INTEGRATED CIRCUITS DATA SHEET HITAG S HTS IC H32/HTS IC H56/HTS IC H48 Transponder IC Product Specification Revision 3.1 PUBLIC INFORMATION 2006 July 18 079231 Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 CONTENTS 9.3 9.4 1 FEATURES . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.1 1.2 1.3 1.4 1.5 Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . Supported Standards . . . . . . . . . . . . . . . . . Security Features . . . . . . . . . . . . . . . . . . . . Delivery Types . . . . . . . . . . . . . . . . . . . . . . 2 GENERAL DESCRIPTION . . . . . . . . . . . . . 4 2.1 2.1.1 2.1.2 2.1.3 2.1.4 2.1.5 2.1.6 Target Markets . . . . . . . . . . . . . . . . . . . . . . Animal Identification . . . . . . . . . . . . . . . . . . Laundry Automation . . . . . . . . . . . . . . . . . . Beer Keg and Gas Cylinder Logistic . . . . . . Pigeon Race Sports . . . . . . . . . . . . . . . . . . Security Applications . . . . . . . . . . . . . . . . . Access Control, Company Cards, Amusement Parks. . . . . . . . . . . . . . . . . . . . Customer Application Support and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 3 3 3 3 3 9.5 9.6 9.7 Reset Time . . . . . . . . . . . . . . . . . . . . . . . . 26 HITAG S Transponder waiting time before transmitting a response after receiving an EOF . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 HITAG S Transponder programming time . 28 HITAG S Transponder waiting time before transmitting data in TTF Mode . . . . . . . . . . 29 HITAG S Transponder Mode switching time . . . . . . . . . . . . . . . . . . . . . . 30 10 STATE DIAGRAM . . . . . . . . . . . . . . . . . . . 31 10.1 10.2 10.3 General Description of States . . . . . . . . . . 31 HITAG S 32 . . . . . . . . . . . . . . . . . . . . . . . . 32 HITAG S 256 and HITAG S 2048 . . . . . . . 33 11 COMMAND SET . . . . . . . . . . . . . . . . . . . . 34 11.1 11.2 11.3 11.4 11.5 11.6 11.7 11.8 11.9 11.10 11.11 General Comments . . . . . . . . . . . . . . . . . . 34 UID REQUEST xx . . . . . . . . . . . . . . . . . . . 34 AC SEQUENCE. . . . . . . . . . . . . . . . . . . . . 35 SELECT (UID) . . . . . . . . . . . . . . . . . . . . . 36 CHALLENGE . . . . . . . . . . . . . . . . . . . . . . . 37 SELECT_QUIET (UID) . . . . . . . . . . . . . . . 38 READ PAGE . . . . . . . . . . . . . . . . . . . . . . . 38 READ BLOCK . . . . . . . . . . . . . . . . . . . . . . 39 WRITE PAGE . . . . . . . . . . . . . . . . . . . . . . 40 WRITE BLOCK . . . . . . . . . . . . . . . . . . . . . 41 QUIET . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 12 TRANSPONDER TALKS FIRST (TTF) MODE . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 12.1 12.2 12.3 32 Bit TTF Mode . . . . . . . . . . . . . . . . . . . . 43 64 Bit TTF Mode . . . . . . . . . . . . . . . . . . . . 43 128 Bit TTF Mode . . . . . . . . . . . . . . . . . . . 44 13 12 13 14 DATA INTEGRITY / CALCULATION OF CRC . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 13.1 15 15 17 13.2.1 13.2.2 4 4 4 4 4 4 4 4 3 ORDERING INFORMATION . . . . . . . . . . . 5 4 BLOCKDIAGRAM . . . . . . . . . . . . . . . . . . . . 6 5 REFERENCE DOCUMENTS . . . . . . . . . . . 6 6 MEMORY ORGANISATION . . . . . . . . . . . . 7 6.1 6.1.1 6.2 6.3 Unique Identifier (UID) . . . . . . . . . . . . . . . . Product identifier (PID) . . . . . . . . . . . . . . . . HITAG S Plain Mode. . . . . . . . . . . . . . . . . . HITAG S Authentication Mode . . . . . . . . . . 7 FUNCTIONAL DESCRIPTION . . . . . . . . . 10 7.1 7.2 7.3 7.4.1 7.4.2 Basic System Configuration . . . . . . . . . . . Energy Transmission . . . . . . . . . . . . . . . . Data Transmission: Transponder Read/Write Device . . . . . . . . . . . . . . . . . . Coding. . . . . . . . . . . . . . . . . . . . . . . . . . . . Data Rate . . . . . . . . . . . . . . . . . . . . . . . . . Data Transmission: Read/Write Device Transponder (Physical Layer) . . . . . . . . . . Coding. . . . . . . . . . . . . . . . . . . . . . . . . . . . Modulation details . . . . . . . . . . . . . . . . . . . 8 CONFIGURATION . . . . . . . . . . . . . . . . . . 18 13.3 Data Transmission: Read/Write Device to HITAG S Transponder . . . . . . . . . . . . . . . . 45 Data Transmission: HITAG S Transponder to Read/Write Device . . . . . . . . . . . . . . . . . . . 45 Standard Response Protocol Mode . . . . . . 45 Advanced/Fast Advanced Response Protocol Mode . . . . . . . . . . . . . . . . . . . . . . 45 Source Code for CRC-Checksum . . . . . . . 46 8.1 8.2 8.2.1 8.2.2 8.2.3 Configuration Page . . . . . . . . . . . . . . . . . . Delivery Configuration. . . . . . . . . . . . . . . . HITAG S32 . . . . . . . . . . . . . . . . . . . . . . . . HITAG S256 . . . . . . . . . . . . . . . . . . . . . . . HITAG S2048 . . . . . . . . . . . . . . . . . . . . . . 18 21 21 22 23 14 ABBREVIATIONS . . . . . . . . . . . . . . . . . . . 47 15 DATA SHEET STATUS . . . . . . . . . . . . . . . 48 16 DEFINITIONS . . . . . . . . . . . . . . . . . . . . . . 48 17 DISCLAIMERS . . . . . . . . . . . . . . . . . . . . . 48 9 PROTOCOL TIMING . . . . . . . . . . . . . . . . 24 18 REVISION HISTORY. . . . . . . . . . . . . . . . . 50 9.1 Read/Write Device waiting time before sending the first command . . . . . . . . . . . . . . . . . . . 24 Read/Write Device waiting time before sending a subsequent command . . . . . . . . . . . . . . 25 7.3.1 7.3.2 7.4 9.2 8 8 8 9 10 11 13.2 2 PUBLIC INFORMATION Philips Semiconductors HITAG S 1 Product Specification Revision 3.1 2006 July 18 HTS IC H32/HTS IC H56/HTS IC H48 FEATURES 1.4 * Integrated Circuit for Contactless Identification Transponders and Cards Security Features * 32 Bit Unique Identification Number (UID) * 48 Bit secret key based encrypted authentication * Integrated resonance capacitor of 210 pF with 5 % tolerance over full production 1.5 * Frequency range 100..150 kHz. * Sawn, gold - bumped 8" Wafer 1.1 Delivery Types * Contactless Chip Card Module MOA2 Protocol * I - Connect (Low Cost Flip Chip Package) * Modulation Read/Write Device Transponder: 100 % ASK and Binary Pulse Length Coding * Modulation Transponder Read/Write Device: Strong ASK modulation with Anticollision, Manchester and Biphase Coding * Fast Anticollision Protocol for inventory tracking: 100 Tags in 3.2 seconds * Data integrity check (CRC) * Optional Transponder Talks First Modes with user defined data length * Temporary switch from Transponder Talks First into Reader Talks First Mode * Data Rate Read/Write Device to Transponder: 5.2 kBit/s * Data Rates Transponder to Read/Write Device: 2 kBit/s, 4 kBit/s, 8 kBit/s 1.2 Memory * Three memory options (32 Bit UID, 256 Bit, 2048 Bit) * More than 100000 erase/write cycles * 10 years non - volatile data retention * Secure Memory Lock functionality 1.3 Supported Standards * Full compliant to ISO 11784/85 Animal ID * Targeted to operated on hardware infrastructure of new upcoming standards - ISO14223 (Animal ID with anticollision and read/write functionality) - ISO 18000-2 (AIDC Techniques-RFID or Item Management) * Supports German Waste Management Standard and Pigeon Race Standard 3 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 2 HTS IC H32/HTS IC H56/HTS IC H48 GENERAL DESCRIPTION 2.1.2 * Identify 200 pcs of garment with one Read/Write Device The HITAGTM product line is well known and established in the contactless identification market. * Long operation distance with typical small shaped laundry button transponders Due to the open marketing strategy of Philips Semiconductors there are various manufacturers well established for both the transponders / cards as well as the Read/Write Devices. All of them supporting HITAG 1 and HITAG 2 transponder IC's. With the new HITAG S family, this existing infrastructure is extended with the next generation of IC's being substantially smaller in mechanical size, lower in cost, offering more operation distance and speed, but still being operated with the same reader infrastructure and transponder manufacturing equipment. * Insensitive to harsh conditions like pressure, heat and water. 