Home

PN533 User Manual UM0801-03

Contents

1. Fig 71 Target commands Passive Passive Passive Passive Active Proprietary TPE TPE Proprietary TPE 106kbps 106kbps 212 424kbps 212 424kbps SENS_REQ SENS_RES SENS_REQ DE SENS RES NFGID1t POL REQ ATR REQ POL RES ATR RES SDD REQ EG SEG POL REQ I NFCID1t I SEL RES I ATR REQ I POL RES I PSL REQ 7 ATR_RES PSL_RES SEL_REQ ed FE SEL RES ATR RES Fed PSL RES PSL REQ PSL RES INITIALISATION ACTIVATION DEP REQ DEP REQ DEP REQ Proprietary DEP RES DEP RES Proprietary DEP RES 2 II 2 2 TL 2 DATA EXCHANGE 3 III 3 III 3 3 III 3 RLS REQ DSL REQ RLS REQ DSL REQ RLS REQ DSL REQ RLS RES DSL RES RLS RES DSL RES RLS RES DSL RES ae WU REO MUP REQ WUP_RES WUP_RES ATR_REQ ATR_RES a Initialisation Data Exchange TgGetData I1 lt gt Start gt Deselected TgSetData IIT TalnitAs Target L1 TgGetlnitiatorCommand 2 Activated End TgResponseTolnitiator 3 enue JeSN EESNd SJOJONPUODIWIS dXN 0 LO80NN jenuew 1SN 6007 Jenuer y4 0 n9Y GZL 40 LGL pamasa SJUBU IY 8002 A dXN 0 LOSOWN C
2. POL RES InListPassiveTarget Tg 1 one card arrives in the field POL_RES and answers correctly InDataExchange Tg 1 DataOut DataOut 06 FO 00 FF 11 22 FeliCa frame xx xx 06 FO 00 FF 11 22 xx xx ACK gt FeliCa frame InDataExchange Status OK Dataln xx xx 06 FO 00 FF 11 22 xx xx Dataln 06 FO 00 FF 11 22 Fig 83 FeliCa PCD example NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 163 of 175 NXP Semiconductors UM0801 03 UM0801 03 8 6 3 PN533 acting as 106 kbps target PN533 User Manual This example shows how the PN533 behaves in front of a MIFARE PCD when it has been configured as target one INITIATOR Controller ACK SENS_REQ b gt SENS RES e SDD gt gt SEL_REQ s gt SEL_RES Cmd_0 lt D TgInitAsTarget Mode Mifare Speed 106 kbps Command received Cmd 0 gt eee Res_0 TaResponseTotnitat Status OK ACK p Cmd_1 D TgGetinitiatorCommand Cmd Cmd 1 Fig 84 106 kbps non DEP target example NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 164 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 6 4 PN533 acting as 212 kbps target This example shows how the PN533 behaves in front of a 212
3. InCommunicateThru DataOut 4 ACK RF Packet PRE DataOut POST gt RF Packet 4 InCommunicateThru Dataln 4 PRE Dataln POST Fig 49 InCommunicateThru 3 If the parameter fRetryTimeout of the command RFConfiguration 8 4 1 p 73 is 0x00 no time out is managed on the delay tresp used by the target to send back its answer The host controller has to manage timeout by itself Otherwise fRetryTimeout is different from 0x00 the PN533 checks the response delay tresp to detect mute target delay greater than fRetryTimeout parameter In case of error either mute target or communication error the PN533 sends again the RF packet to the target as many times as defined in the MaxRtyCOM parameter cf RFConfiguration command in 8 4 1 p 73 In any case the host controller can stop the current InCommunicateThru command by using one of the two dedicated ways of stopping ACK frame or new command frame NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 111 0f 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 4 10 InQuartetByteExchange This command is a specific command used to support basic data exchanges between the PN533 and a card RFA tag or MIFARE card Input or sam e Tg is the logical number of the relevant target e Type is the type of expected input data o Single pass and atime out is expected 0x01 o Single pass and an A
4. InJumpForPSL ATR REQ PN533 TARGET HOST Controller ATR RES InDataExchange xx bytes e g FilelD ATR RES LR 64 bytes DEP REQ S TOJREQ S TOJRES DEP RES 1 Ml DEP_REQ DEP_RES 2 Ml DEP_REQ DEP_RES 3 Ml DEP_REQ DEP RES 4 Ml DEP_REQ 60 602 603 604 240 byte g amp InDataExchange no data DEP RES 5 MI DEP REQ DEP RES 6 Ml DEP REQ DEP RES 7 Ml DEP_REQ DEP RES 8 Ml DEP_REQ 60s 605 607 605 240 bytes MI InDataExchange no data DEP_RES 9 Ml DEP_REQ DEP RES 10 MI DEP REQ DEP RES 11 MI DEP REQ 609 6019 6011 40 2 220 bytes 700 bytes DEP RES 12 TginitAsTarget ATR REG TgGetData 700 bytes xx bytes e g FilelD TgSetMetaData 262 bytes mn OK TgSetMetaData 262 bytes Q 000 Q OK TgSetData 176 bytes Q O Q OK Fig 80 DEP chaining mechanism transfer with Meta Chaining Target case UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 160 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 5 5 Comparison of the length of Payload data field The following figure depicts the available length for the payload field
5. RATS 252 bytes MI InDataExchange no data 700 bytes I 0 o CD gt 0e R ACK 1 252 bytes M InDataExchange no data 1 1 mn R ACK o 196 bytes 700 bytes Fig 75 15014443 4 chaining mechanism Transfer from PICC to PCD I 0 0 L NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 154 of 175 NXP Semiconductors UM0801 03 UM0801 03 8 5 4 2 DEP chaining mechanism PN533 User Manual This chapter details how the PN533 configured as initiator or as target handles the DEP chaining mechanism Four examples are given The following symbolic representation is used InDataExchange no data gt lt lt 60 60 60 60 240 bytes MI TgSetData 196 bytes OK S TO REQ S TO RES 5 DEP_REQ 5 MI d gt DEP_RES i DEP_REQ gt DEP RES 10 o ob InDataExchange command without any data to send and with 240 bytes received The MI bit is set in the status byte informing that additional data is available The subscript 5 6 7 and 8 represents the number of a RF packet of data exchanged TgSetData command with 796 bytes to send Time Out extension request from the target accepted by the initiator Data Exchange between the initiator and the target The initiator sends in the DEP REQ the 5 packet of data and
6. If the bit DEPOnly is not set the complete proprietary command is returned to the host controller If the bit DEPOnly is set the command is refused and the PN533 starts a new AutoColl sequence Host Controller NFC Initiator Fig 55 TginitAsTarget Proprietary command a i ACK i TglnitAsTarget Passive 106 Proprietary Command TglnitAsTarget SENS REQ Lu SENS RES SpD REQ Lu SDD RES m SEL REQ Lu SEL RES AE 212 424 kbps passive BR 212 424 Framing FeliCa When a POL REQ command is detected the PN533 sends back the POL RES contained in FeliCaParams If requested by the initiator 4 byte of the POL REQ 0x01 the system code information is added in the POL RES Then the PN533 waits for a command coming from the initiator that closes the AutoColl process This command may be an ATR REQ Fig 56 or a proprietary command Fig 57 In case of the reception of an ATR REQ the NFCID3i must be the specified NFCID2t with 0x00 padding last two bytes O If not the PN533 rejects the command and starts a new AutoColl sequence If yes the PN533 sends automatically the ATR_RES frame except if the flag fAutomaticATR_RES is not set 8 2 8 p 66 this is the case in Fig 56 If the bit DEPOnly is set the command received must be an ATR REQ The PN533 refuses all other commands and starts a new AutoColl sequence UM080
7. OK InDataExchange 176 bytes DEP RES DEP REQ 1 MI s S TOJREQ S TOJRES TgGetData DEP RES DEP REQ 2 MI DEP RES DEP REG 3 S TOJREQ S TOJRES 601 602 563 176 bytes TgSetData no data DEP_RES Fig 77 DEP chaining mechanism packets transfer 60 60 603 604 225 262 o lt 700 bytes NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 157 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual HOST NFC COntroller INITIATOR 1024 bytes ATR_REQ PN TARGET B TglnitAs Target ATR_RES LR 64 bytes DEP_REQ 1 Ml ATR_REQ E S TO rea S TO res TgGetData DEP_RES DEP_REQ 2 Ml DEP_RES DEP_REQ 3 Ml DEP_RES DEP_REQ 4 Ml DEP_RES DEP_REQ 5 Ml S TO rea S TO res If 60 602 603 604 240 bytes MI TgGetData DEP_RES DEP_REQ 6 MI DEP_RES DEP_REQ 7 MI DEP_RES DEP_REQ 8 MI DEP_RES DEP_REQ 9 MI Siraja o 60 605 607 60 240 bytes MI TgGetData d 5 100 DEP RES DEP REQ 18 S TO rea S TO res 6017 418 64 bytes TgSetData no data 1024 bytes kem SE DEP RES OK Fig 78 DEP cha
8. User Manual Rev 03 14 January 2009 68 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual fSecure When the flag fSecure is set to one the NFC Secure feature is enabled When the flag fSecure is set to zero the NFC Secure feature is disabled Summary of the default settings If the user does not use the SetParameters command the following settings apply Table 17 Default values of internal flags Property Default value fNADUsed No fDIDUsed No fAutomaticATR RES Yes automatic fTDAPowered No fAutomaticRATS Yes automatic fSecure No NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 69 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 3 AlparCommandForTDA This command is used to communicate with the TDA8029 through the PN533 To be able to send an ALPAR command to the TDA you have to switch on the TDA with the SetParameter command see 8 2 8 p 66 Input D4 ALPAR STRUCTURE IN Output D5 ALPAR STRUCTURE OUT e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 In case of error there is no ALPAR STRUCTURE OUT Syntax Error Conditions e ALPAR STRUCTURE IN parameter missing e Incorrect using of ALPAR protocol This protocol encapsulates the useful data of a message in an invariant frame structure and defines a dialog structure of messages exchanges e ALPAR struc
9. 8 4 8 InDataExchange This command is used to support protocol data exchanges between the PN533 as initiator and a target Input e Tg is a byte containing the logical number of the relevant target This byte contains also a More Information MI bit bit 6 indicating when set to 1 that the host controller wants to send more data that all the data contained in the DataOut array see Chaining mechanism 8 5 4 p 152 This bit is only valid for a TPE target or an ISO IEC14443 4 card This byte contains also a Secure bit bit 5 When it is set to 1 the transaction is secured e DataOut is an array of raw data from 0 up to 262 bytes to be sent to the target by the PN533 see 8 5 5 p 161 Output D5 41 Status Dataln e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 When either in DEP or in ISO IEC14443 4 PCD mode this byte indicates also if NAD is used and if the transfer of data is not completed with bit More Information see 8 5 4 p 152 e Dataln is an array of raw data from 0 up to 262 bytes received by the PN533 Syntax Error Conditions e Incase of MIFARE card Cmd value is incorrect Bad number of data for Authentication command Data 0 9 Bad number of data for 16 bytes writing command Data 0 15 Bad number of data for 4 bytes writing command Data 0 3 e Incase of Jewel tag Cmd value is incorrect UM0801
10. NXP Semiconductors UM0801 03 PN533 User Manual 8 6 6 Peer to Peer example with two PN533 active mode This example shows how to make a peer to peer communication in active mode using two PN533 ICs The three commands InDataExchange at the initiator side and TgGetData and TgSetData at the target side allow building a communication based on the NFC DEP protocol In this example the communication is established in active mode whatever the baud rate is From the host controller point of view the one of the PN533 initiator and the one of the PN533 target the set of commands to use is the same in active and in passive communication modes HOST HOST PN533 PN533 Controller INITIATOR TARGET au initiator target InJumpForDEP xxxkbps Active lt ACK ATR_REQ Depends on fATR RES Timeout and MxRtyATR ATR REQ ATR REQ TalnitAsTarget 25 gt ATR_REQ ACK ee ATR_RES en InJumpForDEP OK TgInitAsTarget OK Tg 1 ATR_RES xxxkbps Active ATR_REQ TgGetData InDataExchange Tg 1 CMD 1 a ACK i ACK DEP_REQ CMD 1 S TO rea S TO res O TgGetData OK Data embi TaSetData Data RES 1 at DEP_RES RES_1 ACK gt ie InDataExchange OK RES_1 TgSetData Status OK 9 8 i 8 e 8 V Vv Fig 87 Peer to Peer communication exampl
11. PN533 User Manual Standby mode The Standby mode is the starting mode after reset the PN533 stays in this mode until it is not commanded to go into any other mode After reset the PN533 stays in Normal mode regarding the CPU and in CL D mode regarding the contact less interface see Table 3 p 10 C CL CLD v CPU Normal Mode END Wait for a Host Controller command Fig2 Standby mode NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 12 of 175 NXP Semiconductors UMO0801 03 UM0801 03 3 1 2 3 PN533 User Manual Suspend mode The Suspend mode is the preferred mode to save power consumption PN533 may enter in suspend mode due to the host entering a suspend mode of its own In addition PN533 shall also enter in Suspend mode when the computer hub port is disabled according to reference 7 1 7 6 of 10 4 START y TDA8029 E S M v CL CLD v CPU Power Down Mode y END Wait for a Host Controller command Fig 3 Suspend mode User Manual NXP B V 2008 All rights reserved Rev 03 14 January 2009 13 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 3 1 2 4 Initiator PCD mode This mode is the one used when the PN533 has one target or card activated All the initiator commands listed
12. This command is used for radio regulation test Input e TxMode is the definition of the bit rate and of the framing used for data transmission 7 6 5 4 3 2 1 0 Om sees mi mu Tramino 000 106 kbps 001 212 kbps 00 MIFARE 010 424 kbps 10 FeliCa 011 847 kbps Output This command never stops so no output frame is sent Description The PN533 makes RF transmission with pseudo random numbers by using the PRBS15 bit of the CIU TestSel2 register see 4 The transmission speed and the framing are indicated by the host controller with the TxMode parameter The TxMode TxSpeed parameter defines the bit rate that is used during the transmission 106 212 424 kbps or 847 kbps The TxMode TxFraming parameter defines the type of modulation MIFARE or FeliCa modulation The PN533 transmits data until anew command comes from the host controller NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 79 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 4 3 InJumpForDEP This command is used by a host controller to activate a target using either active or passive communication mode If a target is in the field it will then be ready for DEP exchanges Input PassivelnitiatorData NFCID3i 0 9 Gi 0 n e ActPass is the communication mode requested by the host controller 0x00 Passive mode 0x01 Active Mode e BR is the Baud Ra
13. User Manual Rev 03 14 January 2009 103 of 175 NXP Semiconductors UM0801 03 PN533 User Manual e ISO IEC14443 4 card When the target Tg is ISO IEC14443 4 compliant the input parameters are interpreted by the PN533 to execute an ISO IEC 14443 4 exchange The PN533 uses the data contained in the DataOut buffer to build frames The main ISO IEC14443 4 protocol mechanisms are implemented o Chaining o Waiting time Extension o Error handling The payload data returned by the target are sent back to the host controller in Dataln The C APDU command length can be up to 261 bytes CLA INS P1 P2 P3 255 data bytes Le and the R APDU returned to the host controller can have a length of 258 bytes 256 data bytes SW1 SW2 Remark Both Dataln and DataOut can contain NAD information See SetParameters command 88 2 8 p 66 for having a complete description Example It is assumed in this example that the logical number attributed by the PN533 to the card is 0x01 The command sent to the card is a read command 16 bytes are read gt D4 40 01 00 BO 82 00 10 D5 41 00 00 01 02 03 04 OF 90 00 The value of the status byte is 0x00 indicating that the RF exchange is correct HOST PN533 I8014443 4 Controller Initiator Target InListPassiveTarget MaxTg 1 Baud Rate 106 kbps SENS REQ SENS RES SDD P nea NE i gt SEL_REQ 15014443 4 compliant
14. XX XX xx xx xx 00 FF 02 FE D4 02 2A xx XX xx xx 00 FF 02 FE D4 02 2A xx XX XX xx XX XX XX XX XX 00 FF 02 FE D4 02 2A 00 FF 02 FE D4 02 2A NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 38 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 7 1 2 Dialog structure The following chapters explain the dialog structure The host controller is always the master of the complete exchange It sends a command to the PN533 The PN533 sends back an acknowledge to inform the host controller that the command has been successfully received The PN533 executes the command The PN533 sends back the corresponding answer to the host controller Optionally the host controller may send an ACK frame to indicate to the PN533 that the answer has been successfully received 7 1 2 1 Data link level a Successful exchange at data link level The figure below describes a normal exchange Host Controller PN533 det 3 Pe Fig 21 Data link level normal exchange UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 39 of 175 NXP Semiconductors UM0801 03 PN533 User Manual b Error at data link level from host controller to PN533 When an error is detected by the PN533 at the data link level it does not send back an ACK frame to the host controller Host Controller PN533 Command Packet Fi
15. 8 2 4 p 59 e XRAM memory mapped registers The complete address is given by the high and low bytes of address See 4 Example The host controller writes the value OxFO in the register RX_ THRESHOLD located at address 0x6308 and the value 0x55 in the EN7 register SFR located at address OxE8 The frame from the host controller to the PN533 is D4 08 63 08 Fo FF E8 55 and the frame returned by the PN533 is D5 09 00 Warning The behavior of the PN533 may be altered by this command This command is only recommended for debug purposes UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 62 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 2 6 ReadGPIO The PN533 reads the value for each port and returns the information to the host controller Input vos ae Output is we mle e The field P3 contains the state of the GPIO located on the P3 port 0 Jo Pas P34 pas P32 P31 P30 5 4 3 2 1 0 e The field P7 contains the state of the GPIO located on the P7 port 0 0 0 0 O P72 P71 rfu 2 1 0 e The field I0I1 is reserved for future used po fo of of a o mu tu Description The GPIOs may be used with the following limitations of usage e P32 corresponds to the pin P32 INTO P32 can be used as standard GPIO and is therefore not used as external interrupt trigger e P33 corresponds to the pin P33_INT1 P33 c
16. User Manual Rev 03 14 January 2009 77 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e Cfgltem 0x0D Analog settings for baudrates 212 424 and 847 kbps with ISO IEC14443 4 protocol 9 bytes This Cfgltem is used to choose the analog settings that the PN533 will use for the baud rates 212 424 847 kbps with ISO IEC14443 4 cards When using this command the host controller has to provide 9 values ConfigurationData for the following internal registers Table 24 Analog settings for the baudrate 212 424 and 847 kbps with ISO IEC14443 4 protocol Byte Register Default values Baudrate Byte 1 CIU RxThreshold 0x85 Byte 2 CIU ModWidth 0x15 212 kbps Byte 3 CIU_MifNFC Ox8A Byte 4 CIU RxThreshold 0x85 Byte 5 CIU ModWidth OxOA 424 kbps Byte 6 CIU_MifNFC 0xB2 Byte 7 CIU RxThreshold 0x85 Byte 8 CIU ModWidth 0x04 847 kbps Byte 9 CIU_MifNFC OxDA Except for these three specific registers CIU RxThreshold CIU ModWidth and CIU_MifNFC the 8 remaining analog registers are the same as the previous Cfgltem Ox0A Output Syntax Error Conditions e Various timings values greater than 0x10 item 2 e Incorrect Cfgltem value 0x00 0x03 0x06 0x07 0x08 0x09 and greater than Ox0D e Incorrect command length UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 78 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual RFRegulationTest
17. 11 The PN533 is configured as master on this 12C link and it is able to communicate with an external EEPROM address OxA0 and with the TDA8029 contact card reader address 0x50 HOST TDA8029 Optional EEPROM Optional Fig 10 PN533 links overview As specified in the I2C bus specification only two lines have to be used for managing the serial link between the TDA8029 or EEPROM and the host controller gt A serial data line SDA has to be connected on pin 33 of the PN533 gt And a serial clock line SCL has to be connected on pin 32 of the PN533 The maximum SCL frequency for the TDA is 45 kHz For the EEPROM transactions are performed at a frequency of 400 kHz UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 24 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 6 1 External EEPROM mapping 6 1 1 EEPROM data organization The TLV system is used for organizing data in EEPROM Each block of data is preceded by its tag and its length The EEPROM mapping is shown below Fig 11 EEPROM mapping The remaining free bytes at the end of the EEPROM have to be set to OxFF At least one OxFF has to be present at the end of EEPROM mapping Each block of data has to be present only one time in EEPROM The sequence of these blocks is not important If one of Tags 2 3 4 and 5 is present then all these Tags have to be present If
18. DEP header CMDO CMD1 PFB Payload Data E1 Preamb B2 4D LEN DEP header CMDO CMD1 PFB Payload Data E2 SOF Payload Data EOF Prologue field PCB CID NAD Information field Epilogue field m S ADD DATA CRC1 CRC2 E This example does not show the chaining mechanism It is assumed that all the data are sent in only one RF frame Data from the device is sent in a single frame with a start S and an End E of frame This is an example for the READ command Header Payload Data DCS Fig 43 InDataExchange Different target types The way of exchanging data is different depending on the real nature of the target DEP MIFARE card Jewel and RFA tag FeliCa card or ISO IEC 14443 4 card NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 102 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual MIFARE card When the target Tg is MIFARE compliant the input parameters are interpreted by the PN533 to execute a MIFARE exchange The PN533 sends the command and waits for the answer with a default timeout value of 51 2 ms This value can be changed by using the command RFConfiguration 8 4 1 p 73 The DataOut data must be formatted in the following way Cmd Data 0 15 e Cmd is the MIFARE specific co
19. Management of GPIO configuration A management of GPIO configuration of the PN533 ports P3 and P7 is implemented in order to reduce the power consumption in power down mode If a GPIO is forced in low state by external conditions the following actions are taken before going into power down mode e The initial configuration of the GPIO is saved input quasi bidirectional or output mode e The GPIO is then configured in input mode When the PN533 exits the power down mode the initial configuration of the GPIO is restored Therefore every GPIO of the ports P3 and P7 recovers its initial configuration 3 1 2 7 Management of RF field in the activation commands The activation commands are the first RF communication commands used to initialize a communication session The usual activation commands are InListPassiveTarget InJumpForDEP and InJumpForPSL see Table 14 p 48 When these commands are launched they send activation requests until a target is found The abortion of an on going activation command will automatically switch off the RF field in order to reduce the power consumption The RF field is also switch off if no target has been found before the number of retries see 8 4 1 p 73 is over NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 16 of 175 NXP Semiconductors UM0801 03 UM0801 03 NFC Secure PN533 User Manual NFC Secure Standard specifies an application lay
20. Table 21 Table 22 Table 23 Table 24 Table 25 Table 26 Table 27 Table 28 Table 29 UM0801 03 PN533 User Manual CONTOU OGE EE en ne one re eee mee a eee ee ae eee 7 TX framing and TX speed in RFfieldON configuration cccceeececeeeeeceeeeeeeeeeeeaeeeeesaaeeeeseeeeesaeeeesaenees 8 Power modes TO Ca act recesses eseeranca ce es tb roinne Ori pe cb i a eei seas mab reiben neioii A aeinn iiti ennert 10 Power modes for CL interface rrarnrnnnnrnrnrnnnrrnrnnnrnnnnnnrnvnnnsrnrnnnsnnnnsnrnnnnnsrnrnnnsnnnnsnsnnnnnernnnnssnnnnnnsssnnnnn 10 Power modes for the TDA8029 rrrnrnrnnnnnnrnrnnnrnnrnnnrnnnnnnrnvnnnsrnrnnnsnnnnsnrnnnnnsrnnnnnsnnnnsnsnnnnnernnnnnennnnnsnnsnnnnn 10 Sequence of secured DEP started by Initiator arrrrrnnnnrnrnnrrrnrnnrervnnnrenrnnrrnrnnsrennnnnrennnnrrnnnnsrennnnnnennnn 20 Sequence of secured DEP started by Target cccccccccssececcesececceseeeceeeceeceaseessegeeesseeeeesseseessaneeeeas 20 DOV ICS IOS CID GON eee 22 Configuration DESChIDUOM siccies cece verecouptecnnauaveceusdncetivesereceeens doesn dee vacenseeca RE 22 interlace DN re 23 Endpoint 4 Descriptor IN rrrarrrnnrrnarrrarernrnnnrrnnrennrrnannnanennennnnennennnanennnennaennnnennsennaennnsennnennnnsennnennnene 23 Ed MI Descriptor OUT vr 23 Sequence for fetching information of EEPROM during Enumeration cccccceseeeeeeeeeeeeeeeeeeeseeeeeens 31 Co 11001110 EEE EE Saute ae Serie oceans E E 48 SS ee cet
21. a Error Status 27 Command CT 2 bis ACK Command CT 3 ROSP ni gt _ Cmd CT 3 ACK Response CT 3 Fig 39 CT Command can be aborted by another CT command PN533 TDA8029 Cmd CT 1 Resp CT3 In this case Contact command 1 is aborted by a second one 2 then an error status 0x27 is returned to the host While the TDA is busy every Contact commands 2bis return an error 0x27 When the TDA is free a new Contact command will terminate successfully 3 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 72 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 4 RF Communication command 8 4 1 RFConfiguration This command is used to configure the different settings of the PN533 as described in the input section of this command Input Cfgltem ConfigurationData The ConfigurationData field length and content depend on the Cfgltem as follows e Cfglitem 0x01 RF field ConfigurationData length is 1 byte RFConfiguration allows switching on or off the RF field immediately 7 6 5 4 3 2 1 0 Auto RF RFCA on off 0 Off 0 Off 1 On 1 On When the bit AutoRFCA is off the PN533 does not need to take care of external field before switching on its own field In other words if the bit AutoRFCA is off and RFon off is on the PN533 will generate RF field whatever external field is present or no
22. and the value has no impact on the frame processing NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 47 of 175 NXP Semiconductors UMO0801 03 UM0801 03 8 PN533 User Manual Commands supported The following description of the commands details e The frame structure including the type and amount of data o That the host controller has to deliver to the PN533 Input o That the PN533 returns to the host controller Output e When existing the possible causes of syntax error Syntax Error Conditions e Adescription of the process attached to the command Description For Input and Output data optional bytes are written into square brackets List of commands A cross X in the PN533 column indicates if the command may be used with the PN533 configured as initiator or and with the PN533 configured as target The Command Code column gives the value of the command code CC in the two represented frames below that is used in the frame from the host controller to the PN533 oo 00 Fr ten tes os cc opiera puta ocs 00 roo o0 EF ten res os ccr OptoralOuputaia Des o0 For the RF Communication commands when commands are dedicated to the PN533 as initiator respectively Target a In prefix has been added respectively Tg prefix Table 14 Command set PN533 PN533 Command Page Command as Initiator as Target Code Miscellaneous Dia
