View AS3955_8406210.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

ams datasheet page 1 [v1-01] 2015-apr-29 document feedback AS3955 nfc forum compliant dynamic tag AS3955 nfc dynamic tag ic is the ultimate solution to easily add nfc functionality to electronic devices. thanks to a high sensitivity iso14443a frontend an d high integrated resonance capacitor, AS3955 offers standalone nfc passive tag functionality in a small footprint. fast system integration and high speed data transfer are guaranteed by the available spi and i2c interfaces and by the optimized protocols (tunneling mode and extended mode), allowing bidirectional communication between the device microcontroller and an external nfc compliant device or iso14443a reader device (pcd). AS3955 is able to operate fully powered by the rf field, without any external supply. this, combined with an advanced energy harvesting feature, greatly increases battery life time or even allows battery-less designs. AS3955 is used with an appropriate antenna coil connected to the terminals lc1 and lc2, and behaves as a standard passive iso 14443a tag (picc). after the anti-collision protocol stage, based on configuration, AS3955 can operate as a standalone nfc forum type 2 tag or, when tunneling mode is activated, as a bridge between the pcd and the microcontroller, e.g. to emulate a custom or standard iso14443a level 3 or level 4 picc or a nfc forum tag. a configurable wake-up signal notifies the microcontroller on ongoing rf activities, in order to minimize overall power consumption. AS3955 includes an embedded eeprom memory that can be accessed from the pcd through the rf link or from the microcontroller through the spi or i2c interfaces. part or all memory can be protected by a 32-bit password, or permanently locked. AS3955 supports iso 14443a up to level 4 and is designed according to emvco requirements, to enable the emulation of contactless smart cards or nfc forum compliant type 2 or type 4 tags. AS3955 is designed for high reliability, and can operate in a wide power supply range from 1.65v to 5.5v, in a wide temperature range from -40 c to 125 c. eeprom memory reaches automotive grade quality with en durance of 100,000 cycles and data retention of 10 years at 125 c. ordering information and content guide appear at end of datasheet. general description
page 2 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? general description key benefits & features the benefits and features of AS3955, nfc forum compliant dynamic tag are listed below: figure 1: added value of using AS3955 benefits features ? nfc forum compliance for full interoperability ? type 2 tag standalone functionality ? type 4 tag emulation with external mcu ? nfc forum compliance ? iso 14443a compliance up to level 4 ? operating frequency at 13.56 mhz ? bit rate at 106 kbps ? 7-byte uid ? choice of memory size based on application ? 2 kbit eeprom (216 bytes of user data) or ? 4 kbit eeprom (472 bytes of user data) ? allows zero-power standby ? configurable passive wake-up interrupt ? enables long battery life time, or battery-less designs ? energy harvesting to supply up to 5ma @ 4.5v (regulated) ? allows fast antenna prototyping (iso antenna classes 1 to 6) ? 45 pf integrated resonant capacitor ? design flexibility, easy integration. fits requirements for various embedded applications ? 3/4-wire spi slave interface up to 5 mbps ? i2c slave interface up to 1 mbps ? design flexibility, easy integration ? programmable i2c address ? fits supply requirements for various applications, including industrial ? wide interface supply range (1.65v to 5.5v) ? support for multiple applications, and storage of sensitive data ? 32-bit password memory protection ? high performance and robust data communication, allows custom protocols to be implemented ? tunneling and extended modes for mcu communication ? consistent nfc behavior of battery supplied devices in e.g. pairing applications ? silent mode (mcu power status detection), configurable between 1.42v and 3.65v ? possibility to disable rf communication ? configurable chip kill mode ? small outline, compatibility to common inlay and card manufacturing lines, surface-mount assembly ? sawn wafer ? wl-csp package ? 10-pin mlpd 3x3mm package
ams datasheet page 3 [v1-01] 2015-apr-29 document feedback AS3955 ? general description applications AS3955 is suited to a wide range of applications, including ? nfc connection handover (bluetooth?, bluetooth low energy, wi-fi pairing) ? equipment setup, service and configuration ? firmware upgrades ? activity and status logging ? wireless authentication (e.g. access control to buildings and equipment) typical markets: ? emv payment cards ? consumer electronics, wearables and smart clothing ? home appliances ? automotive ? industrial equipment and building automation ? remote sensing ? gaming a typical system diagram is depicted in figure 2 . at the presence of a 13.56 mhz field generated by a nfc device, AS3955 powers up, notifies the microcontroller through a wake-up signal and handles the tag activation sequence. depending on configuration, several operations are then possible: ? AS3955 exchanges with the nfc device ndef data stored in the internal eeprom ? the microcontroller exchanges with the nfc device ndef data stored in external memory ? the microcontroller exchanges data with AS3955. this operation can be performed concurrently with communication over the rf link, or also in absence of rf power, in presence of an external supply. figure 2: typical system diagram AS3955 microcontroller i2c or spi wake-up
page 4 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? general description this built-in flexibility makes it ideal for a number of applications requiring non-vola tile memory to be accessed when the system is not powered, e.g.: ? personalization data is pr ogrammed by the nfc device (even in case spi / i2 c is not powered) an d it is later read by microcontroller through spi / i2c interface ? log data is stored periodically by the microcontroller and can then be read by the nfc device even when the microcontroller is not powered ? a ndef message is regularly modified by the microcontroller (e.g. bluetooth pin code, or wi-fi key, or dynamic url) and it is later read by a nfc device. block diagram the functional blocks of this device for reference are shown below: figure 3: AS3955 block diagram afe nfc forum type 2 tag logic eeprom 2k or 4kbit i2c/spi interface power manager vp_io irq i2c/spi vss vp_reg vp_int vdd lc1 lc2 AS3955
ams datasheet page 5 [v1-01] 2015-apr-29 document feedback AS3955 ? general description AS3955 is composed of nfc-a analog front end (afe), nfc type 2 tag logic, eeprom, spi / i2c interface and power supply manager block (power manager). the afe is connected to an external tag coil which forms, together with integrated resonant capacitor, a lc tank resonating with the external electromagnetic field frequency of 13.56 mhz. the afe has built-in rectifier and regulators. the output of the internal regulator (vp_int) is used to supply the afe and also the logic and eep rom (through power supply manager). a regulator output vp_reg is available on a pin to supply external circuitry by harvesting energy from the rf field. the power manager is controlling the power supply of logic and eeprom. the two blocks can be supplied either from vp_int or from vp_io (spi / i2c power supply) depending on the power mode of the chip. AS3955 offers a power mode where vp_io supply is switched to vp_int whenever the rf field is present. vp_io is typically used when some activity is started over the spi / i2c and the vp_int is too low to be used as a power supply. the logic is responsible for handling the anti-collision sequence, when acting as nfc type 2 tag, and other data transfer. the interface logic contains also a 32-byte buffer for block transmission between nfc device and AS3955. the eeprom is used to store the uid, configuration and control bits, and user data which can be accessed also via the spi / i2c.
page 6 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? pin assignments figure 4: AS3955 pin assignment pin assignments a1 a2 a3 a4 b1 b4 c4 c1 c2 c3 AS3955 wl-csp (top view) vp_io vp_reg lc1 lc2 vss irq miso / sda mosi sclk / scl /ss 1 2 3 4 5 10 9 8 7 6 AS3955 mlpd (top view) gnd vp_io vp_reg lc1 lc2 vss irq miso / sda mosi sclk / scl /ss
ams datasheet page 7 [v1-01] 2015-apr-29 document feedback AS3955 ? pin assignments pin description figure 5: pin description note(s) and/or footnote(s): 1. pin meas is not bonded in mlpd package. it is only used during wafer sort test. 10-pin mlpd 10-pin wl-csp die pin name pin type description na na 1 meas analog i/o analog test pin (1) 1 c4 2 vp_io supply pad positive supply of the interface / ic 2b13vp_reg analog output regulator output 3c34lc1 analog i/o connection to tag coil 4 c2 5 lc2 connection to tag coil 5 c1 6 vss supply pad ground, die substrate potential 6a19 /ss digital input spi enable (active low) / i2c interface enable 7 a3 10 sclk / scl spi / i2c clock 8a211mosi spi data input 9a412miso / sda digital output / tristate spi data output / i2c data line 10 b4 13 irq digital output interrupt request output (active high)
page 8 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? absolute maximum ratings stresses beyond those listed under absolute maximum ratings may cause permanent damage to the device. these are stress ratings only. functional operation of the device at these or any other conditions beyond those indicated under operating conditions is not implied. exposure to absolute maximum rating conditions for extended periods may affect device reliability. figure 6: absolute maximum ratings symbol parameter min max unit comments electrical parameters vdd dc supply voltage -0.5 6.5 v v in input pin voltage except lc1 and lc2 -0.5 6.5 v input pin voltage pins lc1 and lc2 -0.5 6.5 v peak current induced on pins lc1 and lc2 100 ma i scr input current (latch-up immunity) -100 100 ma norm: jedec 78 electrostatic discharge esd hbm electrostatic discharge hbm 2 kv norm: mil 883 e method 3015 (human body model) esd cdm esd C machine and charged device models 500 v temperature ranges and storage conditions t strg storage temperature -55 150 c t body package body temperature 260 c norm: ipc/jedec j-std-020. the reflow peak soldering temperature (body temperature) is specified according ipc/jedec j-std-020 moisture/reflow sensitivity classification for non-hermetic solid state surface mount devices. the lead finish for pb-free leaded packages is matte tin (100% sn). rh nc relative humidity non-condensing 585% msl moisture sensitivity level 3 represents a max. floor life time of 168h absolute maximum ratings
ams datasheet page 9 [v1-01] 2015-apr-29 document feedback AS3955 ? electrical characteristics all limits are guaranteed. the parameters with min and max values are guaranteed with production tests or sqc (statistical quality control) methods. operating conditions all in this specification defi ned tolerances for external components need to be assured over the whole operation conditions range and also over lifetime. figure 7: electrical characteristics dc/ac characteristics for digital inputs and outputs figure 8: cmos inputs note(s) and/or footnote(s): 1. valid for input pins /ss, mosi and sclk symbol parameter min max unit notes i lim limiter current 30 ma v vp_io spi power supply 1.65 5.5 v when logic powered from rf interface v vp_io spi power supply 1.65 5.5 v when logic powered from vp_io t junc junction temperature -40 125 c symbol parameter min typ max unit note v ih high level input voltage 0.7 * vdd_io v v il low level input voltage 0.3 * vdd_io v i leak input leakage current 10 a @125c electrical characteristics
page 10 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? electrical characteristics figure 9: cmos outputs note(s) and/or footnote(s): valid for output pins miso and irq 1. pull down can be enabled while miso output is in tr istate. the activation is cont rolled by register setting. electrical specifications figure 10: electrical specifications note(s) and/or footnote(s): vp_io=1.8v, temperature 25c unless noted otherwise 1. i lc is the current flowing through lc1 and lc2 pins 2. internal supply current measured over vp_io pin, by forcing internal digital supply to 2.0v, and applying 13.56 mhz alternat ive pulses with amplitude 3.0vpp to lc1 and lc2. 3. 1.6v is set in power mode 2 only. 4. see figure 11 . 5. see figure 12 . symbol parameter min typ max unit note voh high level output voltage 0.85 * vdd_io v isource=1ma vp_io = 5v vol low level output voltage 0.15 * vdd_io v ro output resistance 200 400 rpd pull-down resistance pad miso 10 k see note (1) symbol parameter min typ max unit note i sb_spi stand by consumption on vp_io 100 na v lim limiter voltage 5.2 5.5 v i lc =30ma (dc) (1) i s supply current 350 a see note (2) v hf_pon hf_pon threshold (rising vreg) 1.6 2.3 vsee note (3) v por_hy hf_pon hysteresis 0.8 v v mod modulator on voltage drop 1.2 2.6 v i lc =1ma (1) i lc =30ma (1) c res resonance capacitor 45 pf ee en eeprom endurance 100 000 cycles @ 125c (4) ee ret eeprom retention 10 years @ 125c (5)
ams datasheet page 11 [v1-01] 2015-apr-29 document feedback AS3955 ? electrical characteristics figure 11: eeprom endurance over temperature figure 12: eeprom data retention over temperature 0 500,000 1,000,000 1,500,000 2,000,000 2,500,000 -40 -30 -20 -10 0 10 20 30 40 50 60 70 80 90 100 110 120 130 number of cycles temperature [c] endurance eeprom 0 1 10 100 1,000 10,000 25 50 75 100 125 150 data retention [years] temperature [c] data retention eeprom
page 12 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description analog frontend (afe) the afe is connected to external tag coil, which together with the integrated resonant capacitor forms an lc tank resonating at the external electromagnetic field frequency (13.56 mhz). figure 13 depicts the main afe building blocks. figure 13: picc afe block diagram rectifier extracts dc power supply from the ac voltage induced on coil terminals. limiter limits the maximum voltage on coil terminals to protect afe from destruction. at voltages that exceed limiter voltage it starts to absorb current (acts as some sort of shunt regulator). modulator switch is used for communication the nfc tag to a nfc device. when switched on it will draw current from coil terminals. this mechanism is ca lled load modulation. variation of current in the modulator swit ch (on and off state) is seen as modulation by the nfc device. detailed description hf pon rectifier modulator switch limiter demodulator clock extractor lc1 lc2 nfc type 2 tag logic external regulator bias vp_reg internal regulator vp_int vrec
ams datasheet page 13 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description demodulator is used for communication nfc device to nfc tag. it detects am modulation of the nfc device magnetic field. the demodulator is designed to accept modulation according to nfc-a specifications ( [nfc analog] [nfc digital] ). clock extractor extracts a digital clock signal from the pcd carrier field frequency which is used as clock signal by logic blocks. hf_pon enables operation of the afe and the logic when the supply voltage is sufficiently high. a buffer capacitor and hf_pon hysteresis guarantee that there is no reset during nfc device modulation. internal regulator provides regulated voltage vp_int to the afe and in most cases also to eeprom and logic blocks. typical regulated voltage vp_int is 2.0v. a buffer capacitor is also integrated. external regulator provides regulated voltage on external pin vp_reg where it can be used to supply some external circuitry. the regulated voltage and output resistance can be adjusted using eeprom settings. appropriat e external buffer capacitor is needed in case vp_reg is us ed in the application. current which may be provided depends on reader field strength, antenna size and q factor, but it is limited to maximum 5ma. bias provides bias currents and reference voltages to afe analog blocks. power management AS3955 power management compri ses of four different modes to fit requirements of different applications. AS3955 supports two power sources, whose activation depends on the selected power mode. power mode 0 in this power mode, the power manager is controlling the supply of the picc logic, eeprom and spi / i2c interface (vdd). its inputs are vp_int (rectified and regulated supply extracted from rf field) and the vp_io (s upplied by external battery). in standby mode, when AS3955 is not in the rf field (the condition is that rectified supply voltage is below hf_pon threshold) and the spi / i2c is no t active (/ss is high), the vdd supply is disconnected. the only current consumption in this state is leakage on vp_io, mainly due to level shifters and spi / i2c pins. when AS3955 is placed in a rf fi eld, vdd is connected to vp_int. this happens once the vp_int level is above the hf_pon threshold.
page 14 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description vp_io is connected to vdd only when AS3955 is not in the rf field (rectified supply voltage is below hf_pon threshold) and the spi / i2c interface is activated by pulling /ss signal low. the switch to vp_io is controlled by /ss signal. the deactivation is delayed by 0.7ms minimum, so that the switch shall stay closed in case of shorter ti mes between successive spi / i2c activations. the switch is also closed duri ng eeprom writes activated over spi / i2c. at activation of the switch, th e time between the falling edge of the /ss signal and rising edge of sclk shall be at least 300s to allow charging of internal vdd buffer capacitor, expiration of por signal and to perform a complete ic initialization. please note that the only spi / i2c operations, which are allowed in this mode, are read and write of eeprom and registers. if the rf filed is lost during operation and the external system (mcu) is supplied over battery and /ss is low then power manager will automatically connect the vdd to vp_io. to enable low power mode where tag consumes less than 1ua at room temperature following conditions must be met: ? spi interface configured ? all spi interface input lines (inc luding /ss) must be set to high ? all spi output lines must be open figure 14: power manager concept
ams datasheet page 15 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description power mode 1 AS3955 is fully supplied by rf field. AS3955 checks if extended or tunneling mode are enabled. in this case, vp_reg supplies the system (spi / i2c pads, pull-ups, mcu), otherwise energy harvesting is turned off and vp_reg is set in tristate. such power mode can be used in battery-less systems where the system is fully powered by the rf field. in such configuration, the vp_reg output pin for energy harvesting and vp_io input supply shall be externally connected. battery, even when present, will not be involved. if this power mode is enabled and neither tunneling nor extended mode are enabled, rreg value from ic configuration register 1 will be forced to zero. this will disable energy harvesting. power mode 2 in this case, the external supply is used to provide power to digital blocks, eeprom, spi / i2c pads and mcu. external supply vp_reg is not used. since this mode can be enabled only after initialization of the chip, the /ss line must be either permanently set to low or pulled low for short time (400s) to complete the initialization. this mode is specifically designed to operate with as392x products ( ams active boost). in this mode, the hf_pon threshold of the chip will be decreased so that it will operate with external voltage on lc pin in the range of 2.7-3.6vpp. if this mode is enabled, AS3955 will not be turned off as long as there is an external supply present. power mode 3 in this case the external supply shall be used to provide power to digital blocks, eeprom, spi / i2c pads and mcu. external supply vp_reg is not used. since this mode can be enabled only after initialization of the chip , the /ss line must be either permanently set to low or pulled low for short time to complete the initialization. in this mode, the hf_pon threshold of the chip is set so that it will operate with external voltage on lc pin in the range of 4.1-5vpp. if this mode is enabled, AS3955 will not be turned off as long as there is an external power present. interface arbitration concurrent access to AS3955 internal eeprom from rf or spi / i2c requires arbitration, to resolve conflicts or undesired behaviour. AS3955 implements two arbitratio n modes, which can be set in configuration byte ic_cfg0 .