2.1.3 * Long writing distance. * Voluntarily change between TTF Mode with user defined data length and Read/Write Modes with out changing the configuration on the transponder. * Authenticity check at the beer pubs- between beer bumper and supplied beer keg, provides a safe protection of the beer brand. The protocol and command structure for HITAG S is based on HITAG 1, including anticollision algorithm. Three different memory sizes are offered and can be operated using exactly the same protocol. 32 Bit Unique Identifier Read Only HITAG S 256 256 Bit Total Memory Read/Write HITAG S 2048 2048 Bit Total Memory Read/Write 2.1 2.1.1 BEER KEG AND GAS CYLINDER LOGISTIC * Recognising a complete pallet of gas cylinders at one time. One Protocol - three memory options. HITAG S 32 LAUNDRY AUTOMATION 2.1.4 PIGEON RACE SPORTS According to European pigeon race standards, offering the additional shadow memory, that is required in some European companies. 2.1.5 Target Markets SECURITY APPLICATIONS Authenticity check for high level brands or for original refilling e.g. toner for fax machines. ANIMAL IDENTIFICATION Basically, the animal id market can be divided into two different areas: 2.1.6 a) Identification of pet animals ACCESS CONTROL, COMPANY CARDS, AMUSEMENT PARKS The included encrypted authentication feature is well suited for applications like access control and vending machines. In particular the combined application with one company card opening the barrier for the car parking, opening the access to the building and rooms with different security levels, offering drinks and coffee from the vending machines in the socialising area. Some countries require that the your dog/cat is being microchiped prior to immigration. But it is also of advantage in case your pet is getting lost. The microchiped pet gets easily identified with a handheld reader and thus can be distinguished from stray animals. The ISO standard 11784/85 is well established in this markets and HITAG S 256 and HITAG S 2048 are compliant to this standard, while offering additional memory for storage of customised off line data, such as phone number/address of the pets owner. 2.2 Customer Application Support and Training Within the dedicated CAS team within the BU Identification. b) Identification and Tracking of livestock like cattle, pork and sheep Please Contact: info.bli@philips.com Being compatible with the ISO 11784/85 reader infrastructure, HITAG S can be switched temporarily into read/write mode, thus enabling additional features, like e.g. off line data storage directly on the animals tag Accompanying Data Sheets and Application Notes: http://www.semiconductors.com/markets/identification/ customer/download/index.html#hitag This concept has already been standardised within ISO 14223/1. 4 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 3 HTS IC H32/HTS IC H56/HTS IC H48 ORDERING INFORMATION EXTENDED TYPE NUMBER DESCRIPTION MEMORY SIZE ORDERING CODE PACKAGE Sawn 8" wafer on foil (FFC), 150 m, inked and mapped, with gold bumps 32 Bit 9352 729 70005 - 256 Bit 9352 729 71005 - 2048 Bit 9352 729 73005 - 32 Bit 9352 729 69118 HTS MO H56 01EV 256 Bit 9352 729 72118 SOT500AA1 HTS MO H48 01EV 2048 Bit 9352 729 74118 HTS IC H32 01EW/V4 HTS IC H56 01EW/V4 HTS IC H48 01EW/V4 HTS MO H32 01EV MOA2 Package -25 C to +85 C HTS FC H32 01EV/DH Flip Chip Package, Hot HTS FC H56 01EV/DH Laminated 32 Bit 9352 729 75118 256 Bit 9352 729 76118 SOT732AA1 HTS FC H48 01EV/DH 2048 Bit 9352 729 77118 5 TEMPERATURE RANGE (C) -25 C to +85 C -25 C to +85 C PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 4 HTS IC H32/HTS IC H56/HTS IC H48 BLOCKDIAGRAM The HITAG S Transponder requires no external power supply. The contactless interface generates the power supply and the system clock via the resonant circuitry by inductive coupling to the Read/Write Device (RWD). The interface also demodulates data transmitted from the RWD to the HITAG S Transponder, and modulates the magnetic field for data transmission from the HITAG S Transponder to the RWD. Data are stored in a non-volatile memory (EEPROM). The EEPROM has a capacity up to 2048 Bit and is organised in 64 Pages consisting of 4 Bytes each (1 Page = 32 Bits). Analogue RF Interface VDD V RECT Anticollision 32 Bit Read/Write Control DEMOD Data In Access Control Transponder Cres EEPROM 64 Pages PAD Digital Control VREG MOD Data Out EEPROM Interface Control R/W CLK PAD Clock RF Interface Control Sequencer Charge Pump Fig.1 Block diagram. 5 REFERENCE DOCUMENTS * General Quality Specification * General Specification for 8" Wafer * Bumped Wafer Specification * Addendum Bumped Wafer Specification HTS IC H32/ HTS IC H56/ HTS IC H48 (electrical values) * Contactless Chip Card Module Specification * Addendum Contactless Chip Card Module Specification HTS MO H32/HTS MO H56/HTS MO H48 * Flip Chip Package Specification * Addendum Flip Chip Package Specification HTS FC H32/HTS FC H56/HTS FC H48 * Application Note HITAG S Coil Design Guide. 6 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 6 HTS IC H32/HTS IC H56/HTS IC H48 MEMORY ORGANISATION HITAG S Type Block 15 Block 3 Block 2 Block 1 Block 0 Page Address 32 Bit 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x10 Page 0 Page 1 Page 2 Page 3 Page 4 Page 5 Page 6 Page 7 Page 8 Page 9 Page10 Page 11 Page 12 Page 13 Page 14 Page 15 Page 16 0x3B 0x3C 0x3D 0x3E 0x3F Page 59 Page 60 Page 61 Page 62 Page 63 H32 H56 H48 Fig.2 Memory Organisation. The EEPROM has a capacity up to 2048 Bit and is organised in 16 Blocks, consisting of 4 Pages each, for commands with Block access. A Page consists of 4 Bytes each (1 Page = 32 Bits) and is the smallest access unit. Addressing is done Page by Page (Page 0 up to 63) and access is gained either Page by Page or Block by Block entering the respective Page start address. In case of Block Read/Write access, the transponder is processed from the start Page address within one block to the end of the corresponding block. Three different types of HITAG S IC's with different memory sizes as shown in the figure above are available. 7 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 6.1 HTS IC H32/HTS IC H56/HTS IC H48 Unique Identifier (UID) Page 0 contains the 32 Bit Unique Identifier (UID) which is programmed during the manufacturing process. Page 0 access: Read Only (RO) MSByte Page Address MSB 0x00 LSByte LSB MSB UID 3 LSB MSB UID 2 LSB MSB UID 1 LSB UID 0 PRODUCT IDENTIFIER (PID) 6.1.1 The Product Identifier (PID) for the HITAG S Transponder IC is coded in the UID 3 Byte of the Unique Identifier (UID). This enables to distinguish between different ICs of the HITAG family. UID3 MSB LSB PID 1 PID 0 Condition for HITAG S: PID 1 = 0x7 - 0xF and PID 0 0x5 - 0x6 6.2 HITAG S Plain Mode Page 1 In Plain Mode, Page 1 contains three configuration Bytes CON 0 to CON 2 and a reserved byte. MSByte Page Address MSB 0x01 LSByte LSB MSB Reserved LSB MSB CON 2 LSB MSB CON 1 LSB CON 0 Page 2 - 63 In Plain Mode, Pages 2 - 63 can be used to store user data. MSByte Page Address MSB 0x02 - 0x3F LSByte LSB MSB Data 3 LSB MSB Data 2 LSB MSB Data 1 LSB Data 0 Memory Map for HITAG S in Plain Mode: MSByte Page Address MSB LSByte LSB MSB LSB MSB LSB MSB LSB 0x00 UID 3 UID 2 UID 1 UID 0 0x01 Reserved CON 2 CON 1 CON 0 0x02 Data 3 Data 2 Data 1 Data 0 0x03 Data 3 Data 2 Data 1 Data 0 8 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 6.3 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S Authentication Mode Page 1 In Authentication Mode, Page 1 contains three configuration Bytes CON 0 to CON 2 and the