Home

PN532/C1 - Adafruit

image

Contents

1. Register Register Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Bit1 Bito address name 630Dh CIU ManualRCV Reserved FastFiltMF SO DelayMF SO ParityDisable LargeBWPLL ManualHPCF HPCFT 1 0 630Eh CIU_TypeB RxSOFReq RxEOFReq Reserved EOFSOFWidth NoTxSOF NoTxEOF TxEGT 1 0 630Fh to Reserved 6310h 6311h CIU_CRCResultMSB CRCResultMSB 7 0 6312h CIU CRCResultLSB CRCResultLSB 7 0 6313h CIU_GsNOff CWGsNOff 3 0 ModGsNOff 3 0 6314h CIU_ModWidth ModWidth 7 0 6315h CIU TxBitPhase RcvClkChange TxBitPhase 6 0 6316h CIU RFCfg RFLevelAmp RxGain 2 0 RFLevel 3 0 6317h CIU_GsNOn CWGsNOr 3 0 ModGsNOn 3 0 6318h CIU CWGsP Reserved CWOGsP 5 0 6319h CIU ModGsP Reserved ModGsP 5 0 631Ah CIU_TMode TAuto TGated 1 0 TAutoRestart TPrescaler_Hi 3 0 631Bh CIU_TPrescaler TPrescaler_LO 7 0 631Ch CIU TReloadVal Hi TReloadVal Hi 7 0 631Dh CIU TReloadVal Lo TReloadVal Lo 7 0 631Eh CIU TCounterVal hi TCounterVal Hi 7 0 631Fh CIU TCounterVal lo TCounterVal LO 7 0 6320h Reserved 6321h CIU TestSelt LoadModTst 1 0 SICclksel 1 0 SICCIKD1 TstBusBitSel 2 0 6322h CIU TestSel2 TstBusFlip PRBS9 PRBS15 TstBusSel 4 0 6323h CIU TestPinEn TestPinEn 7 0 6324h CIU TestPinValue useio TestPinValue 6 0 6325h CIU TestBus TestBus 7 0 6326h CIU AutoTest Reserved AmpRcv Reserved SelfTest 3 0 6327h CIU Version Product Version 6328h CIU AnalogTest AnalogSelAux1 3 0 AnalogSelAux2 3 0
2. v PN532 2 Target answers PN532 NFC Initiator atthe same transfer speed NFC Target Host Powered for Digital Aet Power to generate Communication the field Fig 32 Active NFC mode The following table gives an overview of the active communication modes Table 150 Communication overview for NFC Active Communication mode Communication scheme ISO IEC 18092 ECMA 340 NFCIP 1 Baud rate 106 kbit s 212 kbit s 424 kbit s Bit length 3 EE 9 44us T 4 72us HE 2 3605 Initiator to Target Modulation 100 ASK 8 30 ASK 8 30 ASK Bit coding Miller Coded Manchester Coded Manchester Coded Target to Initiator Modulation 100 ASK 8 30 ASK 8 30 ASK Bit coding Miller Coded Manchester Coded Manchester Coded 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 106 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller 8 6 4 2 PASSIVE Communication mode CONFIDENTIAL Passive Communication Mode means that the target answers to an Initiator command in a load modulation scheme Host 1 Initiator starts communication at selected transfer speed PN532 NFC Initiator Power to generate the field PN532 NFC Initiator Power to generate the field Fig 33 Passive NFC mode o Wo 2 Targets answers using load modulation at the
3. SVDD Secure SIGIN P34 SIC CLK Cg 100nF PN532 T AVDD C1 and C2 are matching cap 10 to 300pF Rq is the damping resistor several ohms Ci Ra Zh C2 5 Antenna C2 WIESEN p ay R 9 Ci i Optional oO omo c a SSK SS B l I l Rs R4 OSCIN OSCOUT d 1kQ 22pF 27 12 22 pF MHz L Le a es i es es 4 Fig 51 Application diagram of PN532 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 212 of 224 NXP Semiconductors PN532 C1 14 Package outline HVQFNAO plastic thermal enhanced very thin quad flat package no leads 40 terminals body 6 x 6 x 0 85 mm terminall index area termina index area 5mm Near Field Communication NFC controller CONFIDENTIAL SOT618 1 Note 1 Plastic or metal protrusions of 0 075 mm maximum per side are not included OUTLINE REFERENCES VERSION JEDEC JEITA EUROPEAN PROJECTION ISSUE DATE SOT618 1 MO 220 Fig 52 Package outline HVQFN40 SOT618 1 115432 This package is MSL level 2 Ege 01 08 08 02 10 22 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 213 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 15 Abbreviations
4. To enable the FeliCa communication a 6 byte preamble 00h 00h 00h 00h 00h 00h and 2 byte SYNC bytes B2h 4Dh are sent to synchronize the receiver The following LEN byte indicates the length of the sent data bytes plus the LEN byte itself The CRC calculation is done according to the FeliCa definitions with the MSB first To transmit data on the RF interface the 80C51 has to send the LEN and data bytes to the CIU The Preamble and SYNC bytes are generated by the CIU automatically and must not be written to the FIFO The CIU performs internally the CRC calculation and adds the result to the frame The starting value for the CRC Polynomial is 2 null bytes 00h 00h Example of frame Table 148 FeliCa framing and coding Preamble SYNC LEN 2 Data Bytes CRC 00 00 00 00 00 00 B2 4D 03 AB CD 90 35 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 103 of 224 NXP Semiconductors PN532 C1 8 6 3 3 115432 Near Field Communication NFC controller ISO IEC 14443B Reader Writer The CIU supports layers 2 and 3 of the ISO IEC 14443 B Reader Writer communication scheme except anticollision which must be implemented in firmware as well as upper layers CONFIDENTIAL The following diagram describes the communication at the physical level Table 149 describes the physical parameters 1 PCD to PICC 8 14 ASK Reader Writer
5. Symbol Parameter Conditions Min Typ Max Unit Vin High level Input voltage 1 0 7 x PVpp PVpp V ViL Low level Input voltage 20 0 3x PVpp V Vou Push pull MISO mode PVpp 3 V PVpp 0 4 PVpp V high level output voltage loH 4 mA PVpp 1 8 V B PVpp 0 4 PVpp V lou 2mA VoL Push pull MISO mode PVpp 3 V 0 0 4 V low level output voltage lol 4 mA PVpp 1 8 V Bl o 0 4 V lot 2 mA li Input mode high level input Vi DVpp 1 1 uA current lit Input mode low level input Vi 20V 1 1 uA current li eak Input leakage current RSTPD_N 0 4 V 1 1 uA Cin Input Capacitance 2 5 pF Cout Load Capacitance 30 pF Tsp Width of suppressed Only valid for SCK 15 ns spikes 1 To minimize power consumption when in Soft Power Down mode the limit is PVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V 3 Data at PVDD 1 8 V are only given from characterization results 12 17 Input pin characteristics for SIGIN Table 312 Input output pin characteristics for SIGIN Symbol Parameter Conditions Min Typ Max Unit Vin High level Input voltage 11 0 7 x SVpp SVpp V ViL Low level Input voltage a0 0 3xSVpp V li High level input current Vj SVpp 1 1 uA liL Low level input current Vi 0 V 1 1 uA lLeak Input leakage current RSTPD_N 0 4 V 1 1 uA Cin Input Capacitance 2 5 pF 1 To minimize power consumption when in Soft Power Down mode the limit is SVpp 0 4 V 2 To minimize power consump
6. 1 To minimize power consumption when in Soft Power Down mode the limit is DVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V 12 9 RSTOUT N output pin characteristics Table 302 RSTOUT N output pin characteristics Symbol Parameter Conditions Min Typ Max Unit Vou High level output voltage PVpp 3 V 0 7 x PVpp PVpp V lou 4mA PVpp 1 8V 2 0 7 x PVpp PVpp V lon 2 mA VoL Low level output voltage PVbpp 3 V 0 0 3xPVpp V lot 4mA PVpp 21 8 V 21 o 0 3 x PVpp V lot 2mA Cout Load capacitance 30 pF triseta Rise and fall times PVpp 3 V 13 5 ns Vou 0 8 x PVpp VoL 20 2x PVpp Cout 30 pF PVpp 1 8 V 10 8 ns Vou 0 7 x PVpp VoL 0 3 x PVpp Cout 30 pF 1 lou and Io give the output drive capability from which the rise and fall times may be calculated as a function of the load capacitance 2 Data at PVDD 1 8V are only given from characterization results 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 199 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller 12 10 Input output characteristics for pin P70 IRQ 115432 Table 303 Input output pin characteristics for pin P70 IRQ CONFIDENTIAL Symbol Parameter Vin Vit Vou VoL lin li lLeak Cin Cout trise fall High level input voltage Low level input voltage Push pull mode high level
7. NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 51 CIU AutoTest register 6326h Controls the digital self test Table 274 CIU AutoTest register address 6326h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol AmpRv 0 SelfTest 3 0 Reset 0 1 9 8 0 0 0 0 Access R R RR RW RW RW RW Table 275 Description of CIU AutoTest bits Bit Symbol 7 6 AmpRcv 5104 3to0 SelfTest 3 0 Description Reserved Set to logic 1 the internal signal processing in the receiver chain is performed non linear This increases the operating distance in communication modes at 106 kbit s Note Due to non linearity the effects of MinLevel and CollLevel in CIU RxThreshold register are as well non linear Reserved Enables the digital Self Test The self test can be started by the Selftest command in the CIU Command register The self test is enabled by 1001 Note For default operation the self test has to be disabled 0000 8 6 23 52 CIU Version register 6327h Shows the version of the CIU Table 276 CIU Version register address 6327h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol Product 3 0 Version 3 0 Rest 1 0 oO 0 0 0 0 0 Aces R RH R R R RH R R Table 277 Description of CIU Version bits Bit Symbol 7104 Product 3toO0 Version Description Product 1000 PN532 Version 0000 115432 NXP B V 2007 All rights reser
8. N A MISO 00000000 00000000 00000000 00000000 Nss Fig 17 SPI FIFO manager write access SPlcontrol register SPlcontrol register contains programmable bits used to control the function of the SPI block This register has to be set prior to any data transfer Table 122 SPlicontrol register SFR address AQh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol Enable x CPHA CPOL 1E1 IEO Reset 0 0 0 0 0 0 0 oO Access R RW R RW R W RW RW Table 123 Description of SPlcontrol bits Bit Symbol Description 7106 Reserved 5 Enable SPI enable When set to logic 1 enables the SPI interface assuming that selif 1 0 are set to 01b Reserved CPHA Clock PHAse This bit controls the relationship between the data and the clock on SPI transfers When set to logic 0 Data is always sampled on the first clock edge of SCK When set to logic 1 Data is always sampled on the second clock edge of SCK 2 CPOL Clock POLarity This bit controls the polarity of SCK clock When set to logic 1 SCK starts from logic 0 else starts from logic 1 1 IE1 Interrupt Enable 1 When set to logic 1 the hardware interrupt generated by TR FE in SPlstatus register is enabled The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 0 IEO Interrupt Enable 0 When set to logic 1 the hardware interrupt generated by RCV OVR in SPlstatus
9. 00020 cee eee eee eee 76 Table 114 Description of HSU CTR bits 76 Table 115 HSU_PRE register SFR address ADh bit allocation 2 tr ie ede AoE eaten ahead dh ads 77 Table 116 Description of HSU_PRE bits 77 Table 117 HSU_CNT register SFR address AEh bit allocatiori ed sche aid pre etu ee Ros 77 Table 118 Description of HSU_CNT bits 77 Table 119 Recommendation for HSU data rates 77 Table 120 SPI SFR register list 00 5 78 Table 121 SPl operation 0 0 0 e eee eee 78 Table 122 SPlcontrol register SFR address A9h bit allocation 0002 00 eee eee eee 80 Table 123 Description of SPlcontrol bits 80 Table 124 SPlstatus register SFR address AAh bit allocation 00 0200 cee eee ee eee 82 115432 Near Field Communication NFC controller CONFIDENTIAL Table 125 Description of SPlstatus bits 82 Table 126 LDO register address 6109h bit allocation 87 Table 127 Description of LDO bits 87 Table 128 Control switch rng register address 6106h bit allocation 00 p arenai ie a e 88 Table 129 Description of Control switch rng bits 88 Table 130 PN532 clock source characteristics 89 Table 131 Current consumption in low power modes 91 Table 132 PCR registers 0000 eee eaee 92 Table 133 PCR CFR register address 6200h bit allocation 0000
10. Table 210 CIU RxMode register address 6303h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol RXCRCEn RxSpeed 2 0 RxNoEr RxMuliple RxFraming 0 Reset 0 0 0 0 0 0 0 0 Access RW DY D DY RW RW DY DY Table 211 Description of CIU RxMode bits Bit Symbol Description 7 RxCRCEn Set to logic 1 this bit enables the CRC calculation during reception The CRC bytes will not be written within the CIU FIFO Note This bit shall only set to logic O at 106 kbit s 6to4 RxSpeed 2 0 Defines the bit rate while data receiving The analog part of the CIU handles only transfer speeds up to 424 kbit s internally the digital part of the CIU handles the higher transfer speeds as well Value Description 000 106 kbit s 001 212 kbit s 010 424 kbit s 011 848 kbit s 100 1696 kbit s 101 3392 kbit s 110 111 Reserved Note The bit coding for transfer speeds above 424 kbit s is equivalent to the bit coding of the active communication mode of the 424 kbit s of the of the ISO IEC18092 ECMA340 3 RxNoErr If set to logic 1 a not valid received data stream less than 4 bits received will be ignored The receiver will remain active 2 RxMultiple Set to logic 0 the receiver is deactivated after receiving a data frame Set to logic 1 it is possible to receive more than one data frame This bit is only valid for 212 and 424 kbit s to handle the Polling command Having set this bit the receive and transceive commands will not end
11. Product data sheet Rev 3 2 3 December 2007 46 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 2 2 6 P3register 115432 Table 70 P3 register SFR address BOh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol P3 P344 P3i3 P32 P3 t P3 0 Rest 1 1 1 1 1 1 1 1 Access R R RAW RW RW RW RW RW Table 71 Description of P3 bits Bit Symbol Description 7106 Reserved 5 P3 5 Writing to P3 5 writes the corresponding value to P35 pin according to the configuration mode defined by PSCFGA 5 and P3CFGBJ5 Reading from P3 5 reads the state of P35 pin 4 P3 4 When P34 alternate function SIC_CLK is not used writing to P3 4 writes the corresponding value to P34 pin according to the configuration mode defined by PSCFGA 4 and P3CFGB 4 Reading from P3 4 reads the state of P34 pin 3 P3 3 Writing to P3 3 writes the corresponding value to P33 INT1 pin according to the configuration mode defined by PSCFGA 3 and P3CFGB 3 Reading from P3 3 reads the state of P33_INT1 pin 2 P3 2 Writing to P3 2 writes the corresponding value to P32 INTO pin according to the configuration mode defined by PSCFGA 2 and P3CFGB 2 Reading from P3 2 reads the state of P32 INTO pin 1 P3 1 When the P31 pin alternate function UART TX is not used writing to P3 1 writes the corresponding value to P31 pin according to the configuration mode define
12. frequency then Baud rate in mode 1 and 3 when related to timer1 overflow 3 SMOD 2 32 overlrate See also Section 8 1 8 8 Baud rates using Timer1 Debug UART mode 1 and 3 Baud rate in mode 1 and 3 when related to timer2 overflow 4 1 over2rate 16 See also Section 8 1 8 9 Baud rates using Timer2 Debug UART mode 1 and 3 The next table shows the trigger select Table 55 Trigger select RCLKO TCLKO SMOD receive trigger rate transmit trigger rate 0 0 overtrate 32 0 1 overtrate 16 1 over2rate 16 s 0 0 2 overirate 32 E 0 1 overirate 16 E 1 over2rate 16 Baud rates using Timer1 Debug UART mode 1 and 3 The Timer1 interrupt should be disabled in this application The Timer1 itself can be configured for either timer or counter operation and in any of its 3 running modes In the most typical applications it is configured for timer operation in the auto reload mode Timer1 mode 2 high nibble of TO1MOD 0010b In that case the baud rate is given by the formula Baud rate 5 25MOD fai 32 6x 256 T1H NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 36 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL When rewriting this formula the value for the Timer1 reload value T1H is calculated from the desired baud rate as follows Tim
13. 27 HSU RX NSS P50 SCL 28 HSU TX MOSI SDA 29 P71 MISO P71 30 P72 SCK P72 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 48 of 224 NXP Semiconductors PN532 C1 8 3 1 1 8 3 1 2 115432 Near Field Communication NFC controller CONFIDENTIAL MIF register The Config IO 1 register is used to select the host interface It manages also the polarity of P33_INT1 Table 73 Config IO I1 register address 6103h bit allocation Bit 6 5 4 3 2 1 0 Symbol int pol pad M pad I0 enselif Selif 1 0 Reset 0 x 0 X 0 0 0 Access R W R R W R R W RW RW R W Table 74 Description of Config IO I1 bits Bit Symbol 7 inti pol 6 5 padli 4 3 padlo 2 enselif 1 0 Selif 1 0 Description When set to logic 1 the value of the P33 INT1 pin is inverted Reserved When read this bit gives the state of the I1 pin Reserved When read this bit gives the state of the IO pin When set to logic 1 this bit indicates that the selif bits are valid and that the selected interface on the MIF can drive the pins The firmware must copy the value of the pads IO and 11 to respectively selif 0 and selif 1 When set to logic 0 the MIF cannot drive the IO lines These bits are used by the firmware to select the host interface communication link see Table 72 on page 48 Configuration modes of the host interface pins In I2C mode P50 SCL
14. 3 December 2007 170 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 33 CIU_GsNOff register 6313h 115432 Selects the conductance for the N driver of the antenna driver pins TX1 and TX2 when there is no RF generated by the PN532 Table 238 CIU_GsNOff register address 6313h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol CWGsNO ft 3 0 ModGsNOff 3 0 0 0 Reset 1 0 Access R W R W 0 0 1 0 RW RW RW R W RW RW Table 239 Description of CIU GsNOff bits Bit Symbol Description 7104 CWGsNOff 3 0 The value of this register defines the conductance of the output N driver during the time of no modulation and when there is no RF generated by the PN532 neither Tx1RFEn nor Tx2RFEn is set to logic 1 Note The conductance value is binary weighted Note During CIU Power down mode if DriverSel 1 0 is not equal to 01b CWGsNOff 3 is set to logic 1 This is not readable in the register Note The value of the register is only used if no RF is generated by the driver otherwise the value CWGsNOn in the CIU GsNOn register is used 3to0 ModGsNOTf 3 0 The value of this register defines the conductance of the output N driver for the time of modulation and when there is no RF generated by the PN532 neither Tx1RFEn nor Tx2RFEn is set to logic 1 This may be used to regulate the modulation index when doing load modulation Note The conductance value is b
15. 3 HiAlertlEn When set to logic 1 allows the high alert interrupt request indicated by bit HiAlertlRq to be propagated to CIU_IRQ_1 2 LoAlertlEn When set to logic 1 allows the low alert interrupt request indicated by bit LoAlertIRq to be propagated to CIU_IRQ_1 1 ErrlEn When set to logic 1 allows the error interrupt request indicated by bit ErrlRq to be propagated to CIU IRQ O 0 TimerlEn When set to logic 1 allows the timer interrupt request indicated by bit TimerlRq to be propagated to CIU IRQ O CIU DivIEn register D3h or 6333h Controls bits to enable and disable the passing of interrupt requests Table 182 CIU DivlIEn register address D3h or 6333h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol SiginAct IEn ModelEn CRCIEn RfOnlEn RfOfflEn Reset 0 0 0 0 0 0 0 0 Access R R R RW RW RW RW RW Table 183 Description of CIU_DivlEn bits Bit Symbol Description 7105 Reserved 4 SiginAct IEn Allows the SIGIN active interrupt request to be propagated to CIU IRQ 0 3 ModelEn When set to logic 1 allows the mode interrupt request indicated by bit ModelRq to be propagated to CIU IRQ 0 2 CRCIEn When set to logic 1 allows the CRC interrupt request indicated by bit CRCIRq to be propagated to CIU IRQ O0 1 RfOnlEn When set to logic 1 allows the RF field on interrupt request indicated by bit RfOnIRq to be propagated to CIU_IRQ_O 0 RfOfflEn When set to logic 1 allows
16. Fig 28 Fig 29 Fig 30 Fig 31 Fig 32 Fig 33 Fig 34 Fig 35 Fig 36 Fig 37 Fig 38 Fig 39 Fig 40 Fig 41 Fig 42 Fig 43 Fig 44 115432 Block diagram of PN532 6 Pin configuration for HVQFN 40 SOT618 1 7 PN532 80C51 block description 10 PN532 memory map overview 11 Indirect addressing of XRAM memory space 15 Open drain i lol e eb e 40 Quasi Bidirectional 0 00 cea 41 INPUL err Dm 42 Push pull output llle 43 Host interface block diagram 48 I C state machine of status behavior 57 FIFO manager block diagram 65 HSU block diagram 0 0 00 cee eee 73 Memory manager shift register management 78 SPI Status register read access 79 SPI FIFO manager read access 79 SPI FIFO manager write access 80 SPI Data transfer format 81 Power management scheme 83 LDO block diagram 00 00 0 eee 84 Graph of DVDD versus VBAT with offset 85 Graph of DVDD versus VBAT in Soft Power Down mode with offset 220020005 85 Graph of DVDD versus VBAT without offset 86 27 12 MHz crystal oscillator connection 90 Remote wake up from Power down with P33 as wake up source 2 2 002 ee 92 Simplify Contactless Interface Unit CIU block diagiaM pss idm par leaden Reset 100 I
17. NXP Semiconductors PN532 C1 8 1 7 3 T2MOD register 115432 Near Field Communication NFC controller CONFIDENTIAL This Special Function Register is used to configure Timer2 Table 37 Timer2 T2MOD register SFR address C9h bit allocation Bit E 6 5 4 3 2 1 0 Symbol 7 T2RD DCEN Reset 0 0 0 0 0 0 0 0 Access R R R RW RW Table 38 Description of TMOD bits Bit Symbol 7t03 2 T2RD 1 5 0 DCEN Description Reserved Timer2 ReaD flag Set by hardware and firmware This bit is set to logic 1 by hardware if T2H is incremented between reading T2L and reading T2H This bit is set to logic 0 on the trailing edge of next T2L read This bit is used to indicate that the16 bit Timer2 register is not read properly since the T2H part was incremented by hardware before it was read Reserved Timer2 Down Count ENable Set by firmware only When this bit is set Timer2 can be configured in auto reload mode as an up counter When this bit is reset Timer2 can be configured in auto reload mode as a down counter NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 29 of 224 PN532 C1 Near Field Communication NFC controller CONFIDENTIAL NXP Semiconductors 8 1 7 4 T2L T2H registers These are the actual timer counter bytes T2L is the lower byte T2H the upper byte On the fly reading can give a wrong value sinc
18. SJ0 onpuooliulesS dXN 400z 1equie2eg z eH Jays ejep 1onpoJd vec 10 19 e rSLL peAJese siuBu Ily 4002 8 dXN Table 82 I C Slave Receiver Mode status codes continued Status Status of the I2C Bus and Application firmware Response Next Action Taken By the I C interface Hardware Code the C interface Hardware T5 from I2CDAT TO ICCON ST 7 0 a STA STO SI AA 98h Previously addressed with Read data byte 0 0 0 0 Switched to not addressed SLV mode no recognition of own SLA or General Call Write data byte General call address has been received NOT ACK Read data byte 0 0 0 1 Switched to not addressed SL V mode own SLA will be recognized has been returned General call address will be recognized if IICADR O is set to logic 1 Read data byte 1 0 0 0 Switched to not addressed SLV mode no recognition of own SLA or General call address A START condition will be transmitted when the bus becomes free Read data byte 1 0 0 1 Switched to not addressed SL V mode Own SLA will be recognized General call address will be recognized if IICADR 0 is set to logic 1 A START condition will be transmitted when the bus becomes free AOh A STOP condition or repeated Read data byte 0 0 0 0 Switched to not addressed SLV mode no recognition of own SLA or START condition has been General call address received while still addressed aS Read data byte 0 0 0 1 Switched to not addressed SLV mode SLV REC or TRX Own
19. bit allocation lllllllsellsssns 151 Table 193 Description of CIU Status2 bits 151 Table 194 CIU FlIFOData register address EAh or 6339h bit allocation 0 20000055 152 Table 195 Description of CIU FlFOData bits 152 Table 196 CIU FlFOLevel register address EBh or 633Ah bit allocation 2 20000055 152 Table 197 Description of CIU_FIFOLevel bits 152 Table 198 CIU_WaterLevel register address ECh or 633Bh bit allocation 0 22000005 153 Table 199 Description of CIU_WaterLevel bits 153 Table 200 CIU_Control register address EDh or 633Ch bit allocation 2 20000008 153 Table 201 Description of CIU_Control bits 153 Table 202 CIU BitFraming register address EEh or 633Dh bit allocation llli 154 Table 203 Description of CIU BitFraming bits 154 Table 204 CIU Coll register address EFh or 633Eh bit allocation ei Rao ee tas 155 Table 205 Description of CIU Coll bits 155 115432 Near Field Communication NFC controller CONFIDENTIAL Table 206 CIU Mode register address 6301h bit allocation soci ccricig stisniti esi Gei nih 156 Table 207 Description of CIU Mode bits 156 Table 208 CIU TxMode register address 6302h bit allocation 00002 0c eee eee 157 Table 209 Description of CIU_TxMode bits 157 Table 210 CIU_RxMode register address 6303h bit a
20. x x x Access R R R R R R RH Table 261 Description of CIU TCounterVal hi bits Bit Symbol Description 7100 TCounterVal_Hi 7 0 MSB of the current value of the timer Higher 8 bits Register CIU TCounterVal lo 631Fh Defines the LSB byte of the current value of the timer Table 262 CIU TCounterVal lo register address 631Fh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TCounterVal_LO 7 0 Reset x x x x x x x x Access R R R R R R R Table 263 Description of CIU TCounterVal lo bits Bit Symbol Description 7100 TCounterVal LO 7 0 LSB of the current value of the timer Lower 8 bits 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 179 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 46 CIU TestSel1 register 6321h 115432 General test signal configuration Table 264 CIU TestSel1 register address 6321h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol LoadModTst 1 0 SICclksel 1 0 SICCIkD1 TstBusBitSel 2 0 Reset 0 o o o 0 o o 0 Access RW RW RW RW RW O RW RW RW Table 265 Description of CIU TestSel1 bits Bit Symbol Description 7106 LoadModTst 1 0 Defines the test signal for the LOADMOD pin Note The bits LoadModSel in register CIU_TxSel has to be set to logic 1 to enable LoadModTst Value Description 00 Low 01 High 10 RFU
21. 0000 Tristate 0001 Low 0010 High 0011 Test bus signal as defined by TestBusBitSel in CIU TestSel 0100 Modulation signal envelope from the internal coder 0101 Serial data stream to be transmitted 0110 Output signal of the receiver circuit card modulation signal regenerated and delayed This signal is used as data output signal for secure IC interface connection using 3 lines Note To have a valid signal the CIU has to be set to the receiving mode by either the Transceive or Receive command The RxMultiple bit can be used to keep the CIU in receiving mode Note Do not use this setting in ISO IEC 14443A MIFARE mode Data collisions will not be transmitted on SIGOUT when using Manchester coding 0111 Serial data stream received Note Do not use this setting in ISO IEC 14443A MIFARE mode Miller coding parameters as the bitlength can vary 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 161 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Table 217 Description of CIU TxSel bits continued Bit Symbol Description 1000 1011 FeliCa secure IC modulation 1000 RX 1001 TX 1010 Demodulator comparator output 1011 Reserved Note To have a valid signal the CIU has to be set to the receiving mode by either the Transceive or Receive commands The bit RxMultiple can be used to keep the CIU in receiving mode 1000 1011
22. 08h A START condition has been Load SLA W X 0 0 X SLA W will be transmitted ACK will be received transmitted 10h A repeated START condition Load SLA W X X As above has been transmitted Load SL R X X SLA W will be transmitted the I2C interface will be switched to MST TRX or REC mode 38h Arbitration lost in SLA R W or No I CDAT action 0 X 12C bus will be released a Slave mode will be entered Data bytes No I2CDAT action 1 X A START condition will be transmitted when the bus becomes free 40h SLA R has been transmitted No I CDAT action 0 0 Data byte will be received ACK has been received NOT ACK bit will be returned No I2CDAT action 0 0 0 1 Data byte will be received ACK bit will be returned 48h SLA R has been transmitted No I CDAT action 0 X Repeated START condition will be transmitted NOT ACK has been received No 2CDAT action 0 X STOP condition will be transmitted STO flag will be set to logic 0 No I2CDAT action 1 1 0 X STOP condition followed by a START condition will be transmitted STO flag will be set to logic 0 50h Read data byte has been Read data byte or 0 0 0 0 Data byte will be received received ACK has been NOT ACK bit will be returned returned Read data byte 0 0 0 1 Data byte will be received ACK bit will be returned 58h Read data byte has been Read data byte 1 0 X Repeated START condition will be transmitted received NOT ACK has been Read data byte 0 X STOP condition will be transmitted returned STO flag will be set to
23. 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 194 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 Characteristics 12 1 12 2 115432 Unless otherwise specified the limits are given for the full operating conditions The typical value is given for 25 C VBAT 3 4 V and PVDD 3 V Timings are only given from characterization results Power management characteristics Table 293 Power management characteristics Symbol Parameter Conditions Min Typ Max Unit VBAT Battery power supply range Vsg 20V 2 7 55 V Vpvpp LDO output VBAT gt 3 4 V 2 7 3 3 4 V Ipvpp 150 mA LDOorr LDO offset VBAT 3 4 V 300 400 700 mV Ipvpp 150 mA Offset enabled Vind Reset threshold on DVpp falling 2 04 2 32 26 V Vhys1 Vth1 hysteresis 40 90 mV Cdec DVDD decoupling capacitor Low ESR like X7R or 10 uF X5R ceramic capacitor PSR Power supply rejection on DVpp LDO offset enabled 46 dB F lt 10 kHz Cdec 10 uF FcPsn PSR 3dB cut off frequency Standard LDO mode 10 kHz Cdec 10 uF SVpp SVpp output voltage VBAT gt 3 4 V 2 7 3 3 VV Isvpp 30mA 1 Decreasing the decoupling capacitance can decrease the power supply bursts rejection 2 The capacitance should be placed closed to the pins and can be splitted see Figure 51 on page 212 Overcurrent detection The following values are guaranteed by design Only functional testing is done in productio
24. 54N uoneoiunuiuo pjJarJ Je9N LO c SNd IVLLN3GIJNOO NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 8 RF level detector 115432 The RF level detector is integrated to fulfill NFCIP 1 protocol requirements e g RF collision avoidance Furthermore the RF level detector can be used to wake up the PN532 and to generate an interrupt The sensitivity of the RF level detector is adjustable in a 4 bit range using the bits RFLevel in register CIU_RFCfg see Table 245 on page 174 The sensitivity itself depends on the antenna configuration and tuning Possible sensitivity levels at the RX pin are listed below Table 156 Setting of the RF level detector VRx typical Vpp CIU RFCfg setting CIU RFCfg setting CIU Power Down bit set to logic with additional amplifier 1 0 see Remark 2 1 9 1111b 1 35 1 3 1110b 0 95 0 9 1101b 0 6 0 57 1100b 0 41 0 40 1011b 0 28 0 27 1010b 0 17 0 17 1001b 0 12 0 12 1000b 1xxx1111b 0 085 0111001 1xxx1110b 0 055 0110b 1xxx1101b 0 040 0101b 11 1xxx1100b 0100b 11 1500101 1b 001 1bl4 1xxx101 0b 001 0b 1xxx1001b 0001 bit 1xxx1000b 1 0000b 11 1xxx01 11 bl 1 Due to noise it is recommended not to use this setting to avoid misleading results To increase the sensitivity of the RF level detector an amplifier can be activated by setting the bit RFLevelAmp in register CIU_RFCfg to log
25. 8 6 21 3 8 6 21 4 8 6 22 8 6 23 8 6 23 1 8 6 23 2 8 6 23 3 8 6 23 4 8 6 23 5 8 6 23 6 8 6 23 7 8 6 23 8 8 6 23 9 8 6 23 10 8 6 23 11 8 6 23 12 8 6 23 13 8 6 23 14 8 6 23 15 8 6 23 16 8 6 23 17 8 6 23 18 8 6 23 19 8 6 23 20 8 6 23 21 8 6 23 22 8 6 23 23 8 6 23 24 CONFIDENTIAL CRC co processor 20 55 127 FIFO buffer nanan cc ee eee 127 Accessing the FIFO buffer 127 Controlling the FIFO buffer 127 Status information about the FIFO buffer 128 CIU timer 00000 e eens 129 Interrupt request system 130 Interrupt sources 00000 130 CIU Power Reduction Modes 131 Hard Power Down 055 131 CIU Power down 20055 131 Transmitter Power down 132 CIU command set ssususus 132 General description 4 132 General behavior 132 Commands overview 133 Idle command illsullslsuss 133 Config command ssselssus 133 Generate RandomID command 134 CalcCRC command 05 134 Transmit command 5 134 NoCmdChange command 134 Receive command 255 135 Transceive command 5 135 AutoColl command 136 MFAuthent command 138 SoftReset command 5 138 CIU tests signals 0 000
26. Clock name Frequency MHz Tolerance Clock source Comments OSC CLK27 27 12 t14kHz OSC 27 12 Output of OSC 27 CPU CLK 27 12 13 56 6 78 500ppm OSC 27 12 Default is 6 78 MHz HSU CLK 27 12 t14kHz OSC 27 12 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 89 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 5 2 27 12 MHz crystal oscillator The 27 12 MHz clock applied to the PN532 is the time reference for the embedded microcontroller Therefore stability of the clock frequency is an important factor for reliable operation It is recommended to adopt the circuit shown in Figure 24 PN532 2 Q O op O Crystal 27 12 MHz ae ds Fig 24 27 12 MHz crystal oscillator connection 8 5 3 Reset modes 115432 The possible reset mechanisms are listed below Supply rail variation When DVDD falls below 2 4 V the POR Power On Reset asserts an internal reset signal The Power Sequencer disables all clocks When DVDD rises above 2 4V the POR deasserts the internal reset signal and the Power Sequencer starts the power up sequence Once the PN532 is out of reset the RSTOUT_N pin is driven high Glitch on DVDD When DVDD falls below 2 35 V for more than 1 ms the POR asserts an internal reset signal The power sequencer starts the Power down sequence The PN532 goes into reset and the RSTOUT_N signal is driven l