page 16 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description arbitration mode 0 AS3955 arbitrates eeprom write accesses according to first-come-first-serve principle. ? in case no write access is cu rrently ongoing, both rf and spi / i2c interfaces are allowed to write into eeprom. ? in case a write request comes over rf, while spi / i2c is writing, AS3955 will return a nak. ? in case a write request comes over spi / i2c while rf is writing, AS3955 will trigger a i_err_acc interrupt (see figure 92 ). arbitration mode 1 AS3955 gives always priority to rf accesses. in this mode, AS3955 behaves over rf as a pure contactless tag. ? in case spi / i2c is perfor ming a eeprom write while the rf field is turned on, the writ e operation is interrupted to allow the initialization of the rf communication ? in case the rf field is already on and spi / i2c performs a write to eeprom and a read or write command is received via rf, the write operation of spi / i2c is interrupted so that the rf operation can be performed in both cases, a i_err_acc interrupt (see figure 92 ) will be triggered. please note that the interruption of an eeprom write may result in an undefined or weak state for the cell being programmed, and a second successful write attempt is suggested. energy harvesting AS3955 has energy harvesting capability. the regulated voltage output pin for energy harvesting is vp_reg. the energy harvesting is enabled only in power mode 1 and 2. the output voltage and resistance can be set by configuration byte ic_cfg1 .the energy harvesting can be disabled by setting the output resistance register to 0 as shown in figure 15 . figure 15: output resistance settings figure 15 shows settings of the regulated voltage output. the output can be set between 1.8v and 4.5v in 100mv step. rreg<1:0> output resistance comment 00b x disabled C output pin is in tristate 01b 100 10b 50 11b 25
ams datasheet page 17 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description figure 16: regulated voltage output settings silent mode the silent mode enables detection of the power status of a circuit whose supply (vdd) is connected to vp_io pin. if this mode is enabled and the voltage measured on pin vp_io is below the configured threshold value, the rf part of AS3955 will be disabled, and the ic will not be responsive to incoming commands. silent mode settings can be performed by using configuration byte ic_cfg0 . this feature overcomes a potentially inconsistent behavior in a battery powered system, where a passive nfc tag can always communicate with a nfc device, al so in case the battery is not sufficiently charged to supply the rest of the system. a typical example is when the nfc tag is used for bluetooth pairing: AS3955 would trigger a pairing procedure only in case the system is fully operational by monitoring the supply voltage. memory protection AS3955 internal memory can be protected from unauthorized access by enabling password authentication. a 32-bit password can be set to protect the full user memory, or part of it, to allow the creation of a public data and a private data area. password protection can be applied for read and write accesses. password authentication is performed through a standard write command to the authentication password block. a maximum of 7 negative attempts are permitted before the chip is locked. once authenticate d, the user can modify the password. password protection applies to rf communication only. further information on how to handle password authentication can be found in authentication password , configuration byte auth_cfg , configuration byte auth_cnt and configuration byte auth_lim . vreg<4:0> output voltage abs. accuracy 00000b 1.8v 115mv 00001b : : step 100mv 20mv linearly increasing over range 11011b 4.5v 225mv
page 18 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description passive wake-up AS3955 is able to operate nfc tag operations standalone and fully powered by the rf field. the connected mcu can remain is standby/sleep mode as long as its intervention is not required by the application, in order to save power. AS3955 can be configured to notify the mcu through a wake-up interrupt. a number of triggering events can be selected, e.g.: ? power up ? selected state entered ? reception of slp_req command ? nfc device has updated memory content for a complete interrupt source list, please refer to the section interrupt registers . chip kill some applications require that th e rf link is active only under certain conditions, e.g. during device configuration only in a controlled environment like a production facility. AS3955 can be configured by the mcu in order to restrict the nfc device access to the system. by setting the configuration byte chip_kill in eeprom, the mcu can disable access to spi / i2c from the rf link (i.e. tunneling and extended mode are permanently disabled), or even disable rf communication completely. in the latter case, AS3955 will not respond to incoming rf commands. this configuration can be modi fied only by the mcu through spi / i2c interfaces.
ams datasheet page 19 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description nfc tag functionality communication principle AS3955 autonomously executes complete nfc-a anti-collision communication sequence, during which the 7-byte uid is used ( [nfc analog] [nfc digital] ). after anti-collision, the nfc tag is brought into selected state where read and write commands can be processed. the nfc tag will accept only read and write command issued to the address space actually available in AS3955 eeprom. any attempt to access an address outside the internal memory address space will be rejected. this default behavior of the nfc tag can be modified by enabling tunneling or extended mode. a simplified AS3955 state diagram is shown in figure 17 . figure 17: AS3955 state diagram power off (rf field off) sense sleep authenticated reset all_req sens_req all_req write authentication password read (16 bytes) write (4 bytes) get version resolution anti-collision sel_req slp_req slp_req selected read (16 bytes) write (4 bytes) get version
page 20 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description sense state after a power-on reset (por), AS3955 switches to the sense state. this state is exited wh en a sens_req or an all_req command is received from the nfc device. any other data received while in this state is in terpreted as an error and AS3955 remains in sense state. when in selected or authenticated state, a correctly executed slp_req command will modify the default waiting state from sense to sleep state. sleep state can be exited when an all_req command is received. sleep state together with sense state, sleep state is the other waiting state for AS3955. sleep state can be entered upon reception of a slp_req command. the distinct ion between sense and sleep state is made necessary to discriminate selected and not yet selected tags. AS3955 can only exit this state upon reception of an all_req command. any other command received in this state is interpreted as an error and AS3955 state remains unchanged. resolution state in resolution state, the nfc device is resolving the tag uid. since AS3955 has a double size uid, the resolution state actually comprises of two sub-st ates, where the anti-collision procedure is carried out in cascade level 1 and 2. please refer to [ iso18092 ] for further information. selected state all memory operations are operated in selected state. upon reception of a slp_req command, selected state is exited and AS3955 transits to sleep state. any other command received when the device is in this state is interpreted as an error. depending on its previous state, AS3955 returns to either sense or sleep state. upon reception of a sector se lect command, AS3955 returns a nak and transits to sense or sleep state, depending on its previous state. AS3955 transits to the authen ticated state after successful password verification, using a standard write command to a dedicated memory address (see authentication password ). the number of permitted failed auth entications is set to 7, after which AS3955 transits to locked sub-state (not shown in the picture). when locked state is entered, only the mcu can bring AS3955 back to sense state by resetting the authentication counter ( configuration byte auth_cnt ) back to 0 and issue a set default , or go to sense, or go to sleep command. when in locked sub-state, all memory operations are only allowed in the memory area not password protected, as defined by the configuration byte configuration byte auth_lim .
ams datasheet page 21 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description upon reception of a slp_req command, selected state is exited and AS3955 transits to sleep state. any other command received when the device is in this state is interpreted as an error and, depending on its previous state, AS3955 returns to either sense or sleep state. authenticated state in this state, all operations on memory blocks, which are configured as password verification protected, can be performed. upon reception of a sector se lect command, AS3955 returns a nak and transits to sense or sleep state, depending on its previous state. iupon reception of a slp_req command, authenticated state is exited and AS3955 transits to sleep state. any other command received when the device is in this state is interpreted as an error and, depending on its previous state, AS3955 returns to either sense state or sleep state. nfc forum type 2 tag support nfc forum nfc-a commands all_req, sens_req, sdd_req, sel_req, slp_req are required for anti-collision. commands read and write are used for internal memory access. if nfc device issues a sector select command, AS3955 shall always reply with nak. figure 18: nfc-a vs iso14443 terminology nfc-a term iso14443 term states sense idle sleep halt resolution ready selected active commands / responses sens_req reqa all_req wupa sens_res atqa ssd_req ac sel_req select slp_req hlta
page 22 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description uid coding anti-collision procedure is based on the unique identification number (uid). AS3955 supports double size uid (7 bytes). first three bytes of the uid are hardwired inputs to the picc logic (uid<23:0>). the last 4 bytes of the uid are stored in eeprom uid block. first uid byte (uid0) the first byte of uid is manufacturer id according to [iso7816-6] . it is coded on bits uid<7:0> . ams ic manufacturer id is 3fh. second uid byte (uid1) the second byte of uid (uid<15:8>) is reserved for ams chip type (ic type). every ams rfid tag ic has its own chip type assigned. AS3955 ic type is 14h. third uid byte (uid2) the third byte of uid (uid<23:16>) is set to 00h. figure 19: coding of first three uid bytes last four uid bytes (uid3-uid6) the last 4 bytes of uid are read from eeprom (uid block) and pre-programmed during ic production. those 4 bytes are unique, and cannot be modified. figure 20: last four uid bytes uid byte value (hex) uid0 3f uid1 14 uid2 00 uid byte uid block bits uid3 b7-b0 uid4 b15-b8 uid5 b23-b16 uid6 b31-b24
ams datasheet page 23 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description coding of sens_res, sel_req, ack and nack several bits in certain responses are defined as dont-care in the nfc-a standard [ nfc digital ], some others are defined by optional choices in standard protocol. this chapter defines how these bits are actually set in AS3955. sens_res response sens_res is a response on all_req and sens_req commands. the sens_res is defined by configuration bytes sensr1 and sensr2 stored in eeprom. figure 21: coding of sens_res response sel_res response, cascade level 1 and 2 sel_res is the response to sel_req command. since AS3955 uid is double sized, sel_res responses for cascade level 1 and cascade level 2 are defined. sel_res on cascade level 1 and 2 is defined with configuration byte selr except for cascade bit 3. the response on cascade level 2 is also configured by selr_b6_inv bit which, when set, inve rts cascade bit 6 in sel_res response on cascade level 2 (see ic_cfg2 ). figure 22: sel_res cl1 coding figure 23: sel_res cl2 coding note(s) and/or footnote(s): 1. according to [iso14443-3] , all bits except b3 are dont care for cascade level 1, and all bits except b6 and b3 are dont care for cascade level 2. bit b6 in cl2 indicates whether the tag is compliant to [iso14443] or not (resp. b6=1 and b6=0). in case of applications requiring emvco compliance, bit b6 in cascade level 1 shall be set as bit b6 in cascade level 2 ( [emvco-1] ). b15 b14 b13 b12 b11 b10 b9 b8 b7 b6 b5 b4 b3 b2 b1 b0 sensr2 sensr1 b8 msb b7 b6 b5 b4 b3 b2 b1 lsb description sel_res<7:3> 1 sel_res<1:0> casca de bit set: uid not complete b8 msb b7 b6 b5 b4 b3 b2 b1 lsb description sel_res<7:6> sel_res<5> sel_res<4:3> 0 sel_res<1:0> selr_b6_inv set to 0 not sel_res<5> selr_b6_inv set to 1
page 24 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description ack response the ack response of AS3955 is a 4-bit value ah. nack response the AS3955 uses all four combinations of nak values. the usage of various nak values is explained in section error handling . access to uid, sens_res and sel_req during anti-collision uid block , sensr1 , sensr2 and selr bytes are stored in a buffer. the purpose of storing these data into the buffer is faster access to the data and uid verification during the anti-collision procedure. buffer access over sp i / i2c is locked until nfc tag enters selected state. get version command in addition to standard nfc tag commands, AS3955 supports a custom get version command. this command consists of 8 bits and shall be transmitted only in standalone and extended mode when the tag is selected state. the command code and the tag response are shown resp. in figure 24 and figure 25 . figure 24: coding of get version command b8 b7 b6 b5 b4 b3 b2 b1 01100000
ams datasheet page 25 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description figure 25: response to get version command note(s) and/or footnote(s):notes : 1. the most significant 7 bits of the storage size byte are interpreted as an unsigned integer value n . as a result, it codes the total available user memory size as 2 n . if the least significant bit is 0b, the user memory size is exactly 2 n . if the least significant bit is 1b, the user memory size is between 2 n and 2 n+1 . the user memory is the memory available for user da ta (capability container and lock bits are excluded) 2. the figure below is maintained consistently across the whole as395x family, where get version command is supported. figure 26: get version response, byte 7 byte no. description comment 0 fixed header 00h 1 vendor id 3fh ams ag 2product type 14h as395x 3 product subtype 01h AS3955 4 major product version 01h 1 5 minor product version 00h v0 6 storage size 15h 17h see note (1) 7 supported features 01h or 02h see note (2) get version byte no. 7 description b7 00000b: iso14443a level 3 supported, max baudrate 106 kbps, tunneling and extended mode present, password protection available, energy harvesting available others: rfu b6 b5 b4 b3 b2 000b: no wired interface available 001b: spi slave, passive wake-up available 010b: i2c slave, passive wake-up available b1 b0
page 26 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description memory organization AS3955 contains an embedded eeprom module which can be accessed via rf or spi / i2c interface. eeprom contains 4096 bits (512 bytes) organized in 128 blocks of 4 bytes each. blocks in eeprom are numbered from 00h to 7fh. bits in a block are numbered from 0 to 31. m o s t o f t h e e e p r o m i s n f c ty p e 2 ta g u s e r d a t a a r e a ( 4 7 2 b y t e s ) . the position of the dynamic lock bits is fixed at the end of nfc type 2 tag user data area (blocks 7ah and 7bh). the configuration bits which define AS3955 operating options are stored in blocks 01h, 7ch, 7dh, 7eh, 7fh. housekeeping information is stored in block 00h. 4kbit eeprom organization is shown in figure 27 . AS3955 is also available in 2kbit version. in this case the data area is reduced to 216 byte. AS3955 internal user memory implements static and dynamic lock bits according to nfc forum type 2 tag standard. configuration and lock bits, as well as the full 2kbit eeprom organization, are shown in figure 28 . 4kbit eeprom organization numbers of dynamic lock bits: ? data area size in bytes: 4*(127 C 3) C 7 C 17 = 472 bytes ? number of dynamic lock bits: (472 C 48) / 8 = 53 bits (53 bits)
ams datasheet page 27 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description figure 27: 4kbit eeprom organization note(s) and/or footnote(s): 1. bits that are not used should be set to 0. access properties: ro: read only, writing to this word is not possible rw: reading and writing to this word is possible otp: one time programmable. a bit of this word once set to 1 cannot be set back to 0. byte number in block block 0 1 2 3 description access 00h uid0 uid1 uid2 uid3 uid / internal ro 01h fab_cfg0 fab_cfg1 fab_cfg2 fab_cfg3 fabrication data ro 02h internal 8 internal 9 lock 0 lock 1 internal / lock otp 03h cc 0 cc 1 cc 2 cc 3 cc otp 04h data 0 data 1 data 2 data 3 data rw 05h data 4 data 5 data 6 data 7 data rw 06h data 8 data 9 data 10 data 11 data rw 07h : : 79h data rw 7ah lock 2 lock 3 lock 4 lock 5 lock otp 7bh lock 6 lock 7 lock 8 (1) reserved 0 lock / reserved otp 7ch rfp0 rfp1 rfp2 rfp3 authentication password rw 7dh chip_kill auth_cnt auth_lim auth_cfg authentication settings rw 7eh sensr1 sensr2 selr ic_cfg0 config. block 0 rw 7fh ic_cfg1 ic_cfg2 mirq_0 mirq_1 config. block 1 rw
page 28 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description 2kbit eeprom organization numbers of dynamic lock bits: ? data area size in bytes: 4*(63 C 3) C 3 C 21 = 216 bytes ? number of dynamic lock bits: (200 C 48) / 8 = 21 bits (21 bits) figure 28: 2kbit eeprom organization note(s) and/or footnote(s): 1. bits that are not used should be set to 0. access properties: ro: read only, writing to this word is not possible rw: reading and writing to this word is possible otp: one time programmable. a bit of this word once set to 1 cannot be set back to 0. byte number in block block 0 1 2 3 description access byte number in block block 0 1 2 3 description access 00h uid0 uid1 uid2 uid3 uid / internal ro 01h fab_cfg0 fab_cfg1 fab_cfg2 fab_cfg3 fabrication data ro 02h internal 8 internal 9 lock 0 lock 1 internal / lock otp 03h cc 0 cc 1 cc 2 cc 3 cc otp 04h data 0 data 1 data 2 data 3 data rw 05h data 4 data 5 data 6 data 7 data rw 06h data 8 data 9 data 10 data 11 data rw 07h : : 39h data rw 3ah lock 2 lock 3 lock 4 lock 5 lock otp 3bh lock 6 lock 7 lock 8 (1) reserved 0 lock / reserved otp 3ch rfp0 rfp1 rfp2 rfp3 authentication password rw 3dh chip_kill auth_cnt auth_lim auth_cfg authentication settings rw 3eh sensr1 sensr2 selr ic_cfg0 config. block 0 rw 3fh ic_cfg1 ic_cfg2 mirq_0 mirq_1 config. block 1 rw
ams datasheet page 29 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description uid bytes the uid block contains four lsb bytes of the 7-byte uid which is used during anti-collision and selection process. every ic is programmed by a unique number during fabrication process at ams . see uid coding about details on uid. this block stores some ic manufacturer data which is programmed and locked during fabrication process at ams . uid is treated as ic internal co nfiguration, and is permanently locked during ic production. fabrication data fabrication data are used to set internal configuration and trimming values. they are treate d as ic internal configuration. fabrication data fab_cfg0 figure 29: fabrication data fab_cfg0 note(s) and/or footnote(s): 1. this byte can be set only during production. conf. bit name default function note b7 0 internal configuration b6 0 b5 0 b4 0 b3 0 b2 0 b1 0 b0 0