password high Byte PWDH 0. MSByte Page Address MSB 0x01 LSByte LSB MSB PWDH 0 LSB MSB CON 2 LSB MSB CON 1 LSB CON 0 Page 2 In Authentication Mode, Page 2 contains the password low Bytes PWDL 0 and PWDL 1 and the key high Bytes KEYH 0 and KEYH 1. MSByte Page Address MSB 0x02 LSByte LSB MSB KEYH 1 LSB MSB KEYH 0 LSB MSB PWDL 1 LSB PWDL 0 Page 3 In Authentication Mode, Page 3 contains the key low Bytes KEYL 0 - KEYL 3. MSByte Page Address MSB 0x03 LSByte LSB MSB KEYL 3 LSB MSB KEYL 2 LSB MSB KEYL 1 LSB KEYL 0 Page 4 - 63 MSByte Page Address MSB 0x04 - 0x3F LSByte LSB MSB Data 3 LSB MSB Data 2 LSB MSB Data 1 LSB Data 0 Memory Map for HITAG S in Authentication Mode: MSByte Page Address MSB LSByte LSB MSB LSB MSB LSB MSB LSB 0x00 UID 3 UID 2 UID 1 UID 0 0x01 PWDH 0 CON 2 CON 1 CON 0 0x02 KEYH 1 KEYH 0 PWDL 1 PWDL 0 0x03 KEYL 3 KEYL 2 KEYL 1 KEYL 0 0x04 Data 3 Data 2 Data 1 Data 0 0x05 Data 3 Data 2 Data 1 Data 0 9 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 7 7.1 HTS IC H32/HTS IC H56/HTS IC H48 FUNCTIONAL DESCRIPTION Basic System Configuration The following block diagram shows in principle the HITAG system configuration Read / Write Device (RWD) Oscillator Interface Host Modulator Driver RWD Antenna Control Signal & Data Processing M Amplifier Demodulator Filter HITAG S Transponder Antenna Fig.3 HITAG System configuration. A control and data processing unit controls the modulation of the carrier signal and processes data coming back from the demodulator circuit. 10 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 7.2 HTS IC H32/HTS IC H56/HTS IC H48 Energy Transmission Passive transponders must somehow be supplied with energy to be able to operate. In the HITAG System, this is achieved by using the principle of a loose coupled transformer: Transponder Antenna RWD Antenna M Energy Data Fig.4 Loose coupled transformer. The RWD antenna generates a magnetic field. Some of the generated magnetic flux flows through the transponder antenna and induces a voltage there. The voltage drives a current and the transponder will start operating. As this current will be very small when the transponder is far away from the antenna, the HITAG S Transponder IC is designed for low power consumption. The principle of a loose coupled transformer enables also a bi-directional data transmission. 11 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 7.3 HTS IC H32/HTS IC H56/HTS IC H48 Data Transmission: Transponder Read/Write Device For data transmission from the HITAG S Transponder to the RWD, the implemented method is called 'load modulation'. Here the HITAG S Transponder continuously changes the load on the magnetic field, by in principle turning on/off a resistor, according to the information to transmit. Alteration of the magnetic field is detected by the receiver of the RWD. Data 1 1 0 Coded Data (MC) Voltage on Transponder Antenna Voltage on RWD Antenna Fig.5 Data Transmission Transponder to Read/Write Device. The modulation ratio of the RWD antenna voltage depends on the coupling factor of the antenna configuration (RWD antenna size, transponder antenna size, distance between the antennas,...). 12 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 7.3.1 HTS IC H32/HTS IC H56/HTS IC H48 CODING Three different coding techniques for different States and Modes of the HITAG S Transponder IC are used (see also Chapters 11 "Command Set" and 12 "Transponder Talks First (TTF) Mode": * AC: Anticollision Coding in Init State * MC: Manchester Coding in Selected State and in Transponder Talks First State * BC: Biphase Coding in Transponder Talks First State DATA 1 0 1 1 1 0 0 1 DATA RATE AC MC BC Fig.6 Coding. A high level of the above coding signals means the physical state `modulator on' (field loaded), a low level means `modulator off' (field unloaded). 13 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 7.3.2 HTS IC H32/HTS IC H56/HTS IC H48 DATA RATE The data rate for HITAG S Transponder in Reader Talks First (RTF) Mode depends on the corresponding UID REQUEST xx command. For Transponder Talks First (TTF) Mode the data rate can be defined by configuration Table 1 MODE CODING HITAG S AC RTF Mode MC HITAG S MC TTF Mode Biphase BIT RATE BIT LENGTH 2 kBit/s 64 T0 4 kBit/s 32 T0 4 kBit/s 32 T0 8 kBit/s 16 T0 2 kBit/s 64 T0 4 kBit/s 32 T0 8 kBit/s 16 T0 2 kBit/s 64 T0 4 kBit/s 32 T0 8 kBit/s 16 T0 Note T0...Carrier period time (1/125 kHz = 8 s nominal). 14 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 Data Transmission: Read/Write Device Transponder (Physical Layer) 7.4 Afterwards the field is switched on again. * `0' and `1' can be distinguished by the duration of T[0] and T[1]. Data are transmitted to the transponder using Amplitude Shift Keying (ASK) modulation with a modulation index of 100 %. When the field is switched off, the physical state is named low field, otherwise high field. 7.4.1 * The end of the data transmission is characterised by an end of frame condition. The following figure shows the data transmission from the Read/Write Device to the transponder. CODING Binary Pulse Length Coding (BPLC) is used to encode the data stream. All coded data Bits and the end of frame (EOF) condition start with a low field of length Tg. T[0] Data 0 T[1] 0 1 Tg T EOF 1 EOF Coded Data Voltage on RWD Antenna Voltage on Transponder Antenna Fig.7 Data Transmission Read/Write Device to Transponder. 15 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 SYMBOL DESCRIPTION DURATION Tg Gap time 4..10 T0 (1) T[0] Logic 0 Bit length 18..22 T0 (1) T[1] Logic 1 Bit length 26..30 T0 (1) TEOF Duration for end of frame condition > 36 T0 Note 1. This application specific values must be within this frame, but have to be optimized for each application depending on rise and decay times of the RWD antenna voltage and the transponder antenna quality factor! T0...Carrier period time (1/125 kHz = 8 s nominal). The average Bit rate from the Read/Write Device to the HITAG S Transponder therefore is: 2 Bit rate = ------------------------------- = 5.2kBit/s T[0] + T[1] Note: The end of each data sequence from the Read/Write Device to the HITAG S Transponder has to be a EOF condition. 16 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 7.4.2 HTS IC H32/HTS IC H56/HTS IC H48 MODULATION DETAILS T[0] Tg Tr Tf a y b x Envelope of RWD Antenna Voltage Fig.8 Modulation details. The following table shows two examples of modulation timing parameters for typical short- and long range applications. x = 0.05 a, y = 0.95 a m = (a - b) / (a + b).....Modulation index SYMBOL MIN MAX m 95% 100% Tf 0 0.5 Tg Tg 6 T0 9 T0 1 (T[0] - Tg) T[0] 20 T0 22 T0 T[1] 28 T0 28 T0 Tf 3 T0 4 T0 Tr 4 T0 5 T0 Tr (1) 0 SYMBOL Note 1. This application specific value must be within this range, but has to be optimized depending on transponder coil quality factor and Read performance requirements. For high quality factor transponder coils, a lower rise time Tr should be implemented (recommended Tr = 0.5 (T[0] - Tg)) to achieve the maximum possible performance. 