Datasheet

ManualsBrandsNXP SEMICONDUCTORS ManualsLinear ICsMFRC50001T/0FE,112

1. Introduction

This data sheet describes the functionality of the MFRC500 Integrated Circuit (IC). It

includes the functional and electrical specifications and from a system and hardware

viewpoint gives detailed information on how to design-in the device.

Remark: The MFRC500 supports all variants of the MIFARE Classic, MIFARE 1K and

MIFARE 4K RF identification protocols. To aid readability throughout this data sheet, the

MIFARE Classic, MIFARE 1K and MIFARE 4K products and protocols have the generic

name MIFARE.

2. General description

The MFRC500 is a highly integrated reader IC for contactless communication at

13.56 MHz. The MFRC500 reader IC provides:

• outstanding modulation and demodulation for passive contactless communication

• a wide range of methods and protocols

• pin compatibility with the CLRC632, MFRC530, MFRC531 and SLRC400

All protocol layers of the ISO/IEC 14443 A are supported

The receiver module provides a robust and efficient demodulation/decoding circuitry

implementation for compatible transponder signals (see Section 9.10 on page 30

). The

digital module, manages the complete ISO/IEC 14443 A standard framing and error

detection (parity and CRC). In addition, it supports the fast Crypto1 security algorithm for

authenticating the MIFARE products (see Section 9.12 on page 35

The internal transmitter module (Section 9.9 on page 27

) can directly drive an antenna

designed for a proximity operating distance up to 100 mm without any additional active

circuitry.

A parallel interface can be directly connected to any 8-bit microprocessor to ensure

reader/terminal design flexibility.

MFRC500

The "Original" MIFARE reader solution

Rev. 3.4 — 11 February 2014

048034

Product data sheet

COMPANY PUBLIC

Summary of content (110 pages)