27. Input pin characteristics for RX Symbol Parameter Conditions Min Typ Max Unit ViNRX Dynamic Input voltage VBAT 2 3 4 V 1 AVpp 1 V Range Cinrx RX Input Capacitance 10 pF Rinrx RX Input Series VBAT 3 4 V 350 Q resistance Receiver active VRX 1 Vpp 1 5 V DC offset VpRx mMiniv mii Minimum Dynamic Input VBAT 3 4 V 150 500 mVpp voltage Miller coded 106 kbit s VRX Miniv Man Minimum Dynamic Input VBAT 3 4 V 100 200 mVpp voltage Manchester 212 and 424 kbit s Coded VpRx Max v Mi Maximum Dynamic Input VBAT 3 4 V AVpp 1 Vpp voltage Miller coded 106 kbit s Vrx MaxlVMan Maximum Dynamic Input VBAT 3 4 V AVpp 1 Vpp voltage Manchester 212 and 424 kbit s Coded VmRX Mill Minimum Modulation VBAT 3 4 V 33 96 index 106 kbit s Miller coded VRX 1 5 Vpp SensMiller 3 VnxModMan Minimum modulation VBAT 3 4 V ol 6 mV voltage RxGain 6 and 7 VRXModg Man Minimum modulation VBAT 3 4 V u 18 mV voltage RxGain 4 and 5 VnxModMan Minimum modulation VBAT 3 4 V 120 mV voltage RxGain 0 to 3 1 The minimum modulation voltage is valid for all modulation schemes except Miller coded signals 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 207 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL Vinex Input votage Range Miller Coded Signals AVDD 1V malc Vix ui ra Vnos BO Ve ra Vos
28. Legal information 17 1 Data sheet status Near Field Communication NFC controller CONFIDENTIAL Document status 1 2 Product status Definition Objective short data sheet Development Preliminary short data sheet Qualification Product short data sheet Production This document contains data from the objective specification for product development This document contains data from the preliminary specification This document contains the product specification 1 Please consult the most recently issued document before initiating or completing a design 2 The term short data sheet is explained in section Definitions 3 The product status of device s described in this document may have changed since this document was published and may differ in case of multiple devices The latest product status information is available on the Internet at URL http www nxp com 17 2 Definitions Draft The document is a draft version only The content is still under internal review and subject to formal approval which may result in modifications or additions NXP Semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall have no liability for the consequences of use of such information Short data sheet A short data sheet is an extract from a full data sheet with the same product type number s and title A short data sheet is
29. NFC controller CONFIDENTIAL 8 5 8 PCRregister description 8 5 8 1 CFR register The Clock Frequency Register is used to select the frequency of the CPU and its associated peripherals The clock frequency can be changed dynamically by writing to this register at any time Table 133 PCR CFR register address 6200h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol cpu freq 1 0 Reset 0 0 0 0 0 0 1 0 Access R R R R W R W Table 134 Description of PCR CFR bits Bit Symbol Description 7102 Reserved 1t00 cpu frq 1 0 Select CPU clock frequency cpu frq 1 0 CPU clock frequency 00 27 12 MHz 01 13 56 MHz 10 6 78 MHz 11 27 12 MHz 8 5 8 2 CER register The Clock Enable Register is used to enable or disable the clock of the HSU frequency is fixed at 27 12 MHz The clock can be switched on or off at any time Table 135 PCR CER register address 6201h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol p z hsu enable gt Reset 0 0 0 0 1 Low dq os 0 Access R R R RW R R R Table 136 Description of PCR CER bits Bit Symbol Description 7104 Reserved 3 hsu enable Enable HSU clock When 1 HSU is enabled When 0 HSU is disabled 2100 Reserved 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 93 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC c
30. NRZ L Coded Transfer speed 106 to 424 kbit s ISO IEC 14443B Card PICC 2 PICC to PCD Subcarrier Load modulation BPSK Transfer speed 106 to 424kbit s Fig 30 ISO IEC 14443B Reader Writer communication diagram With appropriate firmware the PN532 can handle the ISO IEC 14443B protocol Table 149 Communication overview for ISO IEC 14443B Reader Writer Communication scheme ISO IEC 14443B Type B higher baud rate Baud rate 106 kbit s 212 kbit s 424 kbit s Bit length s Se 9 4445 ERIE 4 728 Ser 2 361s PN532 to Modulation 8 14 ASK 8 14 ASK 8 1496 ASK PICC Card Bit coding NRZ L NRZ L NRZ L PICC Card to Modulation Subcarrier load Subcarrier load Subcarrier load PN532 modulation modulation modulation Subcarrier 13 56 MHzy 13 56 MHzy 6 18 56 MHz c frequency Bit coding BPSK BPSK BPSK NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 104 of 224 NXP Semiconductors PN532 C1 8 6 4 115432 Near Field Communication NFC controller CONFIDENTIAL ISO IEC 18092 ECMA 340 NFCIP 1 operating mode A NFCIP 1 communication takes place between 2 devices Initiator generates RF field at 13 56 MHz and starts the NFCIP 1 communication Target responds to initiator command either in a load modulation scheme in Passive Communication mode or using a self generated and self modulated RF field for Active Communication mo
31. Oth indicates a bit collision in the 1 bit 08h indicates a bit collision in the 8 bit This bit shall only be interpreted in Passive Communication mode at 106 kbit s or ISO IEC 14443A MIFARE Reader Writer mode if CollPosNotValid is set to logic 0 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 155 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 17 CIU Mode register 6301h Defines general modes for transmitting and receiving Table 206 CIU Mode register address 6301h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol MSBFirst DetectSync TXWaitRF RxWaitRF PolSigin ModeDet CRCPreset Off 1 0 Reset 0 0 EE 04 1 0 1 1 Access RW RW RW PRW R W RW RW RW Table 207 Description of CIU_Mode bits Bit Symbol Description 7 MSBFirst Set to logic 1 the CRC co processor calculates the CRC with MSB first The bit order in the registers CRCResultMSB and the CIU CRCResultLSB is reversed Note During RF communication this bit is ignored 6 DetectSync If set to logic 1 the CIU waits for the FOh byte before the receiver is activated and FOh byte is added as a Sync byte for transmission This bit is only valid for 106 kbit s during NFCIP 1 data exchange protocol In all other modes it shall be set to logic O 5 TXWaitRF Set to logic 1 the transmitter in Reader Writer or Initiator mode for NFCIP
32. Table 287 Description of CIU_RFlevelDet bits 187 Table 288 Standard registers mapping 188 Table 289 SFR registers mapping 191 Table 290 Limiting values llle 194 Table 291 Operating conditions 194 Table 292 Thermal characteristics 194 Table 293 Power management characteristics 195 Table 294 Overcurrent detection characteristics 195 Table 295 Current consumption characteristics 196 Table 296 Antenna presence detection lower levels characteristics 2 220 00000 197 Table 297 Antenna Presence Detection Upper Levels characteristics llle 197 Table 298 Crystal requirements Ls 197 Table 299 Pin characteristics for 27 12 MHz XTAL Oscillator OSCIN OSCOUT 198 Table 300 RSTPD N input pin characteristics 198 Table 301 Input pin characteristics for 10 11 and TESTEN 52 Se hop ated ERE vk 199 Table 302 RSTOUT N output pin characteristics 199 Table 303 Input output pin characteristics for pin P70 IRQ kretene Be cd Soy ee 200 Table 304 Input output pin characteristics for P30 UART_RX P31 UART_TX P32 INTO P33 INT1 0 0 0 ccc eens 201 Table 305 Input output pin characteristics for P34 SIC GUK as ex x alee aot 202 Table 306 Input output pin characteristics for P35 202 Table 307 Input pin characteristics for NSS HSU RX for HSU SPI i
33. The next table lists the baud rates in Debug UART mode 0 Table 53 Baud rates in mode 0 Conditions Min Typ Max Unit foLk 6 78 13 56 27 12 MHz Baud rate 1 13 2 26 4 52 Mb s Mode 2 baud rate In mode 2 the baud rate depends on the value of bit SMOD from the SFR register PCON Baud Rate using mode 2 2 SMOD 2 z Fett The next table lists the baud rates in Debug UART mode 2 Table 54 Baud rates in mode 2 Conditions Min Typ Max Unit foLk 6 78 13 56 27 12 MHz Baud rate SMOD 0 212 424 847 5 kb s Baud rate SMOD 1 424 847 5 1695 kb s NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 35 of 224 NXP Semiconductors PN532 C1 8 1 8 7 8 1 8 8 115432 Near Field Communication NFC controller CONFIDENTIAL Mode 1 and 3 baud rates In modes 1 and 3 the baud rates are determined by the rate of timer1 and timer2 overflow bits t1 ovf and t2 ovf The register bit TCLKO from the register T2CON selects if t1 ovf or t2 ovf should be used as a source when transmitting The register bit RCLKO from the register T2CON selects if t1 ovf or t2 ovf should be used as a source when receiving The timers interrupt should be disabled when used to define the Debug UART baud rates The data rate is also dependant on the value of the bit SMOD from the SFR register PCON If overirate is the equivalent t1 ovf frequency and over2rate is the equivalent t2_ovf
34. Tsp Width of suppressed spikes 20 ns 1 To minimize power consumption when in Soft Power Down mode the limit is PVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V 3 Data at PVDD 1 8V are only given from characterization results Table 310 Input open drain output pin characteristics for SDA for I C interface Symbol Parameter Conditions Min Typ Max Unit Vin High level Input voltage O 0 7 x PVpp PVpp V Vi Low level Input voltage ao 0 3xPVpp V VoL Low level output voltage PVpp 3 V 0 0 3 V lot 4 mA PVpp 1 8 V B 0 0 3 V lo 2 mA li High level input current Vi DVpp 1 1 uA lit Low level input current Vi O0V 1 1 uA li eak Input leakage current RSTPD_N 0 4V 1 1 uA Cin Input Capacitance 2 5 pF Cout Load Capacitance 30 pF Tsp Width of suppressed Out of SPD mode 20 ns spikes In SPD mode 150 ns 1 To minimize power consumption when in Soft Power Down mode the limit is PVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V 3 Data at PVDD 1 8V are only given from characterization results 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 204 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 16 Input output pin characteristics for MISO P71 and SCK P72 Table 311 Input output pin characteristics for MISO P71 and SCK P72
35. automatically In this case the multiple receiving can only be deactivated by writing the Idle command to the CIU Command register or clearing this bit by the 80C51 If set to logic 1 at the end of a received data stream an error byte is added to the FIFO The error byte is a copy of the CIU Error register 1to00 RxFraming 1 0 Defines the expected framing for data reception Value Description 00 ISO IEC 14443A MIFARE and Passive Communication mode 106 kbit s 01 Active communication mode 10 FeliCa and Passive Communication mode at 212 kbit s and 424 kbit s 11 ISO IEC 14443B 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 158 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 20 CIU TxControl register 6304h 115432 Controls the logical behavior of the antenna driver pins TX1 and TX2 See alsoTable 154 on page 113 and Table 155 on page 113 Table 212 CIU TxControl register address 6304h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol InvTx2 InvTx1 InvTx2 InvTx1 Tx2 CheckRF Tx2 Tx1 RFon RFon RFoff RFoff CW RFEn RFEn 0 0 Reset 1 0 0 0 Access R W R W R W R W 0 0 R W Table 213 Description of CIU TxControl bits Bit Symbol Description InvTx2RFon Set to logici and Tx2RFEn set to logic 1 TX2 output signal is inverted InvTx1RFon Setto logici and Tx1RFEn set to logic 1 TX1 output signal is in
36. e the high priority interrupt sources are summarized with CIU IRQ O the low priority interrupt sources are summarized with CIU IRQ 1 See the register Table 190 on page 150 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 130 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Table 165 High priority interrupt sources CIU IRQ 0 Interrupt Flag Interrupt source Set automatically WHEN TxIRq Transmitter a transmitted data stream ends RxIRq Receiver a received data stream ends HiAlertlRq FIFO buffer the FIFO buffer is getting full LoAlertlRq FIFO buffer the FIFO buffer is getting empty Table 166 Low priority interrupt sources CIU IRQ 1 Interrupt Flag Interrupt source Set automatically WHEN TimerlRq Timer Unit the timer counts from 1 to 0 CRCIRq CRC Coprocessor all data from the FIFO buffer have been processed IdlelRq CIU Command a command execution finishes Register RFOnIRq RF Level Detector an external RF field is detected RFOffIRq RF Level Detector a present external RF field is switched off ErrlRq CIU an error is detected ModelRq data mode detector the mode has been detected 8 6 19 CIU Power Reduction Modes 8 6 19 1 Hard Power Down A Hard Power Down is enabled when RSTPD N is low None of the CIU blocks are running even the RF level detector 8 6 19 2 CIU Power down The CIU Power down mode is entered immedia
37. rSLL peAJese siuBu Iv 2002 8 dXN Table 80 1 C Master Transmitter Mode status code Status Status of the I2C Bus Application firmware Response Next Action Taken By the I C interface Hardware Code and of the P ST 7 0 I2C interface Hardware 08h A START condition has been transmitted 10h A repeated START condition has been transmitted 18h SLA W has been transmitted ACK has been received 20h SLA W has been transmitted NOT ACK has been received 28h Write data byte in IICDAT has been transmitted ACK has been received 30h Write data byte in I2CDAT has been transmitted NOT ACK has been received 38h Arbitration lost in SLA R W or Data bytes To from I2CDAT TO PCCON STA STO SI AA Load SLA W Load SLA W Load SLA R Load data byte No I2CDAT action No I2CDAT action No I2CDAT action Load data byte No I CDAT action No I CDAT action No I2CDAT action Load data byte No I2CDAT action No I2CDAT action No I CDAT action Load data byte No I2CDAT action No I2CDAT action No I2CDAT action No I CDAT action No I CDAT action X X X 0 0 X X X x lt SLA W will be transmitted ACK will be received As above SLA W will be transmitted the 12C interface will be switched to MST TRX or REC mode Data byte will be transmitted ACK bit will be received Repeated START will be transmitted STOP condition will be transmitted STO flag will be set to logic 0 STOP c
38. 1 0 0 Access RR R R W R W RW RW R W Table 127 Description of LDO bits Bit Symbol Description 7106 Reserved 5 overcurrent status Set to logic 1 by PN532 when overcurrent is detected The bit IE1 O of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 4103 sel overcurrent 1 0 Select overcurrent threshold 00 300 mA 01 2140 mA 10 180 mA 11 150 mA 2 enoffset Enable of the LDO offset When set to logic 1 offset is present soft highspeedreg Control the LDO regulation speed When set to logic 0 the bandwidth of LDO is reduced to filter bursts on VBAT When set to logic 1 the bandwidth is increased to establish DVDD supply quickly 0 control highspeedreg Select the control source of the LDO regulation speed When set to logic 1 LDO bandwidth controlled by soft highspeedreg When set to logic 0 LDO bandwidth controlled by output of RF level detector When RF is detected bandwidth is reduced 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 87 of 224 NXP Semiconductors PN532 C1 8 4 SVDD switch The SVDD switch is used to control power to the secure IC The switch is controlled by register Control switch rng address 6106h The switch is enabled with bit sic switch en When disabled the SVDD pin is tied to ground A current limiter is incorporated into the switch Current consumption e
39. 1 the SVDD switch is enabled and the SVDD output delivers power to secure IC and internal pads SIGIN SIGOUT and P34 Reserved Forces random number generator into running mode When set to logic 0 random number generator is under control of Contactless Interface Unit When set to logic 1 random number generator is forced to run Indicates availability of random number When set to logic 1 a new random number is available Automatically set to logic 0 when register data rng address 6105h is read Reserved 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 88 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller 8 5 Power clock and reset controller 8 5 1 CONFIDENTIAL The PCR controller is responsible for the clock generation power management and reset mechanism within the PN532 PCR block diagram The block diagram shows the relationship between the PCR other embedded blocks and external signals I CLOCK CLK PCR intO 2 OSC 27 12 Y PC R registers P32_INTO ill P33 INT1 POWER SEQUENCER NI GPIRQ OSC_CLK27 state machine RSTOUT_N Host HSU_CLK RSTPD N Sees HSU_ON SPI_ON 12C_ON Power On DVDD Reset POR RF DETECT Contactless Interface Unit Power management PCR block diagram Table 130 PN532 clock source characteristics
40. 1 can only be started if an own RF field is generated i e Tx1RFEn and or Tx2RFen is set to logic 1 4 RxWaitRF Set to logic 1 the counter for RxWait starts only if an external RF field is detected in Target mode for NFCIP 1 or in Card Operating mode 3 PolSigin PolSigin defines the polarity of the SIGIN pin Set to logic 1 the polarity of SIGIN pin is active high Set to logic 0 the polarity of SIGIN pin is active low Note The internal envelope signal is coded active low Note Changing this bit will generate a SiginActlrq event 2 ModeDetOff Set to logic 1 the internal Data Mode Detector is switched off Note The Data Mode Detector is only active during the AutoColl command 1t00 CRCPreset 1 0 Defines the preset value for the CRC co processor for the CalCRC command Note During any communication the preset values is selected automatically according to the mode definition in the CIU RxMode and CIU TxMode registers Value Description 00 00 00 01 63 63 10 A6 71 11 FF FF 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 156 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 18 CIU TxMode register 6302h Defines the transmission data rate and framing during transmission Table 208 CIU TxMode register address 6302h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TxCRCEn TxSpeed 2 0 InvMod TxMix TxFramin
41. 14443A MIFARE card operating mode With appropriate firmware the PN532 can handle the ISO IEC 14443A including the level 4 and the MIFARE protocols The following diagram describes the communication at the physical level Table 152 describes the physical parameters 1 PCD to PICC 100 ASK Modified Miller Coded Transfer speed 106 to 424 kbit s ISO IEC 14443A Reader Writer 2 PICC to PCD Subcarrier Load modulation Manchester Coded or BPSK Transfer speed 106 to 424kbit s Card operating mode Fig 34 ISO IEC 14443A MIFARE card operating mode communication diagram Table 152 Communication overview for ISO IEC 14443A MIFARE Card operating mode Communication scheme ISO IEC 14443A MIFARE higher baud rate MIFARE Baud rate 106 kbit s 212 kbit s 424 kbit s Bit length a aE 9 4415 HY 4 72 BE 2 36ps Reader Writer Modulation 100 ASK 10096 ASK 100 ASK to PN532 Bit coding Modified Miller Modified Modified coding Miller coding Miller coding PN532 to Modulation Subcarrier load Subcarrier load Subcarrier load Reader Writer modulation modulation modulation Subcarrier 13 56 MHZ 6 13 56 MHzy 6 13 56 MPZA 6 frequency Bit coding Manchester coding BPSK BPSK 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 109 of 224 NXP Semiconductors PN532 C1 8 6 5 2 8 6 6 115432 Near Field Communication NFC control
42. 20V Input leakage current RSTPD N20 4V Input Capacitance Load Capacitance Width of suppressed Out of SPD mode spikes Width of suppressed In SPD mode spikes 3 Min 0 7 x PVpp 0 0 Typ Max Unit PVpp V 0 3 x PVpp V 0 3 V 0 3 V 1 uA 1 uA 1 uA 2 5 pF 30 pF 20 ns 120 ns 1 To minimize power consumption when in Soft Power Down mode the limit is PVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V 3 Data at PVDD 1 8V are only given from characterization results 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 203 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 15 Input output pin characteristics for MOSI SDA HSU TX Table 309 Input output pin characteristics for MOSI HSU TX for HSU and SPI Interfaces Symbol Parameter Conditions Min Typ Max Unit Vin High level Input voltage O1 0 7 x PVp PVpp V D ViL Low level Input voltage Bl o 0 3xPVp V D VoH HSU TX high level output PVbpp 3 V PVpp 0 4 PVpp V voltage lou 4 mA PVpp 1 8 V BI PVpp 0 4 PVpp V lou 2 mA VoL HSU TX low level output PVpp 3 V 0 0 3 V voltage lol 3 mA li MOSI high level input Vi DVpp 1 1 uA current lit MOSI low level input Vi 20V 1 1 uA current li eak Input leakage current RSTPD N 0 4V 1 1 uA Cin Input Capacitance 2 5 pF Cout Load Capacitance 30 pF
43. 3 3 8 3 3 1 Near Field Communication NFC controller CONFIDENTIAL FIFO manager This block is designed to manage a RAM as a FIFO in order to optimize the data exchange between the CPU and the HOST FIFO manager functional description The RAM used for the FIFO is shared between the SPI and HSU interfaces Indeed these interfaces cannot be used simultaneously The selection of the interface used is done by firmware The FIFO manager block is the common part between the SPI and the HSU interfaces It consists of a Data register a Status register and also some registers to define the characteristics of the FIFO These registers are addressed by the CPU as SFRs The RAM used as a FIFO is divided into two part a receive part and a transmit part This block also manages the possible conflicts existing around the FIFO between the CPU and the interfaces Indeed a request coming from the interface TR reg or ROCV req can be simultaneous with a request to access to the data register coming from the CPU SPI CONTROL SPI DATA CPU DATA FIFO lt Manager HIGH SPEED Ir 3 HSU DATA UART Fig 12 FIFO manager block diagram 9 SFR registers are needed to manage the FIFO manager 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 65 of 224 NXP Semiconductors PN532 C1 8 3 3 2 8 3 3 3 115432 Near Field Communication NFC controller CONFIDENTIAL
44. 8 data bits LSB first a 9th data bit and a stop bit 1 In fact mode 3 is the same as mode 2 in all aspects except the baud rate Transmit as mode 2 the 9th data bit is taken from TB8 of SOCON Receive as mode 2 the 9th data bit is stored into RB8 of SOCON Baud rate depends on overflows of Timer1 or Timer2 The Debug UART initiates transmission and or reception as follows Transmission is initiated in modes 0 1 2 3 by any instruction that uses SOBUF as destination Reception is initiated in mode 0 if RI and REN in SOCON are set to logic 0 and 1 respectively Reception is initiated in modes 1 2 3 by the incoming start bit if REN in SOCON is set to a logic 1 The Debug UART contains 2 SFRs Table 47 Debug UART SFR register list Name Size bytes SFR address Description Access SOCON 1 0098h Control and status register R W SOBUF 1 0099h Transmit and receive buffer R W NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 32 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 8 3 SOCON register The Special Function Register SOCON is the control and status register of the Debug UART This register contains the mode selection bits SM2 SM1 SMO the 9th data bit for transmit and receive TB8 and RB8 and the serial port interrupt bits TI and RI Table 48 Debug UART SOCON register SFR address 98h
45. B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 202 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 14 Input pin characteristics for NSS P50 SCL HSU RX Table 307 Input pin characteristics for NSS HSU RX for HSU SPI interfaces Symbol Vin Vit lin Parameter Conditions High level Input voltage PVpp gt 1 6V Low level Input voltage PVpp gt 1 6V High level input current Vj DVpp Low level input current Vj 20V Input leakage current RSTPD N20 4V Input Capacitance Width of suppressed spikes 1 3 2 0 Min 0 7x PVpp Typ Max Unit 0 3xPVpp V 1 uA 1 uA 1 uA 2 5 pF 20 ns 1 To minimize power consumption when in Soft Power Down mode the limit is PVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V 3 When PVDD is not present it is not possible to define a high level on NSS When using SPI host interface a wake up condition can not be avoided if PVDD is absent Table 308 Input open drain output pin characteristics for P50 SCL for I C interface Symbol Vin ViL VoL liu li lLeak Cin Cout Tsp Tsp Parameter Conditions High level Input voltage Low level Input voltage Low level output voltage PVpp 3 V lo 4 mA PVpp 1 8 V lol 2 mA High level input current Vi DVpp Low level input current Vi
46. CDAT via a buffer on the falling edges of clock pulses on P50_ SCL When the CPU writes to I2CDAT the buffer is loaded with the contents of IICDAT 7 which is the first bit to be transmitted to the SDA line After nine serial clock pulses the eight bits in I2CDAT will have been transmitted to the SDA line and the acknowledge bit will be present in ACK Note that the eight transmitted bits are shifted back into I2 CDAT NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 63 of 224 NXP Semiconductors PN532 C1 8 3 2 10 8 3 2 11 115432 Near Field Communication NFC controller CONFIDENTIAL I CADR register The CPU can read from and write to this 8 bit SFR ICADR is not affected by the I2C interface hardware The content of this register is irrelevant when the I C interface is in a Master mode In the Slave modes the seven most significant bits must be loaded with the microcontroller s own Slave address and if the least significant bit is set to logic 1 the general call address 00h is recognized otherwise it is ignored Table 87 I2CADR register SFR address DBh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol SA 6 0 GC Reset 0 0 o o o o o 0 Access RW RW RW RW RW RW RW RW Table 88 Description of I CADR bits Bit Symbol Description 7to1 SA 6 0 Slave address These bits correspond to the 7 bit Slave address which will be recognized on the incoming data
47. IE1 2 IT1 1 IEO 0 ITO Description Timer1 overflow Set to logic 1 by hardware on a Timer1 overflow The flag is set to logic 0 by the CPU after 2 machine cycles The bit IEO 3 of register IEO see Table 11 on page 17 has to be set to logic 1 to enable the corresponding CPU interrupt Timer1 run control Set by firmware only When set to logic 1 Timer1 is enabled TimerO overflow Set by hardware on a TimerO overflow The flag is set to logic 0 by the CPU after 2 machine cycles The bit IEO 1 of register IEO see Table 11 on page 17 has to be set to logic 1 to enable the corresponding CPU interrupt TimerO run control Set by firmware only When set to logic 1 TimerO is enabled External Interrupt1 event Set to logic 1 by hardware when an external interrupt is detected on P33 INT1 The bit IEO_2 of register IEO see Table 11 on page 17 has to be set to logic 1 to enable the corresponding CPU interrupt External Interrupt1 control Set by firmware only When set to logic 1 Interrupt1 triggers on a falling edge of P33 INT1 When set to logic 0 Interrupt triggers on a low level of P33_INT1 External InterruptO event Set to logic 1 by hardware when an external interrupt is detected on P32 INTO The bit IEO 0 of register IEO see Table 11 on page 17 has to be set to logic 1 to enable the corresponding CPU interrupt External InterruptO control Set by firmware only When set to logic 1 InterruptO trigge
48. IPVpp depends on the overall load at the pins The maximum is given assuming 4mA output current for the I O or output pads ISVpp depends on the overall load on SVpp pad During operation with recommended antenna tuning circuitry the overall current is below 100 mA ISPD and IHPD are the total currents across all supplies with the PN532xA3HN C104 and PN532xA3HN C1 05 The antenna should be tuned not to exceed this current limit the detuning effect when coupling with another device must be taken into account These values are valid when applied the Soft Power Down sequence described in Section 8 5 4 on page 91 and with TESTEN pin connected to DVSS NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 196 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 4 Antenna presence self test thresholds The following values are guaranteed by design Testing is done in production for cases andet ithl 1 0 210b and for andet_ithh 2 0 01 1b The operating range is VBAT voltage above 5V Ambient temperature between 0 and 40 C Table 296 Antenna presence detection lower levels characteristics Symbol Parameter Conditions Min Typ Max Unit landetH Ipypp lower current threshold for andet ithI 1 0 10b 20 37 mA antenna presence detection andet ithI 1 0 11b 27 49 mA Table 297 Antenna Presence Detection Upper Levels charac
49. Itvpp Maximum current in TVDD 0l 150 mA Isvpp Maximum current in SVDD switch 30 mA Vesp Electrostatic discharge voltage VespH ESD Susceptibility Human Body model 1500 Q 100pF 2 0 kV EIA JESD22 A114 D Vespm ESD Susceptibility Machine model 0 75 mH 200 pF 200 V EIA JESD22 A115 A Vespc ESD Susceptibility Charge Device model Field induced model 1 0 kV EIA JESC22 C101 C Tstg Storage temperature 55 150 C Tj Junction temperature 40 125 C 1 The antenna should be tuned not to exceed this current limit the detuning effect when coupling with another device must be taken into account 10 Recommended operating conditions Table 291 Operating conditions Symbol Parameter Conditions Min Typ Max Unit Tamb Ambient Temperature 30 25 85 C VBAT Power Supply Voltage Vsg 0V 2 7 55 V is ei PVpp Supply Voltage for host interface Vss 20V 16 181033 36 V 1 Vss represents DVss TVss1 TVss2 AVss 2 Supply voltage of VBAT below 3 3 V reduces the performance e g the achievable operating distance 3 Itis possible to supply PVDD 0V and to use the PN532 with reduced functionality see Section 8 4 Power management on page 83 11 Thermal characteristics Table 292 Thermal characteristics Symbol Parameter Conditions Min Typ Max Unit Rihj a thermal resistance in free air 37 41 1 K W from junction to ambient with exposed pad soldered on a 4 layer Jedec PCB 0 5 115432 NXP B V
50. LLL 50 8 12 Data memory esses 12 8 3 2 1 I C functional description 50 8 1 2 1 IDATA memory 12 8 3 2 2 Master transmitter mode 51 81 22 XRAM memory 0 seeeceeeee 14 8 8 2 3 Master receiver mode 51 8 1 3 Program memory cian Aiea 15 8 3 2 4 Slave receiver mode 52 8 1 4 PCON module 16 8 8 2 5 Slave transmitter mode 53 Eo e c E 8 3 2 6 IPC wake up mode 0 0 0 eee 53 8 1 5 Interrupt Controller lesus 16 833 27 I2CCON register nonna nananana 54 8 1 5 1 Interrupt vectors 0 00 eee eee 16 8328 l CSTA reaist 57 8 1 5 2 Interrupt enable IEO and IE1 registers 17 8329 I2CDAT Aee al ae eae 63 8 1 5 3 Interrupt prioritization IPO and IP1 registers 18 83210 EAR pue EY 64 8 1 5 4 General purpose IRQ control 20 83211 20 regis T lc ee 64 8 1 6 Timer0 1 description 4 21 eared WU CONIO TEJISIEK cocci ated Nk f 8 3 3 FIFO manager eee eee eee ee 65 8 1 6 1 Timer0 1 registers 0 0 21 B 8 1 6 2 TO1CON register 23 8 3 8 1 FIFO manager functional description 65 MC NL ee 8 3 3 2 RWL register 0 eee ee eee 66 8 1 6 3 TO1MOD register 0004 24 8333 TWL reai 8 1 6 4 TOL and TOH registers sss 25 83 3 d M 66 8 3 3 4 FIFOFS register 0 0000 67 8 1 6 5 TiLandTiHre
51. NoTxSOF 2 NoTxEOF 1t00 TxEGTT 1 0 Description If this bit is set to logic 1 the SOF is required A datastream starting without SOF is ignored If this bit is set to logic 0 a datastream with and without SOF is accepted The SOF will be removed and not written into the FIFO If this bit is set to logic 1 the EOF is required A datastream ending without EOF will generate a protocol error ProtocollErr in the CIU Error register will be set to logic 1 If this bit is set to logic 0 a datastream with and without EOF is accepted The EOF will be removed and not written into the FIFO Reserved If this bit is set to logic 1 the SOF and EOF will have the maximum length defined in the ISO IEC 14443B If this bit is set to logic 0 the SOF and EOF will have the minimum length defined in the ISO IEC 14443B If this bit is set to logic 1 the generation of the SOF is suppressed If this bit is set to logic 1 the generation of the EOF is suppressed These bits define the length of the EGT as defined in the ISO IEC 14443B Value Description 00 0 bit 01 1 bit 10 2 bits 11 3 bits NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 169 of 224 NXP Semiconductors PN532 C1 8 6 23 31 8 6 23 32 115432 Near Field Communication NFC controller CONFIDENTIAL CIU_CRCResultMSB register 6311h Shows the actual MSB values of the CRC calculation Note The CRC is split i
52. Rev 3 2 3 December 2007 43 of 224 NXP Semiconductors PN532 C1 8 2 2 8 2 2 1 8 2 2 2 115432 Near Field Communication NFC controller CONFIDENTIAL GPIO registers description P7CFGA register Table 60 P7CFGA register SFR address F4h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol P7CFGA 2 P7CFGA 1 P7CFGA 0 Rest 1 1 1 1 1 1 Access R R R R R SW RW RW Table 61 Description of P7CFGA bits Bit Symbol Description 7103 Reserved 2 P7CFGA 2 Out of SPI mode and in conjuction with P7CFGB 2 it configures the functional mode of the P72 pin 1 P7CFGA 1 Out of SPI mode and in conjuction with P7CFGB 1 it configures the functional mode of the P71 pin 0 P7CFGA 0 In conjuction with P7CFGB 0 it configures the functional mode of P70 IRQ pin Remark When in Hard power down mode the P72 to P70 IRQ pins are forced in quasi bidirectional mode Referring to Figure 7 en n2 e pu 1 e p 0 Ande hd 1 if P7x pin value is 1 and e hd 0 if P7x pin value is 0 P7CFGB register Table 62 P7CFGB register SFR address F5h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol us P7CFGB 2 P7CFGB t P7CFGB O Reset 0 0 0 0 0 0 0 0 Access R R R R R RW RW RW Table 63 Description of P7CFGB bits Bit Symbol Description 7103 Reserved 2 P7CFGB 2 Out of SPI mode and in conjuction with P7CFGA 2