17 SHORT RANGE APPLICATION LONG RANGE APPLICATION PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 8 8.1 HTS IC H32/HTS IC H56/HTS IC H48 CONFIGURATION Configuration Page Memory Page 1 contains the three configuration Bytes CON 0, CON 1 and CON 2 (see Chapter "Memory Organisation"). Changes on the Configuration Bytes are effective after a power on reset of the HITAG S Transponder. CON0: Memory Type Information CON0 MSB LSB RES 5 RES 4 RES 3 RES 2 RES 1 RES 0 MEMT 1 MEMT 0 The following table describes the Memory Type Bits MEMT 0 and MEMT 1 of configuration byte CON 0. Table 2 Memory Type Bits MEMT 0 and MEMT 1 MEMT 1 MEMT 0 MEMORY TYPE 0 0 32 Bit 0 1 256 Bit 1 0 2048 Bit 1 1 Reserved Bits RES 0 to RES 5 are reserved for future use. Only Read access to configuration byte CON 0 is possible. CON 1: Mode and Lock Bits CON1 MSB LSB AUT TTFC TTFDR 1 TTFDR 0 TTFM 1 TTFM 0 LCON LKP If the Authentication Bit AUT = `0' the HITAG S Transponder IC is configured in Plain Mode and can be selected directly by the SELECT (UID) command and the corresponding UID. For Bit AUT = `1' the HITAG S Transponder IC is configured in Authentication Mode and can only be Selected with the SELECT (UID) command and a following secure CHALLENGE sequence (see also Chapters 10 "State Diagram" and 11 "Command Set"). Table 3 Authentication Bit AUT AUT HITAG S MODE 0 Plain 1 Authentication 18 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 The Transponder Talks First Coding Bit TTFC defines the used coding during transmitting data to the RWD. This effects the TTF State only. Table 4 Transponder Talks First Coding Bit TTFC TTFC CODING IN TTF STATE 0 Manchester 1 Biphase The Transponder Talks First Data Rate Bits TTFDR 0 and TTFDR 1 select the data rate used during transmission of data to the RWD. This effects the TTF State only. Table 5 Transponder Talks First Data Rate Bits TTFDR 0 and TTFDR 1 TTFDR 1 TTFDR 0 DATA RATE IN TTF STATE 0 0 4 kBit 0 1 8 kBit 1 0 2 kBit 1 1 2 kBit and Pigeon Race Standard The Transponder Talks First Mode Bits TTFM 0 and TTFM 1 defines the number of Pages continuously transmitted to the RWD. This effects the TTF State only. Table 6 Transponder Talks First Mode Bits TTFM 0 and TTFM 1 TTFM 1 TTFM 0 PAGES TRANSMITTED IN TTF STATE 0 0 TTF Mode disabled (= RTF Mode) 0 1 Page 4, Page 5 1 0 Page 4, Page 5, Page 6, Page 7 1 1 Page 4 The Lock Configuration Bit LCON defines the access rights on the configuration Bytes CON 1 and CON 2. This Bit is one time programmable (OTP). Table 7 Lock Configuration Bit LCON LCON ACCESS RIGHT CON 1 AND CON 2 0 Read / Write 1 CON 1: Read Only. CON 2: OTP 19 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 The Lock Key and Password Bit LKP defines the access rights of the PWDH 0 Byte of Page 1, password low Bytes and key high Bytes of Page 2 and key low Bytes of Page 3 when configured in Authentication Mode. In Plain Mode this Bit can be used to lock the user data of Page 2 and Page 3. Table 8 Lock Key and Password Bit LKP LKP ACCESS RIGHT KEY AND PASSWORD/PAGE 2 AND PAGE 3 0 Read / Write 1 Read Only in Plain Mode No Access in Authentication Mode Attention: In order to prevent further access to key and password, the following procedure must take place: After setting Bit LKP to `1' the Lock Configuration Bit LCON must be set to `1', because the Bit LKP has no OTP functionality! CON 2: Memory Lock Bits CON2 MSB LSB LCK 7 Table 9 LCK 6 LCK 4 LCK 3 LCK 2 LCK 1 LCK 0 Description of Memory Lock Bits BIT SYMBOL 7 LCK 7 6 LCK 5 LCK 6 FUNCTION Lock Page 4 and Page 5 Lock Page 6 and Page 7 ACCESS RIGHTS COMMENT 0...Read / Write OTP if LCON = `1' 1...Read Only If Pigeon Race Standard is enabled (TTFDR 0 = TTFDR 1 = `1') 16 Bits (Data 3 u. Data 2) of Page 5 remain still Read/Write accessible for LCK 7 = `1' 0...Read / Write OTP if LCON = `1' 1...Read Only 5 LCK 5 Lock Page 8 - Page 11 4 LCK 4 Lock Page 12 - Page 15 3 LCK 3 Lock Page 16 - Page 23 2 LCK 2 Lock Page 24 - Page 31 0...Read / Write OTP if LCON = `1' 1...Read Only 0...Read / Write OTP if LCON = `1' 1...Read Only 0...Read / Write OTP if LCON = `1' 1...Read Only 0...Read / Write OTP if LCON = `1' 1...Read Only 1 LCK 1 Lock Page 32 - Page 47 0...Read / Write OTP if LCON = `1' 1...Read Only 0 LCK 0 Lock Page 48 - Page 63 0...Read / Write OTP if LCON = `1' 1...Read Only 20 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 8.2 HTS IC H32/HTS IC H56/HTS IC H48 Delivery Configuration 8.2.1 HITAG S32 This delivery configuration is valid for the following HITAG S 32 types: * HTS IC H32 01EW/V4 * HTS MO H32 01EV * HTS FC H32 01EV/DH MSByte LSByte MSB LSB MSB LSB MSB UID 3 LSB MSB UID 2 LSB UID 1 UID 0 The 32 Bit Unique Identifier (UID) is programmed during the manufacturing process. Access rights: Read Only (RO). On a Select (UID) command the HITAG S 32 Transponder IC sends back three Reserved Bytes and the Byte CON 0 containing the Memory Type Information. MSByte LSByte MSB LSB MSB LSB MSB X LSB MSB X LSB X CON0 CON 0 MSB X LSB X X X X X 0 0 The content of Bits and Bytes marked with `X' are not defined at delivery! 21 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 8.2.2 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S256 This delivery configuration is valid for the following HITAG S 256 types: * HTS IC H56 01EW/V4 * HTS MO H56 01EV * HTS FC H56 01EV/DH MSByte Page Address LSByte MSB LSB MSB 0x00 UID 3 0x01 0x02 LSB MSB LSB MSB LSB UID 2 UID 1 UID 0 0xAA 0x00 0x00 CON 0 0x4E 0x4F 0x54 0x48 0x03 0x52 0x4B 0x49 0x4D 0x04 X X X X 0x05 X X X X 0x06 X X X X 0x07 X X X X CON 0 MSB X LSB X X X X X 0 1 The content of Bits and Bytes marked with `X' are not defined at delivery! * The 32 Bit Unique Identifier (UID) is programmed during the manufacturing process. * Modes: Reader Talks First (RTF), Plain * Access Rights: - UID: Read Only - Page 1: Read/Write with exception of byte CON 0 (Read Only) - Page 2 - Page 7: Read/Write 22 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 8.2.3 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S2048 This delivery configuration is valid for the following HITAG S 2048 types: * HTS IC H48 01EW/V4 * HTS MO H48 01EV * HTS FC H48 01EV/DH MSByte Page Address LSByte MSB LSB MSB 0x00 UID 3 0x01 0x02 LSB MSB LSB MSB LSB UID 2 UID 1 UID 0 0xAA 0x00 0x00 CON 0 0x4E 0x4F 0x54 0x48 0x03 0x52 0x4B 0x49 0x4D 0x04 X X X X 0x05 X X X X 0x3E X X X X 0x3F X X X X CON 0 MSB X LSB X X X X X 1 0 The content of Bits and Bytes marked with `X' are not defined at delivery! * The 32 Bit Unique Identifier (UID) is programmed during the manufacturing process. * Modes: Reader Talks First (RTF), Plain * Access Rights: - UID: Read Only - Page 1: Read/Write with exception of byte CON 0 (Read Only) - Page 2 - Page 63: Read/Write 23 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 9 HTS IC H32/HTS IC H56/HTS IC H48 PROTOCOL TIMING 9.1 Read/Write Device waiting time before sending the first command C oded D ata RW D t wfc Voltage on RW D Antenna a y y = 0.95 a Fig.9 Read/Write Device waiting time before sending the first command. After switching on the powering field, the Read/Write Device has to wait at least the minimum time twfc = 280 T0 before sending the first command. The first command must not be sent later than the maximum time twfc = 5000 T0. Table 10 MIN twfc TYP 280 24 MAX UNIT 5000 T0 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 9.2 HTS IC H32/HTS IC H56/HTS IC H48 Read/Write Device waiting time before sending a subsequent command twsc Data RWD 0 1 Coded Data RWD Voltage on RWD Antenna Voltage on Transponder Antenna Coded Data(MC) Transponder Data Transponder 1 0 Fig.10 Read/Write Device waiting time before sending a subsequent command. When the Read/Write Device has received the response from the HITAG S Transponder to a previous command, the RWD has to wait at least the minimum time twsc = 90 T0 before sending a subsequent command or Write data after a Write command. The subsequent command or Write data must not be sent later than the maximum time twsc = 5000 T0. Table 11 MIN twsc TYP 90 25 MAX UNIT 5000 T0 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 9.3 HTS IC H32/HTS IC H56/HTS IC H48 Reset Time The powering field must be switched off for at least treset = 4.8 ms to generate a reset of the HITAG S IC and to enter it into Power Off State. t re s e t V o lta g e on RWD A n te n n a x a x = 0.05 a Fig.11 Reset Time. Table 12 MIN treset TYP 4.8 MAX UNIT ms 26 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 9.4 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S Transponder waiting time before transmitting a response after receiving an EOF twresp Data RWD EOF 1 Coded Data RWD Voltage on RWD Antenna Voltage on Transponder Antenna Coded Data(MC) Transponder Data Transponder SOF 1 Fig.12 HITAG S Transponder waiting time before transmitting a response after receiving an EOF. When receiving a End of Frame (EOF) condition from the Read/Write Device, the transponder waits twresp before transmitting data. The values given below are specific to transmission system parameters e.g. coil quality factor, RWD antenna quality factor. Table 13 twresp(1) MIN TYP MAX UNIT 204 208 212 T0 Note 1. Valid for coil quality factors Qcoil < 30. 