MAX66140K-000AA+ - Maxim Integrated

General Description

The MAX66140 combines 1024 bits of user EEPROM

with secure hash algorithm (SHA-1) challenge-and-

response authentication (ISO/IEC 10118-3 SHA-1), a

64-bit unique identifier (UID), one 64-bit secret, and a

13.56MHz ISO 15693 RF interface in a single chip. The

memory is organized as 16 blocks of 8 bytes plus three

more blocks—one for the secret and two for data and

control registers. Except for the secret, each block has

a user-readable write-cycle counter. Four adjacent user

EEPROM blocks form a memory page (pages 0 to 3).

The integrated SHA-1 engine provides a Message

Authentication Code (MAC) using data from the

EEPROM of the device and the 64-bit secret to guaran-

tee secure, symmetric authentication for both reading

and writing to the device. Memory protection features

are write protection and EPROM emulation, which the

user can set for each individual memory page. Page 3

can also be read protected for enhanced authentication

strength. The MAX66140 supports all ISO 15693-

defined data rates, modulation indices, subcarrier

modes, the selected state, application family identifier

(AFI), data storage format identifier (DSFID), and the

Option_flag bit for read operations. Memory write

access (except for AFI, DSFID, and the corresponding

lock bytes) is accomplished through custom com-

mands using a write buffer with readback and copy-to-

memory function.

Applications

Driver Identification (Fleet Application)

Access Control

eCash

Asset Tracking

Features

♦Fully Compliant with ISO 15693 and ISO 18000-3

Mode 1 Standard

♦13.56MHz ±7kHz Carrier Frequency

♦1024-Bit Secure User EEPROM with Block Lock

Feature, Write-Cycle Counter, and Optional

EPROM-Emulation Mode

♦64-Bit UID

♦512-Bit SHA-1 Engine to Compute 160-Bit MAC

and to Generate Secrets

♦Mutual Authentication: Data Read from Device is

Verified and Authenticated by the Host with

Knowledge of the 64-Bit Secret

♦Read and Write (64-Bit Block)

♦Supports AFI and DSFID Function

♦10ms Programming Time

♦Write: 10% or 100% ASK Modulation Using 1/4

(26kbps) or 1/256 (1.6kbps) Pulse Position Coding

♦Read: Load Modulation Using Manchester Coding

with 423kHz and 484kHz Subcarrier in Low

(6.6kbps) or High (26kbps) Data-Rate Mode

♦200,000 Write/Erase Cycles (Minimum)

♦40-Year Data Retention (Minimum)

♦Read Compatible with Existing 1Kb ISO 15693

Products on the Market

MAX66140

ISO 15693-Compliant Secure Memory

________________________________________________________________

Maxim Integrated Products

IC LOAD

SWITCHED

LOAD

MAGNETIC

COUPLING

ANTENNA

RX_IN

TX_OUT

TRANSMITTER

13.56MHz READER

MAX66140

Typical Operating Circuit

Rev 1; 1/11

For pricing, delivery, and ordering information, please contact Maxim Direct at 1-888-629-4642,

or visit Maxim’s website at www.maxim-ic.com.

ABRIDGED DATA SHEET

Mechanical Drawings appear at end of data sheet.

EVALUATION KIT

AVAILABLE

Ordering Information

Denotes a lead(Pb)-free/RoHS-compliant package.

PART TEMP RANGE PIN-PACKAGE

MAX66140E-000AA+ -25°C to +50°C ISO Card

MAX66140K-000AA+ -25°C to +50°C Key Fob

MAX66140

ISO 15693-Compliant Secure Memory

2 _______________________________________________________________________________________

ABRIDGED DATA SHEET

ABSOLUTE MAXIMUM RATINGS

ELECTRICAL CHARACTERISTICS

(TA= -25°C to +50°C, unless otherwise noted.) (Note 1)

Stresses beyond those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. These are stress ratings only, and functional

operation of the device at these or any other conditions beyond those indicated in the operational sections of the specifications is not implied. Exposure to

absolute maximum rating conditions for extended periods may affect device reliability.

Note 1: Guaranteed by simulation, not production tested.

Note 2: Write-cycle endurance is degraded as TAincreases. Not 100% production tested; guaranteed by reliability monitor sampling.

Note 3: Guaranteed by 100% production test at elevated temperature for a shorter time; equivalence of this production test to data

sheet limit at operating temperature range is established by reliability testing.

Note 4: System requirement.

Note 5: Production tested at 13.56MHz only.