page 30 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description fabrication data fab_cfg1 figure 30: fabrication data fab_cfg1 note(s) and/or footnote(s): 1. this byte can be set only during production. the fdel bits define frame delay time (fdt) adjustment and represent a time compensation in number of clocks of carrier frequency. the osct bits are trimming bits for the internal oscillator. fabrication data fab_cfg2 figure 31: fabrication data fab_cfg2 note(s) and/or footnote(s): 1. this byte can be set only during production. conf. bit name default function note b7 fdel<3> 0 pcd to picc frame delay time compensation; frame compensation defined as fdel*1/fc b6 fdel<2> 0 b5 fdel<1> 0 b4 fdel<0> 0 b3 osct<1> 0 oscillator trimming bits b2 osct<0> 0 b1 decc<1> 0 decoder compensation register b0 decc<0> 0 conf. bit name default function note b7 test_mode 0 b6 mod_r 0 1: decreased modu lator switch resistance b5 miso_pd2 0 1: pull down on miso, when \ss is low and miso is not driven by the AS3955 b4 miso_pd1 0 1: pull down on miso when \ss is high b3 rfu 0 b2 rfu 0 b1 rfu 0 b0 rfu 0
ams datasheet page 31 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description fabrication data fab_cfg3 figure 32: fabrication data fab_cfg3 note(s) and/or footnote(s): 1. this byte can be set only during production. reserved bytes the reserved bytes belong to reserved memory areas. otp blocks write and read lock blocks are otp (one time programmable). this means that once they are se t to 1, they cannot be set back to 0. since setting otp bits is an irreversible operation, it is strongly recommended to perform this operation in controlled environment. lock bits the bits of byte 2 and 3 of block 02h represent the field-programmable read-only locking mechanism called static lock bytes. they are called static because their position in memory is fixed. when data memory is larger than 16 blocks (64 bytes), also dynamic lock bytes are required. they are located starting at address 7ah (4kbit version) and address 3ah (2kbit version). block lock granularity is 1 block per bit for the first 16 blocks, 2 blocks per bit for the remaining blocks. lock bits are otp, i.e. setting bits to 1b is an irreversible o p e r a t i o n . b i t s a t 0 b c a n b e s e t t o 1 b t h r o u g h a w r i t e o p e r a t i o n , the result being a bit-wise or with the current value. conf. bit name default function note b7 uid_crc<7> crc value calculated on uid b6 uid_crc<6> b5 uid_crc<5> b4 uid_crc<4> b3 uid_crc<3> b2 uid_crc<2> b1 uid_crc<1> b0 uid_crc<0>
page 32 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description lock bits apply only to rf interface, as spi / i2c interface has unlimited access to user data area. ? lock 0 byte locks 8 blocks st arting from address 00h where lock bit 0 locks block on address 00h ? lock 1 byte locks 8 blocks st arting from address 08h where lock bit 0 locks block on address 08h ? lock 2 byte locks 16 blocks starting from address 10h where lock bit 0 locks block on address 10h and 11h ? lock 3 byte locks 16 blocks starting from address 20h where lock bit 0 locks block on address 20h and 21h ? lock 4 byte locks 16 blocks starting from address 30h where lock bit 0 locks block on address 30h and 31h ? lock 5 byte locks 16 blocks starting from address 40h where lock bit 0 locks block on address 40h and 41h ? lock 6 byte locks 16 blocks starting from address 50h where lock bit 0 locks block on address 50h and 51h ? lock 7 byte locks 16 blocks starting from address 60h where lock bit 0 locks block on address 60h and 61h ? lock 8 byte locks 16 blocks starting from address 70h where lock bit 0 locks block on address 70h and 71h figure 33: example of lock bits capability container block 03h in AS3955 eeprom contains the capability container (cc), pre-programmed during ic production according to nfc forum type 2 tag specifications [t2t] . cc bits are otp, i.e. setting bits to 1b is an irreversible operation. bits at 0b can be set to 1b through a write operation, the result being a bit-wise or with the current value. figure 34 and figure 35 show the capability container content at delivery. figure 34: cc content at delivery (4kbit option) lock 0 byte lock 1 byte b7 b6 b5 b4 b3 b2 b1 b0 b7 b6 b5 b4 b3 b2 b1 b0 locks block locks block 07h 06h 05h 04h 03h 02h 01h 00h 0fh 0eh 0dh 0ch 0bh 0ah 09h 08h byte number in block block address 0 1 2 3 03h e1h 10h 3bh 00h
ams datasheet page 33 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description figure 35: cc content at delivery (2kbit option) configuration bytes the configuration bytes are used to define AS3955 operating options. AS3955 is delivered by ams with default settings. authentication password the authentication password block (bytes rfp0, rfp1, rfp2, and rfp3) contains the 32-bit password. this password is used for authentication over rf side. the nfc tag is set into authenticated state when a writ e command is issued via the rf to write password address with the data that has same content as the data stored in au thentication password block. if the nfc tries to authenticate with a wrong password, AS3955 shall not respond and returns into sense / sleep state and the value of the auth_cnt is decreased. the password can be overwritten via rf only in authenticated state and can always be set via spi / i2c. configuration register auth_cfg defines access rights controlled by the password. the rf password cant be read via rf. the authentication for read or write is required only to the memory portion defined by auth_lim . the chip is no longer in authenticated state when the tag leaves selected state. an attempt to read the password block will return zeroes. the authentication does not override permissions set by the lock bits. authentication also does not restrict access over spi / i2c in any way. authentication can be configured using configuration bits in auth_cfg and auth_lim bytes. byte number in block block address 0 1 2 3 03h e1h 10h 1bh 00h
page 34 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description configuration byte chip_kill figure 36: configuration byte chip_kill note(s) and/or footnote(s): 1. this byte can always be acce ssed for read and write via the spi / i2c and cant be accessed for read and write from the rf s ide. by setting chip_kill byte the rf communication part of the chip or tunneling and extended mode will be disabled permanently. at its initial state, the chip_kill byte is set to value 00h. the value of this byte can be changed via spi / i2c. if bit b6 is set to value 1, the rf pa rt of the chip shall be disabled and AS3955 will not respond to any command received from a nfc device. by setting bit b7 to 1, tunneling and extended mode will be disabled. conf. bit name default function note b7 chip_kill_2 0 1: tunneling and extended mode are disabled b6 chip_kill_1 0 1: rf communication part is disabled b5 rfu 0 b4 rfu 0 b3 rfu 0 b2 rfu 0 b1 rfu 0 b0 rfu 0
ams datasheet page 35 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description configuration byte auth_cnt figure 37: configuration byte auth_cnt note(s) and/or footnote(s): 1. this byte can always be acce ssed for read and write via the spi / i2c and cant be accessed for read and write from the rf s ide. this byte indicates the number of allowed unsuccessful authentication attempts over rf available before disabling the chip. the byte consists of two separate counters where the second counter is a copy of the first counter. these counters are updated at each failed authentication. at each successful authentication, counters are reset to 7 and, at each unsuccessful authentication attempt, counters are decreased by one. if the value of the counters reaches 0, the chip will be permanently locked and cannot be authenticated any longer over the rf field. the chip will also be locked in case the two counter values dont match. the lock can always be cleared via spi / i2c interface. conf. bit name default function note b7 rfu 0 b6 auth_cnt2<2> 1 authentication counter 2 b5 auth_cnt2<1> 1 b4 auth_cnt2<0> 1 b3 rfu 0 b2 auth_cnt1<2> 1 authentication counter 1 b1 auth_cnt1<1> 1 b0 auth_cnt1<0> 1
page 36 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description configuration byte auth_lim figure 38: configuration byte auth_lim note(s) and/or footnote(s): 1. this byte can always be accessed for read and write via spi / i2c and can be accessed for read and write from the rf side if chip is in authenticated state and configuration bit auth_set is 1. auth_lim defines the block address above which password verification is required. valid address range for the auth_lim byte is from 00h to ffh. if auth_lim is set to a block address higher than the last block of the eeprom address space, the password protection is effectiv ely disabled. addresses above the limit are protected for read / write depending on auth_r and auth_w values. if no bits are set, password protection is disabled. if the nfc device tries to access protected blocks without authenticating first, then: ? if only protected blocks are accessed, AS3955 will not respond ? if protected and unprotec ted blocks are accessed 1 , AS3955 will return actual stored values only for the unprotected portion, and zeroes for the protected portion. conf. bit name default function note b7 auth_lim<7> 1 auth_lim defines the block address above which password verification is required. b6 auth_lim<6> 1 b5 auth_lim<5> 1 b4 auth_lim<4> 1 b3 auth_lim<3> 1 b2 auth_lim<2> 1 b1 auth_lim<1> 1 b0 auth_lim<0> 1 1. this can occur, for instance, with a read command crossing the border be tween protected and unprotected memory.
ams datasheet page 37 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description configuration byte auth_cfg figure 39: configuration byte auth_cfg note(s) and/or footnote(s): 1. this byte can always be accessed for read and write via spi / i2c and can be accessed for read and write from the rf side if chip is in authenticated state and configuration bit auth_set is 1. bits auth_w and auth_r define for which operations the authentication is needed. if a lock bit is set for a certain block, then write cannot be performed even if ic is in authenticated state. this means that lock bits overrule authentication. configuration byte sensr1 figure 40: configuration byte sensr1 note(s) and/or footnote(s): 1. this byte can always be acce ssed for read and write via spi / i2c and can be accessed for read and write from the rf side if rfcfg_en is set to 1. conf. bit name default function note b7 rfu 0 b6 rfu 0 b5 rfu 0 b4 rfu 0 b3 rfu 0 b2 rfu 0 b1 auth_w<1> 0 authentication is required for writing b0 auth_r<0> 0 authentication is required for reading conf. bit name default function note b7 sens_res<15> 0 sens_res response byte 2 on sens_req b6 sens_res<14> 0 b5 sens_res<13> 0 b4 sens_res<12> 0 b3 sens_res<11> 0 b2 sens_res<10> 0 b1 sens_res<9> 0 b0 sens_res<8> 0
page 38 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description configuration byte sensr2 figure 41: configuration byte sensr2 note(s) and/or footnote(s): 1. this byte can always be acce ssed for read and write via spi / i2c and can be accessed for read and write from the rf side if rfcfg_en is set to 1. configuration byte selr figure 42: configuration byte selr note(s) and/or footnote(s): 1. this byte can always be acce ssed for read and write via spi / i2c and can be accessed for read and write from the rf side if rfcfg_en is set to 1. conf. bit name default function note b7 sens_res<7> 0 sens_res response byte 1 on sens_req b6 sens_res<6> 1 b5 sens_res<5> 0 b4 sens_res<4> 0 b3 sens_res<3> 0 b2 sens_res<2> 1 b1 sens_res<1> 0 b0 sens_res<0> 0 conf. bit name default function note b7 sel_res<7> 0 sel_res response on cascade level 1/2 b6 sel_res<6> 0 b5 sel_res<5> 0 b4 sel_res<4> 0 b3 sel_res<3> 0 b2 sel_res<2> 0 this bit is not used, as cascade bit 3 in sel_res cl1 is fixed to 1, and to 0 in sel_res cl2 b1 sel_res<1> 0 b0 sel_res<0> 0
ams datasheet page 39 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description configuration byte ic_cfg0 figure 43: configuration byte ic_cfg0 note(s) and/or footnote(s): 1. this byte can always be acce ssed for read and write via spi / i2c and can be accessed for read and write from the rf side if rfcfg_en is set to 1. bit arbit_mod can be modified after initialization over spi / i2c. bit slnt_mod enables silent mode. in this mode, the supply pin vp_io is being observed. if voltage is below the level defined in slnt_vl<2:0>, then silent mode is activated. this means that rf part of the ic is turned off and stops being responsive to incoming rf commands. voltage threshold settings on vp_io are shown in figure 44 . figure 44: silent mode threshold voltage levels conf. bit name default function note b7 slnt_mod 0 1: enable silent mode b6 slnt_vl<2> 0 silent mode voltage level (see silent mode ) b5 slnt_vl<1> 0 b4 slnt_vl<0> 0 b3 arbit_mod 0 1: rf has priority access to eeprom over spi / i2c b2 i2c_addr3<2> 0 i2c slave address b1 i2c_addr2<1> 0 b0 i2c_addr1<0> 0 slnt_vl<2:0> voltage threshold abs. accuracy 000b 1.42v 15mv 001b 1.62v linearly increasing over range 010b 1.82v 011b 2.23v 100b 2.53v 101b 2.74v 110b 3.04v 111b 3.65v 25mv
page 40 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description the voltage level of the supply on vp_io is measured when tag enters rf field. the selected voltage level threshold can be properly measured only if the rf field is strong enough to provide sufficient supply voltage level. when small antennas are used, it is advisable to set lower threshold. bit arbit_mod defines arbitration mode during mutual eeprom access via spi / i2c and rf side. if arbit_mod is set to 0, then the eeprom access follows the first-come-first-serve principle. if arbit_mod is set to 1, then the rf part will always have higher priority over spi / i2c. for further details, please refer to section interface arbitration . the i2c_addr bits represent lower three bits of the i2c address. the upper four bits of the i2c address that represent a group shall be se t to 1010b. configuration byte ic_cfg1 figure 45: configuration byte ic_cfg1 note(s) and/or footnote(s): 1. this byte can always be acce ssed for read and write via spi / i2c and can be accessed for read and write from the rf side if rfcfg_en is set to 1. if bit en_rx_crc is set to 1 then the crc shall be part of the message in the buffer. this implies that maximum message effective length is reduced to 30 bytes. crc check is performed regardless of the value of the en_rx_crc bit. conf. bit name default function note b7 en_rx_crc 0 1: crc stored in th e buffer in the tunneling mode b6 vreg<4> 0 voltage level for voltage regulator vp_reg (see figure 16 ) b5 vreg<3> 0 b4 vreg<2> 0 b3 vreg<1> 0 b2 vreg<0> 0 b1 rreg<1> 0 output resistance value for voltage regulator vp_reg (see figure 15 ) b0 rreg<0> 0
ams datasheet page 41 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description configuration byte ic_cfg2 figure 46: configuration byte ic_cfg2 note(s) and/or footnote(s): 1. this byte can always be acce ssed for read and write via spi / i2c and can be accessed for read and write from the rf side if rfcfg_en is set to 1. bits tun_mod and ext_mod represents a default value stored in a volatile memory which can be modified after initialization over spi / i2c. bit rfcfg_en enables the personalization process during production at customer facilities. when this bit is set to 0, the modification of the last two blocks is not possible anymore over the rf field. if auth_set is set then changing of authenticated setting (authentication limits, read/write permission) is enabled over the rf after successful authentication. password can always be changed via the rf side if tag is in authenticated state regardless of the value of read/write bits. bit nak_on_crc_parity configures error handling mechanism as described in error handling . bit selr_b6_inv configures sel_res response on cascade level 2. if selr_b6_inv is set to 1, bit b6 in sel_res response on cascade level 2 will be inverted, otherwise it will be set as configured in selr byte. bits powm<1:0> are setting power modes as defined in power management . conf. bit name default function note b7 rfcfg_en 1 1: enables personaliz ation / configuration over rf b6 tun_mod 0 1: enables tunneling mode b5 ext_mod 0 1: enables extended mode b4 nak_on_crc_parity 0 1: defines error handling and response b3 auth_set 0 1: configuration of the authentication settings is enabled from rf side b2 selr_b6_inv 0 1: inverts bit 6 in sel_res response on cascade level 2 b1 powm<1> 0 00: power mode 0 01: power mode 1 10: power mode 2 11: power mode 3 b0 powm<0> 0
page 42 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description configuration bytes mirq_0 and mirq_1 these two bytes define the default value of the volatile memory for mask interrupt register 0 and mask interrupt register 1 registers. these bytes can always be accessed for read and write via the spi / i2c and can be acce ssed for read and write from the rf side if rfcfg_en is set to 1. AS3955 communication modes AS3955 supports three different modes. the basic communication mode is a standalone mode where AS3955 can behave as a standalone nfc ta g without mcu intervention. the other two modes (tunneling and extended mode) represent modification of the communication in selected state. the anti-collision process is the same for all three modes. it is possible to change the mode of operation at any time. in case tunneling and extended mode are both enabled, tunneling mode has priority over extended mode. standalone nfc type 2 tag mode if neither of the two modes are enabled (tunneling and extended mode) in ic configuration register 2 , the tag is in standalone mode. in this mo de, all rf incoming commands address the internal eeprom. in th is mode, it is always possible to connect the mcu since all other functionalities of AS3955 are not limited by the communication modes. the main purpose of this mode is to use the AS3955 as a standalone chip or a chip in combination with mcu where the mcu is used for managing AS3955 configuration and memory content. tunneling mode tunneling mode enables transp arent data transfer between nfc device and mcu. in this mo de, the internal eeprom cannot be accessed via rf and any type of data received will be forwarded to mcu when the tag is in selected state. an error during the reception will trigge r a corresponding interrupt. in this mode the mcu shal l take care for the correct response. for this purpose, the mcu may issue an ack or a different type nak response using implemented commands. by enabling this mode, the mcu can emulate nfc type 2 tags, nfc type 4 tags, iso14443a level 3 cards, iso14443a level 4 cards, and also implement higher level protocols such as [phdc] . tunneling mode can be configured by setting configuration byte ic_cfg2 in eeprom or the corresponding register ( ic configuration register 2 ). this mode also allows access to the internal eeprom via the spi / i2c during rf communication.