53. Table 91 Fifo manager SFR register list Name Size SFR Description Access bytes Address RWL 1 9Ah FIFO Receive Waterlevel Controls the threshold of the R W FIFO in reception TWL 1 9Bh FIFO Transmit Waterlevel Controls the threshold of the R W FIFO in transmission FIFOFS 1 9Ch FIFO Transmit FreeSpace Status of the number of R W characters which can still be loaded in the FIFO FIFOFF 1 9Dh FIFO Receive Fullness Status of the number of R W received characters in the FIFO SFF 1 9Eh Global Status Error messages R FIT 1 9Fh Interrupt Source R W FITEN 1 Ath Interrupt Enable and Reset FIFO R FDATA 1 A2h Data reception transmission buffer R W FSIZE 1 A3h Control the size of the FIFO in Reception R W RWL register This register defines the warning level of the Receive FIFO for the CPU It implies a FIFO buffer overflow Table 92 RWL register SFR address 9Ah bit allocation Bit 7 6 5 4 3 2 1 0 Symbol RWaterlevel 7 0 Reet 0 0 0 0 0 0 0 0 Access RW RW RW RW RW RW RW RW Table 93 Description of RWL bits Bit Symbol Description 7100 RWaterlevel 7 0 Overflow threshold of the Receive FIFO to set a warning TWL register This register defines the warning level of the Transmit FIFO for the CPU It implies a FIFO buffer underflow Table 94 TWL register SFR address 9Bh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TWaterlevel 7 0 Reset 0 0 0 0 0 0 0 0 Access RW RW R W R
54. The register bits are used to allow the CPU to monitor the status of the FIFO The primary purpose is to detect completion of data transfers 115432 Near Field Communication NFC controller CONFIDENTIAL Table 100 SFF register SFR address 9Eh bit allocation Bit 7 Symbol FIFO EN Reset 0 Access R W 6 5 4 3 2 1 0 TWLL TFF TFE RWLH RFF RFE 0 1 0 1 0 0 1 R R R R R R R Table 101 Description of SFF bits Bit Symbol 7 FIFO EN TWLL 4 TFF 3 TFE 2 RWLH 1 RFF 0 RFE Description Fifo Enable Set to logic 1 this bit enables the FIFO manager clock CPU CLK Set to logic 0 the clock remains low Reserved Transmit WaterlLevelLow This bit is set to logic 1 when the number of bytes stored into the Transmit FIFO is equal or smaller than the threshold TWaterlevel Transmit FIFO Full This is set to logic 1 if the transmit part of the FIFO is full It is set to logic 0 when a transfer is completed Transmit FIFO Empty This bit indicates when the transmit part of the FIFO is empty It is set to logic O when the CPU writes a character in the data register Receive WaterLevel High This bit is set to logic 1 when the number of bytes stored into the Receive FIFO is greater or equal to the threshold RWaterlevel Receive FIFO Full This bit is set to logic 1 if the receive part of the FIFO is full It is set to logic O by reading the FDATA register Receive FIFO Empty
55. W R W RW RW RW Table 95 Description of TWL bits Bit Symbol Description 7100 TWaterlevel 7 0 Underflow threshold of the Transmit FIFO to set a warning NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 66 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 3 4 FIFOFS register 8 3 3 5 115432 This register indicates the number of bytes that the CPU can still load into the FIFO until the Transmit FIFO is full Table 96 FIFOFS register SFR address 9Ch bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TransmitFreespace 7 0 Rest 0 o o o o0 MEE Access R W RW RW RW RW R W RW RW Table 97 Description of FIFOFS register bits Bit Symbol Description 7100 TransmitFreespace 7 0 Freespace into the FIFO FIFOFF register This register indicates the number of bytes already received and loaded into the Receive FIFO Table 98 FIFOFF register SFR address 9Dh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol ReceiveFullness 7 0 Reset 0 o o o 0 0 0 0 Access RW RW RW RW R W RW RW R W Table 99 Description of FIFOFF bits Bit Symbol Description 7to0 ReceiveFullness 7 0 Number of bytes received in the FIFO NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 67 of 224 NXP Semiconductors PN532 C1 8 3 3 6 SFF register
56. When bit CPU PD is set all clocks are stopped and the LDO is put into Soft Power Down mode Finally the Power Sequencer goes into Stopped state 8 5 5 Low power modes There are 2 different low power modes Hard Power Down mode HPD controlled by the pin RSTPD N The PN532 goes into reset and power consumption is at a minimum see Section 8 5 3 Reset modes Soft Power Down mode SPD controlled by firmware See Section 8 5 4 Soft Power Down mode SPD to optimize the power consumption in this mode Table 131 Current consumption in low power modes Mode Conditions Maximum current consumption Hard Power Down RSTPD Nis set to logic 0 2uA Soft Power Down Sequence of Section 8 5 4 is applied 40 uA with no RF detector Soft Power Down Sequence of Section 8 5 4 is applied 45 uA with RF detector active 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 91 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 5 6 Remote wake up from SPD The PN532 can be woken up from a Soft Power Down mode when an event occurs on one of the wake up sources which has been enabled There are eight wake up sources P32 INTO e P33 INT1 HF field detected RF DETECT e HSU wake up HSU ON e C wake up I2C ON SPI wake up SPI ON NFC WI counters e GPIRQ P34 P35 P50_SCL P71 When one of these signals is asserted if
57. a 3 bit counter which counts on every rising edge of the HSU RX pin When the counter reaches 5 the hsu on signal is set to logic 1 in order to wake up the PN532 This block is useful in Soft Power Down mode The firmware shall reset this counter just before going in Soft Power Down by writing a logic 1 in the hsu wu en bit into the HSU CTR register 8 3 4 5 HSU STA register The SFR HSU STA is the status register of the HSU Table 111 HSU STA register SFR address ABh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol set bit disable irq rx irq rx fer irq rx irq rx fer preamb over en en over Reset 0 0 oO oO O O 0 0 Access RW R R RW RW RW RW RW Table 112 Description of HSU_STA bits Bit Symbol Description 7 set_bit When set to logic 0 during write operation the bits set to logic 1 in the write command are written to logic 0 in the register When set to logic 1 during write operation the bits set to logic 1 in the write command are written to logic 1 in the register 6to5 Reserved 4 disable_preamb Preamble filter disable When set to logic 1 this bit disables the preamble filtering it means that HSU_RxX line transmit any received bytes to the FIFO manager 3 irq_rx_over_en FIFO overflow interrupt enable When set to logic 1 this bit enables the interrupt generation when the bit irq_rx_over is set to logic 1 The bit IE1 5 of register IE1 see Table 13 on page 18 has also to
58. an antenna with minimum number of external components Integrated RF level detector Integrated data mode detector Supports ISO IEC 14443A MIFARE Supports ISO IEC 14443B Reader Writer mode only Typical operating distance in Reader Writer mode for communication to ISO IEC 14443A MIFARE ISO IEC 14443B or FeliCa cards up to 50 mm depending on antenna size and tuning Typical operating distance in NFCIP 1 mode up to 50 mm depending on antenna size tuning and power supply Typical operating distance in ISO IEC 14443A MIFARE or FeliCa card emulation mode of approximately 100 mm depending on antenna size tuning and external field strength Supports MIFARE 1 KB or MIFARE 4 KB emulation encryption in Reader Writer mode and MIFARE higher transfer speed communication at 212 kbit s and 424 kbit s Supports contactless communication according to the FeliCa protocol at 212 kbit s and 424 kbit s Integrated RF interface for NFCIP 1 up to 424 kbit s Possibility to communicate on the RF interface above 424 kbit s using external analog components Supported host interfaces SPI interface 12C interface High speed UART Dedicated host interrupts Low power modes Hard Power Down mode 1 uA typical Soft Power Down mode 22 uA typical Automatic wake up on 1 C HSU and SPI interfaces when device is in Power down mode Programmable timers Crystal oscillator 2 7 to 5 5 V power supply operating range Power switch for extern
59. be configured before entering PRBS9 mode Note The data transmission of the defined sequence is started by the Transmit command Starts and enables the PRBS15 sequence according ITU TO150 Note All relevant register to transmit data have to be configured before entering PRBS15 mode Note The data transmission of the defined sequence is started by the Transmit command Selects the test bus source See Section 8 6 21 2 CIU test bus on page 140 CIU TestPinEn register 6323h Enable the output drivers for the test pins Table 268 CIU TestPinEn register address 6323h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TestPinEn 7 0 Reset 0 0 0 0 0 0 0 0 Access R W R W RW RW RW RW RW RW Table 269 Description of CIU TestPinEn bits Bit Symbol Description 7100 TestPinEn 7 0 Each of the bit enables the output driver for an internal test pin P70_IRQ MSB RSTOUT N P35 P34 SIC CLK P33 INT1 P32 INTO P31 UART TX P30 UART_RX LSB DataEn 7 enables P70_IRQ DataEn 0 enables P30 UART_RX Note The data transmission of the defined sequence is started by the Transmit command NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 181 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 49 CIU TestPinValue register 6324h Defines the values for the 7 bit test bus signa
60. bit allocation Bit 7 6 5 4 3 2 1 0 Symbol ZEE TR_FE RCV_OVR READY Reset 0 O0 0 0 0 0 0 0 Access R R R R R W R W R W R W Table 125 Description of SPlstatus bits Bit Symbol Description 7104 Reserved 3 TR FE Transmit FIFO Empty Set to logic 1 when the host attempts to read a new byte and FIFO manager is empty An interrupt can be generated if enabled see IE1 bit in register SPlcontrol It is set to logic O by firmware 2 RCV OVR Receive Overrun Set to logic 1 when the host attempts to write a new byte and FIFO manager is full or has not yet processed the previous byte An interrupt can be generated if enabled see IEO bit in register SPIcontrol It is set to logic O by firmware 1 Reserved This bit must be set to logic 0 0 READY Ready flag The firmware set READY to logic 1 to inform the host when PN532 is ready to send data NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 82 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 4 Power management 115432 Figure 19 Power management scheme depicts the internal and external power distribution management Power is supplied to the PN532 via pins VBAT and PVDD VBAT is driven by the battery and is used to supply the all blocks excluding the host interface PVDD is connected to the host s power supply and powers the PN532 s host inter
61. bit allocation 47 Description of P3 bits 47 HOST interface selection 48 Config IO 11 register address 6103h bit allocation llle 49 Description of Config IO I1 bits 49 I C register list 0 0 0 0 cece eee ee 50 I2CCON register SFR address D8h bit allocation llle 54 Description of IICCON bits 54 l2CSTA register SFR address D9h bit allocation llle 57 Description of IICSTA bits 57 12C Master Transmitter Mode status code 58 I C Master Receiver Mode status codes 59 I C Slave Receiver Mode status codes 60 I C Slave Transmitter Mode status codes 61 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 217 of 224 NXP Semiconductors PN532 C1 Table 84 12C Miscellaneous status codes 62 Table 85 I2CDAT register SFR address DAh bit allocations 12i cR RR DER pn 63 Table 86 Description of I CDAT bits 63 Table 87 I CADR register SFR address DBh bit allocation 2 224 RMRD IHR 64 Table 88 Description of IICADR bits 64 Table 89 I C wu control register address 610Ah bit allocation is i a ia e Rx RR Ek mnn 64 Table 90 Description of IC wu control bits 64 Table 91 Fifo manager SFR register list 66 Table 92 RWL register SFR address 9Ah bit allocatiori
62. cece eee eee 93 Table 134 Description of PCR CFR bits 93 Table 135 PCR CER register address 6201h bit allocation 000000 cee eee eee 93 Table 136 Description of PCR CER bits 93 Table 137 PCR ILR register address 6202h bit allocation 12 22 leor ibm edad cewek 94 Table 138 Description of PCR ILR bits 94 Table 139 PCR Control register address 6203h bit allocation ee rations 95 Table 140 Description of PCR Control bits 95 Table 141 PCR Status register address 6204h bit allocation sics nena i a cee eee eee eee 95 Table 142 Description of PCR Status bits 96 Table 143 PCR Wakeupen register address 6205h bit allocation 223 2 REPERI 96 Table 144 Description of PCR Wakeupen bits 96 Table 145 Communication overview for ISO IEC 14443A MIFARE Reader Writer 101 Table 146 Communication overview for FeliCa Reader Writer llle 103 Table 147 FeliCa Framing and Coding 103 Table 148 FeliCa framing and coding 103 Table 149 Communication overview for ISO IEC 14443B Reader Writer 0000 eee eeee 104 Table 150 Communication overview for NFC Active Communication mode 106 Table 151 Communication overview for NFC Passive Communication mode 107 Table 152 Communication overview for ISO IEC 14443A MIFARE Card operating mode 109 Table 153 Communication overview
63. characters When set to logic 0 the reception is disabled only after the completion of the current reception O soft reset n HSU Reset When set to logic 0 this bit disables the clock of the HSU_RX control HSU TX control and baud rate generator modules 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 76 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 4 7 HSU PRE register 8 3 4 8 115432 This register is used to configure the baud rate generator prescaler The prescaler enlarges the range of the counter at the cost of a lower resolution The division factor of the prescaler ranges from 1 20 to 256 28 Table 115 HSU PRE register SFR address ADh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol hsu prescaler 7 0 Reset 0 0 0 1 1 0 0 0 Access R W RW RW RW RW RW RW R W Table 116 Description of HSU PRE bits Bit Symbol Description 7100 hsu prescaler 7 0 In conjunction with HSU ONT defines the HSU baud rate Baud rate fok hsu prescaler 1 hsu counter HSU CNT register This register is used to configure the baud rate generator counter Table 117 HSU CNT register SFR address AEh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol hsu_counter 7 0 Reset 0 1 1 1 o o oO 0 Access R W RW RW RW RW RW RW RW Table 118 Description of HSU CNT bits Bit Symbol De
64. digital signal on transfer speeds above 424 kbit s SIGOUT pin can also provide a digital signal that can be used with an additional external circuit to generate transfer speeds at 106 kbit s 212 kbit s 424 kbit s and above Load modulation is usually performed internally by the CIU via TX1 and TX2 However it is possible to use LOADMOD to drive an external circuitry performing load modulation at the antenna see optional circuitry of Figure 51 on page 212 The Serial Data Switch is controlled by the registers CIU_TxSel see Table 217 on page 161 and CIU RxSel see Table 219 on page 162 Serial data switch for driver and loadmod The following figure shows the serial data switch for pins TX1 and TX2 Internal invert if coder INVMOD 1 DriverSel To driver TX1 and TX2 0 gt ModGsN P 1 gt CWGsN P invert if SIGIN POLSIGN 0 Fig 39 Serial data switch for TX1 and TX2 SIGIN is in general only used for secure IC communication If TxMix is set to logic 1 see Table 217 on page 161 the driver pins are simultaneously controlled by SIGIN and the internal coder The following figure shows the serial data switch for the LOADMOD pin NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 120 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL LoadModSel Internal invert if coder INVMO
65. for MIFARE 1 KB or MIFARE 4 KB emulation cards This bit shall be set to logic 0 by firmware 2t00 ModemState 2 0 ModemState shows the state of the transmitter and receiver state machines Value Description 000 Idle 001 Wait for StartSend in CIU BitFraming register 010 TxWait Wait until RF field is present if TxWaitRF is set to logic 1 The minimum time for TxWait is defined by the TxWait register 011 Transmitting 100 RxWait Wait until RF field is present if the bit RxWaitRF is set to logic 1 The minimum time for RxWait is defined by the RxWait register 101 Wait for data 110 Receiving 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 151 of 224 NXP Semiconductors PN532 C1 8 6 23 11 8 6 23 12 115432 Near Field Communication NFC controller CONFIDENTIAL CIU_FIFOData register EAh or 6339h In and output of 64 byte FIFO buffer Table 194 CIU FlFOData register address EAh or 6339h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol FIFOData 7 0 Reset X X X X X X X X Access DY DY DY DY DY DY DY DY Table 195 Description of ClIU_FIFOData bits Bit Symbol Description 7t00 FIFOData 7 0 Data input and output port for the internal 64 bytes FIFO buffer The FIFO buffer acts as parallel in parallel out converter for all data stream in and outputs CIU_FIFOLevel register EBh or 633Ah Indicates the number of bytes stored i
66. for FeliCa Card operating mode 0 eee eee 110 Table 154 Settings for TX1 0 0 0 e ee eee 113 Table 155 Settings for TX2 1 2 20 eee eee 113 Table 156 Setting of the RF level detector 115 Table 157 andet_control register address 610Ch bit allocation 2 24 si paw ewe ye eee pn 117 Table 158 Description of andet control bits 117 Table 159 Data rng register address 6105h bit allocate e ngergani e a D E 118 Table 160 Description of Data rng bits 118 Table 161 Control switch rng register address 6106h bit allocation 2000202 00a 118 Table 162 Description of Control_switch_rng bits 118 Table 163 NFC WI control register address 610Eh bit allocation eee wale al nere 125 Table 164 Description of NFC WI control bits 125 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 218 of 224 NXP Semiconductors PN532 C1 Table 165 High priority interrupt sources CIU IRQ 0 131 Table 166 Low priority interrupt sources CIU IRQ 1 131 Table 167 Command overview 0000 133 Table 168 Transceive command scenario 135 Table 169 Observe testbus register address 6104h bit allocation llle 140 Table 170 Description of Observe testbus bits 140 Table 171 TstBusBitSel setto 07h 140 Table 172 TstBusBitSel set toODh 140 Tab
67. intended for quick reference only and should not be relied upon to contain detailed and full information For detailed and full information see the relevant full data sheet which is available on request via the local NXP Semiconductors sales office In case of any inconsistency or conflict with the short data sheet the full data sheet shall prevail 17 3 Disclaimers General Information in this document is believed to be accurate and reliable However NXP Semiconductors does not give any representations or warranties expressed or implied as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information Right to make changes NXP Semiconductors reserves the right to make changes to information published in this document including without limitation specifications and product descriptions at any time and without notice This document supersedes and replaces all information supplied prior to the publication hereof Suitability for use NXP Semiconductors products are not designed authorized or warranted to be suitable for use in medical military aircraft space or life support equipment nor in applications where failure or malfunction of an NXP Semiconductors product can reasonably be expected to result in personal injury death or severe property or environmental 18 Contact information damage NXP Semiconductors accepts no liability for inclusion and or use
68. interrupts 13 006Bh Reserved 14 0073h General Purpose IRQ Lowest 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 16 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 5 2 Interrupt enable IEO and IE1 registers Each interrupt source can be individually enabled or disabled by setting a bit in IEO or IE1 In register IEO a global interrupt enable bit can be set to logic 0 to disable all interrupts at once The 2 following tables describe IEO Table 10 Interrupt controller IEO register SFR address A8h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol IEO 7 IEO 6 IEO 5 IEO 4 IEO 3 IEO2 E01 IEO0 Reset 0 0 0 0 oO 0 0 0 Access RW RW RW RW RW RW RW RW Table 11 Description of IEO bits Bit Symbol Description 7 IEO 7 Global interrupt enable When set to logic 1 the interrupts can be enabled When set to logic 0 all the interrupts are disabled 6 IEO 6 NFC WI counter interrupt enable When set to logic 1 NFC WI interrupt is enabled See Table 164 on page 125 5 IEO 5 Timer2 interrupt enable When set to logic 1 Timer2 interrupt is enabled See Table 36 on page 28 4 IEO 4 Debug UART interrupt enable When set to logic 1 Debug UART interrupt is enabled See Table 49 on page 33 3 IEO 3 Timer1 interrupt enable When set to logic 1 Timer1 interrupt is enabled See Table 23 on page 23 2 IEO 2
69. its corresponding enable bit is set see Table 144 on page 96 the Power Sequencer starts the wake up sequence The wake up event can only be serviced if the Power Sequencer is in the Stopped state which means the PN532 is fully entered in Soft Power Down mode Figure 25 illustrates the wake up mechanism using an event on P33_INT1 as an example CPU CLK is active T1 after the falling edge of P33_INT1 and the PN532 is ready T1 depends on the choice of crystal oscillator and its layout For devices such as TAS 3225A TAS 7 or KSS2F T1 is a maximum of 2ms Exit from the Power down mode is signaled by CPU_PD going low one clock cycle later P33_INT1 E if active low osez SU UU UU UU UU UU UU UU UU HUI CPU_CLK UIT T CPU PD Fig 25 Remote wake up from Power down with P33 as wake up source 8 5 7 PCR extension registers 115432 The PCR is controlled via several registers given in Table 132 Table 132 PCR registers Name Size bytes Address offset Description Reset R W CFR 1 6200h Clock Frequency Register 02 R W CER 1 6201h Clock Enable Register OE R W ILR 1 6202h Interrupt Level Register 40 R W Control 1 6203h Control CO R W Status 1 6204h Status 00 R Wakeupen 1 6205h Wake up Enable 00 R W NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 92 of 224 NXP Semiconductors PN532 C1 Near Field Communication
70. logic 0 Read data byte 1 1 0 X STOP condition followed by a START condition will be transmitted STO flag will be set to logic 0 IVLLN3GIJNOO 49 04 U09 54N uoneoiunuiuo pjarJ Je9N LO c SNd SJ0 onpuooliulesS dXN 1002 1equie2eg z eg 1eeus ejep jonpoud vec 10 09 e rSLL peAJese siuBu Ily 2002 8 dXN Table 82 I C Slave Receiver Mode status codes Status Status of the I2C Bus and Code the l C interface Hardware ST 7 0 60h Own SLA W has been received ACK has been returned Arbitration lost in SLA R W as Master Own SLA W has been received ACK returned 68h 70h General call address 00h has been received ACK has been returned Arbitration lost in SLA R W as Master General call address has been received ACK has been returned 78h 80h Previously addressed with own SLA Write data byte has been received ACK has been returned 88h Previously addressed with own SLA Write data byte has been received NOT ACK has been returned 90h Previously addressed with General Call Write data byte has been received ACK has been returned Application firmware Response To from I2CDAT TO PCCON STA STO SI AA No I2CDAT action X 0 No I2CDAT action X 0 No I2CDAT action X No I2CDAT action x No I2CDAT action X No I2CDAT action X No I2CDAT action X No I2CDAT action X Read data byte X Read data byte X Read data byte 0 0 Read data byt
71. of NXP Semiconductors products in such equipment or applications and therefore such inclusion and or use is at the customer s own risk Applications Applications that are described herein for any of these products are for illustrative purposes only NXP Semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification Limiting values Stress above one or more limiting values as defined in the Absolute Maximum Ratings System of IEC 60134 may cause permanent damage to the device Limiting values are stress ratings only and operation of the device at these or any other conditions above those given in the Characteristics sections of this document is not implied Exposure to limiting values for extended periods may affect device reliability Terms and conditions of sale NXP Semiconductors products are sold subject to the general terms and conditions of commercial sale as published at http www nxp com profile terms including those pertaining to warranty intellectual property rights infringement and limitation of liability unless explicitly otherwise agreed to in writing by NXP Semiconductors In case of any inconsistency or conflict between information in this document and such terms and conditions the latter will prevail No offer to sell or license Nothing in this document may be interpreted or construed as an offer to sell products that is
72. on the pad is at the supply voltage divided by 2 zi goes to logic 1 the pull up e hd is ON e hdis an asynchronous signal The maximum currents that can be sourced by the e pu transistor is 80 mA and 500 mA by e hd transistor NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 41 of 224 NXP Semiconductors PN532 C1 8 2 1 3 115432 Near Field Communication NFC controller CONFIDENTIAL Input PxCFGA n 0 PxCFGB n 1 Control BH ae GPIO pad 417 CPU CLK input mode CPU CLK GPIO pad Zi Read Px n Fig 8 Input In input configuration no pull up or hold resistor are internally connected to the pad NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 42 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 2 1 4 Push pull output 115432 DVDD Control e pu gt PxCFGA n 1 PxCFGB n 1 GPIO pad Px n a CPU CLK output mode ceuak J LT O LE UL Write Px n en n e p GPIO pad d un zi Fig 9 Push pull output In push pull output the output pin drives a strong logic 0 or a logic 1 continuously It is possible to read back the pin output value NXP B V 2007 All rights reserved Product data sheet
73. only be set to logic 1 if the Miller pauses length expected are less than 400 ns At 106 kbit s the Miller pauses duration is around 3 us 5 DelayMF SO If this bit is set to logic 1 when SigoutSel 1100b register 6306h the Signal at SIGOUT pin is delayed according the delay defined by TxBitPhase 6 0 register 6315h and TxWait bits register 630Ch Note In ISO IEC 14443A MIFARE Card MIFARE 1 KB or MIFARE 4 KB emulation Virtual Card mode DriverSel 10b and SigoutSel 1 110b the Signal at SIGIN must then be 128 fc faster compared to the ISO IEC 14443A restrictions on the RF Field for the Frame Delay Time Note This delay shall only be activated for setting bits SigOutSel to 1110b or 1111b in register CIU_TxSel If this bit is set to logic 0 the SIGOUT pin delay is not adjustable Note In ISO IEC 14443A MIFARE Card MIFARE 1 KB or MIFARE 4 KB emulation Virtual Card mode DriverSel 10b and SigoutSel 1 110b the ISO IEC 14443A restrictions on the RF Field for the Frame Delay Time should be adjusted on the secure IC side 4 ParityDisable If this bit is set to logic 1 the generation of the Parity bit for transmission and the parity check for receiving is switched off The received parity bit is handled like a data bit 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 167 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL T
74. open for acceptance or the grant conveyance or implication of any license under any copyrights patents or other industrial or intellectual property rights Quick reference data The Quick reference data is an extract of the product data given in the Limiting values and Characteristics sections of this document and as such is not complete exhaustive or legally binding 17 4 Trademarks Notice All referenced brands product names service names and trademarks are the property of their respective owners MIFARE is a trademark of NXP B V For additional information please visit http www nxp com For sales office addresses send an email to salesaddresses nxp com 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 216 of 224 NXP Semiconductors PN532 C1 19 Tables Table 1 Quick reference data 000 4 Table 2 Ordering information 05 5 Table 3 PN532Pin description 8 Table 4 IDATA memory addressing 12 Table 5 SFR map of NFC controller 13 Table 6 Peripheral mapping into XRAM memory Sp E cncaro um Re R4 e ehe ER ed dees 14 Table 7 PCON register SFR address 87h bit allocation 200000 eae 16 Table 8 Description of PCON bits 16 Table 9 Interruptvector 00 eee 16 Table 10 Interrupt controller IEO register SFR
75. possible Slave action is not interrupted If bus arbitration is lost in the Master mode the 12C interface switches to the Slave mode immediately and can detect its own Slave address in the same serial transfer Master transmitter mode As a Master the I C logic will generate all of the serial clock pulses and the START and STOP conditions A transfer is ended with a STOP condition or with a repeated START condition Since a repeated START condition is also the beginning of the next serial transfer the I2C bus will not be released 12C data are output through SDA while P50_SCL outputs the serial clock The first byte transmitted contains the Slave address of the receiving device 7 bit SLA and the data direction bit In this case the data direction bit R W will be a logic 0 W 12C data are transmitted 8 bits at a time After each byte is transmitted an acknowledge bit is received START and STOP conditions are output to indicate the beginning and the end of a serial transfer In the Master transmitter mode a number of data bytes can be transmitted to the Slave receiver Before the Master transmitter mode can be entered IICCON must be initialized with the ENS1 bit set to logic 1 and the STA STO and SI bits set to logic 0 ENS1 must be set to logic 1 to enable the 12C interface If the AA bit is set to logic 0 the I C interface will not acknowledge its own Slave address or the general call address if they are present on the bus Thi
76. same transfer speed Host PN532 NFC Target Power for digital processing PN532 NFC Target Power for digital processing The following table gives an overview of the active communication modes Table 151 Communication overview for NFC Passive Communication mode Communication scheme ISO IEC 18092 ECMA 340 NFCIP 1 Baud rate 106 kbit s 212 kbit s 424 kbit s Bit length 128 64 32 mome e ERE CU memme PN532 to Modulation 10096 ASK 100 ASK 100 ASK PICC Card Bit coding Modified Miller Modified Modified coding Miller coding Miller coding PICC Card to Modulation Subcarrier load gt 12 ASK gt 12 ASK PN532 modulation Subcarrier 13 56 MHz4g No subcarrier No subcarrier frequency Bit coding Manchester coding Manchester coding Manchester coding 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 107 of 224 NXP Semiconductors PN532 C1 8 6 4 3 8 6 4 4 115432 Near Field Communication NFC controller CONFIDENTIAL NFCIP 1 framing and coding The NFCIP 1 framing and coding in Active and Passive communication modes are defined in the NFCIP 1 standard ISO IEC 18092 or ECMA 340 NFCIP 1 protocol support The NFCIP 1 protocol is not completely described in this document For detailed explanation of the protocol refer to the ISO IEC 18092 ECMA340 NFCIP 1 standard However the datalink layer is according to th
77. stream from the 12C bus When the Slave address is detected and the interface is enabled a serial interrupt SI will be generated to the CPU 0 GC General call When set to logic 1 will cause the 12C logic to watch for the general call address to be transmitted on the I C bus If a general call address is detected and this bit is set to logic 1 SI will be set to logic 1 I C wu control register The wake up block has to be enabled before the whole chip enters in Soft Power Down mode The choice of the wake up conditions is made within the register I amp C wu control Read and Write conditions can be set together Table 89 C wu control register address 610Ah bit allocation Bit 7 6 5 4 3 2 1 0 Symbol i c wu en wr i c wu en rd i c wu en Reset 0 0 0 0 0 0 0 0 Access R RR R R R W R W R W Table 90 Description of IC wu control bits Bit Symbol Description 7103 E Reserved 2 i c wu en wr When set to logic 1 the wake up is valid for write commands 1 i c wu en rd When set to logic 1 the wake up is valid for read commands 0 i c wu en When set to logic 1 enable the 12C wake up conditions The bit i c wu en of register PCR Wakeupen see Table 144 on page 96 has also to be set to logic 1 to enable the corresponding PN532 wake up NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 64 of 224 NXP Semiconductors PN532 C1 8
78. the RF field off interrupt request indicated by bit RfOfflRq to be propagated to CIU IRQ 0 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 146 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 6 CIU Commirq register D4h or 6334h 115432 Contains common CIU interrupt request flags Table 184 CIU Commirq register address D4h or 6334h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol Seti TxlRq RxIRq ldlelrq HiAltertIRq LoAlertlRq ErrlRq TimerlRq Rest 0 0 o 1 0 1 0 0 Access W DY DY DY DY DY DY DY Table 185 Description of CIU CommlIRQ bits Bit Symbol Description 7 Seti When set to logic 0 during write operation the bit set to logic 1 in the write command are written to logic 0 in the register When set to logic 1 during write operation the bit set to logic 1 in the write command are written to logic 1 in the register TxIRq Set to logic 1 immediately after the last bit of the transmitted data was sent out RxIRq Set to logic 1 when the receiver detects the end of a valid datastream If the RxNoErr bit in CIU_RxMode register is set to logic 1 RxIRQ is only set to logic 1 when data bytes are available in the FIFO 4 Idlelrq Set to logic 1 when a command terminates by itself e g when the CIU Command register changes its value from any command to the Idle command If an unknown command i
79. to an interrupt service routine and the appropriate action to be taken for each of the status codes is detailed in Table 82 on page 60 The Slave receiver mode may also be entered if arbitration is lost while the I C interface is in the Master mode If the AA bit is set to logic O during a transfer the 12C interface will return a not acknowledge logic 1 to SDA after the next received data byte While AA is set to logic 0 the I C interface does not respond to its own Slave address or a general call address However the I C bus is still monitored and address recognition may be resumed at any time by setting AA This means that the AA bit may be used to temporarily isolate the 12C interface from the I C bus NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 52 of 224 NXP Semiconductors PN532 C1 8 3 2 5 8 3 2 6 115432 Near Field Communication NFC controller CONFIDENTIAL Slave transmitter mode The first byte is received and handled as in the Slave receiver mode However in this mode the direction bit will indicate that the transfer direction is reversed 1 C data are transmitted via SDA while the serial clock is input through P50_SCL START and STOP conditions are recognized as the beginning and end of a serial transfer In the Slave transmitter mode a number of data bytes are transmitted to a Master receiver Data transfer is initialized as in the Slave receiver mode When I2C
80. to logic 1 The first bit to be transmitted is the MSB bit 7 and after a byte has been received the first bit of received data is located at the MSB of I2CDAT While data is being shifted out data on the bus is simultaneously being shifted in IICDAT always contains the last data byte present on the bus Thus in the event of lost arbitration the transition from Master Transmitter to Slave Receiver is made with the correct data in I2 CDAT Table 85 I2CDAT register SFR address DAh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol I2CDAT 7 0 Rest o 0 o o o o o o0 Access RW RW RW RW R W RW RW RW Table 86 Description of I2CDAT bits Bit Symbol Description 7100 I2CDAT 7 0 I C data Eight bits to be transmitted or just received A logic 1 in I CDAT corresponds to a logic 1 on the I2C bus and a logic 0 corresponds to a logic 0 on the bus I C data shift through I2CDAT from right to left I CDAT 7 0 and the ACK flag form a 9 bit shift register which shifts in or shifts out an 8 bit byte followed by an acknowledge bit The ACK flag is controlled by the 12C interface hardware and cannot be accessed by the CPU 12C data are shifted through the ACK flag into ICDAT on the rising edges of clock pulses on P50_SCL When a byte has been shifted into I CDAT the I C data are available in IICDAT and the acknowledge bit is returned by the control logic during the ninth clock pulse 12C data are shifted out from I
81. vmid 13 56MHz carrer ov Manchester Coded Signals v Input vorago Range AVDDeIV Vaman vmid 13 58MHz carrier Fig 47 RX Voltage definitions 12 21 Output pin characteristics for AUX1 AUX2 Table 316 Output pin characteristics for AUX1 AUX2 Symbol Parameter Conditions Min Typ Max Unit Vou High level output voltage VBAT 3 4 V DVpp 0 4 DVpp V lon 4 mA VoL Low level output voltage VBAT 3 4 V DVss DVss 0 4 V lot 4mA lLeak Input leakage current RSTPD_N 0V 1 1 uA Cin Input Capacitance 2 5 pF Cout Load Capacitance 15 pF 12 22 Output pin characteristics for TX1 TX2 Table 317 Output pin characteristics for TX1 TX2 Symbol Parameter Conditions Min Typ Max Unit Vou C32 3 V High level output voltage VBAT 3 4 V TVpp 150 mV Itx1 2 32 mA CWGsP 5 0 3Fh Vou C80 3 V High level output voltage VBAT 23 4 V TVpp 400 mV Itx1 2 80 mA CWGsP 5 0 3Fh VoL C32 3 V Low level output voltage VBAT 3 4 V 150 mV Itx1 2 32 mA CWGSN 3 0 Fh Voi C80 3 V Low level output voltage VBAT 3 4 V 400 mV Itx1 2 80 mA CWGsN 8 0 Fh NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 208 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 23 Timing for Reset and Hard Power Down VBAT RSTPD N pd d Tresetpon l Thpd n a pe Tresetrstpd
82. 0 139 CIU self test 000000055 139 CIU test bus 2 0 eee eee 140 Test signals at pin AUX 141 PRBS eide ea eh bleed 141 CIU memory map sssseseseeees 142 CIU register description 144 CIU register bit behavior 144 CIU SIC CLK en register 6330h 144 CIU Command register D1h or 6331h 145 CIU CommlEn register D2h or 6332h 146 CIU DivIEn register D3h or 6333h 146 CIU Commlirg register D4h or 6334h 147 CIU_Divirq register D5h or 6335h 148 CIU Error register D6h or 6336h 149 CIU Status1 register DFh or 6337h 150 CIU Status2 register E9h or 6338h 151 CIU FIFOData register EAh or 6339h 152 CIU FlFOLevel register EBh or 633Ah 152 CIU WaterL evel register ECh or 633Bh 153 CIU Control register EDh or 633Ch 153 CIU BitFraming register EEh or 633Dh 154 CIU Coll register EFh or 633Eh 155 CIU Mode register 6301h 156 CIU TxMode register 6302h 157 CIU RxMode register 6303h 158 CIU TxControl register 6304h 159 CIU TxAuto register 6305h 160 CIU TxSel register 6306h 161 CIU RxSel register 6307h 162 CIU RxThreshold register 6308h 163 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 223 of 224 NXP Semiconductors PN532
83. 1 The CRC coprocessor sets the flag CRCIRq in the register CIU Divlrg after having processed all data from the FIFO buffer This is indicated by the flag CRCReady set to logic 1 The RxIRq flag in the register CIU Commlrq indicates an interrupt when the end of the received data is detected The flag IdlelRq in the register CIU Commlrq is set to logic 1 if a command finishes and the content of the CIU Command register changes to idle The flag HiAlertlRq in the register CIU_Commlrq is set to logic 1 if the HiAlert bit is set to logic 1 that means the Contactless FIFO buffer has reached the level indicated by the bits WaterL evel 5 0 The flag LoAlertlRg in the register CIU Commlrg is set to logic 1 if the LoAlert bit is set to logic 1 that means the Contactless FIFO buffer has reached the level indicated by the bits WaterL evel 5 0 The flag RFOnIRq in the register CIU_Divirq is set to logic 1 when the RF level detector detects an external RF field The flag RFOffIRq in the register CIU Divlrq is set to logic 1 when a present external RF field is switched off The flag ErrlRq in the register CIU_CommIrq indicates an error detected by the CIU during sending or receiving This is indicated by any bit set to logic 1 in register CIU Error The flag ModelRq in the register CIU Divlrq indicates that the data mode detector has detected the current mode These flags are summarized with 2 interrupt bits within the register CIU_Status1
84. 1 in the CIU AnalogTest register CIU TestADC register 632Bh Shows the actual value of ADC and Q channel Table 284 CIU TestADC register address 632Bh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol ADC 3 0 ADC Q 8 0 Reset X X X X X X X X Access R RH R HR R R R R Table 285 Description of CIU TestADC bits Bit Symbol Description 7104 ADO I 3 0 Shows the actual value of ADC channel 3to0 ADC Q S 0 Shows the actual value of ADC Q channel NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 186 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 57 CIU RFlevelDet register 632Fh Power down of the RF level detector Table 286 CIU RFlevelDet register address 632Fh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol pd rflvidet Reset 0 0 0 0 0 0 0 0 Access R W R W R W R W R W R W R W R W Table 287 Description of CIU RFlevelDet bits Bit Symbol Description 7105 Reserved These bits must be set to logic 0 4 pd rfleveldet Power down of the RF level detector When set to logic 1 the RF level detector is in power down mode 3to0 Reserved These bits must be set to logic 0 115432 8 7 Registers map NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 187 of 224 100z 1equie2eg z eg 1eeu
85. 11 TstBusBit as defined by the TestBusBitSel bit of this register 5to4 SICclksel 1 0 Defines the source for the 13 56 MHz secure IC clock Value Description 00 GND secure IC clock is switched off 01 Clock derivated by the internal oscillator 10 Internal CIU clock 11 Clock derivated from the RF Field 3 SICCIkD1 Set to logic 1 the secure IC clock is delivered to P31 UART_TX if the observe_ciu bit is set to logic 1 2to0 TstBusBitSel 2 0 Select the TstBusBit from the test bus NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 180 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 47 CIU_TestSel2 register 6322h General test signal configuration and PRBS control 8 6 23 48 115432 Table 266 CIU TestSel2 register address 6322h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TstBusFlip PRBS9 PRBS15 TstBusSel 4 0 Reset 0 0 0 o o o o 0 Access RW RW R W RW RW RW RW RW Table 267 Description of CIU TestSel2 bits Bit Symbol 7 TstBusFlip 6 PRBS9 5 PRBS15 4to0 TstBusSel 4 0 Description If set to logic 1 the internal test bus D6 DO is mapped to the external test bus pins by the following order D4 D3 D2 D6 D5 DO D1 See Section 8 6 21 2 CIU test bus on page 140 Starts and enables the PRBS9 sequence according ITU TO150 Note All relevant register to transmit data have to
86. 2007 70 of 224 NXP Semiconductors PN532 C1 8 3 3 9 8 3 3 10 115432 Near Field Communication NFC controller CONFIDENTIAL FDATA register The FDATA register is used to provide the transmitted and received data bytes Each data written in the data register is pushed into the Transmit FIFO Each data read from the data register is popped from the Receive FIFO Table 106 FDATA register SFR address A2h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol FDATA 7 0 Reset 0 0 0 0 0 0 0 0 Access RW RIW R W R W R W R W R W R W Table 107 Description of FDATA bits Bit Symbol Description 7100 FDATA 7 0 Writing to FDATA writes to the transmit buffer Reading from FDATA reads from the receive buffer FSIZE register This register defines the size of the Receive FIFO The maximum size is 182 bytes The free space not used by the Receive FIFO in the RAM will be allocated to Transmit FIFO Table 108 FSIZE register SFR address A3h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol ReceiveSize 7 0 Reset o o o o o o o o Access ORW RW RW RW RW RW RW RW Table 109 Description of FSIZE bits Bit Symbol Description 7t00 ReceiveSize 7 0 Size of the Receive FIFO NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 71 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 4 HIGH SPEED UART HS
87. 2L register SFR address CAh bit allocation 00000 eee 30 Description of RCAP2L bits 30 Timer2 RCAP2H register SFR address CBh bit allocation llli 30 Description of RCAP2H bits 30 Debug UART SFR register list 32 Debug UART SOCON register SFR address 98h bit allocation llli 33 Description of SOCON bits 33 Debug UART modes 34 Debug UART SOBUF Register SFR address 99h bit allocation 35 Description of SOBUF bits 35 Baud rates in mode 0 illsuusn 35 Baud rates in mode 2 illus 35 Trigger select 20 0 eee eee eee 36 Maximum baud rates using mode 2 of Timer1 37 Baud rates using mode 2 of Timer1 with fc 2 42 MHZ owiehe ERR SS 37 Maximum baud rates using Timer2 38 Timer0 1 Special Function registers List 39 P7CFGA register SFR address F4h bit allocation soars saiae oniri iaga eea 44 Description of P7CFGA bits P7CFGB register SFR address F5h bit allocation 22 ns REIR ERI 44 Description of P7CFGB bits P7 register SFR address F7h bit allocation 45 Description of P7 bits P3CFGA register SFR address FCh bit allocation 0000 cee eee eee eee 45 Description of PSCFGA bits P3CFGB register SFR address FDh bit allocation 0000 ccc ee eee ee 46 Description of PSCFGB bits P3 register SFR address BOh
88. 4 TVDD 5 TX2 6 TVSS2 7 AVDD 8 VMID 9 RX 10 AVSS 11 AUX1 12 AUX2 13 OSCIN 14 OSCOUT 15 lo 16 H 17 TESTEN 18 P35 19 N C 20 N C 21 N C 22 PVDD 23 P30 24 UART_RX P70 IRQ 25 RSTOUT N 26 NSS 27 P50 SCL HSU RX MOSI 28 SDA HSU TX MISO P71 29 PWR O PWR O PWR PWR PWR Voltage DVDD TVDD TVDD AVDD AVDD AVDD AVDD AVDD AVDD DVDD DVDD DVDD DVDD PVDD PVDD PVDD PVDD PVDD PVDD Description Digital ground Load modulation signal Transmitter ground Transmitter output 1 transmits modulated 13 56 MHz energy carrier Transmitter power supply Transmitter output 2 transmits modulated 13 56 MHz energy carrier Transmitter ground Analog power supply Internally generated reference voltage to bias the receiving path Receiver input Analog ground Auxiliary output 1 analog and digital test signals Auxiliary output 2 analog and digital test signals Crystal oscillator input to oscillator inverting amplifier Crystal oscillator output from oscillator inverting amplifier Host interface selector 0 Host interface selector 1 Reserved for test connect to ground for normal operation General purpose IO Not connected Not connected Not connected Pad power supply General purpose IO Debug UART receive input General purpose IO Can be used as Interrupt request to host Reset indicator when low circuit is in reset state Host interface p
89. 4 on page 180 1 Current output The use of 1 KQ pull down resistor on AUX1 is recommended 2 Current output The use of 1 KO pull down resistor on AUX2 is recommended NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 185 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 54 CIU_TestDAC1 register 6329h 8 6 23 55 8 6 23 56 115432 Defines the test value for TestDAC1 Table 280 CIU TestDAC1 register address 6329h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol n TestDAC1 5 0 Reset o x X x x x x Access R R RW RW RW RW RW RW Table 281 Description of CIU TestDAC1 bits Bit Symbol Description 7106 Reserved 5to0 TestDAC1 5 0 Defines the test value for TestDAC1 The output of the DAC1 can be switched to AUX1 by setting AnalogSelAux1 to 0001 in the CIU AnalogTest register CIU TestDAC2 register 632Ah Defines the test value for TestDAC2 Table 282 CIU_TestDAC2 register address 632Ah bit allocation Bit 7 6 5 4 3 2 1 0 Symbol s AN TestDAC2 6 0 Reset 0 0 x x x x x x Access R R O RW RW R W RW RW R W Table 283 Description of CIU_TestDAC2 bits Bit Symbol Description 7106 Reserved 5to0 TestDAC2 6 0 Defines the test value for TestDAC2 The output of the DAC2 can be switched to AUX2 by setting AnalogSelAux2 to 000
90. 532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 15 CIU_BitFraming register EEh or 633Dh Adjustments for bit oriented frames 115432 Table 202 CIU BitFraming register address EEh or 633Dh bit allocation Bit 7 Symbol StartSend Reset 0 Access W 6 5 4 3 2 1 0 RxAlign 2 0 TxLastBits 2 0 o o o o 0 0 0 RW RW RW RH RW RW RW Table 203 Description of CIU BitFraming bits Bit 7 6 to 4 3 2to0 Symbol StartSend RxAlign 2 0 TxLastBits 2 0 Description Set to logic 1 the transmission of data starts This bit is only valid in combination with the Transceive command Used for reception of bit oriented frames RxAlign 2 0 defines the bit position for the first received bit to be stored in the FIFO Further received bits are stored in the following bit positions Example RxAlign 2 0 0 The LSB of the received bit is stored at bit 0 the second received bit is stored at bit position 1 RxAlign 2 0 1 The LSB of the received bit is stored at bit 1 the second received bit is stored at bit position 2 RxAlign 2 0 7 The LSB of the received bit is stored at bit 7 the second received bit is stored in the following byte at bit position 0 These bits shall only be used for bitwise anticollision at 106 kbit s in Passive Communication or Reader Writer mode In all other modes it shall be set to logic 0 Reserved Used for transmission of b
91. 6 12 18 Output pin characteristics for SIGOUT 206 8 6 23 40 CIU TMode register 631Ah 177 12 19 Output pin characteristics for LOADMOD 206 8 6 23 41 CIU TPrescaler register 631Bh 178 12 20 Input pin characteristics for RX 207 8 6 23 42 CIU TReload hi register 681Ch 178 12 21 Output pin characteristics for AUX1 AUX2 208 8 6 23 43 CIU TReloadVal lo register 631Dh 179 12 22 Output pin characteristics for TX1 TX2 208 8 6 23 44 CIU TCounterVal hi register 681Eh 179 12 23 Timing for Reset and Hard Power Down 209 8 6 23 45 Register CIU TCounterVal lo 631Fh 179 12 24 Timing for the SPI compatible interface 210 8 6 23 46 CIU TestSel1 register 6321h 180 12 25 Timing for the 12C interface 211 8 6 23 47 CIU TestSel2 register 6322h Puck x Mr dang 181 13 Application information 212 8 6 23 48 CIU TestPinEn register 6323h 181 8 6 23 49 CIU TestPinValue register 6824h 182 b ea T E 2 8 6 23 50 CIU TestBus register 6325h 182 af ud DD ME 8 6 23 51 CIU AutoTest register 6326h 183 16 Revision history 215 8 6 23 52 CIU Version register 6327h 183 17 Legal information 216 8 6 23 53 CIU_AnalogTest register 6328h 184 17 1 Data sheet status 216 8 6 23 54 CIU_TestDAC1 register 6329h 186 17 2 Defini
92. 6 17 CIU timer on page 129 Note TPreScaler is defined with TPreScaler Hi 3 0 in this register and TPreScaler LO 7 0 in CIU TPrescaler 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 177 of 224 NXP Semiconductors PN532 C1 8 6 23 41 8 6 23 42 115432 Near Field Communication NFC controller CONFIDENTIAL CIU TPrescaler register 631Bh Define the LSB of the Timer Prescaler Table 254 CIU TPrescaler register address 631Bh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TPrescaler_LO 7 0 Reset 0 0 0 0 0 0 0 0 Access R W R W R W R W R W R W R W R W Table 255 Description of CIU TPrescaler bits Bit Symbol Description 7t00 TPrescaler_LO 7 0 Defines lower 8 bits for TPrescaler The following formula is used to calculate ftimer f Timer 6 78MHz T pyescater For detailed description see Section 8 6 17 CIU timer on page 129 Note The TPreScaler time is defined with TPreScaler Hi 3 0 in CIU TMode and TPreScaler LO 7 0 in this register CIU TReload hi register 631Ch Defines the MSB of the 16 bit long timer reload value Table 256 CIU TReloadVal hi register address 631Ch bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TReloadVal Hi 7 0 Reset 0 0 0 0 0 0 0 0 Access RW RW RW RW RW RW RW RW Table 257 Description of CIU TReloadVal hi bits Bit Symbol Description 7t00 TReloadVal_Hi 7 0 Defines the h
93. 6301h 6302h 6303h 6304h 6305h 6306h 6308h 6309h 630Ah 630Bh 630Ch 630Dh Byte Register name size 1 1 CIU Mode CIU TxMode CIU RxMode CIU TxControl CIU TxAuto CIU TxSel CIU RxSel CIU RxThreshold CIU Demod CIU FelNFC1 CIU_FelNFC2 CIU_MifNFC CIU ManualRCV Description Defines general modes for transmitting and receiving Defines the transmission data rate and framing during transmission Defines the transmission data rate and framing during receiving Controls the logical behavior of the antenna driver pins TX1 and TX2 Controls the settings of the antenna driver Selects the internal sources for the antenna driver Selects internal receiver settings Selects thresholds for the bit decoder Defines demodulator settings Defines the length of the valid range for the received frame Defines the length of the valid range for the received frame Controls the communication in ISO IEC 14443 MIFARE and NFC target mode at 106 kbit s Allows manual fine tuning of the internal receiver NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 142 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL Table 174 Contactless Interface Unit extension memory map continued ADDR 630Eh 630Fh 6310h 6311h 6312h 6313h 6314h 6315h 6316h 6317h 6318h 6319
94. 6329h CIU_TestDAC1 Reserved TestDAC1 5 0 632Ah CIU_TestDAC2 Reserved TestDAC2 5 0 632Bh CIU_TestADC ADC 8 0 ADC Q 3 0 632Chto Reserved 632Eh 632Fh CIU RFlevelDet Reserved pd rfleveldet Reserved 6330h SIC CLK Sic clk p34 en Reserved Errorbusbitenable Errorbusbitsel 2 0 6331h CIU Command RcvOff Power down Command IVLLN3GIJNOO 19 01 U09 94N uoneorunuiuo pJarJ Je9N SJ0 onpuooliulesS dXN LO cESNd 1002 1equie2eg z eg 1eeus ejep jonpoud vec 0 06L e rSLL peniesei siuDu Ily L002 8 dXN Table 288 Standard registers mapping continued Register Register Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Bit1 BitO address name 6332h CIU CommlEn Reserved TxIEn RXIEn IdlelEn HiAlertlEn LoAlertlEn ErrlEn TimerlEn 6333h CIU DivlEn Reserved SiginAct IEn ModelEn CRCIEn RfOnlEn RfOfflEn 6334h CIU Commlrq Seti TxIRq RxIRq Idlelrq HiAltertIRq LoAlertlRq ErrlRq TimerlRq 6335h CIU Divlrq Set2 Reserved SiginActlrq ModelRq CRCIRq RfOnIRq RfOfflRq 6336h CIU Error WrErr TempErr RFErr BufferOvfl CollErr CRCErr ParityErr ProtocollErr 6337h CIU_Status1 CIU IRQ 1 CRCOk CRCReady CIU IRQ 0 TRunning RFOn HiAlert LoAlert 6338h CIU Status2 TempSensClear Reserved RFFreqOK TgActivated MFOrypto1On ModemsState 2 0 6339h CIU FIFOData FIFOData 7 0 633Ah CIU FIFOLevel FlushBuffer FIFOLevel 6 0 633Bh CIU_WaterLevel Reserved WaterLevel 5 0 633Ch CI
95. 7 Table 231 Description of CIU_ManualRCV bits 167 Table 232 CIU TypeB register address 630Eh bit allocation kdo a 169 Table 233 Description of CIU TypeB bits 169 Table 234 CIU_CRCResultMSB register address 631 1h bit allocation nee anaa maa ia aa aa A 170 Table 235 Description of CIU_CRCResultMSB bits 170 Table 236 CIU_CRCResultLSB register address 6312h bit allocation n n n naana 170 Table 237 Description of CIU_CRCResultLSB bits 170 Table 238 CIU_GsNOff register address 6313h bit allocation 2 le m Rn tds 171 Table 239 Description of CIU_GsNOff bits 171 Table 240 CIU_ModWidth register address 6314h bit allocation onered aeie rena E pnn ene S E 172 Table 241 Description of CIU_ModWidth bits 172 Table 242 CIU TxBitPhase register address 6315h bit allocation lllllsellslselssn 173 Table 243 Description of CIU TxBitPhase bits 173 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 219 of 224 NXP Semiconductors PN532 C1 Table 244 CIU_RFCfg register address 6316h bit allocation sei ee akreinar eieiaeo 174 Table 245 Description of CIU_RFCfg bits 174 Table 246 CIU_GsNOn register address 6317h bit allocation n nnan n naaa 175 Table 247 Description of CIU_GsNOn bits 175 Table 248 CIU_CWGsP register address 6318h bit allocation n on nananana 176 Table 24
96. 7 6 5 4 3 2 1 0 Symbol TF2 s RCLKO TCLKO TR2 C T2 Reset 0 0 0 0 0 0 0 0 Access R R W R W R W RW RW RW R W Table 36 Description of T2CON bits Bit Symbol Description 7 TF2 Timer2 overflow Set to logic 1 by a Timer2 overflow Set to logic 0 by firmware TF2 is not set when in baud rate generation mode The bit IEO_5 of register IEO see Table 11 on page 17 has to be set to logic 1 to enable the corresponding CPU interrupt 6 E Reserved 5 RCLKO Timer2 Debug UART Receive Clock selector Set by firmware only When set to logic 1 Debug UART uses Timer2 overflow pulses When set to logic 0 Debug UART uses overflow pulses from another source e g Timer1 in a standard configuration 4 TCLKO Timer2 Debug UART Transmit Clock selector Set by firmware only When set to logic 1 Debug UART uses Timer2 overflow pulses When set to logic 0 Debug UART uses overflow pulses from another source e g Timer1 in a standard configuration Reserved TR2 Timer2 Run control Set by firmware only When set to logic 1 Timer2 is started When set to logic 0 Timer2 is stopped 1 C T2 Timer2 Counter Timer selector Set by firmware only When set to logic 1 Timer2 is set to counter operation When set to logicO Timer2 is set to timer operation 0 Reserved This bit must be set to logic 0 by firmware 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 28 of 224
97. 8 1 4 8 1 5 1 Near Field Communication NFC controller CONFIDENTIAL PCON module The Power Control PCON module is configured using the PCON SFR register Table 7 PCONregister SFR address 87h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol SMOD s CPU PD Reset 0 0 o oO 0 0 0 oO Access RW R R R R R RW RW Table8 Description of PCON bits Bit Symbol Description 7 SMOD Serial MODe When set to logic 1 the baud rate of the Debug UART is doubled 6 to3 Reserved 1 CPU_PD Power down When set to logic 1 the microcontroller goes in Power down mode 0 Reserved This bit should only ever contain logic 0 Interrupt Controller The interrupt controller has the following features 13 interrupt sources Interrupt enable registers IEO and IE1 Interrupt priority registers IPO and IP1 Wake up from Power Down state Interrupt vectors The mapping between interrupt sources and interrupt vectors is shown in Table 9 Table 9 Interrupt vector Interrupt Interrupt Interrupt sources Incremental priority level number vector conflict resolution level 0 0003h External P32_INTO Highest 000Bh TimerO interrupt 2 0013h External P33_INT1 3 001Bh Timer1 interrupt 4 0023h Debug UART interrupt 5 002Bh Timer2 interrupt 6 0033h NFC WI interrupt 7 003Bh LDO overcurrent interrupt 8 0043h Reserved 9 004Bh CIU interrupt 1 10 0053h CIU interrupt 0 11 005Bh 12C interrupt 12 0063h SPI FIFO or HSU
98. 9 Description of CIU CWGsP bits 176 Table 250 CIU_ModGsP register address 6319h bit allocation n on nananana 176 Table 251 Description of CIU_ModGsP bits 176 Table 252 CIU_TMode register address 631Ah bit allocation 24 44 22 cag as kun anheg 177 Table 253 Description of CIU TMode bits 177 Table 254 CIU TPrescaler register address 631Bh bit allocation 222i mer RI ER awe 178 Table 255 Description of CIU TPrescaler bits 178 Table 256 CIU TReloadVal hi register address 631Ch bit allocation s 224 2 wien b ast deerunt 178 Table 257 Description of CIU TReloadVal hi bits 178 Table 258 CIU TReload lo register address 631Dh bit allocation 0000000 eee eens 179 Table 259 Description of CIU_TReload_lo bits 179 Table 260 CIU TCounterVal hi register address 631 Eh bit allocation l llliilllsellsssn 179 Table 261 Description of CIU TCounterVal hi bits 179 Table 262 CIU TCounterVal lo register address 631Fh bit allocation liliis 179 Table 263 Description of CIU TCounterVal lo bits 179 Table 264 CIU_TestSel1 register address 6321h bit allocation 0000 cee eee eee 180 Table 265 Description of CIU TestSel bits 180 Table 266 CIU TestSel2 register address 6322h bit allocation ser ees ce ee sage ara cR 181 Table 267 Description of CIU TestSel2 bits 181 Table 268 CIU TestPinEn register addr
99. 9 1 8 6 9 2 8 6 10 8 6 11 8 6 12 8 6 12 1 8 6 13 8 6 13 1 8 6 13 2 8 6 13 3 8 6 14 8 6 14 1 8 6 14 2 8 6 14 3 115432 LDO without offset 0000 5 86 LDO overcurrent detection 86 LDO register 0c eee eee eee 87 SVDD switch secc csi seis 88 Power clock and reset controller 89 PCR block diagram 0000 000 89 27 12 MHz crystal oscillator 90 Reset modes 0200e eee eee 90 Soft Power Down mode SPD 91 Low power modes 2000 91 Remote wake up from SPD 92 PCR extension registers 92 PCR register description 93 CFR register nuana anaana eee eee 93 CER register cee eee eee 93 IUR register gutem 94 PCR Control register 95 PCR Status register 0 95 PCR Wakeupen register 96 Contactless Interface Unit CIU 98 Feature list 00200000 2 eee 99 Simplified block diagram 100 Reader Writer modes 101 ISO IEC 14443A Reader Writer 101 FeliCa Reader Writer 0 103 ISO IEC 14443B Reader Writer 104 ISO IEC 18092 ECMA 340 NFCIP 1 operating mode osaisia rino eeni RID RAEPRLIG 105 ACTIVE Communication mode 106 PASSIVE Communication mode 107 NFCIP 1 framing and coding 108 NFCIP 1 protocol suppor
100. ADR and I CCON have been initialized the I C interface waits until it is addressed by its own Slave address followed by the data direction bit which must be 1 R for the I C interface to operate in the Slave transmitter mode After its own Slave address and the R bit have been received the serial interrupt flag SI is set to logic 1 and a valid status code can be read from I2CSTA This status code is used to vector to an interrupt service routine and the appropriate action to be taken for each of these status codes is detailed in Table 83 on page 61 The Slave transmitter mode may also be entered if arbitration is lost while the 12C interface is in the Master mode If the AA bit is set to logic O during a transfer the I C interface will transmit the last byte of the transfer and enter state COh or C8h the I C interface is switched to the not addressed Slave mode and will ignore the Master receiver if it continues the transfer Thus the Master receiver receives all 1 s as 12C data While AA is set to logic 0 the 12C interface does not respond to its own Slave address or a general call address However the 12C bus is still monitored and address recognition may be resumed at any time by setting AA This means that the AA bit may be used to temporarily isolate the I C interface from the I2C bus 12C wake up mode The wake up block can only be used when I C is configured as a Slave It is a dedicated circuitry separated from the mai
101. ATA memory through the use of direct and indirect address mechanisms Direct addressing the operand is specified by an 8 bit address field in the instruction Indirect addressing the instruction specifies a register where the address of the operand is stored For the range 80h to FFh direct addressing will access the SFR space indirect addressing accesses Upper IDATA RAM For the range 0h0 to 7Fh Lower IDATA RAM is accessed regardless of addressing mode This behavior is summarized in the table below Table 4 IDATA memory addressing Address Addressing mode Direct Indirect 00h to 7Fh Lower IDATA RAM Lower IDATA RAM 80h to FFh SFRs Upper IDATA RAM The SFRs and their addresses are described in the Table 5 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 12 of 224 200z 1equie2eg z NOY 1eeus ejep jonpoud vec JO EL e rSLL peAJese siuBu Ily 002 8 dXN Table 5 SFR map of NFC controller Address Bit Byte addressable Address addressable F8h IP1 XRAMP P3CFGA P3CFGB FFh FOh B P7CFGA P7CFGB P7 F7h E8h IE1 CIU Status2 CIU_FIFOData CIU FlFOLevel CIU WaterLevel CIU Control CIU BitFraming CIU Coll EFh EOh ACC E7h D8h I2CCON I2CSTA I2CDAT I CADR CIU Status1 DFh DOh PSW CIU Command CIU_CommlEn CIU DivlEn CIU Commlrq CIU Divlrq CIU Error D7h C8h T2CON T2MOD RCAP2L RCAP2H T2L T2H CFh C
102. C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 25 CIU Demod register 6309h 163 12 10 Input output characteristics for pin P70_IRQ 200 8 6 23 26 CIU FelNFC1 register 680Ah 164 12 11 Input output pin characteristics for P30 8 6 23 27 CIU FelNFC2 register 680Bh 165 UART_RX P31 UART_TX P32 INTO 8 6 23 28 CIU_MifNFC register 680Ch 166 P33 INT sie RR de es 201 8 6 23 29 CIU_ManualRCV register 630Dh 167 12 12 Input output pin characteristics for P34 8 6 23 30 CIU TypeB register 630Eh 169 SIC CLK 22 hohe Gite ogee ed ERR 202 8 6 23 31 CIU_CRCResultMSB register 6311h 170 12 13 Input output pin characteristics for P35 202 8 6 23 32 CIU_CRCResultLSB register 6312h 170 12 14 Input pin characteristics for NSS P50_SCL 8 6 23 33 CIU GsNOff register 6313h 171 ASU RX vr ne EE a bucky Hanks 203 8 6 23 34 CIU ModWidth register 6314h 172 12 15 Input output pin characteristics for MOSI SDA 8 6 23 35 CIU TxBitPhase register 6315h 173 ASU TX raona sa DE RR 204 8 6 23 36 CIU_RFCfg register 6316h 174 12 16 Input output pin characteristics for MISO P71 8 6 23 37 CIU GsNOn register 6317h 175 and SCK P72 Lille 205 8 6 23 38 CIU CWGsP register 6318h 176 12 17 Input pin characteristics for SIGIN 205 8 6 23 39 CIU_ModGsP register 6319h 17
103. CalcCRC command 4 CIU IRQ O This bit shows if any CIU IRQ 0 source requests attention with respect to the setting of the interrupt enable flags see CIU CommlEn and CIU DivlEn registers The bit IE1 S of register IE1 see Table 13 on page 18 has to be set to logic 1 to enable the corresponding CPU interrupt 3 TRunning Setto logic 1 the CIU timer is running e g the CIU timer will decrement the CIU TCounterVal lo with the next timer clock Note In the gated mode TRunning is set to logic 1 when the CIU timer is enabled by the register bits This bit is not influenced by the gated signal 2 RFOn Set to logic 1 if an external RF field is detected This bit does not store the state of the RF field 1 HiAlert Set to logic 1 when the number of bytes stored in the FIFO buffer fulfils the following equation HiAlert 64 FIFOLength WaterLevel FIFOLenght 60 WaterLevel 4 gt HiAlert 1 Example FIFOLenght 59 WaterLevel 4 gt HiAlert 0 O _LoAlert Set to logic 1 when the number of bytes stored in the FIFO buffer fulfills the following equation LoAlert 2 FIFOLength WaterLevel Example FIFOLenght 4 WaterLevel 4 LoAlert 1 FIFOLenght 5 WaterLevel 4 LoAlert 0 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 150 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 10 CIU Status2 regis
104. Continuous Wave see Table 247 on page 175 ModGsNOn NMOS conductance value for Modulation when generating RF field see Table 247 on page 175 CWGsNOff NMOS conductance value for Continuous Wave when no RF is generated by the PN532 itself see Table 239 on page 171 ModGsNOff NMOS conductance value for modulation when load Modulation see Table 239 on page 171 Remark If only 1 driver is switched on the values for ModGsNOn and CWGsNOn are used for both drivers 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 112 of 224 200z 1equie2eg z eg 1eeus ejep jonpoud vec JOELL e rSLL peAJese siuBu Ily 2002 8 dXN Table 154 Settings for TX1 TX1 Force InvTx1 InvTx1 RFEn 100ASK RFON RFOFF 0 X X 0 1 1 0 0 X 0 1 X 1 0 X 1 1 X Envelope TX1 O l O O Oo O H Oo O O RF RF_n RF_n RF RF_n GsPMos ModGsP CWGsP ModGsP CWGsP ModGsP CWGsP CWGsP CWGsP GsNMos ModGsNOff CWGsNOff ModGsNON CWGsNON ModGsNON CWGsNON ModGsNON CWGsNON ModGsNON CWGsNON Remarks If TX1RFEN is set to logic 0 the pin TX1 is set to logic 0 or 1 depending on InvTx1RFOFF The bit Force 100ASK has no effect Envelope modulates the transconductance value If TX1RFEN is set to logic 1 the RF phase of TX1 is depending on InvTx1RFON The bit Force100ASK has effect when Envelope is set to logic 0 TX1 is pu
105. D 1 LOADMOD Envelope invert if SIGIN POLSIGN 0 LoadModTst TstBusbit Fig 40 Serial data switch for LOADMOD pin NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 121 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 13 NFC WI S C interface support 115432 The NFC WI S C provides the possibility to directly connect a secure IC to the PN532 in order to act as a contactless smart card IC via the PN532 The interfacing signals can be routed to the pins SIGIN and SIGOUT SIGIN can receive either a digital FeliCa or digital ISO IEC 14443A signal sent by the secure IC The SIGOUT pin can provide a digital signal and a clock to communicate to the secure IC A secure IC can be a smart card IC provided by NXP Semiconductors The PN532 generates the supply SVDD to the secure IC The pins SIGIN and SIGOUT are referred to this supply as well as pin P34 SIC CLK which can be used as an extra pin for the connection to a secure IC The following figure outlines the supported communication flows via the PN532 to the secure core IC 1 Wired Card mode Host Interfaces 80C51 FIFO and state machine secure IC QUT Serial Data Switch ES Analog CL UART j 2 Card emulation mode Virtual Card mode Fig 41 Communication flows supported by the NFC WI interface Configured in the Wired Card mode the
106. Description 00 B2 4D 01 00 B2 4D 10 00 00 B2 4D 11 00 00 00 B2 4D 5to0 DataLenMin 5 0 These bits define the minimum length of the accepted frame length DataLenMin x 4 DataPacketLenght This parameter is ignored at 106 kbit s if the DetectSync bit in CIU Mode register is set to logic O If a received frame is shorter as the defined DataLenMin value the frame will be ignored NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 164 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 22 27 CIU_FelNFC2 register 630Bh 115432 Defines the maximum length of the received frame Table 226 CIU FelNFC2 register address 630Bh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol WaitForSelected ShortTimeSlot DataLenMax 5 0 Reset 0 0 oO O 0 0 0 0 Access R W R W RW RW RW RW RW RW Table 227 Description of CIU FeINFC2 bits Bit Symbol Description 7 WaitForSelected Set to logic 1 the AutoColl command is automatically ended only when 1 A valid command has been received after performing a valid Select procedure according to ISO IEC 14443A 2 A valid command has been received after performing a valid Polling procedure according to the FeliCa specification Note If this bit is set no Active Communication is possible Note Setting this bit reduces the 80C51 interaction in case of a communication to another dev
107. KO TCLKO Reserved TR2 C T2 CP RL2 C9h T2MOD Reserved T2RD DCEN CAh RCAP2L R2L 7 R2L 6 R2L 5 R2L 4 R2L 3 R2L 2 R2L 1 R2L 0 CBh RCAP2H R2H 7 R2H 6 R2H 5 R2H 4 R2H 3 R2H 2 R2H 1 R2H 0 CCh T2L T2L 7 T2L 6 T2L 5 T2L 4 T2L 3 T2L 2 T2L 1 T2L 0 CDh T2H T2H 7 T2H 6 T2H 5 T2H 4 T2H 3 T2H 2 T2H 1 T2H 0 CEh to CFh Reserved pont PSW Program Status Word PSW 7 0 Dih CIU_Command Reserved RcvOff Power down Command D2h CIU CommlEn TxIEn RXIEn IdlelEn HiAlertlEn LoAlertlEn ErrlEn TimerlEn D3h CIU DivlEn Reserved SiginAct IEn ModelEn CRCIEn RfOnlEn RfOfflEn D4h CIU Commlrq Seti TxIRq RxIRq Idlelrq HiAltertlRq LoAlertIRq ErrlRq TimerlRq D5h CIU Divlrq Set2 Reserved SiginActlrq ModelRq CRCIRq RfOnIRq RfOffIRq D6h CIU Error WrErr TempErr RFErr BufferOvfl CollErr CRCErr ParityErr ProtocollErr D7h Reserved D8h l2CCON CR 2 ENS1 STA STO SI AA CR 1 0 D9h I CSTA ST 7 0 DAh l2CDAT l2CDAT 7 0 DBh CADR SA 6 0 GC DCh to DEh Reserved DFh CIU Status1 CIU_IRQ_1 CRCOk CRCReady CIU_IRQ_0 TRunning RFOn HiAlert LoAlert Eon ACC Accumulator ACC 7 0 Eihto E7h Reserved E8h IE1 IE1 7 Reserved IE1 5 IE1 4 IE1 3 IE1 2 Reserved IE1_0 E9h CIU Status2 TempSensClear Reserved RFFreqOK TgActivated MFCrypto1On ModemsState 2 0 EAh CIU_FIFOData FIFOData 7 0 EBh CIU FIFOLevel FlushBuffer FIFOLevel 6 0 ECh CIU WaterLevel WaterLevel 5 0 EDh CIU Control TStopNow TStartNow perry ID to Initiator Reserved RxLastBits 2 0 EEh CIU_BitFraming StartSend RxAlign 2 0 Reserved TxLa
108. MIFARE secure IC modulation 1100 RX with RF carrier 1101 TX with RF carrier 1110 RX with RF carrier unfiltered 1111 RX envelope unfiltered Note To have a valid signal the CIU has to be set to the receiving mode by either the Transceive or Receive commands The bit RxMultiple can be used to keep the CIU in receiving mode 8 6 23 23 CIU RxSel register 6307h Selects internal receiver settings Table 218 CIU RxSel register address 6307h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol UarSe t0 RxWait 5 0 Reset 1 0 0 0 oO 1 0 0 Access R W R W R W R W R W R W R W R W Table 219 Description of CIU RxSel bits Bit 7106 5100 Symbol UartSel 1 0 RxWait 5 0 Description Selects the input of the digital part CL UART of the CIU Value Description 00 Constant Low 01 Envelope signal at SIGIN 10 Modulation signal from the internal analog part 11 Modulation signal from SIGIN pin Only valid for transfer speeds above 424 kbit s After data transmission the activation of the receiver is delayed for RxWait bit clocks During this frame guard time any signal at pin Rx is ignored This parameter is ignored by the Receive command All other commands e g Transceive Autocoll MFAuthent use this parameter Depending on the mode of the CIU the counter starts differently In Passive Communication mode the counters starts with the last modulation of the transmitted data stream I
109. N are received from the RF the CIU will sample noise to add the missing bytes If more bytes than indicated by LEN are received from the RF the last bytes will be ignored When LEN is 0 the frame is ignored and the PN532 waits for a new frame In case of data rate at 106 kbps in NFC communication mode the reception ends when the CIU detects an end of frame except if the CIU detects more bytes than indicated by the received LEN byte In that case after receiving LEN bytes a new reception restarts and the CIU timer starts if Tauto in register CIU_TMode Table 252 is set to logic 1 The end of reception is then seen if a new valid frame is received or the firmware has to end the reception phase on time out In all other cases the end of the reception is detected by the end of frame In case no frame is received and Tauto in register CIU_TMode Table 252 is set to logic 1 then TimerlRQ in register CommIRQ is set to logic 1 The firmware has to end the reception phase Note If the bit RxMultiple in the register CIU RxMode is set to logic 1 the Receive command does not terminate automatically It has to be terminated by setting any other command in the CIU Command register Transceive command This circular command repeats transmitting data from the FIFO and receiving data from the RF field continuously If the bit Initiator in the register CIU Control is set to logic 1 it indicates that the first action is transmitting and after havin
110. Oh C7h B8h IPO BFh BOh P3 B7h A8h IEO SPlcontrol SPlstatus HSU_STA HSU_CTR HSU_PRE HSU_CNT AFh AOh FITEN FDATA FSIZE A7h 98h SOCON SBUF RWL TWL FIFOFS FIFOFF SFF FIT 9Fh 90h 97h 88h TO1CON TO1MOD TOL TIL TOH T1H 8Fh 80h SP DPL DPH PCON 87h IVLLN3GIJNOO 419 01 U09 94N uoneorunuiuo pj8rJ Je9N LO cESNd SJ0 onpuooliulesS dXN NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 2 2 XRAM memory 115432 The XRAM memory is divided into 2 memory spaces 0000h to 5FFFh reserved for addressing embedded RAM For the PN532 only accesses between 0000h and 02FF are valid 6000h to 7FFFh reserved for addressing embedded peripherals This space is divided into 32 regions of 256 bytes each Addressing can be performed using RO or R1 and the XRAMP SFR The Table 6 depicts the mapping of internal peripherals into XRAM Table 6 Peripheral mapping into XRAM memory space Base End Description Address Address 6000h 60FFh Reserved 6100h 61FFh IOs and miscellaneous registers configuration Refer to Section 8 2 General purpose IOs configurations on page 38 6200h 62FFh Power Clock and Reset controller Refer to Section 8 5 7 PCR extension registers on page 92 6300h 633Fh Contactless Unit Interface Refer to Section 8 6 Contactless Interface Unit CIU on page 98 6340h FFFFh Reserved XRAM is accessed via the dedicated MOVX instr
111. Own SLA will be recognized received General call address will be recognized if IICADR O is set to logic 1 No I2CDAT action 1 0 0 0 Switched to not addressed SLV mode no recognition of own SLA or General call address A START condition will be transmitted when the bus becomes free No I CDAT action 1 0 0 1 Switched to not addressed SLV mode Own SLA will be recognized General call address will be recognized if IICADR O is set to logic 1 A START condition will be transmitted when the bus becomes free Table 84 1 C Miscellaneous status codes Status Status of the I C Bus and Application firmware Response Next Action Taken By the I C interface Hardware poe the I2C interface Hardware To from I2CDAT TO I2CCON STA STO SI AA 00h Bus error No I2CDAT action X 1 0 X Hardware will enter the not addressed Slave mode F8h No information available No I2CDAT action IVLLN3GIJNOO 19j 041u09 D4N uoneoiunuiuo p314 Je9N LO c SNd SJ0 onpuooliulesS dXN NXP Semiconductors PN532 C1 8 3 2 9 115432 Near Field Communication NFC controller CONFIDENTIAL I CDAT register I CDAT contains a byte of 12C data to be transmitted or a byte which has just been received The CPU can read from and write to this 8 bit SFR while it is not in the process of shifting a byte This occurs when the 12C interface is in a defined state and the serial interrupt flag SI is set to logic 1 Data in IICDAT remains stable as long as Sl is set
112. P33_INT1 interrupt enable When set to logic 1 P33 INT1 pin interrupt is enabled See Table 23 on page 23 The polarity of P383 INT1 can be inverted see Table 73 on page 49 1 IEO 1 TimerO interrupt enable When set to logic 1 TimerO interrupt is enabled See Table 23 on page 23 0 IEO 0 P32 INTO interrupt enable When set to logic 1 P32 INTO pin interrupt is enabled See Table 23 on page 23 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 17 of 224 NXP Semiconductors PN532 C1 8 1 5 3 115432 Near Field Communication NFC controller CONFIDENTIAL The 2 following tables describe IE1 Table 12 Interrupt controller IE1 register SFR address E8h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol E1 7 n IET 5 IET 4 1613 IEE12 IE1 0 Reset 0 0 9 0 0 0 oO 0 Access RW RW RW RW RW R W R W R W Table 13 Description of IE1 bits Bit Symbol Description 7 IE1 7 General purpose IRQ interrupt enable When set to logic 1 enables interrupt function of P34 P35 P50_SCL and P71 according to their respective enable and level control bits See Table 19 on page 20 Table 137 on page 94 and Table 143 on page 96 6 Reserved This bit must be set to logic 0 5 IE1 5 FIFO SPI and HSU interrupt enable When set to logic 1 enables FIFO interrupts SPI interrupts HSU interrupt In HSU mode the interrupt is when NSS is at logic 0 For the FIFO interrupt
113. PN532 C1 Near Field Communication NFC controller Rev 3 2 3 December 2007 Product data sheet 115432 CONFIDENTIAL 1 General description The PN532 is a highly integrated transceiver module for contactless communication at 13 56 MHz based on the 80C51 microcontroller core It supports 6 different operating modes SO IEC 14443A MIFARE Reader Writer FeliCa Reader Writer SO IEC 14443B Reader Writer SO IEC 14443A MIFARE Card MIFARE 1 KB or MIFARE 4 KB emulation FeliCa Card emulation SO IEC 18092 ECMA 340 Peer to Peer The PN532 implements a demodulator and decoder for signals from ISO IEC 14443A MIFARE compatible cards and transponders The PN532 handles the complete ISO IEC 14443A framing and error detection Parity amp CRC The PN532 supports MIFARE 1 KB or MIFARE 4 KB emulation products The PN532 supports contactless communication using MIFARE Higher transfer speeds up to 424 kbit s in both directions The PN532 can demodulate and decode FeliCa coded signals The PN532 handles the FeliCa framing and error detection The PN532 supports contactless communication using FeliCa Higher transfer speeds up to 424 kbit s in both directions The PN532 supports layers 2 and 3 of the ISO IEC 14443 B Reader Writer communication scheme except anticollision This must be implemented in firmware as well as upper layers In card emulation mode the PN532 is able to answer to a Reader Writer command either accordi
114. RSTOUT_N Fig 48 Timings for reset overview Table 318 Reset duration time Symbol Parameter Conditions Min Typ Max Unit Tresetpon Reset time at power on 1 0 1 04 2 ms Tupp Hard Power Down time User dependent 20 ns TreseimsrPp n Reset time 01 04 2 ms when RSTPD N is released 1 27 12 MHz quartz starts in less than 800 us For example quartz like TAS 3225A TAS 7 or KSS2F with appropriate layout 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 209 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 24 Timing for the SPI compatible interface Table 319 SPI timing specification Symbol Parameter Conditions Min Typ Max Unit tsckL SCK low pulse width 50 ns tsckH SCK high pulse width 50 ns tsupx SCK high to data changes 25 ns tpxsH data changes to SCK high 25 ns tei Dx SCK low to data changes 25 ns tSLNH SCK low to NSS high 0 ns BCR MOSI MISC HRS Fig 49 SPI timing diagram 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 210 of 224 NXP Semiconductors PN532 C1 12 25 Timing for the I C interface Table 320 I C timing specification Near Field Communication NFC controller CONFIDENTIAL Symbol Parameter Conditions Min Typ Max Unit scL SCL clock frequency 0 400 kHz tup sta Hold time After this period 600 ns repeat
115. Reserved TWLL TFF TFE RWLH RFF RFE 9Fh FIT Reset Reserved WCOL IRQ TWLL IRQ TFF_IRQ RWLH_IRQ ROVR_IRQ RFF_IRQ AOh Reserved Ath FITEN TFLUSH RFLUSH EN WCOL IRQ EN TWLL IRQ EN TFF IRQ EN RWLH IRQ EN_ROVR_IRQ EN RFF IRQ A2h FDATA FDATA 7 0 A3h FSIZE ReceiveSize 7 0 A4h to A7h Reserved A8h IEO IEO 7 IEO 6 IEO 5 IEO 4 IEO 3 IEO 2 IEO 1 IEO 0 A9h SPlcontrol Reserved Enable Reserved CPHA CPOL IE1 IEO AAh SPlstatus Reserved TR_FE RCV_OVR Reserved READY ABh HSU_STA set_bit Reserved disable preamb irg rx over en irq rx fer en irq rx over irq rx fer ACh HSU CTR hsu wu en start frame tx stopbit 1 0 rx_stopbit tx_en rx en soft reset n ADh HSU PRE hsu prescaler 7 0 AEh HSU CONT hsu counter 7 0 AFh Reserved BOh P3 Reserved P3 5 P3 4 P3 3 P3 2 P3 1 P3 0 s19jsiDa1J HS 278 IVLLN3GIJNOO 19 01 U09 94N uoneorunuiuo pjarJ Je9N LO c SNd SJ0 onpuooiulesS dXN 200Z 1equie2eg z eH eeus ejep 1onpoJd Vcc 10 ZEL e rSLL peAJese siuBu Ily 2002 8 dXN Table 289 SFR registers mapping continued SFR Register name Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Bit1 Bito address B1h to B7h Reserved B8h IPO IPO 7 IPO 6 IPO 5 IPO 4 IPO 3 IPO 2 IPO 1 IPO 0 B9h to C7h Reserved C8h T2CON TF2 Reserved RCL
116. Reset 0 0 0 0 0 0 0 0 Access RW RW RW RW RW RW RW RW Table 33 Description of T1H bits Bit Symbol Description 7100 T1H 7 to T1H 0 Timer1 timer counter upper byte Incrementer The two 16 bit timer counters are built around an 8 bit incrementer The Timer0 1 are incremented in the CPU states S1 to S4 the overflow flags are set in CPU states S2 and S4 e CPU state S1 TOL is incremented if TimerO is set to timer operation counter operation and when a 1 to 0 transition is detected on P34 SIC CLK input CPU state S2 TOH is incremented if TOL overflows The overflow flag TFO in register TO1CON is updated CPU state S3 T1L is incremented if Timer1 is set to timer operation or counter operation and when a 1 to 0 transition is detected on P35 input CPU state S4 T1H is incremented if T1L overflows The overflow flag TF1 in register TO1CON is updated NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 26 of 224 NXP Semiconductors PN532 C1 8 1 6 7 8 1 7 1 115432 Near Field Communication NFC controller CONFIDENTIAL Overflow detection For both the upper and lower bytes of the Timer0 1 an overflow is detected by comparing the incremented value of the most significant bit with its previous value An overflow occurs when this bit changes from logic 1 to logic 0 An overflow event in the lower byte is cloc
117. Rev 3 2 3 December 2007 53 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 2 7 I2CCON register The CPU can read from and write to this 8 bit SFR Two bits are affected by the Serial lO the IC interface hardware the SI bit is set to logic 1 when a serial interrupt is requested and the STO bit is set to logic 0 when a STOP condition is present on the 12C bus The STO bit is also set to logic 0 when ENS1 0 Table 76 I2CCON register SFR address D8h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol CR 2 ENS1 STA STO SI AA CR 1 0 Rest 0 0 0 0 0 0 o 0 Access R W R W RW RW RW R W RW RW Table 77 Description of IICCON bits Bit Symbol Description 7 CR 2 Serial clock frequency selection in Master mode Together with CR 1 0 this bit determines the clock rate serial clock frequency when the 12C interface is in a Master mode Special attention has to be made on the 12C bit frequency in case of dynamic switching of the CPU clock frequency 6 ENS1 Serial IO enable When ENS1 bit is to logic 0 SDA and P50_SCL are in high impedance The state of SDA and P50_SCL is ignored the I C interface is in the not addressed Slave state and the STO bit in IICCON is forced to logic 0 No other bits are affected When ENS is logic 1 the 12C interface is enabled assuming selif 1 0 bits are 10b see Table 72 on page 48 ENS1 should not be use
118. SFR address 8Bh bit allocation llle 26 Table 31 Description of TiL bits 26 Table 32 Timer0 1 T1H register SFR address 8Dh bit allocation 0 20000 000s 26 Table 33 Description of TiH bits 26 Table 34 Timer2 SFR register List 27 Table 35 Timer2 T2CON register SFR address C8h bit allocation 0022000 eee 28 Table 36 Description of T2CON bits 28 Table 37 Timer2 T2MOD register SFR address C9h bit allocation 0022000 eee 29 Table 38 Description of TMOD bits 29 Table 39 Timer2 T2L register SFR address CCh bit allocation 0022000 eee 30 Table 40 Description of T2L bits 30 115432 Table 41 Table 42 Table 43 Table 44 Table 45 Table 46 Table 47 Table 48 Table 49 Table 50 Table 51 Table 52 Table 53 Table 54 Table 55 Table 56 Table 57 Table 58 Table 59 Table 60 Table 61 Table 62 Table 63 Table 64 Table 65 Table 66 Table 67 Table 68 Table 69 Table 70 Table 71 Table 72 Table 73 Table 74 Table 75 Table 76 Table 77 Table 78 Table 79 Table 80 Table 81 Table 82 Table 83 Near Field Communication NFC controller CONFIDENTIAL Timer2 T2H register SFR address CDh bit allocation llle 30 Description of T2H bits 30 Timer2 RCAP
119. SLA will be recognized General call address will be recognized if IICADR O is set to logic 1 Read data byte 1 0 0 0 Switched to not addressed SL V mode No recognition of own SLA or General call address A START condition will be transmitted when the bus becomes free Read data byte 1 0 0 1 Switched to not addressed SL V mode Own SLA will be recognized General call address will be recognized if IICADR O is set to logic 1 A START condition will be transmitted when the bus becomes free Table 83 1 C Slave Transmitter Mode status codes Status Status of the I2C Bus and Application firmware Response Next Action Taken By the I C interface Hardware Code the I C interface Hardware To from I2CDAT TO ICCON ST 7 0 STA STO SI A A8h Own SLA R has been received Load data byte X 0 0 0 Last data byte will be transmitted and ACK bit will be received ACK has been returned Load data byte X 0 0 1 Data byte will be transmitted ACK will be received BOh Arbitration lost in SLA R W as Load data byte X 0 0 0 Last data byte will be transmitted and ACK bit will be received Master Own SLA R hasbeen Load data byte x 0 0 1 Databyte will be transmitted ACK will be received received ACK has been returned IVLLN3GIJNOO 49 04 U09 54N uoneoiunuiuo pjJ9rJ Je9N LO c SNd SJ0 onpuooliulesS dXN 200z 1equie2eg z NOY 1eeus ejep jonpoud Vcc 10 c9 e rSLL peAJese siuBu Ily 2002 8 dXN Table 83 12C Slave Transmitter Mod
120. SO IEC 14443A MIFARE Reader Writer communication diagram 101 Data coding and framing according to ISO IEC 14443A 1 eee eee 102 FeliCa Reader Writer communication diagram 103 ISO IEC 14443B Reader Writer communication diagram irie Li lex Eee ees 104 NFCIP 1 mode 0 cece een eee 105 Active NFC mode 000000e eee 106 Passive NFC mode 000055 107 ISO IEC 14443A MIFARE card operating mode communication diagram 109 FeliCa card operating mode communication diagrami 3 s 2 ia Patekda ee IC ER 110 CIU detailed block diagram 111 Disconnection localization for the antenna detection pnei asn iasanen an anaa iea 116 Data mode detector annaa nnana nan 119 Serial data switch for TX1 and TX2 120 Serial data switch for LOADMOD pin 121 Communication flows supported by the NFC WI interface eich See es RYE 122 Signal shape for SIGOUT in FeliCa secure IC FHOGO escis aee t tette ace oe 123 Signal shape for SIGIN in FeliCa secure IC Tode 6 2224 dag ae REESE EMI 123 Signal shape for SIGOUT in NFC WI mode Fig 45 Fig 46 Fig 47 Fig 48 Fig 49 Fig 50 Fig 51 Fig 52 Near Field Communication NFC controller CONFIDENTIAL Signal shape for SIGIN in NFC WI mode 124 AutoColl command 0 0000 137 RX Voltage definitions 208 Timings for reset overview 209 SPI timi
121. Semiconductors PN532 C1 8 6 22 CIU memory map 115432 Near Field Communication NFC controller CONFIDENTIAL The registers of the CIU are either map into the SFR or into the XRAM memory space Table 173 Contactless Interface Unit SFR memory map ADDR Byte Register name Description Dih D2h D3h D4h D5h D6h DFh E9h EAh EBh ECh EDh EEh EFh size 1 1 a m CIU_Command CIU CommlEn CIU DivlEn CIU Commirq CIU_Divirq CIU_Error CIU Status1 CIU Status2 CIU_FIFOData CIU FIFOLevel CIU WaterLevel CIU Control CIU BitFraming CIU Coll Starts and stops the command execution Control bits to enable and disable the passing of interrupt requests Control bits to enable and disable the passing of interrupt requests Contains common Interrupt Request flags Contains diverse Interrupt Request flags Error flags showing the error status of the last command executed Contains status flags of the CRC Interrupt Request System and FIFO buffer Contain status flags of the Receiver Transmitter and Data Mode Detector in and output of 64 bytes FIFO buffer Indicates the number of bytes stored in the FIFO Defines the thresholds for FIFO under and overflow warning Contains miscellaneous Control bits Adjustments for bit oriented frames Bit position of the first bit collision detected on the RF interface Table 174 Contactless Interface Unit extension memory map ADDR
122. T If the InitialRFOn and Tx1RFAutoEn bits are set to logic 1 RF is switched on at TX1 if no external RF field is detected during the time TIDT Note The times TADT and TIDT are in accordance to the ISO IEC 18092 ECMA340 NFCIP 1 standards 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 160 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 22 CIU TxSel register 6306h Selects the sources for the analogue transmitter part Table 216 CIU TxSel register address 6306h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol LoadModSel 0 DriverSel 1 0 SigOutSel 3 0 Reset o o o 0 o o 0 Access RW R W RW RW RW RW RW RW Table 217 Description of CIU TxSel bits Bit Symbol Description 7to6 LoadModSel 1 0 Selects the signal to be output on LOADMOD Value Description 00 Tristate 01 Modulation signal envelope from the internal coder 10 Modulation signal envelope from SIGIN 11 Test signal defined by LoadModtest in register CIU_TestSel1 5to4 DriverSel 1 0 Selects the signals to be output on Tx1 and Tx2 Value Description 00 Tristate 01 Modulation signal envelope from the internal coder 10 Modulation signal envelope from SIGIN 11 HIGH Note The HIGH level depends on the setting of InvTx1 RFON InvTx1 RFOff and InvTx2RFON InvTx2RFOff 3to0 SigOutSel 3 0 Select the signal to be output on SIGOUT
123. TAutoRestart TPrescaler_Hi 3 0 Reset 0 0 0 0 0 0 0 0 Access R W RW RW R W R W RW RW R W Table 253 Description of CIU TMode bits Bit Symbol Description 7 TAuto Set to logic 1 the timer starts automatically at the end of the transmission in all communication modes at all speed or when InitialRFOn in CIU TxAuto is set to logic 1 and the external RF field is switched on The timer stops immediately after receiving the first data bit if RxMultiple in the CIU RxMode register is set to logic 0 If RxMultiple is set to logic 1 the timer never stops In this case the timer can be stopped by setting the bit TStopNow in register CIU Control to 1 Set to logic 0 indicates that the timer is not influenced by the protocol 6to5 TGated 1 0 The internal timer is running in gated mode Note In the gated mode the bit TRunning is logic 1 when the timer is enabled by the register bits This bit does not influence the gating signal Value Description 00 No gated mode 01 Gated by SIGIN 10 Gated by AUX1 11 Reserved 4 TAutoRestart Set to logic 1 the timer automatically restart its count down from TReloadValue defined within when reaches zero Set to logic 0 the timer decrements to zero and the bit TimerlRq is set to logic 1 3to0 TPrescaler_Hi 3 0 Defines higher 4 bits for the TPrescaler The following formula is used to calculate ftimer frimer 678MHz T PreScaler For detailed description see Section 8
124. Table 321 Abbreviations Acronym Description ASK Amplitude Shift keying BPSK Bit Phase Shift Keying CIU Contactless Interface Unit CRC Cyclic Redundancy Check ECMA European Computer Manufacturers Association organization GPIO General Purpose Input Output GPIRQ General Purpose Interrupt ReQuest HPD Hard Power Down see Section 8 5 3 on page 90 HSU High Speed UART Initiator Generates HF field at 13 56 MHz and starts the NFCIP 1 communication LDO Low Drop Out regulator Load modulation Index The load modulation index is defined as the card s voltage ratio Vmax Vmin Vmax Vmin measured at the card s coil MIF Multi InterFace block Modulation Index The modulation index is defined as the voltage ratio Vmax Vmin Vmax Vmin MSL Moisture Sensitivity Level NFCIP NFC Interface and Protocol NFC WI NFC Wired Interface to connect NFC front end to a SIC PCD Proximity Coupling Device Definition for a Card Reader Writer according to the ISO IEC 14443 Specification PCR Power Clock Reset controller PICC Proximity Cards Definition for a contactless Smart Card according to the ISO IEC 14443 specification SIC Secure Integrated Circuit can be a Smart Card IC a Secure Access Module SAM SPI Serial Parallel Interface SPD Soft Power Down mode see Section 8 5 4 on page 91 Target Responds to initiator command either using load modulation scheme RF field generated by Initiator or using modulation of s
125. This bit indicates when the receive part of the FIFO is empty Set to logic 1 when the Receive FIFO is empty Set to logic 0 when the Receive FIFO contains at least 1 byte NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 68 of 224 NXP Semiconductors PN532 C1 8 3 3 7 FIT register The FIT register contains 6 read write bits which are logically OR ed to generate an interrupt going to the CPU 115432 Near Field Communication NFC controller CONFIDENTIAL Table 102 FIT register SFR address 9Fh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol Reset WCOL TWLL_ TFF_ RWLH_ ROVR RFF IRQ IRQ IRQ IRQ IRQ IRQ Reset 0 0 0 0 0 0 0 0 Access W R R W R W R W R W R W R W Table 103 Description of FIT bits Bit Symbol 7 Reset WCOL IRQ 4 TWLL IRQ 3 TFF IRQ 2 RWLH IRQ 1 ROVR IRQ 0 RFF IRQ Description Reset Set to logic 1 Reset defines that the bits set to logic 1 in the write command are set to logic 0 in the register Reserved Write COLlision IRQ This bit is set to logic 1 when the transmitted part of the FIFO is already full TFF is set to logic 1 and a new character is written by the CPU in the data register Transmit WaterlLevelLow IRQ This bit is set to logic 1 when the number of bytes stored into the Transmit FIFO is equal or smaller than the threshold TWaterlevel Transmit FIFO Full IRQ This is set to logic 1 if t
126. U The High Speed UART HSU provides a high speed link to the host up to 1 288 Mbit s 115432 The HSU is a full duplex serial port The serial port has a Receive buffer in conjunction with the FIFO manager the reception of several bytes can be performed without strong CPU real time constraints However if the Receive FIFO still has not been read by the CPU and the number of receive bytes is greater than the Receive FIFO size then the new incoming bytes will be lost The HSU receive and transmit data registers are both accessed by firmware in the FIFO manager FDATA register Writing to FDATA loads the transmit register reading from FDATA accesses the separate receive register The characteristics of the UART are the following Full duplex serial port Receive buffer to allow reception of byte while the previous bytes are stored into the FIFO manager 8 bit data transfers Programmable baud rate generator using prescaler for transmission and reception Based on 27 12 MHz clock frequency Dedicated protocol preamble filter Wake up generator NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 72 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL FIFO manager ix data hsu txout E Shift Register ix shift TX Control CPU Interface tx_clk hsu_tx_control HSU STA Baud rate Generator Pres
127. U To modulate and demodulate the data an external circuit has to be connected to the communication interface pins SIGIN SIGOUT Remark The size and tuning of the antenna have an important impact on the achievable operating distance NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 110 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Control Register bank CIU_Command register Programmable timer CIU FIFO control e p CIU interrupt control CIU 64 byte FIFO E CRC16 generation amp check MIFARE Classic unit Random Number Generator Parallel Serial Converter PX kK Bit Counter Antenna presence Self Test Clock generation LOADMOD Filtering Distribution Amplitude Rating Analog to Digital Converter Reference Voltage l channel Q channel Amplifier LNA Amplifier LNA l channel Q channel Demodulator Demodulator VMID Fig 36 CIU detailed block diagram 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 111 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 7 Transmitter control The signals delivered by the transmitter are on pins TX1 and pin TX2 The supply and grounds of the transmitter drivers are TVDD TVSS1 and TVSS2 The signals delivered are the 13 56 MHz energy carrier modulated by an env
128. UF loads the transmit register reading from SOBUF accesses a physically separate receive register The serial port can operate in 4 modes These modes are selected by programming bits SMO and SM1 in SOCON Mode 0 Serial data are received and transmitted through UART_RX UART_TX outputs the shift clock 8 bits are transmitted received LSB first Baud rate fixed at 1 6 of the frequency of the CPU clock Mode 1 10 bits are transmitted through UART TX or received through UART_RX a start bit 0 8 data bits LSB first and a stop bit 1 Receive The received stop bit is stored into bit RB8 of register SOCON Baud rate variable depends on overflow of Timer1 or Timer2 Mode 2 11 bits are transmitted through UART TX or received through UART RX start bit 0 8 data bits LSB first a 9th data bit and a stop bit 1 Transmit the 9th data bit is taken from bit TB8 of SOCON For example the parity bit could be loaded into TB8 Receive the 9th data bit is stored into RB8 of SOCON while the stop bit is ignored Baud rate programmable to either 1 16 or 1 32 the frequency of the CPU clock NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 31 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL Mode 3 11 bits are transmitted through UART_TX or received through UART RX a start bit 0
129. U_Control TStopNow TStartNow WrNFCIP 11DtoFIFO Initiator Reserved RxLastBits 2 0 633Dh CIU BitFraming StartSend RxAlign 2 0 Reserved TxLastBits 2 0 633Eh CIU_Coll ValuesAfterColl Reserved CollPosNotValid CollPos 633Fh to Reserved FFFFh IVLLN3GIJNOO 19 01 U09 5 N uoneorunuiu pla Je9N LO c SNd SJ0 onpuooliulesS dXN 1002 Jequieceq zene Jays ejep 1onpoJd vez 40 L6L e rSLL peAJese siuBu Ily 4002 8 dXN Table 289 SFR registers mapping SFR Register name Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Biti Bit0 address 80h Reserved gini SP Stack Pointer SP 7 0 gant DPL Data Pointer Low DPL 7 0 eani DPH Data Pointer High DPLH7 0 84h to 86h Reserved 87h PCON SMOD Reserved CPU PD Reserved 88h TO1CON TF1 TR1 TFO TRO IE1 IT1 IEO ITO 89h TO1MOD GATE1 C T1 M11 M10 GATEO C TO M01 M00 8Ah TOL TOL 7 TOL 6 TOL 5 TOL 4 TOL 3 TOL 2 TOL 1 TOL O 8Bh TIL T1L 7 T1L 6 T1L 5 T1L 4 T1L 3 T1L 2 TA1L 1 T1L O 8Ch TOH TOH 7 TOH 6 TOH 5 TOH 4 TOH 3 TOH 2 TOH 1 TOH O 8Dh T1H T1H 7 T1H 6 T1H 5 T1H 4 T1H 3 T1H 2 T1H 1 T1H 0 8Eh to 97h Reserved 98h SOCON SMO SM1 SM2 REN TB8 RB8 TI RI 99h SOBUF SOBUF 7 0 9Ah RWL RWaterlevel 7 0 9Bh TWL TWaterlevel 7 0 9Ch FIFOFS TransmitFreespace 7 0 9Dh FIFOFF ReceiveFullness 7 0 9Eh SFF FIFO EN
130. Writing to P7 0 writes the corresponding value to the P70_IRQ pin according to the configuration mode defined by P7CFGA 0 and P7CFGB O Reading from P7 0 reads the state of P70_IRQ pin P3CFGA register Table 66 P3CFGA register SFR address FCh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol PSCFGA P3CFGA P3CFGA P3CFGA P3CFGA P3CFGA Sg 4 3 2 1 0 Reset 1 1 1 1 1 1 1 1 Access R R RW R W RW RW R W R W Table 67 Description of P3CFGA bits Bit Symbol Description 7106 Reserved 5 P3CFGA 5 In conjuction with PSCFGB 5 it configures the functional mode of P35 4 P3CFGA 4 In conjuction with PSCFGB A4 it configures the functional mode of P34 3 P3CFGA 3 In conjuction with PSCFGB S it configures the functional mode of P33 INT1 2 P3CFGA 2 In conjuction with PSCFGB 2 it configures the functional mode of P32 INTO 1 P3CFGA 1 In conjuction with PSCFGB 1 it configures the functional mode of P31 0 P3CFGA 0 In conjuction with PSCFGB O it configures the functional mode of P30 1 When CPU PD is set to logic 1 see Table 7 on page 16 for P32 INTO and referring to Section 8 2 1 e hd is forced to logic 1 Remark When in Hard power down mode the P35 to P30 pins are forced in quasi bidirectional mode Referring to Figure 7 en n2 e pu 1 e p 0 Ande hd 1 if P3x pin value is 1 and e hd 0 if P3x pin value is 0 NXP B V 2007 All righ
131. able 13 on page 18 has to be set to logic 1 to enable the corresponding CPU interrupt Remark The SOCON register supports a locking mechanism to prevent firmware read modify write instructions to overwrite the contents while hardware is modifying the contents of the register Table 50 Debug UART modes Mode SMO SM1 Description Baud rate 0 0 0 Shift register fei 6 1 0 1 8 bits Debug UART Variable 2 1 0 9 bits Debug UART fotk 64 or fok 32 3 1 1 9 bits Debug UART Variable 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 34 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 8 4 SOBUF register 8 1 8 5 8 1 8 6 115432 This register is implemented twice Writing to SOBUF writes to the transmit buffer Reading from SOBUF reads from the receive buffer Only hardware can read from the transmit buffer and write to the receive buffer Table 51 Debug UART SOBUF Register SFR address 99h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol SOBUF 7 0 Reset 0 0 0 0 0 0 0 0 Access R W RW RW RW RW RW PRW R W Table 52 Description of SOBUF bits Bit Symbol Description 7100 SOBUF 7 0 Writing to SOBUF writes to the transmit buffer Reading from SOBUF reads from the receive buffer Mode 0 baud rate In mode O0 the baud rate is derived from the CPU states signals and thus Baud rate in mode 0 1 clk 6
132. able 231 Description of CIU ManualRCV bits continued Bit Symbol Description 3 LargeBWPLL Set to logic 1 the bandwidth of the internal PLL for clock recovery is extended Note As the bandwidth is extended the PLL filtering effect is weaker and the performance of the communication may be affected 2 ManualHPCF Set to logic 0 the HPCF 1 0 bits are ignored and the HPCF 1 0 settings are adapted automatically to the receiving mode 1t00 HPCFT 1 0 Selects the High Pass Corner Frequency HPCF of the filter in the internal receiver chain Value Description 00 For signals with frequency spectrum down to 106 kHz 01 For signals with frequency spectrum down to 212 kHz 10 For signals with frequency spectrum down to 424 kHz 11 For signals with frequency spectrum down to 848 kHz NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 168 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller 8 6 23 30 CIU TypeB register 630Eh 115432 Selects the specific settings for the ISO IEC 14443B CONFIDENTIAL Table 232 CIU TypeB register address 630Eh bit allocation Bit 7 Symbol Rx SOFReq Reset 0 Access R W 6 5 4 3 2 1 0 Rx EOFSOF NoTx NoTx TXEGT 1 0 EOFReq Width SOF EOF 0 0 0 0 0 0 0 R W R R W R W R W R W R W Table 233 Description of CIU TypeB bits Bit Symbol 7 RxSOFReq 6 RxEOFReq 5 2 4 EOFSOFWidth 3
133. able to handle the different MSB and LSB requirements for the different protocols The bit MSBFirst in the register CIU Mode indicates that the data will be loaded with MSB first The registers CRCResult Hi and CRCResult Lo indicate the result of the CRC calculation 8 6 16 FIFO buffer An 64 8 bits FIFO buffer is implemented in the CIU It buffers the input and output data stream between the 80C51 and the internal state machine of the CIU Thus it is possible to handle data streams with lengths of up to 64 bytes without taking timing constraints into account 8 6 16 1 Accessing the FIFO buffer The FIFO buffer input and output data bus is connected to the register CIU_FlFOData Writing to this register stores one byte in the FIFO buffer and increments the internal FIFO buffer write pointer Reading from this register shows the FIFO buffer contents stored at the FIFO buffer read pointer and decrements the FIFO buffer read pointer The distance between the write and read pointer can be obtained by reading the register CIU FIFOLevel When the 80C51 starts a command the CIU may while the command is in progress access the FIFO buffer according to that command Physically only one FIFO buffer is implemented which can be used in input and output direction Therefore the 80C51 has to take care not to access the FIFO buffer in an unintended way 8 6 16 2 Controlling the FIFO buffer Besides writing to and reading from the FIFO buffer the FIFO
134. according to the FeliCa or ISO IEC 14443A MIFARE card interface scheme The CIU generates the load modulation signals either from its transmitter or from the LOADMOD pin driving an external active circuit A complete secure card functionality is only possible in combination with a secure IC using the NFC WI S C interface Compliant to ECMA 340 and ISO IEC 18092 NFCIP 1 Passive and Active communication modes the CIU offers the possibility to communicate to another NFCIP 1 compliant device at transfer speeds up to 424 kbit s The CIU handles the complete NFCIP 1 framing and error detection The CIU transceiver can be connected to an external antenna for Reader Writer or Card PICC modes without any additional active component 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 98 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 1 Feature list 115432 Frequently accessed registers placed in SFR space Highly integrated analog circuitry to demodulate and decode received data Buffered transmitter drivers to minimize external components to connect an antenna Integrated RF level detector Integrated data mode detector Typical operating distance of 50 mm in ISO IEC 14443A MIFARE or FeliCa in Reader Writer mode depending on the antenna size tuning and power supply Typical operating distance of 50 mm in NFCIP 1 mode depending on the antenna
135. address A8h bit allocation 17 Table 11 Description of IEO bits 17 Table 12 Interrupt controller IE1 register SFR address E8h bit allocation 18 Table 13 Description of IE1 bits 18 Table 14 Interrupt controller IPO register SFR address B8h bit allocation 19 Table 15 Description of IPO bits 19 Table 16 Interrupt controller IP1 register SFR address F8h bit allocation 19 Table 17 Description of IP1 bits 19 Table 18 GPIRQ register address 6107h bit allocation l lllselllslelllsssn 20 Table 19 Description of GPIRQ bits 20 Table 20 Timer0 1 Special Function registers list 21 Table 21 Timer0 1 SFR registers CPU state access 22 Table 22 Timer0 1 TO1CON register SFR address 88h bit allocation 00200000 eee 23 Table 23 Description of Timer0 1 TO1CON register bits 23 Table 24 Timer 0 1 TO1MOD register SFR address 89h bit allocation 0 02000 eee 24 Table 25 Description of TO1MOD bits 24 Table 26 Timer0 1 TOL register SFR address 8Ah bit allocation llli 25 Table 27 Description of TOL bits 25 Table 28 Timer0 1 TOH register SFR address 8Ch bit allocation 002200 0 eee 25 Table 29 Description of TOH bits 25 Table 30 Timer0 1 T1L register
136. age 2l o 0 3 x PVpp V VoH Push pull mode high PVpp 29V PVpp 0 4 PVpp V level output voltage lou 4 mA PVpp 1 8 V BI PVpp 0 4 PVpp V lou 2 mA VoL Push pull mode low level PVpp 3 V 0 0 4 V output voltage lo 4 mA PVpp 1 8 V Bo 0 4 V lot 2 mA li Input mode high level Vi PVpp 1 1 uA input current lit Input mode low level Vi 20V 1 1 uA input current li eak Input leakage current RSTPD_N 0 4V 1 1 uA Cin Input capacitance 2 5 pF Cout Load capacitance 30 pF trise fall Rise and fall times PVpp 3 V 13 5 ns Vou 0 8 x PVpp VoL 0 2 x PVpp Cout 30 pF PVpp 1 8 V 10 8 ns Vou 0 7 PVpp VoL 0 3 x PVpp Cout 30 pF 1 To minimize power consumption when in Soft Power Down mode the limit is PVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V 3 Data at PVDD 1 8V are only given from characterization results NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 201 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 12 Input output pin characteristics for P34 SIC CLK 12 13 115432 Table 305 Input output pin characteristics for P34 SIC CLK Symbol Parameter Conditions Min Typ Max Unit Vin High level input voltage Cl 0 7 x SVpp SVpp V ViL Low level input voltage 21 0 0 3x SVpp V Vou Push pull mode high level VBAT 3 4 V SVpp 0 4 SVpp V
137. ain In open drain configuration an external pull up resistor is required to output or read a logic 1 When writing polarity Px n to logic 0 the GPIO pad is pulled down to logic 0 When writing polarity Px n to logic 1 the GPIO pad is in High Impedance NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 40 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 2 1 2 Quasi Bidirectional 115432 Control PxCFGA n 1 PxCFGB n 0 GPIO pad Px n a CPU CLK output mode input mode CPU CLK cpu cik LJ LI Write Px n GPIO pad e en n en n e p ep 0 e hd e hd e e pu e pu GPIO pad zi zi Read Px n Fig 7 Quasi Bidirectional In Quasi Bidirectional configuration e p is driven to logic 1 for only one CPU CLK period when writing Px n During the tpushpul time the pad drives a strong logic 1 at its output While zi GPIO is logic 1 the weak hold transistor e hd is ON which implements a latch function Because of the weaker nature of this hold transistor the pad cell can now act as an input as well A third very weak pull up transistor e pu ensures that an high impedance input is read as logic 1 e_pu is clocked and is at logic 1 while Px n is at logic 1 On a transition from logic 0 to logic 1 externally driven on GPIO pad when the voltage
138. al RF level detector DO Envelope shows the output of the internal coder Table 172 TstBusBitSel set to ODh Test bus bit Test signal Commenis D6 clkstable shows if the oscillator delivers a stable signal D5 clk27 8 shows the output signal of the oscillator divided by 8 D4 cIk27r1 8 shows the clk27rf signal divided by 8 D3 clk13 4 shows the clk13rf divided by 4 D2 clk27 shows the output signal of the oscillator D1 clk27rf shows the RF clock multiplied by 2 DO clk13rf shows the RF clock of 13 56 MHz NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 140 of 224 NXP Semiconductors PN532 C1 8 6 21 3 8 6 21 4 115432 Near Field Communication NFC controller CONFIDENTIAL Test signals at pin AUX Each signal can be switched to pin AUX1 or AUX by setting SelAux1 or SelAux2 in the register CIU_AnalogTest See Table 279 on page 184 PRBS Enables the Pseudo Random Bit Stream of 9 bit or 15 bit length sequence PRBS9 or PRBS15 according to ITU TO150 To start the transmission of the defined datastream Transmit command has to be activated The preamble Sync byte start bit parity bit are generated automatically depending on the selected mode Note All relevant registers to transmit data have to be configured before entering PRBS mode according ITU TO150 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 141 of 224 NXP
139. al secure companion chip Dedicated lO ports for external device control Integrated antenna detector for production tests ECMA 373 NFC WI interface to connect an external secure IC NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 3 of 224 NXP Semiconductors PN532 C1 3 Applications B Mobile and portable devices B Consumer applications 4 Quick reference data Near Field Communication NFC controller CONFIDENTIAL Table 1 Quick reference data Symbol Parameter VBAT ICVpp PVpp SVpp IHPD Ispp IpvDD Isvpp lavDD Irvpp Battery supply voltage LDO output voltage Supply voltage for host interface Output voltage for secure IC interface Hard Power Down current consumption Soft Power Down current consumption Digital supply current SVpp load current Analog supply current Transmitter supply current Continuous total power dissipation Operating temperature range Conditions Vear gt 3 4 V Ves 20V Vas 0 V Vss 20V SVpp Switch Enabled Vgar 5V Vgar 5 V RF level detector on Vgar 5 V SVpp switch off Vear 5 V SVpp switch on Vgar 25V During RF transmission Vgar 9 V Tamb 30 to 85 C Min 2 7 0 2 7 1 6 DV pp 0 5 t 2 Typ Max Unit 55 V 3 34 VW 36 V DVpp V 2 uA 45 uA 25 mA 30 mA 6 mA 608 1504 mA 05 W 85 C 1 DVpp AVpp and TVpp must always be at th
140. also to be set to logic 1 to enable the corresponding I C interrupt to the CPU 2 AA Assert Acknowledge flag If AA is set to logic 1 an acknowledge low level to SDA will be returned during the acknowledge clock pulse on the P50_SCL line when The own Slave address has been received The general call address has been received while the general call bit GC in I CADR is set e A data byte has been received while the 12C interface is in Master Receiver mode e A data byte has been received while the I C interface is in the addressed Slave Receiver mode When the IC interface is in the addressed Slave Transmitter mode state C8h will be entered after the last serial bit is transmitted When Sl is set to logic 0 the 12C interface leaves state C8h enters the Not addressed Slave Receiver mode and the SDA line remains at logic 1 In state C8h AA can be set to logic 1 again for future address recognition When the 12C interface is in the Not addressed Slave mode its own Slave address and the general call address are ignored Consequently no acknowledge is returned and a serial interrupt is not requested Thus the 12C interface can be temporarily released from the I C bus while the bus status is monitored While the 12C interface is released from the bus START and STOP conditions are detected and I2C data are shifted in Address recognition can be resumed at any time by setting AA to logic 1 If AA is set to logic 1 when t
141. an interrupt will be generated if P71 is at logic 1 6 gpirq level P50 Configures the polarity of signal on P50 to generate a GPIRQ interrupt event assuming gpirq enable P50 is set When set to logic 0 an interrupt will be generated if P50_SCL is at logic 0 When set to logic 1 an interrupt will be generated if P50_SCL is at logic 1 5 gpirq level P35 Configures the polarity of signal on P35 to generate a GPIRQ interrupt event assuming gpirq enable P35 is set When set to logic 0 an interrupt will be generated if P35 is at logic 0 When set to logic 1 an interrupt will be generated if P35 is at logic 1 4 gpirq level P34 Configures the polarity of signal on P34 to generate a GPIRQ interrupt event assuming gpirq enable P34 is set When set to logic 0 an interrupt will be generated if P34 is at logic 0 When set to logic 1 an interrupt will be generated if P34 is at logic 1 Remark If hide_svdd_sig of the register control_rngpower is set and gpirq enable P34 is also set then this bit will be asserted independently of the level on the pad P34 3 gpirq enable P71 When set to logic 1 enables pad P71 to generate a GPIRQ interrupt event 2 gpirq enable P50 When set to logic 1 enables pad P50_SCL to generate a GPIRQ interrupt event 1 1 gpirq enable P35 When set to logic 1 enables pad P35 to generate a GPIRQ interrupt event 1 0 gpirq enable P34 When set to logic 1 enables pad P34 to generate a GPIRQ interrupt even
142. and SDA are configured in Open Drain mode In HSU mode HSU RX is in input mode and HSU TX is in push pull mode In SPI mode NSS MOSI and SCK are in inputs mode MISO is in push pull mode NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 49 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 2 12C interface It is recommended to refer the 12C standard for more information The 12C interface implements a Master Slave I C bus interface with integrated shift register shift timing generation and Slave address recognition I C Standard mode 100 kHz SCLK and Fast mode 400 kHz SCLK are supported General Call W is supported not hardware General Call GC R The mains characteristics of the I2C module are e Support Master Slave I C bus e Standard and Fast mode supported Wake up of the PN532 on its own address Wake up on General Call W GC W The 12C module is control through 5 registers Table 75 1 C register list Name Size Address Description Access bytes I2ZCCON 1 D8h SFR Control register R W I2CSTA 1 D9h SFR Status register R W l2CDAT 1 DAh SFR Data register R W I2CADR 1 DBh SFR Slave Address register R W i c wu control 1 610Ah Control register for the I2C wake up conditions R W 8 3 2 1 I C functional description The 12C interface may operate in any of the following four modes Master Tran
143. ansfer The protocol used is based on ADDRESS DATA protocol for status data exchanges ADDRESS DATA DATA DATA for data transfers An exchange starts on the falling edge of NSS and follows the diagram described below SPI status register read There is in that case no read request going to the FIFO manager The content of the status register is loaded in the SPI shift register SPI Status register read access STATUS N A Read MISO NA Status DATA NSS Fig 15 SPI Status register read access MOSI FIFO manager read access Bytes are loaded from the FIFO manager into the SPI shift register and sent back to the host Remark for proper operation the firmware should write an additional byte in the FIFO manager FDATA This byte will not be transmitted FIFO manager read access TOS DATA N A Read N A MISO DATA DATA DATA DATA Nss Fig 16 SPI FIFO manager read access NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 79 of 224 NXP Semiconductors PN532 C1 8 3 5 5 8 3 5 6 115432 Near Field Communication NFC controller CONFIDENTIAL FIFO manager write access MISO is maintained at logic 0 Once a byte is received a write request is sent to the FIFO manager and the byte is loaded from SPI shift register into Receive FIFO of the FIFO manager FIFO manager write access
144. are set and these bits can be used to generate an interrupt CIU timer has a input clock of 6 78 MHz derived from the 27 12 MHz quartz CIU timer consists of 2 stages 1 prescaler and 1 counter The prescaler is a 12 bits counter The reload value for the prescaler can be defined between 0 and 4095 in register CIU_TMode and CIU TPrescaler This decimal value is called TPrescaler The reload value TReloadVal for the counter is defined with 16 bits in a range from 0 to 65535 in the registers CIU TReloadVal Lo and CIU TReloadVal Hi The current value of CIU timer is indicated by the registers CIU_TCounterVal_lo and CIU TCounterVal hi If the counter reaches 0 an interrupt will be generated automatically indicated by setting the TimerIRq flag in the register CommonlRq If enabled it will set to logic 1 CIU IRQ 1 in the register CIU_Status1 TimerlRq flag can be set to logic 1 or to logic 0 by the 80C51 Depending on the configuration CIU timer will stop at 0 or restart with the value of the registers CIU TReloadVal Lo and CIU TReloadVal Hi Status of CIU timer is indicated by the bit TRunning in the register CIU_Status1 CIU timer can be manually started by TStartNow in register Control or manually stopped by TStopNow in register Control Furthermore CIU timer can be activated automatically by setting the bit TAuto in the register CIU_TMode to fulfill dedicated protocol requirements automatically The time delay of a timer stage is the r
145. as not been executed and 106 kbit is detected This command can be cleared by firmware by writing any other command to the CIU Command register e g the Idle command Writing the same content again to the CIU Command register resets the state machine NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 136 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL a l pidon L t 53 _____ f jii F 4 rna E mue CE Maa oo gt nm rer m RP nc sie Bi ERA PAL x wma LECT TE Wama ELECT A PUMA c WTA i a HTA TTE Ere al ro Erma E HELT Lf mEADYS je SELECT La hm a riELECT aL MEE ki A fra fo SELOCT ECI d ee 3 act a ar i Hia l 4 hs fers Prata haa Free ma hw i ed Poe te D mwumd Fig 46 AutoColl command NFCIP 1 106 kbps passive communication mode The MIFARE anticollision is finished and the command changes automatically to Transceive The FIFO contains the ATR_REQ frame including the start byte FOh The bit TargetActivated in the register CIU Status is set to logic 1 e NFCIP 1 212 and 424 kbps passive communication mode The FeliCa polling command is finished and the command has automatically changed to Transceive The FIFO contains the ATR_REQ frame The bit TargetActivated in the register CIU Status is set to
146. be set to logic 1 to enable the corresponding CPU interrupt 2 irq rx fer en Framing error interrupt enable When set to logic 1 this bit enables the interrupt generation when the bit irq rx fer is set to logic 1 The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 1 irq rx over Receive FIFO overflow interrupt Set to logic 1 when the FIFO manager is full rcv ack is set to logic 0 and when HSU shift register is ready to send another byte to the FIFO manager 0 irq rx fer Framing error interrupt Set to logic 1 when a framing error has been detected Framing error detection is based on Stop bit sampling When Stop bit is expected at logic 1 but is sampled at logic 0 this bit is set to logic 1 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 75 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 4 6 HSU CTR register This register controls the configuration of the HSU Table 113 HSU CTR register SFR address ACh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol hsu wu start frame tx stopbit 1 0 rx stopbit tx en rx en soft reset n en Reset 0 0 0 0 o o o 1 Access R W R W RW RW RW RW RW RW Table 114 Description of HSU_CTR bits Bit Symbol Description 7 hsu wu en HSU wake up enable When set to logic 1 this bit re ac
147. bit allocation Bit 7 6 5 4 3 2 1 0 Symbol SMO SM1 SM2 REN TB8 RB8 TI RI Reset 0 0 0 0 o o 0 0 Access R W R W R W R W R W R W R W R W Table 49 Description of SOCON bits Bit Symbol Description 7to6 SM 0 1 Mode selection bit 0 and 1 Set by firmware only The Debug UART has 4 modes Table 50 Debug UART modes on page 34 5 SM2 Multi processor communication enable Enables the multi processor communication feature Set by firmware only In mode 2 and 3 if SM2 is set to logic 1 then RI will not be activated and RB8 and SOBUF will not be loaded if the 9th data bit received is a logic 0 if SM2 is set to logic 0 it has no influence on the activation of RI and RB8 In mode 1 if SM2 is set to logic 1 then RI will not be activated and RB8 and SOBUF will not be loaded if no valid stop bit was received if SM2 is set to logic 0 it has no influence on the activation of RI and RB8 In mode 0 SM2 has no influence 4 REN Serial reception enable Set by firmware only When set to logic 1 enables reception 3 TB8 Transmit data bit Set by firmware only In modes 2 and 3 the value of TB8 is transmitted as the 9th data bit In modes 0 and 1 the TB8 bit is not used 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 33 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Table 49 Description of SOCON bits contin
148. buffer pointers might be reset by setting the bit FlushBuffer in the register CIU_FlFOLevel Consequently the FIFOLevel 6 0 bits are set to logic 0 the bit BufferOvfl in the register CIU Error is set to logic 0 the actually stored bytes are not accessible anymore and the FIFO buffer can be filled with another 64 bytes again 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 127 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 16 3 Status information about the FIFO buffer 115432 The 80C51may obtain the following data about the FIFO buffers status Number of bytes already stored in the FIFO buffer FIFOLevel 6 0 in register CIU FIFOLevel Warning that the FIFO buffer is quite full HiAlert in register CIU_Status1 Warning that the FIFO buffer is quite empty LoAlert in register CIU_Status1 Indication that bytes were written to the FIFO buffer although it was already full BufferOvfl in register CIU Error BufferOvfl can be set to logic 0 only by setting to logic 1 bit FlushBuffer in the register CIU FIFOLevel The CIU can generate an interrupt signal If LoAlertlEn in register CIU CommlEn is set to logic 1 it will set to logic 1 CIU IRQ O in the register CIU Status1 when LoAlert in the same register changes to logic 1 If HiAlertlEN in register CIU CommlEn is set to logic 1 it will set to logic 1 CIU IRQ Oin the regi
149. byte 0 Sector key byte 1 Sector key byte 2 Sector key byte 3 Sector key byte 4 Sector key byte 5 Card serial number byte 0 Card serial number byte 1 Card serial number byte 2 Card serial number byte 3 In total 12 bytes shall be written to the FIFO Note When the MFAuthent command is active any FIFO access is blocked Anyhow if there is an access to the FIFO the bit WrErr in the register CIU Error is set to logic 1 This command terminates automatically when the MIFARE 1KB or MIFARE 4 KB emulation card is authenticated The bit MFCrypto10On in the register CIU_Status2 is set to logic 1 This command does not terminate automatically when the card does not answer therefore CIU timer should be initialized to automatic mode In this case beside the bit IdlelRq the bit TimerlRq can be used as termination criteria During authentication processing the bits RxIRq and TxIRq of CIU Commlrq register are blocked The Crypto1On bit is only valid after termination of the MFAuthent command either after processing the authentication or after writing the Idle command in the register CIU Commang In case there is an error during the MIFARE authentication the ProtocolErr bit in the CIU Error register is set to logic 1 and the Crypto1On bit in CIU Status2 register is set to logic 0 SoftReset command This command performs a reset of the CIU The configuration data of the internal buffer remains unchanged All registers are s
150. caler HSU CTR Baud rate control HSU PRE hsu rcv status hsu rcv control rcv req o HSULONT rcv req i amp Preamble Filter 00 00 FF rcv ack rx_clk Ix irq di RX Control hsu irq 1 to 0 Transition Detector rx start 1FFH x shift Bit Detector Input Shift Registe hsu rxin wake up hsu on S generator Fig 13 HSU block diagram The HSU contains 4 SFRs Table 110 HSU SFR register list Name Size bytes SFR Address Description Access HSU_STA 1 ABh HSU STAtus register R W HSU_CTR 1 ACh HSU ConTRol register R W HSU PRE 1 ADh HSU PREscaler for baud rate generator R W HSU_CNT 1 AEh HSU CouNTer for baud rate generator R W 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 73 of 224 NXP Semiconductors PN532 C1 8 3 4 1 8 3 4 2 8 3 4 3 115432 Near Field Communication NFC controller CONFIDENTIAL Mode of operation The HSU supports only one operational mode which has the following characteristics Start bit Start bit is detected when a logic 0 is asserted on the HSU RX line 8 data bits The data bits are sent or received LSB first Stop bit During reception the Stop bit s is detected when all the data bits are received and when Stop bit s is sampled to logic 1 The number of Stop bits is programmable It
151. cally sets STO to logic 0 In Slave mode STO may be set to logic 1 to recover from an error condition In this case no STOP condition is transmitted to the 12C bus However the 12C interface hardware behaves as if a STOP condition has been received and switches to the defined not addressed Slave Receiver mode If the STA and STO bits are both set to logic 1 the STOP condition is transmitted to the 12C bus if the 12C interface is in Master mode in Slave mode the 12C interface generates an internal STOP condition which is not transmitted The 12C interface then transmits a START condition When the STO bit is set to logic 0 no STOP condition will be generated 3 SI Serial interrupt flag When Sl is set to logic 1 then if the serial interrupt from the I2C interface port is enabled the CPU will receive an interrupt SI is set by hardware when any one of 25 of the possible 26 states of the I C interface are entered The only state that does not cause SI to be set to logic 1 is state F8h which indicates that no relevant state information is available While SI is set by hardware to logic 1 P50_SCL is held in logic 0 when the SCL line is logic 0 and P50_SCL is held in high impedance when the SCL line is logic 1 SI must be set to logic 0 by firmware When the SI flag is set to logic 0 no serial interrupt is requested and there is no stretching of the SCL line via P50_SCL The bit IE1 4 of register IE1 see Table 13 on page 18 has
152. can be 1 or 2 During Transmission after the complete data bit transmission a variable number of Stop bit s is transmitted This number is programmable from 1 to 4 HSU Baud rate generator To reach the high speed transfer rate the HSU has it own baud rate generator The baud rate generator comprises a prescaler and a counter The prescaler is located before the counter The purpose of the prescaler is to divide the frequency of the count signal to enlarge the range of the counter at the cost of a lower resolution The division factor of the prescaler is equal to 2 to the power HSU_PRE 8 0 Table 113 on page 76 resulting in division factors ranging from 1 20 to 256 28 The combination of these 2 blocks defines the bit duration and the bit sampling HSU preamble filter Received characters are sent to the FIFO manager after three consecutive characters have been received 00 00 FF When the frame is finished and before a new frame arrives firmware shall write a logic 1 in the start_frame bit of the HSU_CTR register to re activate the preamble filter If firmware does not write a logic 1 then all characters of the frame are sent to the FIFO manager including the preamble NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 74 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 4 4 HSU wake up generator The wake up generator is
153. ch is activated by the switch 4 Sic switch en Enable of the SVDD switch When set to logic 0 the SVDD switch is disabled and the SVDD output power is tied to the ground When set to logic 1 the SVDD switch is enabled and the SVDD output deliver power to the secure IC and to the internal pads SIGIN SIGOUT and P34 3 Reserved NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 118 of 224 NXP Semiconductors PN532 C1 8 6 11 115432 Near Field Communication NFC controller CONFIDENTIAL Table 162 Description of Control switch rng bits continued Bit Symbol Description 2 cpu need rng Force the random number generator in running mode When set to logic 0 the random number generator is under control of the CIU When set to logic 1 the random number generator is forced to run 1 random dataready Indicates availability of random number When set to logic 1 it indicates that a new random number is available It is automatically set to logic O when the register data rng is read 0 Reserved Data mode detector The data mode detector is able to detect received signals according to the ISO IEC 14443A MIFARE FeliCa or NFCIP 1 schemes and the standard baud rates for 106 kbit s 212 kbit s and 424 kbit s in order to prepare the internal receiver in a fast and convenient way for further data processing The data mode detector can only be activated by the AutoColl com
154. cles within 2 and 12 MHz 8 6 14 Hardware support for FeliCa and NFC polling 8 6 14 1 115432 Polling sequence functionality for initiator 1 Timer The CIU has a timer which can be programmed to generate an interrupt at the end of each timeslot or if required at the end of the last timeslot only 2 The receiver can be configured to receive frames continuously The receiver is ready to receive immediately after the last frame has been transmitted This mode is activated by setting to logic 1 the bit RxMultiple in the register CIU_RxMode It has to be set to logic 0 by firmware 3 The CIU adds one byte at the end of every received frame before it is transferred into the FIFO buffer This byte indicates whether the received frame is correct see register Err The first byte of each frame contains the length byte of the frame 4 The length of one frame is 18 or 20 bytes 1 byte error Info The size of the FIFO is 64 bytes This means 3 frames can be stored in the FIFO at the same time If more than 3 frames are expected the 80C51 has to read out data from the FIFO before the FIFO is filled completely In the case that the FIFO overflows data is lost See error flag BufferOvfl NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 125 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 14 2 Polling sequence functionality for targe
