View MF0UL2101DA8_5909217.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

1. general description nxp semiconductors devel oped the mifare ultralight ev1 mf0ulx1 for use in a contactless smart ticket, smar t card or token in combinat ion with a proximity coupling device (pcd). the mf0ulx1 is designed to work in an iso/iec 14443 type a compliant environment (see ref. 1 ). the target applications include single trip or lim ited use tickets in public transportation networks, loyalty cards or day passes for events. the mf0ulx1 serves as a replacement for conventional ti cketing solutions such as paper tickets, magnetic stripe tickets or coins. it is also a perfect ticketing coun terpart to contactless card families such as mifare desfire or mifare plus. the mifare ultralight ev1 is succeeding the mi fare ultralight ticketing ic and is fully functional backwards compatible. its enhanced feature and command set enable more efficient implementations and offer more flexibility in system designs. the mechanical and electrical specifications of mifare ultralight ev1 are tailored to meet the requirements of inlay and paper ticket manufacturers. 1.1 contactless energy and data transfer in a mifare system, the mf0ulx1 is connected to a coil with a few turns. the mf0ulx1 fits the tfc.0 (edmondson) and tfc.1 (iso) ticket formats as defined in ref. 8 . the mf0ulx1 chip, which features a 17 pf on-chip resonance capacitor, supports both tfc.1 and tfc.0 ticket formats. 1.2 anticollision an intelligent anticollision functi on allows more than one ca rd to operate in the field simultaneously. the anticollision algorithm selects each card individually. it ensures that the execution of a transaction with a select ed card is performed correctly without interference from another card in the field. mf0ulx1 mifare ultralight ev1 - contactless ticket ic rev. 3.0 ? 19 february 2013 234530 product data sheet company public fig 1. contactless system aaa-006271 energy data iso/iec 14443 a pcd
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 2 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 1.3 simple integration and user convenience the mf0ulx1 is designed for simple integration and user convenience which allows complete ticketing transactions to be handled in less than 35 ms. 1.4 security ? manufacturer programmed 7-byte uid for each device ? 32-bit user definable one-time programmable (otp) area ? 3 independent 24-bit true one-way counters ? field programmable read-only locking function per page (per 2 pages for the extended memory section) ? ecc based originality signature ? 32-bit password protection to prevent unintended memory operations 1.5 naming conventions table 1. naming conventions mf0ulx101dyy description mf mifare family 0 ultralight product family ul product: mifare ultralight x one character identifier defining the memory size 1... 640 bit total memory, 384 bit free user memory 2... 1312 bit total memory, 1024 bit free user memory dyy yy defining the delivery type uf... bare die, 75 ? m thickness, au bumps, e-map file ud... bare die, 120 ? m thickness, au bumps, e-map file a8... moa8 contactless module
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 3 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 2. features and benefits 2.1 eeprom 3. applications 4. quick reference data [1] lcr meter, t amb = 22 ? c, f i = 13.56 mhz, 2 v rms. ? contactless transmission of data and supply energy ? operating distance up to 100 mm depending on antenna geometry and reader configuration ? operating frequency of 13.56 mhz ? data transfer of 106 kbit/s ? data integrity of 16 -bit crc, parity, bit coding, bit counting ? true anticollision ? 7 byte serial number (cascade level 2 according to iso/iec 14443-3) ? typical ticketing transaction: < 35 ms ? fast counter transaction: < 10 ms ? 640-bit or 1312-bit, organized in 20 or 41 pages with 4 bytes per page ? first 512 bits compatible to mf0icu1 ? field programmable read-only locking function per page for the first 512 bits ? field programmable read-only locking function per double page above the first 512 bits ? 32-bit user definable one-time programmable (otp) area ? 384-bit or 1024-bit freely available user read/write area (12 or 32 pages) ? 3 independent, true one-way 24-bit counters on top of the user area ? anti-tearing support for counters, otp area and lock bits ? configurable password protection with optional limit of unsuccessful attempts ? ecc based originality signature ? data retention time of 10 years ? write endurance 100.000 cycles ? write endurance for one-way counters 1.000.000 cycles ? public transportation ? loyalty ? event ticketing table 2. quick reference data symbol parameter conditions min typ max unit c i input capacitance [1] - 17.0 - pf f i input frequency - 13.56 - mhz eeprom characteristics t ret retention time t amb = 22 ? c10 - - year n endu(w) write endurance t amb = 22 ? c 100000 - - cycle n endu(w) write endurance counters t amb = 22 ? c 100000 1000000 - cycle
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 4 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 5. ordering information 6. block diagram table 3. ordering information type number package name description version mf0ul1101duf ffc bump 8 inch wafer, 75 ? m thickness, on film frame carrier, electronic fail die marking according to secs-ii format), au bumps, 384 bit user memory, 17 pf input capacitance - mf0ul1101dud ffc bump 8 inch wafer, 120 ? m thickness, on film frame carrier, electronic fail die marking according to secs-ii format), au bumps, 384 bit user memory, 17 pf input capacitance - mf0ul2101duf ffc bump 8 inch wafer, 75 ? m thickness, on film frame carrier, electronic fail die marking according to secs-ii format), au bumps, 1024 bit user memory, 17 pf input capacitance - mf0ul2101dud ffc bump 8 inch wafer, 120 ? m thickness, on film frame carrier, electronic fail die marking according to secs-ii format), au bumps, 1024 bit user memory, 17 pf input capacitance - MF0UL2101DA8 moa8 plastic lead less module carrier package; 35 mm wide tape, 1024 bit user memory, 17 pf input capacitance sot500-4 fig 2. block diagram of mf0ulx1 aaa-006272 antenna rf-interface digital control unit eeprom anticollision command interpreter eeprom interface
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 5 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 7. pinning information 7.1 pinning the pinning for the mf0ulx1dax is shown figure 3 for a contactless moa8 module. fig 3. pin configuration for sot500-4 (moa8) table 4. pin allocation table pin symbol la la antenna coil connection la lb lb antenna coil connection lb aaa-006273 la lb top view
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 6 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8. functional description 8.1 block description the mf0ulx1 chip consists of a 640-bit or a 1312-bit eepr om, rf interface and digital control unit (dcu). energy and data are tran sferred via an antenna consisting of a coil with a few turns which is directly connect ed to the mf0ulx1. no further external components are necessary. refer to ref. 2 for details on antenna design. ? rf interface: ? modulator/demodulator ? rectifier ? clock regenerator ? power-on reset (por) ? voltage regulator ? anticollision: multiple cards may be selected a nd managed in sequence ? command interpreter: processes memory access commands that the mf0icu1 supports ? eeprom interface ? eeprom: 640 bit, organized in 20 pages of 4 byte per page. ? 208 bit reserved for manufacturer and configuration data ? 16 bit used for the read-only locking mechanism ? 32 bit available as otp area ? 384 bit user programmable read/write memory ? eeprom: 1312 bit, organized in 41 pages of 4 byte per page. ? 208 bit reserved for manufacturer and configuration data ? 31 bit used for the read-only locking mechanism ? 32 bit available as otp area ? 1024 bit user programmable read/write memory
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 7 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.2 rf interface the rf-interface is based on the iso/iec 14443 type a standard for contactless smart cards. during operation, the reader generates an rf field. this rf field must always be present (with short pauses for data communication), as it is used for the powe r supply of the card. for both directions of data communication, there is one start bit at the beginning of each frame. each byte is transmitted with an odd parity bit at the end. the lsb of the byte with the lowest address of the selected block is transmitted first. the maximum length of a pcd to picc frame is 199 bits (20 data bytes + 2 crc bytes = 20 ? 9 + 2 ? 9 + 1 start bit). the maximum length for a fixed size picc to pcd frame is 307 bits (32 data bytes + 2 crc bytes = 32 ? 9 + 2 ? 9 + 1 start bit). the fast_read response has a variable frame length depending on the start and end address parameters. when issuing this command, take into account the maximum frame length that the pcd supports. for a multi-byte parameter, the least signif icant byte is always transmitted first. as an example, take reading from the memory using the read command. byte 0 from the addressed block is transmitted first after which, byte 1 to byte 3 are transmitted. the same sequence continues for the next block and all subsequent blocks. 8.3 data integrity following mechanisms are implemented in the contactless communication link between reader and card to ensure very reliable data transmission: ? 16 bits crc per block ? parity bits for each byte ? bit count checking ? bit coding to distinguish between ?1?, ?0? and ?no information? ? channel monitoring (protocol sequence and bit stream analysis)