PAGE 1
MFRC500 The "Original" MIFARE reader solution Rev. 3.4 — 11 February 2014 048034 Product data sheet COMPANY PUBLIC 1. Introduction This data sheet describes the functionality of the MFRC500 Integrated Circuit (IC). It includes the functional and electrical specifications and from a system and hardware viewpoint gives detailed information on how to design-in the device. Remark: The MFRC500 supports all variants of the MIFARE Classic, MIFARE 1K and MIFARE 4K RF identification protocols.
PAGE 2
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 3. Features and benefits 3.
PAGE 3
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 5. Quick reference data Table 1. Quick reference data Symbol Parameter Tamb Conditions Min Typ Max Unit ambient temperature 40 - +150 C Tstg storage temperature 40 - +150 C VDDD digital supply voltage 0.5 +5 +6 V VDDA analog supply voltage 0.5 +5 +6 V VDD(TVDD) TVDD supply voltage 0.5 +5 +6 V Vi input voltage (absolute value) on any digital pin to DVSS 0.5 - VDDD + 0.
PAGE 4
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 7.
PAGE 5
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 8. Pinning information OSCIN 1 32 OSCOUT IRQ 2 31 RSTPD MFIN 3 30 VMID MFOUT 4 29 RX TX1 5 28 AVSS TVDD 6 27 AUX TX2 7 26 AVDD TVSS 8 NCS 9 MFRC500 25 DVDD 24 A2 23 A1 NWR/R/NW/nWrite 10 22 A0/nWait NRD/NDS/nDStrb 11 21 ALE/AS/nAStrb DVSS 12 AD0/D0 13 20 D7/AD7 AD1/D1 14 19 D6/AD6 AD2/D2 15 18 D5/AD5 17 D4/AD4 AD3/D3 16 001aal483 Fig 2. MFRC500 pin configuration 8.1 Pin description Table 3.
PAGE 6
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 3.
PAGE 7
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9. Functional description 9.1 Digital interface 9.1.1 Overview of supported microprocessor interfaces The MFRC500 supports direct interfacing to various 8-bit microprocessors. Alternatively, the MFRC500 can be connected to a PC’s Enhanced Parallel Port (EPP). Table 4 shows the parallel interface signals supported by the MFRC500. Table 4.
PAGE 8
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.1.3 Connection to different microprocessor types The connection to various microprocessor types is shown in Table 5. Table 5. MFRC500 pins 9.1.3.
PAGE 9
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.1.3.2 Common read and write strobe address bus (A3 to An) ADDRESS DECODER DEVICE NCS non-multiplexed address ADDRESS DECODER LOW A2 HIGH address bus (A0 to A2) A1 LOW A0 to A2 data bus (D0 to D7) A0 multiplexed address/data (AD0 to AD7) AD0 to AD7 D0 to D7 HIGH Address strobe (AS) ALE Data strobe (NDS) Read/Write (R/NW) DEVICE NCS ALE Data strobe (NDS) NRD NRD Read/Write (R/NW) NWR NWR 001aak608 Fig 4.
PAGE 10
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.2 Memory organization of the EEPROM Table 6. EEPROM memory organization diagram Block MFRC500 Product data sheet COMPANY PUBLIC Byte address Access Memory content Refer to Position Address 0 0 00h to 0Fh R product information field Section 9.2.1 on page 11 1 1 10h to 1Fh R/W Section 9.2.2.
PAGE 11
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.2.1 Product information field (read only) Table 7. Product information field byte allocation Byte 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Symbol CRC Internal Product Serial Number - Product Type Identification Access R R R R R Table 8.
PAGE 12
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution The byte assignment is shown in Table 10. Table 10. 9.2.2.
PAGE 13
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 11.
PAGE 14
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Using this format, 12 bytes of EEPROM memory are needed to store a 6-byte key. This is shown in Figure 6. Master key byte 0 (LSB) 1 5 (MSB) Master key bits k7 k6 k5 k4 k7 k6 k5 k4 k3 k2 k1 k0 k3 k2 k1 k0 k7 k6 k5 k4 k7 k6 k5 k4 k3 k2 k1 k0 k3 k2 k1 k0 k7 k6 k5 k4 k7 k6 k5 k4 k3 k2 k1 k0 k3 k2 k1 k0 EEPROM byte address n n+1 n+2 n+3 n + 10 n + 11 Example 5Ah F0h 5Ah E1h 5Ah A5h 001aak640 Fig 6.
PAGE 15
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution When the microprocessor starts a command, the MFRC500 can still access the FIFO buffer while the command is running. Only one FIFO buffer has been implemented which is used for input and output. Therefore, the microprocessor must ensure that there are no inadvertent FIFO buffer accesses. Table 13 gives an overview of FIFO buffer access during command processing. Table 13.
PAGE 16
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution HiAlert =  64 – FIFOLength   WaterLevel (1) The LoAlert flag bit is set to logic 1 when the FIFOLevel register’s WaterLevel[5:0] bits or less are stored in the FIFO buffer. The trigger is generated by Equation 2: LoAlert = FIFOLength  WaterLevel (2) 9.3.4 FIFO buffer registers and flags Table 14 shows the related FIFO buffer flags in alphabetic order. Table 14.
PAGE 17
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution When the FIFO buffer reaches the HIGH-level indicated by the WaterLevel[5:0] value (see Section 9.3.3 on page 15) and bit HiAlert = logic 1, then the HiAlertIRq flag bit is set to logic 1. When the FIFO buffer reaches the LOW-level indicated by the WaterLevel[5:0] value (see Section 9.3.3 and bit LoAlert = logic 1, then LoAlertIRq flag bit is set to logic 1. Table 15.
PAGE 18
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Example: Writing 3Fh to the InterruptRq register clears all bits. SetIRq is set to logic 0 while all other bits are set to logic 1. Writing 81h to the InterruptRq register sets LoAlertIRq to logic 1 and leaves all other bits unchanged. 9.4.3 Configuration of pin IRQ The logic level of the IRq flag bit is visible on pin IRQ. The signal on pin IRQ can also be controlled using the following IRQPinConfig register bits.