27 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 9.5 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S Transponder programming time tprog Write Data EOF RWD Transponder SOF ACK Fig.13 HITAG S Transponder programming time. When receiving the EOF of the write data from the Read/Write Device, the transponder waits tprog before transmitting the SOF and acknowledge to confirm correct programming. Table 14 tprog MIN TYP MAX UNIT 716 721 726 T0 28 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 9.6 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S Transponder waiting time before transmitting data in TTF Mode Coded Data RWD Voltage on RWD Antenna t TTF aa y Voltage on Transponder Antenna Coded Data (MC) 1 Data 1 y = 0.95 a Fig.14 HITAG S Transponder waiting time before transmitting data in TTF Mode. After switching on the powering field, the HITAG S Transponder waits a time tTTF before transmitting data if it is configured in TTF Mode. Table 15 tTTF MIN TYP MAX UNIT 565 585 625 T0 29 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 9.7 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S Transponder Mode switching time UID REQUEST Code Data RW t switch Voltag y on RW Antenn a y = 0.95 a Fig.15 HITAG S Transponder Mode switching time. With an UID REQUEST xx command starting with the first bit after tswitch, a HITAG S Transponder configured in TTF Mode can be switched into RTF Mode. The Read/Write Device has to wait at least the minimum time tswitch = 280 T0 and must not wait longer than the maximum time tswitch = 520 T0. The HITAG S Transponder responds to this command with the UID and changes into Init State. Table 16 tswitch MIN TYP MAX UNIT 280 400 520 T0 30 PUBLIC INFORMATION Philips Semiconductors HITAG S Product Specification Revision 3.1 2006 July 18 HTS IC H32/HTS IC H56/HTS IC H48 10 STATE DIAGRAM Transponder Talks First (TTF) 10.1 The HITAG S Transponder enters this State when configured in TTF Mode if no UID REQUEST xx command is received within the Mode switch window. Once entered this State, the HITAG S Transponder continuously transmits data with configurable data coding, data rate and data length. General Description of States Power Off The powering magnetic field is switched off or the HITAG S Transponder is out of field. Ready After start up phase, the HITAG S Transponder is ready to receive the first command. Init The HITAG S Transponder enters this State after the first UID REQUEST xx command. In this State the Response Protocol Mode (see Chapter11 "Command Set") may be changed by further UID REQUEST xx commands. If there are several HITAG S Transponders in the field of the RWD antenna at the same time, the AC SEQUENCE can be started to determine the UID of every HITAG S Transponder. Authenticate The HITAG S Transponder enters this State after a valid SELECT (UID) command when configured in Authentication Mode. After an encrypted CHALLENGE Authentication the HITAG S Transponder changes into the Selected State. Selected The HITAG S Transponder enters this State after a valid SELECT (UID) command when configured in Plain Mode or a SELECT (UID) and CHALLENGE sequence when configured in Authentication Mode. Only one HITAG S Transponder in the field of the RWD antenna can be Selected at the same time. In this State, Read and Write operations are possible. Data Transmission is not encrypted even if configured in Authentication Mode. Quiet The HITAG S Transponder enters this State after a SELECT_QUIET command in Init State or a QUIET command in Selected State. In this State, the HITAG S Transponder will not answer to any command. Switching off the powering magnetic field or moving the HITAG S Transponder out of field enters it into the Power Off State. 31 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 10.2 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S 32 Power Off In Field Ready UID REQUEST xx Transmission error Any other command or transmission error UID REQUEST xx AC SEQUENCE SELECT (UID) command with wrong UID SELECT_QUIET (UID) command with wrong UID Any other command Init SELECT (UID) SELECT_QUIET (UID) Selected QUIET Any command Quiet Fig.16 State diagram HITAG S 32. Note: Switching off the powering magnetic field or moving the HITAG S Transponder out of the RWD antenna field, enters the HITAG S Transponder into the Power Off State, independently of its actual State. 32 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 10.3 HTS IC H32/HTS IC H56/HTS IC H48 HITAG S 256 and HITAG S 2048 A : T T F M o d e e n a b le d a n d U ID R E Q U E S T x x c o m m a n d n o t s e n t w ith in s w itc h w in d o w P o w e r O ff B : T T F M o d e e n a b le d : U ID R E Q U E S T x x c o m m a n d s e n t w ith in s w itc h w in d o w or T T F M o d e d is a b le d : U ID R E Q U E S T x x In F ie ld T ra n s p o n d e r T a lk s F ir s t A R eady B it A U T : S e e c h a p te r 'C o n fig u r a tio n ' A ny com m and T r a n s m is s io n e rro r B ln it A n y o th e r c o m m a n d , tr a n s m is s io n e r r o r o r w ro n g k e y s A u th e n tic a te U ID R E Q U E S T x x AC SEQUENCE S E L E C T ( U ID ) c o m m a n d w ith w r o n g U ID S E L E C T _ Q U IE T ( U ID ) c o m m a n d w ith w r o n g U ID A n y o th e r c o m m a n d S E L E C T ( U ID ) & AUT=1 S E L E C T ( U ID ) & AUT = 0 C H ALLEN G E A n y o th e r c o m m a n d o r tr a n s m is s io n e r r o r READ PAGE R EAD BLO C K W R IT E P A G E W R IT E B L O C K S e le c te d S E L E C T _ Q U IE T ( U ID ) Q U IE T Q u ie t A ny com m and Fig.17 State diagram HITAG S 256 and HITAG S 2048. Note: Switching off the powering magnetic field or moving the HITAG S Transponder out of the RWD antenna field, enters the HITAG S Transponder into the Power Off State, independently of its actual State. 33 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 11 COMMAND SET 11.1 General Comments For HITAG S 32 only the commands described in the corresponding State diagram are valid commands. 11.2 UID REQUEST xx MSB RWD: LSB UID REQUEST xx EOF LSByte MSB Transponder twresp MSByte LSB MSB LSB MSB LSB MSB LSB SOF UID 0 UID 1 UID 2 UID 3 N= 1.............8 9....k...16 17.......24 25.......32 N...physical Bit position during air transmission. N=25 is the bit with the highest valence 231. k...Any collision position (see command AC SEQUENCE) After the RWD transmits this command, all HITAG S Transponders located in the field of the RWD antenna respond with a start of frame pattern followed by the corresponding 32 Bit UID. The complete response of the HITAG S Transponder is transmitted in Anticollision Coding (AC, see Section 7.3.1 "Coding"). Table 17 Coding MSB LSB RESPONSE PROTOCOL MODE UID REQUEST Std 00110 Standard UID REQUEST Adv 1100x Advanced UID REQUEST FAdv 11010 Fast Advanced Note 1. x... can be `0' or `1' The Response Protocol Mode defined by the corresponding UID Request command determines the coding, data rate and the SOF pattern of the HITAG S Transponder response. Table 18 RESPONSE PROTOCOL MODE SOF CODING DATA RATE Standard `1' AC 2 kBit/s Advanced `111' AC 2 kBit/s Fast Advanced `111' AC 4 kBit/s A HITAG S Transponder in Ready State changes into Init State after receiving a correct UID REQUEST xx command. A HITAG S Transponder being already in Init State remains in Init State after receiving a further correct UID REQUEST xx command. Always the latest UID REQUEST xx command defines the Response Protocol Mode for the following commands. 