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 8 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.4 communication principle the reader initiates the commands and the digital control unit of the mf0ulx1 controls them. the command response is depending on the state of the ic and for memory operations also on the access conditions valid for the corresponding page. remark: in all states, the command interpreter returns to the idle state on receipt of an unexpected command. if the ic was previously in the halt state, it returns to that state remark: the vcsl command is only allowed in the active state fig 4. state diagram aaa-006274 vcsl read (16 byte) fast_read write, compatibility_write (4 byte) incr_cnt read_cnt chk _ tearing_event get_version read_sig pwd_auth select cascade level 2 select cascade level 1 wupa reqa wupa ready 1 ready 2 active authenticated idle halt por anticollision anticollision read from page 0 read from page 0 hlta h l t a identification and selection procedure memory operations
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 9 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.4.1 idle state after a power-on reset (por), the mf0ulx1 switches to the idle state. it only exits this state when a reqa or a wupa command is received from the pcd. any other data received while in this state is interpreted as an error and the mf0ulx1 remains in the idle state. refer to ref. 4 for implementation hints for a card po lling algorithm that respects relevant timing specifications from iso/iec 14443 type a. after a correctly executed hlta comm and, for example out of the active or authenticated state, the default waiting state changes from idle to halt. this state can then be exited with a wupa command only. 8.4.2 ready1 state in this state, the pcd resolves the fi rst part of the uid (3 bytes) using the anticollision or select commands in cascade level 1. this state is exited correctly after execution of either of the following commands: ? select command from cascade level 1: the pcd switches the mf0ulx1 into ready2 state where the second part of the uid is resolved. ? read command (from address 0 ): all anticollision mechanis ms are bypassed and the mf0ulx1 switches direct ly to the active state. remark: if more than one mf0ulx1 is in the pcd field, a read command from address 0 selects all mf0ulx1 devices. in this case, a collision occurs due to the different serial numbers. any other data received in the ready1 state is interpreted as an error. depending on its previous state, the mf0ulx1 returns to either the idle state or halt state. 8.4.3 ready2 state in this state, the mf0ulx1 supports the pc d in resolving the second part of its uid (4 bytes) with the cascade level 2 anticollis ion command. this state is usually exited using the cascade level 2 select command. alternatively, ready2 state can be skipped using a read command (from address 0) as described for the ready1 state. remark: the response of the mf0ulx1 to the ca scade level 2 select command is the select acknowledge (sak) byte. in accordance with iso/iec 14443, this byte indicates if the anticollision cascade proced ure has finished. it also de fines the type of device selected for the mifare architecture platfo rm. the mf0ulx1 is now uniquely selected and only this device communicates with the pcd even when other contactless devices are present in the pcd field. if more than one mf0ulx1 is in the pcd field, a read command from address 0 select s all mf0ulx1 devices. in this case, a collision occurs due to the different serial numbers. any other data received when the device is in this state is interpreted as an error. depending on its previous state the mf0ulx1 returns to either the idle state or halt state.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 10 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.4.4 active state all memory operations and other functions like the originality signature read-out are operated in the active state. the active state is gratefully exited wit h the hlta command and upon reception the mf0ulx1 transits to the halt state. any othe r data received when the device is in this state is interpreted as an error. depending on its previous state the mf0ulx1 returns to either the idle state or halt state. the mf0ulx1 transits to the authentica ted state after successful password verification using the pwd_auth command. 8.4.5 authenticated state in this state, all operations on memory pages, which are configured as password verification protected, can be accessed. the authenticated state is gratefully exited with the hlta command and upon reception the mf0ulx1 transits to the halt state. any other data received when the device is in this state is interpreted as an error. depending on its previous state the mf0ulx1 returns to either the idle state or halt state. 8.4.6 halt state the halt and idle states constitute the tw o wait states implemented in the mf0ulx1. an already processed mf0ulx1 can be set into the halt state using the hlta command. in the anticollision phase, th is state helps the pcd to distinguish between processed cards and cards yet to be selected. the mf0ulx1 can only exit this state on execution of the wupa command. any other data received when the device is in this state is interpreted as an error and the mf0ulx1 state remains unchanged. refer to ref. 4 for correct implementation of an anticollision proc edure based on the id le and halt states and the reqa and wupa commands.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 11 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.5 memory organization the eeprom memory is organiz ed in pages with 4 bytes pe r page. the mf0ul11 variant has 20d pages and the mf0ul21 variant has 41d pages in total. the memory organization can be seen in figure 5 and figure 6 , the functionality of the different memory sections is described in the following sections. (1) counter pages are only accessible with read_cnt and incr_cnt commands fig 5. memory organization mf0ul11 (1) counter pages are only accessible with read_cnt and incr_cnt commands fig 6. memory organization mf0ul21 aaa-006275 byte number within a page 0 3 1 2 serial number internal lock bytes otp otp otp otp pack serial number serial number user memory cfg0 cfg1 pwd rfui hex 0h 1h 2h 3h 4h 5h 10h 11h 12h 13h description manufacturer data and lock bytes one time programmable user memory pages configuration pages fh eh ... one-way counters 1) counter pages dec 0 1 2 3 4 5 16 17 18 19 15 14 ... page adr aaa-006276 28h 0 1 2 3 4 5 37 38 39 40 35 34 ... 36 0h 1h 2h 3h 4h 5h 24h 25h 26h 27h 23h 22h ... byte number within a page 0 3 1 2 serial number internal lock bytes otp otp otp otp pack serial number serial number user memory cfg0 cfg1 pwd rfui description manufacturer data and lock bytes one time programmable user memory pages configuration pages one-way counters 1) counter pages lock bytes lock bytes rfui hex dec page adr
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 12 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.5.1 uid/serial number the unique 7-byte serial number (uid) and its two check bytes are programmed into the first 9 bytes of memory covering page addre sses 00h, 01h and the first byte of page 02h. the second byte of page address 02h is reserved for internal data. these bytes are programmed and write protected in the production test. in accordance with iso/iec 14443-3 check byte 0 (bcc0) is defined as ct ? sn0 ? sn1 ? sn2. check byte 1 (bcc1) is defined as sn3 ? sn4 ? sn5 ? sn6. sn0 holds the manufacturer id for nxp semiconductors (04h) in accordance with iso/iec 14443-3 and iso/iec 7816-6 amd.1 8.5.2 lock byte 0 and byte 1 the bits of byte 2 and byte 3 of page 02h represent the field programmable read-only locking mechanism. each page from 03h (o tp) to 0fh can be individually locked by setting the corresponding locking bit lx to lo gic 1 to prevent further write access. after locking, the corresponding page becomes read-only memory. the three least significant bits of lock byte 0 are the block-locking bits. bit 2 deals with pages 0ah to 0fh, bit 1 deals with pages 0 4h to 09h and bit 0 deals with page 03h (otp). once the block-locking bits are set, the locking configuration for the corresponding memory area is frozen. for example if bl15-10 is set to logic 1, then bi ts l15 to l10 (lock byte 1, bit[7:2]) can no longer be changed. a write command or compatibility_write command to page 02h, sets the locking and block-locking bits. byte 2 and byte 3 of the write or fig 7. uid/serial number 001aai001 msb lsb page 0 byte check byte 0 serial number part 1 serial number part 2 manufacturer id for nxp semiconductors (04h) 00000100 0123 page 1 0123 page 2 0123 internal check byte 1 lock bytes fig 8. lock bytes 0 and 1 aaa-006277 l 7 l 6 l 5 l 4 l otp bl 15-10 bl 9-4 bl otp msb 0 page 2 lx locks page x to read-only blx blocks further locking for the memory area x lock byte 0 lock byte 1 123 lsb l 15 l 14 l 13 l 12 l 11 l 10 l 9 l 8 msb lsb
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 13 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic compatibility_write command, and the contents of the lock bytes are bit-wise or?ed and the result then becomes the new c ontent of the lock bytes. this process is irreversible. if a bit is set to logic 1, it cannot be changed back to logic 0. the contents of bytes 0 and 1 of page 02h ar e unaffected by the corresponding data bytes of the write or compatibility_write command. the default value of the static lock bytes is 00 00h. any write operation to the lock byte s, features anti-tearing support. 8.5.3 lock byte 2 to byte 4 to lock the pages of the mf0ul21 starting at page address 10h onwards, the lock bytes 2-4 located in page 24h are used. those three lock bytes cover the memory area of 80 data bytes. the granularity is 2 pages, compared to a single page for the first 512 bits as shown in figure 9 . remark: set all bits marked with rfui to 0, when writing to the lock bytes. the default value of lock bytes 2-4 is 00 00 00h. the value of byte 3 on page 36 (see figure 9 ) is always bdh when read. any write operation to the lock byte s, features anti-tearing support. fig 9. lock bytes 2-4 aaa-006278 0 1 2 3 page lock byte 2 lock byte 3 36 (24h) lo ck p age 30-31 lo ck p age 28-29 lo ck p age 26-27 lo ck p age 24-25 lo ck p age 22-23 lo ck p age 20-21 lo ck p age 18-19 lo ck p age 16-17 rfui rfui rfui rfui rfui rfui lo ck p age 34-35 lo ck p age 32-33 rfui rfui rfui bl 32-35 bl 28-31 bl 24-27 bl 20-23 bl 16-19 msb lsb bit 7 6 5 4 3 2 1 0 msb lsb bit 7 6 5 4 3 2 1 0 msb lsb bit 7 6 5 4 3 2 1 0 lock byte 4