Note 6: Measured from the time at which the incident field is present with strength greater than or equal to H(MIN) to the time at

which the MAX66140’s internal power-on reset signal is deasserted and the device is ready to receive a command frame.

Not characterized or production tested; guaranteed by simulation only.

Maximum Incident Magnetic Field Strength ..........141.5dBµA/m

Operating Temperature Range ...........................-25°C to +50°C

Relative Humidity ..............................................(Water Resistant)

Storage Temperature Range ...............................-25°C to +50°C

PARAMETER SYMBOL CONDITIONS MIN TYP MAX UNITS

SHA-1 ENGINE

SHA-1 Computation Time tCSHA (Note 1) Refer to the full data sheet. ms

EEPROM

Programming Time tPROG (Note 1) 9 10 ms

Endurance NCYCLE At +25°C (Note 2) 200,000 Cycles

Data Retention tRET (Note 3) 40 Years

RF INTERFACE

Carrier Frequency fC(Notes 4, 5) 13.553 13.560 13.567 MHz

At +25°C, MAX66140E 110.5

Activation Field Strength

(Note 1) HMIN At +25°C, MAX66140K 122.0 dBμA/m

At +25°C, MAX66140E 110.7

Write Field Strength (Note 1) HWR At +25°C, MAX66140K 122.4 dBμA/m

Maximum Field Strength HMAX At +25°C (Note 1) 137.5 dBμA/m

Power-Up Time tPOR (Notes 1, 6) 1.0 ms

Detailed Description

The MAX66140 combines 1024 bits of user EEPROM,

128 bits of user and control registers, a 64-bit UID, one

64-bit secret, a 512-bit SHA-1 engine, and a 13.56MHz

ISO 15693 RF interface in a single chip. The memory is

organized as 19 blocks of 8 bytes each. Except for the

secret, each block has a user-readable write-cycle

counter. Four adjacent user EEPROM blocks form a

memory page (pages 0 to 3). Memory protection fea-

tures include write protection and EPROM emulation,

which the user can set for each individual memory

page. Page 3 can also be read protected for enhanced

authentication strength. The MAX66140 is accessed

through ISO 15693-compliant memory and control func-

tion commands. The data rate can be as high as

26.69kbps. The MAX66140 supports AFI and DSFID.

Applications of the MAX66140 include driver identifica-

tion (fleet application), access control, electronic cash,

and asset tracking.

Overview

Figure 1 shows the relationships between the major con-

trol and memory sections of the MAX66140. The device

has six main data components: 1) 64-bit UID, 2) 64-bit

read/write buffer, 3) four 256-bit pages of user EEPROM,

4) two 8-byte blocks of user and control registers, 5) 64-

bit secret’s memory, and 6) a 512-bit SHA-1 engine.

Figure 2 shows the applicable ISO 15693 commands

and their purpose. The network function commands

allow the master to identify all slaves in its range and to

change their state, e.g., to select one for further commu-

nication. The protocol required for these network func-

tion commands is described in the

Network Function

Commands

section. The memory and control functions

access the memory of the MAX66140 for reading and

writing. The protocol for these memory and control func-

tion commands is described in the

Memory and Control

Function Commands

section. All data is read and writ-

ten least significant bit (LSb) first, starting with the least

significant byte (LSB).

Parasite Power

As a wireless device, the MAX66140 is not connected

to any power source. It gets the energy for operation

from the surrounding RF field, which needs to have a

minimum strength as specified in the

Electrical

Characteristics

table.

Unique Identification Number (UID)

Each MAX66140 contains a factory-programmed and

locked identification number that is 64 bits long

(Figure 3). The lower 36 bits are the serial number of the

chip. The next 8 bits store the device feature code, which

is 03h. Bits 45 to 48 are 0h. The code in bit locations 49 to

56 identifies the chip manufacturer, according to ISO/IEC

7816-6/AM1. This code is 2Bh for Maxim. The code in the

upper 8 bits is E0h. The UID is read accessible through

the Inventory and Get System Information commands.