ams datasheet page 43 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description the basic assumption of tunneling mode is that mcu is responsible for generating the response and that AS3955 takes care of the response synchronization over rf. for this reason, AS3955 has a possibility to tran smit ack and nack by issuing a direct command (see section direct commands ). the mcu can also transmit data by writing the data into the buffer and issuing a transmit command. the implem entation of tunneling mode also requires the handling of the slp_req command since all the received data in selected st ate are stored in the buffer and will not be processed by AS3955. this also implies that mcu has to take care of correct transition of the tag into sleep or sense state by using one of the three available commands go to sleep , go to sense and go to sense / sleep . data transaction in tunneling mode figure 47 shows an example of how communication in tunneling mode should be implemented. figure 47: read first, then acknowledge ack and nack responses can be replaced by data, in case of an incoming read command. relevant registers, interrupts and commands registers : ? buffer status register 1 and buffer status register 2 (data length and error type) pcd AS3955 d a t a r x a c k / n a c k mcu d a t a r d o u t c m d a c k / n a c k da ta tx rx start rx end, crc or parity error, buffer error tx end
page 44 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description interrupts : ? rx start ( i_rxs bit in interrupt register 1 ) ? rx end, tx end (resp. i_rxe and i_txe bits in interrupt register 0 ) ? crc, parity and fram ing interrupt (resp. i_crc_err, i_par_err and i_frm_err bits in interrupt register 1 ) ? buffer error ( i_bf_err in interrupt register 1 ) ? spi / i2c buffer access error ( i_acc_err in interrupt register 1 ) commands : ? transmit ack ? transmit nack 0-5 ? transmit buffer ? go to sense ? go to sleep ? go to sense / sleep extended mode extended mode enables communication between the nfc device and mcu by employing standard nfc tag 2 type read and write commands. the purpose of this communication mode is to provide a simple da ta transfer mechanism between a nfc device and a mcu while guaranteeing correct timing and synchronization. this is achiev ed by implementing a robust handshake mechanism. this mode uses a part of the me mory address space that is out of range of the internal physical memory. the communication between a nfc device and a mcu can be performed by using write/read commands on addre ss fch C ffh, independently of the eeprom configuration size . data with crc or any other error will not be forwarded to the mcu. in case of successful reception of data, AS3955 will automatically reply with ack. error handling in extended mode is defined in error handling . data received from rf side are kept available until the mcu reads the data. the implemented asynchronous transmission protocol arbitrates on overlapping memory accesses (producer-consumer principle) and complies with timing constraints of both rf and spi / i2c protocols regardless of the mcu performance. extended mode can be configured by setting configuration byte ic_cfg2 in eeprom or the corresponding register ( ic configuration register 2 ).
ams datasheet page 45 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description extended mode uses an address space above the address space of the internal eeprom. it is then possible for a nfc device to perform accesses to AS3955 intern al memory and data transfer to/from the mcu, without switching modes. this feature allows the nfc device e.g. to request to the mcu a switch to tunneling mode with a simple write command. the extended mode communication employs a built-in buffer for communication. access to buffer from rf and spi / i2c is mutually exclusive. AS3955 ensures that buffer content shall be kept as long as the AS3955 is powered (even in case rf field is not present) and as long the tag is in selected state. in case the rf field is switched off and th en on again, the buffer content will be reset. nfc device to mcu data flow protocol for the data transmission from nfc device to the mcu employing the extended mode, a nfc write shall be used. each data transfer from nfc device is comprised of four write commands starting from addre ss fch and ending at address ffh. the protocol implemented on a nfc device is expected to always start the data transmission at address fch, which signals the beginning of the communication, and end at address ffh. figure 48 depicts regular implementation of the extended mode using the write commands. figure 48: address space employed for communication time fch fdh feh ffh 00h 11h 22h 33h 44h 55h 66h 77h 88h 99h aah bbh cch ddh eeh ffh address space used for communication in extended mode ... ... write fch,00112233h ack, rf_busy = 1, irq rx start = 1 write fdh,44556677h ack, rf_data_rdy = 1, irq rx end = 1 write feh,8899aabbh write hff,ccddeeffh ack ack
page 46 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description assuming that the internal buffer is empty, the nfc device may start with data transmission by sending a write command on address fch. when the first block is written, the rf_busy flag is set and rx start interrupt is triggered. at this point, the buffer cannot be accessed over spi / i2c until the entire write message is received which is assumed to be complete when nfc device sends a write command to block ff h. at this point, an rx end interrupt is triggered. this implies that a minimum two messages must be received from a nfc device in order to successfully complete a message. if a write command is received on address ffh before a write command to address fch, AS3955 will assume that an error has occurred and will respond as described in error handling . when the reader writes into the last block ffh, rf_data_rdy flag is set and the reader cannot chan ge the buffer content until the mcu reads the content of the block and clears the rf_data_rdy flag. any additional reception of write commands from nfc device, prior to mcu reading out the buffer content, shall result in a response as defined in error handling . the blocks from internal memory address space are directly mapped into buffer space as shown on figure 49 . figure 49: mapping of data received into buffer when mcu reads out the data from the buffer, data will be sent to mcu in the same order as they were stored in the buffer starting from address 00h. when mcu has read all buffer content, it shall issue a clear buffer command to clear the flag rf_data_rdy . at this point, a new data message can be received. 00h 04h 08h 0ch 00h 11h 22h 33h 44h 55h 66h 77h 88h 99h aah bbh cch ddh eeh ffh buffer address space fch fdh feh ffh 00h 11h 22h 33h 44h 55h 66h 77h 88h 99h aah bbh cch ddh eeh ffh address space used for communication in extended mode ... ...
ams datasheet page 47 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description figure 50: data reception in extended mode mcu to nfc device data flow protocol nfc devices can receive data from a mcu through AS3955 by using standard read commands. prior to writing data into th e buffer, the mcu shall issue a clear buffer command to AS3955 to ensure data are correctly mapped into the buffer. to start data transmission, the mcu shall issue then a transmit buffer command. in this way, the flag io_data_rdy is set and data can be transmitted to the reader. the transmission of the data from the tag to the nfc device is done by issuing a read command on block fch. the fourth block being read during the read command contains the status flags of the ongoing communication. nfc devices can receive data from a mcu through AS3955 by using standard read commands. prior to writing data into the buffer, it is advisable that to issue a clear buffer command to AS3955 to ensure data are correctly mapped into the buffer. mcu can trigger data transmission by writing three words of data into the buffer at addresses fch-feh, and issuing a transmit buffer command. this will also set io_data_rdy flag. the transmission of the data from the tag to the read is done by issuing a read command on word 0xfc. the nfc device can then retrieve the data from the buffer by sending a read command to address fch. the fourth word contains the status flags as shown in figure 51 . pcd AS3955 a c k mcu d a t a r d o u t w r i t e @ fc h rx end w r i t e @ fd h a c k w r i t e @ fe h a c k w r i t e @ ff h a c k
page 48 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description figure 51: data transmission from mcu to nfc device when the nfc device has success fully read all data from the buffer, it shall clear the buffer and prepare for further data transfer by issuing a write comma nd to address ffh. this will trigger a tx end interrupt. if a read command is received on address fch prior to the transmit buffer command, AS3955 will return zero data, io_busy set to 1 and io_data_rdy set to 0. a nfc device can then poll AS3955 by continuously sendin g read commands at address fch and waiting until the last word equals 01h. a read command can be issued only to address fch. issuing a read command to any other address than fch while in extended mode shall be treated as an error. in extended mode, it is assumed that AS3955 will always receive 16 bytes and transmit 12 byte s of data, 3 empty bytes and 1 byte for flags. if the message size differs in any direction, then the mcu or nfc device are responsible for proper error management. fch fdh feh ffh 00h 11h 22h 33h 44h 55h 66h 77h 88h 99h aah bbh 00h 00h 00h flags address space used for communication in extended mode ... ... read fch io_busy = 1, io_data_rdy = 0 response : 00000000h, 00000000h, 00000000h, 00000002h read fch io_busy= 0, io_data_rdy = 1 response : 00112233h, 44556677h, 8899aabbh, 00000001h time write ffh, 00000000h io_busy = 0, io_data_rdy = 0 response : ack 0 0 0 0 io_busy io_data_rdy flags: b7 b6 b5 b4 b3 b2 b1 b0 rf_busy rf_data_rdy
ams datasheet page 49 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description figure 52: data transmission in extended mode if mcu decides to update the buffer before the nfc device issues a write command to address ffh, a i_acc_err interrupt will be triggered, signaling that buffer cannot be accessed (see interrupt register 1 ). relevant registers, interrupts and commands relevant registers : ? buffer status register 1 (status flags : rf_busy, rf_data_rdy, io_data_rdy ) relevant interrupts : ? rx start ( i_rxs bit in interrupt register 1 ) ? rx end, tx end (resp . i_rxe and i_txe bits in interrupt register 0 ) commands : ? transmit buffer ? clear buffer pcd AS3955 mcu transmit w r i t e @ ffh r e a d @ fc h d ata w r i t e i n tx end
page 50 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description extended mode timing diagram figure 53: rf to mcu data transfer in extended mode rf field nfc reader write 0xfc, 0x001122 33 write 0xfd, 0x445566 77 write 0xfe, 0x8899aa bb write 0xff, 0xccdde eff read 0xfc tag state sense resoluti on selected AS3955 rf response ack ack ack ack 0x000000 00 0x000000 00 0x000000 00 0x000000 02 0xfc 0x00000000 0x00112233 0x00112233 0x00112233 0x00112233 0x00000000 0xfd 0x00000000 0x00000000 0x44556677 0x44556677 0x44556677 0x00000000 0xfe 0x00000000 0x00000000 0x00000000 0x8899aabb 0x8899aabb 0x00000000 0xff 0x00000000 0x00000000 0x00000000 0x00000000 0xccddeeff 0x00000000 AS3955 spi/i2c 0x10 0x001122 33 0x445566 77 0x8899aa bb 0xccdde eff mcu spi/i2c read irq read buffer length buffer read clear buffer rx start rx end tx end rf_busy rf_data_rdy io_busy io_data_rdy rf link rf field on anti r collision sequence power off anti r collision sequence rf to buffer data transfer buffer to mcu data transfer buffer buffer content spi/i2c link interrupts flags tag initialization
ams datasheet page 51 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description figure 54: mcu to rf data transfer in extended mode rf field nfc reader read 0xfc read 0xfc write 0xff, 0x000000 00 tag state AS3955 rf response 0x00000000 0x00000000 0x00000000 0x000000 02 0xffeecc aa 0x998877 66 0x554433 22 0x000000 09 ack 0xfc 0x00000000 0x00000000 0xffeeccaa 0xffeeccaa 0xffeeccaa 0x00000000 0xfd 0x00000000 0x00000000 0x00000000 0x99887766 0x99887766 0x00000000 0xfe 0x00000000 0x00000000 0x00000000 0x00000000 0x55443322 0x00000000 0xff 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 AS3955 spi/i2c mcu spi/i2c buffer load 0xffeeccaa 0x99887766 0x55443322 transmit buffer read irq rx start rx end tx end rf_busy rf_data_rdy io_busy io_data_rdy rf link mcu to buffer data transfer buffer to rf data transfer buffer buffer content spi/i2c link interrupts flags
page 52 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description implementation recommendations while in extended mode, the nfc device shall not issue a write command to the address space of the internal eeprom until the buffer is empty. the nfc device can issue a read command to check internal status flag (io_busy = 0), before writing to eeprom. it is also not allowed to interleave data communication in extended mode (e.g. writing to addresses fch-ffh) and issue a write command to internal eepro m. if case this happens, writing to internal eeprom would be successful, but the buffer content would be lost. reading status flags is always allowed. error handling figure 55 shows how different type of errors in standalone and extended communication modes are handled and what is the resulting state of the tag. figure 55: error handling command condition AS3955 nak_on_crc_parity=0 AS3955 nak_on_crc_parity=1 (empty fields have same reply as nak_on_crc_parity=0) any bit coding error no response, sleep any incomplete frame no response, sleep t2t read parity error no response, sleep nak_1, sleep t2t read crc error no response, sleep nak_1, sleep t2t read 1 byte frame (no crc) no response, sleep t2t read empty frame (only crc bytes) no response, sleep t2t read missing addr ess no response, sleep t2t read too long frame no response, sleep t2t read memory fully locked send block content t2t read memory partially locked send block content t2t read memory fully protected nak_4, sleep t2t read memory partially protected send unprotected memory as is, replace protected memory with zero bytes t2t read memory address range fully not existent nak_0, sleep
ams datasheet page 53 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description t2t read memory address range partially not existent send existing memory appended with zero bytes t2t read eeprom access collision nak_5, sleep t2t read no error send block content t2t write parity error no response, sleep nak_1, sleep t2t write crc error no response, sleep nak_1, sleep t2t write 1 byte frame (no crc) no response, sleep t2t write 2 byte frame with correct crc no response, sleep t2t write missing address and data no response, sleep t2t write missing data no response, sleep t2t write incomplete data no response, sleep t2t write too long frame no response, sleep t2t write memory fully locked nak_0, sleep t2t write memory partially locked cannot occur t2t write memory fully protected nak_4, sleep t2t write memory partially protected cannot occur t2t write memory address range fully not existent nak_0, sleep t2t write memory address range partially not existent cannot occur t2t write eeprom access collision nak_5, sleep t2t write no error ack, selected t2t sector select 1 parity error no response, sleep nak_1, sleep t2t sector select 1 crc error no response, sleep nak_1, sleep t2t sector select 1 1 byte frame (no crc) no response, sleep t2t sector select 1 empty frame (only crc bytes) no response, sleep command condition AS3955 nak_on_crc_parity=0 AS3955 nak_on_crc_parity=1 (empty fields have same reply as nak_on_crc_parity=0)
page 54 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description t2t sector select 1 missing second byte no response, sleep t2t sector select 1 incorrect second byte (not ffh) no response, sleep t2t sector select 1 too long frame no response, sleep t2t sector select 1 only 1 sector available nak_0, sleep t2t sector select 2 parity error no response, sleep nak_1, sleep t2t sector select 2 crc error no response, sleep nak_1, sleep t2t sector select 2 1 byte frame no response, sleep t2t sector select 2 empty frame (only crc bytes) no response, sleep t2t sector select 2 missing sector number no response, sleep t2t sector select 2 missing rfu bytes no response, sleep t2t sector select 2 too few rfu bytes no response, sleep t2t sector select 2 too long frame no response, sleep t2t sector select 2 selected sector not existent (cannot happen for AS3955) no response, sleep t2t sector select 2 no error (cannot occur for AS3955) no response, sleep unknown command code parity error no response, sleep nak_1, sleep unknown command code crc error no response, sleep nak_1, sleep unknown command code no error no response, sleep command condition AS3955 nak_on_crc_parity=0 AS3955 nak_on_crc_parity=1 (empty fields have same reply as nak_on_crc_parity=0)
ams datasheet page 55 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description wired interfaces AS3955 host interface can be configured to be either spi or i2c at production ( fabrication data fab_cfg0 ). in both cases, the /ss signal is also used to control the ic power state. by pulling the /ss low, the chip interface or the chip itself is enabled / powered (see power management ). note that interrupting spi / i2c operations or issuing inco mplete command sequence from the mcu may result in corrupted data content. for more information on eeprom and buff er data reading and writing see eeprom read and write and data buffer sections. spi / i2c access modes figure 56: access modes mode mode byte (com. bits) mode related data mode trailer m2 m1 m0 c4 c3 c2 c1 c0 register write 0 0 0 a4 a3 a2 a1 a0 data byte(s) register read 0 0 1 a4 a3 a2 a1 a0 data byte(s) eeprom write 0 1 000000 block address byte 4 bytes of block data eeprom read 0 1 111111 block address byte n*4 bytes buffer load 100xxxxx data byte(s) buffer read 101xxxxx data byte(s) command mode 1 1 c5 c4 c3 c2 c1 c0
page 56 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description spi interface communication between AS3955 and microcontroller can be done via a four-wire serial peripheral interface (spi) and an additional interrupt signal. as39 55 acts an spi slave device, and it can request mcu attention by sending an interrupt (pin irq). the sclk frequency can be between 100 khz and 5 mhz. figure 57: spi and interrupt signals spi interface is in reset mode when signal /ss is high, and it is enabled when /ss is low. it is recommended to keep signal /ss high whenever the spi interface is not used. mosi is sampled at the falling edge of sclk. all communication is done in 8-bit blocks (bytes). first three bits of first byte transmitted after /ss high to low transition define spi operation mode. msb bit is always transmitted first (valid for address and data). read and write modes support address au to incrementing, which means that in case some additional data bytes may be sent (read), they are written to (read from) addresses incremented by 1 after the address and first data byte. spi interface supports the following modes: ? internal registers read and write ? eeprom read and write ? buffer read and write ? direct commands note that in case when logic and eeprom are supplied from the vp_io, the only spi operations permitted are reading and writing of eeprom and registers (see also power management ). miso output is usually in trista te and it is only driven when output data is available. mosi and miso can then be externally shorted to create a bidirectional signal. when miso output is in tristate, it is possible to sw itch on a 10 k pull down by activating option bits miso_pd1 and miso_pd2 in io configuration register . name signal signal level description /ss digital input with pull up cmos spi enable (active low) mosi digital input cmos serial data input miso digital output with tristate cmos serial data output sclk digital input cmos clock for serial communication irq digital output cmos interrupt output pin (active high)
ams datasheet page 57 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description figure 58: io signals to controller writing data to addressable registers (register write mode) following figures show waveforms of writing a single byte and writing multiple bytes with auto-incrementing address. after the spi operation mode bits, the a ddress of starting register to be written is provided. then one or more data bytes are transferred from the spi, always msb first. the data byte is written in register on falling edge of its last clock. in case the communication is terminated by putting /ss high before a packet of 8 bits composing one byte is sent, writing of this register is not performed. in case the register on the defined address does not exist or it is a read-only register, no write is performed. figure 59: spi communication: writing a single register mosi miso miso mosi c AS3955 mosi miso i/o c AS3955 separate spi input and outp ut signals to controller bidirectional data io signal to controller 0 0 0 a4 a3 a2 a1 a0 d5 d4 d3 d2 d1 d0 d7 d6 x x sclk raising edge data is transfered from c sclk falling edge data is sampled data is moved to address a4-a0 /ss rising edge signals end of write mode three leading bits indicate mode /ss sclk mosi
page 58 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description figure 60: spi communication: writin g register data with auto-incrementing address reading data from addressable registers (register read mode) after the spi operation mode bits, the register address to be read shall be provided, msb first. then one or more data bytes are transferred to miso output, always msb first. as in case of the write mode, also the read mode supports auto-incrementing addressing. mosi is sampled at the falling sclk edge (as shown in the following diagrams); data to be read from AS3955 internal register is driven to miso pin on rising edge of sclk and is sampled by the master at the falling sclk edge. in case the register on defined a ddress does not exist, all 0 data is sent to miso. in the following figure an example of reading of a single byte is given. figure 61: spi communication: reading a single register 000 a 4 a 3 a 2 a 1 a 0 d 5 d 4 d 3 d 2 d 1 d 0 d 7 d 6 x x data is moved to address + n /ss rising edge signals end of write mode three leading bits indicate mode d 5 d 4 d 3 d 2 d 1 d 0 d 7 d 6 d 7 d 6 d 5 d 4 d 3 d 2 d 1 d 0 d 7 d 6 d 1 d 0 data is moved to address + (n-1) data is moved to address + 1 data is moved to address /ss sclk mosi 001a4a3a2a1a0 x x sclk rising edge data is moved from address /ss rising edge signals end of read mode three leading bits indicate the mode d4 d3 d2 d1 d0 d7 d6 x x sclk rising edge data is transferred from c sclk falling edge data is sampled sclk falling edge data is transferred to c d5 /ss sclk mosi miso
ams datasheet page 59 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description writing and reading of eeprom through spi eeprom data can be read and written also through spi interface. due to possible conflict with the rfid interface additional arbitration bit can be set ( ic_cfg0 ) in order to set the priority access to the eeprom access. if eeprom write operation is terminated due to higher priority of the rf an i_acc_err ( interrupt register 1 ) irq is sent. the description is referring to following case when an eeprom write operation is triggered via spi / i2c and bit arbit_mod (eepro m, ic_cfg0, bit3) is set to 1 which means that rf has priority over spi when accessing eeprom. in this case eeprom via spi / i2c write will be terminated and irq i_acc_err is triggered if tags enters rf field and eeprom is needed for rf initialization, eprom read or write is issued via rf.