PAGE 19
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.5 Timer unit The timer derives its clock from the 13.56 MHz on-board chip clock. The microprocessor can use this timer to manage timing-relevant tasks.
PAGE 20
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution TStartTxBegin TReloadValue[7:0] TxBegin Event TStartTxEnd PARALLEL IN TxEnd Event START COUNTER/ PARALLEL LOAD TAutoRestart TStartNow Q S COUNTER MODULE (x ≤ x − 1) TRunning Q R TStopNow STOP COUNTER RxEnd Event TStopRxEnd RxBegin Event TStopRxBegin TPreScaler[4:0] 13.56 MHz CLOCK DIVIDER PARALLEL OUT to parallel interface TimerValue[7:0] Counter = 0 ? to interrupt logic: TimerIRq 001aak611 Fig 7.
PAGE 21
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution • transmission of the first bit to the card (TxBegin event) with bit TStartTxBegin = logic 1 • transmission of the last bit to the card (TxEnd event) with bit TStartTxEnd = logic 1 • bit TStartNow is set to logic 1 by the microprocessor Remark: Every start event reloads the timer from the TimerReload register which re-triggers the timer unit.
PAGE 22
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.5.2 Using the timer unit functions 9.5.2.1 Time-out and WatchDog counters After starting the timer using TReloadValue[7:0], the timer unit decrements the TimerValue register beginning with a given start event. If a given stop event occurs, such as a bit being received from the card, the timer unit stops without generating an interrupt.
PAGE 23
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.5.3 Timer unit registers Table 18 shows the related flags of the timer unit in alphabetical order. Table 18.
PAGE 24
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 19. Signal on pins during Hard power-down …continued Symbol Pin Type Description RX 29 I not changed VMID 30 A pulled to VDDA RSTPD 31 I not changed OSCOUT 32 O HIGH 9.6.2 Soft power-down mode Soft power-down mode is entered immediately using the Control register bit PowerDown. All internal current sinks, including the oscillator buffer, are switched off.
PAGE 25
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.7 StartUp phase The events executed during the StartUp phase are shown in Figure 8. StartUp phase states tRSTPD treset tinit Hard powerdown phase Reset phase Initialising phase ready 001aak613 Fig 8. The StartUp procedure 9.7.
PAGE 26
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution To ensure correct detection of the microprocessor interface, the following sequence is executed: • the Command register is read until the 6-bit register value is 00h. On reading the 00h value, the internal initialization phase is complete and the MFRC500 is ready to be controlled • write 80h to the Page register to initialize the microprocessor interface • read the Command register.
PAGE 27
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.9 Transmitter pins TX1 and TX2 The signal on pins TX1 and TX2 is the 13.56 MHz energy carrier modulated by an envelope signal. It can be used to drive an antenna directly, using minimal passive components for matching and filtering (see Section 15.1 on page 91). To enable this, the output circuitry is designed with a very low-impedance source resistance. The TxControl register is used to control the TX1 and TX2 signals. 9.9.
PAGE 28
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.9.2 Antenna operating distance versus power consumption Using different antenna matching circuits (by varying the supply voltage on the antenna driver supply pin TVDD), it is possible to find the trade-off between maximum effective operating distance and power consumption. Different antenna matching circuits are described in the Application note “MIFARE Design of MFRC500 Matching Circuit and Antennas”. 9.9.
PAGE 29
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 22. TX1 and TX2 source resistance of n-channel driver transistor against GsCfgCW or GsCfgMod …continued MANT = Mantissa; EXP= Exponent. GsCfgCW, GsCfgMod (decimal) EXPGsCfgCW, EXPGsCfgMod (decimal) MANTGsCfgCW, RS(ref) MANTGsCfgMod () (decimal) GsCfgCW, GsCfgMod (decimal) EXPGsCfgCW, EXPGsCfgMod (decimal) MANTGsCfgCW, MANTGsCfgMod (decimal) RS(ref) () 10 0 10 0.1000 55 3 7 0.0200 11 0 11 0.0909 46 2 14 0.
PAGE 30
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution adjusted using the ModWidth register. The pulse width (tw) is calculated using Equation 9 where the frequency constant (fclk) = 13.56 MHz. ModWidth + 1 t w = 2 ------------------------------------f clk (9) 9.10 Receiver circuit The MFRC500 uses an integrated quadrature demodulation circuit enabling it to extract the ISO/IEC 14443 A compliant subcarrier from the 13.56 MHz ASK modulated signal applied to pin RX.
PAGE 31
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 9.10.2 Receiver operation In general, the default settings programmed in the StartUp initialization file are suitable for use with the MFRC500 to MIFARE card data communication. However, in some environments specific user settings will achieve better performance. 9.10.2.1 Automatic Q-clock calibration The quadrature demodulation concept of the receiver generates a phase signal (I-clock) and a 90 phase-shifted quadrature signal (Q-clock).
PAGE 32
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 23. Gain factors for the internal amplifier See Table 78 “RxControl1 register bit descriptions” on page 55 for additional information. 9.10.2.3 Register setting Gain factor (dB) (simulation results) 00 20 01 24 10 31 11 35 Correlation circuitry The correlation circuitry calculates the degree of matching between the received and an expected signal.