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 14 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.5.4 otp bytes page 03h is the otp page and it is preset so th at all bits are set to logic 0 after production. these bytes can be bit-wise modified us ing the write or compatibility_write command. the parameter bytes of the write command and the current contents of the otp bytes are bit-wise or?ed. the result is the new otp byte contents. this pr ocess is irreversible and once a bit is set to logic 1, it cannot be changed back to logic 0. the default value of the otp bytes is 00 00 00 00h. any write operation to the otp bytes features anti-tearing support. 8.5.5 data pages pages 04h to 0fh for the mf0ul11 and 04h to 23h for the mf0ul21 are the user memory read/write area. the access to a part of the user memory area can be restricted using a password verification. see section 8.6 for further details. remark: the default content of the data blocks at delivery is not defined. this memory area can be used as a 32 tick one-time counter. fig 10. otp bytes 001aak571 byte 12 13 14 15 page 3 example otp bytes otp bytes default value 00000000 00000000 00000000 00000000 1st write command to page 3 11111111 11111100 00000101 00000111 result in page 3 11111111 11111100 00000101 00000111 2nd write command to page 3 11111111 00000000 00111001 10000000 result in page 3 11111111 11111100 00111101 10000111
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 15 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.5.6 configuration pages pages 10h-13h for the mf0ul11 and pages 25h-28h for the mf0ul21 variant, are used to configure the memory acce ss restriction of the mf0ulx1. they are also used to configure the response to a vcsl command. the memory content of the configuration pages is detailed in ta b l e 5 , table 6 and ta b l e 7 . [1] page address for mf0ul11/mf0ul21 table 5. configuration pages page address byte number dec hex 0 1 2 3 16/37 10h/25h rfui rfui rfui auth0 17/38 11h/26h access vctid rfui rfui 18/39 12h/27h pwd 19/40 13h/28h pack rfui rfui table 6. access configuration byte bit number 7 6 6 4 3 2 1 0 prot cfglck rfui authlim table 7. configuration parameter descriptions field bit default value description auth0 8 ffh auth0 defines the page address from which the password verification is required. valid address range for byte auth0 is 00h to ffh. if auth0 is set to a page address which is higher than the last user configuration page, the password pr otection is effectively disabled. prot 1 0b one bit inside the access byte de fining the memory protection 0b ... write access is protected by the password verification 1b ... read and write access is pr otected by the password verification cfglck 1 0b write locking bit for the user configuration 0b ... user configuration open to write access 1b ... user configuration permanently locked against write access authlim 3 000b limitation of negative password verification attempts 000b... limiting of negative password verification attempts disabled 001b-111b ... maximum number of negative password verification attempts vctid 8 05h virtual card type identifier which represents the response to a vcsl command. to ensure infrastructure compatibility, do not change the default value of 05h. pwd 32 ffff ffffh 32-bit password used for memory access protection pack 16 0000h 16-bit password acknowledge used during password verification rfui - all 0b reserved for future use - implemented. write all bits and bytes denoted as rfui as 0b.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 16 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic remark: the cfglck bit activates the permanent write protection of the first two configuration pages. the write lock is only ac tivated after a power cycle of the mf0ulx1. if write protection is enabled, each write attempt leads to a nak response. 8.6 password verific ation protection the memory write or read/write access to a configurable part of the memory can be constrained to a positive password verificati on. the 32-bit secret password (pwd) and the 16-bit password acknowledge (pack) are typically programmed into the configuration pages at ticket issuing or personalization. the use of a chip individual password acknowledge response raises the trust level on the pcd side into the picc. the authlim parameter specified in section 8.5.6 can be used to limit the negative verification attempts. in the initial state of the mf0ulx1, an auth0 value of ffh disables password protection. pwd and pack are freely writable in this state. access to the configuration pages and any part of the user memory, can be restricted by setting auth0 a page address within the available memory space. the page address is the first one protected. remark: note that the password verification method available in then mf0ulx1 does not offer a high security protection. it is an easy and convenient way to prevent unauthorized memory access. if a higher level of protection is required, cryptographic methods on application layer can be used to increase overall system security. 8.6.1 programming of pwd and pack program the 32-bit pwd and the 16-bit pack into the configuration pages, see section 8.5.6 . the password as well as the password acknowledge, are written lsbyte first. this byte order is the same as the byte order used during the pwd_auth command and its response. the pwd and pack bytes can never be read out of the memory. instead of transmitting the real value on any valid read or fast _read command, only 00h bytes are replied. if the password verification does not protect the configuration pages, pwd and pack can be written with normal write and compatibility_write commands. if the password verification protects the c onfiguration pages, pwd and pack can be written after a successful pwd_auth command. the pwd and pack are writable even if the cfglck bit is set to 1b. therefore it is strongly recommended to set auth0 to the page where the pwd is located after the password has been written. this page is 12h for the mf0ul11 and 27h for the mf0ul21. remark: to improve the overall system security, it is strongly recommended to diversify the password and the password acknowledge using a die individual parameter, that is, the 7-byte uid available on the mf0ulx1.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 17 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.6.2 limiting negative verification attempts to prevent brute-force attacks on the password, the maximum allowed number of negative password verification attempts can be set using authlim. this mechanism is disabled by setting authlim to a value of 000b which is also the initial state of the mf0ulx1. if authlim is not equal to 000b, each negativ e authentication verifica tion is internally counted. the count operation features anti-tea ring support. as soon as this internal counter reaches the number specified in authlim, any further negative password verification leads to a permanent locking of the protected part of the memory for the specified access modes. specifically, whethe r the provided password is correct or not, each subsequent pwd_auth fails. any successful password veri fication, before reaching the limit of negative password verification attempts, resets the internal counter to zero. 8.6.3 protection of special memory segments the configuration pages can be protected by the password authentication as well. the protection level is defined with the prot bit. the protection is enabled by setting the au th0 byte to a value that is within the addressable memory space. all counters can always be incremented and read without prior password verification. 8.7 counter functionality the mf0ulx1 features three independent 24-b it one-way counters. these counters are located in a separate part of the nvm whic h is not directly addressable using read, fast_read, write or compatibility_writ e commands. the actual value can be retrieved by using the read_cnt command, the counters can be incremented with the incr_cnt command. the incr_cnt command fe atures anti-tearing support, thus no undefined values originating from interrupted programing cycles are possible. either the value is unchanged or the correct, incremented value is correctly programmed into the counter. the occurrence of a tearing event can be checked using the check_tearing_event command. in the initial state, the counter values are set to 000000h. the counters can be incremented by an arbitr ary value. the incremented value is valid immediately and does not require a rf reset or re-activation. once counter value reaches ffffffh and an increment is performed via a valid incr_cnt command, the mf0ulx1 replies a nak. if the sum of the addressed co unter value and the increment value in the incr_cnt command is higher than ffffffh, the mf0ulx1 replies a nak and does not update the respective counter. an increment by zero (000000h) is always possible, but does not have any impact on the counter value.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 18 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 8.8 originality function the mf0ulx1 features a cryptographically support ed originality check. wi th this feature, it is possible to verify with a certain pro bability, that the ticket is using an nxp semiconductors manufactured silicon. this check can also be performed on personalized tickets. each mf0ulx1 holds a 32-b yte cryptographic signatur e based on elliptic curve cryptography. this signature can be retrieved using the read_sig command and can be verified using the corresponding ecc public key in the pcd. 8.9 virtual card architecture support the mf0ulx1 supports the virtual card architectu re by replying to a virtual card select last (vcsl) command with a virtual card type identifier. the vctid that is replied can be programmed in the configuration pages. it enabl es infrastructure supporting this feature to process mifare cards across differen t mifare families in a common way. for example, a contactless system is enabled to select a specific virtual mifare card inside a mobile phone. it can use the same card identification principle to detect that the mf0ulx1 belongs to the system.