ib technology 1 data sheet H2PROT.pdf 9 pages last revised 04/11/09 micro rwd h2 protocol the microrwd h2 version is a complete reader and ta g acceptance solution for hitag 2 rf transponders. the solution only needs a 700uh an tenna coil connected and 5v dc supply to be a fully featured read/write system. th e module provides internal eeprom memory for holding lists of authorised identity cod es, a manual override switch facility and has led drives to give visual indication of acc eptance. the rwd also has a ttl level rs232 interface that a llows a host system to communicate with the rwd if necessary, so that syst em features can be customised, configurations changed and tag read/write data hand led by the host system. the hitag 2 transponders provide 256 bits (32 bytes ) of read/write eeprom memory arranged as 8 partitioned 32 bit pages. an area of 128 bits (16 bytes) is open for general user data. the hitag 2 transponders are configurabl e for different modes of operation and the mircorwd h2 version supports the high secur ity password mode only. this feature uses two password codes stored both in the h2 transponder and the rwd that are mutually exchanged when a tag is brought i nto the rf field; the tag is only unlocked for read/write operations if these codes e xactly agree. the use of this mutual authentication process, encr ypted communications and a pulsed rf field ensures that the microrwd h2 reader system is very secure. ttl rs232 i/f tx rx cts load screen (if applicable) 700 uh antenna 25ma (sink) o/p drives micro rwd ht green led red led 1k sw overri de +5v 0v gnd +5v dc supply 25ma (sink) (o/p) drives +5v 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 0v gnd 22r nom typical application configuration for micro rwd mod ule
ib technology 2 the microrwd is essentially a proximity system and a read/write range of up to 20cm can be achieved with the same level of reliable com munication and emc resilience. the unique ast (adaptive sampling) feature allows the r wd to continually adjust and re- tune the sampling to allow for inductive changes in the rf field, an essential feature for real-world reliability and robust operation. the co mmunication protocol with the tags can achieve 4k bits/second of data transfer and the total time to read a 32-bit page takes less than 50ms. the microrwd can be easily integrated into almost a ny application; when power (5v dc) is first applied to the board the red and green leds flash once to indicate successful power-up. the device can also check for broken or s horted antenna and can even detect badly tuned antennas; these problems are indicated by the red led flashing continuously until the fault has been rectified. the microrwd will normally have the red led lit unt il a valid card or tag is brought into the rf field. if the tag is accepted as valid then the green led is lit and the output drivers (op0, op1, op2, op3) are switched on. these outputs can be connected together to give up to 100ma of drive current for operating a relay etc. in addition, a switch input is provided for overriding the tag reading operatio n and switching the output drives directly. (hitag 2 is a trademark of philips/nxp semiconduct ors nv) the micro rwd has two basic modes of operation:- remote mode (connected to a host computer or microc ontroller) and standalone mode. 1) remote mode involves connecting to a host serial interface. this is where the stored list of authorised identity codes can be emp ty, effectively authorising any ht2 transponder for subsequent read/write operation s. a simple serial protocol allows a host system to communicate with the micro rwd in order to program new authorised identity codes, change passwords and perform read/write operations to the tag itself. 2) standalone mode is where the ht2 tag identity co des (serial number) are checked against a stored list of authorised codes. if an identity code is matched, the output drives and green led are enabled. effect ively standalone mode occurs when there is no host system communicating w ith the micro rwd. antenna antenna micro rwd chip module micro rwd chip module host system rs232 serial comms standalone mode with internal eeprom holding authorised tag codes for acceptance