PAGE 33
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution • digital circuitry: comprising the state machines, encoder and decoder logic etc. • analog circuitry: comprising the modulator, antenna drivers, receiver and amplification circuitry The interface between these two blocks can be configured so that the interface signals are routed to pins MFIN and MFOUT. This makes it possible to connect the analog part of one MFRC500 to the digital part of another device. 9.11.
PAGE 34
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 24. DecoderSource[1:0] values See Table 88 on page 57 for additional information. Number DecoderSource Input signal to decoder [1:0] 0 00 constant 0 1 01 output of the analog part. This is the default configuration 2 10 direct connection to pin MFIN; expects an 847.
PAGE 35
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 27.
PAGE 36
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution WriteE2 EEPROM KEYS from the microcontroller FIFO BUFFER LoadKey LoadKeyE2 KEY BUFFER during Authent1 serial data stream in (plain) CRYPTO1 MODULE serial data stream out (encrypted) 001aak624 Fig 13. Crypto1 key handling block diagram 9.12.2 Authentication procedure The Crypto1 security algorithm enables authentication of MIFARE cards.
PAGE 37
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10. MFRC500 registers 10.1 Register addressing modes Three methods can be used to operate the MFRC500: • initiating functions and controlling data by executing commands • configuring the functional operation using a set of configuration bits • monitoring the state of the MFRC500 by reading status flags The commands, configuration bits and flags are accessed using the microprocessor interface.
PAGE 38
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.2 Register bit behavior Bits and flags for different registers behave differently, depending on their functions. In principle, bits with same behavior are grouped in common registers. Table 30 describes the function of the Access column in the register tables. Table 30. Behavior and designation of register bits Abbreviation Behavior Description R/W read and write These bits can be read and written by the microprocessor.
PAGE 39
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.3 Register overview Table 31.
PAGE 40
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 31.
PAGE 41
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.4 MFRC500 register flags overview Table 32.
PAGE 42
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 32.
PAGE 43
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 32.
PAGE 44
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.1.2 Command register Starts and stops the command execution. Table 35. Command register (address: 01h) reset value: x000 0000b, x0h bit allocation Bit 7 6 Symbol IFDetectBusy 0 Command[5:0] Access R R D Table 36. 10.5.1.
PAGE 45
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.1.4 PrimaryStatus register Bits relating to receiver, transmitter and FIFO buffer status flags. Table 39. PrimaryStatus register (address: 03h) reset value: 0000 0101b, 05h bit allocation Bit 7 Symbol 0 Access R Table 40.
PAGE 46
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.1.5 FIFOLength register Number of bytes in the FIFO buffer. Table 41. FIFOLength register (address: 04h) reset value: 0000 0000b, 00h bit allocation Bit 7 Symbol 0 FIFOLength[6:0] Access R R Table 42. 6 4 3 2 1 0 FIFOLength bit descriptions Bit Symbol Description 7 0 reserved 6 to 0 FIFOLength[6:0] 10.5.1.6 5 gives the number of bytes stored in the FIFO buffer.
PAGE 47
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.1.7 InterruptEn register Control bits to enable and disable passing of interrupt requests. Table 45. InterruptEn register (address: 06h) reset value: 0000 0000b, 00h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol SetIEn 0 TimerIEn TxIEn RxIEn IdleIEn HiAlertIEn LoAlertIEn Access W R/W R/W R/W R/W R/W R/W R/W Table 46.
PAGE 48
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 48. InterruptRq register bit descriptions …continued Bit Symbol Value Description 2 1 command terminates correctly. For example; when the Command register changes its value from any command to the Idle command. If an unknown command is started the IdleIRq bit is set. Microprocessor start-up of the Idle command does not set the IdleIRq bit.
PAGE 49
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.2.3 ErrorFlag register Error flags show the error status of the last executed command. Table 51. Bit 7 6 5 4 3 2 1 0 Symbol 0 KeyErr AccessErr FIFOOvfl CRCErr FramingErr ParityErr CollErr Access R R R R R R R R Table 52.
PAGE 50
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.2.4 CollPos register Bit position of the first bit-collision detected on the RF interface. Table 53. CollPos register (address: 0Bh) reset value: 0000 0000b, 00h bit allocation Bit 7 6 5 4 3 Symbol CollPos[7:0] Access R Table 54. 2 1 0 CollPos register bit descriptions Bit Symbol Description 7 to 0 CollPos[7:0] this register shows the bit position of the first detected collision in a received frame.
PAGE 51
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.2.7 CRCResultMSB register MSB of the CRC coprocessor register. Table 59. CRCResultMSB register (address: 0Eh) reset value: xxxx xxxxb, xxh bit allocation Bit 7 6 5 4 3 2 Symbol CRCResultMSB[7:0] Access R Table 60. 1 0 CRCResultMSB register bit descriptions Bit Symbol Description 7 to 0 CRCResultMSB[7:0] gives the CRC register’s most significant byte value; only valid if CRCReady = logic 1.
PAGE 52