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 19 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 9. command overview the mifare ultralight card ac tivation follows the iso /iec 14443 type a. after the mifare ultralight card has been selected, it can either be deactivated using the iso/iec 14443 hlta command, or the mifa re ultralight commands can be performed. for more details about the card activation, refer to ref. 1 . 9.1 mifare ultralight ev1 command overview all available commands for the mifare ultralight are shown in table 8 . [1] unless otherwise specified, all commands use the coding and framing as described in ref. 1 . [2] this command is new in mifare ultral ight ev1 compared to mifare ultralight table 8. command overview command [1] iso/iec 14443 command code (hexadecimal) request reqa 26h (7 bit) wake-up wupa 52h (7 bit) anticollision cl1 anticollision cl1 93h 20h select cl1 select cl1 93h 70h anticollision cl2 anticollision cl2 95h 20h select cl2 select cl2 95h 70h halt hlta 50h 00h get_version [2] - 60h read - 30h fast_read [2] -3 a h write - a2h comp_write - a0h read_cnt [2] - 39h incr_cnt [2] -a 5 h pwd_auth [2] -1 b h read_sig [2] -3 c h check_tearing_event [2] -3 e h vcsl [2] -4 b h
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 20 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 9.2 timing the command and response timings shown in this document are not to scale and values are rounded to 1 ? s. all given command and response transmission times refer to the data frames including start of communication and end of communication. they do not include the encoding (such as miller pulses). a pcd data frame, contains the start of communication (1 ?start bit?) and the end of communication (one logic 0 + 1 bit length of unmodulated carrier). a picc data frame, contains the start of communication (1 ?start bit?) and the end of communication (1 bit length of no subcarrier). the minimum command response ti me is specified according to ref. 1 as an integer n which specifies the pcd to pi cc frame delay time. the frame delay time from picc to pcd is at least 87 ? s. the maximum command response ti me is specified as a time-out value. depending on the command, the t ack value specified for command responses defines the pcd to picc frame delay time. it does it for either the 4-bit ack value specified in section 9.3 or for a data frame. all command timings are according to iso/iec 14443-3 frame specification as shown for the frame delay time in figure 11 . for more details, refer to ref. 1 . remark: due to the coding of commands, the measur ed timings usually excludes (a part of) the end of communication. consider this factor when comparing the specified times with the measured times. fig 11. frame delay time (from pcd to picc), t ack and t nak aaa-006279 last data bit transmitted by the pcd fdt = (n* 128 + 84)/fc first modulation of the picc fdt = (n* 128 + 20)/fc 128/fc logic ?1? 128/fc logic ?0? 256/fc end of communication (e) 256/fc end of communication (e) 128/fc start of communication (s) 128/fc start of communication (s)
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 21 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 9.3 mifare ultralight ack and nak the mifare ultralight uses a 4-bit ack / nak as shown in ta b l e 9 . 9.4 atqa and sak responses for details on the type identification procedure, refer to ref. 3 . the mf0ulx1 replies to a reqa or wupa command with the atqa value shown in ta b l e 1 0 . it replies to a select cl2 co mmand with the sak value shown in ta b l e 11 . the 2-byte atqa value is transmitted with th e least significant byte first (44h). remark: the atqa coding in bits 7 and 8 indicate the uid size according to iso/iec 14443 independent from the settings of the uid usage. remark: the bit numbering in the iso/iec 14443 starts with lsb = bit 1 and not with lsb = bit 0. so 1 byte counts bit 1 to bit 8 instead of bit 0 to 7. table 9. ack and nak values code (4-bit) ack/nak ah acknowledge (ack) 0h nak for invalid argument (i.e. invalid page address) 1h nak for parity or crc error 4h nak for counter overflow 5h, 7h nak for eeprom write error 6h, 9h nak, other error table 10. atqa response of the mf0ulx1 bit number sales type hex value 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 mf0ulx1 00 44h 0000000001000100 table 11. sak response of the mf0ulx1 bit number sales type hex value 8 7 6 5 4 3 2 1 mf0ulx1 00h 00000000
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 22 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10. mifare ultralight ev1 commands 10.1 get_version the get_version command is used to retrie ve information on the mifare family, product version, storage size and other product data required to identify the mf0ulx1. this command is available on other mifare products to have a common way of identifying products across platforms and evolution steps. the get_version command has no arguments and replies the version information for the specific mf0ulx1 type. the command structure is shown in figure 12 and ta b l e 1 2 . ta b l e 1 3 shows the required timing. fig 12. get_version command table 12. get_version command name code description length cmd 60h get product version 1 byte crc - crc according to ref. 1 2 bytes data - product version information 8 bytes nak see table 9 see section 9.3 4-bit table 13. get_version timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout get_version n=9 t timeout n=9 t timeout 5 ms aaa-006280 crc crc pcd cmd data picc ,,ack'' 283 s 868 s picc ,,nak'' nak time out t timeout t nak t ack 57 s
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 23 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic the most significant 7 bits of the storage size byte are interpreted as an unsigned integer value n. as a result, it codes the total available user memory size as 2 n . if the least significant bit is 0b, the user memory size is exactly 2 n . if the least significant bit is 1b, the user memory size is between 2 n and 2 n+1 . the user memory for the mf0ul11 is 48 byte s. this memory size is between 32d bytes and 64d bytes. therefore, the most significant 7 bits of the value 0bh, are interpreted as 5d and the least significant bit is 1b. the user memory for the mf0ul21 is 128 by tes. this memory size is exactly 128d. therefore, the most sign ificant 7 bits of the value 0eh, are interpreted as 7d and the least significant bit is 0b. table 14. get_version response for mf0ul11 and mf0ul21 byte no. description mf0ul11 mf0ul21 interpretation 0 fixed header 00h 00h 1 vendor id 04h 04h nxp semiconductors 2 product type 03h 03h mifare ultralight 3 product subtype 01h 01h 17 pf 4 major product version 01h 01h ev1 5 minor product version 00h 00h v0 6 storage size 0bh 0eh see following explanation 7 protocol type 03h 03h iso/iec 14443-3 compliant
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 24 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.2 read the read command requires a start page address, and returns the 16 bytes of four mifare ultralight pages. for example if address (addr) is 03h then pages 03h, 04h, 05h, 06h are returned. special conditions apply if the read command address is near the end of the accessible memory area. the special conditions also apply if at least part of the addressed pages is within a password protec ted area. for details on those cases and the command structure, refer to figure 12 and ta b l e 1 2 . ta b l e 1 3 shows the required timing. fig 13. read command table 15. read command name code description length cmd 30h read four pages 1 byte addr - start page address 1 byte crc - crc according to ref. 1 2 bytes data - data content of the addressed pages 16 bytes nak see table 9 see section 9.3 4-bit table 16. read timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout read n=9 t timeout n=9 t timeout 5 ms aaa-006284 crc crc addr pcd cmd data picc ,,ack'' 368 s 1548 s picc ,,nak'' nak time out t timeout t nak t ack 57 s
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 25 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic in the initial state of the mf0ulx1, all memo ry pages are allowed as addr parameter to the read command. ? page address 00h to 13h for the mf0ul11 ? page address 00h to 28h for the mf0ul21 addressing a memory page beyond the limits above results in a n ak response from the mf0ulx1. a roll-over mechanism is implemented to continue reading from page 00h once the end of the accessible memory is reached. reading from address 11h on a mf0ul11 results in pages 11h, 12h, 13h and 00h being returned. the following conditions apply if part of t he memory is password protected for read access: ? if the mf0ulx1 is in the active state ? addressing a page which is equal or higher than auth0 results in a nak response ? addressing a page lower than auth0 results in data being returned with the roll-over mechanism occurring just before the auth0 defined page ? if the mf0ulx1 is in the authenticated state ? the read command behaves like on a mf0ulx1 without access protection remark: pwd and pack values can never be read out of the memory. when reading from the pages holding those two values, all 00h bytes are replied to the pcd instead.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 26 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.3 fast_read the fast_read command requires a start page address and an end page address and returns the all n*4 bytes of the addressed pages. for example if the start address is 03h and the end address is 07h then pages 03h, 04h, 05h, 06h and 07h are returned. if the addressed page is outside of accessible area, the mf0ulx1 replies a nak. for details on those cases and the command structure, refer to figure 14 and ta b l e 1 7 . ta b l e 1 8 shows the required timing. in the initial state of the mf0ulx1, all memory pages are allowed as startaddr parameter to the fast_read command. ? page address 00h to 13h for the mf0ul11 ? page address 00h to 28h for the mf0ul21 addressing a memory page beyond the limits above results in a n ak response from the mf0ulx1. the endaddr parameter must be equal to or higher than the startaddr. the following conditions apply if part of t he memory is password protected for read access: fig 14. fast_read command table 17. fast_read command name code description length cmd 3ah read multiple pages 1 byte startaddr - start page address 1 byte endaddr - end page address 1 byte crc - crc according to ref. 1 2 bytes data - data content of the addressed pages n*4 bytes nak see table 9 see section 9.3 4-bit table 18. fast_read timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout fast_read n=9 t timeout n=9 t timeout 5 ms aaa-006285 crc crc startaddr pcd cmd data picc ,,ack'' 453 s depending on nr of read pages picc ,,nak'' nak time out t timeout t nak t ack 57 s endaddr