page 60 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description word address byte both eeprom modes (read and wr ite) use word address byte to define the address of the eeprom word which is accessed. seven msb bits of the address byte are used to define the address; while the last bit is dont care (it is used to synchronize eeprom access). figure 62: eeprom block address byte eeprom write in order to program an eeprom block, six bytes shall be sent (mode byte, block address byte an d 4 bytes of data, all of them msb first). actual eeprom programming is started with rising /ss edge signal which terminates the eeprom write command. eeprom read in order to read data from eeprom, first a mode byte is sent, followed by the block address byte (msb first). then one or more blocks of data with address auto-incrementing (packets of 4 bytes) are transferred to miso output, also msb first. mosi is sampled at the sclk falling edge; data to be read from AS3955 eeprom is driven to miso pin on sclk rising edge and is sampled by the master at the sclk falling edge. in case the block on the defined address does not exist, all 0 data is sent to miso. please note that sclk frequency should not exceed 1mhz during eeprom read (limited by eeprom read access time). figure 63: reading an eeprom block over spi b7 b6 b5 b4 b3 b2 b1 b0 eeprom block address wa6 wa5 wa4 wa3 wa2 wa1 wa0 x 01111111 w a 4 w a 3 w a 2 w a 1 w a 0 x w a 6 w a 5 x msb byte from address /ss sclk mosi x b 2 9 b 2 8 b 2 7 b 2 6 b 2 5 b 2 4 b 3 1 b 3 0 b 2 3 b 2 2 b 5 b 4 b 3 b 2 b 1 b 0 b 7 b 6 b 9 b 8 xx lsb byte from address x miso 1s min
ams datasheet page 61 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description loading transmission data into buffer loading the transmitting data into the buffer is similar to writing data into an addressable re gisters. difference is that in case of loading more bytes all bytes go to the buffer. the command mode code 100b indica tes buffer write operation. a bit stream of 32 bytes of data can be transferred. the following figure shows how to load the tran smission data into the buffer. figure 64: loading data into buffer over spi /ss sclk mosi 100xx x xx 1 to 32 bytes x sclk rising edge data is transfered from c sclk falling edge data is sampled /ss rising edge signals end of command mode 10 pattern indicates fifo mode x start of payload data
page 62 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description reading received data from buffer reading received data from the buffer is similar to reading data from an addressable registers. difference is that, in case of reading more bytes, they all come from the buffer. the command mode code 101b indicates buffer operations . in case the command is terminated by putting /ss high before a packet of 8 bits composing one byte is read that particular byte is considered read. direct command mode direct command mode is comprised of one command byte followed by argument byte. spi operation mode bits 11b indicate direct command mode. the following six bits define command code, sent msb first. last two bits in argument byte indicate success of the direct command. value 01h of the argument byte indicates that command was accepted, while value 02h indicates rejected due to internal access priorities. the argument byte does not provide information on timing of the command execution. figure 65: sending a direct command over spi 1 1 c5 c4 c3 c2 c1 c0 x x sclk rising edge data is transferred from c sclk falling edge data is sampled two leading one indicate command mode d7 d6 d5 d4 d3 d2 d1 d0 /ss sclk mosi
ams datasheet page 63 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description spi timing figure 66: spi timing note(s) and/or footnote(s): 1. t sclk =t sclkl +t sclkh, during eeprom read the sclk period has to be increa sed to 1s (this limitation is imposed by eeprom read access time) figure 67: spi general timing symbol parameter min typ max unit note general timing (vdd=vdd_io=vdd_ d= 3.3v, temperature 25c) t sclk sclk period 200 ns (1) t sclkl sclk low 80 ns t sclkh sclk high 80 ns t ssh spi reset (/ss high) 50 ns t ncsl /ss falling to sclk rising 25 ns first sclk pulse t ncsh sclk falling to /ss rising 80 ns last sclk pulse t dis data in setup time 10 ns t dih data in hold time 10 ns read timing (vdd=vdd_io=vdd_d= 3. 3v, temperature 25c, cload50pf) t dod data out delay 20 ns t dohz data out to high impedance delay 20 ns ... ... ... t dis t dih datai datai datai ... t ncsh t sclkh t sclkl /ss mosi miso sclk t ncsl
page 64 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description figure 68: spi read timing spi electrical connection a pull-down resistor can be conn ected by setting miso_pd1 and miso_pd2 bits in io configuration register . figure 69: spi electrical connection ... ... ... datai ... t dohz /ss mosi miso sclk t dod datao datao r p =10k vp_io vss miso AS3955 pull down settings
ams datasheet page 65 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description i2c interface communication between AS3955 and microcontroller can be done via a i2c interface and an additional interrupt signal. AS3955 acts an i2c slave device, and supports single master, multiple slave configurations. AS3955 i2c supports following modes: standard-mode, fast-mode, fast-mode plus. figure 70: i2c and interrupt signals during i2c communication, the sign al /ss should be set to low. by setting the /ss to low, i2c interface is enabled. it is recommended to keep signal /ss high whenever the i2c interface is not used. i2c interface supports the following modes: ? internal registers read and write ? eeprom read and write ? buffer read and write ? direct commands please note that the only i2c operations allowed, when logic and eeprom are supplied from vp_io, are eeprom and registers reading and writing (see also power management ). name signal signal level description /ss digital input with pull up cmos should be set to high during i2c communication sda digital output cmos serial data output scl digital input cmos clock for serial communication irq digital output cmos interrup t output pin (active high)
page 66 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description writing data to addressable registers (register write mode) following figures show cases of writing a single byte and writing multiple bytes with auto-incrementing address. after the i2c slave address, the initial register address follows. then one or more data bytes are transferred from the i2c, msb first. the data byte is written in regist er on falling edge of its last clock. figure 71: writing a single register over i2c figure 72: writing register data with auto -incrementing address over i2c 0 0 0 0 a 6 a 5 a 4 a 3 a 2 a 1 a 0 r 4 r 3 r 2 r 1 a c k p s slave address d 7 d 6 d 5 d 4 d 3 d 2 r 1 a c k d 1 d 0 data mode byte scl sda a c k 0 0 0 a 6 a 5 a 4 a 3 a 2 a 1 a 0 0 r 4 r 3 r 2 r 1 a c k p s data is moved to address + n slave address d 7 d 6 d 5 d 4 d 3 d 2 r 1 a c k d 1 d 0 d 3 d 2 d 1 d 0 a c k d 5 d 4 d 7 d 6 data is moved to address + 0 mode byte scl sda a c k
ams datasheet page 67 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description reading data from addressable registers (register read mode) after the i2c slave address, the address of register to be read shall be provided, msb first. then one or more data bytes are transferred to sda output, also msb first. as in case of the write mode, also read mode supports auto-incrementing address. in case the register at the defined a ddress does not exist, all 0 data is sent to sda. in the following figure, an example for reading of single byte is given. figure 73: reading a single register over i2c writing and reading eeprom through i2c eeprom data can be read and written through i2c interface. due to possible conflict with rfid interface, additional arbitration bit can be set ( ic_cfg0 ) in order to set the priority access to the eeprom access. if eeprom write operation is terminated due to higher priority of the rf an i_spi ( interrupt register 1 ), an irq is sent. block address byte both eeprom read and write use block address byte to define the eeprom block address to be accessed. seven msb bits of the address byte are used to define the address; while the last bit is dont-care (it is used to synchronize eeprom access). figure 74: eeprom block address byte over i2c b7 b6 b5 b4 b3 b2 b1 b0 eeprom block address wa6 wa5 wa4 wa3 wa2 wa1 wa0 x a 6 a 5 a 4 a 3 a 2 a 1 a 0 01 r 4 r 3 r 2 r 1 a c k p s slave address a 6 a 5 a 4 a 3 a 2 a 1 r 0 a c k a 1 1 mode byte scl sda a c k d 7 d 6 d 5 d 4 d 3 d 2 d 1 d 0 data n a k s slave address 0 0
page 68 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description eeprom write in order to program an eeprom bl ock, seven bytes shall be sent (slave address, mode byte, bloc k address byte and 4 bytes of data, all of them msb first). actual eeprom programming is started with rising edge of ack of the last byte. figure 75: writing register data with auto -incrementing address over i2c eeprom read in order to read data from eeprom, first a slave address and mode byte is sent, followed by the block address byte (msb first). then one or more blocks of data with address auto-incrementing (packets of 4 bytes) are transferred via sda line, also msb first. sda is sampled at the scl falling edge. in case the block on defined address does not exist, all 0 data is sent via sda line. figure 76: reading a eeprom block over i2c a 6 a 5 a 4 a 3 a 2 a 1 a 0 100000 a c k 0 p s data slave address w a 6 w a 5 w a 4 w a 3 w a 2 w a 1 0 a c k w a 0 x d 3 d 2 d 1 d 0 a c k d 5 d 4 d 7 d 6 eeprom page address mode byte scl sda a c k 0 a 6 a 5 a 4 a 3 a 2 a 1 a 0 0111111 a c k 0 s slave address w a 6 w a 5 w a 4 w a 3 w a 2 w a 1 1 a c k w a 0 x eeprom page address mode byte scl sda a c k p slave address a 2 a 1 a 0 1 a c k a 4 a 3 a 6 a 5 s data d 3 d 2 d 1 d 0 n a k d 5 d 4 d 7 d 6
ams datasheet page 69 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description loading transmission data into buffer loading the transmitting data into the buffer is similar to writing data into an addressable register. difference is that, in case of loading more bytes, all bytes go to the buffer. the command mode code 10b indi cates buffer operations. the following figure shows how to load the transmitting data into the buffer. figure 77: loading data into buffer over i2c reading received data from buffer reading received data from the buffer is similar to reading data from an addressable register. difference is that, in case of reading more bytes, they all come from the buffer. the command mode code 10b indicate s buffer operations. in case of reading the received data from the buffer, all bits are set to 1. figure 78: reading data from buffer over i2c a 6 a 5 a 4 a 3 a 2 a 1 a 0 0 000000 a c k 1 p s data slave address d 7 d 6 d 5 d 4 d 3 d 2 0 a c k d 1 d 0 d 3 d 2 d 1 d 0 a c k d 5 d 4 d 7 d 6 data mode byte scl sda a c k a 6 a 5 a 4 a 3 a 2 a 1 a 0 0011111 a c k 1 s slave address 1 a c k mode byte scl sda p slave address a 2 a 1 a 0 1 a c k a 4 a 3 a 6 a 5 s data d 3 d 2 d 1 d 0 n a k d 5 d 4 d 7 d 6
page 70 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description direct command mode direct command mode is comprised of one command byte and argument byte. the two msbs of command code 11b indicate direct command mode. the following six bits define command code, sent msb first. last two bits in argument byte indicate success of the direct command. value 01h of the argument byte indicates that command was acce pted, while 02h indicates it was rejected due to internal access priorities. the argument byte does not provide information on timing of the command execution. figure 79: sending a direct command over i2c i2c electrical connection the AS3955 has two built-in 3k pull-up resistors on sda and scl lines as shown on figure 80 and used only in i2c mode. the spi pull-down bits in io configuration register must be set 00h. figure 80: i2c interface with built-in pull-up resistors a 6 a 5 a 4 a 3 a 2 a 1 a 0 c 5 c 4 c 3 c 2 c 1 a c k p s slave address a 6 a 5 a 4 a 3 a 2 a 1 c 0 a c k a 1 1 mode byte scl sda a c k 000000 xx argument byte n a k s slave address c 7 c 6 r p =3k r p =3k vp_io vss sda scl AS3955
ams datasheet page 71 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description interrupt interface description there are two interrupt registers implemented in AS3955 ( interrupt register 0 and interrupt register 1 ). when an interrupt condition is me t, the source of interrupt bit is set in the interrupt register and the irq pin goes to high. the microcontroller shall read the interrupt registers to distinguish between different interrupt sources. after an interrupt register is read, its content is reset to 0. irq pin goes to low after the interrupt bit(s), which caused its transition to high, has been read. please note that there may be multiple interrupt register bits set in case the controller does not immediately read the interrupt registers after the irq signal was set and another event causing interrupt occurred. the process of reading interrupt registers is composed of two phases. in the first phase, interrupts are pushed into internal buffer just before reading the fi rst bit of the register. in the second phase the bits stored in the buffer are read out. the interrupts stored in each inte rnal register are cleared and considered being read out at the rising edge of sclk of the first interrupt bit for each interrupt register. buffer interrupts and buffer status register the AS3955 contains a 32 byte bu ffer. in case of transmission the control logic shifts data which was previously loaded by the external controller to the framing block and further to the transmitter. during reception, the demodulated data is stored in the buffer and the external controller can download received data. transmit and receive capability of the AS3955 is limited by the buffer size. the maximum message size that can be received or transmitted is 32 bytes. the mu tual access to the buffer from nfc block and spi / i2c block is not allowed. at the beginning of each reception the buffer is cleared automatically. before the data is loaded into the buffer via spi / i2c for transmission the mcu must take care of clearing the buffer. five interrupts that can be trigge red during read or write of the buffer: ? when buffer overflow or underflow is detected an i_bf_err is triggered. the reason for the interrupt can be distinguished by reading the buffer status register 1 . ? buffer overflow irq is not blocke d, in case if more than 32 bytes are received from reader or written via spi / i2c into buffer the buffer underf low irq is produced. ? when data is loaded via data rf an i_rxs and i_rxe are triggered ? when all data is transmitted an i_txe is triggered ? when buffer is already busy due to another operation in progress and mcu tries to acce ss the internal buffer an interrupt i_acc_err shall be triggered.