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.3 Page 2: Transmitter and control 10.5.3.1 Page register Selects the page register; see Section 10.5.1.1 “Page register” on page 43. 10.5.3.2 TxControl register Controls the logical behavior of the antenna pins TX1 and TX2. Table 63.
PAGE 53
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.3.3 CwConductance register Selects the conductance of the antenna driver pins TX1 and TX2. Table 65. CwConductance register (address: 12h) reset value: 0011 1111b, 3Fh bit allocation Bit 7 6 5 4 3 2 Symbol 00 GsCfgCW[5:0] Access R/W R/W Table 66.
PAGE 54
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.3.6 ModWidth register Selects the pulse-modulation width. Table 71. ModWidth register (address: 15h) reset value: 0001 0011b, 13h bit allocation Bit 10.5.3.7 7 6 5 4 3 2 Symbol ModWidth[7:0] Access R/W 1 Table 72.
PAGE 55
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.4 Page 3: Receiver and decoder control 10.5.4.1 Page register Selects the page register; see Section 10.5.1.1 “Page register” on page 43. 10.5.4.2 RxControl1 register Controls receiver operation. Table 77. RxControl1 register (address: 19h) reset value: 0111 0011b, 73h bit allocation Bit 7 6 5 3 2 1 0 Symbol 0 111 00 Gain[1:0] Access R/W R/W R/W R/W Table 78.
PAGE 56
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.4.4 BitPhase register Selects the bit-phase between transmitter and receiver clock. Table 81. BitPhase register (address: 1Bh) reset value: 1010 1101b, ADh bit allocation Bit 7 6 5 4 3 Symbol BitPhase[7:0] Access R/W 2 1 0 Table 82.
PAGE 57
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.4.7 RxControl2 register Controls decoder behavior and defines the input source for the receiver. Table 87. RxControl2 register (address: 1Eh) reset value: 0100 0001b, 41h bit allocation Bit 7 6 Symbol RcvClkSelI RxAutoPD 0000 DecoderSource[1:0] Access R/W R/W R/W R/W Table 88.
PAGE 58
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.5 Page 4: RF Timing and channel redundancy 10.5.5.1 Page register Selects the page register; see Section 10.5.1.1 “Page register” on page 43. 10.5.5.2 RxWait register Selects the time interval after transmission, before the receiver starts. Table 91. RxWait register (address: 21h) reset value: 0000 0101b, 06h bit allocation Bit 7 5 4 3 Symbol RxWait[7:0] Access R/W Table 92. 10.5.5.
PAGE 59
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 94. Bit Symbol Value Function 1 ParityOdd 1 odd parity is generated or expected[1] 0 even parity is generated or expected 1 a parity bit is inserted in the transmitted data stream after each byte and expected in the received data stream after each byte (MIFARE, ISO/IEC 14443 A) 0 no parity bit is inserted or expected 0 [1] 10.5.5.
PAGE 60
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 100. PreSet25 register bit descriptions 10.5.5.7 Bit Symbol Value Description 7 to 0 00000000 0 these values must not be changed MFOUTSelect register Selects the internal signal applied to pin MFOUT. Table 101. MFOUTSelect register (address: 26h) reset value: 0000 0000b, 00h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol 00000 MFOUTSelect[2:0] Access R/W R/W Table 102.
PAGE 61
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.6 Page 5: FIFO, timer and IRQ pin configuration 10.5.6.1 Page register Selects the page register; see Section 10.5.1.1 “Page register” on page 43. 10.5.6.2 FIFOLevel register Defines the levels for FIFO underflow and overflow warning. Table 105. FIFOLevel register (address: 29h) reset value: 0000 1000b, 08h bit allocation Bit 7 6 5 4 3 2 Symbol 00 WaterLevel[5:0] Access R/W R/W 1 0 Table 106.
PAGE 62
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.6.4 TimerControl register Selects start and stop conditions for the timer. Table 109. TimerControl register (address: 2Bh) reset value: 0000 0110b, 06h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol 0000 TStopRxEnd TStopRxBegin TStartTxEnd TStartTxBegin Access R/W R/W R/W R/W R/W Table 110.
PAGE 63
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.6.6 IRQPinConfig register Configures the output stage for pin IRQ. Table 113. IRQPinConfig register (address: 2Dh) reset value: 0000 0010b, 02h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol 000000 IRQInv IRQPushPull Access R/W R/W R/W Table 114. IRQPinConfig register bit descriptions Bit Symbol Value Description 7 to 2 000000 0 these values must not be changed 1 IRQInv 0 10.5.6.
PAGE 64
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.8 Page 7: Test control 10.5.8.1 Page register Selects the page register; see Section 10.5.1.1 “Page register” on page 43. 10.5.8.2 Reserved register 39h Table 118. Reserved register (address: 39h) reset value: xxxx xxxxb, xxh bit allocation Bit 7 6 5 4 3 Symbol xxxxxxxx Access W 2 1 0 Remark: This register is reserved for future use. 10.5.8.3 TestAnaSelect register Selects analog test signals. Table 119.
PAGE 65
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.8.4 Reserved register 3Bh Table 121. Reserved register (address: 3Bh) reset value: xxxx xxxxb, xxh bit allocation Bit 7 6 5 4 3 Symbol xxxxxxxx Access W 2 1 0 Remark: This register is reserved for future use. 10.5.8.5 Reserved register 3Ch Table 122.
PAGE 66
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.5.8.7 Reserved registers 3Eh, 3Fh Table 125. Reserved register (address: 3Eh, 3Fh) reset value: xxxx xxxxb, xxh bit allocation Bit 7 6 5 4 3 Symbol xxxxxxxx Access W 2 1 0 Remark: This register is reserved for future use. 11. MFRC500 command set MFRC500 operation is determined by an internal state machine capable of performing a command set. The commands can be started by writing the command code to the Command register.