34 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 11.3 HTS IC H32/HTS IC H56/HTS IC H48 AC SEQUENCE If more than one HITAG S Transponder is in the field of the antenna a special designed RWD detects the first collision at the Bit position N = k of the UID response. As a result the RWD starts an Anticollision Sequence (AC SEQUENCE). This command consists of a 5 Bit number (k4 to k0) describing the physical Bit position k where the collision occurred followed by (k - 1) Bits of the detected UID and a Bit (one or zero) at the collision position. An 8 Bit CRC (cyclic redundancy check) of this sequence is also sent to the transponders. MSB RWD: k4 k3 k2 k1 LSB 1................k k0 k Bits of UID MSB LSB CRC 8 EOF Transponder twresp SOF (32 - k) Bits of UID N= k+1.............................32 After transmitting this command, all HITAG S Transponders which first k Bits of the own UID match with the k received UID Bits, answer with the SOF and the rest of their own UID. If a collision occurs again the described cycle has to be repeated until one valid UID of the transponders in the field is determined. The complete response of the HITAG S Transponder is transmitted in Anticollision Coding (AC). Table 19 RESPONSE PROTOCOL MODE SOF CODING DATA RATE Standard `1' AC 2 kBit/s Advanced `111' AC 2 kBit/s Fast Advanced `111' AC 4 kBit/s During the AC SEQUENCE commands the HITAG S Transponder stays in Init State. Even those HITAG S Transponders where the k received Bits of the UID do not match remain in Init State. 35 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 11.4 HTS IC H32/HTS IC H56/HTS IC H48 SELECT (UID) The SELECT (UID) command consists of 5 Zero-Bits followed by the determined 32 Bit UID and an 8 Bit Cyclic Redundancy Check (CRC). The selected transponder then responds with a start of frame pattern (SOF) followed by the content of the Configuration Page and depending on the Response Protocol Mode with an 8 Bit CRC. LSByte MSB RWD: 00000 LSB MSByte MSB UID 0 LSB UID 1 MSB LSB UID 2 MSB LSB UID 3 MSB LSB CRC 8 EOF LSByte MSB Transponder twresp SOF LSB CON 0 MSByte MSB LSB CON 1 MSB LSB CON 2 MSB LSB MSB Reserved LSB CRC 8 The complete response of the HITAG S Transponder is transmitted in Manchester Coding (MC). In Plain Mode the MSByte of Page 1 is a Reserved Byte, in Authentication Mode this Byte contains the password high Byte PWDH 0. At the response on a SELECT (UID) command of a HITAG S Transponder configured in Authentication Mode (Bit AUT = 1, keys and password locked), this PWDH 0 Byte is dissolved by `1' Bits. Table 20 RESPONSE PROTOCOL MODE SOF CRC8 CODING DATA RATE Standard `1' no MC 4 kBit/s Advanced `111111' yes MC 4 kBit/s Fast Advanced `111111' yes MC 8 kBit/s In Plain Mode (Bit AUT = 0) the HITAG S Transponder changes into Selected State after receiving a correct SELECT (UID) command. In Authentication Mode (Bit AUT = 1) the HITAG S Transponder changes into Authenticate State after receiving a correct SELECT (UID) command and waits for the CHALLENGE command. 36 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 11.5 HTS IC H32/HTS IC H56/HTS IC H48 CHALLENGE By means of the response of the SELECT (UID) command the RWD detects that the HITAG S Transponder is configured in Authentication Mode (Bit AUT = 1) and starts the encrypted Challenge sequence. MSB RWD: LSB MSB 32 Bit RND LSB 32 Bit Secret Data EOF MSB twresp Transponder SOF LSB MSB CON 2 LSB MSB PWDH 0 LSB MSB PWDL 0 LSB MSB PWDL 1 LSB CRC 8 32 Bit Secret Response The Read/Write Device sends a 32 Bit Random Number (RND) and a 32 Bit secret data stream to the transponder. In order to perform the secret data stream, a security co-processor is required on the read/write Device. For more information please contact us at - info.bli@philips.com. If the received secret data stream corresponds with the secret data stream calculated by the HITAG S Transponder, a 32 Bit Secret Response (secret data stream encrypting the configuration byte CON 2, password high byte PWDH 0 and password low Bytes PWDL 0 and PWDL 1) is transmitted after the SOF. The response of the HITAG S Transponder is transmitted in Manchester Coding (MC). Table 21 RESPONSE PROTOCOL MODE SOF CRC8 CODING DATA RATE Standard `1' no MC 4 kBit/s Advanced `111111' yes MC 4 kBit/s Fast Advanced `111111' yes MC 8 kBit/s A HITAG S Transponder configured in Authentication Mode changes from Authenticate State into Selected State only after a correct CHALLENGE Sequence. Note: Even with AUT=1 further data transmission for read and write commands is done in plain mode. 37 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 11.6 HTS IC H32/HTS IC H56/HTS IC H48 SELECT_QUIET (UID) With this command a HITAG S Transponder in Init State can be directly entered into the Quiet State. LSByte MSB RWD: 00000 MSByte LSB MSB UID 0 LSB MSB UID 1 LSB MSB UID 2 LSB UID 3 MSB 0 LSB CRC 8 EOF ACK Transponder twresp SOF 01 The `start of frame' (SOF) pattern and the acknowledge (ACK) is transmitted in Manchester Coding. Table 22 RESPONSE PROTOCOL MODE SOF CODING DATA RATE Standard `1' MC 4 kBit/s Advanced `111111' MC 4 kBit/s Fast Advanced `111111' MC 8 kBit/s A HITAG S Transponder, once entered the Quiet State can only be enabled by switching off the powering magnetic field for at least a time treset or the HITAG S Transponder must be moved out of the antenna field (Power Off State). 11.7 READ PAGE After a HITAG S Transponder was selected by the corresponding SELECT (UID) command (or SELECT (UID) and CHALLENGE for Authentication Mode) a read operation of data stored on the EEPROM can be performed. After transmitting the READ PAGE command, the Page address PADR (8 Bits) and the 8 Bit Cyclic Redundancy Check CRC 8, the HITAG S Transponder responds with the SOF and 32 Bits data of the corresponding Page. MSB RWD: 1100 LSB MSB PADR LSB CRC 8 EOF LSByte MSB Transponder twresp SOF MSByte LSB MSB Data 0 LSB MSB Data 1 LSB MSB Data 2 LSB MSB Data3 LSB CRC 8 The highest Page address (PADR) is 0x 3F, therefore the two highest Bits must be `0'. Table 23 RESPONSE PROTOCOL MODE SOF CRC8 CODING DATA RATE Standard `1' no MC 4 kBit/s Advanced `111111' yes MC 4 kBit/s Fast Advanced `111111' yes MC 8 kBit/s 38 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 11.8 HTS IC H32/HTS IC H56/HTS IC H48 READ BLOCK After transmitting the READ BLOCK command, the Page address PADR (8 Bits) within a block and the 8 Bit Cyclic Redundancy Check CRC 8, the HITAG S Transponder responds with the SOF and 32 up to 128 Bits of data beginning with the addressed Page within a Block to the last Page of the corresponding Block. MSB RWD: 1 1 0 1 LSB MSB PADR LSB CRC 8 EOF LSByte MSB Transponder twresp SOF LSB MSB Data 0 LSB Data 1 MSB LSB Data 2 MSByte LSByte MSByte MSB MSB MSB LSB Data3 LSB Data 0 LSB MSB Data 3 LSB CRC 8 Table 24 RESPONSE PROTOCOL MODE SOF CRC8 CODING DATA RATE Standard `1' no MC 4 kBit/s Advanced `111111' yes MC 4 kBit/s Fast Advanced `111111' yes MC 8 kBit/s 39 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 11.9 HTS IC H32/HTS IC H56/HTS IC H48 WRITE PAGE After a HITAG S Transponder was selected by the corresponding SELECT (UID) command (or SELECT (UID) and CHALLENGE for Authentication Mode) a write operation of data onto the memory can be carried out. Least significant Byte is always transmitted first. E.g. in order to change the configuration page the byte Con0 would have to be transmitted first. After transmitting the WRITE PAGE command, the Page address PADR (8 