ib technology 3 supported transponder types the micro rwd h2 version is designed to communicate with hitag 2 transponders configured in password mode. setting the ht2 transp onder to any other configuration will render them inoperable with this system. the operation of the micro rwd and hitag 2 transponders is described in more d etail at the end of this document. the identification codes described in this text are regarded as the first four bytes (serial number or page 0) of the tag memory array. serial interface this is a basic implementation of rs232. the micro rwd does not support buffered interrupt driven input so it must control a busy (c ts) line to inhibit communications from the host when it is fully occupied with tag co mmunication. it is assumed that the host (such as a pc) can buffer received data. tx, rx and rts signals from the micro rwd are all t tl level and can be converted to +/-10v rs232 levels using an inverting level conver ter device such as the max202 (note the inversion of the ttl levels). the serial communication system and protocol allows for a 10ms window every tag polling cycle indicated by the busy line being low. during this window the host must assert the first start bit and start transmitting d ata. the busy goes high again 10ms after the last stop bit is received. note that only one command sequence is handled at a time. b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 5v 0v idle start 8 bit data stop idle 1 0 ttl levels 5v 0v 5v 0v 5v 0v rwd busy rwd rx rwd tx ready to receive ready to receive rwd cannot receive cmd or data cmd/data cmd/data data rwd tag polling cycle and serial communication busy protocol transmitted or received data byte, 9600 baud, 8 bit , 1 stop, no parity (104us per bit) polling delay (100ms to 600ms) 100ms default host must transmit cmd/data within 10ms of busy goi ng low busy
ib technology 4 command protocol the following commands are supported. the correspon ding acknowledge code should be read back by the host and decoded to confirm tha t the command was received and actioned correctly. the serial bit protocol is 9600 baud, 8 bits, 1 stop, no parity (lsb transmitted first). the status flags returned in the acknowledge byte a re as follows: b7 b6 b5 b4 b3 b2 b1 b0 1 1 1 1 1 1 1 1 | | | | | eeprom er ror (internal eeprom write error) | | | | tag ok (tag ide ntity code matched to list and password exchange su ccessful) | | | rx ok (tag communic ations and acknowledgement ok) | | rs232 error (host serial communications error) | relay enabled flag htrc (or antenna fault) error flag note that bits 6 and 7 are fixed 1s so that an ack nowledge code of d6 (hex) would generally indicate no errors with a matched (or au thorised) ht2 tag present. note also that only the relevant flags are set afte r each command as indicated in the following specification. write tag command to write 4 bytes of data to ht2 32 bit page . if the write was unsuccessful (invalid tag or out of field) then status flags in acknowledge byte indicate error. b7 b0 command: 0 1 0 1 0 1 1 1 (asc ii w, 0x57) argument1: x x x x x n n n (n = h t2 page address 0-7) argument2: d d d d d d d d (d = msb data to write to ht2) argument3: d d d d d d d d argument4: d d d d d d d d argument5: d d d d d d d d (d = lsb data to write to ht2) acknowledge: 1 1 f f f f f x (f = status flags) note that password exchange occurs for write comman d. if no tag present then acknowledge / status byte re ply is 0xc0 if tag present but rwd password check fails then ac knowledge byte reply is 0xc0. if tag present but tag password check fails then ac knowledge byte reply is 0xc4. if tag present and both passwords match then acknow ledge reply is 0xd6.
ib technology 5 read tag command to read 4 bytes of data from ht2 32 bit pag e. if the read was successful, indicated by acknowledge status flags then four byt es of tag data follow. b7 b0 command: 0 1 0 1 0 0 1 0 (ascii r, 0x52) argument1: x x x x x n n n (n = ht2 page address 0-7) acknowledge: 1 1 f f f f f x ( f = status flags) data only follows if read was successful reply1: d d d d d d d d (d = msb data to write to ht2) reply2: d d d d d d d d reply3: d d d d d d d d reply4: d d d d d d d d (d = lsb data to write to ht2) note that password exchange occurs for read command . if no tag present then acknowledge / status byte re ply is 0xc0 if tag present but rwd password check fails then ac knowledge byte reply is 0xc0. if tag present but tag password check fails then ac knowledge byte reply is 0xc4. if tag present and both passwords match then acknow ledge reply is 0xd6 followed by 4-bytes of data. tag status command to return tag status. the acknowledge byte flags indicate general tag status. b7 b0 command: 0 1 0 1 0 0 1 1 (ascii s, 0x53) acknowledge: 1 1 f f f f f x ( f = status flags) card uid command to return card status and uid (unique ident ifier or serial number). the acknowledge byte flags indicate general tag sta tus. b7 b0 command: 0 1 0 1 0 1 0 1 (ascii u, 0x55) acknowledge: 1 1 f f f f f x ( f = status flags) data only follows if card was selected ok with no errors detected. reply1: d d d d d d d d (d =ms byte o f uid/serial number from card) reply2: d d d d d d d d reply3: d d d d d d d d reply4: d d d d d d d d (d =ls byte of uid/serial number from card) note that the card uid command works independently of the password mode. the password authentication only occurs for read/wr ite operations.