23. imm pr gt E S E E EE ES BENENE ee pepu os 7 Remarks Target is not selected Target is called by NFCID XXX REQ Baudrate dependent command C Target is selected rase is called by DID XXX REQ Transport protocol command Fig 72 Target states jenue N J8SN CESNd SJOJONPUODIWIS dXN 0 LO80NN NXP Semiconductors UM0801 03 PN533 User Manual 8 5 4 Chaining mechanism 8 5 4 1 ISO IEC14443 4 chaining mechanism This chapter details how the PN533 configured as initiator handles the ISO IEC14443 4 chaining mechanism Two examples are given The following symbolic representation is used InDataExchange no data InDataExchange command without any data to send and with 252 lt bytes received The MI bit is set in the status byte informing that 252 bytes MI additional data are available I 1 x l block with chaining bit set and block number x 1 0 x l block with chaining bit not set and block number x R ACK x _R block that indicates a positive acknoledge and block number x ae pd Initiator to the Target or from the Target to the Initiatar The more red the container is the more data it contains Stage number when filling up emptying the container Fig 73 Legend used for the figures describing the I5014443 4 chaining of data In the first and second examples the PN533 uses the Chaining functionality to allow transfer of large amount of data The Fig 74 represents th
24. lt e RATS e ATS InListPassiveTarget Target number 1 target info oe InDataExchange 1 00 BO 82 00 10 _S T CL command Frame lt ACK xx xx PCB 00 BO 82 00 10 xx xx J l TimeOut control T CL response Frame L InDataExchange OK zz zz zz 90 00 xx xx PCB zz zz zz 9000 xx xx i Fig 44 InDataExchange Example of a ISO IEC14443 4 exchange UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 104 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual During the exchanges the following timeout control is used between the ISO IEC14443 4 command and the response from the card TimeOut FWT 3 2 etu Concerning the error handling the PN533 tolerates up to 3 errors detected in the communication flow before returning an error code to the host controller Also a S DESELECT request is automatically send to fulfill ISO IEC14443 4 standard NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 105 of 175 UM0801 03 PN533 User Manual NXP Semiconductors e FeliCa card When the target Tg is a FeliCa card the PN533 just transfers the data contained in the DataOut buffer as they are The Len and Cmd bytes of the FeliCa protocol must be present in this buffer the frame is completely built by the host controller L
25. 02 A5 15 03 00 4B 02 4F 49 8A 8A FF FF In the answer frame it is indicated that one target has been initialized with the following parameters Logical number 01 POL RES length 14 response code byte 01 NFCID2t 01 01 06 01 67 02 A5 15 PAD 03 00 4B 02 4F 49 8A 8A System Code FF FF NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 93 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual In this fourth example the host controller requires to detect and to initialize an Innovision Jewel tag gt D4 4A 01 04 D5 4B 01 OL 04 00 92 2E 58 32 In the answer frame it is indicated that one target has been initialized with the following parameters Logical Number 01 ATQA RES 04 00 RID content 92 2E 58 32 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 94 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 4 6 InATR This command is used by a host controller to launch an activation of a target in case of passive mode Input NFCID3i 0 9 Gi 0 n e Tg is the logical number of the relevant target e Next indicates if the optional fields of the command NFCID3i and Gi are present bit 1 or not bit 0 Bit 0 NFCID3i is present Bit 1 Gi is present e NFCID3i is the NFCID3 of the initiator that is used by the PN533 within the ATR_REQ Depending on the
26. 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 100 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual Description When using this command it is assumed that a target has been first activated The baud rate and the modulation type that have been chosen by using one of the 3 possible commands InListPassiveTarget InJumpForDEP or InJumpForPSL Host PN533 Taraet Controller initiator g InDataExchange Tg DataOut ACK K _ __ _ DataOut Dataln InDataExchange Status Dataln 4 Fig 42 InDataExchange General context If the target number is unknown the PN533 returns a specific error code Status 0x27 The PN533 has stored internally all the necessary information needed about all the initialized targets e Type DEP MIFARE card Jewel tag RFA tag ISO IEC14443 4 card or FeliCa card e Baud rate communication mode active or passive e Internal state selected deselected released So first of all the PN533 applies all the correct configuration settings corresponding to the target Tg Baud Rate modulation type Then if the target Tg is not currently selected current state memorized inside the PN533 the PN533 initiates the selection The detailed process of the selection depends on the type of the target it is given in the InSelect 8 4 13 p 117 command desc
27. 2009 83 of 175 NXP Semiconductors UM0801 03 PN533 User Manual The following figure depicts the InJumpForDEP process in case of passive mode activation at 106 kbps HOST PN533 Target 1 Controller Initiator 106 kbps InJumpForDEP ActPass Passive Baud Rate 106bps NFCID1 i NFCID3i Gi gt SENS REQ ACK lt gt SENS_RES SDD SEL_REQ lt pr SEL RES TPE target ATR REQ DIDi 0 gt lt lt ATR_RES DIDt 0 InJumpForDEP Target number 1 ATR RES Fig 41 InJumpForDEP Passive Communication Mode DID not used Remark In any cases active or passive mode if this command is aborted by the host controller without any target activated the RF field is automatically switched off to decrease power consumption see chapter 3 1 2 7 p 16 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 84 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 4 4 InJumpForPSL This command is used by a host controller to activate a target using either active or passive communication mode If a target is in the field it will then be ready for PSL or DEP exchanges Input PassivelnitiatorData NFCID3i 0 9 Gi 0 n e ActPass is the communication mode requested by the host controller 0x00 Passive mode 0x01 Active Mode e BR is the Baud
28. B V 2008 All rights reserved User Manual Rev 03 14 January 2009 118 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual Fig 51 InSelect HOST PN533 Target1 Controller Initiator 106 kbps p gt SENS REQ ACK lg gt SENS RES SDD Das J K ZJ4Z Z a SEL_REQ gt td en SEL_RES InListPassiveTarget Nb of initialised Target 1 Target_1 info lt ACK Mifare Frame DataOut 5 lt Mifare Frame Dataln s ACK SLP_REQ InDeselect OK SS ALL_REQ lt ACK k gt SEL_REQ UID_1 lg gt SEL_RES InSelect OK NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 119 0f 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 4 14 InActivateDeactivatePaypass The goal of this command is to poll IS014443 4 PICCs with respect to Paypass1 1 and EMVco2 0 specifications Input e Paypass Item specifies the type of Paypass action o 0x01 Polling anti Collision Activation for Paypass 1 1 o 0x02 PICC removal procedure for Paypass 1 1 o 0x03 Polling Anti Collision Activation for EMVCo 2 0 o 0x04 PICC removal procedure for EMVCo 2 0 Output e Paypass Item 0x01 Polling Anti Collision Activation for Paypass 1 1 This Paypass Item is used to poll a PICC when we have to be compliant wi
29. Bad TSN Time Slot Number value in PassivelnitiatorData in passive 212 424 kbps mode different from 0x00 0x01 0x03 0x07 or 0x0F e Incorrect command length Description The process of this command is exactly the same than the one of InJumpForDEP 8 4 3 p 80 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 86 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 4 5 InListPassiveTarget The goal of this command is to detect targets maximum MaxTg in passive mode Input e MaxTg is the maximum number of targets to be initialized by the PN533 The PN533 is capable of handling 1 target maximum at once so this field should not exceed 0x01 e BrTyis the baud rate and the modulation type to be used during the initialization 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 106 kbps type A ISO IEC14443 Type A or MIFARE or 106 kbps RFA tag 212 kbps FeliCa polling 424 kbps FeliCa polling 106 kbps type B ISO IEC14443 3B 106 kbps Innovision Jewel tag rfu 212 kbps type B ISO IEC14443 3B 424 kbps type B ISO IEC14443 3B 847 kbps type B ISO IEC14443 3B e InitiatorData is an array of data to be used during the initialization of the target s Depending on the Baud Rate specified the content of this field is different 106 kbps type A The field is optional
30. Type A or RFA tag As long as there is no target detected maximum MaxTg This process is done MxRtyPassiveActivation times 8 4 1 p 73 Cfgltem 0x05 if no answer is detected the command is terminated and the field NbTg in the output buffer contains 0x00 meaning that no target has been detected with the number of allowed trials o Probe the field for targets using either SENS REQ or ALL REQ command with timeout control of 5 ms The ALL REQ command is sent if the InitiatorData input data contains a UID of a card The ID includes the cascade tag CT if it is cascaded level 2 or 3 o If one of several target s has been detected with the previous command handle the anti collision SDD REQ and then select one target SEL REQ command o If the selection is successful the PN533 attributes a logical number for the current target This logical number will then be used by the host controller in all the target related commands InDataExchange InATR InPSL InSelect to identify the target The first target found when executing this command will have the number Tg 1 The information relative to previously initialized targets stored inside the PN533 is lost o Fill the TargetData output buffer with all the information relative to the target Tg SENS RES SEL RES length of the NFCID1t field NFCID1t o If the target indicates that it is ISO IEC14443 4 compliant then the PN533 carries out the ISO IEC14443 4 acti
31. at this stage the baud rate and the communication mode are now determined and sent back to the host controller within Mode parameter The command received should be an ATR_REQ If the incoming RF frame does not fit with ATR REQ the PN533 starts a new sequence of AutoColl Depending on the flag fAutomaticATR_RES 88 2 8 p 66 the PN533 sends automatically the ATR_RES frame Fig 58 or not If not the host controller shall use the TgSetGeneralBytes 8 4 16 p 133 Host PN533 Controller target TglnitAsTarget ACK aH ATR REQ d i _____ Active BR ATR_REQ Fig 58 TglnitAsTarget Active mode NFC Initiator ATR RES TgInitAs Target Host PN533 Controller target SetParameters fAutomaticATR_RES OFF ACK SetParameters OK TginitAsTarget A ACK TginitAs Target Active BR ATR_REQ L SAE EN gj gt E TgSetGeneralBytes OK Fig 59 TginitAsTarget Active mode and use of TgSetGeneralBytes ATR_REQ ATR RES NFC Initiator NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 131 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual Once the PN533 is configured as target it can handle some of the DEP commands without any help of its host controller The PN533 builds the corresponding ans
32. eee eet et ese een ced ncaa dt 50 BE RI gt go ee en En ee em eee ee E ae 60 Default values of internal flaQS cccccccssseccceeeecceececceececseueecseuuseeseuecessegeeessusseeseseeeseuseeesseseessaass 69 KE TO ES TIMING SE OE EE EEE 13 Timings definition for RFConfiguration command rrrnrnnnrrnrnnnrvvnnnnrnvnnnrrrrnnrernnnnrennnnnrnnnnsrennnnsrensnssennnnn 74 JET Ga Vg gt EE EE NE NTE NE NE 15 Analog settings for the baudrate 106 kbps type A ccc cceeccccseeeeeeeeeeeeeeeeeeeeeeeeeeaaeeeesaaeeeeseeeeesaaeeeesanes 76 Analog settings for the baudrate 212 424 KODS cccccccseccceseeeeeeeeeeeeeeeeeeesaeeeeeaeeeeeseaeeeesaeeeessaeseesaaees 77 Analog settings for the type B rrrrrnnrrrnrnnrrrrnnnrerrnnnrennnnnrnnnsrennnnnrennnnnsnnnnsnennnnsrennnsnennnnsnennnnssesennnsseennnn 77 Analog settings for the baudrate 212 424 and 847 kbps with ISO IEC14443 4 protocol 0 78 Tal BEE de RF ACTIONS EEE EEE EE REN 115 las 2 Nr ACUONS EEE EE NE eter h 116 KER FRI IN ae 117 Target configuration Automatic response rrrrrrrnnnnenrnnnrrvrnnrrnnnnerrnnnnnrrnnnnesnnnnsrennnnsrennnneennnsnennnnsnene 132 Command Set 0 0 ccccceeccccceeeee eee ee cece eee eee a neces eee eee Gee eEAAAEEEEAAAEEEEA GA EEE A A SEEGA SS EESA GG SEEEG GG EEEsG a EEEsGaSeSEEEa Oa EEEE 168 continued gt gt NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 171 of 175 NXP Semiconductors
33. information Syntax Error Conditions e Incorrect Baud Rate BR e Incorrect ActPass parameter e Bad TSN Time Slot Number value in PassivelnitiatorData in passive 212 424 kbps mode different from 0x00 0x01 0x03 0x07 or 0x0F e Incorrect command length UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 81 of 175 NXP Semiconductors UM0801 03 UM0801 03 Description PN533 User Manual The process is different depending on the communication mode Active or Passive ACTIVE MODE Do Initial RFCA ATR REQ o Set the communication settings Active mode baud rate BR o Send ATR REQ constructed with NFCID3i and Gi Depending on the value of the internal parameter fDIDUsed set by the host controller with SetParameters command 8 2 8 p 66 the PN533 constructs the ATR REQ with or without a DID parameter If used the DID value is fixed by the PN533 to 0x01 o Receive ATR RES The PN533 waits for this answer from the target a maximum time timeout defined with the RFConfiguration command 8 4 1 p 73 In case of incorrect ATR RES received the PN533 sends again ATR_REQ MxRtyATR times If a correct ATR_RES is received then the PN533 stores the NFCID3t and attributes a logical number for this new target Tg The target number returned within this output frame is always 0x01 The complete ATR RES CMDO CMD1 0xD5 0x01 excepted is sent back to the
34. it has received a complete RF frame from the initiator the PN533 uses a Supervisory frame to ask for time extension to the initiator 7 x 154 ms 1 078s e Then the PN533 sends the received RF frame back to the host controller 18 7 is the default value of the RTOX parameter sent by the PN533 in an S TO reo 154 ms corresponds to the default value of RWT Response Waiting Time for the PN533 configured as target NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 135 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e After having processed these data the host controller shall use the TgSetData command 8 4 18 p 137 to complete the exchange NFC Initiator Host Controller TgGetData q An nd AEL AAAA PEE IEE ARENA EEEE A EN A EEA AANO NEARE ee INF PDU Dataln nn S TO req 4 S TO res TgGetData Dataln TgSetData DataOut P ACK INF_PDU DataOut TgSetData OK Fig 61 TgGetData 1 In this schematic representation no chaining is shown Refer to 8 5 4 p 152 to have a more detailed explanation of the chaining mechanism in case of the PN533 configured as target The PN533 can also accept a INF_PDU incoming frame from the initiator even if it has not received yet a TgGetData command from the host controller The protocol exchange with the initiator is then preserved by using S TO rea H
35. kbps initiator when it has been configured as target In this example there are two POL REQ POL RES exchanges during the initialization of the target This is just to show that TgInitAsTarget ends only after having received a command frame different from POL REQ PRAT INITIATOR Controller la POL_REQ Tornit AsTarget No response from the PN532 because not initialized yet _ S gt gt lt ACK POL REQ POL RES d POL REQ gt POL RES CMD 0 different from polling No automatic response from the PN532 TgInitAsTarget Mode FeliCa Speed 212 kbps Command received CMD 0 TgResponseTolnitiator RES 0 gt lt noe RES 0 gt TgResponseTolnitiator Status OK TgGetnitiatorCommand 0 a 3 ACK la CMD_1 TgGetlnitiatorCommand Status OK Frame received CMD 1 To ResponseTolnitiator RES 1 A lt ACK RES 1 TaResponseToinitiator Status OK Fig 85 212 kbps target example UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 165 of 175 NXP Semiconductors UM0801 03 8 6 5 Peer to Peer example with two PN533 passive mode PN533 User Manual This
36. payload InJumpForDEP ATR_RES ATR_REQ NAD usable ATR_RES NAD usable SetParameters NADUsed Can be sent before InJumpForDEP OK InDataExchange NADi payload Status NADt payload DEP REQ NADi payload S TO REQ S TO RES DEP_RES NADt payload Fig 33 fNADUsed Status byte coding add t MI Error code T 6 5 0 Fig 34 Status Byte definition NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 67 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual In ISOAEC14443 4 PCD mode By default the PN533 initiator does not use the NAD byte in the Transport Protocol so the host controller must set this flag in order to use NAD The NAD value itself is set by the host controller directly in the InDataExchange command see 8 4 8 p 100 In reception mode the NAD value received by the PN533 will be transmitted to the PN533 host controller fDIDUsed DEP and ISO IEC14443 4 PCD By default the PN533 initiator does not use the DID byte for DEP and the CID byte for ISO IEC14443 4 PCD in the Transport Protocol not multi target configuration So the host controller must set this flag in order to use DID CID In that case the DID CID value itself is completely handled internally by the firmware The DID CID has a fixed value of 0x01 when fDIDUsed is set to 1 fAutomat
37. pin configuration UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 9 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual Power modes of the PN533 The PN533 has different power modes which are listed in the following table refer to 4 to have a complete description 3 1 1 1 Power modes for CPU Table 3 Power modes for CPU Power Mode Description Hard Power Down The CPU is in reset state This mode can be reached only by an external action on RSTPDN pin not by a firmware action Normal The CPU is running Power Down Oscillator is stopped needs delay to be waken up typ 500us 3 1 1 2 Power modes for Contact Less interface Table 4 Power modes for CL interface Power Mode Description Hard Power Down The contactless UART and the analog front end are in reset state This mode can be reached only by external action on RSTPDN pin not by a firmware action CLA The contactless UART is running The analog front end is operational RF field is not generated CL B The contactless UART is running The analog front end is operational RF field is generated CLC The contactless UART is in Power Down mode The analog front end is partially operational only the RF level detector is active RF field is not generated CL D The contactless UART and the analog front end are set in the mode in which the power consumption is the minimum i e pow
38. retries MxRtyPSL is a byte containing the number of times that e The PN533 will retry to send the PSL_REQ in case of incorrect reception of the PSL_RES or no reception at all for the NFCIP 1 protocol e The PN533 will retry to send the PPS request in case of incorrect reception of the PPS response or no reception at all for the ISO IEC14443 4 protocol Value OxFF means to try eternally 0x00 means only once no retry only one try The default value of this parameter is 0x01 the PSL REQ PPS request is sent twice in case of need MxRtyPassiveActivation is a byte containing the number of times that the PN533 will retry to activate a target in InListPassiveTarget command 8 4 5 p 87 Value OxFF means to try eternally 0x00 means only once no retry only one try The default value of this parameter is OxFF infinitely UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 75 of 175 UM0801 03 PN533 User Manual NXP Semiconductors e Cfgltem 0x0A Analog settings for the baudrate 106 kbps type A 11 bytes This Cfgltem is used to choose the analog settings that the PN533 will use for the baudrate 106kbps type A When using this command the host controller has to provide 11 values ConfigurationData for the following internal registers Table 21 Analog settings for the baudrate 106 kbps type A Byte Register Default values Byte 1 CIU_RFCfg Ox5A B
39. the baudrate 212 424 kbps Byte Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Register CIU RFCfg CIU GsNOn CIU CWGsP CIU ModGsP CIU DemodRfOn when own RF is On CIU RxThreshold CIU DemodRfOff when own RF is Off CIU GsNOff Default values Ox6A OxFF Ox3F 0x11 0x41 0x85 0x61 Ox6F Note Actually there is only one CIU Demod register which defines a setting used by the reader in reception only But depending on the RF condition two different settings can be used for this register e CIU Demod when own RF is On defines a setting when its RF field is on during a reception i e initiator passive mode e CIU Demod when own RF is Off defines a setting when its RF field is off during a reception i e initiator active mode e Cfgiltem 0x0C Analog settings for the type B 3 bytes This Cfgltem is used to choose the analog settings that the PN533 will use for the type B when configured as PCD When using this command the host controller has to provide 3 new values ConfigurationData for the following internal registers Table 23 Analog settings for the type B Byte Byte 1 Byte 2 Byte 3 Register CIU_GsNOn CIU ModGsP CIU RxThreshold Default values OxFF 0x17 0x85 Except for these three specific settings the 8 remaining analog settings are the same as the Cfgltem 106 kbps type A UM0801 03 NXP B V 2008 All rights reserved
40. the polled target type If a PICC was not found it indicates a collision error transmission error or time out error All possible values of the field PAYPASS Type are listed below o 0x01 Type A target found o 0x02 Type B target found o 0x10 Transmission error reported o 0x11 Protocol error reported o 0x12 Collision error reported o 0x13 Time out error reported e PICCData contains the information about the detected PICC and depends on the baud rate selected The following information is given for one PICC o 106 kbps type A ATQA RES SAK UIDLength Me T ATS 2 bytes 1 byte 1 byte bytes g ATSLength bytes o 106 kbps type B ATQB ATTRIB_RES ATTRIB RES Response Length ATTRIB RES 12 bytes 1 byte Length UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 122 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e Paypass Item 0x04 PICC removal procedure for EMVCo 2 0 This Paypass Item is used to remove a PICC when we have to be compliant with the EMVCo specification version 2 0 This procedure is executed when a Paypass transaction is completed The PN533 shall deactivate the PICC After the PICC has been deactivated the PCD shall poll for the PICC until it is removed from the operating field os ae san sos e Status is a byte indicating if the process has been terminated successfully or not see 88 1 p 50 e PAYPA
41. the terminal may initiate the transaction This phase is compliant with Paypass 1 1 specification see 8 If the PCD receives a response from more than one PICC then the PCD reports 2 a collision to the host 3 If there is only one PICC in the Operating Field then the PCD activates the PICC After the PICC has been activated the PN533 is initialized with respect to 8 The PCD performs the transaction with the InDataExchange command see 88 4 8 p 100 The transaction processing is situated on the application layer When the transaction is finished the host asks the PCD to deactivate the PICC and to wait until the PICC is removed from the Operating Field UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 124 of 175 NXP Semiconductors UM0801 03 e EMVCo 2 0 Main loop The figure below depicts the EMVCo 2 0 main loop This loop is compliant with EMV Contactless Communication Specification 2 0 see 9 PN533 User Manual UM0801 03 Use the InDataExchange Cmd to process the PICC PROCESS PICC Fig 53 EMVCo v2 0 main loop POLL COLLISION DETECTION YES Paypass item 0x03 VO Z O ACTIVATE PICC PICC is Activated REMOVE PICC Paypass item r 0x04 PICC is removed The PN533 proceeds as follow Procedure To detect PICCs which are in the Operating Field the PN533 polls for the different communication sign
42. there is one error in the EEPROM mapping then the information embedded in it are not used In this case PN533 will boot with the default settings located in ROM code 6 1 2 List of EEPROM tags Tags allow PN533 to identify each block of data in the EEPROM The list of EEPROM tags is the following e 0x01 RF settings block O O O O 106kbps communication Type A 212kbps 424kbps communication for FeliCa 106 212 424 847kbps communication Type B 212 424 847kbps communication Type A e 0x02 amp Fixed USB descriptor block O O O O O Device Descriptor Configuration Descriptor Interface Descriptor OUT endpoint Descriptor IN Endpoint Descriptor e 0x03 Device ID String Descriptor e 0x04 gt Manufacturer ID String Descriptor e 0x05 gt String Descriptor 0 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 25 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 6 1 2 1 RF settings block description e 106kbps communication Type A This information is related with the RF Configuration command Cfgitem OAh Analog settings for the baud rate 106 kbps type A o aurca O CIU_DemodRfOn 6 Ciubemodrof 8 CiU Moown 9 cumme e 212kbps 424kbps communication for FeliCa This information is related with the RF Configuration command Cfgitem OBh Analog settings for the baud rate 212 424 kbps UM0801 03 N
43. version of the embedded firmware Input Output EI KAKA Suppor Version of the IC For PN533 the contain of this byte is 0x33 e Ver Version of the firmware e Rev Revision of the firmware e Support indicates which are the functionalities supported by the firmware When the bits are set to 1 the functionality is supported otherwise bit is set to 0 it is not ISO IEC ISO IEC RFU RFU RFU RFU RFU 15018092 14443 14443 TypeB TypeA 7 6 5 4 3 1 0 Description In the case of the PN533 the version is 2 7 That leads to IC 0x33 Ver 0x02 Rev 0x07 Support 0x07 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 56 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 2 3 GetGeneralStatus This command allows the host controller to know at a given moment the complete situation of the PN533 Input Output e Err is an error code corresponding to the latest error detected by the PN533 e Field indicates if an external RF field is present and detected by the PN533 Field 0x01 or not Field 0x00 e NbTg is the number of targets currently controlled by the PN533 acting as initiator has to be always equal to 0 or 1 PN533 can not manage 2 targets e For the target controlled by the PN533 Tg _ logical number BrRx bit rate in reception o 0x00 106 kbps o 0x01 212 kbps o 0x02 424 kbps o 0x03 847 kbps bit rate in
44. 00 TG_IDLE TG RELEASED the PN533 acting as NFCIP 1 target waits for an initiator or has been released by its initiator Qx01 TG ACTIVATED the PN533 is activated as NFCIP 1 target 0x02 TG DESELECTED the PN533 acting as NFCIP 1 target has been de selected by its initiator e BRit gives information about the baud rate used only when in TG_ACTIVATED state 7 6 5 4 3 2 1 0 a Speed _ Initiator a Speed_ Target 000 106 kbps 000 106 kbps 001 212 kbps 001 212 kbps 010 424 kbps 010 424 kbps Description The goal of this command is to offer the possibility for the host controller to know if the PN533 target has been either de selected or released In addition the baud rates used in both directions are also returned UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 146 of 175 NXP Semiconductors UM0801 03 8 5 Commands summary PN533 User Manual The host controller has several commands that can be used when the PN533 is configured either as initiator or as target 8 5 1 Commands for Initiator mode The Fig 70 summarizes all the possible commands that can be used when the PN533 is configured as initiator Initialization Activation e InJumpForDEP e InJumpForPSL e InListPassiveTarget e InATR e InPSL e InActivateDeactivatePaypass Data Exchange e InDataExchange e InCommunicate Thru e InQuartetByteExchange Selection De Selection Release e