page 72 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description after data is received, the microcontroller shall check the amount of bytes actually received. this information is available in the buffer status register 2 , which displays number of bytes in the buffer not yet read out. buffer status register 1 additionally contains a flag indicating buffer overflow. eeprom read and write the eeprom can be accessed from spi / i2c interface or over rf field issuing nfc read and wr ite commands. the eeprom access is controlled by the internal eeprom controller. since the mutual access to the eeprom is not possible AS3955 needs to arbitrate between mcu and nfc device in cases of mutual access. how this is handled it is defined according to arbit_mod bit. typical eeprom programing ti me is 8.3 ms and should not e xc e e d 9 . 5 m s. p l e a s e n o t e t h a t w o r d d a t a i s s e n t m s b f i r s t w h i c h is opposite to the rfid eeprom programming where lsb is sent first. three interrupts can be triggered during eeprom read or write: ? when eeprom programing is executed successfully an i_io_eewr interrupt is triggered. ? when eeprom programming is terminated due to higher priority of the rf part, writ ing to a non-existent address or writing is not allowed an i_eeac_err interrupt is triggered. ? when eeprom is busy and cant be accessed an i_acc_err interrupt is triggered note that eeprom does not contain any kind on ant tearing mechanism that would allow detection of corrupted data the valid range for the block address byte depends on the eeprom size. for 4kbit eeprom, the valid range for the block address byte is from 000_0000b to 111_1111b (eeprom blocks from 00h to 7fh). data buffer data in buffer is organized in bytes; each byte is terminated by a parity bit. data bits in a byte are numbered from b1 to b8 where b1 is lsb bit, lsb is sent first. data sent over spi / i2c is also organized in bytes, bits in a byte are marked d0 to d7, where d0 is lsb bit, msb is sent first. during reception, the framing engine checks the parity bit and removes it from data frame, and only data bytes are put into buffer. during transmission, the process is reversed, only data bytes are put into buffer, while the framing engine adds the parity bits. the data bits b1 to b8 are mapped to buffer data bits d0 to d7, which means that the order of re ceiving/transmitting bits in a byte is reversed (the bytes are sent lsb first while the spi / i2c bytes are sent msb first).
ams datasheet page 73 [v1-01] 2015-apr-29 document feedback AS3955 ? detailed description direct commands figure 81: list of direct commands set default this direct command puts the AS3955 in the same state as power-up initialization except for i2c bit in register ic status display register that defines th e interface and io configuration register, which are not cleared. clear buffer clears buffer, buffer overflow and underflow bits. restart transceiver resets protocol logic to its initia l state except for the tag state. this interrupts all receptions and transmissions that are being processed at the time. command byte value command comments c2 set default set AS3955 to default state c4 clear buffer clears buffer and its error flags c6 restart transceiver restarts transceiver communication logics c7 disable/enable transceiver toggles disable transceiver bit c8 transmit buffer starts a transmit sequence of the buffer content c9 transmit ack transmits nfc ack reply ca transmit nack 0 transmits nfc nak reply with code 0h cb transmit nack 1 transmits nfc nak reply with code 1h cd transmit nack 4 transmits nfc nak reply with code 4h cc transmit nack 5 transmits nfc nak reply with code 5h d0 go to sleep puts a tag in sleep state d1 go to sense puts a tag in sense state d2 go to sense / sleep puts a tag in sense or sleep state depending on the internal AS3955 state
page 74 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? detailed description disable/enable transceiver this direct command toggles internal states which enables or disables the reception or tran smission of the data. this command should be used when mcu wants to disable the interruption of eeprom write/read over spi / i2c by the received rf wire/read command. the rf part can also be enabled by issuing the restart rx/tx. this command shall not change the tag state. transmit buffer this direct command trigger the transmission of data stored in the buffer over the rf link. before issuing a transmit command, the mcu shall send a clear buffer command, and write into the buffer the data to be transmit ted by sending a buffer load command. execution of this direct comm and is only enabled when the AS3955 antenna coil is in a pc d field (vp_int is above hf_pon threshold) and AS3955 extended or tunneling modes are enabled. transmit ack transmit 4-bit ack response. transmit nack 0-5 transmit 4-bit nack response with different nack codes. go to sleep puts tag in sleep state. execution of this direct command is only enabled when AS3955 antenna co il is in a nfc device field (vp_int is above hf_pon threshold). go to sense puts tag in sense state. execution of this direct command is only enabled when the AS3955 antenna coil is in a nfc device field (vp_int is above hf_pon threshold). go to sense / sleep puts tag in sleep state dependin g on the internal state of the tag. execution of this direct command is only enabled when AS3955 antenna coil is in a nfc device field (vp_int is above hf_pon threshold).
ams datasheet page 75 [v1-01] 2015-apr-29 document feedback AS3955 ? register description the 6-bit register addresses be low are defined in hexadecimal notation. the possible address range is from 00h to 3fh. there are two types of registers implemented in AS3955: configuration registers and displa y registers. the configuration registers are used to configure AS3955. they can be written and read through spi / i2c (rw). the display registers are read-only (ro); they contain information about AS3955 internal state, which can be accessed through spi / i2c. registers overview figure 82: list of the spi / i2c internal registers address [hex] content comment type 00 io configuration register rw 01 ic configuration register 0 default: ic_cfg0 ro/rw 02 ic configuration register 1 default: ic_cfg1 ro 03 ic configuration register 2 default: ic_cfg2 + battery supply enable ro/rw 04 rfid status display register ro 05 ic status display register ro 08 mask interrupt register 0 default: mirq_0 rw 09 mask interrupt register 1 default: mirq_1 rw 0a interrupt register 0 ro 0b interrupt register 1 ro 0c buffer status register 2 ro 0d buffer status register 1 ro 0e last nfc address access register ro 1e version control C major revision ro 1f version control C minor revision ro register description
page 76 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? register description io configuration register figure 83: io configuration register note(s) and/or footnote(s): 1. default value is loaded from eeprom configuration block bits ( ic_cfg2 ). ic configuration registers figure 84: ic configuration register 0 note(s) and/or footnote(s): 1. default value is loaded from eeprom configuration block bits ( ic_cfg0 ). address 00h: io configuration type: rw bit name default function comments 7 miso_pd2 0 1: pull down on miso, when \ss is low and miso is not driven by the AS3955 6 miso_pd1 0 1: pull down on miso when \ss is high 5rfu 0 4rfu 0 3rfu 0 2rfu 0 1rfu 0 0rfu 0 address 01h: ic configuration 0 bit name default function type 7slnt_mod see note 1: enable silent mode ro 6slnt_vl<2> silent mode voltage level (see silent mode )ro 5slnt_vl<1> 4slnt_vl<0> 3 arbit_mod 1: rf has priority a ccess to eeprom over spi / i2c rw 2 i2c_addr3<2> i2c slave address ro 1 i2c_addr2<1> 0 i2c_addr1<0>
ams datasheet page 77 [v1-01] 2015-apr-29 document feedback AS3955 ? register description figure 85: ic configuration register 1 note(s) and/or footnote(s): 1. default value is loaded from eeprom configuration block bits ( ic_cfg1 ). figure 86: ic configuration register 2 note(s) and/or footnote(s): 1. default value is loaded from eeprom configuration block bits ( ic_cfg2 ) address 02h: ic configuration 1 bit name default function type 7en_rx_crc see note 1: crc stored in the buffer in the tunneling mode ro 6vreg<4> voltage level for voltage regulator vp_reg (see energy harvesting ) ro 5vreg<3> 4vreg<2> 3vreg<1> 2vreg<0> 1rreg<1> output resistance value for voltage regulator vp_reg (see energy harvesting ) ro 0rreg<0> address 03h: ic configuration 2 bit name default function type 7rfcfg_en see note see configuration byte ic_cfg2 for full description ro 6tun_mod rw 5ext_mod rw 4 nak_on_crc_parity 0 ro 3auth_setsee note ro 2selr_b6_inv 0 ro 1powm<1> see note rw 0powm<0> rw
page 78 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? register description status display registers figure 87: rfid status display register figure 88: ic status display register note(s) and/or footnote(s): 1. default is set during production address 04h: rfid status display bit name function type 7hf_pon1: picc afe is active ro 6state<3> 0000: power off 0001: sense 0011: resolution 0010: resolution_l2 0110: selected 0111: sector_2 1111: sectorx_2 1110: selectedx 1010: sensex_l2 1011: sensex 1001: sleep ro 5state<2> 4state<1> 3state<0> 2 state_notvalid 1: state update C indicates that the state is not valid ro 1rfu ro 0rfu ro address 05h: ic status display bit name default function type 7ee2k see note (1) ro 6i2c ro 5chipkill_2 0 signal depends on the chip_kill value at initialization ro 4chipkill_1 0 signal depends on the chip_kill value at initialization ro 3 auth_locked 0 signal depends on the auth_cnt value ro 2rfu 0 ro 1rfu 0 ro 0rfu 0 ro
ams datasheet page 79 [v1-01] 2015-apr-29 document feedback AS3955 ? register description interrupt registers figure 89: mask interrupt register 0 note(s) and/or footnote(s): 1. the mask bits only mask the triggering of the physical interrupt line. the interr upt bits in the interrupt register still ge t set when the interrupt is masked. 2. default values are loaded from eeprom configuration block bits ( mirq_0 ). figure 90: mask interrupt register 1 note(s) and/or footnote(s): 1. the mask bits only mask the triggering of the physical interrupt line. the interr upt bits in the interrupt register still ge t set when the interrupt is masked. 2. default values are loaded from eeprom configuration block bits ( mirq_1 ). address 08h: mask interrupt 0 (1) bit name default function type 7m_pu see note (2) mask i_pu irq rw 6 m_wu_a mask i_wu_a irq rw 5 m_slp mask i_slp irq rw 4 m_eew_rf mask i_eew_rf irq rw 3 m_eer_rf mask i_eer_rf irq rw 2 m_rxe mask i_rxe irq rw 1 m_txe mask i_txe irq rw 0 m_xrf mask i_xrf irq rw address 09h: mask interrupt 1 (1) bit name default function type 7m_rxs see note (2) mask i_rxs irq rw 6 m_frm_err mask i_frm_err irq rw 5 m_par_err mask i_par_err irq rw 4 m_crc_err mask i_crc_err irq rw 3 m_bf_err mask i_bf_err irq rw 2 m_io_eewr mask i_io_eewr irq rw 1 m_eeac_err mask i_eeac_err irq rw 0 m_acc_err mask i_acc_err irq rw
page 80 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? register description figure 91: interrupt register 0 note(s) and/or footnote(s): 1. power-up and set default command set the content of this register to 0. afte r interrupt register has been read, its content is set again to 0. figure 92: interrupt register 1 address 0ah: interrupt register 0 bit name function type 7i_pu power-up irq. interrupt is triggered at each power up (rf or battery), when chip is already powered and rf field appears and after go to sleep , go to sense , go to sense / sleep and set default command ro 6 i_wu_a wake-up irq at entry in selected state ro 5 i_slp irq due to reception of slp_req command ro 4 i_eew_rf pcd has updated the content of the data area ro 3 i_eer_rf pcd has read the content of the data area ro 2i_rxe irq due to end of receive. applicable when receive frame is put in buffer ro 1i_txe irq due to end of transmission. appl icable when data from buffer is sent ro 0 i_xrf exit rf field irq ro address 0bh: interrupt register 1 bit name function type 7i_rxs irq due to start of receive. ap plicable when receive frame is put in buffer ro 6 i_frm_err lower layer error (broken byte, wrong bit coding sequence) / in case of error the receive data is still put in buffer, error irq is additionally sent ro 5i_par_err parity error / in case of error the receive data is still put in buffer, error irq is additionally sent ro 4i_crc_err crc error / in case of crc error the receive data is still put in buffer, error irq is additionally sent ro 3 i_bf_err buffer error (overflow/underflow). see buffer status register 2 ro
ams datasheet page 81 [v1-01] 2015-apr-29 document feedback AS3955 ? register description note(s) and/or footnote(s): 1. power-up and set default command re set the content of this register to 0. after inte rrupt register has been read, its content is set again to 0. buffer registers figure 93: buffer status register 2 note(s) and/or footnote(s): 1. power-up and commands set default and clear buffer reset the content of this register to 0. 2i_io_eewr irq due to successful termination of eeprom programming. in case eeprom write command wa s sent through spi / i2c ro 1i_eeac_err irq due to eeprom write on write protected block or write to non-existing address ro 0 i_acc_err irq due to interruption of spi / i2c operation on buffer, eeprom or registers due to access control ro address 0ch: buffer status register 2 bit name function type 7 buf_len_invalid buffer content is bein g changed C data length not valid ro 6rfu ro 5 buf_len<5> number of data bytes (binary code d) in the buffer not yet read out. valid range is from 000000b to 100000b C 000000b means that there are no data bytes to be read out ro 4 buf_len<4> 3 buf_len<3> 2 buf_len<2> 1 buf_len<1> 0 buf_len<0> address 0bh: interrupt register 1 bit name function type
page 82 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? register description figure 94: buffer status register 1 note(s) and/or footnote(s): 1. power-up and commands set default and clear buffer reset the content of this register to 0. nfc last address register figure 95: last nfc address access register note(s) and/or footnote(s): 1. power-up and commands set default and clear buffer reset the content of this register to 0. address 0dh: buffer status register 1 bit name function type 7rfu ro 6rfu ro 5rf_busy extended mode buffer status flags (see extended mode ); io_busy flag is omitted since in this it is always zero when this byte is read out ro 4 rf_data_rdy ro 3 io_data_rdy ro 2rfu ro 1buf_unf buffer underflow. set when read more bytes then actual content of buffer ro 0buf_ovr buffer overflow. set when written more bytes then actual content of buffer ro address 0eh: last nfc address access bit name function type 7 last_addr<7> contains last address accessed by reader. updated on internal eeprom access over rf. the address is 8 bit long and contains also access attempts that are hi gher than the eeprom address space. value ffh indicates that the value is being updated and is not valid. ro 6 last_addr<6> 5 last_addr<5> 4 last_addr<4> 3 last_addr<3> 2 last_addr<2> 1 last_addr<1> 0 last_addr<0>
ams datasheet page 83 [v1-01] 2015-apr-29 document feedback AS3955 ? register description version control register figure 96: version control C major revision figure 97: version control C minor revision note(s) and/or footnote(s): 1. default values are loaded from eeprom configuration block bits ( configuration bytes mirq_0 and mirq_1 ) address 1eh: version control ? major revision bit name default function type 7maj7 0 major version revision ro 6maj6 0 5maj5 0 4maj4 0 3maj3 0 2maj2 0 1maj1 0 0maj0 1 address 1fh: version control ? minor revision bit name default function type 7min7 0 minor version revision ro 6min6 0 5min5 0 4min4 0 3min3 0 2min2 0 1min1 0 0min0 0
page 84 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? application information this section describes some ge neral use cases of AS3955 in combination with a microcontroller. the examples are shown for explanatory purposes of specific AS3955 features. detailed descriptions of specific im plementations are subject of dedicated application notes. writing a ndef message into AS3955 memory AS3955 is an nfc forum type 2 tag platform and as such its memory has to have the layout defined in nfc forum type 2 tag operation specification. in a type 2 tag platform data is stored in memory in the form of tlv blocks. a tlv block has three fields: t field C tag field, l field C length field and v field C value field. ? t field C indicates the type of the tlv block and is one byte long. ? l field C gives the size in bytes of the value field. its 1 or 3 bytes long depending on the size of the value filed. when the size of the value field is between 0 and 254 bytes, the l field is one byte long and has a value between 00h and feh. for sizes of the value field between 255 and 65535 bytes, the l field is 3 bytes long . first byte is ffh indicating that the size will be provided by the following two bytes that can have values between 00ffh and fffeh. ? v field C holds the bytes of the data carried by the tlv block. when the l field is zero or not present, the v field is omitted. for ndef messages the tlv block has a t field value of 03h and the message is stored inside th e v field. the ndef message tlv should always be present in a t2t platform and at a minimum it is an empty ndef message tlv, which is defined as an ndef message tlv with l field equal 00h and no v field. for the ndef message format refer to nfc data exchange format technical specification. two more tlv types can exist in the memory, these are lock control tlv and memory control tlv. when they are present inside the memory, the ndef me ssage tlv should be placed after them. another structure that has to be present in the memory of t2t platform is the capability container (cc). cc contains nfc forum management data. it is co mprised of 4 bytes and always resides at block number 03h of the memory. the AS3955 comes with programmed cc (refer to capability container in the section memory organization of this datasheet), no lock control tlv and no memory control tlv. the ndef message tlv then can be placed already at the beginning of the data area of the memory - block 04h. application information
ams datasheet page 85 [v1-01] 2015-apr-29 document feedback AS3955 ? application information following is an example of an ndef message with one well known url record, which carries the http://www.ams.com url: ? in the ndef message format, the url above will be represented by the bytes: [d1 01 08 55 01 61 6d 73 2e 63 6f 6d]h ? the ndef message tlv will have the content: [03 0c d1 01 08 55 01 61 6d 73 2e 63 6f 6d]h; first byte is 03h C t field value, indicating this is an ndef m essage tlv, second byte is 0ch saying the v field is 12 bytes long, the following 12 bytes are the v field holding the ndef message. the ndef message tlv given above will fully occupy the first 3 blocks of the data area and the first two bytes of the 4th block of the data area (each memory block is 4 bytes long). reading/writing through nfc device nfc devices use the t2t write command to write data into a t2t platform. the t2t write command consists of 6 bytes, 1st byte is the command code C a2h, 2nd byte is the block number where data is to be written and the remaining 4 bytes are the data content. when the execution of the command is successful, the tag will return an ack response C a0h. in case of failure, a nack code will be returned (see error handling section of this datasheet for nack codes). the t2t read command consists of 2 bytes, first byte is the c o m m a n d c o d e a n d i s e q u a l t o 3 0 h , s e c o n d b y t e i s t h e f i r s t b l o c k number from which data will be returned. the response, when successful, will return 4 blocks of data, each block is 4 bytes long, so 16 bytes of data. in case of error, one byte nack response will be returned (see error handling section of AS3955 datasheet for nack codes). AS3955 has to be configured in extended or normal mode in order for an nfc device to write/read ndef data from the eeprom of the tag. an nfc device has to send 4 write commands to the tag to write the ndef message tlv bytes [03 0c d1 01 08 55 01 61 6d 73 2e 63 6f 6d]hex defined in the section above into blocks 04h-07h: 1. [a2 04 03 0c d1 01]hex 2. [a2 05 08 55 01 61]hex 3. [a2 06 6d 73 2e 63]hex 4. [a2 07 6f 6d 00 00]hex the same ndef message tlv bytes can be obtained with a single read command, as the tlv occupies only 4 blocks and the read command returns 16 bytes. in case of longer ndef messages of course several re ads are necessary until the complete message has been read out.