MAX66140

FRONT-

END

VOLTAGE

REGULATOR

INTERNALSUPPLY

MEMORY AND

FUNCTION

CONTROL

ISO 15693

FRAME

FORMATTING

AND

ERROR

DETECTION

READ/WRITE BUFFER

SECRET

UID

BLOCK

USER

EEPROM

SHA-1

ENGINE

DATA

MODULATION

Figure 1. Block Diagram

ISO 15693-Compliant Secure Memory

_______________________________________________________________________________________ 3

ABRIDGED DATA SHEET

MAX66140

Detailed Memory Description

ISO 15693-Compliant Secure Memory

4 _______________________________________________________________________________________

ABRIDGED DATA SHEET

AVAILABLE COMMANDS: DATA FIELD AFFECTED:

INVENTORY

STAY QUIET

SELECT

RESET TO READY

UID, AFI, DSFID, ADMINISTRATIVE DATA

UID

NETWORK

FUNCTION COMMANDS

GET SYSTEM INFORMATION UID, AFI, DSFID, CONSTANTS

MEMORY AND CONTROL

FUNCTION COMMANDS

COMMAND TYPE:

MAX66140

Figure 2. ISO 15693 Commands Overview

MSB LSB

64 57 56 49 48 45 44 37 36 1

E0h 2Bh 0h Feature Code (03h) 36-Bit IC Serial Number

Figure 3. 64-Bit UID

Refer to the full data sheet for this information.

Refer to the full data sheet.

ISO 15693 Communication

Concept

The communication between master and MAX66140

(slave) is based on the exchange of data packets. The

master initiates every transaction; only one side (master

or slaves) transmits information at any time. Each data

packet begins with a start-of-frame (SOF) pattern and

ends with an end-of-frame (EOF) pattern. A data packet

with at least 3 bytes between SOF and EOF is called a

frame (Figure 5). The last 2 bytes of an ISO 15693

frame are an inverted 16-bit CRC of the preceding data

generated according to the CRC-16-CCITT polynomial.

This CRC is transmitted with the LSB first. For more

details on the CRC-16-CCITT, refer to ISO 15693 Part 3,

Annex C.

For transmission, the frame information is modulated on

a carrier frequency, which in the case of ISO 15693 is

13.56MHz. The subsequent paragraphs are a concise

description of the required modulation and coding. For

MAX66140

ISO 15693-Compliant Secure Memory

_______________________________________________________________________________________ 7

SOF 1 OR MORE DATA BYTES CRC (LSB) CRC (MSB) EOF

TIME

Figure 5. ISO 15693 Frame Format

ABRIDGED DATA SHEET

MAX66140

full details including graphics of the data coding

schemes and SOF/EOF timing, refer to ISO 15693-2,

Sections 7.2, 7.3, and 8.

The path from master to slave uses amplitude modula-

tion (Figure 6); the modulation index can be either in

the range of 10% to 30% or 100% (ISO 15693-2,

Section 7.1). The standard defines two pulse-position

coding schemes that must be supported by a compli-

ant device. Scheme A uses the “1 out of 256” method

(Figure 7), where the transmission of 1 byte takes

4.833ms, equivalent to a data rate of 1655 bits/s. The

location of a modulation notch during the 4.833ms con-

veys the value of the byte. Scheme B uses the “1 out

of 4” method (Figure 8), where the transmission of 2

bits takes 75.52µs, equivalent to a data rate of 26,484

bits/s. The location of a modulation notch during the

75.52µs conveys the value of the 2 bits. A byte is trans-

mitted as a concatenation of four 2-bit transmissions,

with the least significant 2 bits of the byte being trans-

mitted first. The transmission of the SOF pattern takes

the same time as transmitting 2 bits in Scheme B. The

SOF pattern has two modulation notches, making it dis-

tinct from any 2-bit pattern. The position of the second

notch tells whether the frame uses the “1 out of 256” or

“1 out of 4” coding scheme (Figures 9 and 10, respec-

tively). The transmission of the EOF pattern takes

37.76µs; the EOF is the same for both coding schemes

and has one modulation notch (Figure 11).

The path from slave to master uses one or two subcar-

riers, as specified by the Subcarrier_flag bit in the

request data packet. The standard defines two data

rates for the response, low (approximately 6,600 bits/s)

and high (approximately 26,500 bits/s). The

Data_rate_flag bit in the request data packet specifies

the response data rate. The data rate varies slightly

depending on the use of one or two subcarriers. The

LSb is transmitted first. A compliant device must sup-

port both subcarrier modes and data rates.

In the single subcarrier case, the subcarrier frequency

is 423.75kHz. One bit is transmitted in 37.76µs (high

data rate) or 151µs (low data rate). The modulation is

the on/off key. For a logic 0, the subcarrier is on during

the first half of the bit transmission time and off for the

second half. For a logic 1, the subcarrier is off during

the first half of the bit transmission time and on for the

second half. See Figure 12 for more details.