45. 01 06 FO 00 FF 11 22 D5 41 01 Here the status byte informs of a timeout detected by the PN533 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 106 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e DEP target When the target Tg is a NFC DEP the PN533 takes care of the protocol internally The PN533 sends the data contained in the DataOut array either in one or several stages chaining mechanism as described in 3 and 8 5 4 p 152 depending of the total length of the frame to send The PN533 uses a fixed value of Length Reduction of 64 bytes even if the target indicates a higher capability The error handling and the timeout extensions S TO reqg and S TO res are also completely internally managed by the PN533 If the More Information bit is not set in the Tg field of the host controller command the PN533 waits fora DEP_RES After having received a complete frame from the target the PN533 sends back the data received in the Dataln array If the More Information bit is set in the Tg field of the host controller command the PN533 returns no data to its host controller but takes care of the target with the timeout extensions request and response Remark Both Dataln and DataOut can contain NAD information See SetParameters command 8 2 8 p 66 to have a complete description Example It is assumed in this example that the logical number attribu
46. 1 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 129 of 175 NXP Semiconductors UM0801 03 PN533 User Manual Fig 56 TglnitAsTarget Passive DEP 212 424 kbps Host PN533 NFC Controller target Initiator SetParameters fAutomaticATR_RES OFF ACK A W_ SetParameters OK TginitAsTarget i ACK POL REQ L POL RES ee POL RES OP gt ATR_REQ TglnitAs Target lt r Felica 212 ATR_REQ o proprietary command the PN533 does nothing with this command example in Fig 55 If the bit DEPOnly is not set the complete proprietary command is returned to the host controller If the bit DEPOnly is set the command is refused and the PN533 starts a new AutoColl sequence Host PN533 NFC Controller target Initiator Fig 57 TglnitAsTarget Passive 212 424 kbps Proprietary command p FHomfslageh er gg CR ___ POL REQ L POL RES _ eTo nei gn ET TgInitAs Target GJ FeliCa 212 Proprietary Command UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 130 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual e 106 212 424 kbps active BR 106 212 424 Framing Active mode The PN533 waits for a command coming from the initiator that closes the AutoColl process
47. 11 Oth 1interface available 5 bConfiguratonVave 111 0h 6 iConfiguraton 111 OOM Te PT po No Remote wakeup 8 MaxPower 11 32h 100 mA of max power UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 22 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual Table 10 Interface Descriptor Field ee bLength 9 bytes of descriptor length NG KE TE 7 NE Table 11 Endpoint 4 Descriptor IN bLength 1 O7h 7 bytes of descriptor length 1 bDescriptorlype 11 05h Endpoint descriptor 3 bmaAttibues 1171 02h BULK endpoint 4 wMaxPacketSize 2 0040h 64 bytes of max packet size 6 binterva 117 h 255ms _____ 3 lt D Table 12 Endpoint 4 Descriptor OUT Field Size Value Description bmAttributes BULK endpoint wMaxPacketSize 0040h 64 bytes of max packet size 255ms binterval 255 ms UM0801 03 Remote WakeUp The PN533 is an USB device which does not support Remote WakeUp functionality ability reported in bmAttributes of Configuration Descriptor see Table 9 p 22 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 23 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 6 12C master interface The I2C master interface of the PN533 is compliant with the I2C bus specification see reference document
48. 212 kbps 0x02 424 kbps Qx03 847 kbps BRti is the Baud Rate to be negotiated for communication from the target to the initiator 0x00 106 kbps 0x01 212 kbps 0x02 424 kbps Qx03 847 kbps Output os Jo e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 Syntax Error Conditions e BRit value is incorrect e BRti value is incorrect e Incorrect command length not equal to 5 Description It is assumed that the target Tg has been activated before see commands InListPassiveTarget 8 4 5 p 87 InATR 8 4 6 p 95 and InJumpForPSL 8 4 4 p 85 If this is not the case or if the Tg number is unknown the PN533 informs the host controller with a specific error code Status 0x27 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 98 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual In the case of a TPE target a Parameter Selection is launched with the target Tg e Send aPSL_REQ based on the parameters BRti and BRit The FSL parameter of the PSL REQ is fixed to 0x00 meaning that the maximum length of the Transport protocol field is 64 bytes e Ifa PSL RES is correctly received MxRtyPSL retries 8 4 1 p 73 The PN533 takes internally into account the parameters changes The Status byte is set to 0x00 and sent back to the host controller e Else the PN533 gives up and an
49. 255 bytes including TFI The preamble field is represented here as byte whose value is 0x00 In the way from the host controller to the PN533 refer to each host link communication detailed paragraphs The postamble field is represented here as byte whose value is 0x00 In the way from the host controller to the PN533 refer to each host link communication detailed paragraphs NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 34 of 175 NXP Semiconductors UMO0801 03 UM0801 03 7 1 1 2 PN533 User Manual Extended information frame The information frame has an extended definition allowing exchanging more data between the host controller and the PN533 theoretically up to 64 kB In the firmware implementation of the PN533 the maximum length of the packet data is limited to 264 bytes 265 bytes with TFI included The structure of this frame is the following U g 00 00 FF FF FF LENy LEN LCS TF IDA pete PDn DCS 00 Postamble Packet Data Checksum Packet Data Specific TFI Packet Length Checksum Packet Length Start of Packet Code Preamble Normal Packet Length Checksum Fixed to FF value Normal Packet Length Fixed to FF value Fig 15 Extended Information frame The normal LEN and LCS fields are fixed to the
50. 3 8 4 9 PN533 User Manual InCommunicateThru This command is used to support basic data exchanges between the PN533 and a target Input e DataOut is an array of raw data to be sent to the target by the PN533 max 264 bytes cf 88 5 5 p 161 Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 e Dataln is an array of raw data received by the PN533 coming from the target Description When using this command it is assumed that a target has been first activated The baud rate and the modulation type that have been chosen by a former InListPassiveTarget command 8 4 5 p87 are used for transmitting the DataOut and for receiving the Dataln bytes This command is complementary of the InDataExchange command 8 4 8 p 100 The main difference compared to InDataExchange is that here the PN533 does not handle with all the protocol features chaining error handling The host controller has to take care of the selection of the target it wants to reach whereas when using the InDataExchange command it is done automatically NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 109 of 175 UM0801 03 PN533 User Manual NXP Semiconductors The process performed by this function is e Send the data by encapsulating the raw data DataOut in accordance with the current baud rate used The CRC is automat
51. 3 During an anti collision select operation ISO IEC14443 3 0x04 Type A and ISO IEC18092 106 kbps passive mode an erroneous Bit Count has been detected Framing error during MIFARE operation 0x05 An abnormal bit collision has been detected during bit wise 0x06 anti collision at 106 kbps Communication buffer size insufficient 0x07 RF Buffer overflow has been detected by the CIU bit 0x09 BufferOvfl of the register CIU Error In active communication mode the RF field has not been Ox0A switched on in time by the counterpart as defined in NFCIP 1 standard RF Protocol error cf 4 description of the C U_Error register 0x0B Temperature error the internal temperature sensor has OxOD detected overheating and therefore has automatically switched off the antenna drivers Internal buffer overflow OxOE UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 50 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual Error cause Invalid parameter range format DEP Protocol The PN533 configured in target mode does not support the command received from the initiator the command received is not one of the following ATR_REQ WUP_REQ PSL REQ DEP REQ DSL REQ RLS REQ 1 DEP Protocol MIFARE or ISO IEC14443 4 The data format does not match to the specification Depending on the RF protocol used it can be e Bad length of RF received frame e Incorre
52. 4 January 2009 49 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 1 Error handling In some of the commands detailed hereafter there is a status byte returned by the PN533 reflecting if the RF communication has been successful or not In case of unsuccessful command only the status byte is sent back to the host controller Moreover this byte contains two separated bits bits 7 and 6 used for specific purposes 7 6 5 4 3 2 1 0 present e The NADPresent bit informs the host controller that the payload data contained in the PN533 answer frame for the InDataExchange or TgGetData contain a NAD byte See SetParameters command 88 2 8 p 66 e The MI bit informs the host controller that the PN533 has received data from the initiator in DEP mode or from the PICC on ISO14443 4 PCD mode with MI bit set Thus chaining in reception is on going See how the chaining is handled either by the initiator or by the target in examples given in 8 5 4 Chaining mechanism p 152 e The Error Code bits 0 to 5 informs the host controller on the result of the command When null the operation has gone properly When Error Code is equal to 0x20 a secure command was done properly Otherwise the possible error code values are the following Table 15 Error code list Error cause Error code Time Out the target has not answered 0x01 A CRC error has been detected by the CIU 0x02 A Parity error has been detected by the CIU 0x0
53. 4 Kbps rrrrnnnnrnrnnnrrrnnnnnrrnnnrenrnnnrrnrnnrernnnnrennnnrennnnerrnnnsrernnnsrennnnsneen 130 Fig 57 TglnitAsTarget Passive 212 424 kbps Proprietary command rrrenrnnnvvvnnnrrvvnnnrevrnnrrnvnnrenrnnrrenrnsrrnnnnn 130 Fig 58 TglnitAsTarget Active MOde rrrnrernnrernnnrvvnnnrnnanennnnernnnsnnnnnnnnnnennnnsnnnnsnnnnnnnnnnennnnennnnssnnnnennnnennnnnennnnsennn 131 Fig 59 TglnitAsTarget Active mode and use of TgSetGeneralBytes rrrrrrrrrnnrrrvnnrenrnnnrevrnnrrrvnnrenvnnerenrnnnnen 131 Fig60 TgSetGeneralBytes cccccccccccccssececsesececeececcesseecsesececsseceseaseessegecessgeeessueeesseeeecsageeessaeseeesseaeesssegeeesss 134 FOOT TODT ee 136 2 TEN 622 Pate ee E ee eee a eee eee ee en eee ee 136 Soho rs TREN 137 Fig 64 TgSetDataSecure cise iccccnieccdcsezecstdcces cdiusedtsvececdued utinytactlaidueedbeidets scaed vod eded inblecbunt c evbestdasteeddceisekeediededhssb lt a 138 Fig 65 TgSetMetaData ccccccccccccsssccccssececseeeecceeececseuscecseueeesseueeessueeesseeeesseueeessueseeseueeessegseessagaesesssuesesseneeesas 140 Fig 66 TgGetlnitiatorCommand 1 cccccccccccseeeceeeeeeeeeeeeeeeeeeeeeeeeeeeeseeeeeeseeeeeeseeeeeeeeeeesaeeeeesaeeeesaeeeeesaeaeeeesseeeneas 142 FIG O7 TOGEtMIliatOrCOminmanid 2 REE 143 Fig 68 TgResponseTolnitiator 1 ccccccecccccssscccesececcesececseseeecsusececeuecesseueesseueeesseceeseueeessugeeessecessessgeeessenseeses 144 Fig 69 TgR
54. 7vsvrvvevrvvrvvvvr Ree 67 Fig 35 ALPAR structur definitio scccesecscweices ccceetecticcsnned adecctexsueriualdneacedstevieetousdadee ctinxdaslbanes eni iniiai 70 Fig 36 ALPAR Header definition crete cinacicentesasecdcecendscncesicedecacidaninnaaceeseadsesendaqunedcadainecsdaataad dacscbenndactenaricidantund lecddaceede 70 Fig 37 CT Command aborts other commandS rrrrnnnrrrrnnnrerrnnnrrvrnnnerrnnnrennnnrrnrnnsrernnnerennnnsrennnsnernnnsrennnnseennnsnsnennnnn 71 Fig 38 CTLess command aborts a CT command cccccccseeceeeeeeeeeeeeeeeeseeeeesseeeeeseeeeeeseeeeeeaeeeesaaeeeeseeeeesseeeeesagaes 71 Fig 39 CT Command can be aborted by another CT command rrrrnnnnrnrnnnrnnrnnnrnvnnnnenrnnnrnnrnsnennnnrennnnrrrnnnsnennnnere 72 Fig 40 InJumpForDEP Active communication mode DID used rrrrnnrrnnnnnnnnnnnnnnennnrennnrrnnnerennnrennnnennnensnsrennnne 82 continued gt gt UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 172 0f 175 NXP Semiconductors UMO0801 03 PN533 User Manual Fig41 InJumpForDEP Passive Communication Mode DID not used rrrrrnnnrnnnnnrrnnnnrrrnnnnrrnrrnnerenrnnrrenrnsnennnnn 84 Fig 42 InDataExchange General context cc ceccecceeeeeeeeeeeeeeeeeeesaeeeeeseeeeeeseeeeesaeeeeesaeseeeseeeessaeeeeseeeeeesseeeeeeas 101 Fig 43 InDataExchange Different target types rrrrrrrrnnnrrrrnnnrrrrnnrrrrnnnrenrnnnrrnrnnrernnnnnenn
55. 8029 e WakeUpSlave line is used to wake up the TDA8029 It has to be connected between INT1 pin 30 of the TDA8029 and P31 pin 29 of the PN533 e Slavel2CMute line is used by the TDA8029 to indicate to the host controller either that it is ready to receive a command frame or to send the corresponding answer or to signal a hardware event It has to be connected between pin 24 of the TDA8029 and P33 pin 31 of the PN533 e Shut down line is used for entering in the TDA8029 shut down mode This mode is set when the TDA8029 SDWN_N pin is set to 0 The only way to leave shut down mode is when pin SDWN_N is set to 1 Shutdown P30 lt gt SDWN_N WakeUpI2C P31 lt gt INT 1 VCC SDA P26 PNS533 TDA8029 pe P17 GND Slavel2CMute P33 lt gt P27 Fig 13 PN533 and TDA connection One command is defined to access to the TDA8029 through the PN533 Refer to AlparCommandForTDA command 88 3 p 70 The I2C transactions use the ALPAR protocol described in 6 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 33 of 175 NXP Semiconductors UMO0801 03 UM0801 03 l 7 1 1 7 1 1 1 PN533 User Manual Host controller communication protocol Frames structure Communication between the host controller and the PN533 is performed through frames in a half duplex mode Four different types of frames are used in one or both directions h
56. Bytes must follow the TgInitAsTarget as described in the following figure Fig 60 The PN533 does not send ATR_RES before the command TgSetGeneralBytes Then the PN533 prepares the ATR_RES with the Gt bytes and sends the complete ATR_RES to the initiator NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 133 of 175 NXP Semiconductors UM0801 03 PN533 User Manual Host Controller SetParameters fAutomaticcATR RES 0 ACK ee SetParameters OK TglnitAsTarget ACK i TglnitAsTarget Active BR ATR_REQ TgSetGeneralBytes Gt ACK gt EEE a EEE Fig 60 TgSetGeneralBytes PN533 target ATR REQ ATR RES IS not sent TT ATR RES TgSetGeneralBytes OK NFC Initiator Be careful of timeout Remark The NFC initiator controls a timeout after having sent an ATR REQ see 3 so the host controller of the PN533 must take care of that meaning that if the ATR RES is not ready in time the initiator will stop the transaction with the target UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 134 of 175 NXP Semiconductors UMO0801 03 UM0801 03 8 4 17 PN533 User Manual TgGetData This command is used in case of the PN533 configured as target for Data Exchange Protocol DEP Input m e Output e Status is
57. DataOut array The protocol management chaining error handling is completely managed internally by the PN533 Host Controller NFC Initiator PN533 as a target hhh ACK TgGetData INF PDU Dataln S TO reg a TaGetbata Datan S TO Res fe Wale SEN j ACK INF PDU Dataout gel aianecure ON gt Fig 64 TgSetDataSecure The examples given in 8 4 21 p141 show how the chaining is handled either by the initiator or by the target UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 138 of 175 NXP Semiconductors UM0801 03 UM0801 03 8 4 20 PN533 User Manual TgSetMetaData This command is used in case of the PN533 configured as target for Data Exchange Protocol DEP if the overall amount of data to be sent cannot be transmitted in one frame more than 262 bytes Input e DataOut Jis an array of data from 0 up to 262 bytes to be sent by the PN533 as response to its initiator Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 Description The main difference compared to the TgSetData command see 8 4 18 p 137 is therefore that in the last chained packet sent by the PN533 to the initiator the PFB control byte will contain the More Information bit set to one NXP B V 2008 All rights reserved Use
58. ES JEWELID g 2 bytes 4 bytes 106 kbps RFA tag 16 RFAID1 SENS_RES SEL_RES RFAIDLength RFAIDLength 2 bytes 1 byte 1 byte T a bytes Syntax Error Conditions e MaxTg value is incorrect 0 or higher than 1 for the targets 106 kbps type A 106 212 424 847 kbps type B 212 424 kbps felica 106kbps Innovision Jewel and 106 kbps RFA e BrTy value is incorrect e TSN number in the InitiatorData is incorrect in passive 212 424 kbps mode different from 0x00 0x01 0x03 0x07 or 0x0F e AFI parameter missing for Type B e Incorrect command length 14 The first byte is the MSB the second one the LSB 15 The first byte of the ATS frame sent by an I18014443 4 card in response to RATS is the length of the complete ATS cf 2 Thus here the ATS structure is ATSLength xx XX2 XX3 XX4 XXATSLength 2 XXATSLength 1 16 The first byte is the MSB the second one the LSB UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 89 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual Description Depending on the baud rate and the modulation type requested the PN533 will use a MIFARE FeliCa ISO IEC14443 3B or Innovision Jewel initialization The default analog settings or those that have been modified by the host controller with the RFConfiguration command Cfgltem OxOA 0x0B OxOC 0x0D are used during the activation e if BrTy 0x00 106 kbps
59. InSelect e InDeselect e InRelease Alpar Communication e AlparcommandForTDA UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 147 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 5 2 Commands for Target mode The Fig 71 summarizes all the possible commands that can be used when the PN533 is configured as target Initialization e TginitAs Target e TgSetGeneralBytes Data Exchange e TgGetData e TgSetData e TgSetDataSecure e TgSetMetaData e TgSetMetaDataSecure e TgGetlnitiatorCommand e TgResponseTolnitiator 8 5 3 Target states summary The Fig 72 details all the possible states for the PN533 configured as target in passive communication mode UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 148 of 175 6007 Menuer tl 0 Ady jenuey 1SN GZL JO 6VL pamasa SJUBU IVY 8007 A dXN 0 LOSOWN Passive Passive Passive Passive Passive Active Not TPE 1ISO14443 4 TPE TPE Not TPE scan 106kbps 106kbps 106kbps 212 424kbps 212 424kbps a x SENS_REQ SENS_REQ me SDD REQ SDD REQ SDD REQ 1 1 SEL REQ SEL REQ SEL REQ P
60. OL REQ POL REQ II II II INITIALISATION ATR_REQ ATR_REQ ATR_REQ RATS 22002222 He EEE EE ME Me ie Soc ACTIVATION Proprietary F 1ISO14443 4 DEP_REQ DEP_REQ i Proprietary DEP_REQ 4 4 4 ATA EXCHANGE III III III Li III iit 8 Pad p Ze 2 Vad 2 Pa 7 SLP REQ 5 sLP REQ 7 S co JEG se 7 RLS_REQ 5 DSL REQ 7 RLS_REQ 5 DSL REQ 7 5 7 RLS REQ 5 DSL REQ ALL REQ ALL REQ ALL_REQ POL_REQ SEL REQ I dg 6 SEL REQ 6 ATR REQ a a k ie ATR REQ Initialisation Data Exchange SPEEL ae Start Initialized gt End Release InJumpForDEP 1 InJumpForPSL II InListPassiveTarget 1 InATR 2 InPSL 3 InDataExchange III InCommunicateThru 4 InDeselect 5 InSelect 6 InRelease 7 Fig 70 Initiator commands OD amp Activated Deselected enuen J8SN EEGNd SJOJONPUODIWIS dXN 0 LO80NN 6007 Aenuer pl 0 Ady JEnuen asf GAL JO OSL pamasa SJUBU IVY 8007 A dXN 0 LOSOWN
61. OxFF value which is normally considered as erroneous frame due to the fact that the checksum does not fit The real length is then coded in the two following bytes LENy MSByte and LEN LSByte with LENGTH LENm x 256 LEN coding the number of bytes in the data field TFI and PDO to PDn gt LCS 1 Packet Length Checksum LCS byte that satisfies the relation Lower byte of LENy LEN LCS 0x00 gt DATA LENGTH 1 bytes of Packet Data Information The first byte PDO is the Command Code The host controller for sending frame whose length is less than 255 bytes can also use this type of frame But the PN533 always uses the suitable type of frame depending on the length Normal Information Frame for frame lt 255 bytes and Extended Information Frame for frame gt 255 bytes NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 35 of 175 NXP Semiconductors UM0801 03 UM0801 03 7 1 1 3 PN533 User Manual ACK frame The specific ACK frame is used for the synchronization of the packets and also for the abort mechanism This frame may be used either from the host controller to the PN533 or from the PN533 to the host controller to indicate that the previous frame has been successfully received ACK frame 00 FF 00 FF o Postamble ACK Packet Code Start of Packet Code Preamble T Fig 16 ACK frame 7 1 1 4 NACK frame The speci
62. RF Settings information is used as initial values after power on otherwise ROM code information are used as initial values If there is one error in the EEPROM mapping ROM code information USB desc RF Settings are used as initial values after power on PN533 shall activate the USB_SoftConnect switch see Fig 12 p 32 The voltage of D will be set to 1 The host shall detect this voltage modification and it shall send a request to ask for USB device information for the enumeration phase The PN533 has to fill the IN Bulk Endpoint with its USB information The Host has to read the content of the IN Bulk Endpoint After this reading the PN533 is enumerated UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 31 of 175 NXP Semiconductors UM0801 03 PN533 User Manual USB core Fig 12 USB connection of the PN533 device Two commands are defined to Read or Write in the EEPROM e Reading data in EEPROM Refer to ReadRegister command 8 2 4 p 59 e Writing data in EEPROM Refer to WriteRegister command 8 2 5 p 61 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 32 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 6 3 12C TDA8029 In addition to I2C specification we shall use three other lines to manage Energy Saving Mode mechanism of the TDA
63. Rate to be used during the activation 0x00 106 kbps 0x01 212 kbps 0x02 424 kbps e Next indicates if the optional fields of the command PassivelnitiatorData NFCID3i and Gi are present bit 1 or not bit 0 bit 0 PassivelnitiatorData is present in the command frame bit 1 NFCID3i is present in the command frame bit2 Giis present in the command frame e PassivelnitiatorData is an array of data to be used during the initialization of the target in case of passive communication mode ActPass Depending on the Baud Rate specified the content of this field is different 106 kbps The field is optional and is present only when the host controller wants to initialize a target with a known ID In that case PassivelnitiatorData contains the ID of the target 4 bytes 212 424 kbps In that case this field is mandatory in passive communication mode and contains the complete payload information that should be used in the polling request command 5 bytes length byte is excluded as defined in 3 11 2 2 5 e NFCID3i is the NFCID3 of the initiator that is used by the PN533 within the ATR_REQ Depending on the baud rate specified and the communication mode the use of this field is different 106 212 424 kbps active mode The field is used to build the ATR_REQ frame If not present the PN533 will use a random value 106 kbps passive mode The field is used to build the ATR_REQ
64. Read 16 bytes in the RFA card Addr is the address associated with the RFA command Write 4 bytes in the RFA card A2 Data 0 3 Addr is the address associated with the RFA command Data 0 3 is an array of maximum 4 bytes containing the data to be sent to the card during a writing operation Authenticate to the RFA card A5 Act Token 0 15 Addr is the address associated with the RFA command Act Token 0 15 is the authentication code A part of RFA commands which are recognized by the PN533 are listed below 0x30 16 bytes reading OxA2 4 bytes writing OxAS5 Authentication OxA8 Test OxAB Test disable Refer to RFA card documentation to have a more detailed description of the RFA command set Examples e Read 16 bytes from the address 0x02 gt D4 38 01 04 30 02 D5 39 00 01 02 03 OD OE OF e Write 4 bytes 0x01 0x04 from the address 0x02 gt D4 38 01 02 A2 02 01 02 03 04 D5 39 00 e Run RFA test Mode gt D4 38 01 04 aA8 D5 39 00 02 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 114 of 175 NXP Semiconductors UM0801 03 UM0801 03 8 4 11 PN533 User Manual InDeselect The goal of this command is to deselect the target Tg The PN533 keeps all the information relative to this target Input e Tg is a byte containing the logical number of the relevant target 0x00 is a specific value indicating all targets Output e Status is a byt
65. SS type If a PICC is removed it indicates a Time out error If a PICC is still close to the antenna the PN533 will poll until the PICC is removed from the antenna If an error occurred during this removal procedure it indicates a collision error or transmission error All possible values of the field PAYPASS TYPE are listed below o 0x10 Transmission error reported o 0x11 Protocol error reported o 0x13 Time out error reported Syntax Error Conditions The PayPass Item parameter is missing Invalid PayPass Item parameter UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 123 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual Description e Paypass 1 1 Main loop The figure below depicts the Paypass 1 1 main loop This loop is fully compliant with Paypass ISO IEC14443 Implementation Specification 1 1 see 8 POLL FOR TYPE A amp TYPE B PICC 1 Paypass item 0x01 ACTIVATE ACTIVATE PICC PICC PICC IS PICC IS Ss _ Use InDataExchange Command to process the PROCESS PICC PROCESS PICC PICC REMOVE REMOVE PICC PICC Paypass item 0x02 PICC IS REMOVED Fig 52 Paypass v1 1 main loop Step Procedure 1 To detect PICCs that are in the Operating Field the PCD sends repeated Type A and Type B wake up commands The PCD must ensure that there is only a single PICC in the Operating Field before
66. UM0801 03 PN533 User Manual Rev 03 User Manual Document information Info Content Keywords NFC PN533 V2 7 Abstract This document describes the firmware V2 7 embedded in the PN533 founded by Philips NXP Semiconductors UMO0801 03 PN533 User Manual Revision history 01 2008 04 01 Initial version for firmware version V2 6 PN533 02 2008 07 31 Update the user manual for the firmware version V2 7 PN533 03 2009 01 14 Perform some corrections in the User Manual This UM is applicable for the firmware version V2 7 PN533 Contact information For additional information please visit http www nxp com For sales office addresses please send an email to sales addresses Qwww nxp com UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 2 of 175 NXP Semiconductors UM0801 03 UM0801 03 1 1 1 2 1 3 PN533 User Manual Introduction Purpose and Scope The PN533 is a highly integrated transmission module for contactless communication at 13 56 MHz including microcontroller functionality based on an 80C51 core with 44 Kbytes of ROM and 1232 bytes of RAM The PN533 combines a modulation and demodulation concept completely integrated for different kinds of contactless communication methods and protocols at 13 56 MHz with an easy to use firmware for the different supported modes and the USB host controller interface This document describes the firmwa
67. UMO0801 03 PN533 User Manual 12 Figures Fig 1 Mode DIPA NO sssr A mamas dateun EE EE RRE 11 Fig 2 ADN 12 Fig 3 Suspend MOG EE 13 Fig 4 me POU MOJE seene nr erg eon eemnne meg eee eter ence nen er ee ee ee et ee erate eee 14 Fig 5 WAG 19191610 RE EE EEE RE NE EN 15 Fig 6 NFO SEN 17 Fig 7 Secured DEP started by the Initiator rrrrrarnrrrnnrorrrnnnrrnrnnnrnrnnnnrnrnnnrnnrnnnrnnnnnrnnnnnsnnnnnnsnnnnnernrnnnnssnnnnnsennnnn 18 Fig 8 Secured DEP activated by the Target cccccsscccccseeecceeececcesececseseeeceuseeeseueeecseeeesseueeessueeeeseueeesseagsessages 19 Fig 9 USB Description Of ihe PN533 sassaniderna nenn nEn AAE A AAE AEE AAA EEE AEAEE AAAS 21 EE SEE EEE EEE iaaii aaie iiaa E iina ai aai 24 Fio li PEPR MANN 25 Fig 12 USB connection of the PN533 device rrrnnnarnrnrnnnrvnrnnnrnnnannrnrnnnrrnrnnnrnnrnnnrnrnnnsrnnnnnsnnnnnnsnnnnsernnnnnsnnnnrnnsennnnn 32 Fig 13 PN533 and TDA COMMECIONuaanshenasamsehenmndkaatamsmskikkehmsndndednrsenhetapbaedadedddn 33 Fig 14 Normal information frame rrrrrnnrrrrnnnrrrrnnnrrrnnnnrrrnnrrnrnnrrrnnnsrennnnsrennnnernnnnsnennnnssennnnseennnsnennnnsserennnnssennnsseennnn 34 Fig15 Extended Information F in eiaa aiai aiiiar 35 FOG FN 36 OG ANE 36 FOTO Poe 37 PIG As PRAM EEE EEE EN 37 FO POSE area E A E A 38 Fig 21 Data link level normal exchange rrrrrnnrrnnnnrrrnnrennnrrnnnnrrnnnrernnrernnrennnernnnrennnsennnrrnnsrennnnennneennnssennnnennnsennnee 39 Fi
68. XP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 26 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e 106 212 424 847kbps communication Type B This information is related with the RF Configuration command Cfgitem OCh Analog settings for the type B Byte CIU_GsNOn CIU_ModGsP CIU_RxThreshold e 212 424 847kbps communication Type A This information is related with the RF Configuration command Cfgitem ODh Analog settings for the baud rate 212 424 and 847 kbps with 1S014443 4 protocol CIU RxThreshold CIU ModWidth 212 kbps CIU_MifNFC CIU_RxThreshold CIU ModWidth 424 kbps CIU_MifNFC CIU RxThreshold CIU ModWidth 847 kbps CIU_MifNFC UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 27 of 175 NXP Semiconductors UM0801 03 UM0801 03 6 1 2 2 Fixed USB descriptor block description Device Descriptor bLength 0 1 bDeseriptor Type 2 bcdUSB gt 4 bDevice Class 5 bDevice Subclass 6 bDevice Protocol 7 bMax Packet Size 8 10 12 14 15 16 SerialNumber 17 bNumConfigurations 1 2 4 5 r 10 12 14 15 16 17 Configuration Descriptor Byes Fed se 1 btengh Jo noo 49 bDescriptor Type 1 20 wrotaltenght 2 22 bNumintertaces 1 Q a BI 23 beonfgurationvaue 1 24 iConfiguration 1 25 bmAtributes 4 26
69. a byte indicating if the process has been terminated successfully or not see 8 1 p 50 When in DEP mode Status is equal to 0x20 then the secured transaction has terminated successfully When in DEP mode this byte indicates also if NAD is used and if the transfer of data is not completed with bit More Information see 8 5 4 p 152 e Dataln is an array of data from 0 up to 262 bytes received by the PN533 coming from the initiator see 8 5 5 p 161 Description This command allows the host controller to get back the data received by the PN533 from its initiator in Dataln array The delay between a reception from its initiator and the transmission of the corresponding response elaborated by the host controller is not completely under the PN533 control the host controller may take a long time to prepare the data to be returned To bypass this potential problem the PN533 automatically generates the necessary Supervisory pdu S TO reo for DEP DEP Protocol Regarding the DEP protocol a typical data exchange between the PN533 as target anda NFC Initiator can be represented as follows Fig 61 e When the host controller wants to retrieve a command message coming from the initiator it uses the TgGetData command e n that case the PN533 sends back an ACK frame to the host controller and then waits for available data from the initiator It may take a long time before data are available Tema e As soon as
70. al interfaces Type A and Type B During the collision detection procedure the PN533 ensures that there is only one PICC in the Operating Field If the PCD receives a response from more than one PICC then the chip reports a collision to the host If there is only one PICC in the Operating Field then the PN533 activates the PICC After the PICC has been activated the PCD installs the half duplex transmission protocol When the transaction is finished the PCD waits until the PICC is removed from the Operating Field When the PICC is removed from the Operating Field the PCD reports a time out NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 125 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 4 15 TginitAsTarget The host controller uses this command to configure the PN533 as target Input MIFAREParams FeliCaParams NFCID3t 6 bytes 18 bytes 10 bytes LEN Gt Gt 0 n LEN Tk D4 8C Mode e Mode is a byte indicating which mode the PN533 should respect F 6 5 4 3 2 1 0 DEP Passive nu nu nu nu nu nu 0 no 0 no 1 yes 1 yes o PassiveOnly flag is used to configure the PN533 to accept to be initialized only in passive mode i e to refuse active communication mode o DEPOnly flag is used to configure the PN533 to accept to be initialized only as DEP target i e receiving an ATR REQ frame The PN533 can be activated either in passive or active
71. an be used as standard GPIO and is therefore not used as external interrupt trigger e P71 and P72 are used as GPIO e 10andI1 are not used UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 63 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 2 7 WriteGPIO The PN533 applies the value for each port that is validated by the host controller bit Val of each port Input COL e The field P3 contains the value to apply to the GPIO located on the P3 port Val nu P35 P34 rtu P32 rtu fu 4 3 2 1 0 7 5 e The field P7 contains the value to apply to the GPIO located on the P7 port va mu ru J na ww e72 prs 0 1 0 7 2 Output os To Description For each port that is validated bit Val 1 all the bits are applied simultaneously It is not possible for example to modify the state of the port P32 without applying a value to the ports P34 and P35 As for the command ReadGPIO see 8 2 6 p 63 the GPIO may be used with the following limitations of usage e P32 corresponds to the pin P32 INTO It can be used as standard GPIO and is therefore not used as external interrupt trigger e P34 can be used as standard GPIO e P71 and P72 are used as GPIO UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 64 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual Example The host control
72. and is present only when the host controller wants to initialize a target with a known UID In that case InitiatorData contains the UID of the card or part of it The UID must include the cascade tag CT if it is cascaded level 2 or 3 Cascade Level 1 UID1 UID2 UID3 UID4 Cascade Level 2 CT UID UID2 UID3 UID4 UID5 UID6 UID7 Cascade Level 3 CT UD UID2 UID3 CT UID4 UIDs UID6 UID7 UIDs UIDY UID10 During activation phase PN533 will negociate a maximum baud rate of 106kbps 1 During activation phase PN533 will negociate a maximum baud rate of 212kbps During activation phase PN533 will negociate a maximum baud rate of 424kbps During activation phase PN533 will negociate a maximum baud rate of 847kbps UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 87 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 106 212 424 847 kbps type B In this case InitiatorDatal is formatted as following AFI 1 byte Polling Method e AFI The AFI Application Family Identifier parameter represents the type of application targeted by the PN533 and is used to pre select the PICCs before the ATQB This field is mandatory e Polling Method This field is optional It indicates the approach to be used in the ISO IEC14443 3B initialization o If bit 0O 1 Probabilistic approach option 1 in the ISO IEC14443 3B initializ
73. ard 106 kbps Type B card e Initialization WUPB ATTRIB commands using N 1 and indicating the card is initially in HALT state e Initialization anti collision loop and Selection REQA Anti MIFARE card collision and SELECT using the UID NFCID1 field of InListPassiveTarget see 8 4 5 p87 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 117 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual Target Type RF AO tag ISO IEC14443 4 Type A compliant card ISO IEC14443 4 Type B compliant card FeliCa card Innovision Jewel tag Action e Initialization anti collision loop and selection REQA Anti collision and SELECT using the UID NFCID1 field of InListPassiveTarget see 8 4 5 p87 e Initialization anti collision loop and Selection WUPA Anti collision and SELECT using the UID NFCID1 field of InListPassiveTarget see 8 4 5 p87 of the target that has been stored during the first activation of this target e Send an RATS e Initialization WUPB ATTRIB commands using N 1 and indicating the card is initially in HALT state e Initialization and Single Device Detection POL_REQ e No action Note This command can be used in combination with InDeselect command 88 4 11 p 115 as described in the following figure When using the InDataExchange command 8 4 8 p 100 the Select Deselect sequence is done automatically NXP
74. as to set the High Byte of the address to OxFF the real address of the register is given by the low byte PN533 User Manual The list of the SFR registers accessible for the host controller is configured in the firmware The firmware gives access control to the following SFR registers Table 16 List of SFR registers Address Register 0x87 Ox9A 0x9B Ox9C Ox9D Ox9E Ox9F OxA1 OxA2 PCON RWL TWL FIFOFS FIFOFF SFF FIT FITEN FDATA Address Register OxA3 FSIZE OxA8 IENO OXAB HSU STATUS OxAC HSU CONTROL OxAD HSU PRESCALER OxAE HSU COUNTER OxBO P3 OxB8 IP OxD1 CL_COMMAND Address Register OxD7 OxE8 OxF4 OxF5 OxF7 OxF8 OxFC OxFD P5 IEN1 P7CFGA P7CFGB Pr IP1 P3CFGA P3CFGB e XRAM memory mapped registers The complete address is given by the high and low bytes of address See 4 Example The host controller reads the value OxFO in the register RX_ THRESHOLD located at address 0x6308 the value 0x55 in the EN7 register SFR located at address OxE8 and the value OxAA in EEPROM at the address 0x20 The frame from the host controller to the PN533 is 04 06 63 06 FF 8 ao 20 And the one returned by the PN533 is 05 or 0 Fo ss an NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 60 of 175 NXP Semiconductors UMO0801 03 UM0801 03 8 2 5 PN533 User Manual WriteRegister This command is used to overwrite
75. at two different levels e Inthe host controller protocol for the commands used to get or set data either in initiator or target configuration o InDataExchange O TgGetData TgSetData and TgSetMetaData e Inthe NFC Data Exchange Protocol DEP This shows that the capacity of the payload data field at DEP level is lower than the one between the host controller and the PN533 even when DID field is not used 251 bytes VS 250 That means that if the host controller uses the total capacity of the InDataExchange command the PN533 will have to handle chaining even with a target having a length reduction of 255 bytes example shown in Fig 77 Host Controller lt gt PN533 265 bytes max lt gt lt gt 262 bytes max DEP 106 kbps Transport Data Field 254 bytes max gt Re o lt 212 424 kbps 251 bytes max Fig 81 Payload data field maximum capacity UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 161 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 6 Examples of use This paragraph gives some examples of use detailing the commands used 8 6 1 PN533 acting as MIFARE PCD The following example describes a short session with a MIFARE Standard card The first step consists of initializing the MIFARE card the PN533 does not answer to the host controller as long as there is no target detected Then in the sec
76. ation o If bit 0 0 Timeslot approach option 2 in the ISO IEC14443 3B initialization o If this field is absent the timeslot approach will be used 212 424 kbps In that case this field is mandatory and contains the complete payload information that should be used in the polling request command 5 bytes length byte is excluded as defined in 3 11 2 2 5 106 kbps Innovision Jewel tag This field is not used 106 kbps RFA tag This field is not used 13 This NXP IC is licensed under Innovatron s ISO IEC 14443 Type B patent license UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 88 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual Output NbTg TargetData e NbTg is the Number of initialized Targets minimum 0 maximum 1 target e TargetData contains the information about the detected target and depends on the baud rate selected The following information is given for one target 106 kbps Type A 3 SENS RES SEL RES NFCIDLength Np ATS g 2 bytes 1 byte 1 byte E 9 ATSLength bytes 106 212 424 847 kbps Type B ATQB ATTRIB RES ATTRIB RES Tg Response Length ATTRIB RES 12 bytes 1 byte Length 212 424 kbps POL_RES 0x01 NFCID2t Pad SYST_CODE length response code optional 1 byte 8 bytes 2 bytes POL_RES 18 or 20 bytes 106 kbps Innovision Jewel tag T SENS_R
77. bMaxPower 1 PN533 User Manual NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 28 of 175 NXP Semiconductors UM0801 03 UM0801 03 Interface Descriptor bLength bDescriptor Type bNumInterfaces bAlternateSettings bNumEnapoints mE 33 bInterfaceSubClass bInterfaceProtocol OUT Endpoint Descriptor Byer Field s 36 bleh 1 37 Descriptor Type 1 38 bendooimtaddress 4 39 bmatrbutes 4 40 wmarPacketsze 2 42 bien 1 IN Endpoint Descriptor Byer ed s a foenn 4 44 bDescripior Type 1 45 bEndpoinaadress 1 bmAtibutes a wMaxPacketSize 2 binterva 4 PN533 User Manual NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 29 0f 175 NXP Semiconductors UMO0801 03 PN533 User Manual 6 1 2 3 Device ID String Descriptor description e String Descriptor Device ID Byte Field Size o blength 1 bDescriptor Type Pt 1 bString 2 Unicode encoded N string 6 1 2 4 Manufacturer ID String Descriptor description e String Descriptor Manufacturer ID Byte Field Size o blength bDeseriptor Type bString 2 Unicode encoded N string 6 1 2 5 String Descriptor 0 description String Descriptor 0 Specifying languages supported by the device Byer mild s o ble
78. baud rate the use of this field is different 106 kbps passive mode The field is used to build the ATR_REQ frame If not present the PN533 will use a random value 212 424 kbps passive mode This field is not used The NFCID3i field of the ATR_REQ is filled with the value of the NFCID2t of the target received in the POL_RES frame Refer to InJumpForDEP 8 4 3 p 80 e Gi contains the general bytes for the ATR REQ optional max 48 bytes Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 The following parameters are part of the ATR_RES sent by the target e NFCID3t 0 9 is an array of bytes containing the random identifier of the target e DIDt is the DID byte sent by the target e BSt specifies the supported send bit rate by the target e BRt specifies the supported receive bit rate of the target e TO specifies the timeout value of the target in transport protocol e PPt specifies the optional parameters of the target Length reduction NAD usable and General bytes e Gt 0 n are the optional general bytes max 47 bytes They contain general information Syntax Error Conditions e Tg and Next parameters are missing UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 95 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual Description It is assumed that the target T
79. borted by the host controller without any target activated the RF field is automatically switched off to decrease power consumption see chapter 3 1 2 7 p 16 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 92 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual Examples e In the first example the host controller requires the initialization of one target at 106 kbps type A gt D4 4A 01 00 D5 4B 01 01 04 00 08 04 92 2E 58 32 In the answer frame it is indicated that one target has been initialized with the following parameters Logical Number 01 SENS RES 04 00 SEL RES 08 NFCID1t length 04 NFCID1t content 92 2E 58 32 e In the second example the host requires the initialization of one ISO IEC14443 3B card with the default parameters AFI 0x00 gt D4 4A 01 03 00 deterministic approach gt D4 4A 01 03 00 O1 probabilistic approach D5 4B 01 01 50 01 02 03 04 00 00 00 00 00 00 00 01 01 ne G ATOB gt One target of 106 kbps type B is detected in the field and gives the following responses ATQB RES 12 50 01 02 03 04 00 00 00 00 00 00 00 ATTRIB RES length 01 ATTRIB RES 01 e Inthe third example the host controller requires the initialization of one target at 212 kbps with the POL REQ payload 00 FF FF 01 00 system code requested gt D4 4A 01 01 00 FF FF 01 00 D5 4B 01 01 14 01 01 01 06 OL 67
80. capsulated before sending back data to the host controller 212 424 847 kbits sec 00 00 00 B2 4D len cmd CRC TT Preamble Sync CRC212 42Y 847 Code 106 kbits sec CRC 2 I CRC 106 8 o S I Wy 00 00 FF LEN LCS D5 89 Status InCommand DCS 00 Command code Fig 66 TyGetInitiatorCommand 1 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 142 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual This command is complementary of the TgGetData command The main difference compared to TgGetData is that here the PN533 does not handle at all the protocol DEP features Supervisory chaining error handling As a consequence the TgGetData command may be used to carry information whatever the protocol used So this command combined with TgresponseToInitiator 8 4 23 p 144 may be used to build exchanges without using the protocol handled by the PN533 DEP The following figure depicts the linking of the exchanges between the initiator and the PN533 and between the host controller and the PN533 Host FEN Initiator Controller target AN ENE EE ER RF Packet se TgGetlnitiatorCommand Data PRE Data POST Fig 67 TgGetlnitiatorCommand 2 No control is done on t
81. cessful answer In that case the test is declared as successful NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 54 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual o In case of FeliCa card PN533 read the production ID 8 bytes of the target An InDataExchange command with parameters 04 1 byte Production ID 8 bytes is sent to the target and it is expected to receive a successful answer 05 1 byte Production ID 8 bytes Mode 1 byte In that case the test is declared as successful In case of no or incorrect response the Result informs about the status of the transaction refer to 88 1 p 50 Parameter Length 0 Result Length 1 Result 0x00 gt OK different from 0x00 Not OK Status byte NumTst 0x07 Self Antenna Test This test is used to check the continuity of the transmission paths of the antenna Parameter Length 1 Parameter Threshold used for antenna detection applied in register Andet Control 610C see 4 T 6 5 4 3 2 1 0 andet bot andet ithl 1 0 andet ithh 1 0 Result Length 1 Result 0x00 gt OK antenna is detected different from 0x00 not OK no antenna is detected NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 55 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 2 2 GetFirmwareVersion The PN533 sends back the
82. ck is expected 0x02 o Single pass and data are expected 0x04 o Double pass and a time out is expected 0x11 o Double pass and an Ack is expected 0x12 o Double pass and data are expected 0x14 e DataOut is an array of raw data to be sent to the target by the PN533 The total length of this array is determined by the host PN533 protocol layer max 264 bytes 88 5 5 p 161 Type 0x01 Command CMD ADR DO Dn CRC1 CRC2 Response Time out Type 0x02 Command CMD ADR DO ce Dn CRC1 CRC2 qowmm Response ACK Type 0x04 Command CMD ADR DO Dn CRC1 CRC2 Response DO pe Dn CRC1 CRC2 Type 0x11 Command CMD ADR CRC1 CRC2 DO as Dn CRC1 CRC2 Response ACK Time out Type 0x12 Command CMD ADR CRC1 CRC2 DO x Dn CRC1 CRC2 gt Response ACK ACK Type 0x14 Command CMD ADR CRC1 CRC2 DO r Dn CRC1 CRC2 n Response ACK DO a Dn CRC1 CRC2 Fig 50 description of available exchange type with InQuartetByteExchange command UM0801 03 NXP B V 2008 All righ
83. ct value of PCB or PFB e Invalid or unexpected RF received frame e NAD or DID incoherence MIFARE Authentication error Target or Initiator does not support NFC Secure I2C bus line is Busy A TDA transaction is on going ISO IEC 14443 3 UID Check byte is wrong DEP Protocol Invalid device state the system is in a state which does not allow the operation Operation not allowed in this configuration host controller interface This command is not acceptable due to the current context of the PN533 Initiator vs Target unknown target number Target not in the good state The PN533 configured as target has been released by its initiator PN533 and ISO IEC14443 3B only the ID of the card does not match meaning that the expected card has been exchanged with another one PN533 and ISO IEC14443 3B only the card previously activated has disappeared Mismatch between the NFCID3 initiator and the NFCID3 target in DEP 212 424 kbps passive An over current event has been detected NAD missing in DEP frame Error code 0x10 0x12 0x13 0x14 0x18 0x19 0x23 0x25 0x26 0x27 0x29 0x2A 0x2B 0x2C 0x2D 0x2E NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 51 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 2 Miscellaneous commands 8 2 1 Diagnose This command is designed for self diagnosis Input e NumftTst Test number to be exec
84. cuts out the 262 bytes packet of data into individual packets of 60 bytes and sends these packets to the target After having received the 5 individual packet the PN533 target sends back a S TO rea RF frame to the initiator and sends the information data 262 bytes to its host controller B In this example B knows that these first 262 bytes are only a part of the complete file to transfer header information for example and then has no data to send back to A Consequently it uses TgSetData without data When the PN533 target receives this TgSetData command it can send back a DEP_RES frame to the initiator This mechanism goes on until all the data are transferred In the second example Fig 78 the initiator has a large memory area meaning that the complete file to be transferred is ready in its memory The scenario is then a little bit different the initiator maintains the MI bit in the PFB byte to 1 until the complete data are transferred The difference compared to the first example is that the PN533 target returns always the MI information to the host controller B In that case B does not need to use TgSetData as in the first example In the third and fourth examples the PN533 uses Meta Chaining functionality to allow transfer of large amount of data The Fig 79 represents the case of data to be transferred from the initiator to the target and the Fig 80 details the opposite case data to be transferr
85. ddress associated with the Jewel command o Data1 8 is an array of maximum 8 bytes containing the data to be sent to the card during a writing operation The Dataln data are formatted in the same way Data1 255 o Data1 255 is an array of maximum 255 bytes containing data read from the card The Jewel specific command byte Cmd may take one of the possible values 0x00 Read all bytes maximum 255 bytes including HR UID data LOCK and OTP bytes 0x01 Read a single byte 0x03 Read 8 bytes 0x10 Read segment RSEG 0x1A Write no Erase a single byte 0x1C Write no Erase 8 bytes 0x53 Write with Erase a single byte 0x55 Write with Erase 8 bytes 0x78 Read ID Use to read the metal mask ROM and UIDO 3 from block 0 Refer to Jewel tag documentation to have a more detailed description of the Jewel command set and on the frames structure 7 or 8 bit data and CRC Examples Read all bytes read from 0x00 to 0x79 there are 122 bytes on this tag gt D4 40 01 00 D5 41 00 01 3C CC 15 30 FF 01 01 25 OO 12 AA 00 00 00 00 01 60 00 00 OO 00 00 00 Write no Erase a single byte 55 at the address 0x02 of block 0 gt D4 40 OL 1A 02 55 D5 41 00 Write with Erase 8 bytes 0x01 0x08 from the address 0x02 of block 0 gt D4 40 OL 55 02 OL 02 03 04 05 06 07 08 D5 41 00 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 108 of 175 NXP Semiconductors UM0801 03 UM0801 0
86. e active mode UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 167 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 9 Appendix 9 1 Command set The available commands are listed below Table 29 Command set Command Page Command Code Miscellaneous Diagnose 0x00 52 GetFirmwareVersion 0x02 56 GetGeneralStatus 0x04 57 ReadRegister 0x06 59 WriteRegister 0x08 61 ReadGPIO OxOC 63 WriteGPIO 0x0E 64 SetParameters Ox12 66 AlparCommandForTDA 0x18 70 RF communication RFConfiguration 0x32 13 RFRegulationTest 0x58 79 Initiator InJumpForDEP 0X50 80 InJumpForPSL 0x46 85 InListPassiveTarget Ox4A 87 InATR 0x50 95 INPSL Ox4E 98 InDataExchange 0x40 100 InCommunicateThru 0x42 109 InQuartetByteExchange 0x38 112 InDeselect 0x44 115 InRelease 0x52 116 InSelect 0x54 117 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 168 of 175 NXP Semiconductors UM0801 03 UM0801 03 Command InActivateDeactivatePaypass Target TgInitAsTarget TgsSetGeneralBytes TgGetData TgsetData TgSetDataSecure TgSetMetaData TgSetMetaDataSecure TgGetInitiatorCommand TgResponseTolInitiator TgGetTargetstatus Command Code 0x48 Ox8C 0x92 0x86 Ox8E 0x96 0x94 0x98 0x88 0x90 Ox8A Page 120 126 133 135 137 138 139 141 142 144 146 PN533 User Manual NXP B V 2008 All rights reserv
87. e case of data to be transferred from the initiator to the target and the Fig 75 details the opposite case data to be transferred from target to initiator In the first example Fig 74 one will notice how the MI bit is used in the InDataExchange command On the other hand in the second example Fig 75 the comparative use of the InDataExchange command with no data after receiving a response of InDataExchange with MI bit set in the returned status UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 152 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual Ri PN533 ISO 144434 A INITIATOR PICC InListPassiveTarget SENS REQ SENS RES SDD SEL REQ I5014443 4 compliant RATS ATS ATR RES i InDataExchange 252 bytes MI I 1 o C A p R ACK o OK InDataExchange 252 bytes MI 1 1 x R ACK pe mn InDataExchange 196 bytes I 0 0 I 0 0 D 7 XX bytes 700bytes Fig 74 15014443 4 chaining mechanism Transfer from PCD to PICC UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 153 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual HOST Controller PN533 INITIATOR InListPassiveTarget 15014443 4 PICC SENS REQ SENS RES SDD SEL REQ 1SO14443 4 compliant
88. e content of one or several internal registers of the PN533 located either in the SFR area in external EEPROM or in the XRAM memory space Input or la rors oor non om e ADR1 ADR1 First address High and Low bytes e ADRn ADRn n address High and Low bytes Output e Status indicates if the command is accepted or not see 8 1 p 50 If Status returned is equal to 0x19 I2C bus line is busy then values corresponding of EEPROM are fixed at OxFF the others values are available for XRam or SFR e VAL1 Value read in the register located at address ADR1 e VALn Value read in the register located at address ADRn Syntax Error Conditions e Unknown SFR address Description For each address ADR the PN533 performs a reading operation in the register located either in the SFR area or in the XRAM memory space or in the external EEPROM at address ADR Then the value is returned in the VAL parameter The table below shows information which is readable by ReadRegister Command readable information 0x00 00 to 0x03 C7 XRam memory EEPROM 128 or 256 bytes OxA0 00 to OxAO FF OxAO 00 address corresponds to 0x00 of the EEPROM OxFF 80 to OxFF FF SFR 64 bytes Fig 31 ReadRegister Memory mapping NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 59 of 175 NXP Semiconductors UM0801 03 UM0801 03 e SFRregisters The host controller h
89. e indicating if the process has been terminated successfully or not see 8 1 p 50 Description If the target is unknown Tg number not attributed by the PN533 a specific error code is returned Status 0x27 If the target is already deselected no action is performed and Status OK is returned The process depends on the way that the target or the targets has or have been initialized In case of Tg equals to 0x00 this process is done for all the known targets Table 25 InDeselect RF actions Target Type Action DEP compliant target Send DSL REQ whatever the baud rate and the communication mode are 106 kbps Type A card Send HLTA 106 kbps Type B card Send HLTB MIFARE card Send HLTA ISQO IEC14443 4 compliant card Send DESELECT FeliCa card No action Innovision Jewel tag No action RFA tag Send HLTA NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 115 0f 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 4 12 InRelease The goal of this command is to release the target Tg Input e Tg is the logical number of the relevant target 0x00 is a specific value indicating all available targets Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 Description Releasing a target means that the host controller has finished the communication with the target so the PN533 erases all the informati
90. e is executed when a Paypass transaction is completed The PN533 shall deactivate the PICC After the PICC has been deactivated successfully the PCD shall poll for the PICC until it is removed from the operating field DS 49 Status PAYPASS Type e Status is a byte indicating if the process has been terminated successfully or not see 88 1 p 50 e PAYPASS type If a PICC is removed it indicates a Time out error If a PICC is still close to the antenna the PN533 will poll until the PICC is removed from the antenna lf an error occurred during this removal procedure it indicates a collision error or transmission error All possible values of the field PAYPASS TYPE are listed below o 0x10 Transmission error reported o 0x11 Protocol error reported o 0x13 Time out error reported UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 121 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e Paypass Item 0x03 Polling Anti Collision Activation for EMVCo 2 0 This Paypass Item is used to poll a PICC when we have to be compliant with the EMVCo specification version 2 0 The firmware will execute several procedures polling collision detection and PICC activation D5 49 Status PAYPASS Type PICCData e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 e PAYPASS type If a PICC was found it indicates
91. e total information relative to the target number Tg The reception of the ATR_RES is done under conditions of timeout This timeout value is defined in the SetParameters command 8 2 8 p 66 If no valid ATR RES is received MxRtyATR attempts the PN533 returns in the Status byte an error code The PN533 waits for this ATR RES coming from the target a maximum time timeout defined with the SetParameters command 8 2 8 p 66 In case of incorrect ATR RES received the PN533 sends again ATR REQ MxRtyATR times NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 96 of 175 NXP Semiconductors UM0801 03 UM0801 03 Example PN533 User Manual The InATR command may be used in a step by step process when the host controller wants to activate a target The following sequence Tg InListPassiveTarget 1 106 INATR Tg TAPSL TS ac Is equivalent to InJumpForDEP Passive 106 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 97 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 4 7 InPSL This command is used by a host controller to change the defined bit rates either with a TPE target or with a ISO IEC14443 4 target Input ro ae w om ow e Tg is the logical number of the relevant target e BRit is the Baud Rate to be negotiated for communication from the initiator to the target 0x00 106 kbps 0x01
92. ed User Manual Rev 03 14 January 2009 169 of 175 NXP Semiconductors UM0801 03 10 Legal information 10 1 Definitions Draft The document is a draft version only The content is still under internal review and subject to formal approval which may result in modifications or additions NXP Semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall have no liability for the consequences of use of such information 10 2 Disclaimers General Information in this document is believed to be accurate and reliable However NXP Semiconductors does not give any representations or warranties expressed or implied as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information Right to make changes NXP Semiconductors reserves the right to make changes to information published in this document including without limitation specifications and product descriptions at any time and without notice This document supersedes and replaces all information supplied prior to the publication hereof Suitability for use NXP Semiconductors products are not designed authorized or warranted to be suitable for use in medical military aircraft space or life support equipment nor in applications where failure or malfunction of a NXP Semiconductors product can reasonably be expec
93. ed User Manual Rev 03 14 January 2009 126 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual Output e Mode is a byte indicating in which mode the PN533 has been activated 7 6 5 4 3 2 1 0 Baudrate NU DEP Framing Type 000 106 kbps gene 00 MIFARE 001 212 kbps 4 as 01 Active mode 010 424 kbps y 10 FeliCa e InitiatorCommand is an array containing the first valid frame received by the PN533 once the PN533 has been initialized This frame is different depending on the mode in which the PN533 has been initialized DEP passive 106 kbps or 212 424 kbps Syntax Error Conditions e LEN Gt exceeds 47 bytes e LEN Tk exceeds 48 bytes e Incorrect command length Description When this command is used by the host controller the PN533 first stores the input parameters in the dedicated area of the internal CIU and then activates the AutoColl command This AutoColl command handles FeliCa polling and MIFARE anti collision automatically UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 127 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual Thus TgInitAsTarget is ended when a complete command frame has been received from the external initiator Depending on the initialization type the 3 following scenarios are possible e 106 kbps passive BR 106 Framing MIFARE When a SENS REQ command is detected the PN533 sends back the SENS_RES contained
94. ed from target to initiator In the third example one will notice how the MI bit is used both in the InDataExchange and the TgGetData commands On the other hand in the fourth example Fig 80 the comparative use of the TgSetMetaData and TgSetData commands is shown The total Transport Frame length indicated by the target is maximum 64 bytes Thus the maximum payload data length is then 60 bytes as there are CMDO CMD1 and PFB bytes to deduct see 3 12 1 and Fig 23 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 156 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual ES INITIATOR HOST EN Controller TARGET TglnitAsTarget 700 bytes InJumpForPSL AEG ATR RES ATR RES LR 64 bytes InDataExchange 262 bytes DEP REQ 1 MI TO REQ S TOJRES TgGetData DEP_RES DEP_REQ 2 Ml DEP_RES DEP_REQ 3 Ml DEP_RES DEP_REQ 4 Ml DEP_RES DEP_REQ 5 S TO REQ S TO RES 60 60 603 604 225 262 bytes TgSetData no data DEP_RES OK InDataExchange 262 bytes DEP REQ 1 MI Mener OK TgGetData DEP_RES DEP_REQ 2 Ml DEP_RES DEP_REQ 3 Ml DEP_RES DEP_REQ 4 Ml DEP_RES DEP_REQ 5 S TOJREQ S TOJRES bytes TgSetData no data
95. en Cmd Data o Len is the length of the total DataOut buffer o Cmd is the FeliCa specific command byte o Data is an optional array of data bytes depending on the command used After having sent the command frame the PN533 waits for a reply from the card and sends back the received frame to the host controller in Dataln A mute target can be detected by using a timeout mechanism after the transmitted frame default value is 102 4 ms The configuration of this timeout is done with the RFConfiguration command 88 4 1 p 73 Cfgltem 0x02 fRetryTimeout and 0x04 MaxRtyCOM Examples It is assumed in this example that the logical number attributed by the PN533 to the card is 0x01 The card does an echo of the received frame gt D4 40 01 06 FO 00 FF 11 22 D5 41 00 06 FO 00 FF 11 22 The value of the status byte is 0x00 indicating that the RF exchange is correct HOST PN533 FeliCa Controller Initiator card InListPassiveTarget MaxTg 1 Baud Rate 212 kbps lt POL REQ ACK EG POL_RES InListPassiveTarget Target number 1 Target infa InDataExchange 1 06 FO 00 FF 1122 _ __eer OQOCOCOCOCC lt ACK FeliCa Frame 06 FO 00 FF 11 22 TimeOut control lt FeliCa Frame 06 FO 00 FF 11 22 InDataExchange OK 06 FO 00 FF 11 22 Fig 45 InDataExchange Example of a FeliCa exchange gt D4 40
96. ending its Public key with InDataExchange command See 8 4 8 p 100 Bits 7 5 of the Tg field are set to 001 The T Host is informed that the communication has to be secured because the returned status of the GetData response See 8 4 17 p 135 is equal to 0x20 See Table 15 p 50 3 The T Host replies with a SetDataSecure command with contained its Public Key The I Host receives the T Host Public Key within the InDataExchange response And the returned status of this command is equal to 0x20 if the RF communication was successful Table 7 Sequence of secured DEP started by Target In this case the I Host starts a basic Data Exchange Protocol but the T Host requests for a secure communication The T Host activates this secure channel by sending its Public key with SetDataSecure command See 8 4 19 p 138 The I Host is informed that the communication has to be secured because the returned status of the InDataExchange response See 8 4 8 p 100 is equal to 0x20 See Table 15 p 50 The T Host receives the I Host Public Key within the TgGetData response And the returned status of this command is equal to 0x20 if the RF communication was successful Afterwards the target will send the encrypted data to the Initiator in secure mode Remark 1 If the InDataExchange command is used with the 5 bit of Tg field equal to 1 or SetDataSecure command is used or SetMetaDataSecure command is u
97. ent with a timeout control whose value depends on the Time Slot Number TSN chosen by the host controller in the InitiatorData field TOvalue Td TSN 1 x Ts TOvalue 512 x 64 fc TSN 1 x 256 x 64 fc TOvalue 2 42 ms TSN 1 x 1 21 ms This process is done MxRtyPassiveActivation times 8 4 1 p 73 Cfgltem 5 if no answer is detected the command is terminated and the field NbTg in the output buffer contains 0x00 meaning that no target has been detected with the number of allowed trials When one or several targets have answered to the polling request command the PN533 checks the coherence of the answer s o The command byte in the polling response has to be equal to 1 Value of Param2 Parameter of ATTRIB command will depend on BrTy value UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 91 of 175 NXP Semiconductors UM0801 03 UM0801 03 O PN533 User Manual The PN533 has to receive 18 bytes or 20 bytes of polling response frame The response frame length depends on POL REQ type and Card model All the targets that do not satisfy these conditions are rejected If the POL RES is correct the PN533 attributes a logical number for the current target This logical number will then be used by the host controller in all the target related commands InDataExchange InATR InPSL InSelect to identify the target The first target found when executin
98. er down with RF level detector not activated 3 1 1 3 Power modes for the TDA8029 Table 5 Power modes for the TDA8029 Power Mode Description Hard Power Down The TDA80209 is in reset state Shutdown The CPU of the TDA8029 is set in powerdown mode Normal The TDA8029 is running NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 10 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 3 1 2 Operating modes of the PN533 3 1 2 1 Mode dispatcher The firmware adapts the overall power consumption to the real needs depending on the state where it is Several cases have to be considered the power modes involved being different e Standby mode e Initiator PCD mode e Target mode The transition between the three defined modes is automatically done by the firmware either due to a change in the internal state machine PN533 acting as target has been released for example or by the reception of a command from the host controller 4 Standby Mode gt Y Process the command ReadRegister WriteRegister etc A PCD Initiator N as N Y Y Y v y v Initiator PCD Target Suspend Mode Mode Mode Fig 1 Mode Dispatcher UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 11 0f 175 NXP Semiconductors UMO0801 03 UM0801 03 3 1 2 2
99. er on top of NFCIP 1 interface and protocol The NFC Secure layer protects the communication on the RF interface against eavesdropping and data modification at the NFCIP 1 message level by cryptographic methods The protocol can be activated either by the Initiator or by the Target This layer is implemented on the application level The PN533 provides only a pipe of exchange all the cryptographic methods are implemented on the application layer During a secured DEP the upper 3 bits of the NFCIP 1 Data Exchange Protocol PFB byte shall be set to 001 The remaining bits of the PFB byte shall be identical to the ones used in a normal Data Exchange Protocol Request and they are used in the same way NFC Secure Frame SB LEN DEP header Payload Data E1 VW DEP Header CMD 0 CMD 1 PFB DID NAD VW PFB 0 0 X Fig 6 NFC Secure frame NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 17 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual Two examples of Secret Channel establishment activated either by the Initiator or by the Target are shown below Acknowledge are not shown on these figures Host requests for a secure Data Exchange Req GetData Req exchange bit 5 of Tg is set to 1 DEP Reaq SSE EST REQ Bits 7 5 of PFB set to 001 I Host shares
100. es with one of the NFC Standards ISO IEC 18 092 ISO IEC21 481 does not convey an implied license under any patent right on that standards A license for the portfolio of the NFC Standards patents of NXP B V needs to be obtained at Via Licensing the pool agent of the NFC Patent Pool e mail info Qvialicensing com UM0801 03 NXP B V 2008 All rights reserved 5 of 175 User Manual Rev 03 14 January 2009 NXP Semiconductors UM0801 03 PN533 User Manual 1 5 General presentation of the PN533 e The embedded firmware and the internal hardware support the handling of the host controller protocol for USB interface The host controller protocol is defined in chapter 7 p 34 The firmware of the PN533 supports the following operating modes e PCD mode for FeliCa 212 kbps amp 424 kbps ISO IEC14443 Type A amp B from 106 kbps to 847 kbps MIFARE 106 kbps RFA cards 106 kbps and Innovision Jewel cards 106 kbps e NFC IP 1 with NFC Secure compliancy mode The NFC IP 1 mode offers different baud rates from 106 kbps up to 424 kbps The PN533 handles the complete NFC framing and error detection e The PN533 manages an I2C master interface The PN533 is configured as master and is able to communicate with external EEPROM address OxA0 and a smart card reader TDA8029 e PN533 in PCD mode is compliant with Paypass specification V1 1 and EMV contactless specification V2 0 In this document e PN533 refe
101. esponseTolnitiator 2 cccccccccccccsscecceesccccesececseueeeceesceeceececseueesseueeessueeesseueeesseueeessassesssssuesesseneeseas 145 ge commands EE EE NER NE NE area ee 149 FROL T MME Deer 150 FOT TEMA ser dl Jaatte 151 Fig 73 Legend used for the figures describing the IS014443 4 chaining of data rrrrrnrrrnrnnrrrrnnnrrnnnnnrrenrnnnnen 152 Fig 74 15014443 4 chaining mechanism Transfer from PCD to PICG rrrnrrrrrnnrrvvnnnrrvnrnnrrerrnnrrrnrnsrennnnerenrnnsnen 153 Fig 75 15014443 4 chaining mechanism Transfer from PICC to PCD rrnnnrrnrnnnrnnnnnrenrnnnrenrnnrrnnnnsrenrnnsrennnnsnen 154 Fig 76 Legend used for the figures describing the Chaining of data ccccccccccseeeceseeeeeeeeeeeeeeeeeeseeeeesaeeeeesaaees 155 Fig 77 DEP chaining mechanism packets transfer ccccccccccsseceeeeeeeeeeeeeeeeseeeeesaeeeeeseeeeeeseeeeesaeeeeesaneeeeseeeseneas 157 Fig 78 DEP chaining mechanism streaming transfer from initiator to target rrrnnrrrrnnnnrrrnnnrrrrnrrrvnnnrrnrnnnnen 158 Fig 79 DEP chaining mechanism transfer with Meta Chaining Initiator CaSe rrrrrarrnnrrrrrnnrrrrrnrrrrrnnrrenrnnnnen 159 Fig 80 DEP chaining mechanism transfer with Meta Chaining Target case rrrrrnrrrrrnnnrerrnnrrrnrnsrenrnnerenrnnnnnn 160 Fig 81 Payload data field maximum capaCcity rrrnnnnnnrnrnnnnrnrnnnnrrnnnnrrrnnerennnnerrnrnnnernnnsrennnnennnnerennnsnennnnsnerennnnssen 161 co
102. example shows how to make a peer to peer communication in passive mode using two PN533 ICs The three InDataExchange commands at the initiator side and TgGetData and TgSetData at the target side allow building a communication based on the NFC DEP protocol In this example the communication is established in passive mode at 212 kbps Other examples are available in 8 5 4 p 152 where the DEP chaining mechanism is considered Karl be eee er er INITIATOR TARGET initiator target IndumpForDEP 212 Passive POL_REQ ACK POL REQ TglnitAsTarget POL REQ POL_REQ gt a ACK POL_RES ATR_REQ gt lt lt ATR_RES bo y InJumpForDEP OK TgInitAsTarget OK 212 Tg 1 ATR RES Passive ATR REQ TgGetData InDataExchange Tg 1 CMD 1 D a ACK gt Ip ACK DEP REQ CMD 1 S TO rea S TO res gt TgGetData OK Data CMD 1 TgSetData Data RES 1 t DEP RES RES 1 ACK gt lt lt _ gt InDataExchange OK RES 1 TgSetData Status OK M p e m 0 m 0 p Vv Vv Fig 86 Peer to Peer communication example passive mode UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 166 of 175
103. fic NACK frame is used for the synchronization of the packets This frame is used only from the host controller to the PN533 to indicate that the previous response frame has not been successfully received then asking for the retransmission of the last response frame from the PN533 to the host controller NACK frame e Eee 00 Postamble NACK Packet Code Start of Packet Code Preamble T Fig 17 NACK frame NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 36 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 7 1 1 5 Error frame The syntax error frame is used to inform the host controller that the PN533 has detected an error at the application level Error frame 00 00 FF 01 FF 7F 81 00 Postamble Packet Data Checksum Specific Application Level Error Code Packet Length Checksum Packet Length Start of Packet Code Preamble Fig 18 Error frame 7 1 1 6 Preamble and Postamble These two specific fields of the frames are described in the previous paragraphs as single byte which the value is 0x00 In fact these fields can be composed with an undetermined number of bytes o Preamble The preamble field is composed of an undetermined number of bytes in which two consecutives bytes are not equal to 0x00 OxFF otherwise specified in host controller link commun
104. for Answer To Select Radio Frequency Activation Reserved for Future Use Single Device Detection Secure Exchange Protocol Software Requirements Specification To Be Defined Encoding method Type Length Value NFC Transport Protocol Equipped DEP Data Exchange Protocol Time Slot Number ISO IEC14443 4 protocol Unique Identifier Type A NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 4 of 175 NXP Semiconductors UM0801 03 1 4 References 1 2 3 4 ISO IEC 14443 3 ISO IEC 14443 4 ISO IEC 18092 PN533 C1 Product Datasheet PN533 User Manual Identification cards Contactless integrated circuit s cards Proximity card s Part 3 Initialization and anti collision Identification cards Contactless integrated circuit s cards Proximity card s Part 4 Transmission protocol Near Field Communication Interface and Protocol NFCIP 1 PN533 NFC Controller Product data sheet 5 AN10682 2 PN533 Application Note 6 AN010207 4 Smart Card Reader Application with TDA8029 7 NFC PRIV P2P Privacy feature for NFCIP 1 for Peer to Peer Communication 8 Paypass 1 1 Paypass ISO IEC 14443 Implementation Specification 1 1 9 EMVco 2 0 EMV Contactless Specifications for Payment Systems 2 0 10 USB 2 0 Universal Serial Bus Specification revision 2 0 11 12C 3 0 l C bus Specification revision 3 0 1 Purchase of an NXP Semiconductors IC that compli
105. frame If not present the PN533 will use a random value UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 85 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 212 424 kbps passive mode This field is not used The NFCID3i field of the ATR REQ is filled with the value of the NFCID2t of the target received in the POL RES frame Refer to InJumpForDEP 8 4 3 p 80 e Gi contains the general bytes for the ATR REQ optional max 48 bytes Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 e Tg is the logical number attributed to the activated target The target number returned within this output frame is always 0x01 only one TPE target is supported The following parameters are part of the ATR_RES sent by the target e NFCID3t 0 9 is an array of bytes containing the random identifier of the target e DIDt is the DID byte sent by the target e BSt specifies the supported send bit rate by the target e BRt specifies the supported receive bit rate of the target e TO specifies the timeout value of the target in transport protocol e PPt specifies the optional parameters of the target Length reduction NAD usable and General bytes e Gt 0 n are the optional general bytes They contain general information Syntax Error Conditions e Incorrect Baud Rate BR e Incorrect ActPass parameter e
106. g 22 Data link level error from the host controller to the PN533 The following errors are considered by the PN533 as data link level errors e LCS error e DCS error UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 40 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual c Error at data link level from the PN533 to the host controller When the host controller detects an error in the response packet erroneous frame or no response it uses a NACK frame to ask for the PN533 to send again the last response frame Host Controller PN533 ee EE Pastel NACK __ Response rat gt Fig 23 Data link level error from the PN533 to the host controller d Abort The host controller may send an ACK frame to force the PN533 to abort the current process In that case the PN533 discontinues the last processing and does not answer anything to the host controller Then the PN533 starts again waiting for a new command Host Controller O x l y SS8001q Fig 24 Data link level Host controller aborts the current command UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 41 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 71 22 Application level a Successive exchanges The host controller sends a new command after hav
107. g 22 Data link level error from the host controller to the PN533 rrrnrrrnrnnnrnnnnnnrnnnnnrrnnnnnrrrnnrennnnerenrnnerenrnsnennnnnnn 40 Fig 23 Data link level error from the PN533 to the host controller rrrrrnnrrrrrnnrrrrnnnrrnrnnrrrrnnnrerrnnerennnnrrenrnsnrennnnn 41 Fig 24 Data link level Host controller aborts the current command rrnrannnnrnrnnnennnnennnnrnvnrennnrennnrennnrrnnnsrennnnennnnne 41 Fig 25 Application level SUCCESSIVE EXCNANGES ccccecccccseeeeeceeeeeeeeeeeeseeeeeeaeeeeesseeeeeseeeesaaeeesaeeeesaeeeesssaaeeeesaass 42 Fig 26 Datalink level de 43 Fig 27 Application level Abort a command and process a NEW On rrrarrrnnrrnnrrranernerrnarrranernrnnarrnnennnennaennnnennnennn 44 Fig 28 Application level Error detected cccccccccecccsecceeecececseeceueeccecuecaeecseeseueesaeesseessueesaeesseessseeesseesageeseeens 45 Fig29 VENNE sesi R ER e eee E ER 46 Fig 30 USB link general principle of communication rrrrnrnnnrnrnnnnerrnnnrenrnnnrrrnnnnerrnnrennnnrrrnnnsnernnnrennnnerennnnnssennnne 46 Fig 31 ReadRegister Memory mapping rrnrernanervnnnvvnenvnnnnernnnnnnnnennnnennnnsnvnnnnnnnnennnnennnnsnnnnnennnnennnnennnnsnnnnsssnnnnsennene 59 Fig 32 WriteRegister Memory mapping rrrrrrnrrrrnnrernnrrnnernnnnrrnnnrennnrrrnnrrrnnrennnrennnnennnrnnnsrennanennnsennnseenannsennnssennnee 61 EG NADU GU EEE A EEE EE eee 67 FIG Status Byte den L avvrvvvrrvrvrvrevevv4v4vvrvr7v4v4evr
108. g has been initialized before see command InListPassiveTarget 88 4 5 p 87 If the Tg number is unknown the PN533 informs the host controller with a specific error code Status 0x27 The Baud Rate and the modulation type defined for the target Tg in the former InListPassiveTarget Command are re used The following process is performed e the process of activation of the target is the same whatever the mode of activation or the baud rate are Set the communication settings Passive mode baud rate BR Depending of the baud rate 106 kbps send ATR_REQ constructed by means of NFCID3i and Gi at BR If the NFCID3i is not present a random value is used 212 424 kbps send ATR_REQ with the NFCID3i field filled with the value of the NFCID2t of the target received in the POL_RES frame during the initialization with 0x00 padding two last bytes Depending on the value of the internal parameter fDIDUsed set by the host controller with the SetParameters command 8 2 8 p 66 the PN533 constructs the ATR_REQ with or without a DID parameter If used the DID value is fixed by the PN533 to 0x01 If Gi is not present in the command the PN533 constructs the ATR REQ without Gi bytes Receive ATR_RES The complete ATR_RES received from the target is returned back to the host controller in the ATR RES field for further decision CMDO CMD1 OxD5 0x01 excepted The NFCID3t is stored internally in the PN533 as part of th
109. g this command will have the number Tg 1 If previous targets were initialized previously the information relative to these targets stored inside the PN533 is lost Fill the TargetData output buffer with the answer of the valid target O O 1 byte containing the logical number attributed Tg 1 byte indicating the length of the POL RES 2 IDm NFCID2t Pad SystCode gt 18 or 20 bytes 1 response code byte fixed value 0x01 8 bytes for NFCID2t IDm 8 bytes for the Pad 2 possible bytes for the System Code of the target when the polling response frame is 20 bytes long The real number of initialized target is indicated to the host controller in the NbTg field 0 lt NbTg lt MaxTg e If BrTy 0x04 106 kbps Innovision Jewel tag As long as there is no target detected maximum 1 target O Probe the field for targets using the ATQA REQ command with timeout control of 5 ms If one target has been detected with the previous command read the identification of the Jewel tag using the RID command If the reading of identification is successful the PN533 attributes the logical number 1 for the current target This logical number will then be used by the host controller in all the target related commands InDataExchange InSelect to identify the target Fill the TargetData output buffer with all the information relative to the target ATQA_RES RID_RES Remark If this command is a
110. gain the process POL REQ o Send an ATR REQ constructed with an overruled NFCID3i and Gi Depending on the value of the internal parameter fDIDUsed the ATR_REQ contains or not a DID parameter If used the DID value is fixed by the PN533 to 0x01 To allow selection between several targets the NFCID3i field of the ATR_REQ is filled with the value of the NFCID2t of the target received in the POL_RES The sizes of NFCID3i and NFCID2t are different so following padding is used NFCID3i 0 1 2 3 4 5 6 7 8 9 NFCID2t0 NFCID2t1 NFCID2t2 NFCID2t3 NFCID2t4 NECID2t NECID2te NECID2t7 0x00 0x00 padding padding Receive ATR RES In case of success no timeout the target is Transport Protocol Equipped In that case the NFCID3t is memorized in the PN533 and the ATR RES is sent back to the host controller CMDO CMD1 0xD5 0x01 excepted The PN533 waits for this ATR RES coming from the target a maximum time timeout defined with the SetParameters command 8 2 8 p 66 Twice ATR REQ are sent by PN533 in case of incorrect ATR RES received The MxRtyATR parameter from the RFConfiguration command 88 4 1 p 73 is not take into account If correct ATR RES is received then the PN533 stores the NFCID3t and attributes a logical number for this new target Tg The target number returned within this output frame is always 0x01 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January
111. gh Speed UART Consequently in this mode the PN533 must be interconnected with P30 pin 24 for the RS232 RX line and P31 pin 31 for the RS232 TX line UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 7 of 175 NXP Semiconductors UM0801 03 UM0801 03 2 3 PN533 User Manual RFfieldON Mode In this mode the PN533 is configured to switch on its RF field immediately after the reset The modulation and the baud rate used depend on the selection GPIOs P33_INT1 and P34 SIC CLK and random data bytes are continuously sent In this mode the temperature sensor is not activated so that tests can be done at temperature higher than 125 C Table 2 TX framing and TX speed in RFfieldON configuration Selection Pins TX framing TX speed P33_INT1 P34 SIC_CLK pin 33 pin 34 1 1 MIFARE 106 kbps 0 0 FeliCa 212 kbps 0 1 FeliCa 424 kbps 1 0 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 8 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 3 Power management The design of the firmware embedded in the PN533 takes care of power consumption in a sense that it minimizes the overall power consumption This chapter defines the strategy used to save current consumption The firmware can play with different parameters described hereafter e Power modes of the CPU e Power modes of the CL front end e Management of
112. gnose X X 0x00 52 GetFirmwareVersion X X 0x02 56 GetGeneralStatus X X 0x04 57 ReadRegister X X 0x06 59 WriteRegister X X 0x08 61 ReadGPIO X X Ox0C 63 WriteGPIO X X UXUE 64 SetParameters X X ol 66 AlparCommandForTDA X X 0x18 70 The frame representation does not include the complete frame but only the following field e TFI e Command Code e When needed the input or output data Thus the Preamble Start of Packet LEN LCS DCS and Postamble are omitted in this description NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 48 of 175 NXP Semiconductors UM0801 03 PN533 User Manual PN533 PN533 Command Page Command as Initiator as Target Code RF communication RFConfiguration X X 0x32 13 RFRegulationTest X X 0x58 19 Initiator InJumpForDEP X 0x56 80 InJumpForPSL X 0x46 85 InListPassiveTarget X Ox4A 87 InATR X 0x50 95 InPSL X Ox4E 98 InDataExchange X 0x40 100 InCommunicateThru X 0x42 109 InQuartetByteExchange X 0x33 112 InDeselect X 0x44 115 InRelease X 0x52 116 InSelect X 0x54 117 InActivateDeactivatePaypass X 0x48 120 Target TgInitAsTarget X Ox8C 126 TgSetGeneralBytes X 0x92 133 TgGetData X 0x86 135 TgSetData X Ox8E 137 TgSetDataSecure X 0x96 138 TgSetMetaData X 0x94 139 TdSetMetaDataSecure X 0x98 141 TgGetInitiatorCommand X 0x88 142 TgResponseToInitiator X 0x90 144 TgGetTargetStatus X Ox8A 146 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 1
113. he delay treact used by the initiator to send its command frame The host controller has to manage timeout by itself it can stop the current TgGetInitiatorCommand command by using one of the two dedicated ways of stopping ACK frame or new command frame UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 143 of 175 NXP Semiconductors UMO0801 03 8 4 23 UM0801 03 PN533 User Manual TgResponseTolnitiator This command is used to send a response packet of data to an initiator Input e TgResponse is an array of raw data from 0 up to 262 bytes to be sent by the PN533 response to the initiator Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 Description This command is usually used in co operation with TgGet InitiatorCommand 88 4 21 p 141 The received data from the host controller TgResponse array are simply encapsulated in the RF frame which format depends on the mode and the RF baud rate used 00 00 FF LEN LCS D4 90 TgResponse DCS 00 Command A code CO r 106kbits sec CRC S CRC 106 q x N Jj N 212 424 847 kbits sec 00 ii 00 00 B2 4D len cmd CRC i Sync CRC212 424 847 Preamble Code Fig 68 TgResponseTolnitiator 1 This command is comp
114. host controller HOST Target Controller PNa33 212kbps InJumpForDEP ActPass Active Baud Rate 212bps NFCID3i Gi lt ACK ATR REQ DIDi J lt ATR_ RES DIDt DIDi InJumpForDEP Target number 1 ATR RES Fig 40 InJumpForDEP Active communication mode DID used NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 82 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual PASSIVE MODE Do Initial RFCA IfBR 106 kbps o Select one target SENS REQ SDD REQ SEL REQ o If no Transport Protocol Equipped TPE target is detected try again the process SENS _ REQ The absence of target is detected with a 5 ms timeout value o Store the NFCID1t for further use o Send an ATR REQ constructed with NFCID3i and Gi Depending on the value of the internal parameter fDIDUsed the ATR REQ contains or not a DID parameter If used the DID value is fixed by the PN533 to 0x01 Else if BR 212 424 or 847 kbps o Process atime slot SDD send a POL_REQ with a PassivelnitiatorData given by the host controller This POL REQ command is sent under a timeout control which value depends on the Time Slot Number see InListPassiveTarget 8 4 5 p 87 f a correct POL RES answer is received then store the NFCID2t for further use f no valid POL RES is received in due time try a
115. icATR RES By default the PN533 target sends back to the initiator the ATR_RES after having received an ATR_REQ For various reasons the host controller of the PN533 may want to choose the content of the Gt general bytes of the target only after having received the general bytes of the initiator In that case the host controller must set this flag to 0 To have a detailed description of these two possibilities see the commands TgSetGeneralBytes see 8 4 16 p 133 and TgInitAsTarget see 8 4 14 p 120 fTDApowered When the flag fTDApowered is set to one the PN533 shall wake up the TDA8029 The PN533 set the SHUTDOWN pin of the TDA to one When the flag fTDApowered is set to zero the PN533 shall shutdown the TDA8029 The PN533 set the SHUTDOWN pin of the TDA to zero Refer to I2C TDA8029 see 6 3 p 33 to have more details on this functionality fAutomaticRATS When executing the command InListPassiveTarget at 106 kbps the PN533 may initialize cards supporting ISO IEC14443 4 protocol the PN533 knows that the target is ISO IEC14443 4 compliant by analyzing the SEL RES SAK byte In that case and if the flag fAutomaticRATS is set the first command sent to the card is a RATS command This command is automatically elaborated by the PN533 If the user does not want to use the ISO IEC14443 4 protocol with a card that is ISO IEC 14443 4 compliant this flag must be set to 0 NXP B V 2008 All rights reserved
116. ically calculated and added by the PN533 00 OO FF LEN LCS D4 42 DataOuf DCS 00 Command 2 code D 3 ww 106kbits sec CRC A CRC106 2 N amp A Ni N i N 212 424 847 kbits sec 00 00 00 B2 4D len cmd CRC Preamble Sync CRC 212 424 847 Code Fig 47 InCommunicateThru 1 e Receive the data coming from the target in accordance with the current baud rate in use and de encapsulate them Dataln The received CRC is checked but does not appear in Dataln 212 424 847kbits sec 00 i 00 00 B2 4D len cmd CRC TT Sync 2 CRC 212 424 847 Preamble Code 2 NR amp wr I Q N 106 kbits sec CRC CRC 106 8 M 8 00 00 FF LEN LCS D5 43 Status Datalnf DCS 00 Command code Fig 48 InCommunicateThru 2 NXP B V 2008 All rights reserved UM0801 03 User Manual Rev 03 14 January 2009 110 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual The following figure depicts the complete exchange of data between the host controller and the target In that case the PN533 acts only as RF transceiver between the host controller and the selected target Host PN533 Taraet Controller as an initiator g
117. ication details see 7 1 3 p 46 The PN533 uses this synchronization pattern 0x00 OxFF to detect the beginning of a frame all the previous data are ignored XX XX XX XX XX XX XX XX 00 FF LEN Packet Length Start of Packet Code Preamble Fig 19 Preamble UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 37 of 175 NXP Semiconductors UMO0801 03 UM0801 03 O PN533 User Manual Postamble The postamble field is composed of an undetermined number of bytes in which two consecutives bytes are not equal to 0x00 OxFF otherwise specified in host controller link communication details see 7 1 3 p 46 The PN533 receives and analyses the frame until the DCS byte After this checksum byte the common synchronization pattern detection starts again Thus all the data comprised between the DCS byte and the next synchronization pattern 0x00 OxFF is ignored PDn DCS xx XX XX XX XX XX XX XX Postamble Packet Data Checksum Packet Data Fig 20 Postamble O Frames sent by the PN533 Concerning the frames sent by the PN533 to the host controller both the preamble and the postamble are constituted of only one 0x00 byte Examples All the following frames are the same for the PN533 s point of view GetFirmwareVersion
118. in HALT state o If one of several target s have been detected with the previous command handle the anti collision using of REQB command if the probabilistic approach is used 1S0144443 3B option 1 SLOT MARKER command in the timeslot approach ISO IEC14443 3B option 2 and then select one target ATTRIB command o If the selection is successful the PN533 attributes a logical number for the current target This logical number will then be used by the host controller in all the target related commands InDataExchange InATR InPSL InSelect to identify the target The first target found when executing this command will have the number Tg 1 The information relative to previously initialized targets stored inside the PN533 is lost o Fill the TargetData output buffer with all the information relative to the target Tg ATQB RES length of the ATTRIB RES and the ATTRIB RES The real number of initialized target is indicated to the host controller in the NbTg field 0 lt NbTg lt MaxTg The latest target initialized remains active and is not put in HALT state Thus the host controller is able to exchange data with this target more quickly e if BR 0x01 or 0x02 212 kbps or 424 kbps As long as there is no target detected with a maximum number MxRtyPassiveActivation of retries process a time slot SDD send a POL_REQ with the PolReqPayload information given by the host controller This command is s
119. in MIFAREParams Then the PN533 uses the NFCID1t part of MIFAREParams during the anti collision process At the end of the selection the PN533 sends the SEL RES to the initiator Then the PN533 waits for a command coming from the initiator that closes the AutoColl internal command This command may be an ATR_REQ a SLP_REQ or a proprietary command o ATR REG if the flag fAutomaticATR_RES is set 8 2 8 p 66 the PN533 sends back automatically the ATR_RES frame to the initiator example in Fig 54 Otherwise the ATR_RES will be sent back to the initiator only after having received a TgSetGeneralBytes 8 4 16 p 133 from the host controller The complete ATR_REQ is returned to the host controller Host PN533 NFC Controller target Initiator TglnitAsTarget De ACK A SENS_REQ L SENS RES SDD_REQ Gu SDD RES SEL RES ATR REQ ATR RES TginitAsTarget ET Passive 106 DEP ATR REG Fig 54 TglnitAsTarget Passive DEP 106 kbps UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 128 of 175 NXP Semiconductors UM0801 03 O PN533 User Manual SLP REG the PN533 starts again an AutoColl sequence and therefore is ready to receive a new activation command TgInitAsTarget process is still running proprietary command the PN533 does nothing with this command example in Fig 55
120. in Table 14 p 48 are using this mode GE TD CLess CL B Process the command InListPassiveTarget InJumpForDEP InDataExchange Active or passive modes are not considered in this description since these are only transitional states regarding the fact that the RF field is generated or not RF field has to be cut when the command explicitly ask for the target has been released the activation command has not succeeded after the maximum attempts authorized CLess CL_D N Fig 4 Initiator PCD mode UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 14 of 175 NXP Semiconductors UMO0801 03 UM0801 03 3 1 2 5 PN533 User Manual Target Mode This mode is the one used when the PN533 is configured as target All the target commands listed in Table 14 p 48 are using this mode START gt CLess CL C Wait for being activated y CLess CL A v Process the command as been released by Initiator l CLess CL D SS Fig 5 Target mode NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 15 of 175 NXP Semiconductors UM0801 03 UM0801 03 3 1 2 6 PN533 User Manual
121. indicates MD that chaining is on going The target acknowledges this packet exchange with the DEP RES Data Exchange between the initiator and the target The initiator sends no data in the DEP REQ whereas the target sends in the DEP RES the 10 packet of data No chaining is on going Container indicating the progress of the transfer either from the initiator to the target or from the target to the initiator The more red the container is the more data it contains Stage number when filling up emptying the container Packet of 60 bytes of data that are conveyed with individual DEP REQ DEP RES exchanges The white number written inside corresponds to the packet number Packet of xx data bytes that are conveyed with individual DEP REQ DEP RES exchanges The white number y written inside corresponds to the packet number Fig 76 Legend used for the figures describing the chaining of data NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 155 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual In the first example shown Fig 77 both the initiator and the target are supposed to be a PN533 which are not using Meta Chaining The host controller of the initiator A sends packets of 262 bytes maximal capacity of the InDataExchange command see 8 4 8 p 100 The target indicates a length reduction of 64 bytes i e payload of 60 bytes The PN533 initiator
122. ing received the answer of the previous one Host Controller PN533 ENDE Ne q Response Packer oo POE ss PUBWIUWO SS8001d PUBLULUOD SS8001d Response Paet oo Fig 25 Application level Successive exchanges UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 42 of 175 UM0801 03 PN533 User Manual NXP Semiconductors b Abort The host controller can force the PN533 to abort an ingoing process thanks to two different methods 1 Abort previous command with a ACK frame The host controller may send an ACK frame to force the PN533 to abort the current process In that case the PN533 discontinues the last processing and does not answer anything to the host controller Then the PN533 starts again waiting for a new command Host Controller O x l y SS 90Jd Fig 26 Data link level Abort UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 43 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual 2 Abort previous command with a new command If the PN533 receives a command before having answered to the previous one it stops the current process and start processing the new command received It will send only the response to the last command This statement is true for all commands except the TDA commands for mo
123. ining mechanism streaming transfer from initiator to target NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 158 of 175 NXP Semiconductors UM0801 03 PN533 User Manual es EN EE en 4 INITIATOR TARGET p TglnitAsTarget 700 bytes InJumpForPSL ATR_REQ ATR_RES InDataExchange MI 262 bytes ATR_RES LR 64 bytes DEP_REQ 1 Ml S TOJREQ S TOJRES DEP RES DEP REQ 2 MI DEP RES DEP REGQ 3 Ml DEP RES DEP REQ 4 MI DEP RES OK InDataExchange MI 262 bytes OK DEP REGQ 5 MI S TOJREQ S TOJRES 60 602 603 604 240 bytes MI TgGetData DEP_RES DEP_REQ 6 MI DEP_RES DEP_REQ 7 MI DEP_RES DEP_REQ 8 Ml DEP_RES DEP_REQ 9 Ml InDataExchange 176 bytes S TOJREQ S TOJRES 605 60s 607 605 240 bytes MI TgGetData DEP_RES DEP_REQ 10 MI DEP_RES DEP_REQ 11 MI DEP_RES DEP_REQ 12 S TO REQ S TOJRES 700 bytes TgSetData no data DEP RES Fig 79 DEP chaining mechanism transfer with Meta Chaining Initiator case UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 159 of 175 NXP Semiconductors UM0801 03 PN533 User Manual Controle PN533 INITIATOR
124. iscellaneous commandS rrarrnnnrrnanevnnrnnnnn 52 8 2 1 DENE srein e ee 52 8 2 2 GetFirmwareVersiOn ccccccecccecesecceeseeececeeeeceeseeeeeseueeeeeaes 56 8 2 3 GetGeneralStatus EE 57 8 2 4 ReadRegister si cdsdetcsattssnenmmatccinad cobsueniacntdes dassueemanedcatiarmaenieded 59 8 2 5 JE CGIS GF EE 61 8 2 6 R eadGPIO ssa car ceases seed E EE E n 63 8 2 7 GIE sd LO EE ETE E 64 8 2 8 SetParametefS ireira iE e pe EEE Ea Epaia E ne 66 8 3 AlparCommandForTDA rrrarrrrarrnvnnrernnrennnnen 70 8 4 RF Communication command rannrrnnnennnnen 73 8 4 1 RFConfiguration see 73 8 4 2 RFREGUISNONT ES Luke crud edvadanadeenvarnebicnidcnatarens 79 8 4 3 NJUNPFODEP erensia EES 80 8 4 4 InJ mpForP SL eii enere eE EE ESEE EEES Et 85 8 4 5 InListPassiveTarget ov ccsiveaicnct dena docessdnan dees cavemescazesduccsessuecaazent 87 8 4 6 MATR EE EEE 95 8 4 7 MPS RE EEE EN 98 8 4 8 InDataExchange wicciscstccotdcsacciaccctsnsccrsasdstersanndissaadernscrmmccinns 100 8 4 9 InCommunicateThru rrrnronnrrrrrnnnrrvrnnnnonnnnnnrnvnnennnnnnnnrnnnnen 109 8 4 10 InQuartetByteExchange rrrrrnnnnnnvrvrnnnnnrrrnnnnnnnrrrnnnnnnnnnneen 112 founded by Philips 8 4 11 8 4 12 8 4 13 8 4 14 8 4 15 8 4 16 8 4 17 8 4 18 8 4 19 8 4 20 8 4 21 8 4 22 8 4 23 8 4 24 8 5 8 5 1 8 5 2 8 5 3 8 5 4 8 5 5 8 6 8 6 1 8 6 2 8 6 3 8 6 4 8 6 5 8 6 6 9 1 10 10 1 10 2 10 3 10 4 10 5 11 12 13 PN533 User Manual NDESE Ear
125. iting test data checking test data and finally restore original data So this test is non destructive Parameter Length 0Q Result Length ae Result 0x00 OK OxFF Not Good NumTst 0x04 Polling Test to Target This test is for checking the percentage of failure regarding response packet receiving after polling command transmission In this test the PN533 sends a FeliCa polling command packet 128 times to target The PN533 counts the number of fails and returns the failed number to host controller This test doesn t require specific system code for target Polling is done with system code OxFF OxFF The baud rate used is either 212 kbps or 424 kbps One polling is considered as defective after no correct polling response within 4 ms During this test the analog settings used are those defined in command RFConfiguration within the item n 7 8 4 1 p 73 Parameter Length 1 Parameter 0x01 212 kbps 0x02 424 kbps Result Length 1 Result Number of fails Maximum 128 NumTst 0x05 Echo Back Test In this test the PN533 is configured in target mode The analog settings used are those defined by using the command RFConfiguration with the item n 6 8 4 1 p 73 This test is running as long as a new command is not received from the host controller The principle of this test is that the PN533 waits for a command frame coming from the initiator and after the Reply Delay
126. its Public Key GetData Res SSE EST Rea Status secure SetDataSecure DEP Res SSE EST RES Data Exchange Res Bits 7 5 of PFB set to 001 Status secure T Host shares its Public Key SSE EST Reda Status secure GetData Rea DEP Res SSE ACK REQ Bits 7 5 of PFB set to 001 Data Exchange Req Host sends the key cenfirmation Bit 5 of Tg is set to 1 message GetData Res SSE_EST Res Status secure At SetDataSecure DEP Res SSE ACK RES Data Exchange Res Bits 7 5 of PFB set to 001 Status secure gt T Host sends the key confirmation SSE ACK Rea page Status secure etData Reo DEP Rea encrypted DATA G Bits 7 5 of PFB set to 001 Data Exchange Req sy at ye the ar ponte I Host sends the encrypted data Secure bit 5 of Tg 1 GetData Res Encrypted request _ is received Status secure SetDataSecure DEP_Res encrypted DATA Data Exchange Res Bits 7 5 of PFB set to 001 Encrypted data Status secure T Host sends the encrypted data are received Status secure Fig 7 Secured DEP started by the Initiator NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 18 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual Host requests fo a non secure exchange Data Exchange Req Bit 5 of Tg is set to 0 Data Exchange Res Status secure SSE EST REQ Status secure Data Excha
127. le 115 ale eee E e EEE E 116 ge EE EEE 117 InActivateDeactivatePaypass rrrrrrnnrrnnnnnrrrnrnnrrnnnnnrrrnnnnrr 120 TglnitAsTarget nstintscsinacidisantensscaimoedesaudsatectingliveasiniescasiabetssantt 126 TgSetGeneralBytes rrrrrrnnrnnnnnnvrvnnrnnnnrrnnrrnnsnnrnnnnnnnnnnnnn 133 ToGetData end 135 TE PE 137 TG Stata Se CUS vu 138 TYSSEDAL 139 TgSetMetaDataSecure rrrrrrrnnnnnnvrnnnrnnnnrrvnnrnnsnrrnnnnnnnnsnnnn 141 TgGetlnitiatorCommand arnnnrnnnnnvvvvrnnnnnrvrvnnnnnerrrnnnnnnnnnnene 142 TYResponseTolnll tora u uvnmsssreunanimvsunzdvmedunnsske 144 TgGetTargetStatus sad mekadjendede 146 Commands Summary rrrnrrrrrnnnrvrrnnrrvrvrnnrernnnn 147 Commands for Initiator MOde rrrrrrrvrrrnnnnrrervrnrnnrrrrnnnrnnnrr 147 Commands for Target mode cccsseeeeeeeeeeeeeeeeeeeeeaaeeeees 148 Target states summary cccceecceceeeeeeeceeeeeeeaeeeeeeeeeeeeaaeees 148 Chaining MECHANISM cccccsssseeececeeeseeeeececuseeeeeeeseanaeeees 152 Comparison of the length of Payload data field 161 Examples Of USC c cccccceececeeesseeeeseeeees 162 PN533 acting as MIFARE PCD arrnnnnnnnnonnnnnrnnnnnnnnnrnnnnnnnene 162 PN533 acting as FeliCa PCD sunsets 163 PN533 acting as 106 kbps target rrrnnnnnrrrnnnnrrnnnnrrrrnnnnnnn 164 PN533 acting as 212 kbps target rrrnnnnnrrrnnnnrrnnnnerrrnnnnnnn 165 Peer to Peer example with two PN533 passive mode 166 Peer
128. lementary of the TgSetData command The main difference compared to TgSetData is that here the PN533 does not handle at all the protocol DEP features Supervisory chaining error handling This command coupled with the TgGetInitiatorCommand is the counterpart of the InCommunicateThru see 8 4 9 p 109 command from the initiator side NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 144 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual The following figure depicts how the exchanges between the initiator and the PN533 but also between the host controller and the PN533 are cascaded moet oases Initiator Controller as a target TgResponseT olnitiator Data 4 ACK RF Packet PRE Data POST gt TgResponseTolnitiator Fig 69 TgResponseTolnitiator 2 The TgResponseToInitiator command ends as soon as the RF frame is sent to the initiator If an error is detected Status byte is filled in with an error code indicating the communication error NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 145 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 8 4 24 TgGetTargetStatus This command is used by the host controller to know what the current state of the PN533 is Input Output e State gives information about the current state of the PN533 0x
129. ler wants to e set P32 e reset P34 and P35 e leave P71 and P72 unchanged The frame from the host controller to the PN533 is D4 OE 84 00 And the frame returned by the PN533 is D5 OF The host controller wants to set all the bits of P3 and P7 The frame from the host controller to the PN533 is D4 OE BF And the frame returned by the PN533 is D5 OF NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 65 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 8 2 8 SetParameters This command is used to set internal parameters of the PN533 and then to configure its behavior regarding different cases Input e Flags is a bit field byte which individual definition is the following bit 0 fNADUsed Use of the NAD information in case of initiator configuration DEP and _ ISO IEC14443 4 PCD bit 1 TDIDUsed Use of the DID information in case of initiator configuration or CID in case of ISO IEC 14443 4 PCD configuration bit 2 fAutomaticATR_RES Automatic generation of the ATR RES in case of target configuration bit 3 fTDApowered gt Allow the host to manage the power of TDA bit 4 fAutomaticRATS gt Automatic generation of the RATS in case of ISO IEC 14443 4 PCD mode bit 5 fSecure gt Enable the PN533 to support the NFC Secure layer bit 6 RFU gt Must be set to 0 bit 7 RFU gt Must be set to 0 Output Sy
130. lly or not see 8 1 p 50 Description If this target is unknown Tg number not attributed by the PN533 a specific error code is returned Status 0x27 If the target is already selected no action is performed and Status OK is returned The process depends on the way that the target has been initialized see Table 27 p 117 Table 27 InSelect RF actions Target Type Action DEP compliant target Active communication mode Wake up of the deselected target WUP_REQ whatever the baud rate is e Initialization and Single Device Detection ALL REQ SEL REQ using the NFCID1t of the target that has been stored during the initial activation of this target e Send a ATR REQ in which the NFCID3i is replaced by the DEP compliant target Passive communication mode ep NFCID3t of the target that has been stored during the initial activation of this target e Initialization and Single Device Detection POL REQ DEP compliant target e Send a ATR REQ in which the NFCID3i is replaced by the Passive communication mode NFCID2t of the target that has been stored during the initial 212 424 kbps activation of this target using padding as described in InJumpForDEP 8 4 3 p 80 e Initialization anti collision loop and Selection WUPA Anti collision and SELECT using the UID NFCID1 field of InListPassiveTarget see 8 4 5 p87 of the target that has been stored during the initial activation of this target 106 kbps Type A c
131. mmand byte e Addr is the address associated with the MIFARE command e Data 0 15 is an array of maximum 16 bytes containing either the data to be sent to the card during a writing operation or the data to be used during an authentication operation o Data 0 5 contain the 6 bytes key o Data 6 9 contain the 4 bytes serial number of the card The Dataln data are formatted in the same way Data 0 15 e Data 0 15 is an array of maximum 16 bytes containing data read from the card in case of a reading command The MIFARE specific command byte Cmd may take one of the possible values 0x60 0x61 Authentication A Authentication B 0x30 16 bytes reading OxAO 16 bytes writing OxA2 4 bytes writing OxC1 Incrementation OxCO Decrementation OxBO Transfer OxC2 Restore Refer to MIFARE cards Classic and Ultralight documentation and 5 to have a more detailed description of the MIFARE command set Examples UM0801 03 It is assumed in these examples that the logical number attributed by the PN533 to the card is 01 D4 40 01 60 02 FF FF FF FF FF FF E2 3F B8 1E Authenticate using the keys OxFF OxFF OxFF OxFF OxFF OxFF to the address 0x02 of a MIFARE Standard card whose UID number is OxE2 OX3F OxB8 Ox1E D4 40 OL 30 02 Read 16 bytes from the address 0x02 D4 40 OL AO 02 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 10 Write 16 bytes 0x01 to 0x10 from the address 0x02 NXP B V 2008 All rights reserved
132. mmediately The MSB bit CRC enable of CL TxMode and CL RxMode must be set to 1 04 00 05 00 52 82 umTst 0x06 Check Presence for DEP target Felica card ISO IEC14443 4 card and MIFARE card This test can be used by an initiator to ensure that a target card PICC is still in the field O UM0801 03 In case of DEP target an Attention Request command is sent to the target and it is expected to receive the same answer from the target In that case the test is declared as successful In case of ISO IEC14443 4 card a R NACK block is sent to the card and it is expected to receive either a R ACK block or the last I Block In that case the test is declared as successful ISO IEC 14443 4 card is still in the RF field In case of MIFARE UL card a read command is sent to the target and it is expected to receive a successful answer In that case the test is declared as successful In case of MIFARE Classic card two cases have to be considered e If PN533 is not authenticated we stored the MIFARE Classic UID Then we poll for MIFARE Classic card Once poll is done PN533 has to compare the UID discovered and UID of the remote device for which presence check is running If there is no difference between UID the test is declared as successful e If PN533 is authenticated PN533 has to know for which block number it is authenticated Then PN533 send a read command on this block number and it is expected to receive a suc
133. mode but if the PN533 receives a proprietary command frame as first command following AutoColl process it will be rejected and the PN533 returns automatically in the AutoColl state e MIFAREParamsf is the information needed to be able to be activated at 106 kbps in passive mode MIFAREParamsf is composed of o SENS RES 2 bytes LSB first as defined in ISO IEC 14443 3 o NFCID1t has a fixed length of 3 bytes containing the nfcid11 to nfcid13 bytes Indeed the PN533 can handle only NFCID1t in single size o SEL RES 1 byte typical value 0x40 for DEP e FeliCaParams contain the information to be able to respond to a polling request at 212 424 kbps in passive mode FeliCaParamsf is composed of o NFCID2t 8 bytes o PAD 8 bytes o System Code 2 bytes these two bytes are returned in the POL_RES frame if the 4 byte of the incoming POL REQ command frame is 0x01 e NFCID3t is used in the ATR RES in case of ATR_REQ received from the initiator e LEN Gt codes the number of general bytes max 47 bytes This field is mandatory When set to 0 there are no general bytes following e Gt is an array containing the general bytes to be used in the ATR RES This information is optional and the length is not fixed max 47 bytes e LEN Tk codes the number of historical bytes max 48 bytes This field is mandatory When set to 0 there are no historical bytes following UM0801 03 NXP B V 2008 All rights reserv
134. nagement chaining error handling is completely managed internally by the PN533 A typical data exchange between the PN533 as target and a NFC Initiator is represented in the TgGetData command description Host NFC PN533 Controller as a target Initiator TgGetData ACK INF_PDU Dataln S TO req lt __1uGetData batan TOs 0220 INF TgSetData OK PDU DataOut J Fig 63 TgSetData Examples given in 8 5 4 p 152 show how the chaining is handled either by the initiator or by the target NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 137 of 175 UM0801 03 PN533 User Manual NXP Semiconductors 8 4 19 TgSetDataSecure This command is used in case of the PN533 configured as target for Secret Exchange Protocol SEP The overall amount of data to be sent can be transmitted in one frame 262 bytes maximum Input e Means that the Data exchange is secured e DataOut is an array of secured data from 0 up to 262 bytes to be sent by the PN533 as response to its initiator see 8 5 5 p 161 Output e Status is a byte indicating if the process has been terminated successfully or not see 88 1 p 50 Description It allows the host controller to supply the PN533 with the data that it wants to send back to the initiator The PN533 sends in the RF link the secured data contained in
135. nge Req Bit 5 of Tg is set to 1 Data Exchange Res Status secure SSE ACK REQ Status secure Data Exchange Req Bit 5 of Tg is set to 1 Data Exchange Res Status Encrypted data are received Status secure Fig 8 Secured DEP activated by the Target Host requests for a secure GetData Req exhange GetData Res SetDataSecure DEP Req DATA Bits 7 0 of PER 10000 I Host sends the request Non encrypted request is received tatus secure DEP Res SSE EST REQ Bits 7 5 of PFB set to 001 T Host sharesits Public Key GetData Rea DEP Req SSE EST RES Bits 7 6 of PFB set to 001 l Host shares its Public Key GetData Res SSE EST Res Status secure AV SetDataSecure GetData Rea GetData Res SetDataSecure DEP Res SSE ACK REQ Bits 7 5 of PFB set to 001 T Host sends the key confirmation message DEP Req SSE ACK RES Bits 7 5 of PFB set to 001 l Host sends the key confirmation message SSE ACK Res Status secure DEP Res encrypted DATA Bits 7 5 of PFB set to 001 T Host sends the amp ncrypted data NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 19 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual Table 6 Sequence of secured DEP started by Initiator Step Deseripton O SS O In case of Secured DEP activated by the Initiator the l Host activates this secure channel by s
136. ngth bDescriptr Type Due to RAM limitation the value of N has to be defined within 0 and 30 bytes Due to RAM limitation the value of N has to be defined within 0 and 30 bytes Due to RAM limitation the value of N has to be defined within 0 and 30 bytes UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 30 of 175 NXP Semiconductors UM0801 03 PN533 User Manual 6 2 Read data in EEPROM The PN533 is able to fetch a modified USB descriptor and modified RF settings from the external EEPROM during the startup of the IC Moreover the host is able to read and write data in EEPROM through two specific commands e Sequence for fetching information during enumeration Table 13 Sequence for fetching information of EEPROM during enumeration When the PN533 is switched on it shall check if some information USB desc RF settings are contained in the EEPROM 2 During this step PN533 will look for tags 0x01 0x02 0x03 0x04 and 0x05 see 86 1 2 p 25 Once a tag is discovered the firmware will read the content of its associated block and store it in RAM If the 4 blocks corresponding to USB information tags 0x02 0x03 0x04 and 0x05 have been read correctly in EEPROM EEPROM USB information are used as initial values after power on otherwise ROM code USB information are used as initial values If the RF Settings block tag 0x01 has been read correctly in EEPROM EEPROM
137. nnnnnnennnnnnn 7 2 1 Standard Mode rarrronnornnnrnnnronrnnrnnnnnnnnnnennnnen 7 2 2 PN512 emulation MOde rrarrnnnrrnnrernnrnnnrnnanennre T 2 3 RFfieldON Mode rarmnnnnnranernnrnnnnnnanernnennnnnnunenene 8 3 Power management rannunnnnnuvnnnnnnnnnnnnvennnnuennnnnuer 9 3 1 1 Power modes of the PN533 ccccccccsssseeeeeeseeseeeeeeeeenaeees 10 3 1 2 Operating modes of the PN533 ccccceceeesseeeeeeeeeeeeeeeees 11 4 NFC Secure nnannnnnunnnnnnnnnnnnunnnnnnnnnnnnunnnunnnnunnnnunnnr 17 5 Host controller Interface rrvnnnnnnnnnnnnnnnnnnnnnnn 21 5 1 General pointS rarrrrnnrrrnarerrarrnrnnnernnnennanennnn 21 5 1 1 PNEFOGUE TOM setecceccecaevcnnagedladedeneccasndedendcdendetesapcadeasdenctzeaseedeeacdee 21 5 1 2 USB interfaca san sed 21 6 I2C master interface nannnnnnannnnnnnnnnnnnnnunnnnnnnnnnnr 24 6 1 External EEPROM mapping rorrrrorrrronrennnnnn 25 6 1 1 EEPROM data organization rrvrrrnnrrrrvrrrnnnnnrrrrvrnnnnrrrrnnnnnn 25 6 1 2 Listof EEPROM AGS 2 25 6 2 Read data in EEPROM eerurroronnonrnnnnrennnrenvannnn 31 6 3 PC TDAI are 33 7 Host controller communication protocol 34 7 1 1 Frames STUMP oriire ona aran E Ea eat 34 7 1 2 Dialog structure RE rerent 39 7 1 3 USB communication details ccccccesssseeeeeeseeaeeeeeeeeeeees 46 8 Commands supported errvnnnnnnnnnvnnnnnnnnnnnnnnnennr 48 8 1 Error handing uaans mmmminnsesnsdmmnnsivv 50 8 2 M
138. nnrrennnnrsnnnnsrennnnsnennnnnssen 102 Fig 44 InDataExchange Example of a ISO IEC14443 4 exchange rrrrranrrrrrnnrrrrnnrenrnnrrenrnnrrnnnnsrenrnnerenrnnneen 104 Fig 45 InDataExchange Example of a FeliCa exchange rrrrrrnnnrrnnnnnrnvnnnrenrnnnnnnnnnrennnnnrennnnnrnnnnsnenrnnsrenrnssennnnn 106 Fig 46 InDataExchange Example of a DEP Exchange cccccccccseeceeceeeeeeeeeeeeeaeeeeesaeeeeeseeeeesaaeeeesaeeeesaaeeeesages 107 Fig 47 InCommunicate Thru 1 ccccccssecccceeeecceececceseecseseecseeseeseececseeeessuueeesseeecsaueeessuueeessaesessesseseesseneeesas 110 Fig 48 InCommunicateThru 2 rronnnnnnnnnrrrnnnrerrnnrrrrnnnrerrnnnrernnnrrrnnnnrernnnrennnnsrennnsnernnnsrennnnsrennnnsennnnsnessnnnnseennnnssen 110 SEE au ae TMU 3 EEE EE EE EE E 111 Fig 50 description of available exchange type with InQuartetByteExchange command rrrnrnnnnnnnnnnrnnnnnnennnnnnen 112 i VEN 119 EE KE IY NOOO REE EE RE ENE EE 124 Fig 53 EMVCo v2 0 main I00p rrnnnnnnnnnnrvvnnnrerrnnnrrrrnenerrnnererrnnrrrrnnsrennnnsrennnsrennnnennnnsrennnnsrennnnseennnsnenennnnssennnnssen 125 Fig 54 TglnitAsTarget Passive DEP 106 kbps arrnnnnnnnnnnnnnnnnrnnnnrnnnnnnnnrnnnnrnvnnrnnnnrrnnnnrnnnrennrnrnnnennnnrnnnsesrnssennn 128 Fig 55 TglnitAsTarget Proprietary command rannnnnnnvnnnnvnrnnrrvnnrnvnnrernnrennnnrrvnerennnrennnrennnnsnnnsrenneennnsennnsernnrnseennn 129 Fig 56 TglnitAsTarget Passive DEP 212 42
139. ntax Error Conditions e Flags parameter is missing e Incorrect command length UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 66 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual Description fNADUsed DEP and ISO IEC14443 4 PCD In DEP mode By default the PN533 initiator does not use the NAD byte in the Transport Protocol so the host controller must set this flag in order to use NAD The NAD value itself is set by the host controller directly in the InDataExchange command see 8 4 8 p 100 On the opposite side when the PN533 configured as target is in front of an initiator using NAD byte the NAD value received by the PN533 will be transmitted to the PN533 host controller for further analysis and the NAD value to be returned to the initiator will be elaborated by the host controller of the PN533 so the NAD values are transported respectively within the TgGetData and TgSetData commands In both cases PN533 initiator or PN533 target in Fig 33 the host controller A or B knows that the payload data of the transport commands include NAD values by checking the higher bit of the status byte returned see 8 1 Error handling p 50 and Fig 34 HOST Controller HOST Controller B Q PN533 TARGET INITIATOR TglnitAsTarget ATR_REQ TgGetData Status NADi payload TgSetData NADt
140. ntinued gt gt UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 173 0f 175 NXP Semiconductors UMO0801 03 PN533 User Manual Fig 82 MIFARE PCD example Lumsk ededmaikedudkndeddeduddes d ntsnueeaadautr 162 Fig 83 FeliCa PCD example cess ccdccesscccdeceesc avevsectceicdeecbeisets odesctdeidvecdbeicets scicecdvedueet2seddecbuacds avbesteesteaddavsccduedieesdhseb lt 03 163 Fig 84 106 kbps non DEP target example ccccccccssecesssceceseecesecceseceseueeceueeseueesseeessueeseueesseeseesenseseeenseseneas 164 PIGS 212 kbps target Gx AION EEE EEE ENER RE 165 Fig 86 Peer to Peer communication example passive MOCE ccecccecseeeeeeeeeeeeeeeeeeeaeeeeeaeeeeesaaeeeeseeeeeeseeeeesaaes 166 Fig 87 Peer to Peer communication example active MOE ccccseecceceeeceeeeeeeeeeeeeeseeeeeeseeeeesaeeeeeseeeeeseeeesaness 167 continued gt gt UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 174 of 175 13 NXP Semiconductors UM0801 03 Contents 1 ITO GUC ION vasse ds tenne 3 1 1 Purpose and Scope rrrannrnnnnrnrannnnannnnnnnennannnnen 3 1 2 Intended audience rarrrarrnnnrrnnnnvnrevnnnnnnnennnennn 3 1 3 Es EE ae eee ee ee 3 1 4 References rrrrnnrrnnannnnannonnnnenranrnnannennunennansnnnn 5 1 5 General presentation of the PN533 6 2 Configuration Modes rrnnnnnnnnnnnnnnnnnnnn
141. ommunication Protocol Diagram target view 106kbps Passive Communication Mode Se ee ee Active NFC mode Mode 0 PT S EN ALL REQ REG 2 N QN NS XT ALL REQ SE Polled state POL_REQ RESOLUTION RESOLUTION A State State SDD_REQ SEL_REQ SDD_REQ SEL_REQ SELECTED SELECTED ee N E an me i ATR_REQ NG SLP REQ SLP REQ l ATR_REQ frame O I Bate 12 SLP REQ frame SLP REQ frame Recall RLU ET EE LT OL EE Lad LE LE EEE LL Baw Fru l Fru Fram 1 LIEN Lit CV ch 212 424kbps Passive Communication Mode Gh Eu EE bd ee Gi 12 ee NFCID2t ATR RES frame EE ENE SE ENE EE Transport Protocol se a ie p ATR REQ ATR REQ N 1 ATR REQ frame N pe ener men ee eee ee LE Transport Protocol Target Selected ATR RES frame Transport Protocol Target Selected PSL AER frame J J J J J J J J J Transport Protocol bt Paramete Target Selected ange ee ee ee ee ee ee ne ne ae RLS_REQ J I J DEP_REQ Transport Protocol PSL_REQ framme Parameter Selected J PSL_REQ I l RLS REQ frame I DEP REQ frame EE frir E J DEP_REQ I rh i L Hi wib Transport Protocol Parameter Selected i l l DEP_REQ frame DSL_REQ frame KG AIG Byte 0 a Het HED S 7 I psu red C Cm p DSL REQ frame Ee 7 chine moi mer g 4 SS on fom
142. on relative to it them This command is used whatever the target type and its current state initialized activated deselected is The process depends on the way that the target has been initialized In case of Tg equals to 0x00 this process is done for all the known targets Table 26 InRelease RF actions Target Type Action DEP compliant target Send RLS_REQ whatever the baud rate and the communication mode are 106 kbps Type A card Send HLTA 106 kbps Type B card Send HLTB MIFARE card Send HLTA ISO IEC14443 4 compliant card Send DESELECT FeliCa card No action Innovision Jewel tag No action RFA tag Send HLTA In all the cases DEP compliant or not the logical numbers of the released targets are freed meaning that no further data exchanges will be possible with the target s If there is no more activated target after the release of the Tg one the PN533 automatically returns in the Standby mode as defined in 3 1 2 2 p 12 meaning that the RF field is switched off and the CL frond end is put in low power mode UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 116 of 175 NXP Semiconductors UMO0801 03 UM0801 03 8 4 13 PN533 User Manual InSelect The goal of this command is to select the target Tg Input e Tg is the logical number of the target to be selected Output e Status is a byte indicating if the process has been terminated successfu
143. ond step the PN533 makes the authentication of the MIFARE card to allow reading and writing operations HOST Mifare Controller Card SENS REQ j SENS_RES SDD SEL_REQ gt lt SEL_RES InListPassiveTarget NbTarget 1 SENS RES NFCID1 SEL RES ACK Mifare Authentication Mifare Reading Dataln XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX gps Status OK Dataln Mifare Writing In DataExchange Status OK Fig 82 MIFARE PCD example UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 162 of 175 NXP Semiconductors UM0801 03 UM0801 03 8 6 2 PN533 User Manual PN533 acting as FeliCa PCD The following example describes a short session with a FeliCa card The first step consists of initializing the FeliCa card the PN533 does not answer to the host controller as long as there is no target detected In the second step the PN533 exchanges data with the FeliCa card using the InDataExchange command HOST FeliCa Controller Card InListPassiveTarget MaxTg 1 Baud Rate 212 kbps POL REQ gt lt ACK POL_REQ gt No target visible POL_REQ a No target visible POL_REQ P gt lt
144. ormation and allows generic USB status and control access Supports control transfers Logical endpoint 4 bulk out This endpoint performs transfers to supply data to the PN533 Logical endpoint 4 bulk in This endpoint performs transfers to retrieve data from the PN533 Logical endpoints 1 2 and 3 interrupt in Not used UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 21 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 5 1 2 1 Default USB descriptors USB descriptors report the attributes of an USB device They are data structures with a fixed format defined in the document Universal Serial Bus Specification The default descriptors of the PN533 are listed below Table 8 Device Descriptor Otfset Field Size Value Description 0 blengh 1 12h 18 bytes of descriptor length 1 bDescriptorlype 111 Olh Devicedescriptor bodUSB 2 0200h USB Spec 2 0 compliant ___ 4 bDeviceClass 111 00h bDeviceSubClass 111 OOH 6 bDeviceProtocol 1 00h SS 8 ddVendor 2 04CCh VendorD 14 iManufacturer 111 h 158 iProdut 111 Ohn 16 iSerialNumber 111 00h o Table 9 Configuration Descriptor Vad iss G bLength 1 09h 9 bytes of descriptor length BEONE bDescriptorType 1 02h Configuration Descriptor wTotalLength 2 0020h 39 bytes of total length 9 9 7 7 4 bNumhterfaces 1
145. ost PN533 NFC Controller target Initiator INF PDU Dataln 4 S TO req gt ee EE S TO res la ACK q CetData Datain ToSetData DataOu y la ACK INF PDU DataOut aa etpata OK gt gt Fig 62 TgGetData 2 Possible errors returned e Target is not in a correct state to perform this operation not in DEP protocol gt A specific error code is returned Status 0x25 e Target has been released gt A specific error code is returned Status 0x29 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 136 of 175 NXP Semiconductors UMO0801 03 UM0801 03 8 4 18 PN533 User Manual TgSetData This command is used in case of the PN533 configured as target for Data Exchange Protocol DEP The overall amount of data to be sent can be transmitted in one frame 262 bytes maximum Input e DataOut is an array of data from 0 up to 262 bytes to be sent by the PN533 as response to its initiator see 8 5 5 p 161 Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 Description It allows the host controller to supply the PN533 with the data that it wants to send back to the initiator in response of the previous RF DEP_REQ frame s for DEP The PN533 sends in the RF link the data contained in DataOut array The protocol ma
146. ost controller to the PN533 and PN533 to the host controller Normal information frame Information frames are used to convey e Commands from the host controller to the PN533 e And responses to these commands from the PN533 to the host controller The structure of this frame is the following 00 00 FF LEN LCS TFI PDO PDI vannene PDn DCS 00 Postamble Packet Data Checksum Packet Data Specific PN533 Frame Identifier Packet Length Checksum Packet Length Start of Packet Code Preamble Fig 14 Normal information frame gt PREAMBLE 1 byte gt START CODE 2 bytes 0x00 and OxFF gt LEN 1 byte indicating the number of bytes in the data field TFI and PDO to PDn gt LCS 1 Packet Length Checksum LCS byte that satisfies the relation Lower byte of LEN LCS 0x00 gt TEI 1 byte frame identifier the value of this byte depends on the way of the message D4h in case of a frame from the host controller to the PN533 D5h in case of a frame from the PN533 to the host controller gt DATA LEN 1 bytes of Packet Data Information The first byte PDO is the Command Code gt DCS 1 Data Checksum DCS byte that satisfies the relation Lower byte of TFI PDO PD1 PDn DCS 0x00 gt POSTAMBLE 1 byte The amount of data that can be exchanged using this frame structure is limited to
147. proximately the same than the TgSetDataSecure one see 8 4 18 p 137 except that it is used when the host controller of the target wants to transfer data which length is greater than what the PN533 can send in a single transaction This command is used during a secure exchange The main difference compared to the TgSetDataSecure command is therefore that in the last chained packet sent by the PN533 to the initiator the PFB control byte will contain the More Information bit set to one NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 141 of 175 NXP Semiconductors UM0801 03 UM0801 03 8 4 22 PN533 User Manual TgGetinitiatorCommand This command is used to get a packet of data from an initiator and to send it back to the host controller Input Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 e InCommand is an array of raw data from 0 up to 262 bytes received by the PN533 command from the initiator Description This command is used when the PN533 is configured as target see TgInitAsTarget 88 4 14 p 120 The received data are simply returned to the host controller in InCommand array that will process them and then use the TgResponseToInitiator command 8 4 23 p 144 to give the response to the initiator Depending on the mode and the baud rate used the frame received from the initiator will be de en
148. r Manual Rev 03 14 January 2009 139 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual A typical data exchange using this command is shown in the following figure Fig 65 TgSetMetaData HOST DEP Controller Initiator ATR REQ gt ATR_RES DEP_REQ Frame 4 ACK p xx xx D4 06 PFB 55 AA 55 AA 55 AA S TO req gt S TO res ee DEP RES Frame CC YH le xx xx D5 07 PFB 00 01 02 ACK gt Intermediate chaining bs gt s gt be gt lt S TO req I i S TO res TgSetmetaData OK C 7 lt DEP RES Frame ACK xx xx D5 07 PFB FD FE FF TgSetData OK NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 140 of 175 NXP Semiconductors UMO0801 03 UM0801 03 8 4 21 PN533 User Manual TgSetMetaDataSecure This command is used in case of the PN533 configured as target for Secure Exchange Protocol SEP if the overall amount of data to be sent cannot be transmitted in one frame more than 262 bytes Input e DataOut jis an array of data from 0 up to 262 bytes to be sent by the PN533 as response to its initiator Output os am ome e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 Description This command is ap
149. random value 106 kbps passive mode The field is used to build the ATR_REQ frame If not present the PN533 will use a random value UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 80 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 212 424 kbps passive mode This field is not used The NFCID3i field of the ATR REQ is filled with the value of the NFCID2t of the target received in the POL RES frame refer to process description in passive mode e Gi contains the general bytes for the ATR REQ optional max 48 bytes Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 e Tg is the logical number attributed to the activated target The target number returned within this output frame is always 0x01 only one TPE target is supported The following parameters are part of the ATR_RES sent by the target e NFCID3t 0 9 is an array of bytes containing the random identifier of the target e DIDt is the DID byte sent by the target e BSt specifies the supported send bit rate by the target e BRt specifies the supported receive bit rate of the target e TO specifies the timeout value of the target in transport protocol e PPt specifies the optional parameters of the target Length reduction NAD usable and General bytes e Gt 0 n are the optional general bytes max 47 bytes They contain general
150. re embedded in the PN533 chip in particular the global behavior in the system depending if the PN533 device is used as initiator or target Intended audience This document has been written to allow the use of the PN533 from the host controller point of view All the RF protocols used by the PN533 are not described in this document The reader is supposed to have knowledge on NFCIP 1 Reference 3 and ISO IEC 14443 Reference 1 amp 2 Glossary APDU Application Protocol Data Unit ATQA Answer To Request type A ATQB Answer To Request type B C APDU Command APDU CIU Contactless Interface Unit CL ContactLess CPU Central Processing Unit CT Cascade Tag DEP ISO IEC18092 Data Exchange Protocol DRI Bit duration of Target to Initiator DSI Bit duration of Initiator to Target E S M Energy Saving Mode FSL Maximum value for the Frame Length I2C Inter Integrated Circuit IC Integrated Circuit ID Card Identifier N A Not Applicable NAD Node ADdress NFC SEC NFC Secure N I Not Implemented NU Not Used PCB Protocol Control Byte ISO IEC 14443 4 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 3 of 175 NXP Semiconductors UM0801 03 UM0801 03 PCD PFB PPS R APDU RATS RFA RFU SDD SEP SRS TBD TLV TPE TSN T CL UID PN533 User Manual Proximity Coupling Device Contactless PCD Control Information for Transaction NFCIP 1 Protocol and Parameter Selection Response APDU Request
151. re information see 88 3 p 70 Host Controller PN533 EE OE a D DN OD a jix PUCUWUOD ssa001d Z PUBUWIUWOX SS8001d Response Paet Fig 27 Application level Abort a command and process a new one NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 44 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual c Error at application level When the PN533 detects an error at the application level it sends back the specific Syntax Error frame to the host controller see 87 1 1 5 p 37 An application level error may be due to one of the following reasons e Unknown Command Code sent by the host controller in the command frame e Unexpected frame length e Incorrect parameters in the command frame Host Controller PN533 Command Packet en Syntax Error Frame 00 00 FF 01 FF 7F 81 00 Fig 28 Application level Error detected UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 45 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual USB communication details The USB device interface of the PN533 is built around e A Control Endpoint 0 8bytes IN 8 bytes OUT e A BULK IN Endpoint 64 bytes e A BULK OUT Endpoint 64 bytes The command is sent by the system controller over the BULK OUT endpoint and the response is
152. received in the BULK IN endpoint The host polls the BULK IN after BULK OUT has been sent The frames used when communicating with the USB are exactly the same as defined in the previous paragraphs 87 1 2 BULK OUT Information COMMAND frame BULK IN Information RESPONSE frame BULK OUT ACK frame In case of communication from host to PN533 BULK IN ACK frame In case of communication from PN533 to host BULK OUT NACK frame BULK IN Error frame Fig 29 USB link frames The figure below depicts the normal scheme of communication with the USB Controller PN533 Command BULK OUT ACK BULK IN UeWUWO SS9890014 Response BULK IN ee ACK BULK OUT ee ee a aa gt Fig 30 USB link general principle of communication The PN533 has to respond to the incoming command frame within 15 ms T max Response Time delay between the command frame and the ACK frame In the case the host controller does not detect an ACK frame within these 15 ms the host controller should resend the same command frame NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 46 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual Preamble and Postamble In the way from the host controller to the PN533 both the preamble and postamble fields may have a length different from one byte 0 to n
153. ription NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 101 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual After this selection stage the PN533 takes in charge the data exchange 2 PN533 gt Target 3 Target gt PN533 1 Host Controller gt PN533 o FeliCa o DEP106 o DEP212 424 o Mifare o I5014443 4 o Jewel o FeliCa o DEP 106 o DEP 212 424 o Mifare o 1S014443 4 o Jewel 4 PN533 gt Host Controller Header Payload Data DCS Preamb B2 4D Payload Data including LEN and CMD CRC SB LEN DEP header CMDO CMD1 PBB Payload Data E1 Preamb B2 4D LEN DEP header CMDO CMD1PFEB Payload Data E2 SOF Payload Data EOF Prologue field PCB CID NAD Information field Epilogue field S READ E S ADD E S DATA E S UID echo F CRC 1 S CRC2 E This example does not show the chaining mechanism It is assumed that all the data are sent in only one RF frame Each byte is sent in a separate frame with a start S and an End E of frame This is an example for the READ command Preamb B2 4D Payload Data including LEN and CMD CRC SB LEN
154. rs to PN533 V2 7 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 6 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 2 Configuration Modes The PN533 has 3 possible modes that can be chosen by using two GPIOs during the reset phase of the IC Table 1 Configuration modes Selection Pins Mode P70 IRQ P35 pin 21 pin 20 Standard 1 1 0 0 PN512 emulation 1 0 RF field ON 0 1 2 1 Standard Mode This is the default mode of the PN533 The description of this mode is detailed in this document starting from chapter 3 p 9 2 2 PN512 emulation mode In this test mode the PN533 is configured to act as real PN512 IC using serial interface The PN512 is a transmission module for contactless communication at 13 56 MHz It integrates a modulation and demodulation concept for different kind of contactless communication methods and protocols Then the PN533 can be easily interfaced with the PN512 dedicated host controller software as e g Joiner PC Serial The link used is RS232 at 9600 bauds It is not possible to change the value of the baud rate the SerialSpeedReg register is not emulated The emulation of the PN512 IRQ pin is supported as well the pin used is P70 IRQ The level of the P70 IRQ pin is low when an interrupt occurs The bit RQI nv in the register CommlEnReg has no effect see 4 The RS232 link used here is the standard UART not the Hi
155. s 0x08 12 8 ms 0x09 25 6 ms Ox0A 51 2 ms 0x0B 102 4 ms OxOC 204 8 ms Ox0D 409 6 ms OxOE 819 2 ms OxOF 1 64 sec 0x10 3 28 sec e Cfgltem 0x04 MaxRtyCOM 1 byte The information MaxRtyCOM 1 byte defines the number of retry that the PN533 will use in the InCommunicateThru 88 4 9 p 109 command in case of mute target or error detected This information is also used with InDataExchange 8 4 8 p 100 when the target is a FeliCa or a MIFARE card The specific value OxFF means that the PN533 retries eternally The default value of this parameter is 0x00 no retry only one try UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 74 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e Cfgltem 0x05 MaxRetries 3 bytes Table 20 Maximum retries Byte Variable name Byte 1 MxRtyATR Byte 2 MxRtyPSL Byte 3 MxRtyPassiveActivation The parameters MxRtyATR MxRtyPSL and MxRtyPassiveActivation define the number of retries that the PN533 will use in case of the following processes MxRtyATR is a byte containing the number of times that the PN533 will retry to send the ATR_REQ in case of incorrect reception of the ATR_RES or no reception at all timeout For active mode value OxFF means to try endlessly 0x00 means only once no retry only one try The default value of this parameter is OxFF For passive mode the value is always overruled with 0x02 two
156. sed then the PN533 shall set bits 7 5 of the PFB to 001 Remark 2 If bits 7 5 of PFB are set to 001 then the communication is secured and the returned status of the GetData or InDataExchange response is set to 0x20 if the RF communication was successful Remark 3 For enabling the NFC Secure layer the Host has to set the fSecure bit of the SetParameters command to 1 see 8 2 8 p 66 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 20 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual 5 Host controller Interface 5 1 General points 5 1 1 Introduction The system host controller communicates with the PN533 by using the USB link The protocol between the host controller and the PN533 on top of this physical link is described in 7 p 34 5 1 2 USB interface The figure below shows an USB modeling of the PN533 Device Configuration Vendor Spec Interface IN OUT OUT Bulk Endpoint IN Bulk Endpoint Logical Endpoint 0 Logical Endpoint 4 Logical Endpoint 4 Control pipe Bulk Out pipe Bulk In pipe Fig 9 USB Description of the PN533 PN533 uses 2 endpoints which are part of the Vendor Specific Interface in addition to two mandatory default endpoint IN OUT 0 Logical endpoint 0 control in out It is needed for initializing and configuring the logical device once the device is attached and powered It provides access to the device s inf
157. sends it back to it whatever its content and its length are ParameterLength 3 Parameter 1 Reply Delay step of 0 5 ms Parameter 2 Content of the CL_TxMode 0x6302 register defining the baud rate and the modulation type in transmission Parameter 3 Content of the CL RxMode 0x6303 register defining the baud rate and the modulation type in reception Result Length no result the test runs infinitely so no output frame is sent to the host controller UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 53 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual For example N The PN533 is configured to receive frame with passive 106 kbps modulation type The frames are sent back immediately The MSB bit CRC enable of CL_TxMode and CL_RxMode must be set to 0 D4 00 o5 00 00 00 The PN533 is configured to receive frame with passive 212 kbps modulation type The frames are sent back with a delay of 64 ms The MSB bit CRC enable of CL_TxMode and CL_RxMode must be set to 1 oa oo 05 e0 02 o2 The PN533 is configured to receive frame with passive 424 kbps modulation type The frames are sent back immediately The MSB bit CRC enable of CL_TxMode and CL_RxMode must be set to 1 D4 00 05 00 a2 a2 The PN533 is configured to receive frame with passive 847 kbps modulation type The frames are sent back i
158. swers to the host controller with a status byte different from 0x00 In the case of an ISO IEC14443 4 card a Protocol and Parameter Selection PPS is launched with the target Tg e Send a PPS request based on the parameters BRti DRi and BRit DSi e Ifa PPS response is correctly received MxRtyPSL retries 8 4 1 p 73 The PN533 takes internally into account the parameters changes The Status byte is set to 0x00 and sent back to the host controller The register values contained in the RFConfiguration Cfgltem Ox0D are then applied to the respective registers CIU RxThreshold CIU ModWidth and CIU_MifNFC depending on the chosen baud rate e Else the PN533 gives up and answers to the host controller with a Status byte different from 0x00 This command is only valid for Type A cards not Type B Possible errors returned Status byte e Negotiation already performed with the relevant target gt Operation not allowed error code is returned Status 0x26 e The target is neither a TPE nor ISO IEC 14443 4 gt Operation not allowed error code is returned Status 0x26 e Unknown target number Command not acceptable error code is returned Status 0x27 e InPSL command was sent to a Type B card Command not acceptable error code is returned Status 0x27 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 99 0f 175 NXP Semiconductors UMO0801 03 PN533 User Manual
159. t Cfgltem 0x02 Various timings 3 bytes Table 18 Various timings Byte Variable definition Variable name Byte 1 RFU Byte 2 ATR_RES TimeOut fATR RES Timeout Byte 3 TimeOut during non DEP communications fRetryTimeout The first byte is RFU The second byte in this item defines the timeout between ATR REQ and ATR RES when the PN533 is in initiator mode A target is considered as mute if no valid ATR RES is received within this timeout value In this way the PN533 can easily detect non TPE target in passive 212 424 kbps mode The default value for this parameter is OxOB 102 4 ms The third byte defines the timeout value that the PN533 uses in the InCommunicateThru 88 4 9 p 109 command to give up reception from the target in case of no answer The default value for this parameter is 0x0A 51 2 ms This timeout definition is also used with InDataExchange 8 4 8 p 100 when the target is a FeliCa or a MIFARE card Ultralight Standard UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 73 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual For the timings of Cfgltem 0x02 the coding is the following Incasen 0 No timeout In case 1 lt n lt 16 Lus 100 x DNG Table 19 Timings definition for RFConfiguration command Byte Value n Timeout Value 0x00 no timeout 0x01 100 us 0x02 200 us 0x03 400 us 0x04 800 us 0x05 1 6 ms 0x06 3 2 ms 0x07 6 4 m
160. te to be used during the activation 0x00 106 kbps 0x01 212 kbps 0x02 424 kbps e Next indicates if the optional fields of the command PassivelnitiatorData NFCID3i and Gi are present bit 1 or not bit 0 bit 0 PassivelnitiatorData is present in the command frame bit1 NFCID3i is present in the command frame bit2 Giis present in the command frame e PassivelnitiatorData is an array of data to be used during the initialization of the target in case of passive communication mode ActPass Depending on the Baud Rate specified the content of this field is different 106 kbps The field is optional and is present only when the host controller wants to initialize a target with a known ID according to 1 the first byte of this ID should be 0x08 for a TPE target In that case PassivelnitiatorData contains the ID of the target 4 bytes 212 424 kbps In that case this field is mandatory in passive communication mode and contains the complete payload information that should be used in the polling request command 5 bytes length byte is excluded as defined in 3 11 2 2 5 e NFCID3i is the NFCID3 of the initiator that is used by the PN533 within the ATR_REQ Depending on the baud rate specified and the communication mode the use of this field is different 106 212 424 kbps active mode The field is used to build the ATR_REQ frame If not present the PN533 will use a
161. ted by the PN533 to the target is 01 The target does an echo of the received frame gt D4 40 01 11 22 33 44 D5 41 00 11 22 33 44 The value of the status byte is 0x00 indicating that the RF exchange is correct HOST PN533 DEP Controller Initiator Target nJumpForDEP Active BR P gt ATR_REQ ACK le gt ATR_RES tA InJumpForDEP Target number 1 ATR_RES InDataExchange 1 1122 33 44 E DEP_REQ Frame ACK xx xx D4 06 PFB 11 22 33 44 xx xx gt l TimeOut control A DEP RES Frame InDataExchange OK 11 22 33 44 xx xx D5 07 PFB 11 22 33 44 xx xx Fig 46 InDataExchange Example of a DEP exchange To simplify the figure DID and NAD are not used in this example UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 107 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual e Innovision Jewel tag When the target is an Innovision Jewel tag the input parameters are interpreted by the PN533 to execute a Jewel exchange The PN533 sends the command and waits for the answer with a default timeout value of 51 2 ms This value can be changed by using the command RFConfiguration 8 4 1 p 73 The DataOut data must be formatted in the following way Cmd Data1 8 o Cmd is the Jewel specific command byte o Addr is the a
162. ted to result in personal injury death or severe property or environmental damage NXP Semiconductors accepts no liability for inclusion and or use of NXP Semiconductors products in such equipment or applications and therefore such inclusion and or use is for the customer s own risk Applications Applications that are described herein for any of these products are for illustrative purposes only NXP Semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification 10 3 UM0801 03 PN533 User Manual Licenses Purchase of NXP components Not applicable 10 4 Patents Notice is herewith given that the subject device uses one or more of the following patents and that each of these patents may have corresponding patents in other jurisdictions See footnote Error Bookmark not defined p Error Bookmark not defined 10 5 Trademarks Notice All referenced brands product names service names and trademarks are property of their respective owners MIFARE is a trademark of NXP B V NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 170 of 175 NXP Semiconductors UMO0801 03 11 Tables Table 1 Table 2 Table 3 Table 4 Table 5 Table 6 Table 7 Table 8 Table 9 Table 10 Table 11 Table 12 Table 13 Table 14 Table 15 Table 16 Table 17 Table 18 Table 19 Table 20
163. th the Paypass specification version 1 1 The firmware will execute several procedures polling collision detection and PICC activation os B s Paveass Tyee PCcbaan e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 e PAYPASS type If a PICC was found it indicates the polled target type If the PICC was not found it indicates a collision error transmission error or time out error All possible values of the field PAYPASS TYPE are listed below o 0x01 Type A target found o 0x02 Type B target found o 0x10 Transmission error reported o 0x11 Protocol error reported o 0x12 Collision error reported o 0x13 Time out error reported e PICCData contains the information about the detected PICC and depends on the target type found The following information is given for one PICC o 106 kbps type A SENS RES SEL RES NFCIDLength Ane i je ATS 2 bytes 1 byte 1 byte bytes g ATSLength bytes o 106 kbps type B ATQB ATTRIB_RES ATTRIB RES Response Length ATTRIB RES 12 bytes 1 byte Length UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 120 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e Paypass Item 0x02 PICC removal procedure for Paypass 1 1 This Paypass Item is used to remove a PICC when we have to be compliant with the Paypass specification version 1 1 This procedur
164. the content of one or several internal registers of the PN533 located either in the SFR area or in the XRAM memory space or the content of one or several bytes of the EEPROM Input e ADR1 ADR1 First address High and Low bytes e VAL1 First value to be written e ADRn ADRn n address High and Low bytes e VALn n value to be written Output acc e Status indicates if the command is accepted or not see 8 1 p 50 If status returned is 0x19 then the value are not written in EEPROM but the others values are written in XRam or SFR Syntax Error Conditions e Unknown SFR address Description For each address ADR the PN533 performs a writing operation of the value VAL in the register or in the EEPROM byte located at address ADR The table below shows information which is writable by WriteRegister Command writable information EEPROM 128 or 256 bytes OxA0 00 to OxA0 FF OxAO 00 address corresponds to 0x00 of the EEPROM OxFF 80 to OxFF FF SFR 64 bytes Fig 32 WriteRegister Memory mapping NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 61 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e SFRregisters The host controller has to set the High Byte of the address to OxFF the real address of the register is given by the low byte The list of SFR registers that may be acceded is the same as the one defined in the ReadRegister command
165. to Peer example with two PN533 active mode 167 PADD ONION sunne 168 Command Set cccccceececeeceeeeeeesaeeeeeeeeeeaes 168 Legal information arrnnnnvrnnnnnnvnnnnnvnnnnnvennnnnuennn 170 Definitions ronrrrnnrrrranrorannovnnnennnnennanenrannnnen 170 DISCAIMENS snieni nia 170 LICENSES rrranrnnrrnnnnnvanennnrnnnnnvanennnsnnnnnnanennnenne 170 PA 170 Trademarks rrnnrnnnnrnranonnnrnnnnnnannvnnrnnnnnnnnnnne 170 TADICS Ledin sideesden 171 FOU Ja 172 COEN 175 Please be aware that important notices concerning this document and the product s described herein have been included in the section Legal information NXP B V 2008 All rights reserved For more information please visit http www nxp com For sales office addresses email to sales addresses www nxp com Date of release 14 January 2009 Document identifier UM0801 03
166. transmission o 0x00 106 kbps o 0x01 212 kbps o 0x02 424 kbps o 0x03 847 kbps modulation type o 0x00 MIFARE RFA ISO IEC14443 3 Type A ISO IEC14443 3 Type B U mm gt mm lt O D ISO IEC18092 passive 106 kbps o 0x10 FeliCa ISO IEC18092 passive 212 424 kbps o 0x01 ISO IEC18092 Active mode o 0x02 Innovision Jewel tag UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 57 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual Description Err Err contains error code as defined in the error code paragraph 88 1 p 50 After the execution of the GetGeneralStatus command the content of the latest error is cleared Field The PN533 scans the RF field to inform the host controller if an external field is detected or not Tq BrRx BrTx and Type When the PN533 is configured as initiator for the target handled by the PN533 the indication of the baud rate used and the modulation is given The Tg information corresponds to the logical target number attributed by the PN533 when a previous InListPassiveTarget InJumpForDEP or InJumpForPSL command has been used is equal to 0 for the target handled by the PN533 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 58 of 175 NXP Semiconductors UMO0801 03 8 2 4 UM0801 03 PN533 User Manual ReadRegister This command is used to read th
167. ts reserved User Manual Rev 03 14 January 2009 112 of 175 NXP Semiconductors UM0801 03 UM0801 03 PN533 User Manual Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 e Dataln is an array of raw data received by the PN533 coming from the target Description When using this command it is assumed that the card has been first activated by an InListPassiveTarget command 8 4 5 p 87 This command is complementary of the InDataExchange command 8 4 8 p 100 and the IncommunicateThru command 8 4 9 p 109 The InQuartetByteExchange works like the InCommunicateThru command but the InQuartetByteExchange is able to manage different type of Input Data Coming from the PICC as quartets Ack Nack data bytes or time out The host has to specify the type of response which is expected after the issuance of the command NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 113 of 175 NXP Semiconductors UMO0801 03 UM0801 03 PN533 User Manual e RFA tag When the target is RFA compliant the input parameters are interpreted by the PN533 to execute a RFA exchange The PN533 sends the command and waits for the answer with a default timeout value of 51 2 ms This value can be changed by using the command RFConfiguration 8 4 1 p 73 The DataOut data must be formatted to be RFA compliant Examples
168. ture Header 4bytes C APDU or R APDU 0 to 249 bytes LRC 1byte Fig 35 ALPAR structure definition e The header includes 1 byte 2 byte 3 byte 4 byte x 111 0 0 01 o 0 LENGTH H LENGTH L COMMAND X 0 gt ACK Data length to transmit excluding header and Command byte X 1 gt NACK LRC Fig 36 ALPAR Header definition The LRC Longitudinal Redundancy Check byte is such that the exclusive or XOR of all bytes including LRC is null See 6 for more details about commands bytes UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 70 of 175 NXP Semiconductors UM0801 03 PN533 User Manual Contact command aborts all other commands See figure below Host PN533 TDA8029 Controller Command CTLess ACK Command CT ACK sSRQnse TLE Response CT Fig 37 CT Command aborts other commands Contact command can be aborted by all other commands See figures below HOS PN533 TDA8029 Controller Command CT ACK Command CTLess ACK RQSPDONS T Response CTLess Fig 38 CTLess command aborts a CT command UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 71 of 175 NXP Semiconductors UM0801 03 PN533 User Manual Host Controller CO Command CT 1 lt __ _ Command CT 2 na
169. uted by the PN533 1 byte e InParam Input parameters needed for some of the tests Output e QOutParam Parameters returned to the host controller after execution of the test Syntax Error Conditions e Unknown test number NumT st Description There are some parameters in command packet The controller sends a command packet with parameter length and parameter itself The PN533 returns result OutParam with 1 to 262 bytes length parameters Processing time of this command varies depending on the content of the processing NumTst 0x00 Communication Line Test This test is for communication test between host controller and the PN533 Parameter Length and Parameters in response packet are same as Parameter Length and Parameter in command packet Parameter Length m 0 lt m lt 262 Parameter Data Result Length Same value of m 1 OutParam consists of NumTst concatenate with InParam NumTst 0x01 ROM Test This test is for checking ROM data by 8 bits checksum Parameter Length 0 Result Length T Result 0x00 OK OxFF Not Good UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 52 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual NumTst 0x02 RAM Test This test is for checking RAM 976 bytes of XRAM and 128 bytes of IDATA The test method used consists of saving original content wr
170. vation sending a RATS and waiting for a ATS response from the card In that case the complete ATS response frame is sent back to the host controller in TargetData The real number of initialized target is indicated to the host controller in the NbTg field 0 lt NbTg lt MaxTg The latest target initialized remains active and is not put in HALT state Thus the host controller is able to exchange data with this target more quickly Remark 1 The NFCID1t does not include the cascade tag CT if it is cascaded level 2 or 3 Remark 2 In case of multiple targets activation when a collision is detected on the SENS_RES the SENS_RES field in TargetData is filled with value 0x00 0x00 UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 90 of 175 NXP Semiconductors UMO0801 03 PN533 User Manual e if BrTy 0x03 0x06 0x07 or 0x08 106 212 424 or 847 kbps Type B As long as there is no target detected maximum MaxTg This process is done MxRtyPassiveActivation times 8 4 1 p 73 Cfgltem 5 if no answer is detected the command is terminated and the field NbTg in the output buffer contains 0x00 meaning that no target has been detected with the number of allowed trials o Probe the field for targets using either REQB or WUPB command with timeout control of 5 ms The WUPB command is sent if the InitiatorData input data indicates that the card is initially
171. wer frame and updates its internal state released deselected activated This is the case for the following command frame Table 28 Target configuration Automatic response Command Automatic DEP Received Response mode ATR REQ ATR RES Y may need TgSetGeneralBytes if fAutomaticATR RES is not set PSL REQ PSL RES Y DSL REQ DSL RES Y RLS REQ RLS RES Y WUP REQ WUP RES Y NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 132 of 175 NXP Semiconductors UM0801 03 UM0801 03 8 4 16 PN533 User Manual TgSetGeneralBytes This command is used in combination with the TgInitAsTarget command 88 4 14 p 120 to give the General Bytes The PN533 uses them to build the ATR_RES sent to the initiator Input e Gt is an array containing the general bytes to be used in the ATR RES The length of this field is not fixed max 47 bytes Output e Status is a byte indicating if the process has been terminated successfully or not see 8 1 p 50 Syntax Error Conditions e Gt length exceeds 47 bytes Description By default flag fAutomaticATR_RES is set 8 2 8 p 66 the PN533 uses the general bytes given in TgInitAsTarget command present or not in the input parameters The command TgSetGeneralBytes allows the host controller to build the General Bytes of the target after having analyzed the ATR_REQ coming from the initiator When used the command TgSetGeneral
172. yte 2 CIU GsNOn OxF4 Byte 3 CIU CWGsP Ox3F Byte 4 CIU_ModGsP Ox11 Byte 5 CIU DemodRfOn when own FF is On 0x4D Byte 6 CIU RxThreshold 0x85 Byte 7 CIU DemodRfOff when own RF is Off 0x61 Byte 8 CIU GsNOff Ox6F Byte 9 CIU_ModWidth 0x26 Byte 10 CIU_MifNFC 0x62 Byte 11 CIU_TxBitPhase 0x87 Note Actually there is only one Demod register which defines a setting used by the reader in reception only But depending on the RF condition two different settings can be used for this register e CIU _ Demod when own RF is On defines a setting when its RF field is on during a reception i e initiator passive mode e CIU _ Demod when own RF is Off defines a setting when its RF field is off during a reception i e initiator active mode It is the same case for the GsN register e CIU GsnOn defines a setting to be used by a reader or a target when the RF field is on e CIU GsnOff defines a setting to be used by a reader or a target when the RF field is off UM0801 03 NXP B V 2008 All rights reserved User Manual Rev 03 14 January 2009 76 of 175 NXP Semiconductors UM0801 03 PN533 User Manual e Cfgltem 0x0B Analog settings for the baudrate 212 424 kbps 8 bytes This Cfgltem is used to choose the analog settings that the PN533 will use for baudrates 212 424kbps When using this command the host controller has to provide 8 values ConfigurationData for the following internal registers Table 22 Analog settings for

Download Pdf Manuals

Related Search

Related Contents

Valueline VLCP60880B20 printer cable  Davis Instruments Vantage Pro 2: Console User Manual  INDICE  DELL Inspiron 15 7000  取扱説明書をPDFで開く  Modelos TIPO 2  check-list de l`association employeur  Manual Del Propietario  Targus 15" Getta Backpack  Charlottes à l`abricot allégées – Le vendredi c`est  

Copyright © All rights reserved. Failed to retrieve file