Bits) and the 8 Bit Cyclic Redundancy Check (CRC 8), the HITAG S Transponder responds with the SOF and an acknowledge (ACK) to confirm the reception of a correct WRITE PAGE command. After the waiting time twsc the RWD transmits the write data with CRC 8. After the programming time tprog the HITAG S Transponder responds with a SOF and an acknowledge to confirm correct programming. MSB RWD: 1000 LSB MSB PADR LSB CRC 8 EOF twsc ACK Transponder: twresp LSByte MSB RWD: 01 MSByte LSB MSB Data 0 SOF LSB MSB Data 1 LSB MSB Data 2 LSB MSB Data3 LSB CRC 8 EOF ACK Transponder: twresp SOF 01 Table 25 RESPONSE PROTOCOL MODE SOF CODING DATA RATE Standard `1' MC 4 kBit/s Advanced `111111' MC 4 kBit/s Fast Advanced `111111' MC 8 kBit/s 40 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 11.10 WRITE BLOCK After transmitting the WRITE BLOCK command, the Page address PADR (8 Bits) within a Block and the 8 Bit Cyclic Redundancy Check (CRC 8), the HITAG S Transponder responds with the SOF and an acknowledge (ACK) to confirm the reception of a correct WRITE BLOCK command. After the waiting time twsc the RWD transmits the write data with CRC 8 Page by Page (1 to 4 Pages depending on the Page address PADR within the corresponding block). After the programming time tprog the HITAG S Transponder responds with a SOF and an acknowledge to confirm correct programming of each Page. MSB RWD: 1001 LSB MSB PADR LSB CRC 8 EOF twsc ACK Transponder: twresp SOF 01 Write Data for Page with Page address: PADR LSByte MSB RWD: MSByte LSB MSB Data 0 LSB MSB Data 1 LSB MSB Data 2 LSB MSB Data3 LSB CRC 8 EOF twsc ACK Transponder: tprog SOF 01 Write Data for Page with Page address: PADR + 1 LSByte MSB RWD: MSByte LSB MSB Data 0 LSB MSB Data 1 LSB MSB Data 2 LSB MSB Data3 LSB CRC 8 EOF twsc ACK Transponder: tprog SOF 01 Write Data for Page with Page address: PADR + 2 LSByte MSB RWD: MSByte LSB MSB Data 0 LSB MSB Data 1 LSB MSB Data 2 LSB MSB Data3 LSB CRC 8 EOF twsc ACK Transponder: tprog SOF 01 Write Data for Page with Page address: PADR + 3 LSByte MSB RWD: MSByte LSB MSB Data 0 LSB MSB Data 1 LSB MSB Data 2 LSB MSB Data3 LSB CRC 8 EOF twsc ACK Transponder: tprog SOF 01 Table 26 RESPONSE PROTOCOL MODE SOF CODING DATA RATE Standard `1' MC 4 kBit/s Advanced `111111' MC 4 kBit/s Fast Advanced `111111' MC 8 kBit/s 41 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 11.11 QUIET With this command a Selected HITAG S Transponder can be entered into the Quiet State. A valid Page address PADR (8 Bits) and Cyclic Redundancy Check (CRC 8) must be sent for command structure reasons only. MSB RWD: 0111 LSB MSB PADR LSB CRC 8 EOF ACK Transponder: twresp SOF 01 After the response wait time twresp the HITAG S Transponder responds with a SOF and an acknowledge to confirm entering the Quiet State. Table 27 RESPONSE PROTOCOL MODE SOF CODING DATA RATE Standard `1' MC 4 kBit/s Advanced `111111' MC 4 kBit/s Fast Advanced `111111' MC 8 kBit/s A HITAG S Transponder, once entered the Quiet State can only be reactivated after switching off the powering magnetic field for at least a time treset or the HITAG S Transponder must be moved out of the antenna field (Power Off State). 42 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 12 TRANSPONDER TALKS FIRST (TTF) MODE This special mode of the HITAG S Transponder enables data transmission to a Read/Write Device without sending any command. The TTF Mode can be enabled/disabled and configured by setting the corresponding Bits of the Configuration byte CON 1 (see Chapter 8 "Configuration"). A HITAG S Transponder configured in TTF Mode can be switched temporarily into Reader Talks First (RTF) Mode by sending a UID REQUEST xx command within a defined window after turning on the powering field. The HITAG S Transponder will leave this temporarily RTF Mode after switching off the powering field or moving it out of the RWD antenna field. If the HITAG S Transponder is configured in TTF Mode and no Mode switch command is sent by the RWD within the defined switch window it enters the TTF State. Depending on the configuration, the HITAG S Transponder transmits the data with different coding, data rate and data length. It is recommended to use some of the data bits as a well defined start sequence. 12.1 32 Bit TTF Mode Configuration: TTFM 1 TTFM 0 1 1 In this Mode, the HITAG S Transponder continuously transmits the data content of Page 4. Page 4 Page 4 LSByte MSB Transponder: tTTF LSB Data 0 MSByte MSB LSB Data 1 MSB LSB Data 2 MSB LSB Data3 LSByte MSB LSB Data 0 LSByte MSB LSB Data 1 MSB LSB Data 2 MSB LSB Data3 MSB LSB Data 0 The data rate and the data coding can be chosen independently by configuration Bits TTFC, TTFDR 0 and TTFDR 1. 12.2 64 Bit TTF Mode Configuration: TTFM 1 TTFM 0 0 1 In this Mode, the HITAG S Transponder continuously transmits the data content of Page 4 and Page 5. Page 4 MSB Transponder: tTTF LSB Data 0 MSByte MSB LSB Data 1 MSB Page 4 Page 5 LSByte LSB Data 2 MSB LSB Data3 LSByte MSB LSB Data 0 LSByte MSB LSB Data 1 MSB LSB Data 2 MSB LSB Data3 MSB LSB Data 0 The data rate and the data coding can be chosen independently by configuration Bits TTFC, TTFDR 0 and TTFDR 1. Note: This Mode may be used for Pigeon race standards. 43 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 12.3 HTS IC H32/HTS IC H56/HTS IC H48 128 Bit TTF Mode Configuration: TTFM 1 TTFM 0 1 0 In this Mode, the HITAG S Transponder continuously transmits the data content of Page 4, Page 5, Page 6 and Page 7. Page 4 LSByte Transponder: Page 5 MSByte LSByte Page 6 MSByte LSByte Page 7 MSByte LSByte Page 4 MSByte LSByte MSByte tTTF The data rate and the data coding can be chosen independently by configuration Bits TTFC, TTFDR 0 and TTFDR 1. Note: This Mode may be used for ISO 11784/85 Animal ID standard and German Waste Management standard (BDE) respectively. 44 PUBLIC INFORMATION Philips Semiconductors HITAG S Product Specification Revision 3.1 2006 July 18 HTS IC H32/HTS IC H56/HTS IC H48 13 DATA INTEGRITY / CALCULATION OF CRC The following explanations show the features of the HITAG S protocol to protect read and write access to transponders from undetected errors. 13.1 Data Transmission: Read/Write Device to HITAG S Transponder Every data stream transmitted by the Read/Write Device to the HITAG S Transponder includes an 8 Bit Cyclic Redundancy Check (CRC 8). The data stream is first checked for data errors by the HITAG S Transponder and then executed. The generator polynomial for the CRC 8 is: u8 + u4 + u3 + u2 + 1 = 0x1D The CRC pre set value is: 0xFF 13.2 13.2.1 Data Transmission: HITAG S Transponder to Read/Write Device STANDARD RESPONSE PROTOCOL MODE The HITAG S Transponder response does not include any check sum because of flexibility reasons. To get the data integrity required by the application, check sums have to be calculated by the user software and stored together with the information in the transponder memory. This seems uncomfortable, because the check sums use a little part of the available memory space in the transponder. The advantage of this solution is the flexibility to choose large checksums for applications requiring high data integrity and smaller check sums for applications requiring short access times which means short protocols. 