In the two subcarrier cases, the subcarrier frequencies

are 423.75kHz and 484.28kHz. The bit duration is the

same as in the single subcarrier case. The modulation

is equivalent to binary FM. For a logic 0, the lower sub-

carrier is on during the first half of the bit transmission

time, switching to the higher subcarrier for the second

half. For a logic 1, the higher subcarrier is on during the

ISO 15693-Compliant Secure Memory

8 _______________________________________________________________________________________

ABRIDGED DATA SHEET

Figure 6. Downlink Modulation (e.g., Approximately 100%

Amplitude Modulation)

CARRIER

AMPLITUDE

100%

Figure 7. Downlink Data Coding (Case “1 Out of 256”)

PULSE-

MODULATED

CARRIER

01234 . . . . .2

....... ........2

.....

~ 9.44μs

~ 18.88μs

~ 4.833ms

MAX66140

ISO 15693-Compliant Secure Memory

_______________________________________________________________________________________ 9

Figure 9. Downlink SOF for “1 Out of 256” Coding (Carrier Not Shown)

~ 9.44μs

~ 37.76μs ~ 37.76μs

~ 9.44μs

Figure 8. Downlink Data Coding (Case “1 Out of 4,” Carrier Not Shown)

PULSE POSITION "00"

PULSE POSITION "01" (1 = LSB)

PULSE POSITION "10" (0 = LSB)

PULSE POSITION "11"

~ 9.44μs ~ 9.44μs

~ 9.44μs

~ 75.52μs

~ 66.08μs

~ 28.32μs

~ 47.20μs

first half of the bit transmission time, switching to the

lower subcarrier for the second half. See Figure 13 for

details. The transmission of the SOF pattern takes the

same time as transmitting 4 bits (approximately 151µs

at a high data rate or approximately 604µs at a low data

rate). The SOF is distinct from any 4-bit data sequence.

The EOF pattern is equivalent to a SOF being transmit-

ted backwards. The exact duration of the SOF and EOF

varies slightly depending on the use of one or two sub-

carriers (Figures 14 and 15, respectively).

ABRIDGED DATA SHEET

MAX66140

ISO 15693-Compliant Secure Memory

10 ______________________________________________________________________________________

ABRIDGED DATA SHEET

Figure 10. Downlink SOF for “1 Out of 4” Coding (Carrier Not Shown)

~ 9.44μs

~ 37.76μs ~ 37.76μs

~ 9.44μs~ 9.44μs

Figure 11. Downlink EOF (Identical for Both Coding Schemes, Carrier Not Shown)

~ 9.44μs

~ 37.76μs

~ 9.44μs

Figure 12. Uplink Coding, Single Subcarrier Case (High Data-Rate Timing)

TRANSMITTING A ZERO

423.75kHz, ~ 18.88μs ~ 18.88μs

~ 37.76μs

TRANSMITTING A ONE

423.75kHz, ~ 18.88μs~ 18.88μs

~ 37.76μs

MAX66140

Figure 13. Uplink Coding, Two Subcarriers Case (High Data-Rate Timing)

TRANSMITTING A ZERO

484.28kHz, ~ 18.58μs423.75kHz, ~ 18.88μs

~ 37.46μs

TRANSMITTING A ONE

484.28kHz, ~ 18.58μs 423.75kHz, ~ 18.88μs

~ 37.46μs

Figure 14. Uplink SOF, Single Subcarrier Case (High Data-Rate Timing)

423.75kHz 423.75kHz

~ 56.64μs ~ 56.64μs ~ 37.76μs

Figure 15. Uplink SOF, Two Subcarriers Case (High Data-Rate Timing)

423.75kHz 423.75kHz484.28kHz484.28kHz

~ 55.75μs ~ 56.64μs ~ 37.46μs

ISO 15693-Compliant Secure Memory

______________________________________________________________________________________ 11

ABRIDGED DATA SHEET

MAX66140

ISO 15693-Compliant Secure Memory

12 ______________________________________________________________________________________

ABRIDGED DATA SHEET

ISO 15693 Slave States and

Address Modes

Initially, the master has no information whether there are

any RF devices in the field of its antenna. The master

learns the UIDs of the slaves in its field from the

responses to the Inventory command, which does not

use the Address_flag and the Select_flag bits. The state

transitions are controlled by network function com-

mands. Figure 16 shows details.

ISO 15693 defines four states in which a slave can be

plus three address modes. The states are power-off,

ready, quiet, and selected. The address modes are

nonaddressed, addressed, and selected. The

addressed mode requires that the master include the

slave’s UID in the request, which increases the size of

the requests by 8 bytes. Table 5 shows which address

mode is applicable depending on the slave’s state and

how to set the Address_flag and the Select_flag bits for

each address mode.