PAGE 67
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 126. MFRC500 commands overview …continued Command Value Action FIFO communication Arguments and data sent Data received Transceive[1] 1Eh data stream transmits data from FIFO buffer to the card and automatically activates the receiver after transmission. The receiver waits until the time defined in the RxWait register has elapsed before starting. See Section 11.2.3 on page 75.
PAGE 68
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.1.1 Basic states 11.1.2 StartUp command 3Fh Table 127. StartUp command 3Fh Command Value Action Arguments and data Returned data StartUp 3Fh runs the reset and initialization phase - - Remark: This command can only be activated by a Power-On or Hard reset. The StartUp command runs the reset and initialization phases. It does not need or return, any data.
PAGE 69
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.2 Commands for card communication The MFRC500 is a fully ISO/IEC 14443 A compliant reader IC. This enables the command set to be more flexible and generalized when compared to dedicated MIFARE reader ICs. Section 11.2.1 to Section 11.2.5 describe the command set for ISO/IEC 14443 A card communication and related communication protocols. 11.2.1 Transmit command 1Ah Table 129.
PAGE 70
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.2.1.2 RF channel redundancy and framing Each ISO/IEC 14443 A frame transmitted consists of a Start Of Frame (SOF) pattern, followed by the data stream and is closed by an End Of Frame (EOF) pattern. These different phases of the transmission sequence can be monitored using the PrimaryStatus register ModemState[2:0] bits; see Section 11.2.4 on page 75.
PAGE 71
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution TxLastBits[2:0] TxLastBits = 0 FIFOLength[6:0] 01h 00h FIFO empty TxData 7 0 7 0 7 check FIFO empty accept further data 001aak619 Fig 15. Timing for transmitting byte oriented frames As long as the internal signal accept further data is logic 1, data can be written to the FIFO buffer. The MFRC500 appends this data to the data stream transmitted using the RF interface.
PAGE 72
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Figure 16 also shows write access to the FIFOData register just before the FIFO buffer’s status is checked. This leads to FIFO empty state being held LOW which keeps the accept further data active. The new byte written to the FIFO buffer is transmitted using the RF interface. Accept further data is only changed by the check FIFO empty function. This function verifies FIFO empty for one bit duration before the last expected bit transmission.
PAGE 73
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.2.2.2 RF channel redundancy and framing The decoder expects the SOF pattern at the beginning of each data stream. When the SOF is detected, it activates the serial-to-parallel converter and gathers the incoming data bits. Every completed byte is forwarded to the FIFO buffer. If an EOF pattern is detected or the signal strength falls below the RxThreshold register MinLevel[3:0] bits setting, both the receiver and the decoder stop.
PAGE 74
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 132.
PAGE 75
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 133. Communication error table Cause Flag bit Received data did not start with the SOF pattern FramingErr CRC block is not equal to the expected value CRCErr Received data is shorter than the CRC block CRCErr The parity bit is not equal to the expected value (i.e. a bit-collision, not parity) ParityErr A bit-collision is detected CollErr 11.2.3 Transceive command 1Eh Table 134.
PAGE 76
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.2.
PAGE 77
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.3 EEPROM commands 11.3.1 WriteE2 command 01h Table 136. WriteE2 command 01h Command Value Action FIFO Arguments and data WriteE2 01h get data from FIFO buffer and write it to the EEPROM Returned data start address LSB - start address MSB - data byte stream - The WriteE2 command interprets the first two bytes in the FIFO buffer as the EEPROM start byte address.
PAGE 78
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.3.1.2 Timing diagram Figure 18 shows programming five bytes into the EEPROM. tprog,del NWR data write E2 addr LSB addr byte 0 MSB byte 1 byte 2 byte 3 Idle command byte 4 WriteE2 command active EEPROM programming tprog tprog tprog programming byte 0 programming byte 1, byte 2 and byte 3 programming byte 4 E2Ready TxIRq 001aak623 Fig 18.
PAGE 79
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.3.2 ReadE2 command 03h Table 137. ReadE2 command 03h Command Value Action Arguments Returned data ReadE2 03h start address LSB data bytes reads EEPROM data and stores it in the FIFO buffer start address MSB number of data bytes The ReadE2 command interprets the first two bytes stored in the FIFO buffer as the EEPROM starting byte address. The next byte specifies the number of data bytes returned.
PAGE 80
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.4.1.2 Relevant LoadConfig command error flags Valid EEPROM starting byte addresses are between 10h and 60h. Copying from block 8h to 1Fh (keys) is restricted. Reading from these addresses sets the flag AccessErr = logic 1. Addresses above 1FFh are taken as modulo 200h; see Section 9.2 on page 10 for the EEPROM memory organization. 11.4.2 CalcCRC command 12h Table 139.
PAGE 81
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.5 Error handling during command execution If an error is detected during command execution, the PrimaryStatus register Err flag is set. The microprocessor can evaluate the status flags in the ErrorFlag register to get information about the cause of the error. Table 141.