13.2.2 ADVANCED/FAST ADVANCED RESPONSE PROTOCOL MODE In Advanced - and Fast Advanced Response Protocol Mode the response on a SELECT (UID), CHALLENGE, READ PAGE, READ BLOCK command, includes a CRC 8 check sum. The generator polynomial for the CRC 8 is: u8 + u4 + u3 + u2 + 1 = 0x1D The CRC pre set value is: 0xFF 45 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S 13.3 HTS IC H32/HTS IC H56/HTS IC H48 Source Code for CRC-Checksum The following lines of C-Code show an example for a CRC-Calculation. #include #define CRC_PRESET 0xFF #define CRC_POLYNOM 0x1D void calc_crc(unsigned char * crc, unsigned char data, unsigned char Bitcount) { *crc ^= data; // crc = crc (exor) data do { if( *crc & 0x80 ) // if (MSB-CRC == 1) { *crc<<=1; // CRC = CRC Bit-shift left *crc ^= CRC_POLYNOM; // CRC = CRC (exor) CRC_POLYNOM } else { *crc<<=1; // CRC = CRC Bit-shift left } printf("CRC: %02X ", *crc); } while(--Bitcount); printf("\n"); } // output result step by step void main(void) { const cmd=0x00; /* 5 Bit command, aligned to MSB */ const ident[4]={0x2C, 0x68, 0x0D, 0xB4 }; unsigned char crc; int i; crc = CRC_PRESET; /* initialize crc algorithm */ calc_crc(&crc, cmd, 5); /* compute 5 crc Bits only */ for(i=0; i<4; i++) calc_crc(&crc, ident[i], 8); /* crc = 0x9E at this point */ printf("%02X\n",crc); getch(); } 46 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 14 ABBREVIATIONS ABBREVIATION DEFINITION AC Anticollision Code ASK Amplitude Shift Keying BC Biphase Code BPLC Binary Pulse Length Coding CRC Cyclic Redundancy Check EEPROM Electrically Erasable Programmable Memory EOF End of frame LSB Least Significant Bit LSByte Least Significant Byte m Modulation Index MC Manchester Code MSB Most Significant Bit MSByte Most Significant Byte NA No Access OTP One Time Programmable PID Product Identifier RND Random Number RO Read Only RTF Reader Talks First R/W Read/Write RWD Read/Write Device SOF Start of Frame TTF Transponder Talks First UID Unique Identifier 47 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 15 DATA SHEET STATUS LEVEL DATA SHEET STATUS(1) PRODUCT STATUS(2)(3) Development DEFINITION I Objective data II Preliminary data Qualification This data sheet contains data from the preliminary specification. Supplementary data will be published at a later date. Philips Semiconductors reserves the right to change the specification without notice, in order to improve the design and supply the best possible product. III Product data This data sheet contains data from the product specification. Philips Semiconductors reserves the right to make changes at any time in order to improve the design, manufacturing and supply. Relevant changes will be communicated via a Customer Product/Process Change Notification (CPCN). Production This data sheet contains data from the objective specification for product development. Philips Semiconductors reserves the right to change the specification in any manner without notice. Notes 1. Please consult the most recently issued data sheet before initiating or completing a design. 2. The product status of the device(s) described in this data sheet may have changed since this data sheet was published. The latest information is available on the Internet at URL http://www.semiconductors.philips.com. 3. For data sheets describing multiple type numbers, the highest-level product status determines the data sheet status. 16 DEFINITIONS Short-form specification The data in a short-form specification is extracted from a full data sheet with the same type number and title. For detailed information see the relevant data sheet or data handbook. Limiting values definition Limiting values given are in accordance with the Absolute Maximum Rating System (IEC 60134). Stress above one or more of the limiting values may cause permanent damage to the device. These are stress ratings only and operation of the device at these or at any other conditions above those given in the Characteristics sections of the specification is not implied. Exposure to limiting values for extended periods may affect device reliability. Application information Applications that are described herein for any of these products are for illustrative purposes only. Philips Semiconductors make no representation or warranty that such applications will be suitable for the specified use without further testing or modification. 17 DISCLAIMERS Field of Use Philips owns a worldwide perpetual license for patents US 5,214,409, US 5,499,017, US 5,235,326, and for any foreign counterparts or equivalents of these patents. The license is granted for the Philips Field. The Philips Field covers: (a) all non-animal applications and (b) any application for animals raised for human consumption (including but not limited to dairy animals), including without limitation livestock and fish. Please note that the license does not include rights outside the Philips Field, and that Philips does not provide indemnity for the foregoing patents outside the Philips Field. In case you intend to use the product related to this data sheet outside the Philips Field we recommend that you consult a Philips representative for further clarification. 48 PUBLIC INFORMATION Philips Semiconductors HITAG S Product Specification Revision 3.1 2006 July 18 HTS IC H32/HTS IC H56/HTS IC H48 Life support applications These products are not designed for use in life support appliances, devices, or systems where malfunction of these products can reasonably be expected to result in personal injury. Philips Semiconductors customers using or selling these products for use in such applications do so at their own risk and agree to fully indemnify Philips Semiconductors for any damages resulting from such application. Right to make changes Philips Semiconductors reserves the right to make changes in the products - including circuits, standard cells, and/or software - described or contained herein in order to improve design and/or performance. When the product is in full production (status `Production'), relevant changes will be communicated via a Customer Product/Process Change Notification (CPCN). Philips Semiconductors assumes no responsibility or liability for the use of any of these products, conveys no licence or title under any patent, copyright, or mask work right to these products, and makes no representations or warranties that these products are free from patent, copyright, or mask work right infringement, unless otherwise specified. 49 PUBLIC INFORMATION Philips Semiconductors Product Specification Revision 3.1 2006 July 18 HITAG S HTS IC H32/HTS IC H56/HTS IC H48 18 REVISION HISTORY Table 28 HTS IC H32/HTS IC H56/HTS IC H48 Revision History REVISION DATE CPCN PAGE 1.0 2002 August - Initial version. 1.1 2002 October - Contents updated. Complete Document 29 to 33 1.2 2003 January 24 to 30 2003 Sept 24 to 30 2003 Nov Data Rate corrected for Manchester Coding. Delivery Configuration added. Values for modulation details completed. Chapter 9 "Protocol timing" modified and final timing parameters added. Contents updated. Status now -> Preliminary specification 8 3.0 Public Mode changed into Plain Mode. Contents updated. 17 2.0 DESCRIPTION added new Section 6.1.1 "Product identifier (PID)" Timing parameter updated. Contents updated. Status now -> Product specification 3 Section 1.1 "Protocol" - added new bullet: "Fast Anticollision Protocol ..." 3 Section 1.3 "Supported Standards" - rewording 3.1 2006 Jul - 48 Section 17 - added: Patent information, Field of Use 50 PUBLIC INFORMATION Philips Semiconductors - a worldwide company Contact information For additional information please visit http://www.semiconductors.philips.com. Fax: +31 40 27 24825 For sales offices addresses send e-mail to: sales.addresses@www.semiconductors.philips.com. (c) Koninklijke Philips Electronics N.V. 2002 SCA74 All rights are reserved. Reproduction in whole or in part is prohibited without the prior written consent of the copyright owner. The information presented in this document does not form part of any quotation or contract, is believed to be accurate and reliable and may be changed without notice. No liability will be accepted by the publisher for any consequence of its use. Publication thereof does not convey nor imply any license under patent- or other industrial or intellectual property rights.