ISO 15693 States and Transitions

Power-Off State

This state applies if the slave is outside the master’s RF

field. A slave transitions to the power-off state when

leaving the power-delivering RF field. When entering

the RF field, the slave automatically transitions to the

ready state.

Ready State

In this state, a slave has enough power to perform any

of its functions. The purpose of the ready state is to

have the slave population ready to process the invento-

ry command as well as other commands sent in the

addressed or nonaddressed mode. A slave can exit the

ready state and transition to the quiet or the selected

state upon receiving the Stay Quiet or Select command

sent in the addressed mode.

Quiet State

In this state, a slave has enough power to perform any

of its functions. The purpose of the quiet state is to

silence slaves that the master does not want to commu-

nicate with. Only commands sent with the addressed

mode are accepted and processed. This way the mas-

ter can use the nonaddressed mode for communication

with remaining slaves in the ready state, which mini-

mizes the size of the request data packets. As long as

no additional slaves arrive in the RF field, it is safe for

the master to continue communicating in the nonad-

dressed mode. A slave can exit the quiet state and

transition to the ready or the selected state upon receiv-

ing the Reset to Ready or Select command sent in the

addressed mode.

Selected State

In this state, a slave has enough power to perform any

of its functions. The purpose of the selected state is to

isolate the slave that the master wants to communicate

with. Commands are accepted and processed regard-

less of the address mode in which they are sent, includ-

ing the Inventory command. With multiple slaves in the

RF field, the master can put one slave in the selected

state and leave all the others in the ready state. This

method requires less communication than using the

quiet state to single out the slave for communication.

For a slave in the selected state, the master can use the

selected mode, which keeps the request data packets

as short as with the nonaddressed mode. A new slave

entering the RF field cannot disturb the communication,

since it stays in the ready state. A slave can exit the

ADDRESS MODES

SLAVE STATES

NONADDRESSED MODE

(Address_flag = 0;

Select_flag = 0)

ADDRESSED MODE

(Address_flag = 1;

Select_flag = 0)

SELECTED MODE

(Address_flag = 0;

Select_flag = 1)

Power-Off (Inactive) (Inactive) (Inactive)

Ready Yes Yes No

Quiet No Yes No

Selected Yes Yes Yes

Table 5. Slave States and Applicable Address Modes

selected state and transition to the ready or the quiet

state upon receiving the Reset to Ready command sent

in any address mode or the Stay Quiet command sent

in the addressed mode. A slave also transitions from

selected to ready upon receiving a Select command if

the UID in the request is different from the slave’s own

UID. In this case the master’s intention is to transition

another slave with the matching UID to the selected

state. If the slave already in the selected state does not

recognize the command, e.g., due to a bit error, two

slaves could be in the selected state. To prevent this

from happening, the master should use the Reset to

Ready or the Stay Quiet command to transition a slave

out of the selected state.

MAX66140

Figure 16. ISO 15693 State Transitions Diagram

POWER-OFF

READY

SELECTEDQUIET

IN FIELD

NOTE 1

NOTE 3

OUT OF FIELD

RESET TO READY

[N, A, S]

OUT OF FIELD

NOTE 2

RESPONSE LEGEND:

NOTE 1: THE SLAVE PROCESSES THE INVENTORY COMMAND AND OTHER COMMANDS PROVIDED THAT THEY ARE SENT IN THE [N] OR [A] ADDRESS MODE.

NOTE 2: THE SLAVE PROCESSES ONLY COMMANDS SENT IN THE [A] ADDRESS MODE.

NOTE 3: THE SLAVE PROCESSES THE INVENTORY COMMAND AND OTHER COMMANDS IN ANY ADDRESS MODE.

RESPONSE TO

RESET TO READY

RESET TO READY [A]

MATCHING UID

STAY QUIET [A]

MATCHING UID

SELECT [A],

NONMATCHING UID

RESPONSE TO

SELECT

NO RESPONSE

STAY QUIET [A] MATCHING UID

SELECT [A]

MATCHING UID

SELECT [A] MATCHING UID

ADDRESS MODE LEGEND:

[N] NONADDRESSED

[A] ADDRESSED

[S] SELECTED

ISO 15693-Compliant Secure Memory

______________________________________________________________________________________ 13

ABRIDGED DATA SHEET

MAX66140

Request Flags

The command descriptions on the subsequent pages begin with a byte called request flags. The ISO 15693 stan-

dard defines two formats for the request flags byte. The state of the Inventory_flag bit controls the function of the bits

in the upper half of the request flag byte. The function of the request flags is as follows:

Request Flags, Inventory_flag Bit Not Set

Bits 8 and 4: No Function

These bits have no function. They must be transmitted as 0.

Bit 7: Options Flag (Option_flag)

This bit is used with block read commands to include the block security status in the response. If not applicable for a

command, the Option_flag bit must be 0.

Bit 6: Address Flag (Address_flag)

This bit specifies whether all slaves in the master’s field that are in the selected or ready state process the request

(bit = 0) or only the single slave whose UID is specified in the request (bit = 1). If the Address_flag bit is 0, the

request must not include a UID. The combination of both the Select_flag and Address_flag bits being set (= 1) is not

valid.

Bit 5: Select Flag (Select_flag)

This bit specifies whether the request is processed only by the slave in the selected state (bit = 1) or by any slave

according to the setting of the Address_flag bit (bit = 0).

Bit 3: Inventory Flag (Inventory_flag)

This bit must be 1 for the Inventory command only. For all other commands, this bit must be 0.

Bit 2: Data Rate Flag (Data_rate_flag)

This bit specifies whether the response data packet is transmitted using the low data rate (bit = 0) or the high data

rate (bit = 1).

Bit 1: Subcarrier Flag (Subcarrier_flag)

This bit specifies whether the response data packet is transmitted using a single subcarrier (bit = 0) or two subcarri-

ers (bit = 1).

ISO 15693-Compliant Secure Memory

14 ______________________________________________________________________________________

ABRIDGED DATA SHEET

BIT 8 (MS) BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT1 (LS)

0 Option_flag Address_flag Select_flag 0 Inventory_flag (= 0) Data_rate_flag Subcarrier_flag

MAX66140

ISO 15693-Compliant Secure Memory

______________________________________________________________________________________ 15

Request Flags, Inventory_flag Bit Set

Bits 8, 7, and 4: No Function

These bits have no function. They must be transmitted as 0.

Bit 6: Slot Counter Flag (Nb_slots_flag)

This bit specifies whether the command is processed using a slot counter (bit = 0) or without using the slot counter

(bit = 1).

Bit 5: Application Family Identifier Flag (AFI_flag)

To detect only slaves with a certain AFI value, the AFI_flag bit must be 1 and the desired AFI value must be included

in the request. If the least significant nibble of the AFI in the request is 0000b, slaves process the command only if

the most significant nibble of the AFI matches. If the AFI in the request is 00h, all slaves process the command

regardless of their AFI.

Bit 3: Inventory Flag (Inventory_flag)

This bit must be 1 for the Inventory command only. For all other commands, this bit must be 0.

Bit 2: Data Rate Flag (Data_rate_flag)

This bit specifies whether the response data packet is transmitted using the low data rate (bit = 0) or the high data

rate (bit = 1).

Bit 1: Subcarrier Flag (Subcarrier_flag)

This bit specifies whether the response data packet is transmitted using a single subcarrier (bit = 0) or two subcarri-

ers (bit = 1).

Network Function Commands

The command descriptions show the data fields of the request and response data packets. To create the complete

frame, an SOF, 16-bit CRC, and EOF must be added (see Figure 5). The ISO 15693 standard defines four network

function commands: Inventory, Stay Quiet, Select, and Reset to Ready. This section describes the format of the

request and response data packets.

Inventory

This command allows the master to learn the UIDs and DSFIDs of all slaves in its RF field in an iterative process. It is

the only command for which the Inventory_flag bit must be 1. The Inventory command uses two command-specific

parameters, which are the mask length and the mask pattern. The mask allows the master to preselect slaves for

responding to the Inventory command. The LSb of the mask aligns with the LSb of the slave’s UID. The master can

choose not to use a mask, in which case all slaves qualify, provided they are not excluded by the AFI criteria (see

the

Request Flags

section). The maximum mask length is 60 (3Ch, if Nb_slots_flag = 0) or 64 (40h, if Nb_slots_flag =

1). The mask pattern defines the least significant bits (as many as specified by the mask length) that a slave’s UID

must match to qualify for responding to the Inventory command (case Nb_slots_flag = 1). If the slot counter is used

(Nb_slots_flag = 0), the value of the slot counter extends the mask pattern at the higher bits for comparison to the

slave’s UID. The slot counter starts at 0 after the inventory request frame is transmitted and increments during the

course of the Inventory command with every subsequent EOF sent by the master. The processing of an Inventory

command ends when the master sends the SOF of a new frame.

BIT 8 (MS) BIT 7 BIT 6 BIT 5 BIT 4 BIT 3 BIT 2 BIT 1 (LS)

0 0 Nb_slots_flag AFI_flag 0 Inventory_flag (= 1) Data_rate_flag Subcarrier_flag

ABRIDGED DATA SHEET

MAX66140

Request Data for the Inventory Command

Response Data for the Inventory Command (No Error)

This response is generated only if a slave qualifies to respond. In case of an error in the request, slaves do not

respond.

When receiving the Inventory command, the slave devices in the RF field enter the collision management sequence.

If a slave meets the conditions to respond, it sends out a response data packet. If multiple slaves qualify, e.g., AFI,

mask, and slot counter are not used, the response frames collide and are not readable. To receive readable

response frames with the UID and DSFID, the master must eliminate the collision.

Not knowing the slave population, the master could begin with a mask length of 0 and activate the slot counter. By

using this method and going through all 16 slots, the master has a chance to receive clean responses (i.e., the slave

is identified) as well as colliding responses. To prevent a slave that has been identified from further participating in

the collision management sequence, the master transitions it to the quiet state. Next, the master issues another

Inventory command where the slot number that previously generated a collision is now used as a 4-bit mask, and

runs again through all 16 slots. If a collision is found, another inventory command is issued, this time with a mask that

is extended at the higher bits by the slot counter value that produced the collision. This process is repeated until all

slaves are identified. For a full description of the Inventory command processing by the slave device and the timing

specifications, refer to ISO 15693 Part 3, Sections 8 to 9.

Stay Quiet

This command addresses an individual slave and transitions it to the quiet state. The request must be sent in the

addressed mode (Select_flag bit = 0, Address_flag bit = 1). The slave transitioning to the quiet state does not send a

response.

Request Data for the Stay Quiet Command

Select

This command addresses an individual slave and transitions it to the selected state. The request must be sent in the

addressed mode (Select_flag bit = 0, Address_flag bit = 1). The slave transitioning to the selected state sends a

response. If there was a slave with a different UID in the selected state, then that slave transitions to the ready state

without sending a response.

ISO 15693-Compliant Secure Memory

16 ______________________________________________________________________________________

ABRIDGED DATA SHEET

REQUEST FLAGS COMMAND AFI

(NOTE 1) MASK LENGTH MASK PATTERN

(NOTE 2)

(1 Byte) 01h (1 Byte) (1 Byte) (Up to 8 Bytes)

Note 1: The AFI byte is transmitted only if the AFI_flag bit is set to 1. The AFI byte, if transmitted, narrows the range of slaves that

qualify for responding to the request.

Note 2: The mask pattern is transmitted only if the selection mask length is not 0. If the mask length is not an integer multiple of 8,

the MSB of the mask pattern must be padded with 0 bits. The LSB of the mask pattern is transmitted first.

RESPONSE FLAGS DSFID UID

00h (1 Byte) (8 Bytes)

REQUEST FLAGS COMMAND UID

(1 Byte) 02h (8 Bytes)

MAX66140

ISO 15693-Compliant Secure Memory

______________________________________________________________________________________ 17

Request Data for the Select Command*

Reset to Ready

This command addresses an individual slave and transitions it to the ready state. To address a slave in the quiet

state, the request must be sent in the addressed mode (Select_flag bit = 0, Address_flag bit = 1). To address a

slave in the selected state, the request can be sent in any address mode. The slave transitioning to the ready state

sends a response.

Request Data for the Reset to Ready Command*

Memory and Control Function Commands

The command descriptions show the data fields of the request and response data packets. To create the complete

frame, an SOF, 16-bit CRC, and EOF must be added (see Figure 5). ISO 15693 defines three address modes,

selected, addressed, and nonaddressed, which are specified through the setting of the Select_flag bit and the

Address_flag bit. The memory and control function commands can be issued in any address mode. To access

slaves in the quiet state, the addressed mode is required. The addressed mode requires that the master include the

slave’s UID in the request.

REQUEST FLAGS COMMAND UID

(1 Byte) 25h (8 Bytes)

If this command is processed without any error, the slave responds with a response flags byte of 00h.

REQUEST FLAGS COMMAND UID**

(1 Byte) 26h (8 Bytes)

If this command is processed without any error, the slave responds with a response flags byte of 00h.

The UID is transmitted only in the addressed mode.

ABRIDGED DATA SHEET

MAX66140

Error Indication

Depending on the complexity of a function, various error conditions can occur. In case of an error, the response to a

request begins with a response flags byte 01h followed by one 1-byte error code.

Table 6 shows a matrix of commands and potential errors. If there was no error, the response begins with a

response flags byte 00h followed by command-specific data, as specified in the detailed command description.

If the MAX66140 does not recognize a command, it does not generate a response.

ISO 15693-Compliant Secure Memory

18 ______________________________________________________________________________________

ABRIDGED DATA SHEET

Table 6. Error Code Matrix

Refer to the full data sheet for this information.

Detailed Command Descriptions

In the request data graphics of this section, the UID field is shaded to indicate that the inclusion of the UID depends

on the address mode.

Get System Information

This command allows the master to retrieve technical information about the MAX66140. The IC reference code indi-

cates the die revision in hexadecimal format, such as A1h, A2h, B1h, etc.

Request Data for the Get System Information Command

Response Data for the Get System Information Command (No Error)

For additional command descriptions, refer to the full data sheet.

MAX66140

ISO 15693-Compliant Secure Memory

______________________________________________________________________________________ 19

REQUEST FLAGS COMMAND UID

(1 Byte) 2Bh (8 Bytes)

RESPONSE

FLAGS

INFO

FLAGS UID DSFID AFI NUMBER OF

BLOCKS

MEMORY BLOCK

SIZE IC REFERENCE

00h 0Fh (8 Bytes) (1 Byte) (1 Byte) 13h 07h (1 Byte)

ABRIDGED DATA SHEET

CRC Generation

The MAX66140 uses two different types of CRCs. One

CRC is an 8-bit type. The equivalent polynomial func-

tion of this CRC is X8+ X5+ X4+ 1.

The other CRC is a 16-bit type, generated according to

the CRC-16-CCITT polynomial function (see Figure 18)

X16 + X12 + X5+ 1. This CRC is used for error detec-

tion in request and response data packets and is

always communicated in the inverted form. After all

data bytes are shifted into the CRC generator, the state

of the 16 flip-flops is parallel-copied to a shift register

and shifted out for transmission with the LSb first. For

more details on this CRC, refer to ISO/IEC 15693-3,

Annex C.

MAX66140

ISO 15693-Compliant Secure Memory

______________________________________________________________________________________ 29

ABRIDGED DATA SHEET

MAX66140

ISO 15693-Compliant Secure Memory

30 ______________________________________________________________________________________

ABRIDGED DATA SHEET

Figure 17. 8-Bit CRC Generator

1ST

STAGE

MSb LSb

2ND

STAGE

3RD

STAGE

4TH

STAGE

7TH

STAGE

8TH

STAGE

6TH

STAGE

5TH

STAGE

X0X1X2X3X4

POLYNOMIAL = X8 + X5 + X4 + 1

INPUT DATA

X5X6X7X8

Figure 18. CRC-16-CCITT Generator

1ST

STAGE

MSb

LSb

2ND

STAGE

7TH

STAGE

8TH

STAGE

6TH

STAGE

X0X1

3RD

STAGE

4TH

STAGE

5TH

STAGE

X2X3X4

POLYNOMIAL = X16 + X12 + X5 + 1

INPUT DATA

X5X6

11TH

STAGE

X11

9TH

STAGE

10TH

STAGE

X9X10

12TH

STAGE

15TH

STAGE

14TH

STAGE

13TH

STAGE

X12 X13 X14

16TH

STAGE

X16

X15

MAX66140

ISO 15693-Compliant Secure Memory

36 ______________________________________________________________________________________

ABRIDGED DATA SHEET

MAX66140K-000AA+MAX66140K-000AA+

TOP VIEW

SIDE VIEW

54mm

28mm 7.7mm

1.6mm

85.60mm

53.98mm

0.76mm

14.29mm

3.49mm

MAX66140E-000AA+

TOP VIEW

SIDE VIEW

KEY FOB

ISO CARD

Mechanical Drawings

MAX66140

ISO 15693-Compliant Secure Memory

Maxim cannot assume responsibility for use of any circuitry other than circuitry entirely embodied in a Maxim product. No circuit patent licenses are

implied. Maxim reserves the right to change the circuitry and specifications without notice at any time.

Maxim Integrated Products, 120 San Gabriel Drive, Sunnyvale, CA 94086 408-737-7600 ____________________

Revision History

REVISION

NUMBER

REVISION

DATE DESCRIPTION PAGES

CHANGED

0 4/10 Initial release —

1 1/11 Added ISO card option to the Ordering Information and Mechanical Drawings 1, 2, 3, 36

ABRIDGED DATA SHEET