page 86 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? application information reading/writing through spi / i2c an mcu can write the ndef message tlv bytes [03 0c d1 01 08 55 01 61 6d 73 2e 63 6f 6d]hex into blocks 04h-07h by sending the following 4 bytes sequences th rough spi or i2c (as described in the wired interfaces section of this datasheet): writing: 1. [40 08 03 0c d1 01]hex 2. [40 0a 08 55 01 61]hex 3. [40 0c 6d 73 2e 63]hex 4. [40 0e 6f 6d 00 00]hex to read the same data bytes written in blocks 04h C 07h, the mcu should send the bytes sequences below (2 clock cycles for mode and address and 4 addition al clock cycles to read the data sent from AS3955, refer to the wired interfaces section of this datasheet): 1. [7f 08 00 00 00 00]hex 2. [7f 0a 00 00 00 00]hex 3. [7f 0c 00 00 00 00]hex 4. [7f 0e 00 00 00 00]hex using extended mode to switch AS3955 into tunneling mode an nfc device can force the AS3955 in tunneling mode by sending a command via extended to the mcu to switch the AS3955 operating mode from extended to tunneling (refer to extended mode section of this datasheet for implementation details). if the mcu should emulate a t4t after the switch, AS3955 should be sent to se nse state by the mcu with the direct command go to sense (command code d1h) and the nfc device should do a new anti-collision round for proper t4t activation. using tunneling mode to emulate a nfc type 4 tag for t4t emulation the tunneling mode has to be enabled by setting the tun_mod bit of ic_cfg 2 to 1 and the selr to 0x20. with this configuration, once AS3955 has passed anti-collision and entered selcted state, all frames coming from the nfc interface will be pushed to the buffer. that means also the sens_req, all_req, ssd_req, sel_req and slp_req will not be executed by the AS3955, so mcu must send the tag to sleep state on slp_req (with direct command go to sleep) and to sense state (with direct command go to sense) on any of the other commands listed above. the iso14443a-4 command rats should also be handled by the mcu. rats is sent by an nfc device to activate iso14443a-4, on top of which is t4t platform is implemented.
ams datasheet page 87 [v1-01] 2015-apr-29 document feedback AS3955 ? application information if (rxbuffer.size > 0) { switch (rxbuffer.data[0]) { case 0x26: //sens_req err = AS3955directcommand(0xd2); break; case 0x50: //slp_req if ((rxbuffer.size == 2) && (rxbuffer.data[1] == 0x00)) { err = AS3955directcommand(0xd0); } else { err = AS3955directcommand(0xd2); } break; case 0x52: //all_req err = AS3955directcommand(0xd2); break; case 0x93: //ssd_req cascade level 1 err = AS3955directcommand(0xd2); break; case 0x95: // sel_req cascade level 2 err = AS3955directcommand(0xd2); break; case 0x97: // ssd_req select cascade level 1 err = AS3955directcommand(0xd2); break; case 0xe0: //rats if (rxbuffer.size == 2) { //initialize iso14443a-4 (t4t) err = l4tagappinitialize(rxbuffer.data[1]); /*point dispatcher to a function that handles * iso14443a-4 blocks */ hfdispatcher = &handlel4cmd; } else { //send the tag to sleep/sense state err = AS3955directcommand(0xd2); }
page 88 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? application information break; case 0x30: // t2t read case 0xa2: // t2t write case 0xc2: // t2t sector select case 0x60: // AS3955 get_version break; default: //unexpected frame, send the tag to sleep/sense state err = AS3955directcommand(0xd2); break; } } further, the mcu should implement the iso14443a-4 block transmission protocol; select, readbinary and updatebinary commands from iso/iec 7816-4. iso14443a-4 block transmission protocol #define iso14443_4_pcb_i 0x02 /*!< iso14443 _4 data link layer head-er i-block. */ #define iso14443_4_pcb_i_mask 0xc6 /*!< iso14443_4 i-block header mask, nad not supported. */ // added the rfu for the emvco tests #define iso14443_4_pcb_i_chaining 0x10 /*!< iso14443_4 i-block chaining bit. */ #define iso14443_4_pcb_r 0xa2 /*!< iso14443 _4 data link layer head-er r-block. */ #define iso14443_4_pcb_rack iso14443_4_pcb_r /*!< iso14443_4 data link layer r(ack) */ #define iso14443_4_pcb_r_mask 0xe6 /*!< iso14443_4 r-block header mask */ #define iso14443_4_pcb_r_nak_bit 0x10 /*!< iso14443_4 r-block nak bit */ #define iso14443_4_pcb_s 0xc0 /*!< iso14443 _4 data link layer head-er s-block. */ #define iso14443_4_pcb_s_wtx_mask 0xf2 /*!< iso14443_4 s-block header mask */ #define iso14443_4_pcb_s_mask 0xc2 /*!< iso14443_4 s-block header mask */ s8 handlel4cmd() { s8 err = err_none; u8 pcb; /* read the current frame from the hf-interface */ err = AS3955rxnbytes(rxbuffer.data, AS3955_rx_tx_buffer_size, &rxbuffer.size); if (rxbuffer.data[0 ] & iso14443_4_pcb_cid_bit) { if (l4config.cid != rxbuffer.data[1]) { //wrong cid; return err_none; } else { /* reply with cid */
ams datasheet page 89 [v1-01] 2015-apr-29 document feedback AS3955 ? application information dllheadersize = 2; txbuffer.data[1] = l4config.cid; } } else { if (l4config.cid) { return err_none; } else { /* reply without cid */ dllheadersize = 1; } } pcb = rxbuffer.data[0]; err = handlel4block(pcb); return err; } s8 handlel4block(u8 pcb) { s8 err = err_none; /* look at the different commands and decide on further action */ if (iso14443_4_pcb_i == (pcb & iso14443_4_pcb_i_mask)) { if ((pcb & 1) != isodepcnt) { l4fwtstartus = stopwatchmeasure(); l4fwttemp = l4config.fwt_us; txbuffer.size = 0; isodepcnt = !isodepcnt; /* 7. 5.3.2 rule d, standard has a "may" on check-ing the current block number.... */ if (iso14443_4_pcb_i_chaining & pcb) { /* i(1) received */ memcpy(chaininbu ffer + chaininsize, rxbuffer.data + dllheader-size, rxbuffer.size - dllheadersize); chaini nsize += (rxbuffer.size - dllheadersize); txbuffer.data[ 0] = iso14443_4_pcb_rack | isodepcnt | curr_cid_bit; txbuffer.size = dllheadersize; err = AS3955txnbytes(txbuffer.data, txbuffer.size, 0, AS3955_tx_flag_none); } else { /* i(0) received */ txbuffer.data[0] = iso14443_4_pcb_i | isodepcnt | curr_cid_bit; if (chaininsize > 0) { memc py(chaininbuffer + chaininsize, rxbuffer.data +
page 90 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? application information dllheadersize, rxbuffer.size - dllheadersize); ch aininsize += (rxbuffer.size - dllheadersize); memc py(rxbuffer.data + dllhea dersize, chaininbuffer, chaininsize); rxbuffer.size = dllheadersize + chaininsize; chaininsize = 0; } err = nfctagappprocessapdu(dllheadersize); if (txbuffer.size > l4config.fsd) { //start chaining to reader memc py(chainoutbuffer, txbuffer.data + dllheadersize, txbuffer.size - dllheadersize); ch ainoutbuffersize = txbuff er.size - dllheadersize; chainoutsize = 0; txbuffer.data[0] |= iso14443_4_pcb_i_chaining; err = AS3955txnbytes(txbuffer.data, l4config.fsd, 0, AS3955_tx_flag_none); state = l4_wait_for_ack; if (err == err_none) { chainoutsize += l4config.fsd - dllheadersize; } } else { err = AS3955txnbytes(txbuffer.data, txbuffer.size, 0, AS3955_tx_flag_none); AS3955settxframestate(AS3955frametxed); state = l4_idle; } rxbuffer.size = 0; rxbuffer.state = AS3955frameidle; } } else { /* repeat last buffer */ err = AS3955txnbytes(txbuffer.data, txbuffer.size, 0, AS3955_tx_flag_none); } } else if (iso14443_4_pcb_r == (pcb & iso14443_4_pcb_r_mask)) { if ((pcb & 1) != isodepcnt) { if (iso14443_4_pcb_r_nak_bit & pcb)
ams datasheet page 91 [v1-01] 2015-apr-29 document feedback AS3955 ? application information { /* r(nak) received */ /* 7.5.3.2 rule e, note 2 no toggling for nak*/ txbuffer.data[0] = iso14443_4_pcb_rack | isodepcnt | curr_cid_bit; txbuffer.size = dllheadersize; err = AS3955txnbytes(txbuffer.data, txbuffer.size, 0, AS3955_tx_flag_none); rxbuffer.size = 0; rxbuffer.state = AS3955frameidle; } else { /* r(ack) received */ /* 7.5.3.2 rule e, normal toggling*/ isodepcnt = !isodepcnt; if (l4_wait_for_ack == state) { txbuffer.data[0] = iso14443_4_pcb_i | isodepcnt | curr_cid_bit; if ((chainoutbuffersize - chainoutsize + dllheadersize) > l4config.fsd) { //continue with chaining memcpy(txbuffer.data + dllheadersize, chainoutbuffer + chainoutsize, l4config.fsd - dllheadersize); txbuffer.size = l4config.fsd; chainoutsize += l4config.fsd - dllheader-size; txbuffer.data[0] |= iso14443_4_pcb_i_chaining; } else { //last block of chaining memcpy(txbuffer.data + dllheadersize, chainoutbuffer + chainoutsize, chainoutbuffersize - chainoutsize); txbuffer.size = dllheadersize + (chainoutbuffersize C chainoutsize); chainoutsize = 0; chainoutbuffersize = 0; state = l4_initialized; } err = AS3955txnbytes(txbuffe r.data, txbuffer.size, 0, AS3955_tx_flag_none); } else { //r(ack)! txbuffer.data[ 0] = iso14443_4_pcb_rack | isodepcnt | curr_cid_bit; txbuffer.size = dllheadersize; err = AS3955txnbytes(txbuffer.data, txbuffer.size, 0, AS3955_tx_flag_none);
page 92 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? application information } } } else { //r-block same cnt -> repeat last block if (txbuffer.size > 0) { err = AS3955txnbytes(txbuffer.data, txbuffer.size, 0, AS3955_tx_flag_none); } } } else if (iso14443_4_pcb_s == (pcb & iso14443_4_pcb_s)) { //s-block if (iso14443_4_pcb_s_wtx_mask == (pcb & iso14443_4_pcb_s_wtx_mask)) { /* s(wtx) received */ l4fwtstartus = stopwatchmeasure(); txbuffer.data[0] = iso14443_4_pcb_s_wtx_mask | curr_cid_bit; txbuffer.size = dllheadersize; err = AS3955txnbytes(txbuffe r.data, txbuffer.size, 0, AS3955_tx_flag_none); } if (iso14443_4_pcb_s_mask == (pcb & iso14443_4_pcb_s_mask)) { /* s(deselect) received */ txbuffer.data[0] = iso14443_4_pcb_s_mask | curr_cid_bit; txbuffer.size = dllheadersize; err = AS3955txnbytes(txbuffer.data, txbuffer.size, 0, AS3955_tx_flag_none); err = AS3955directcommand(0xd0); //go to sleep state = l4_idle; hfdispatchinitialize(); } } return err; }
ams datasheet page 93 [v1-01] 2015-apr-29 document feedback AS3955 ? application information select, readbinary and updatebinary apdus (iso/iec 7816-4), ndef management //ndef application aid static const u8 ndefappaid[] ={0xd2 , 0x76, 0x00, 0x00, 0x85, 0x01, 0x01}; #define ndef_msg_max_length 0x0204 /*! < ndef message maximum length */ #define ndef_ccf_max_length 0x0f /*! < ndef message maximum length */ u8 ndefmessagefile[ndef_msg_max_length] = { 0x00, 0x31, //nlen 0xd1, //mb=1 me=1 cf=0 sr=1 il=0 tnf=001 0x01, //type length = 1 byte 0x2d, //payload length 45 bytes 0x55, //type 'u' //payload: ams.com/eng/products/rf-pr oducts/rfid/as3953, below the bytes 0x01, //uri identifier code 0x01 me ans prepending http://www. - 5 bytes so far 0x61, 0x6d, 0x73, 0x2e, 0x63, 0x6f , 0x6d, 0x2f, 0x65, 0x6e, 0x67, 0x2f, //12 0x50, 0x72, 0x6f, 0x64, 0x75, 0x63 , 0x74, 0x73, 0x2f, 0x52, 0x46, 0x2d, //12 0x50, 0x72, 0x6f, 0x64, 0x75, 0x63 , 0x74, 0x73, 0x2f, 0x52, 0x46, 0x49, //12 0x44, 0x2f, 0x41, 0x53, 0x33, 0x39, 0x35, 0x33, //8 0xfe,//1 }; #define rxtx_buffer_size 256 u8 ndeffilereadcount = 0; u8 * fileptr = null; bool ndefinitdone = false; u8 ndefccfile[ndef_ccf_max_length] = { 0x00, 0x0f, 0x20, 0x00, 0x1c, 0x00, 0x1a, 0x04, 0x06, 0xe1, 0x04, (u8)(0x0204 >> 8), (u8)(0x0204), 0x00, 0x00, }; s8 nfctagappprocessapdu(int dllinheadersize) { s8 err = err_none; u8 * rxptr = &rxbuffer.data[dllinheadersize]; if (*(rxptr) == 0x00) { txbuffer.size = dllinheadersize + 2; rxptr += 1; switch (*rxptr) { case c_apdu_select_cmd: //select command detected -> check what should be selected switch (*(rxptr + 1))
page 94 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? application information { case c_apdu_select_p1_byname: // check if this is _the_ ndef app select cmd if (*(rxptr + 3) == 0x07 && !memcmp((rxptr + 4), &ndefappaid[0], 7)) { selectedapp = t4appndef; txbuffer.data[dllinheadersize] = 0x90; txbuffer.data[dllinheadersize + 1] = 0x00; } else { //error selectedapp = t4appnone; err = err_param; txbuffer.data[dllinheadersize] = 0x6a; txbuffer.data[dllinheadersize + 1] = 0x82; } break; case c_apdu_select_p1_byid: if (selectedapp == t4appndef) { //read ndef message saved in mcu's internal flash memory flashreadndef(); err = ndefselectfile(rxptr); if (err_none == err) { txbuffer.data[dllinheadersize + 0] = 0x90; txbuffer.data[dllinheadersize + 1] = 0x00; } else { txbuffer.data[dllinheadersize + 0] = 0x6a; txbuffer.data[dllinheadersize + 1] = 0x82; } } else { err = err_param; txbuffer.data[dllinheadersize] = 0x6a; txbuffer.data[dllinheadersize + 1] = 0x82; } break; default: err = err_param; txbuffer.data[dllinheadersize] = 0x6a; txbuffer.data[dllinheadersize + 1] = 0x82; break; } break; case c_apdu_readbin_cmd:
ams datasheet page 95 [v1-01] 2015-apr-29 document feedback AS3955 ? application information if (selectedapp == t4appndef) { err = ndefreadfile(rxptr, dllinheadersize); } else { err = err_param; txbuffer.data[dllinheadersize] = 0x6a; txbuffer.data[dllinheadersize + 1] = 0x82; } break; case c_apdu_updatebin_cmd: if (selectedapp == t4appndef) { err = ndefwritefile(rxptr); if (err_none == err) { txbuffer.data[dllinheadersize + 0] = 0x90; txbuffer.data[dllinheadersize + 1] = 0x00; } else { txbuffer.data[dllinheadersize + 0] = 0x6a; txbuffer.data[dllinheadersize + 1] = 0x82; } } else { err = err_param; txbuffer.data[dllinheadersize] = 0x6a; txbuffer.data[dllinheadersize + 1] = 0x82; } break; default: err = err_param; txbuffer.data[dllinheadersize + 0] = 0x6d; txbuffer.data[dllinheadersize + 1] = 0x00; break; } } else { //unknown class byte err = err_param; txbuffer.data[dllinheadersize + 0] = 0x6d; txbuffer.data[dllinheadersize + 1] = 0x00; } return err; }
page 96 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? application information s8 ndefreadfile (u8 * rxptr, u8 hdrlen) { s8 err = err_none; if (fileptr != null) { // read from file u16 offset = (*(rxptr + 1) << 8) | *(rxptr + 2); u8 length = *(rxptr + 3); memcpy(&txbuffer.data[hdrlen], fileptr + offset, length); txbuffer.data[hdrlen + length] = 0x90; txbuffer.data[hdrlen + length + 1] = 0x00; txbuffer.size = hdrlen + length + 2; } else { txbuffer.data[hdrlen + 0] = 0x6a; txbuffer.data[hdrlen + 1] = 0x82; err = err_param; } return err; } s8 ndefwritefile (u8 * rxptr) { s8 err = err_none; if (fileptr != null) { //write to file u16 offset = (*(rxptr + 1) << 8) | *(rxptr + 2); u8 length = *(rxptr + 3); memcpy(fileptr + offset, rxptr + 4, length); } else { err = err_param; } return err; } s8 ndefselectfile (u8 * rxptr) { s8 err = err_none; fileptr = null; if (*(rxptr + 3) == 0x02) { // id size == 2 -> files if (*(rxptr + 4) == 0xe1) { switch (*(rxptr + 5)) {
ams datasheet page 97 [v1-01] 2015-apr-29 document feedback AS3955 ? application information case 0x03: // ccf selected fileptr = (u8*) ndefccfile; break; case 0x04: //ndef message selected fileptr = (u8*) ndefmessagefile; break; default: err = err_param; break; } } else { err = err_param; } } else { err = err_param; } return err; }
