Datasheet

NXP Semiconductors

MF0ICU2

MIFARE Ultralight C - Contactless ticket IC

Product data sheet Rev. 3.3 — 30 July 2019

COMPANY PUBLIC 137633 16 / 36

Table 13. Initial memory organization

Page address Byte number

dec. hex. 0 1 2 3

0 00h SN0 SN1 SN2 BCC0

1 01h SN3 SN4 SN5 SN6

2 02h BCC1 internal 00h 00h

3 03h 00h 00h 00h 00h

4 to 39 04h to 27h not defined not defined not defined not defined

40 28h 00h 00h rfu rfu

41 29h 00h 00h rfu rfu

42 2Ah 30h rfu rfu rfu

43 2Bh 00h rfu rfu rfu

44 2Ch 42h 52h 45h 41h

45 2Dh 4Bh 4Dh 45h 49h

46 2Eh 46h 59h 4Fh 55h

47 2Fh 43h 41h 4Eh 21h

This configuration ensures that the complete memory area is available for

personalization, without knowledge of the authentication key. All lock bytes are set to

zero meaning that no page or functionality is locked. The Counter is set to zero.

Remark: It is strongly recommended to program the authentication key during

personalization in a secure environment and configure the AUTH0 byte at least in a

way that the key and the AUTH0 and AUTH1 bytes can only be overwritten with prior

authentication. This can be achieved by setting AUTH0 to 2Ah.

7.5.11 Counter

The MF0ICU2 features a 16-bit one-way counter, located at the first two bytes of page

29h. The default counter value is 0000h.

The first

valid WRITE or COMPATIBILITY WRITE to address 29h can be performed

with any value in the range between 0001h and FFFFh and corresponds to the initial

counter value. Every consecutive WRITE command, which represents the increment, can

contain values between 0001h and 000Fh. Upon such WRITE command and following

mandatory RF reset, the value written to the address 29h is added to the counter content.

After the initial write, only the lower nibble of the first data byte is used for the increment

value (0h-Fh) and the remaining part of the data is ignored. Once the counter value

reaches FFFFh and an increment is performed via a valid WRITE command, the

MF0ICU2 will reply a NAK. If the sum of counter value and increment is higher than

FFFFh, MF0ICU2 will reply a NAK and will not increment the counter.

An increment by zero (0000h) is always possible, but does not have any impact to the

counter value.

It is recommended to protect the access to the counter functionality by authentication.

An example for the counter functionality is shown in Figure 9.

1 The first valid write is defined as a write to a counter value of 0000h with an argument different than zero