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 27 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic ? if the mf0ulx1 is in the active state ? if any requested page address is equal or higher than auth0 a nak is replied ? if the mf0ulx1 is in the authenticated state ? the fast_read command behaves like on a mf0ulx1 without access protection remark: pwd and pack values can never be read out of the memory. when reading from the pages holding those two values, all 00h bytes are replied to the pcd instead. remark: the fast_read command is able to read out the whole memory with one command. nevertheless, receive buffer of the pcd must be able to handle the requested amount of data as there is no chaining possibility.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 28 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.4 write the write command requires a block address, and writes 4 bytes of data into the addressed mifare ultralight ev1 page. the write command is shown in figure 15 and ta b l e 1 9 . ta b l e 2 0 shows the required timing. in the initial state of the mf 0ulx1, the following memory pages are valid addr parameters to the write command. ? page address 02h to 13h for the mf0ul11 ? page address 02h to 28h for the mf0ul21 addressing a memory page beyond the limits above results in a n ak response from the mf0ulx1. pages which are locked against writing cannot be reprogrammed using any write command. the locking mechanisms include lock bits as well as the locking of the configuration pages. the following conditions apply if part of t he memory is password protected for write access: fig 15. write command table 19. write command name code description length cmd a2h write one page 1 byte addr - page address 1 byte crc - crc according to ref. 1 2 bytes data - data 4 bytes nak see table 9 see section 9.3 4-bit table 20. write timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout write n=9 t timeout n=9 t timeout 5 ms aaa-006286 crc addr pcd cmd picc ,,ack'' 708 s picc ,,nak'' nak time out t timeout t nak t ack 57 s ack 57 s data
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 29 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic ? if the mf0ulx1 is in the active state ? writing to a page which address is equal or higher than auth0 results in a nak response ? if the mf0ulx1 is in the authenticated state ? the write command behaves like on a mf0ulx1 without access protection the mf0ulx1 features tearing protected write op erations to specific memory content. the following pages are protected against tearing events during a write operation: ? page 2 containing lock bits ? page 3 containing otp bits ? page 36 containing the additional lock bits for the mf0ul21
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 30 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.5 compatibility_write the compatibility_write command is implemented to accommodate the established mifare classic pcd infrastructure. even th ough 16 bytes are transferred to the mf0ulx1, only the least significant 4 bytes (b ytes 0 to 3) are wri tten to the specified address. set all the remaining bytes, 04h to 0fh, to logic 00h. the compatibility_write command is shown in figure 16 and table 19 . ta b l e 2 2 shows the required timing. fig 16. compatibility_write command part 1 fig 17. compatibility_write command part 2 table 21. compatibility_write command name code description length cmd a0h compatibility write 1 byte addr - page address 1 byte crc - crc according to ref. 1 2 bytes data - 16-byte data, only least significant 4 bytes are written 16 bytes nak see table 9 see section 9.3 4-bit 001aan015 crc addr pcd cmd picc ,,ack'' 368 s picc ,,nak'' nak time out t timeout t nak t ack 59 s ack 59 s 001aan016 crc pcd data picc ,,ack'' 1558 s picc ,,nak'' nak time out t timeout t nak t ack 59 s ack 59 s
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 31 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic in the initial state of the mf 0ulx1, the following memory pages are valid addr parameters to the compatibility_write command. ? page address 02h to 13h for the mf0ul11 ? page address 02h to 28h for the mf0ul21 addressing a memory page beyond the limits above results in a n ak response from the mf0ulx1. pages which are locked against writing cannot be reprogrammed using any write command. the locking mechanisms include lock bits as well as the locking of the configuration pages. the following conditions apply if part of t he memory is password protected for write access: ? if the mf0ulx1 is in the active state ? writing to a page which address is equal or higher than auth0 results in a nak response ? if the mf0ulx1 is in the authenticated state ? the compatibility_write command behaves the same as on a mf0ulx1 without access protection the mf0ulx1 features tearing protected write op erations to specific memory content. the following pages are protected against tearing events during a compatibility_write operation: ? page 2 containing lock bits ? page 3 containing otp bits ? page 36 containing the additional lock bits for the mf0ul21 table 22. compatibility_write timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout compatibility_write part 1 n=9 t timeout n=9 t timeout 5 ms compatibility_write part 2 n=9 t timeout n=9 t timeout 10 ms
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 32 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.6 read_cnt the read_cnt command is used to read out the current value of one of the 3 one-way counters of the mf0ulx1. the command has a single argument specifying the counter number and returns the 24-bit counter value of the corresponding counter. the counters are always readable, independent on the password protection settings. the command structure is shown in figure 18 and ta b l e 2 3 . ta b l e 2 4 shows the required timing. fig 18. read_cnt command table 23. read_cnt command name code description length cmd 39h read counter 1 byte addr - counter number from 00h to 02h 1 byte crc - crc according to ref. 1 2 bytes data - counter value 3 bytes nak see table 9 see section 9.3 4-bit table 24. read_cnt timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout read_cnt n=9 t timeout n=9 t timeout 5 ms aaa-006287 crc crc addr pcd cmd data picc ,,ack'' 368 s 444 s picc ,,nak'' nak time out t timeout t nak t ack 57 s
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 33 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.7 incr_cnt the incr_cnt command is used to increment one of the 3 one-way counters of the mf0ulx1. the two arguments are the counte r number and the increment value. the incr_cnt command is shown in figure 19 and table 25 . ta b l e 2 6 shows the required timing. the incrvalue argument is a 4-byte field to support the same command structure as the write command. as the counter width is on ly 3 byte, the last transmitted, most significant byte is ignored. any increment value is allowed. nevertheless, the final counter value is ffffffh. no further increment is possible af ter the final value is reached. also, trying to increment the current value by a number which would exceed the final value leads to a nak response and the counter remains unchanged. an incremen t by 0 is allowed but leaves the counter unchanged. fig 19. incr_cnt command table 25. incr_cnt command name code description length cmd a5h increment counter 1 byte addr - counter number from 00h to 02h 1 byte incrvalue - increment value, only the 3 least significant bytes are relevant 4 byte crc - crc according to ref. 1 2 bytes nak see table 9 see section 9.3 4-bit table 26. incr_cnt timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout incr_cnt n=9 t timeout n=9 t timeout 5 ms aaa-006288 crc addr pcd cmd picc ,,ack'' 708 s picc ,,nak'' nak time out t timeout t nak t ack 57 s ack 57 s incrvalue
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 34 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic the order of bytes in the increment argument follows the same order that the bytes are sent via the communication interface. this me ans from the lsbyte (incrvalue0) to msbyte (incvalue3), where the last valid byte is actua lly incrvalue2. it is in line with the arguments consisting of multiple bytes for other commands. as an example, an increment of the counter 00h by 01h, is formulated as incr cnt 00 01 00 00 00. the incr_cnt command features anti-tearing support.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 35 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.8 pwd_auth a protected memory area can be accessed only after a successful password verification using the pwd_auth command. the auth0 co nfiguration byte defines the protected area. it specifies the first page that the password mechanism protects. the level of protection can be configured using the prot bi t either for write protection or read/write protection. the pwd_auth command takes the password as parameter and, if successful, returns the password authenticat ion acknowledge, pack. by setting the authlim configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. each un successful authentication is then counted in a counter featuring anti-tearing support. after re aching the limit of unsuccessful attempts, the memory access specified in prot, is no longer possible. the pwd_auth command is shown in figure 15 and table 19 . ta b l e 2 0 shows the required timing. remark: it is strongly recommended to change the password from its delivery state at ticket issuing and set the auth0 value to the pwd page. fig 20. pwd_auth command table 27. pwd_auth command name code description length cmd 1bh password authentication 1 byte pwd - password 4 bytes crc - crc according to ref. 1 2 bytes pack - password authentication acknowledge 2 bytes nak see table 9 see section 9.3 4-bit table 28. pwd_auth timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout pwd_auth n=9 t timeout n=9 t timeout 5 ms crc pcd cmd picc ,,ack'' 623 s picc ,,nak'' nak time out t timeout t nak t ack 57 s pack 359 pwd