page 98 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? application information references ? [emvco-1] emvco type approval contactless terminal level 1 C pcd digital test be nch & test cases, version 2.3.1a, january 2013 ? [iso14443-3] iso/iec 14443-3:2011(e), identification cards contactless integrated circuit cards proximity cards part 3: initialization and anticollision ? [iso14443-4] iso/iec 14443-4:2008(e), identification cards contactless integr ated circuit(s) cards proximity cards part 4: transmission protocol ? [iso18092] iso/iec 18092:2013 information technology telecommunic ations and information exchange between systems near field communication interface and protocol (nfcip-1) ? [iso7816-3] iso/iec 7816-3:2006, identification cards integrated circuit cards part 3: cards with contacts electrical interf ace and transmission protocols ? [iso7816-4] iso/iec 7816-4:2005, identification cards integrated circuit cards part 4: organization, security and commands for interchange ? [iso7816-6] iso/iec 7816-6:2004, identification cards integrated circuit cards part 6: interindustry data elements for interchange ? [nfc analog] nfc analog sp ecification nfc forum, 11.07.2011, version 1.0 ? [nfc digital] nfc digita l protocol nfc forum, 17.11.2010, version 1.0 ? [ndef] nfc data exchange format (ndef), technical specification nfc forum, 24.07.2006, version 1.0 ? [phdc] personal health device communication), technical specification nfc forum, 27.02.2013, version 1.0 ? [t2t] tag 2 type operation, technical specification nfc forum, 31.05.2011, version 1.1 ? [t4t] tag 4 type operation, technical specification nfc forum, 28.06.2011, version 2.0
ams datasheet page 99 [v1-01] 2015-apr-29 document feedback AS3955 ? package drawings & markings figure 98: package outline drawings mlpd note(s) and/or footnote(s): 1. dimensioning and tolerancing conform to asme y14.5m-1994. 2. all dimensions are in millimeters. angles are in degrees. 3. coplanarity applies to the exposed heat slug as well as the terminal. 4. radius on terminal is optional. 5. n is the total number of terminals. package drawings & markings symbol min nom max a 0.80 0.90 1.00 a1 0 0.02 0.05 a3 0.20 ref l 0.30 0.40 0.50 b 0.18 0.25 0.30 d3.00 bsc e3.00 bsc e0.50 bsc d2 2.23 2.38 2.48 e2 1.49 1.64 1.74 aaa - 0.15 - bbb - 0.10 - ccc - 0.10 - ddd - 0.05 - eee - 0.08 - n10 green rohs
page 100 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? package drawings & markings figure 99: package marking mlpd (i2c) figure 100: package marking mlpd (spi) figure 101: package code mlpd xxxx tracecode as39 55i4 xxxx as39 55s4 xxxx
ams datasheet page 101 [v1-01] 2015-apr-29 document feedback AS3955 ? package drawings & markings figure 102: package outline drawings wl-csp note(s) and/or footnote(s): 1. pin 1=a1 2. ccc coplanarity 3. all dimensions are in m. green rohs
page 102 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? package drawings & markings figure 103: package marking wl-csp figure 104: package code wl-csp xxxx tracecode 3955_s4 xxxx
ams datasheet page 103 [v1-01] 2015-apr-29 document feedback AS3955 ? ordering & contact information figure 105: ordering information note(s) and/or footnote(s): 1. not available yet 2. will be available on request ordering code package marking delivery form configuration AS3955-atdm-s4 mlpd AS3955s4 mini reels spi - eeprom 4kbit AS3955-atdt-s4 mlpd AS3955s4 tape & reel spi - eeprom 4kbit AS3955-atdm-i4 (1) mlpd AS3955i4 mini re els i2c - eeprom 4kbit AS3955-atdt-i4 (1) mlpd AS3955i4 tape & reel i2c - eeprom 4kbit AS3955-awlt-s4 (1) wl-csp 3955_s4 tape & reel spi - eeprom 4kbit AS3955-awlt-i4 (1) wl-csp 3955_i4 tape & reel i2c - eeprom 4kbit AS3955-aswf-s4 (1) sorted wafer na wafer box spi - eeprom 4kbit AS3955-aswf-i4 (1) sorted wafer na wafer box i2c - eeprom 4kbit AS3955-atdm-s2 (2) mlpd AS3955s2 mini reels spi - eeprom 2kbit AS3955-atdt-s2 (2) mlpd AS3955s2 tape & reel spi - eeprom 2kbit AS3955-atdm-i2 (2) mlpd AS3955i2 mini re els i2c - eeprom 2kbit AS3955-atdt-i2 (2) mlpd AS3955i2 tape & reel i2c - eeprom 2kbit AS3955-awlt-s2 (2) wl-csp 3955_s2 tape & reel spi - eeprom 2kbit AS3955-awlt-i2 (2) wl-csp 3955_i2 tape & reel i2c - eeprom 2kbit AS3955-aswf-s2 (2) sorted wafer na wafer box spi - eeprom 2kbit AS3955-aswf-i2 (2) sorted wafer na wafer box i2c - eeprom 2kbit ordering & contact information
page 104 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? ordering & contact information buy our products or get free samples online at: www.ams.com/icdirect technical support is available at: www.ams.com/technical-support provide feedback about this document at: www.ams.com/document-feedback for further information and requests, e-mail us at: ams_sales@ams.com for sales offices, distributors and representatives, please visit: www.ams.com/contact headquarters ams ag tobelbaderstrasse 30 8141 unterpremstaetten austria, europe tel: +43 (0) 3136 500 0 website: www.ams.com
ams datasheet page 105 [v1-01] 2015-apr-29 document feedback AS3955 ? rohs compliant & ams green statement rohs: the term rohs compliant means that ams ag products fully comply with current rohs directives. our semiconductor products do not contain any chemicals for all 6 substance categories, including the requirement that lead not exceed 0.1% by weight in homogeneous materials. where designed to be soldered at high temperatures, rohs compliant products are suitable for use in specif ied lead-free processes. ams green (rohs compliant and no sb/br): ams green defines that in addition to rohs compliance, our products are free of bromine (br) and antimony (sb) based flame retardants (br or sb do not exceed 0.1% by weight in homogeneous material). important information: the information provided in this statement represents ams ag knowledge and belief as of the date that it is provided. ams ag bases its knowledge and belief on information provided by third parties, and makes no representation or warranty as to the accuracy of such information. efforts are unde rway to better integrate information from third parties. ams ag has taken and continues to take reasonable steps to prov ide representative and accurate information but may not have conducted destructive testing or chemical analysis on incoming materials and chemicals. ams ag and ams ag suppliers consider certain information to be proprietary, and thus cas numbers and other limited information may not be available for release. rohs compliant & ams green statement
page 106 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? copyrights & disclaimer copyright ams ag, tobelbader strasse 30, 8141 unterpremstaetten, austria-europe. trademarks registered. all rights reserved. the material herein may not be reproduced, adapted, merged, translated, stored, or used without the prior written consent of the copyright owner. devices sold by ams ag are covered by the warranty and patent indemnification provisions appe aring in its general terms of trade. ams ag makes no warranty, express, statutory, implied, or by description regarding th e information set forth herein. ams ag reserves the right to ch ange specifications and prices at any time and without notice. therefore, prior to designing this product into a system, it is necessary to check with ams ag for current information. this product is intended for use in commercial applications. applications requiring extended temperature range, unusual environmental requirements, or high reliability applications , such as military, medical life-support or life-sustaining equipment are specifically not recommended without additional processing by ams ag for each application. this product is provided by ams ag as is and any express or implied wa rranties, including, but not limited to the implied warranties of merchantability and fitness for a particular purpose are disclaimed. ams ag shall not be liable to recipient or any third party for any damages, including but not limited to personal injury, property damage, loss of profits, loss of use, interruption of business or indirect, special, incidental or consequential damages, of any kind, in connection with or arising out of the furnishing, performance or use of the technical data herein. no obligation or liability to recipient or any th ird party shall arise or flow out of ams ag rendering of technical or other services. copyrights & disclaimer
ams datasheet page 107 [v1-01] 2015-apr-29 document feedback AS3955 ? document status document status product status definition product preview pre-development information in this datasheet is based on product ideas in the planning phase of development. all specifications are design goals without any warranty and are subject to change without notice preliminary datasheet pre-production information in this datasheet is based on products in the design, validation or qualific ation phase of development. the performance and parameters shown in this document are preliminary without any warranty and are subject to change without notice datasheet production information in this datashee t is based on products in ramp-up to full production or full production which conform to specifications in accordance with the terms of ams ag standard warranty as given in the general terms of trade datasheet (discontinued) discontinued information in this datasheet is based on products which conform to specifications in accordance with the terms of ams ag standard warranty as given in the general terms of trade, but these products have been superseded and should not be used for new designs document status
page 108 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? revision information note(s) and/or footnote(s): 1. page and figure numbers for the previous version may diff er from page and figure numbers in the current revision. 2. correction of typographical er rors is not explicitly mentioned. changes from 1-00 (2015-apr-27) to current revision 1-01 (2015-apr-29) page added section spi / i 2 c access modes 55 updated figure 71 66 updated figure 72 66 updated figure 73 67 updated figure 75 68 updated figure 76 68 updated figure 77 69 updated figure 78 69 updated figure 79 70 revision information
ams datasheet page 109 [v1-01] 2015-apr-29 document feedback AS3955 ? content guide 1 general description 2 key benefits & features 3 applications 4 block diagram 6 pin assignments 7 pin description 8absolute maximum ratings 9 electrical characteristics 9 operating conditions 9 dc/ac characteristics for digital inputs and outputs 10 electrical specifications 12 detailed description 12 analog frontend (afe) 13 power management 13 power mode 0 15 power mode 1 15 power mode 2 15 power mode 3 15 interface arbitration 16 arbitration mode 0 16 arbitration mode 1 16 energy harvesting 17 silent mode 17 memory protection 18 passive wake-up 18 chip kill 19 nfc tag functionality 19 communication principle 20 sense state 20 sleep state 20 resolution state 20 selected state 21 authenticated state 21 nfc forum type 2 tag support 22 uid coding 22 first uid byte (uid0) 22 second uid byte (uid1) 22 third uid byte (uid2) 22 last four uid bytes (uid3-uid6) 23 coding of sens_res, sel_req, ack and nack 23 sens_res response 23 sel_res response, cascade level 1 and 2 24 ack response 24 nack response 24 access to uid, sens_res and sel_req during anti-col- lision 24 get version command 26 memory organization 26 4kbit eeprom organization 28 2kbit eeprom organization content guide
page 110 ams datasheet document feedback [v1-01] 2015-apr-29 AS3955 ? content guide 29 uid bytes 29 fabrication data 29 fabrication data fab_cfg0 30 fabrication data fab_cfg1 30 fabrication data fab_cfg2 31 fabrication data fab_cfg3 32 capability container 33 configuration bytes 33 authentication password 34 configuration byte chip_kill 35 configuration byte auth_cnt 36 configuration byte auth_lim 37 configuration byte auth_cfg 37 configuration byte sensr1 38 configuration byte sensr2 38 configuration byte selr 39 configuration byte ic_cfg0 40 configuration byte ic_cfg1 41 configuration byte ic_cfg2 42 configuration bytes mirq_0 and mirq_1 42 AS3955 communication modes 42 standalone nfc type 2 tag mode 42 tunneling mode 43 data transaction in tunneling mode 43 relevant registers, interrupts and commands 44 extended mode 45 nfc device to mcu data flow protocol 47 mcu to nfc device data flow protocol 49 relevant registers, interrupts and commands 50 extended mode timing diagram 52 implementation recommendations 52 error handling 55 wired interfaces 55 spi / i2c access modes 56 spi interface 57 writing data to a ddressable registers (register write mode) 58 reading data from addressable registers (register read mode) 59 writing and reading of eeprom through spi 61 loading transmission data into buffer 62 reading received data from buffer 62 direct command mode 63 spi timing 64 spi electrical connection 65 i2c interface 66 writing data to addressable registers (register write mode) 67 reading data from addressa ble registers (register read mode) 67 writing and reading eeprom through i2c 69 loading transmission data into buffer 69 reading received data from buffer 70 direct command mode
ams datasheet page 111 [v1-01] 2015-apr-29 document feedback AS3955 ? content guide 70 i2c electrical connection 71 interrupt interface description 71 buffer interrupts and buffer status register 72 eeprom read and write 72 data buffer 73 direct commands 73 set default 73 clear buffer 73 restart transceiver 74 disable/enable transceiver 74 transmit buffer 74 transmit ack 74 transmit nack 0-5 74 go to sleep 74 go to sense 74 go to sense / sleep 75 register description 75 registers overview 76 io configuration register 76 ic configuration registers 78 status display registers 79 interrupt registers 81 buffer registers 82 nfc last address register 83 version control register 84 application information 84 writing a ndef mess age into AS3955 memory 85 reading/writing through nfc device 86 reading/writing through spi / i2c 86 using extended mode to switch AS3955 into tunneling mode 86 using tunneling mode to emulate a nfc type 4 tag 98 references 99 package drawings & markings 103 ordering & contact information 105 rohs compliant & ams green statement 106 copyrights & disclaimer 107 document status 108 revision information

▲Up To Search▲

Price & Availability of AS3955

	To Download AS3955 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .