Datasheet

NXP Semiconductors
MF0ICU2
MIFARE Ultralight C - Contactless ticket IC
MF0ICU2 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2019. All rights reserved.
Product data sheet Rev. 3.3 — 30 July 2019
COMPANY PUBLIC 137633 9 / 36
Page address Byte number
Decimal Hex 0 1 2 3
41 29h 16-bit counter 16-bit counter - -
42 2Ah authentication configuration
43 2Bh authentication configuration
44 to 47 2Ch to 2Fh authentication key
7.5.1 UID/serial number
The unique 7 byte serial number (UID) and its two Block Check Character Bytes (BCC)
are programmed into the first 9 bytes of the memory. It therefore covers page 00h, page
01h and the first byte of page 02h. The second byte of page 02h is reserved for internal
data. Due to security and system requirements these bytes are programmed and write-
protected in the production test.
001aai001
MSB LSB
page 0
byte
check byte 0
serial number
part 1
serial number
part 2
manufacturer ID for NXP Semiconductors (04h)0 0 0 0 0 1 0 0
0 1 2 3
page 1
0 1 2 3
page 2
0 1 2 3
internal
check byte 1
lock bytes
Figure 5. UID/serial number
SN0 holds the Manufacturer ID for NXP (04h) according to ISO/IEC14443-3 and ISO/IEC
7816-6 AMD.1.
According to ISO/IEC14443-3 BCC0 is defined as CT
⊕
SN0
⊕
SN1
⊕
SN2.
Abbreviations CT stays for Cascade Tag byte (88h) and BCC1 is defined as SN3
⊕
SN4
⊕
SN5
⊕
SN6.
7.5.2 Lock byte 0 and 1
The bits of byte 2 and byte 3 of page 02h represent the field programmable permanent
read-only locking mechanism. Each page from 03h (OTP) to 0Fh can be individually
locked by setting the corresponding locking bit Lx to logic 1 to prevent further write
access. After locking, the corresponding page becomes read-only memory. To restrict
read access to the memory refer to the authentication functionality (see Section 7.5.5).
The three least significant bits of lock byte 0 are the block-locking bits. Bit 2 deals
with pages 0Ah to 0Fh, bit 1 deals with pages 04h to 09h and bit 0 deals with page
03h (OTP). Once the block-locking bits are set, the locking configuration for the
corresponding memory area is frozen. The functionality of the bits inside the lock bytes 0
and 1 are shown in Table 6.