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 36 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.9 read_sig the read_sig command returns an ic-specifi c, 32-byte ecc signature, to verify nxp semiconductors as the silicon vendor. the si gnature is programmed at chip production and cannot be changed afterwards. the command structure is shown in figure 21 and ta b l e 2 9 . ta b l e 3 0 shows the required timing. ref. 7 describes the signature verification procedure. fig 21. read_sig command table 29. read_sig command name code description length cmd 3ch read ecc signature 1 byte addr 00h rfu, is set to 00h 1 byte crc - crc according to ref. 1 2 bytes sign - ecc signature 32 bytes nak see table 9 see section 9.3 4-bit table 30. read_sig timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout read_sig n=9 t timeout n=9 t timeout 5 ms aaa-006290 crc crc addr pcd cmd sign picc ,,ack'' 368 s 2907 s picc ,,nak'' nak time out t timeout t nak t ack 57 s
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 37 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.10 check_tearing_event the check_tearing_event comman d enables the application to identify if a tearing event happened on a specified counter element. it takes the counter number as single argument and returns a specified valid flag for this counter. if the returned valid flag is not equal to the predefined value, a tearing event happened. note, although a tearing event might have happened on the counter, a valid value corresponding to the last valid counter status is still available using the read_cnt command. the command structure is shown in figure 12 and ta b l e 1 2 . ta b l e 1 3 shows the required timing. the valid flag for normal operation is bdh. if any other value than bdh is replied on the check_tearing_event command, a tearing event has hap pened on t he addressed counter. the application can use this information to base business logic decisions on. fig 22. check_teari ng_event command table 31. check_teari ng_event command name code description length cmd 3eh check tearing event 1 byte addr - counter number from 00h to 02h 1 byte crc - crc according to ref. 1 2 bytes valid - valid flag 1 byte nak see table 9 see section 9.3 4-bit table 32. check_teari ng_event timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout check_tearing_event n=9 t timeout n=9 t timeout 5 ms aaa-006291 crc crc addr pcd cmd valid picc ,,ack'' 368 s 274 s picc ,,nak'' nak time out t timeout t nak t ack 57 s
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 38 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 10.11 vcsl the vcsl command is used to enable a unique identification and selection process across different mifare cards and card implementations on mobile devices. the command requires a 16-byte installation identifier iid and a 4-byte pcd capability value as parameters. the parameters are present to support compatibility to other mifare devices but are not used or checked inside the mf0ulx1. nevertheless, the number of bytes is checked for correctness. the answer to the vcsl command is the virtual card type identifier vctid. this id entifier indicates the type of card or ticket. using this information, the reader can decide whether the ticket belongs to the installation or not. the command structure is shown in figure 23 and ta b l e 3 3 . ta b l e 3 4 shows the required timing. fig 23. vcsl command table 33. vcsl command name code description length cmd 4b read four pages 1 byte iid - installation identifier 16 bytes pcdcaps - pcd capabilities 4 bytes crc - crc according to ref. 1 2 bytes vctid - virtual card type identifier 1 byte nak see table 9 see section 9.3 4-bit table 34. vcsl timing these times exclude the end of communication of the pcd. t ack min t ack max t nak min t nak max t timeout vcsl n=9 t timeout n=9 t timeout 5 ms aaa-006292 crc iid pcdcaps pcd cmd picc ,,ack'' 1982 s picc ,,nak'' nak time out t timeout t nak t ack 57 s vctid 274 s crc
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 39 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 11. limiting values stresses exceeding one or more of the limiting values, can cause permanent damage to the device. exposure to limiting values for extended periods can affect device reliability. [1] ansi/esda/jedec js-001; human body model: c = 100 pf, r = 1.5 k ? 12. characteristics [1] lcr meter, t amb = 22 ? c, f i = 13.56 mhz, 2 v rms table 35. limiting values in accordance with the absolute maximum rating system (iec 60134). symbol parameter min max unit i i input current - 40 ma p tot /pack total power dissipation per package - 120 mw t stg storage temperature ? 55 125 ?c t amb ambient temperature ? 25 70 ?c v esd electrostatic discharge voltage on la/lb [1] 2- k v table 36. characteristics symbol parameter conditions min typ max unit c i input capacitance [1] -17.0-pf f i input frequency - 13.56 - mhz eeprom characteristics t ret retention time t amb = 22 ? c10 - - year n endu(w) write endurance t amb = 22 ? c 100000 - - cycle n endu(w) write endurance counters t amb = 22 ? c 100000 1000000 - cycle
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 40 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 13. wafer specification [1] the step size and the gap between chips may vary due to changing foil expansion [2] pads gnd and tp are disconnected when wafer is sawn 13.1 fail die identification electronic wafer mapping covers the elec trical test results and the results of mechanical/visual inspection. no ink dots are applied. table 37. wafer specifications mf0ulx1 wafer diameter 200 mm typical (8 inches) maximum diameter afte r foil expansion 210 mm die separation process laser dicing thickness mf0ulx101dud 120 ? m ? 15 ? m mf0ulx101duf 75 ? m ? 10 ? m flatness not applicable potential good dies per wafer (pgdw) 103682 wafer backside material si treatment ground and stress relieve roughness r a max = 0.5 ? m r t max = 5 ? m chip dimensions step size [1] x = 505 ? m y = 590 ? m gap between chips [1] typical = 20 ? m minimum = 5 ? m passivation type sandwich structure material psg / nitride thickness 500 nm / 600 nm au bump (substrate connected to vss) material > 99.9 % pure au hardness 35 to 80 hv 0.005 shear strength > 70 mpa height 18 ? m height uniformity within a die = ? 2 ? m within a wafer = ? 3 ? m wafer to wafer = ? 4 ? m flatness minimum = ? 1.5 ? m size la, lb, gnd, tp [2] = 60 ? m ? 60 ? m size variation ? 5 ? m under bump metallization sputtered tiw
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 41 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 14. package outline for more details on the contac tless moa8 module, refer to ref. 5 . fig 24. package outline sot500-4 references outline version european projection issue date iec jedec jeita sot500-4 - - - - - - - - - sot500-4_po 11-02-18 unit mm max nom min 0.26 35.05 35.00 34.95 a (1) dimensions note 1. total package thickness, exclusive punching burr. pllmc: plastic leadless module carrier package; 35 mm wide tape sot500-4 d for unspecified dimensions see pllmc-drawing given in the subpackage code. 0 10 20 mm scale x d detail x a
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 42 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 14.1 bare die outline for more details on the wafer delivery forms, see ref. 6 . fig 25. bare die outline mf0ulx1 aaa-006293 typ. 505,0 (1) ty p. 59 0,0 (1 ) 43 ,0 423 ,0 508,0 typ. 20,0 (1) min. 5,0 typ. 20,0 (1) min. 5.0 bump size x [m] y [m] la, lb, gnd, tp 60 60 chip step 505 (1) 590 (1) mf0ulx1 lb gnd la tp (1) the air gap and thus the step size may vary due to varying foil expansion (2) all dimensions in m, pad locations measured from metal ring edge (see detail) x y 43,0
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 43 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 15. abbreviations table 38. abbreviations and symbols acronym description ack acknowledge atqa answer to request: type a crc cyclic redundancy check ct cascade tag (value 88h) as defined in iso/iec 14443-3 type a ecc elliptic curve cryptography eeprom electrically erasable programmable read-only memory fdt frame delay time ffc film frame carrier ic integrated circuit iid installation identifier lcr l = inductance, capacitance, resistance (lcr meter) lsb least significant bit lsbyte least significant byte msbyte most significant byte nak not acknowledge nv non-volatile memory otp one time programmable pcd proximity coupling de vice (contactless reader) pcdcaps pcd capability bytes picc proximity integrated circuit card (contactless card) reqa request command: type a rf radio frequency rfui reserver for futu re use - implemented rms root mean square sak select acknowledge: type a secs-ii semi equipment communications standard part 2 tiw titanium tungsten uid unique identifier vctid virtual card type identifier wupa wake-up protocol: type a
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 44 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 16. references [1] iso/iec 14443 ? international organization for standardization [2] mifare (card) coil design guide ? application note, bu-id document number 0117** 1 [3] mifare type identification procedure ? application note, bu-id document number 0184** 1 [4] mifare iso/iec 14443 picc selection ? application note, bu-id document number 1308** 1 [5] contactless smart card module specification moa8 ? delivery type description, bu-id document number 1636** 1 [6] general specification for 8" wafer on uv-tape; delivery types ? delivery type description, bu-id document number 1005** 1 [7] an073121 mifare ultralight features and hints ? application note, bu-id document number 0731** [8] iso/iec 15457-1 identification cards ? thin flexible cards 1. ** ... document version number
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 45 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 17. revision history table 39. revision history document id release date data sheet status change notice supersedes mf0ulx1 v.3.0 20130219 product data sheet - 234521 modifications: ? editorial changes ? security status changed into ?company public? ? added default values for c onfiguration elements in table 7 ? corrected response timing in figure 18 ? corrected pcdcaps length in table 33 ? changed eeprom reliability parameters for counters 234521 20120928 preliminary data sheet - 234520 modifications: ? editorial changes ? changed eeprom reliability parameters 234520 20120525 objective data sheet - - ? initial version
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 46 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 18. legal information 18.1 data sheet status [1] please consult the most recently issued document before initiating or completing a design. [2] the term ?short data sheet? is explained in section ?definitions?. [3] the product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple device s. the latest product status information is available on the internet at url http://www.nxp.com . 18.2 definitions draft ? the document is a draft versi on only. the content is still under internal review and subject to formal approval, which may result in modifications or additions. nxp semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall hav e no liability for the consequences of use of such information. short data sheet ? a short data sheet is an extract from a full data sheet with the same product type number(s) and title. a short data sheet is intended for quick reference only and should not be relied upon to contain detailed and full information. for detailed and full information see the relevant full data sheet, which is available on request vi a the local nxp semiconductors sales office. in case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail. product specification ? the information and data provided in a product data sheet shall define the specification of the product as agreed between nxp semiconductors and its customer , unless nxp semiconductors and customer have explicitly agreed otherwis e in writing. in no event however, shall an agreement be valid in which the nxp semiconductors product is deemed to offer functions and qualities beyond those described in the product data sheet. 18.3 disclaimers limited warranty and liability ? information in this document is believed to be accurate and reliable. however, nxp semiconductors does not give any representations or warranties, expressed or implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such info rmation. nxp semiconductors takes no responsibility for the content in this document if provided by an information source outside of nxp semiconductors. in no event shall nxp semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation - lost profits, lost savings, business interruption, costs related to the removal or replacement of any products or rework charges) whether or not such damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. notwithstanding any damages that customer might incur for any reason whatsoever, nxp semiconductors? aggregate and cumulative liability towards customer for the products described herein shall be limited in accordance with the terms and conditions of commercial sale of nxp semiconductors. right to make changes ? nxp semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without notice. this document supersedes and replaces all information supplied prior to the publication hereof. suitability for use ? nxp semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or malfunction of an nxp semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. nxp semiconductors and its suppliers accept no liability for inclusion and/or use of nxp semiconducto rs products in such equipment or applications and therefore such inclusion and/or use is at the customer?s own risk. applications ? applications that are described herein for any of these products are for illustrative purpos es only. nxp semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification. customers are responsible for the design and operation of their applications and products using nxp semiconductors products, and nxp semiconductors accepts no liability for any assistance with applications or customer product design. it is customer?s sole responsibility to determine whether the nxp semiconductors product is suitable and fit for the customer?s applications and products planned, as well as fo r the planned application and use of customer?s third party customer(s). customers should provide appropriate design and operating safeguards to minimize the risks associated with their applications and products. nxp semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the customer?s applications or products, or the application or use by customer?s third party customer(s). customer is responsible for doing all necessary testing for the customer?s applic ations and products using nxp semiconductors products in order to av oid a default of the applications and the products or of the application or use by customer?s third party customer(s). nxp does not accept any liability in this respect. limiting values ? stress above one or more limiting values (as defined in the absolute maximum ratings system of iec 60134) will cause permanent damage to the device. limiting values are stress ratings only and (proper) operation of the device at these or any other conditions above those given in the recommended operating conditions section (if present) or the characteristics sections of this document is not warranted. constant or repeated exposure to limiting values will permanently and irreversibly affect the quality and reliability of the device. terms and conditions of commercial sale ? nxp semiconductors products are sold subject to the gener al terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms , unless otherwise agreed in a valid written individual agreement. in case an individual agreement is concluded only the terms and conditions of the respective agreement shall apply. nxp semiconductors hereby expressly objects to applying the customer?s general terms and conditions with regard to the purchase of nxp semiconducto rs products by customer. no offer to sell or license ? nothing in this document may be interpreted or construed as an offer to sell products t hat is open for acceptance or the grant, conveyance or implication of any lic ense under any copyrights, patents or other industrial or intellectual property rights. document status [1] [2] product status [3] definition objective [short] data sheet development this document contains data from the objecti ve specification for product development. preliminary [short] data sheet qualification this document contains data from the preliminary specification. product [short] data sheet production this document contains the product specification.
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 47 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic export control ? this document as well as the item(s) described herein may be subject to export control regu lations. export might require a prior authorization from competent authorities. quick reference data ? the quick reference data is an extract of the product data given in the limiting values and characteristics sections of this document, and as such is not comple te, exhaustive or legally binding. non-automotive qualified products ? unless this data sheet expressly states that this specific nxp semicon ductors product is automotive qualified, the product is not suitable for automotive use. it is neither qualified nor tested in accordance with automotive testing or application requirements. nxp semiconductors accepts no liabili ty for inclusion and/or use of non-automotive qualified products in automotive equipment or applications. in the event that customer uses t he product for design-in and use in automotive applications to automotive specifications and standards, customer (a) shall use the product without nxp semiconductors? warranty of the product for such automotive applicat ions, use and specifications, and (b) whenever customer uses the product for automotive applications beyond nxp semiconductors? specifications such use shall be solely at customer?s own risk, and (c) customer fully indemnifies nxp semiconductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive app lications beyond nxp semiconductors? standard warranty and nxp semiconduct ors? product specifications. translations ? a non-english (translated) version of a document is for reference only. the english version shall prevail in case of any discrepancy between the translated and english versions. 18.4 trademarks notice: all referenced brands, produc t names, service names and trademarks are the property of their respective owners. mifare ultralight ? is a trademark of nxp b.v. 19. contact information for more information, please visit: http://www.nxp.com for sales office addresses, please send an email to: salesaddresses@nxp.com