ib technology 6 message command to return product and firmware identifier s tring to host. b7 b0 command: 0 1 1 1 1 0 1 0 (ascii z, 0x7a) reply: a ide rwd h2 (secx v1.xx) dd/mm/yy 0x00 returned string identifies author, product descript or, project name, firmware version no. and date of last software change. note that the str ing is always null terminated. the string begins with a unique lower case character th at can be used to identify a particular version of micro rwd. note: 1) the serial communications uses hardware handshak ing to inhibit the host from sending the micro rwd commands while tag interrogat ion is in progress. 2) following the read tag command, if an error flag has been set in the acknowledge code then there will be no following da ta. 3) the serial communications system and protocol al lows for a 10ms window every tag polling cycle indicated by the busy line being low. during this window the host must assert the first start bit a nd start transmitting data. the busy goes high again 10ms after the last stop bit i s received. 4) only one command sequence is handled at a time. program eeprom the micro rwd has some internal eeprom for storing system parameters such as passwords and authorised identity codes. this comma nd sequence allows individual bytes of the eeprom to be programmed with new data. note that due to the fundamental nature of these system parameters, inco rrect data may render the system temporarily inoperable. b7 b0 command: 0 1 0 1 0 0 0 0 (ascii p, 0x50) argument1: n n n n n n n n (n = eeprom memory location 0- 255) argument2: d d d d d d d d (d = data t o write to eeprom) acknowledge: 1 1 x f x x x f (f = status flags)
ib technology 7 internal eeprom memory map byte 0: tag polling rate (x 2.5ms) byte 1: rf on/off lock (0x55 = on, anything else = off, normally set to 0x55) byte 2: reserved (checksum) byte 3: reserved byte 4: password_rwd "m" (sent to ht2) byte 5: password_rwd "i" byte 6: password_rwd "k" byte 7: password_rwd "r" byte 8: reserved byte 9: password_tag 0xaa (reply from ht2) byte 10: password_tag "h" byte 11: password_tag "t start of authorised tag codes. list is terminated w ith ff ff ff ff sequence. list is regarded as empty (all identity codes valid ) if first code sequence in list is (ff ff ff ff). list can hold up to 60 identity codes (serial numbe rs). byte 12: 0xff empty list byte 13: 0xff byte 14: 0xff byte 15: 0xff byte 16: (msb) tag identity code byte 17: byte 18: byte 19: (lsb) byte 20: (msb) tag identity code byte 21: byte 22: byte 23: (lsb) - - - - byte 255: last internal eeprom location method of operation the micro rwd reader only allows full read/write ac cess to the hitag 2 transponders if two levels of security have both succeeded. dur ing the initial communication with the h2 tag the serial number (identity code) is acq uired (4-bytes from h2 page 0). the micro rwd internal eeprom is then checked to see if this serial number is stored in the authorisation list located from byte 12 onwards . if the tag serial number is matched or the list is empty then the tag has passed the fi rst security check (if the micro rwd has 0xff ff ff ff stored at eeprom locations 12 to 15 then the list is treated as empty and all hitag 2 tags are accepted through the first security level). the serial number can be accessed at this stage usi ng the card uid command.
ib technology 8 for read and write commands a second security check is automatically performed by mutually exchanging two passwords between the rw d and the hitag2 tag. if the password exchange operation is successful then memo ry access is allowed and the read and write commands can proceed. the first password is four bytes long (32 bits) and is called the "rwd password" which is located at page 1 in the tag memory. the s econd password is three bytes long (24 bits) and is called the "tag password". it is l ocated at page 3 in the tag from the second to the forth byte, the first byte in page 3 is the tag configuration byte which controls the basic mode of operation. this should b e left as 06 (hex) until the system is fully understood. the configuration byte bit defini tions are described at the end of this document. the rwd and tag passwords are also stored in the mi cro rwd eeprom to allow the reader to verify the tag, and the tag to mutually verify the reader. for read and write commands the micro rwd reader se nds the rwd password to the h2 tag first, which then checks thi s code against its own rwd password. if they agree then the h2 tag sends its tag password to the reader which then checks the code against its stored tag password. if they agree then the second security level has been passed and the read/ write commands can proceed. the use of these two levels of security makes the h itag 2 tags very suitable for secure data storage or for rf identification applications such as locks and access control. hitag 2 memory map (password mode) the memory of the hitag 2 transponder consists of 2 56 bits of very low power eeprom memory which is organised into 8 pages of 32 bits (4 bytes) each. page no. content (32 bit words/ 4 bytes) 0 serial number 1 password rwd (default = m ikr = 4d 49 4b 52 hex) 2 reserved 3 8 bit configuration, 24 bit password tag (default = 06 aa 48 54 hex) 4 read/write page 5 read/write page 6 read/write page 7 read/write page
ib technology 9 hitag 2 configuration byte the 8 bit configuration byte located at the start o f page 3 defines the basic mode of the hitag 2 transponder and whether certain parts of it s memory are locked or open for read/write operations. note that the microrwd h2 on ly supports password mode and can communicate with hitag 2 tags with the configuration byte = 0x06 (or 0x46 with configuration and tag password locked). configuration or passwords must not be changed unle ss the operation of the hitag 2 transponder is underst ood. configuration byte (page 3, byte 0) b7 b6 b5 b4 b3 b2 b1 b0 | | | | 0 1 1 0 | | | 0 = page 6 and 7 read/write | | | 1 = page 6 and 7 read only | | | | | 0 = page 4 and 5 read/write | | 1 = page 4 and 5 read only | | | 0 = page 3 read/write | 1 = page 3 read only, configuration and tag password fixed , this bit is otp | 0 = page 1 an 2 read/write 1 = page 1 no read/no write, page 2 (rwd password) read only, this bit is otp no responsibility is taken for the method of integr ation or final use of micro rwd more information on the micro rwd and other product s can be found at the internet web site: http://www.ibtechnology.co.uk or alternatively contact ib technology by email at: sales@ibtechnology.co.uk
|