PAGE 82
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution The LoadKey command interprets the first twelve bytes it finds in the FIFO buffer as the key when stored in the correct key format as described in Section 9.2.3.1 “Key format” on page 13. When the twelve argument bytes are available in the FIFO buffer they are checked and, if valid, are copied into the key buffer.
PAGE 83
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.6.4.1 Authent2 command effects If the Authent2 command is successful, the authenticity of card and the MFRC500 are proved. This automatically sets the Crypto1On control bit. When bit Crypto1On = logic 1, all further card communication is encrypted using the Crypto1 security algorithm. If the Authent2 command fails, bit Crypto1On is cleared (Crypto1On = logic 0).
PAGE 84
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 13.2 Current consumption Table 148.
PAGE 85
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Pin RSTPD has Schmitt trigger CMOS characteristics. In addition, it is internally filtered by a RC low-pass filter which causes a propagation delay on the reset signal. Table 151. RSTPD input pin characteristics Symbol Parameter Conditions ILI input leakage current Vth threshold voltage tPD Min Typ Max Unit 1.0 - A +1.0 positive-going threshold; CMOS = VDDD < 3.6 V 0.65VDDD - 0.
PAGE 86
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 13.3.3 Antenna driver output pin characteristics The source conductance of the antenna driver pins TX1 and TX2 for driving the HIGH-level can be configured using the CwConductance register’s GsCfgCW[5:0] bits, while their source conductance for driving the LOW-level is constant. The antenna driver default configuration output characteristics are specified in Table 154. Table 154.
PAGE 87
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution tLHLL ALE tSLRWL tRWHSH NCS tLLRWL tRWHRWL tRWLRWH tRWHRWL NWR NRD tAVLL D0 to D7 tWLQV tRLDV tLLAX A0 to A2 tWHDX tRHDZ D0 to D7 Multiplexed address bus tAVRWL A0 to A2 tWHAX A0 to A2 Separated address bus 001aaj638 Fig 19. Separate read/write strobe timing diagram Remark: The signal ALE is not relevant for separate address/data bus and the multiplexed addresses on the data bus do not care.
PAGE 88
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 156.
PAGE 89
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 157.
PAGE 90
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 13.4.4 Clock frequency The clock input is pin OSCIN. Table 158. Clock frequency Symbol Parameter Conditions Min Typ Max Unit fclk clock frequency checked by the clock filter - 13.56 - MHz clk clock duty cycle 40 50 60 % tjit jitter time of clock edges - - 10 ps The clock applied to the MFRC500 acts as a time constant for the synchronous system’s encoder and decoder.
PAGE 91
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 15. Application information 15.1 Typical application 15.1.1 Circuit diagram Figure 22 shows a typical application where the antenna is directly matched to the MFRC500: DVDD Reset AVDD TVDD DVDD RSTPD AVDD TVDD control lines C1 L0 data bus TX1 MICROPROCESSOR BUS C0 MICROPROCESSOR C2a TVSS C0 L0 IRQ C2b C1 TX2 DEVICE IRQ C3 R1 RX R2 VMID DVSS OSCIN OSCOUT AVSS 13.56 MHz C4 100 nF 15 pF 15 pF 001aak625 Fig 22.
PAGE 92
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution A multilayer board is recommended to implement a low-pass filter as shown in Figure 22. The low-pass filter consists of the components L0 and C0. The recommended values are given in Application notes MICORE reader IC family; Directly Matched Antenna Design Ref. 1 and MIFARE (14443 A) 13.56 MHz RFID Proximity Antennas Ref. 2. Remark: To achieve best performance, all components must be at least equal in quality to those recommended.
PAGE 93
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 15.1.2.4 Antenna coil The precise calculation of the antenna coil’s inductance is not practicable but the inductance can be estimated using Equation 10. We recommend designing an antenna that is either circular or rectangular. I1 1.
PAGE 94
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 15.2.1 Measurements using the serial signal switch Using the serial signal switch on pin MFOUT, data is observed that is sent to the card or received from the card. Table 160 gives an overview of the different signals available. Table 160. Signal routed to pin MFOUT 15.2.1.
PAGE 95
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution (1) (2) (3) 10 μs per division 001aak626 (1) MFOUTSelect[2:0] = 3; serial data stream; 2 V per division. (2) MFOUTSelect[2:0] = 2; serial data stream; 2 V per division. (3) RFOut; 1 V per division. Fig 23. TX control signals 15.2.1.2 RX control Figure 24 shows an example of ISO/IEC 14443 A communication which represents the beginning of a card’s answer to a request signal.
PAGE 96
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution (1) (2) (3) 10 μs per division 001aak627 (1) RFOut; 1 V per division. (2) MFOUTSelect[2:0] = 4; Manchester with subcarrier; 2 V per division. (3) MFOUTSelect[2:0] = 5; Manchester; 2 V per division. Fig 24. RX control signals 15.2.2 Analog test signals The analog test signals can be routed to pin AUX by selecting them using the TestAnaSelect register TestAnaOutSel[4:0] bits. Table 161.
PAGE 97
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 161. Analog test signal selection …continued Value Signal Name Description B VEvalR evaluation signal from the right half-bit C VTemp temperature voltage derived from band gap D reserved reserved for future use E reserved reserved for future use F reserved reserved for future use 15.2.3 Digital test signals Digital test signals can be routed to pin MFOUT by setting bit SignalToMFOUT = logic 1.