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 48 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 20. tables table 1. naming conventions . . . . . . . . . . . . . . . . . . . . . .2 table 2. quick reference data . . . . . . . . . . . . . . . . . . . . .3 table 3. ordering information . . . . . . . . . . . . . . . . . . . . .4 table 4. pin allocation table . . . . . . . . . . . . . . . . . . . . . . .5 table 5. configuration pages . . . . . . . . . . . . . . . . . . . . .15 table 6. access configuration byte . . . . . . . . . . . . . . .15 table 7. configuration parameter descriptions. . . . . . . .15 table 8. command overview . . . . . . . . . . . . . . . . . . . . .19 table 9. ack and nak values . . . . . . . . . . . . . . . . . . . .21 table 10. atqa response of the mf0ulx1 . . . . . . . . . . .21 table 11. sak response of the mf0ulx1 . . . . . . . . . . . .21 table 12. get_version command . . . . . . . . . . . . . . . .22 table 13. get_version timing . . . . . . . . . . . . . . . . . . .22 table 14. get_version response for mf0ul11 and mf0ul21 . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23 table 15. read command . . . . . . . . . . . . . . . . . . . . . . . .24 table 16. read timing . . . . . . . . . . . . . . . . . . . . . . . . . . .24 table 17. fast_read command . . . . . . . . . . . . . . . . . .26 table 18. fast_read timing . . . . . . . . . . . . . . . . . . . . .26 table 19. write command . . . . . . . . . . . . . . . . . . . . . . .28 table 20. write timing . . . . . . . . . . . . . . . . . . . . . . . . . .28 table 21. compatibility_write command . . . . . . . .30 table 22. compatibility_write timing. . . . . . . . . . . .31 table 23. read_cnt command . . . . . . . . . . . . . . . . . . .32 table 24. read_cnt timing . . . . . . . . . . . . . . . . . . . . . .32 table 25. incr_cnt command. . . . . . . . . . . . . . . . . . . .33 table 26. incr_cnt timing . . . . . . . . . . . . . . . . . . . . . . .33 table 27. pwd_auth command. . . . . . . . . . . . . . . . . . .35 table 28. pwd_auth timing . . . . . . . . . . . . . . . . . . . . . .35 table 29. read_sig command. . . . . . . . . . . . . . . . . . . .36 table 30. read_sig timing . . . . . . . . . . . . . . . . . . . . . . .36 table 31. check_tearing_event command . . . . . .37 table 32. check_tearing_event timing. . . . . . . . . .37 table 33. vcsl command . . . . . . . . . . . . . . . . . . . . . . . .38 table 34. vcsl timing . . . . . . . . . . . . . . . . . . . . . . . . . . .38 table 35. limiting values . . . . . . . . . . . . . . . . . . . . . . . . .39 table 36. characteristics . . . . . . . . . . . . . . . . . . . . . . . . .39 table 37. wafer specifications mf0ulx1 . . . . . . . . . . . . .40 table 38. abbreviations and symbols . . . . . . . . . . . . . . .43 table 39. revision history . . . . . . . . . . . . . . . . . . . . . . . .45
2345 all information provided in this document is subject to legal disclaimers. ? nxp b.v. 2013. all rights reserved. product data sheet company public rev. 3.0 ? 19 february 2013 234530 49 of 50 nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic 21. figures fig 1. contactless system . . . . . . . . . . . . . . . . . . . . . . . .1 fig 2. block diagram of mf0ulx1 . . . . . . . . . . . . . . . . . .4 fig 3. pin configuration for sot500-4 (moa8) . . . . . . . .5 fig 4. state diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . .8 fig 5. memory organization mf0ul11. . . . . . . . . . . . . . 11 fig 6. memory organization mf0ul21. . . . . . . . . . . . . . 11 fig 7. uid/serial number . . . . . . . . . . . . . . . . . . . . . . . .12 fig 8. lock bytes 0 and 1. . . . . . . . . . . . . . . . . . . . . . . .12 fig 9. lock bytes 2-4 . . . . . . . . . . . . . . . . . . . . . . . . . . .13 fig 10. otp bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14 fig 11. frame delay time (from pcd to picc), t ack and t nak . . . . . . . . . . . . . . . . . . . . . . . . . . .20 fig 12. get_version command. . . . . . . . . . . . . . . . . .22 fig 13. read command . . . . . . . . . . . . . . . . . . . . . . . . .24 fig 14. fast_read command . . . . . . . . . . . . . . . . . . . .26 fig 15. write command . . . . . . . . . . . . . . . . . . . . . . . .28 fig 16. compatibility_write command part 1 . . . . .30 fig 17. compatibility_write command part 2 . . . . .30 fig 18. read_cnt command. . . . . . . . . . . . . . . . . . . . .32 fig 19. incr_cnt command . . . . . . . . . . . . . . . . . . . . .33 fig 20. pwd_auth command . . . . . . . . . . . . . . . . . . . .35 fig 21. read_sig command . . . . . . . . . . . . . . . . . . . . .36 fig 22. check_tearing_event command . . . . . . . .37 fig 23. vcsl command. . . . . . . . . . . . . . . . . . . . . . . . . .38 fig 24. package outline sot500-4 . . . . . . . . . . . . . . . . .41 fig 25. bare die outline mf0ulx1 . . . . . . . . . . . . . . . . . .42
nxp semiconductors mf0ulx1 mifare ultralight ev1 - contactless ticket ic ? nxp b.v. 2013. all rights reserved. for more information, please visit: http://www.nxp.com for sales office addresses, please se nd an email to: salesaddresses@nxp.com date of release: 19 february 2013 234530 please be aware that important notices concerning this document and the product(s) described herein, have been included in section ?legal information?. 22. contents 1 general description . . . . . . . . . . . . . . . . . . . . . . 1 1.1 contactless energy and data transfer. . . . . . . . 1 1.2 anticollision. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.3 simple integration and user convenience. . . . . 2 1.4 security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.5 naming conventions . . . . . . . . . . . . . . . . . . . . . 2 2 features and benefits . . . . . . . . . . . . . . . . . . . . 3 2.1 eeprom . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3 applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 4 quick reference data . . . . . . . . . . . . . . . . . . . . . 3 5 ordering information . . . . . . . . . . . . . . . . . . . . . 4 6 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 4 7 pinning information . . . . . . . . . . . . . . . . . . . . . . 5 7.1 pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 8 functional description . . . . . . . . . . . . . . . . . . . 6 8.1 block description . . . . . . . . . . . . . . . . . . . . . . . 6 8.2 rf interface . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 8.3 data integrity. . . . . . . . . . . . . . . . . . . . . . . . . . . 7 8.4 communication principle . . . . . . . . . . . . . . . . . 8 8.4.1 idle state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 8.4.2 ready1 state. . . . . . . . . . . . . . . . . . . . . . . . . . 9 8.4.3 ready2 state. . . . . . . . . . . . . . . . . . . . . . . . . . 9 8.4.4 active state . . . . . . . . . . . . . . . . . . . . . . . . . 10 8.4.5 authenticated state . . . . . . . . . . . . . . . . . 10 8.4.6 halt state . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 8.5 memory organization . . . . . . . . . . . . . . . . . . . 11 8.5.1 uid/serial number. . . . . . . . . . . . . . . . . . . . . . 12 8.5.2 lock byte 0 and byte 1 . . . . . . . . . . . . . . . . . . 12 8.5.3 lock byte 2 to byte 4 . . . . . . . . . . . . . . . . . . . 13 8.5.4 otp bytes. . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 8.5.5 data pages . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 8.5.6 configuration pages . . . . . . . . . . . . . . . . . . . . 15 8.6 password verification protection . . . . . . . . . . . 16 8.6.1 programming of pwd and pack . . . . . . . . . . 16 8.6.2 limiting negative verification attempts . . . . . . 17 8.6.3 protection of special memory segments. . . . . 17 8.7 counter functionality . . . . . . . . . . . . . . . . . . . . 17 8.8 originality function . . . . . . . . . . . . . . . . . . . . . 18 8.9 virtual card architecture support . . . . . . . . . . 18 9 command overview . . . . . . . . . . . . . . . . . . . . . 19 9.1 mifare ultralight ev1 command overview . . 19 9.2 timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 9.3 mifare ultralight ack and nak . . . . . . . . . 21 9.4 atqa and sak responses . . . . . . . . . . . . . . . 21 10 mifare ultralight ev1 commands. . . . . . . . . 22 10.1 get_version . . . . . . . . . . . . . . . . . . . . . . . 22 10.2 read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 10.3 fast_read . . . . . . . . . . . . . . . . . . . . . . . . . 26 10.4 write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 10.5 compatibility_write. . . . . . . . . . . . . . . . 30 10.6 read_cnt . . . . . . . . . . . . . . . . . . . . . . . . . . 32 10.7 incr_cnt. . . . . . . . . . . . . . . . . . . . . . . . . . . 33 10.8 pwd_auth. . . . . . . . . . . . . . . . . . . . . . . . . . 35 10.9 read_sig. . . . . . . . . . . . . . . . . . . . . . . . . . . 36 10.10 check_tearing_event . . . . . . . . . . . . . 37 10.11 vcsl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 11 limiting values . . . . . . . . . . . . . . . . . . . . . . . . 39 12 characteristics . . . . . . . . . . . . . . . . . . . . . . . . 39 13 wafer specification . . . . . . . . . . . . . . . . . . . . . 40 13.1 fail die identifica tion . . . . . . . . . . . . . . . . . . . 40 14 package outline. . . . . . . . . . . . . . . . . . . . . . . . 41 14.1 bare die outline . . . . . . . . . . . . . . . . . . . . . . . . 42 15 abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . 43 16 references. . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 17 revision history . . . . . . . . . . . . . . . . . . . . . . . 45 18 legal information . . . . . . . . . . . . . . . . . . . . . . 46 18.1 data sheet status . . . . . . . . . . . . . . . . . . . . . . 46 18.2 definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 18.3 disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . . 46 18.4 trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . 47 19 contact information . . . . . . . . . . . . . . . . . . . . 47 20 tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 21 figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 22 contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

▲Up To Search▲

Price & Availability of MF0UL2101DA8

	To Download MF0UL2101DA8 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .