my- dTM mov e my- dTM mov e N FC S LE 66 R01 P S LE 66 R01 P N Intelligent 1216 bit EEPROM with Contactless Interface compliant to ISO/IEC 14443-3 Type A and support of NFC ForumTM Type 2 Tag Operation Sh o rt P ro d u c t I n fo r m a ti o n 2011-11-24 Ch i p C a rd & S e c u r i ty Edition 2011-11-24 Published by Infineon Technologies AG 81726 Munich, Germany (c) 2011 Infineon Technologies AG All Rights Reserved. Legal Disclaimer The information given in this document shall in no event be regarded as a guarantee of conditions or characteristics. With respect to any examples or hints given herein, any typical values stated herein and/or any information regarding the application of the device, Infineon Technologies hereby disclaims any and all warranties and liabilities of any kind, including without limitation, warranties of non-infringement of intellectual property rights of any third party. Information For further information on technology, delivery terms and conditions and prices, please contact the nearest Infineon Technologies Office (www.infineon.com). Warnings Due to technical requirements, components may contain dangerous substances. For information on the types in question, please contact the nearest Infineon Technologies Office. Infineon Technologies components may be used in life-support devices or systems only with the express written approval of Infineon Technologies, if a failure of such components can reasonably be expected to cause the failure of that life-support device or system or to affect the safety or effectiveness of that device or system. Life support devices or systems are intended to be implanted in the human body or to support and/or maintain and sustain and/or protect human life. If they fail, it is reasonable to assume that the health of the user or other persons may be endangered. my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN my-dTM move / my-dTM move NFC - SLE 66R01P / SLE 66R01PN Short Product Information The information in this document is subject to change without notice. Revision History: Current Version 2011-11-24 Previous Release: Preliminary 2011-11-18 Page Subjects (major changes since last revision) All Editorial changes; removed "Preliminary" status Trademarks of Infineon Technologies AG BlueMoonTM, COMNEONTM, C166TM, CROSSAVETM, CanPAKTM, CIPOSTM, CoolMOSTM, CoolSETTM, CORECONTROLTM, DAVETM, EasyPIMTM, EconoBRIDGETM, EconoDUALTM, EconoPACKTM, EconoPIMTM, EiceDRIVERTM, EUPECTM, FCOSTM, HITFETTM, HybridPACKTM, ISOFACETM, IRFTM, IsoPACKTM, MIPAQTM, ModSTACKTM, my-dTM, NovalithICTM, OmniTuneTM, OptiMOSTM, ORIGATM, PROFETTM, PRO-SILTM, PRIMARIONTM, PrimePACKTM, RASICTM, ReverSaveTM, SatRICTM, SensoNorTM, SIEGETTM, SINDRIONTM, SMARTiTM, SmartLEWISTM, TEMPFETTM, thinQ!TM, TriCoreTM, TRENCHSTOPTM, X-GOLDTM, XMMTM, X-PMUTM, XPOSYSTM. Other Trademarks Advance Design SystemTM (ADS) of Agilent Technologies, AMBATM, ARMTM, MULTI-ICETM, PRIMECELLTM, REALVIEWTM, THUMBTM of ARM Limited, UK. AUTOSARTM is licensed by AUTOSAR development partnership. BluetoothTM of Bluetooth SIG Inc. CAT-iqTM of DECT Forum. COLOSSUSTM, FirstGPSTM of Trimble Navigation Ltd. EMVTM of EMVCo, LLC (Visa Holdings Inc.). EPCOSTM of Epcos AG. FLEXGOTM of Microsoft Corporation. FlexRayTM is licensed by FlexRay Consortium. HYPERTERMINALTM of Hilgraeve Incorporated. IECTM of Commission Electrotechnique Internationale. IrDATM of Infrared Data Association Corporation. ISOTM of INTERNATIONAL ORGANIZATION FOR STANDARDIZATION. MATLABTM of MathWorks, Inc. MAXIMTM of Maxim Integrated Products, Inc. MICROTECTM, NFC ForumTM is trademark of Near Field Communication Forum, NUCLEUSTM of Mentor Graphics Corporation. MifareTM of NXP. MIPITM of MIPI Alliance, Inc. MIPSTM of MIPS Technologies, Inc., USA. muRataTM of MURATA MANUFACTURING CO., MICROWAVE OFFICETM (MWO) of Applied Wave Research Inc., OmniVisionTM of OmniVision Technologies, Inc. OpenwaveTM Openwave Systems Inc. RED HATTM Red Hat, Inc. RFMDTM RF Micro Devices, Inc. SIRIUSTM of Sirius Sattelite Radio Inc. SOLARISTM of Sun Microsystems, Inc. SPANSIONTM of Spansion LLC Ltd. SymbianTM of Symbian Software Limited. TAIYO YUDENTM of Taiyo Yuden Co. TEAKLITETM of CEVA, Inc. TEKTRONIXTM of Tektronix Inc. TOKOTM of TOKO KABUSHIKI KAISHA TA. UNIXTM of X/Open Company Limited. VERILOGTM, PALLADIUMTM of Cadence Design Systems, Inc. VLYNQTM of Texas Instruments Incorporated. VXWORKSTM, WIND RIVERTM of WIND RIVER SYSTEMS, INC. ZETEXTM of Diodes Zetex Limited. Short Product Information 3 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN Features Intelligent 1216 bit EEPROM with Contactless Interface compliant to ISO/IEC 14443-3 Type A and support of NFC ForumTM Type 2 Tag Operation Contactless Interface * * * Physical Interface and Anticollision compliant to ISO/IEC 14443-3 Type A - Operation frequency 13.56 MHz - Data rate 106 kbit/s in both direction - Contactless transmission of data and supply energy - Anticollision logic: several cards may be operated in the field simultaneously Unique IDentification number (7-byte double-size UID) according to ISO/IEC 14443-3 Type A Read and Write Distance up to 10 cm and more (influenced by external circuitry i.e. reader and inlay design) 152 byte EEPROM * * * * * * * Organized in 38 blocks of 4 bytes each 128 bytes freely programmable User Memory 24 bytes of Service Area reserved for UID, Configuration, LOCK Bytes, OTP Block and Manufacturer Data Read and Write of 128 bytes of User Memory in less than 100 ms Programming time per block < 4 ms Endurance minimum 10,000 erase/write cycles1) Data Retention minimum 5 years1) Privacy Features * * * * * * 32 bit of One Time Programmable (OTP) memory area Locking mechanism for each block Block Lock mechanism Optional 32 bit Password for Read/Write or Write access Optional Password Retry Counter Optional 16 bit Value Counter Data Protection * * Data Integrity supported by 16 bit CRC, parity bit, command length check Anti-tearing mechanism for OTP, Password Retry Counter and Value Counter NFC ForumTM Operation * * * * Compliant to NFC ForumTM Type 2 Tag Operation Support of Static and Dynamic Memory Structure according to NFC ForumTM Type 2 Tag Operation SLE 66R01PN: pre-configured NFC memory with empty NDEF message (INITIALIZED state, non-reversible) SLE 66R01P: UNINITIALIZED state, may be configured to INITIALIZED state Electrical Characteristics * * * On-Chip capacitance 17 pF + 5% ESD protection minimum 2 kV Ambient Temperature -25C ... +70C (for the chip) 1) Values are temperature dependent Short Product Information 4 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN Ordering and packaging information 1 Ordering and packaging information Table 1 Ordering information Total Memory / User Memory1) Type Package SLE 66R01P C wafer sawn / unsawn SLE 66R01P NB NiAu Bumped (sawn wafer) Ordering code on request SP000911428 152 / 128 bytes SLE 66R01PN C wafer sawn / unsawn SLE 66R01PN NB NiAu Bumped (sawn wafer) on request SP000953914 1) Total memory size includes the service area whereas user memory size is freely programmable for user data. For more ordering information about the form of delivery please contact your local Infineon sales office. 1.1 Pin description LA my-dTM move (NFC) SLE 66R01P(N) LB Figure 1 Pin configuration die Table 2 Pin description and function Symbol Function LA Antenna Connection LB Antenna Connection Short Product Information 5 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN my-dTM Product Family 2 my-dTM Product Family my-dTM products are available both in plain mode with open memory access and in secure mode with memory access controlled by authentication procedures. The my-dTM product family provides users with different memory sizes, features NFC ForumTM Type 2 Tag functionality and incorporates security features to enable considerable flexibility in the application design. Flexible controls within the my-dTM devices start with plain mode operation featuring individual page locking; for more complex applications various settings in secure mode can be set for multi user / multi application configurations. In plain mode access to the memory is supported by both 4-byte block as well as 8-byte page structure. In secure mode a cryptographic algorithm based on a 64-bit key is available. Mutual authentication, message authentication codes (MAC) and customized access conditions protect the memory against unauthorized access. The functional architecture, meaning the memory organization and authentication of my-dTM products is the same for both my-dTM proximity (ISO/IEC 14443) and my-dTM vicinity (ISO/IEC 18000-3 mode 1 or ISO/IEC 15693). This eases the system design and allows simple adaptation between applications. Configurable Value Counters featuring anti-tearing functionality are suitable for value token applications, such as limited use transportation tickets. Architectural interoperability of my-dTM products enables an easy migration from simple to more demanding applications. The my-dTM move family is designed for cost optimized applications and its implemented command set eases the usage in existing applications and infrastructures. In addition, the my-dTM light (ISO/IEC 18000-3 mode 1 or ISO/IEC 15693) is part of the my-dTM family. Its optimized command set and memory expands the range of applications to cost sensitive segments. 2.1 my-dTM move and my-dTM move NFC The my-dTM move and my-dTM move NFC are part of Infineon's my-dTM product family and are designed to meet the requirements of the increasing NFC market demanding smart memories. They are compliant to ISO/IEC 14443-3 Type A, to ISO/IEC 18092 and to NFC ForumTM Type 2 Tag Operation. 128 Bytes of memory can be arranged in static or dynamic memory structures for NFC applications. my-dTM move and my-dTM move NFC products also feature configurable Value Counters which support antitearing protection. Privacy features like a password protection including password retry counter provide basic security to the applications. Based on SLE 66R01P the SLE 66R01PN already contains a pre-configuration of the NFC memory indicating the INITIALIZED state according to the definition of the NFC ForumTM Type 2 Tag life cycle. Due to that the my-dTM move NFC is ready to be used in NFC infrastructures. my-dTM move and my-dTM move NFC products are suited for a broad range of applications like public transport, event ticketing or smart posters. Short Product Information 6 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN my-dTM Product Family 2.2 Application Segments my-dTM products are optimized for personal and object identification. Please find in the following table some dedicated examples Table 3 my-dTM family product overview Product Application my-dTM move - SLE 66R01P Public Transport, Smart Posters, NFC Device Pairing my-dTM move NFC - SLE 66R01PN Public Transport, Smart Posters, NFC Device Pairing, NFC INITIALIZED state my-dTM move lean - SLE 66R01L Public Transport, Smart Posters, NFC Device Pairing my-dTM NFC - SLE 66RxxP Smart Posters and Maps, NFC Device Pairing, Loyalty Schemes, Consumer Good Information, Healthcare Monitoring my-dTM proximity 2 - SLE 66RxxS Access Control, Entertainment, Public Transport, Customer Loyalty Schemes, Micro Payment my-dTM proximity enhanced - SLE 55RxxE Access Control, Gaming, Entertainment, Customer Loyalty Schemes my-dTM light - SRF 55V01P Libraries, Laundry, Factory Automation, Media Management, Event Ticketing, Leisure Park Access my-dTM vicinity plain - SRF 55VxxP Factory Automation, Healthcare, Ticketing, Access Control my-dTM vicinity plain HC - SRF 55VxxP HC Ticketing, Brand Protection, Loyalty Schemes, Ski passes my-dTM vicinity secure - SRF 55VxxS Ticketing, Brand protection, Loyalty Schemes, Access Control Short Product Information 7 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN Scope of my-dTM move / my-dTM move NFC 3 Scope of my-dTM move / my-dTM move NFC The SLE 66R01P and SLE 66R01PN are part of the Infineon my-dTM product family and support Infineon's transport and ticketing strategy and are designed to meet the requirements of NFC applications. They are compliant to ISO/IEC 14443-3 Type A, to ISO/IEC 18092 and to NFC ForumTM Type 2 Tag Operation. 3.1 Circuit Description The SLE 66R01P and SLE 66R01PN are made up of an EEPROM memory unit, an analog interface for contactless operation, a data transmission path and a control unit. The following diagram shows the main blocks of the SLE 66R01P and SLE 66R01PN. LA POWER Analog Contactless Interface Memory Unit CLOCK Antenna Power Circuit Rectifier Clock Extractor Voltage Regulator Power on Reset DATA Parallel Serial IO Command LB Anticollision Memory Access Control Unit Figure 2 Block Diagram of the SLE 66R01P and SLE 66R01PN The SLE 66R01P and SLE 66R01PN comprise the following three parts: * * * Analog Contactless Interface - The Analog Contactless Interface contains the voltage rectifier, voltage regulator and system clock to supply the IC with appropriate power. Additionally the data stream is modulated and demodulated. Memory Unit - The Memory Unit consists of 38 blocks of 4 bytes each. Control Unit - The Control Unit decodes and executes all commands. Additionally the control unit is responsible for the correct anticollision flow. Short Product Information 8 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN Scope of my-dTM move / my-dTM move NFC 3.2 Memory Principle The total amount of addressable memory is 152 bytes organized in blocks of 4 bytes each. The general structure comprises Service Areas as well as User Areas: * * 24 bytes of service and administration data (located in Service Area 1 and 2) reserved for - 7-byte double-size UID - configuration data - LOCKx bytes - OTP memory - Manufacturing Data 128 bytes of User memory (located in User Area 1 and 2) reserved for - User Data - Value Counter Additionally the Password and Password Retry Counter are available and accessible via dedicated commands. Service Area 1 Unique serial number (UID) User Area 1 Password protectable User Area 2 Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 3 SLE 66R01P and SLE 66R01PN memory principle Short Product Information 9 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN Scope of my-dTM move / my-dTM move NFC 3.2.1 Service Area 1 Service Area 1 contains * * * * the 7-byte UID which is programmed at manufacturing of the chip and cannot be changed CONFIG byte to enable the Password (incl. the Password Retry counter) and the Value Counter functionality LOCK0, LOCK1 bytes to enable an irreversible write-protection for the blocks located in User Area 1 32 bits of the One-Time-Programmable (OTP) memory block can irreversibly be programmed from 0B to 1B 3.2.2 User Area 1 48 bytes (12 blocks, 4 bytes each) of memory for user data. 3.2.3 User Area 2 User Area 2 contains * * 80 bytes (20 blocks, 4 bytes each) of user memory for user data. These memory blocks can be used to store user data. This portion of the memory may be protected with a 32 bit password. a 16-bit Value Counter may be activated providing a mechanism to store some value (points, trips, ...) on the my-dTM move and my-dTM move NFC chip. 3.2.4 Service Area 2 Service Area 2 contains * * lock bytes LOCK2 to LOCK5 to enable an irreversible write-protection for the blocks loacted in User Area 2 Manufacturing Data (programmed during manufacturing of the chip) which cannot be changed Short Product Information 10 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN Scope of my-dTM move / my-dTM move NFC 3.3 Memory Principle for NFC ForumTM Type 2 Tag The memory organization is configurable according to the NFC ForumTM Type 2 Tag Operation specification. Static or dynamic memory structures are supported. Figure 4 illustrates the principle of the SLE 66R01P and SLE 66R01PN as a NFC ForumTM Type 2 Tag compatible chip. The memory can be accessed with NFC ForumTM Type 2 Tag commands. Service Area 1 Unique serial number (UID) CAPABILITY CONTAINER Data Data User Area 1 Password protectable User Area 2 Data Service Area 2 PASSWORD PASSWORD RETRY COUNTER Figure 4 SLE 66R01P and SLE 66R01PN NFC ForumTM Type 2 Tag memory structure Based on SLE 66R01P the SLE 66R01PN already contains a pre-configuration of the NFC memory indicating the INITIALIZED state according to the definition of the NFC ForumTM Type 2 Tag life cycle. With this preconfiguration the my-dTM move NFC can be immediately used in NFC infrastructures. For details regarding the NFC initialization of my-dTM move and my-dTM move NFC please refer the the Application Note "How to operate my-dTM move and my-dTM move NFC devices in NFC ForumTM Type 2 Tag infrastructures" and the Data Book available at Chip Card & Security security.chipcard.ics@infineon.com. Attention: The pre-configuration of SLE 66R01PN is nonreversible and the my-dTM move NFC cannot be overwritten and used as plain, standard my-dTM move anymore. Short Product Information 11 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN Scope of my-dTM move / my-dTM move NFC 3.4 System Overview The system consists of a host system, one or more SLE 66R01P / SLE 66R01PN tags or other ISO/IEC 144433 Type A compliant cards and an ISO/IEC 14443-3 Type A compatible contactless reader. Alternatively, since the SLE 66R01P and SLE 66R01PN can be used in NFC ForumTM Type 2 Tag memory structures, a NFC ForumTM device in card reader/writer mode can be used to operate the chip. Host System PCD Micro Controller Analog Circuitry SLE 66R01P(N) my-dTM move (NFC) Energy Identification Terminal ISO/IEC14443 Type A or NFC ForumTM Device Figure 5 Clock PICC Antenna Data SLE 66R01P and SLE 66R01PN Contactless System Overview Short Product Information 12 / 14 2011-11-24 my-dTM move / my-dTM move NFC SLE 66R01P / SLE 66R01PN Scope of my-dTM move / my-dTM move NFC UID Coding 3.5 To identify a SLE 66R01P and SLE 66R01PN chip the manufacturer code and a chip family identifier are coded into the UID as described in the Table 4. The chip family identifier can be used to determine the basic command set for the chip. UID PCD size double PICC '93' '95' CT uid0 uid1 uid2 BCC '05H' uid3 uid4 uid5 uid6 BCC Chip Family ID Figure 6 SLE 66R01P and SLE 66R01PN double-size UID Table 4 UID Coding UID Field Value Description uid0 05H IC Manufacturer Code according to ISO/IEC 7816-6 uid1 3xH Chip Family Identifier Higher Nibble: 0011B: my-dTM move and my-dTM move NFC Lower Nibble: part of the UID number 3.6 Supported Standards the SLE 66R01P and SLE 66R01PN support the following standards: * * * ISO/IEC 14443 Type A (Parts 1, 2 and 3) tested according to ISO/IEC 10373-6 (PICC Test & Validation) ISO/IEC 14443-3 Type A NFC ForumTM Type 2 Tag Operation 3.7 Command Set The SLE 66R01P and SLE 66R01PN is compliant to the ISO/IEC 14443-3 Type A standard. A set of standard ISO/IEC 14443-3 Type A commands is implemented to operate the chip. Additionally NFC ForumTM Type 2 Tag commands and a my-dTM move and my-dTM move NFC specific command set is implemented. This facilitates the access to the on-chip integrated memory and supports the execution of password and counter functionality. Short Product Information 13 / 14 2011-11-24 w w w . i n f i n e o n . c o m Published by Infineon Technologies AG 14