PAGE 98
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution RX reference VRxAmpQ VCorrDQ VCorrNQ VEvalR VEvalL s_data s_valid 50 μs per division 001aak628 Fig 25. ISO/IEC 14443 A receiving path Q-clock MFRC500 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.4 — 11 February 2014 048034 © NXP B.V. 2014. All rights reserved.
PAGE 99
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 16. Package outline SO32: plastic small outline package; 32 leads; body width 7.5 mm SOT287-1 D E A X c y HE v M A Z 17 32 Q A2 A (A 3) A1 pin 1 index θ Lp L 16 1 0 detail X w M bp e 5 10 mm scale DIMENSIONS (inch dimensions are derived from the original mm dimensions) UNIT A max. A1 A2 A3 bp c D (1) E (1) e HE L Lp Q v w y Z (1) mm 2.65 0.3 0.1 2.45 2.25 0.25 0.49 0.36 0.27 0.18 20.7 20.
PAGE 100
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 17. Abbreviations Table 163.
PAGE 101
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 19. Revision history Table 164. Revision history Document ID Release date Data sheet status Change notice Supersedes MFRC500 v. 3.
PAGE 102
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 20. Legal information 20.1 Data sheet status Document status[1][2] Product status[3] Definition Objective [short] data sheet Development This document contains data from the objective specification for product development. Preliminary [short] data sheet Qualification This document contains data from the preliminary specification. Product [short] data sheet Production This document contains the product specification.
PAGE 103
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Export control — This document as well as the item(s) described herein may be subject to export control regulations. Export might require a prior authorization from competent authorities. Quick reference data — The Quick reference data is an extract of the product data given in the Limiting values and Characteristics sections of this document, and as such is not complete, exhaustive or legally binding.
PAGE 104
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 22. Tables Table 1. Table 2. Table 3. Table 4. Table 5. Table 6. Table 7. Table 8. Table 9. Table 10. Table 11. Table 12. Table 13. Table 14. Table 15. Table 16. Table 17. Table 18. Table 19. Table 20. Table 21. Table 22. Table 23. Table 24. Table 25. Table 26. Table 27. Table 28. Table 29. Table 30. Table 31. Table 32. Table 33. Table 34. Table 35. Quick reference data . . . . . . . . . . . . . . . . . . . . .3 Ordering information . .
PAGE 105
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 68. PreSet13 register bit descriptions . . . . . . . . . .53 Table 69. PreSet14 register (address: 14h) reset value: 0001 1001b, 19h bit allocation . . . . . . . . . . . . .53 Table 70. PreSet14 register bit descriptions . . . . . . . . . .53 Table 71. ModWidth register (address: 15h) reset value: 0001 0011b, 13h bit allocation . . . . . . . . . . . . .54 Table 72. ModWidth register bit descriptions . . . . . . . . . .54 Table 73.
PAGE 106
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution Table 136. WriteE2 command 01h . . . . . . . . . . . . . . . . . .77 Table 137. ReadE2 command 03h . . . . . . . . . . . . . . . . . .79 Table 138. LoadConfig command 07h . . . . . . . . . . . . . . .79 Table 139. CalcCRC command 12h . . . . . . . . . . . . . . . . .80 Table 140. CRC coprocessor parameters . . . . . . . . . . . .80 Table 141. ErrorFlag register error flags overview . . . . . .81 Table 142. LoadKeyE2 command 0Bh . . . . . .
PAGE 107
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 23. Figures Fig 1. Fig 2. Fig 3. Fig 4. Fig 5. Fig 6. Fig 7. Fig 8. Fig 9. Fig 10. Fig 11. Fig 12. Fig 13. Fig 14. Fig 15. Fig 16. Fig 17. Fig 18. Fig 19. Fig 20. Fig 21. Fig 22. Fig 23. Fig 24. Fig 25. Fig 26. MFRC500 block diagram . . . . . . . . . . . . . . . . . . . .4 MFRC500 pin configuration . . . . . . . . . . . . . . . . . .5 Connection to microprocessor: separate read and write strobes . . . . . . . . . . . . . . . . . . . . . .
PAGE 108
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 24. Contents 1 2 3 3.1 4 5 6 7 8 8.1 9 9.1 9.1.1 9.1.2 9.1.3 9.1.3.1 9.1.3.2 9.1.3.3 9.2 9.2.1 9.2.2 9.2.2.1 9.2.2.2 9.2.2.3 9.2.3 9.2.3.1 9.2.3.2 9.3 9.3.1 9.3.1.1 9.3.2 9.3.3 9.3.4 9.4 9.4.1 9.4.2 9.4.2.1 9.4.2.2 9.4.3 9.4.4 9.5 9.5.1 9.5.1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 General description . . . . . . . . . . . . . . . . . . . . . . 1 Features and benefits . . . . . . . . . . . . . . . . . . . .
PAGE 109
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 10.1.3 10.2 10.3 10.4 10.5 10.5.1 10.5.1.1 10.5.1.2 10.5.1.3 10.5.1.4 10.5.1.5 10.5.1.6 10.5.1.7 10.5.1.8 10.5.2 10.5.2.1 10.5.2.2 10.5.2.3 10.5.2.4 10.5.2.5 10.5.2.6 10.5.2.7 10.5.2.8 10.5.3 10.5.3.1 10.5.3.2 10.5.3.3 10.5.3.4 10.5.3.5 10.5.3.6 10.5.3.7 10.5.3.8 10.5.4 10.5.4.1 10.5.4.2 10.5.4.3 10.5.4.4 10.5.4.5 10.5.4.6 10.5.4.7 10.5.4.8 10.5.5 10.5.5.1 10.5.5.2 10.5.5.3 10.5.5.4 10.5.5.5 10.5.5.6 10.5.5.7 10.5.5.8 10.5.
PAGE 110
MFRC500 NXP Semiconductors The "Original" MIFARE reader solution 11.4.1.1 Register assignment . . . . . . . . . . . . . . . . . . . . 79 11.4.1.2 Relevant LoadConfig command error flags . . 80 11.4.2 CalcCRC command 12h . . . . . . . . . . . . . . . . . 80 11.4.2.1 CRC coprocessor settings . . . . . . . . . . . . . . . 80 11.4.2.2 CRC coprocessor status flags . . . . . . . . . . . . 80 11.5 Error handling during command execution . . . 81 11.6 MIFARE security commands . . . . . . . . . . . . . 81 11.6.