155. d by PSCFGA 1 and PSCFGB 1 Reading from P3 1 reads the state of P31 pin 0 P3 0 When the P30 pin alternate function UART RX is not used writing to P3 0 writes the corresponding value to P30 pin according to the configuration mode defined by P3CFGA 0 and PSCFGB 0 Reading from P3 0 reads the state of P30 pin NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 47 of 224 NXP Semiconductors PN532 C1 8 3 Host interfaces Near Field Communication NFC controller CONFIDENTIAL PN532 must be able to support different kind of interfaces to communicate with the HOST All the interfaces that have to be supported are exclusive SPI interface e C interface Standard and Fast modes High Speed UART HSU supporting specific high baud rates FIFO Manager Host Interfaces Fig 10 Host interface block diagram selif 1 0 RAM HOST 8 3 1 Multi InterFace MIF description The Multi InterFace MIF manages the configuration of the host interface pins supplied by PVDD according to the selected links with the bits selif 1 0 of register Config IO 11 see Table 74 on page 49 The firmware must copy the value of the pads 10 and I1 to respectively selif 0 and selif 1 Table 72 HOST interface selection Selif 1 0 00 01 10 11 Host interface selected HSU SPI Pc Reserved Pin number
156. d execution will clear all error flags except for bit TempErr A setting by firmware is impossible 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 149 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 9 CIU Status1 register DFh or 6337h Contains status flags of the CRC Interrupt Request System and FIFO buffer Table 190 CIU Status1 register address DFh or 6337h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol b n CRCOk CRCReady CIU_IRQ eal RFOn HiAlert LoAlert 1 0 Reset 0 0 1 0 0 x 0 1 Access R R R R Table 191 Description of CIU Status1 bits Bit Symbol Description 7 CIU IRQ 1 This bit shows if any CIU IRQ 1 source requests attention with respect to the setting of the interrupt enable flags see CIU CommlEn and CIU DivlEn registers The bit IE1 2 of register IE1 see Table 13 on page 18 has to be set to logic 1 to enable the corresponding CPU interrupt 6 CRCOk Set to logic 1 the CRC result is zero For data transmission and reception the bit CRCOk is undefined use CRCErr in CIU Error register CRCok indicates the status of the CRC coprocessor during calculation the value changes to logic 0 when the calculation is done correctly the value changes to logic 1 5 CRCReagy Settologic 1 when the CRC calculation has finished This bit is only valid for the CRC co processor calculation using the
157. d to temporarily release the I C interface from the 12C bus since when ENS is set to logic 0 the 12C bus status is lost The AA flag should be used instead 5 STA START control When the STA bit is set to logic 1 to enter Master mode the 12C interface hardware checks the status of the 12C bus and generates a START condition if the bus is free If the bus is not free then the 12C interface waits for a STOP condition which will free the bus and generates a START condition after a delay of a half clock period of the internal serial clock generator If STA is set to logic 1 while the 12C interface is already in a Master mode and one or more bytes are transmitted or received the 12C interface transmits a repeated START condition STA may be set to logic 1 at any time This includes the case when the 12C interface is the addressed Slave When the STA bit is set to logic 0 no START condition or repeated START condition will be generated 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 54 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Table 77 Description of I2CCON bits continued Bit Symbol Description 4 STO STOP control When the STO bit is set to logic 1 while the 12C interface is in Master mode a STOP condition is transmitted to the IC bus When the STOP condition is detected on the bus the 12C interface hardware automati
158. ddress 8Ah bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TOL7 TOL6 TOL5 TOL4 TOL3 TOL2 TOL1 TOLO Reset 0 0 0 o Oo 0 O 0 Access RW RW RW RW RW RW RW RW Table 27 Description of TOL bits Bit Symbol Description 7 0 TOL 7 to TOL O TimerO timer counter lower byte Table 28 Timer0 1 TOH register SFR address 8Ch bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TOH 7 TOH 6 TOH 5 TOH 4 TOH3 TOH 2 TOH 1 TOH O Reset 0 0 0 0 0 0 0 0 Access RW RW RW RW RW RW RW RW Table 29 Description of TOH bits Bit Symbol Description 7100 TOH 7 to TOH O TimerO timer counter upper byte NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 25 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 6 5 T1L and T1H registers These are the actual timer counter bytes for Timer1 T1L is the lower byte T1H is the 8 1 6 6 115432 upper byte Table 30 Timer0 1 T1L register SFR address 8Bh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol T1L 7 T1L 6 T1L 5 T1L 4 T1L 3 T1L 2 T1L 1 T1L O Reset 0 0 oO 0 0 0 0 0 Access RW RW RW RW RW RW RW RW Table 31 Description of T1L bits Bit Symbol Description 7100 T1L 7to T1L 0 Timer1 timer counter lower byte Table 32 Timer0 1 T1H register SFR address 8Dh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol T1H 7 T1H 6 T1H 5 T1H 4 T1H 3 T1H 2 T1H 1 T1H 0
159. de The NFCIP 1 communication differentiates between Active and Passive communication modes Active Communication mode means both the initiator and the target are using their own HF field to transmit data Passive Communication mode means that the Target answers to an Initiator command in a load modulation scheme The Initiator is active in terms of generating the RF field In order to fully support the NFCIP 1 standard the PN532 supports the Active and Passive Communications mode at the transfer speeds 106 kbit s 212 kbit s and 424 kbit s as defined in the NFCIP 1 standard Initiator Active Target Passive or Active Fig 31 NFCIP 1 mode With appropriate firmware the PN532 can handle the NFCIP 1 protocol for all communication modes and data rates for both Initiator and Target NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 105 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 4 1 ACTIVE Communication mode Active Communication Mode means both the Initiator and the Target are using their own RF field to transmit data e PN532 1 Initiator starts the communication PN532 NFC Initiator at selected transfer speed NFC Target Host Power to generate Powered for Digital the field Communication
160. e 0 0 Read data byte 1 0 Read data byte 1 0 Read data byte X Read data byte X 0 0 0 1 0 Next Action Taken By the I C interface Hardware Data byte will be received an NOT ACK will be returned Data bye will be received and ACK will be returned Data byte will be received an NOT ACK will be returned Data byte will be received and ACK will be returned Data byte will be received and NOT ACK will be returned Data byte will be received and ACK will be returned Data byte will be received an NOT ACK will be returned Data byte will be received and ACK will be returned Data byte will be received an NOT ACK will be returned Data byte will be received and ACK will be returned Switched to not addressed SLV mode No recognition of own SLA or General call address Switched to not addressed SLV mode Own SLA will be recognized General call address will be recognized if IICADR O is set to logic 1 Switched to not addressed SLV mode No recognition of own SLA or General call address A START condition will be transmitted when the bus becomes free Switched to not addressed SLV mode Own SLA will be recognized General call address will be recognized if IICADR 0 is set to logic 1 A START condition will be transmitted when the bus becomes free Data byte will be received and NOT ACK will be returned Data byte will be received and ACK will be returned IVLLN3GIJNOO J9j 01u09 54N uoneoiunuiuo pjJarJ Je9N LO c SNd
161. e CRC co processor is in Self Test mode and performs a digital self test The result of the self test is written in the FIFO Transmit command The content of the FIFO is transmitted immediately after starting the command Before transmitting FIFO content all relevant register settings have to be set to transmit data in the selected mode This command terminates automatically when the FIFO gets empty and the active command is Idle It can be terminated by any other command written to the CIU Command register NoCmdChange command This command does not influence any ongoing command in the CIU Command register It can be used to manipulate any bit except the command bits in the CIU Command register e g the bits RcvOff or Power down NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 134 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 20 10 Receive command 8 6 20 11 115432 The CIU activates the receiver path and waits for any data stream to be received The correct settings for the expected mode have to be set before starting this command This command terminates automatically when the reception ends and the active command is Idle In case of data rates at 212 kbps or 424 kbps with NFC or FeliCa framing the reception ends when the number of bytes indicated by the LEN byte received are received If less bytes than indicated by LE
162. e Miller decoder 2 MFHalted Set to logic 1 this bit indicates that the CIU is set to HALT mode in Card Operating mode at 106 kbit s This bit is either set by the 80C51 or by the internal state machine and indicates that only the code 52h is accepted as a Request command This bit is automatically set to logic O by RF reset 1to00 TxWait 1 0 In combination with TxBitPhase 6 0 in CIU TxBitPhase register defines the additional response time for the target at 106 kbit s in Passive Communication mode and during the AutoColl command See CIU TxBitPhase register NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 166 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 29 CIU_ManualRCV register 630Dh Allows manual fine tuning of the internal receiver IMPORTANT NOTE For standard application it is not recommended to change this register settings Table 230 CIU_ManualRCV register address 630Dh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol FastFilt Delay ParityDisable LargeBWPLL ManualHPCF HPCF 1 0 MF SO MF SO Reset 0 0 0 0 0 0 0 0 Access R RW RW R W R W RW RW RW Table 231 Description of CIU ManualRCV bits Bit Symbol Description 7 Reserved 6 FastFiltMF SO If this bit is set to logic 1 the internal filter for the Miller Delay circuit is set to Fast Mode Note This bit should
163. e T2H can be changed after T2L is read and before T2H is read This situation is indicated by flag T2RD in T2MOD These two 8 bit registers are always combined to operate as one 16 bit timer counter Table 39 Timer2 T2L register SFR address CCh bit allocation 8 1 7 5 Bit 7 6 5 4 3 2 1 0 Symbol T2L 7 T2L 6 T2L 5 T2L 4 T2L 3 T2L 2 T2L 1 T2L 0 Reset 0 0 o o 1 0 9 o 0 Access R W R W RW RW RW RW RW PRW Table 40 Description of T2L bits Bit Symbol Description 7100 T2L 7 to T2L 0 Timer2 timer counter lower byte Table 41 Timer2 T2H register SFR address CDh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol T2H 7 T2H 6 T2H 5 T2H 4 T2H 3 T2H 2 T2H 1 T2H 0 Reset 0 0 0 o o o0 0 0 Access RW RW R W RW RW RW RW RW Table 42 Description of T2H bits Bit Symbol Description 7100 T2H 7 to T2H 0 Timer2 timer counter upper byte RCAP2L RCAP2H registers These are the reload bytes In the reload mode the T2H T2L counters are loaded with the values found in the RCAP2H RCAP2L registers respectively Table 43 Timer2 RCAP2L register SFR address CAh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol R2L 7 R2L 6 R2L 5 R2L 4 R2L 3 R2L 2 R2L 1 R2L 0 Reset 0 0 0 oO 0 0 0 0 Access R W R W RW RW R W RW RW R W Table 44 Description of RCAP2L bits Bit Symbol Description 7100 R2L 7 to R2L 0 Timer2 lower reload byte Table 45 Timer2 RCAP2H regist
164. e following policy Transaction includes initialization anticollision methods and data transfer This sequence must not be interrupted by another transaction Speed should not be changed during a data transfer In order not to disturb current infrastructure based on 13 56 MHz general rules to start NFC communication are defined in the following way Per default NFCIP 1 device is in target mode meaning its RF field is switched off The RF level detector is active Only if application requires the NFCIP 1 device shall switch to Initiator mode Initiator shall only switch on its RF field if no external RF field is detected by RF Level detector during a time of TIDT The initiator performs initialization according to the selected mode NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 108 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 5 Card operating modes 8 6 5 1 The PN532 can be addressed like a FeliCa or ISO IEC 14443A MIFARE card This means that the PN532 can generate an answer in a load modulation scheme according to the ISO IEC 14443A MIFARE or FeliCa interface description Remark The PN532 does not support a secure storage of data This has to be handled by a dedicated secure IC or a host The secure IC is optional Remark The PN532 can not be powered by the field in this mode and needs a power supply ISO IEC
165. e same supply voltage 2 The total current consumption depends on the firmware version different internal IC clock speed 3 With an antenna tuned at 50 at 13 56 MHz 4 The antenna should be tuned not to exceed this current limit the detuning effect when coupling with another device must be taken into account 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 4 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 5 Ordering information 115432 Table 2 Ordering information Type number Package Name Description Version PN5320A3HN C1xxl l4 HVQFN40 Heatsink Very thin Quad Flat package SOT618 1 40 pins plastic body 6 x 6 x 0 85 mm leadless MSL level 2 81 PN5321A3HN C1xxl I2l4 HVQFNA4O Heatsink Very thin Quad Flat package SOT618 1 40 pins plastic body 6 x 6 x 0 85 mm leadless MSL level 2 31 1 2 3 4 xx refers to the ROM code version The ROM code functionalities are described in the User Manual document Each ROM code has its own User Manual Type B software enabled This NXP IC is licensed under Innovatron s ISO IEC 14443 Type B patent license This is tested according the joint IPC JEDEC standard J STD 020C of July 2004 Purchase of an NXP Semiconductors IC that complies with one of the NFC Standards ISO IEC 18 092 ISO IEC21 481 does not convey an implied license under any pa
166. e status codes continued Status Status of the I C Bus and Application firmware Response Next Action Taken By the I C interface Hardware em the I C interface Hardware To from I2CDAT TO I2CCON l STA STO SI AA B8h Read data bye in IICDAT has Load data byte X 0 0 0 Last data byte will be transmitted and ACK bit will be received been transmitted ACK has Load data byte X 0 0 1 Databyte will be transmitted ACK will be received been received COh Read data byte in IICDAT has No I2CDAT action 0 0 0 0 Switched to not addressed SLV mode no recognition of own SLA or been transmitted NOT ACK has General call address been received No I2CDAT action 0 0 0 1 Switched to not addressed SLV mode Own SLA will be recognized General call address will be recognized if IICADR O is set to logic 1 No I2CDAT action 1 0 0 0 Switched to not addressed SLV mode no recognition of own SLA or General call address A START condition will be transmitted when the bus becomes free No I CDAT action 1 0 0 1 Switched to not addressed SLV mode Own SLA will be recognized General call address will be recognized if IICADR O is set to logic A START condition will be transmitted when the bus becomes free C8h Last read data byte in I2CDAT No I2CDAT action 0 0 0 0 Switched to not addressed SLV mode no recognition of own SLA or has been transmitted AA is set General call address to logic 0 ACK has been No I2CDAT action 0 0 0 1 Switched to not addressed SLV mode
167. ed Product data sheet Rev 3 2 3 December 2007 10 of 224 NXP Semiconductors PN532 C1 CONFIDENTIAL Near Field Communication NFC controller 8 1 1 PN532 memory map The memory map of PN532 is composed of 2 main memory spaces data memory and program memory The following figure illustrates the structure XRAM ROM FFFFH FFFFH AO00H 9FFFH 8000H TFFFH PERIPHERAL AREA EE a 60H 7 7 5FFFH 0 I 40 KBYTES SFR RAM ROM FFH Special Function 128 BYTES RAM li Registers INDIRECT M DIRECT ADDRESSING ADDRESSING ONLY ll 128 BYTES RAM f DIRECT O2FFH amp 768 BYTES INDIRECT XRAM ooH ADDRESSING Ooooh 0000H IDATA Data Memory Area Program Memory Area Fig 4 PN532 memory map overview Rev 3 2 3 December 2007 NXP B V 2007 All rights reserved 11 of 224 115432 Product data sheet NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 2 Data memory 8 1 2 1 115432 Data memory is itself divided into 2 spaces 384 byte IDATA with byte wide addressing 258 byte RAM 128 byte SFR 1 bank of 64 KB extended RAM XRAM with 2 byte wide addressing IDATA memory The IDATA memory is mapped into 3 blocks which are referred as Lower IDATA RAM Upper IDATA RAM and SFR Addresses to these blocks are byte wide which implies an address space of only 256 bytes However 384 bytes can be addressed within ID
168. ed START condition the first clock pulse is generated tsu sta Set up time 600 ns for a repeated START condition tsu sto Set up time for STOP condition 600 ns tLow LOW period 1300 ns of the P50 SCL clock tHIGH HIGH period 600 ns of the P50_SCL clock tup pat Data hold time 0 900 ns tsu DAT Data set up time 100 ns tr Rise time 1 20 1000 ns P50_SCL and SDA tf Fall time 0 20 300 ns P50 SCL and SDA tBuF Bus free time between 1 3 ms a STOP and START condition tstrwuspd Stretching time 2 1 ms on P50 SCL when woken up on its own address tHDSDA Internal hold time 330 590 ns for SDA tHDSDA Internal hold time 3 270 ns for SDA in SPD mode 1 The PN532 has a slope control according to the I C specification for the Fast mode The slope control is always present and not dependant of the 12C speed 2 27 12 MHz quartz starts in less than 800 us For example quartz like TAS 3225A TAS 7 or KSS2F with appropriate layout 3 The PN532 has an internal hold time of around 270ns for the SDA signal to bridge the undefined region of the falling edge of P50_SCL SCL SU STO tume HD STA HIGH sr P s E S HD DAT Fig 50 I C timing diagram 115432 NXP B V 2007 All rights reserved 211 of 224 Product data sheet Rev 3 2 3 December 2007 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 13 Application information
169. egister setting of the antenna drivers The 13 56MHz clock can be switched to P34 SIC CLK see sic clk p34 en bit in Table 177 on page 144 clock a A ey es es ee S p S p S signal on ooo 1d r SIGIN signal on antenna Fig 43 Signal shape for SIGIN in FeliCa secure IC mode Remark The signal on antenna is shown in principle only This signal is sinusoidal The clock for SIGIN is the same as the clock for SIGOUT NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 123 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 13 2 Signal shape for ISO IEC14443A and MIFARE NFC WI S C support The secure IC e g the SmartMX is connected to the PN532 via the pins SIGOUT SIGIN and P34 SIC CLK The signal at SIGOUT is a digital 13 56 MHz Miller coded signal between PVSS and SVDD It is either derived from the external 13 56 MHz carrier signal when in Virtual Card Mode or internally generated when in Wired Card mode The register CIU_TxSel controls the setting at SIGOUT Note The clock settings for the Wired Card mode and the Virtual Card mode differ Refer to the description of the bit SicClockSel in register CIU_TestSel1 Bu Tlw RT Sagnal om Emni ced on GIOUT Fig 44 Signal shape for SIGOUT in NFC WI mode The signal at SIGIN is a digital Manchester coded signal compliant with ISO IEC 14443A with a
170. elf generated RF field no RF field generated by initiator during target answer UART Universal Asynchronous Receive Transmit 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 214 of 224 NXP Semiconductors PN532 C1 16 Revision history Table 322 Revision history Near Field Communication NFC controller CONFIDENTIAL Document ID Release date Data sheet status Change notice Supersedes 115410 17 October 2005 Objective data sheet Initial version 115411 24 October 2005 Objective data sheet Revision 1 0 115412 21 December 2005 Objective data sheet Revision 1 1 115420 11 May 2006 Preliminary data sheet Revision 1 2 115421 2 June 2006 Preliminary data sheet Revision 2 0 115422 16 June 2006 Preliminary data sheet update for rev1 3 Revision 2 1 115423 17 August 2006 Preliminary data sheet update for rev1 3 after spec review Revision 2 2 115430 17 October 2006 Product data sheet complete review of the specification Revision 2 3 115431 3 April 2007 Product data sheet Revision 3 0 115432 3 December 2007 Product data sheet Revision 3 1 Modifications Apart from typo corrections General rewording of Mifare designation e g MIFARE Within the Section 1 General description on page 1 Section 8 6 Contactless Interface Unit CIU on page 98 Section 8 6 3 3 ISO IEC 14443B Reader Writer on page 104 the text related to patent The use of this NXP IC accordin
171. eload value 1 Maximum time TPrescaler 4095 TReloadVal 65535 gt 4096 65536 6 78 MHz 39 59 s Example To indicate 100 ms it is required to count 678 clock cycles This means the value for TPrescaler has to be set to TPrescaler 677 The timer has now an input clock of 100 us The timer can count up to 65535 timeslots of 100 ms NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 129 of 224 NXP Semiconductors PN532 C1 8 6 18 8 6 18 1 115432 Near Field Communication NFC controller CONFIDENTIAL Interrupt request system The CIU indicates certain events by setting interrupt bits in the register CIU_Status1 and in addition it will set to logic 1 CIU IRQ 1 or CIU IRQ O If this interrupt is enabled see Table 12 on page 18 the 80C51 will be interrupted This allows the implementation of efficient interrupt driven firmware Interrupt sources The following table shows the integrated interrupt flags the corresponding source and the condition for its activation The interrupt flag TimerIRg in the register CIU Commlrq indicates an interrupt set by the timer unit The setting is done when the timer decrements from logic 1 down to logic 0 The TxIRq bit in the register CIU Commlrq indicates that the transmitter has finished If the state changes from sending data to transmitting the end of frame pattern the transmitter unit sets automatically the interrupt bit to logic
172. elope signal It can be used to drive an antenna directly using a few passive components for matching and filtering see Section 13 Application information on page 212 The signals on TX1 and TX2 can be configured by the register CIU_TxControl see Table 212 on page 159 The modulation index can be set by adjusting the impedance of the drivers The impedance of the p driver can be configured by the registers CIU_CWGsP and CIU_ModGsP The impedance of the n driver can be configured by the registers CIU GsNOn and CIU GsNOff Furthermore the modulation index depends on the antenna design and tuning Remark It is recommended to use a modulation index in the range of 896 for the FeliCa and NFCIP 1 communication scheme at 212 and 424 kbit s The registers CIU_TxMode and CIU TxAuto control the data rate and framing during the transmission and the setting of the antenna driver to support the different requirements at the different modes and transfer speeds In the following tables these abbreviations are used RF 13 56 MHz clock derived from 27 12 MHz quartz divided by 2 e RF n inverted 13 56 MHz clock GsPMos Conductance of the transmitter PMOS GsNMos Conductance of the transmitter NMOS CWGsP PMOS conductance value for Continuous Wave see Table 249 on page 176 e ModGsP refers to ModGsP 5 0 PMOS conductance value for Modulation see Table 250 on page 176 CWGsNOn refers to CWGsP 5 0 NMOS conductance value for
173. ength The demodulated signal changes only at a positive edge of the clock The register CIU_TxSel see Table 217 on page 161 controls the setting at SIGOUT clock lF 1 1 1 1 1 1 l J l J l demodulated signal OT ed o signal on SIGOUT LIT LT LT LT LT LT LT Li Fig 42 Signal shape for SIGOUT in FeliCa secure IC mode Remark The PN532 differs from the ECMA 373 specification by the fact that when in FeliCa card emulation mode the PN532 does send preamble bytes at 212kbps on SIGOUT as soon as the PN532 detects RF field Remark In FeliCa card emulation mode when the PN532 mode detector is activated the data sent on SIGOUT are clocked at the received data rate only after the SYNC bytes are received If per default the FeliCa card emulation mode is expected at 212kpbs the 424kbps may need specific implementation at application level the PN532 will sent beginning of first received frame preamble SYNC bytes at 212kbps Remark To properly work in FeliCa wired card mode the SIGIN signal generated by the FeliCa secure element must be synchronous with the received SIGOUT bit clock and the bit RCVOFF in the register 6331h or SFR register D1h must be set to logic level 1 The phase relationship of the SIGIN and SIGOUT bit clocks must respect a modulo 4 13 56MHz clock cycles The response from the FeliCa secure IC is transferred from SIGIN directly to the antenna driver The modulation is done according to the r
174. er CONFIDENTIAL 8 6 21 2 CIU test bus 115432 The test bus is implemented for production test purposes The following configuration can be used to improve the design of a system using the PN532 The test bus allows to route internal signals to output pins The Observe testbus register is used to enable this functionality Table 169 Observe testbus register address 6104h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol observe_ciu Reset 0 0 0 0 0 0 0 0 Access R R R R R R R RW Table 170 Description of Observe testbus bits Bit Symbol Description 7to1 Reserved 0 observe ciu Configure the pads P3x P30 to P35 RSTOUT N and P70 IRQ to observe internal CIU data bus When set to logic 1 the pads are configured in output mode and show the internal data bus DO to D6 of the CIU P70 IRQ is the 13 56 MHz digital clock of CIU generated from field or crystal The test bus signals are selected by accessing TestBusSel in register CIU TestSel2 Table 171 TstBusBitSel set to 07h Test bus bit Test signal Comments D6 sdata shows the actual received data value D5 scoll shows if in the actual bit a collision has been detected 106 kbit s only D4 svalid shows if sdata and scoll are valid D3 sover shows that the receiver has detected a stop bit ISO IEC 14443A MIFARE mode only D2 RCV_reset shows if the receiver is reset D1 RFon filtered shows the value of the intern
175. er SFR address CBh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol R2H 7 R2H 6 R2H 5 R2H 4 R2H 3 R2H 2 R2H 1 R2H 0 Reset 0 0 0 0 0 0 0 0 Access RW RW RW O RW RW RW RW RW Table 46 Description of RCAP2H bits Bit Symbol Description 7100 R2H 7 to R2H 0 Timer2 upper reload byte 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 30 of 224 NXP Semiconductors PN532 C1 8 1 8 8 1 8 1 8 1 8 2 115432 Near Field Communication NFC controller CONFIDENTIAL Debug UART The Debug UART is implemented to assist debug using UART_RX and UART TX pins Feature list The Debug UART has the following characteristics Full duplex serial port Receive buffer to allow reception of a second byte while the first byte is being read out by the CPU Four modes of operation which support 8 bit and 9 bit data transfer at various baud rates e Supports multi processor communication Baud rate can be controlled through Timer1 or Timer2 baud rate generator Debug UART functional description The serial port has a receive buffer a second byte can be stored while the previous one is read out of the buffer by the CPU However if the first byte has still not been read by the time reception of the second byte is complete one of the bytes will be lost The receive and transmit data registers of the serial port are both accessed by firmware via the Special Function Register SOBUF Writing to SOB
176. er1 reload value T1H 6 ySMOD js 256 32 x6 x Baudrate One can achieve very low baud rates with Timer1 by leaving the Timer1 interrupt enabled and configuring the timer to run as a 16 bit timer high nibble of TO1MOD 0001b and using the Timer1 interrupt to do a 16 bit firmware reload Note the frequency fo is the internal microcontroller frequency If there is no clock divider then feik fosc For details on programming Timer1 to function as baud rate generator for the Debug UART see Section 8 1 6 Timer0 1 description on page 21 The next table lists the maximum baud rates for using mode 2 of Timer1 Table 56 Maximum baud rates using mode 2 of Timer1 Reload value fci divided by SMOD Baud rate at fci Unit 6 78 13 56 27 12 MHz FF 96 1 70 6 141 2 282 5 kb s The next table shows commonly used baud rates using mode 2 of Timer1 and a CLK frequency of 27 12 MHz Table 57 Baud rates using mode 2 of Timer1 with fc 27 12 MHz Reload value fci divided by SMOD Baud rate at fci Unit FC 706 0 38 4 kb s F9 1412 0 19 2 kb s F1 2825 0 9 6 kb s E3 5650 0 4 8 kb s C5 11300 0 2 4 kb s 8A 22600 0 1 2 kb s NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 37 of 224 NXP Semiconductors PN532 C1 8 1 8 9 8 2 115432 Near Field Communication NFC controller CONFIDENTIAL Baud rate
177. ess 6323h bit allocation are rp REPRE DRESS 181 Table 269 Description of CIU TestPinEn bits 181 Table 270 CIU TestPinValue register address 6324h bit allocation 020000 eee eee 182 Table 271 Description of CIU_TestPinValue bits 182 Table 272 CIU TestBus register address 6325h bit allocation 002000 cece eee 182 Table 273 Description of CIU_TestBus bits 182 Table 274 CIU_AutoTest register address 6326h bit allocation 020000 eee eee 183 Table 275 Description of CIU AutoTest bits 183 Table 276 CIU Version register address 6327h bit alocati eerren ene ena e aei e 183 Table 277 Description of CIU Version bits 183 Table 278 CIU AnalogTest register address 6328h bit allocation pes rbd 184 Table 279 Description of CIU AnalogTest bits 184 Table 280 CIU TestDAC1 register address 6329h bit allocation 020000 eee eee 186 Table 281 Description of CIU_TestDAC1 bits 186 115432 Near Field Communication NFC controller CONFIDENTIAL Table 282 CIU_TestDAC2 register address 632Ah bit allocation 2 525 ete gs 186 Table 283 Description of CIU TestDAC2 bits 186 Table 284 CIU TestADC register address 632Bh bit allocation 0000020 cee eee 186 Table 285 Description of CIU_TestADC bits 186 Table 286 CIU RFlevelDet register address 632Fh bit allocation 000020 cee eee 187
178. et Rev 3 2 3 December 2007 38 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL where x is 3 or 7 and n is the bit index At maximum 4 different controllable modes can be supported These modes are defined with the following bits e PxCFGA n 0 and PxCFGB n 0 Open drain e PxCFGA n 1 and PxCFGBj n 0 Quasi Bidirectional Reset mode e PxCFGA n 0 and PxCFGB n 1 input High Impedance e PxCFGA n 1 and PxCFGB n 1 Push pull output Px n is used to write or read the port value Here is the list of the registers used for these GPIO configuration Table 59 Timer0 1 Special Function registers List Name Size SFR address Description Access bytes P3CFGA 1 FCh Port 3 configuration R W P3CFGB 1 FDh Port 3 configuration R W P3 1 BOh Port 3 value RAN P7CFGA 1 F4h Port 7configuration R W P7CFGB 1 F5h Port 7 configuration R W P7 1 F7h Port 7 value R W NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 39 of 224 NXP Semiconductors PN532 C1 8 2 1 8 2 1 1 115432 Near Field Communication NFC controller CONFIDENTIAL Pad configurations description Open drain PxCFGA n 0 OOo PxCFGB n 0 Control CPU CLK output mode input mode ceucik _ LJ LIL LLL RR ESELS Write Px n i GPIO pad en n en n GPIO pad Zi zi Read Px n Fig 6 Open dr
179. et to high priority Reserved This bit must be set to logic 0 IP1_5 When set to logic 1 combined SPI FIFO and HSU interrupt is set to high priority 4 IP1_4 When set to logic 1 12C interrupt is set to high priority 3 IP1 3 When set to logic 1 CIU interrupt O is set to high priority 2 IP1 2 When set to logic 1 CIU interrupt 1 is set to high priority 1 Reserved This bit must be set to logic 0 0 IP1 0 When set to logic 1 interrupt number 7 is set to high priority 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 19 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 5 4 General purpose IRQ control 115432 The general purpose interrupts are controlled by register GPIRQ NOTE this is not a standard feature of the 8051 Table 18 GPIRQ register address 6107h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol gpirg gpirq gpirq_ gpirq_ X gpiq gpirq_ gpirq_ gpirq_ level_ level_ level_ level_ enable enable enable_ enable P71 P50 P35 P34 _P71 P50 P35 P34 Reset 0 0 0 0 0 0 0 0 Access RW RW RW RW RW RW RW RW Table 19 Description of GPIRQ bits Bit Symbol Description 7 gpirq level P71 Configures the polarity of signal on P71 to generate a GPIRQ interrupt event assuming gpirq enable P71 is set When set to logic 0 an interrupt will be generated if P71 is at logic 0 When set to logic 1
180. et to the reset values When SoftReset is finished the active command switches to Idle NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 138 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 21 CIU tests signals 8 6 24 1 CIU self test The CIU has the capability to perform a self test To start the self test the following procedure has to be performed Perform a SoftReset Clear the internal buffer by writing 25 bytes of 00h and perform the Config command Enable the self test by writing the value 09h to the register CIU AutoTest Write 00h to the FIFO Start the self test with the CalcCRC command The self test will be performed When the self test is finished the FIFO is contains the following bytes N oc fF ODM Correct answer for VersionReg equal to 80h 0x00 Oxaa 0xe3 0x29 0xOc 0x10 0x29 Ox6b 0x76 0x8d Oxaf Ox4b 0xa2 Oxda 0x76 0x99 Oxc7 0x5e 0x24 0x69 Oxd2 Oxba Oxfa Oxbc Ox3e Oxda 0x96 Oxb5 Oxf5 0x94 OxbO 0x3a Ox4e 0xc3 0x9d 0x94 0x76 Ox4c Oxea 0x5e 0x38 0x10 Ox8f Ox2d 0x21 Ox4b 0x52 Oxbf Oxfb Oxf4 0x19 0x94 0x82 0x5a 0x72 Ox9d Oxba OxOd Ox1f 0x17 0x56 0x22 Oxb9 0x08 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 139 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controll
181. ext machine cycle the count is incremented The new count value appears in the timer counter in state S3 of the machine cycle following the one in which the transition was detected The maximum count rate is 1 12 of the CPU CLK frequency There are no restrictions on the duty cycle of the external input signal but to ensure that a given level is sampled at least once before it changes it should be held for at least one full machine cycle The overflow output t1_ovf of Timer can be used as a baud rate generator for the Debug UART The Timer1 interrupt should be disabled in this case For most applications which drive the Debug UART Timer1 is configured for timer operation and in auto reload mode Timer0 1 registers The TimerO 1 module contains six Special Function Registers SFRs which can be accessed by the CPU Table 20 Timer0 1 Special Function registers list Name Size Address Description Access bytes Offset TO1CON 1 88h TimerO 1 control register R W TO1MOD 1 89h TimerO 1 mode register R W TOL 1 8Ah TimerO timer counter lower byte R W TiL 1 8Bh Timer1 timer counter lower byte R W TOH 1 8Ch TimerO timer counter upper byte R W T1H 1 8Dh Timer1 timer counter upper byte R W NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 21 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL The firmware performs a register read
182. face No specific sequencing is required between the two supply rails VBAT can be present without PVDD and vice versa An internal low drop out LDO voltage regulator generates DVDD and SVDD which are used to supply the internal digital logic and the secure IC respectively DVDD is also routed externally to supply AVDD analog power and TVDD transmit power DVDD AVDD and TVDD must be separately decoupled When another host interface than SPI is used the PN532 can be used with reduced functionalities all functionalities except those related to the PVDD supplied pins like host interfaces when PVDD 0 4V 5 5V VBAT 2 7V 3 6V RSTPD N VBAT 0 65 VBAT PN532 2 7V gt 5 5V 4 7uF 100nF Secure IC Power distribution Fig 19 Power management scheme NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 83 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 4 14 Low drop out voltage regulator 8 4 1 4 LDO block diagram The regulator is used to reduce the VBAT voltage to the typical voltage rating of the PN532 It acts as a 3 0 V linear regulator with resistive feed back as long as the VBAT voltage is above 3 4 V It is designed to cope with a maximum fluctuation of 400 mV on the VBAT line due to voltage bursts exhibited by the battery If VBAT falls below 3 4 V the output of the
183. fines the minimum length of the accepted frame length This register is 6 bits long Each value represents a length of 4 DataLenMax in register CIU FelNFC2 defines the maximum length of the accepted frame This register is 6 bits long Each value represents a length of 4 If set to logic 0 this limit is switched off If the length is not in the supposed area the packed is not transferred to the FIFO and receiving is kept active Example 1 DataLenMin 4 The length shall be greater or equal 16 e DataLenMax 5 The length shall be smaller than 20 Valid area 16 17 18 19 Example 2 DataLenMin 9 The length shall be greater or equal 36 DataLenMax 0 The length shall be smaller than 256 Valid area 36 to 255 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 126 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 15 CRC co processor The CRC preset value of the CRC co processor can be configured to 0000h 6363h A671h or FFFFh depending of the bits CRCPreset in the register Mode This is only valid when using CalcCRC command see Section 8 6 20 7 CalcC RC command on page 134 During a communication the preset value of the CRC coprocessor is set according to the bits CIU RxMode and CIU TxMode The CRC polynomial for the 16 bit CRC is fixed to x19 x 2 x5 1 The CRC co processor is configur
184. g 1 0 Reset 0 0 ojo o 0 o 0 Access R W DY DY DY RW RW DY DY Table 209 Description of CIU_TxMode bits Bit Symbol Description 7 TxCRCEn Set to logic 1 this bit enables the CRC generation during data transmission Note This bit shall only set to logic 0 at 106 kbit s 6to4 TxSpeed 2 0 Defines bit rate while data transmission Value Description 000 106 kbit s 001 212 kbit s 010 424 kbit s 011 848 kbit s 100 1696 kbit s 101 3392 kbit s 110 111 Reserved Note The bit coding for transfer speeds above 424 kbit s is equivalent to the bit coding of the Active Communication mode of the 424 kbit s of the ISO IEC18092 ECMA340 3 InvMod Set to logic 1 the modulation for transmitting data is inverted 2 TxMix Set to logic 1 the signal at SIGIN is mixed with the internal coder See Section 8 6 12 Serial data switch on page 120 1t00 TxFraming 1 0 Defines the framing used for data transmission Value Description 00 ISO IEC 14443A MIFARE and Passive Communication mode 106 kbit s 01 Active Communication mode 10 FeliCa and Passive Communication mode at 212 kbit s and 424 kbit s 11 ISO IEC 14443B 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 157 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 19 CIU RxMode register 6303h Defines the reception data rate and framing during receiving
185. g finished transmission the receiver is activated to receive data If the bit Initiator in the CIU Control register is set to logic 0 the first action is receiving and after having received a data stream the transmitter is activated to transmit data In the second configuration the PN532 first acts as a receiver and if a data stream is received it switches to the Transmit mode The end of the reception phase is detected in the same way than for the receive command and also when the HF field is cut The transceive command always take into account the presence or absence of the RF field No transmission or reception can be done when no RF field Table 168 Transceive command scenario Communication step Initiator 1 Initiator 0 1 Send Receive 2 Receive Send 3 Send Receive 4 Receive Send NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 135 of 224 NXP Semiconductors PN532 C1 8 6 20 12 115432 Near Field Communication NFC controller CONFIDENTIAL Each transmission process has to be started with setting bit StartSend in the register CIU BitFraming This command has to be cleared by firmware by writing any command to the CIU Command register e g the command idle Note If the bit RxMultiple in register CIU_RxMode is set this command will never leave the receiving state because the receiving will not be cancelled automatically AutoColl command This command automaticall
186. g to ISO IEC 14443 B might infringe third party patent rights A purchaser of this NXP IC has to take care for appropriate third party patent licenses has been removed It is replaced with the Table 2 Ordering information on page 5 notes and the Section 17 4 Trademarks on page 216 Table 2 Ordering information on page 5 notes have been modified P70 IRQ pin description in Table 3 on page 8 has been changed Reduced functionality not working in SPI mode added in Section 8 4 on page 83 Table 142 on page 96 Table note 2 has been modified Remark for the Wired Card mode FeliCa added in Section 8 6 13 1 on page 123 VIH of RSTPD N when PVDD lt 0 4V aligned between Section 8 4 on page 83 and Section 12 7 on page 198 Table 156 on page 115 for RF level detector has been modified Functional conditions have been added in Section 8 6 9 on page 116 and in Section 12 4 on page 197 Table 158 on page 117 Table 296 on page 197 and Table 297 on page 197 have been modified and aligned 2 remarks have been added in Section 8 6 13 1 on page 123 Table 293 on page 195 modified the VBAT condition for VDVDD to 3 4V instead of 3 7V Table 307 on page 203 has been modified and a note has been added Table 315 on page 207 for RX characteristics has been modified 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 215 of 224 NXP Semiconductors PN532 C1 17
187. gisters 26 8 8 8 5 FIFOFF register 0 000 67 8 1 6 6 Incrementer 000e0 ee eee 26 8336 SFF redi 68 8 1 6 7 Overflow detection 0 0 27 8337 FIT register aea pM EUN 8 7 Timer2 description sssssssesse 27 833 QIN se Ai iai taiias 69 8 3 3 8 FITENregister 05 70 8 1 71 Timer2 registers lllllelssssns 27 8 3 3 9 FDATAregister 0 0 eee 71 8 1 7 2 T2CON register 000 eee ee 28 8 1 7 3 T2MOD register 29 8 3 3 10 FSIZE register 0 cee ee eee 71 A oa ais cars 8 3 4 HIGH SPEED UART HSU 72 8 1 7 4 T2L T2Hregisters 30 834 1 Mode of 2 74 8 1 7 5 RCAP2L RCAP2H registers 30 Pda DIDI ODEIHUDET s pinin ESSEN i RE 81 8 Debug UART 2 22 ccccceeeeeeees 31 8 3 4 2 HSU Baud rate generator 74 8 1 8 1 Feature list ccccceeeeeeeeees 31 83 43 HSU preamble filter che reanetsen teases 74 8 1 8 2 Debug UART functional description 31 8 3 4 4 HSU wake up generator AA 75 8 3 45 HSU STAregister 000 75 8 1 8 8 SOCON register 0 02a 33 s 8 3 46 HSU_CTRregister 005 76 8 1 8 4 SOBUF register 0 0000 35 8 3 4 7 HSU_PRE register 205 77 8 1 85 Mode Obaudrate 35 8 3 4 8 HSU_CNT register 005 77 8 1 8 6 Mode 2ba
188. gnal voltage gain factor Value Description 000 18 dB 001 23 dB 010 18 dB 011 23 dB 100 33 dB 101 38 dB 110 43 dB 111 48 dB 3to0 RFLevel 3 0 Defines the sensitivity of the RF level detector for description see Section 8 6 8 RF level detector on page 115 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 174 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 37 CIU GsNOn register 6317h 115432 Selects the conductance for the N driver of the antenna driver pins TX1 and TX2 when generating RF Table 246 CIU GsNOn register address 6317h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol CWGsNOr 3 0 ModGsNOn 3 0 Reset 1 0 0 0 1 0 0 0 Access RW RW RW R W RW RW RW R W Table 247 Description of CIU GsNOn bits Bit Symbol Description 7104 CWGsNOr 3 0 The value of this register defines the conductance of the output N driver during times of no modulation and when the PN532 generates the RF field This may be used to regulate the output power and subsequently current consumption and operating distance Note The conductance value is binary weighted Note During CIU Power down mode if DriverSel 1 0 is not equal to 01b CWGSsNOn 3 is set to logic 1 This is not readable in the register Note The value of the register is only used if RF is generated by the driver either Tx1RFEn or Tx2RFEn is se
189. h 631Ah 631Bh 631Ch 631Dh 631Eh 631Fh 6320h 6321h 6322h 6323h 6324h 6325h 6326h 6327h 6328h 6329h 632Ah 632Bh 632Ch 632Dh 632Eh 632Fh 6330h Byte Register name size CIU_TypeB CIU_CRCResultMSB CIU_CRCResultLSB CIU_GsNOff i d CIU_ModWidth CIU TxBitPhase CIU_RFCfg CIU_GsNOn 1 CIU_CWGsP 1 CIU_ModGsP Description Configure the ISO IEC 14443 type B Reserved Reserved Shows the actual MSB values of the CRC calculation Shows the actual LSB values of the CRC calculation Selects the conductance of the antenna driver pins TX1 and TX2 for load modulation when own RF field is switched OFF Controls the setting of the width of the Miller pause Bit synchronization at 106 kbit s Configures the receiver gain and RF level Selects the conductance of the antenna driver pins TX1 and TX2 for modulation when own RF field is switched ON Selects the conductance of the antenna driver pins TX1 and TX2 when not in modulation phase Selects the conductance of the antenna driver pins TX1 and TX2 when in modulation phase 1 CIU_TMode Defines settings for the internal timer 1 CIU_TPrescaler 1 CIU_TReloadVal_hi Describes the 16 bit long timer reload value Higher 8 bits 1 CIU_TReloadVal_lo Describes the 16 bit long timer reload value Lower 8 bits 1 CIU TCounterVal hi Describes the 16 bit long timer actual value Higher 8 bits 1 CIU TCounterVal lo Describes the 16 bit long timer actua
190. h SLA W Slave receiver mode 12C data and the serial clock are received through SDA and P50_SCL After each byte is received an acknowledge bit is transmitted START and STOP conditions are recognized as the beginning and end of a serial transfer Address recognition is performed by hardware after reception of the Slave address and direction bit In the Slave receiver mode a number of data bytes are received from a Master transmitter To initiate the Slave receiver mode 2CADR must be loaded with the 7 bit Slave address to which the I C interface will respond when addressed by a Master Also the least significant bit of IICADR should be set to logic 1 if the interface should respond to the general call address 00h The control register IICCON should be initialized with ENS1 and AA set to logic 1 and STA STO and SI set to logic 0 in order to enter the Slave receiver mode Setting the AA bit will enable the logic to acknowledge its own Slave address or the general call address and ENS1 will enable the interface When I CADR and I CCON have been initialized the I C interface waits until it is addressed by its own Slave address followed by the data direction bit which must be 0 W for the 12C interface to operate in the Slave receiver mode After its own Slave address and the W bit have been received the serial interrupt flag SI is set to logic 1 and a valid status code can be read from I2CDAT This status code should be used to vector
191. he 12C own Slave address or the general call address has been partly received the address will be recognized at the end of the byte transmission 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 55 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller Table 77 Description of I2CCON bits continued CONFIDENTIAL Bit Symbol Description 1t00 CR 1 0 Serial clock frequency selection in Master mode CR2 CR1 CRO CPU CLK division factor 0 an 00 2 2a 0 0 o o o0 10 20 30 40 80 120 160 256 T1 reload value 12 24 3072 12C bit frequency CPU_CLK 10 CPU_CLK 20 CPU_CLK 30 CPU_CLK 40 CPU_CLK 80 CPU_CLK 120 CPU_CLK 160 CPU CLK 3072 CPU CLK 24 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 56 of 224 NXP Semiconductors PN532 C1 8 3 2 8 115432 Near Field Communication NFC controller CONFIDENTIAL I CSTA register I CSTA is an 8 bit read only special function register The three least significant bits are always at logic 0 The five most significant bits contain the status code There are 26 possible status codes When I2CSTA contains F8h no relevant state information is available and no serial interrupt is requested Reset initializes IICSTA to F8h All other I CSTA values correspond to defined I C interface states When each of
192. he transmitted part of the FIFO is full Receive WaterLevel High IRQ This bit is set to logic 1 when the number of bytes stored into the Receive FIFO is greater or equal to the threshold RWaterlevel Read OVeRrun IRQ This bit indicates that a read overrun has occured It occurs when the receiver part of the FIFO is full and a new data transfer is completed Then the new received data is lost and ROVR IRQ is set Receive FIFO Full IRQ This bit is set to logic 1 if the received part of the FIFO is full NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 69 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 3 8 FITEN register The FITEN register enables or disables the interrupt requests to the CPU It is also used to reset the content of the Receive and Transmit FIFO Table 104 FITEN register SFR address Ath bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TFLUSH RFLUSH EN EN EN EN EN EN WCOL TWLL TFF RWLH_ ROVR RFF_ IRQ IRQ IRQ IRQ IRQ IRQ Reset 0 0 0 0 0 0 0 0 Access R W R W RW RW R W RW RW R W Table 105 Description of FITEN bits Bit Symbol Description 7 TFLUSH When set to logic level 1 the pointer of the Transmit FIFO is reset This bit and RFLUSH must not be set at the same time 6 RFLUSH When set to logic level 1 the pointer of the Receive FIFO is reset This bit and TFLUSH must not be set at
193. he transmitter modulation input is coming from the internal coder this delay is added to the waiting period before transmitting data in all communication modes Note When SigoutSel 1110b CIU TxSel register and DelayMF SO 1b CIU ManualRCV register this delay is added on SIGOUT Note Il the Signal at SIGIN is 128 fc faster compared to the ISO IEC 14443A restrictions on the RF Field for the Frame Delay Time this delay is made so that if the FDT is correct when DriverSel 01b the same values of TxWait 1 0 and TxBitPhase 6 0 are also correct for this configuration when DriverSel 10b the transmitter modulation input is coming from SIGIN 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 173 of 224 PN532 C1 Near Field Communication NFC controller CONFIDENTIAL NXP Semiconductors 8 6 23 36 CIU RFCfg register 6316h Configures the receiver gain and RF level detector sensitivity Table 244 CIU RFCfg register address 6316h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol RFLevelAmp RxGain 2 0 RFLevel 3 0 Reset 0 1 o qoo i o o 0 Access R W RW RW RW RW RW RAW RW Table 245 Description of CIU_RFCfg bits Bit Symbol Descrip tion 7 RFLevelAmp Set to logic 1 this bit activates the RF level detector s amplifier see Section 8 6 8 RF level detector on page 115 6to4 RxGain 2 0 This register defines the receivers si
194. host controller can directly communicate to the secure IC via SIGIN SIGOUT In this mode the PN532 generates the RF clock and performs the communication on the SIGOUT line To enable the Wired Card mode the clock has to be derived by the internal oscillator of the PN532 see bits sic clock sel in Table 265 on page 180 Configured in Card emulation mode the secure IC can act as contactless smart card IC via the PN532 In this mode the signal on the SIGOUT line is provided by the RF field of the external Reader Writer To enable the Virtual Card mode the clock derived by the external RF field has to be used The configuration of the NFC WI S C interface differs for the FeliCa and MIFARE scheme as outlined in the following chapters NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 122 of 224 NXP Semiconductors PN532 C1 8 6 13 1 115432 Near Field Communication NFC controller CONFIDENTIAL Signal shape for FeliCa NFC WI S C interface support The FeliCa secure IC is connected to the PN532 via the pins SIGOUT and SIGIN The signal at SIGOUT contains the information of the 13 56 MHz clock and the digitized demodulated signal The clock and the demodulated signal are combined by using the logical function exclusive OR XOR To ensure that this signal is free of spikes the demodulated signal is digitally filtered first The time delay for the digital filtering is in the range of one bit l
195. i22 ed pu REESE 66 Table 93 Description of RWL bits 66 Table 94 TWL register SFR address 9Bh bit allocation66 Table 95 Description of TWL bits 66 Table 96 FIFOFS register SFR address 9Ch bit allocation 0000200 cee eee ee eee 67 Table 97 Description of FIFOFS register bits 67 Table 98 FIFOFF register SFR address 9Dh bit allocations 22e bhai idee 67 Table 99 Description of FIFOFF bits 67 Table 100 SFF register SFR address 9Eh bit allocations ee inermem 68 Table 101 Description of SFF bits 68 Table 102 FIT register SFR address 9Fh bit allocation cd pee br tanen eek 69 Table 103 Description of FIT bits 69 Table 104 FITEN register SFR address A1h bit allocation coge ERE RR pA 70 Table 105 Description of FITEN bits 70 Table 106 FDATA register SFR address A2h bit allocation sek dmt Runs 71 Table 107 Description of FDATA bits 71 Table 108 FSIZE register SFR address A3h bit Allocations 22 5 recse ota cn wed p E da Rene pns 71 Table 109 Description of FSIZE bits 71 Table 110 HSU SFR register list 73 Table 111 HSU_STA register SFR address ABh bit allocation sss harre cus toad be bp Runs 75 Table 112 Description of HSU STA bits 75 Table 113 HSU CTR register SFR address ACh bit allocation
196. ic 1 see Table 245 on page 174 Remark With typical antenna lower sensitivity levels without the additional amplifier set below 1000b can provoke misleading results because of intrinsic noise in the environment Remark For the same reasons than above it is recommended to use the RFLevelAmp only with upper RF level settings above 1001b Remark During the CIU Power down mode the additional amplifier of the RF level detector is automatically switched off to ensure that the power consumption is minimal NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 115 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 9 Antenna presence self test 8 6 9 1 115432 The goal of the Antenna Presence Self Test is to facilitate at assembly phase the detection of the absence of the antenna and or antenna matching components Such a detection is done by mean of measuring the current consumption Therefore the functionality is guaranteed within a restricted temperature and supply voltage range VBAT voltage is above 5 V Ambient temperature is between 0 and 40 C Principle The principle is explained with typical antenna tuning and matching components PN532 TVSS1 Antenna Fig 37 Disconnection localization for the antenna detection The testing operation can be managed via a dedicated register Table 158 on
197. ice in the same RF field during Passive Communication mode 6 ShortTimeSlot Defines the time slot length for Active Communication mode at 424 kbit s Set to logic 1 a short time slot is used half of the timeslot at 212 kbit s Set to logic 0 a long timeslot is used equal to the timeslot for 212 kbit s 5to0 DataLenMax 5 0 These bits define the maximum length of the accepted frame length DataLenMax x 4 2 DataPacketLenght Note If set to logic 0 the maximum data length is 256 bytes This parameter is ignored at 106 kbit s if the bit DetectSync in register CIU Mode is set to logic 0 If a received frame is larger as the defined DataLenMax value the frame will be ignored NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 165 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 28 CIU MIifNFC register 630Ch 115432 Defines ISO IEC 14443A MIFARE NFC specific settings in target or card operating mode Table 228 CIU MifNFC register address 630Ch bit allocation Bit E 6 5 4 3 2 1 0 Symbol SensMiller 2 0 TauMiller 1 0 MFHalted TxWait 1 0 Reset o 1 1 0 0 0 4 0 Access RW RW RW RW R W DY RW R W Table 229 Description of CIU MifNFC bits Bit Symbol Description 7105 SensMiller 2 0 This bit defines the sensitivity of the Miller decoder 4to3 TauMillr 1 0 This bit defines the time constant of th
198. igher 8 bits for the TReloadValue With a start event the timer loads with the TReloadValue Changing this register affects the timer only with the next start event Note The reload value is defined with TReloadVal Hi 7 0 in this register and TReloadVal Lo 7 0 in CIU TReloadVal lo NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 178 of 224 NXP Semiconductors PN532 C1 8 6 23 43 8 6 23 44 8 6 23 45 Near Field Communication NFC controller CONFIDENTIAL CIU TReloadVal lo register 631Dh Defines the LSB of the 16 bit long timer reload value Table 258 CIU TReload lo register address 631Dh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TReloadVal_Lo 7 0 Reset 0 o o oO 0 0 0 0 Access R W RW RW RM RW RM RW RW Table 259 Description of CIU TReload lo bits Bit Symbol Description 7100 TReloadVal_Lo 7 0 Defines the lower 8 bits for the TReloadValue With a start event the timer loads with the TReloadValue Changing this register affects the timer only with the next start event Note The reload value is defined with TReloadVal Lo 7 0 in this register and TReloadVal Hi 7 0 in CIU TReload Hi CIU TCounterVal hi register 631Eh Defines the MSB byte of the current value of the timer Table 260 CIU TCounterVal hi register address 631Eh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TCounterVal Hi 7 0 Reset x x X x x
199. in SPI Not Slave Selected NSS or 12C clock SCL or HSU receive HSU RX Refer to Table 72 on page 48 for details Host interface pin SPI Master Out Slave In MOSI or I2C data SDA or HSU transmit HSU TX Refer to Table 72 on page 48 for details Host interface pin SPI Master In Slave Out MISO Refer to Table 72 on page 48 for details Can be used as general purpose IO NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 8 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Table 3 PN532 Pin description continued Symbol Pin Type Ref Description Voltage SCK 30 O PVDD _ Host interface pin SPI serial clock Refer to Table 72 on P72 page 48 for details Can be used as general purpose IO P31 31 IO PVDD General purpose IO Debug UART TX UART TX P32 INTO 32 10 PVDD General purpose IO Interrupt source INTO P33 INT1 33 10 PVDD General purpose IO Interrupt source INT1 P34 34 O SVDD General purpose IO Secure IC clock SIC CLK SIGOUT 35 O SVDD Contactless communication interface output delivers a serial data stream according to NFCIP 1 to a secure IC SIGIN 36 SVDD Contactless communication interface input accepts a serial data stream according to NFCIP 1 and from a secure IC SVDD 37 O Switchable output power for secure IC power supply with overload detection Used as a reference voltage for
200. in state S5 and a register write in state S6 The hardware loads bits TFO and TF1 of the register TO1CON during state S2 and state S4 respectively The hardware loads bits IEO and IE1 of the register TO1CON during state S1 and reset these bits during state S2 The registers TOL TOH T1L T1H are updated by the hardware during states S1 S2 S3 and S4 respectively At the end of a machine cycle the firmware load has overridden the hardware load as the firmware writes in state S6 Table 21 Timer0 1 SFR registers CPU state access CPU STATE Register Bit S1 S2 S3 S4 S5 S6 TO1CON TFO HW read SW read SW write TF1 HW read SWread SW write IEO IE1 HW write HW reset SW read SW write TOL HW write SW read SW write TOH HW write SW read SW write TIL HW write SW read SW write T1H HW write SW read SW write NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 22 of 224 NXP Semiconductors PN532 C1 8 1 6 2 TO1CON register Near Field Communication NFC controller CONFIDENTIAL The register is used to control Timer0 1 and report its status Table 22 Timer0 1 TO1CON register SFR address 88h bit allocation Bit 7 Symbol TF1 Reset 0 Access R W 6 5 4 3 2 1 0 TRI TFO TRO IE1 IT1 IEO ITO 0 oO 0 0 0 0 0 RW RW R W R W R W RW RW Table 23 Description of Timer0 1 TO1CON register bits Bit Symbol 7 TF1 6 TR1 5 TFO 4 TRO 3
201. inary weighted Note During CIU Power down if DriverSel 1 0 is not equal to 01b ModGsNoOff 3 is set to logic 1 This is not readable in the register Note The value of the register is only used if no RF is generated by the driver otherwise the value ModGsNOn in the CIU GsNOn register is used NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 171 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 34 CIU ModWidth register 6314h 115432 Controls the setting of the modulation width Table 240 CIU ModWidth register address 6314h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol ModWidth 7 0 Reset o o o 0 1 1 0 Access RW RW RW RW RW RW RW RW Table 241 Description of CIU ModWidth bits Bit Symbol Description 7t00 ModWidth 7 0 These bits define the width of the Miller modulation as initiator in Active and Passive Communication mode as multiples of the carrier frequency ModWidth 1 fc The maximum value is half the bit period Acting as a target in Passive Communication mode at 106 kbit s or in Card Operating mode for ISO IEC 14443A MIFARE these bits are used to change the duty cycle of the subcarrier frequency Number of cycles with low value NCLV Modwidth modulo 8 1 Number of cycles with high value NCHV 16 NCLV NXP B V 2007 All rights reserved Product data
202. interrupts NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 18 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL The 2 following tables describe IPO Table 14 Interrupt controller IPO register SFR address B8h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol IP0_7 IP06 IPO5 IPO4 IPO3 IPO2 IPO 1 IPO 0 Reset 0 0 0 0 0 0 0 OQ Access RW RW RW RW RN RW RW RW Table 15 Description of IPO bits Bit Symbol Description 7 IPO 7 Reserved 6 IPO 6 When set to logic 1 NFC WI interrupt is set to high priority 5 IPO 5 When set to logic 1 Timer2 interrupt is set to high priority 4 IPO 4 When set to logic 1 Debug UART interrupt is set to high priority 3 IPO 3 When set to logic 1 Timer1 interrupt is set to high priority 2 IPO 2 When set to logic 1 external P33 INT1 pin is set to high priority 1 IPO 1 When set to logic 1 TimerO interrupt is set to high priority 0 IPO 0 When set to logic 1 external P32 INTO pin is set to high priority The 2 following tables describe IP1 Table 16 Interrupt controller IP1 register SFR address F8h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol IP17 IP15 IP44 IP13 IP12 s Reset 0 0 0 0 0 0 00 Access RW RW RW RW RW RW R W Table 17 Description of IP1 bits Bit Symbol Description IP1 7 When set to logic 1 General Purpose IRQ interrupt is s
203. ion 7 AutoRFOff Set to logic 1 own RF field is switched off after the last data bit has been transmitted as defined in the NFCIP 1 standard 6 Force100ASK Setto logic 1 Force100ASK forces a 10096 ASK modulation independent of the setting in CIU_ModGsP register 5 AutoWakeUp Setto logic 1 the PN532 in CIU Power down mode can be woken up by the RF level detector Reserved CAOn Set to logic 1 the collision avoidance is activated and internally the value n is set in accordance to the ISO IEC 18092 ECMA340 NFCIP 1 standards 2 InitialRFOn Set to logic 1 the initial RF collision avoidance is performed and the bit InitialRFOn is set to logic 0 automatically if the RF is switched ON Note The driver s which should be switched on have to enabled by Tx2RFAutoEn and or Tx1RFAutoEn bits Note If the own RF field is already ON when the bit InitialRFOn is set it is not set to logic 0 1 Tx2RFAutoEn Set to logic 1 RF is switched on at TX2 i e TX2RFEn is set to logic 1 after the external RF field is switched off according to the time TADT If the InitialRFOn and Tx2RFAutoEn bits are set to logic 1 RF is switched on at TX2 if no external RF field is detected during the time TIDT Note The times TADT and TIDT are in accordance to the ISO IEC 18092 ECMA340 NFCIP 1 standards 0 Tx1RFAutoEn Set to logic 1 RF is switched on at TX1 i e Tx1RFEn is set to logic 1 after the external RF field is switched off according to the time TAD
204. is detected It is set to logic 0 automatically at receiver start phase This flag is only valid during the bitwise anticollision at 106 kbit s During communication schemes at 212 and 424 kbit s this flag is always set to logic 0 2 CRCErr Set to logic 1 if RXCRCEn in CIU RxMode register is set to logic 1 and the CRC calculation fails It is set to logic O automatically at receiver start up phase 1 ParityErr Set to logic 1 if the parity check has failed It is set to logic O automatically at receiver start up phase Only valid for ISO IEC 14443A MIFARE or NFCIP 1 communication at 106 kbit s O ProtocollErr Set to logic 1 if one out of the following cases occurs Setto logic 1 if the SOF is incorrect It is set to logic O automatically at receiver start up phase The bit is only valid for 106 kbit in Active and Passive Communication mode If bit DetectSync in CIU Mode register is set to logic 1 during FeliCa communication or Active Communication with transfer speeds higher than 106 kbit ProtocolErr is set to logic 1 in case of a byte length violation During the AutoColl command ProtocolErr is set to logic 1 if the Initiator bit in CIU Control register is set to logic 1 During the MFAuthent Command ProtocolErr is set to logic 1 if the number of bytes received in one data stream is incorrect Setto logic 1 if the Miller Decoder detects 2 pauses below the minimum time according to the ISO IEC 14443A definitions 1 Comman
205. is true when gpirq is low 1 int level Selects P33 INT1 interrupt level When set to logic 1 wake up condition is true when P33_INT1 is low When set to logic 0 wake up condition is true when P33_INT1 is high O intO level Selects P32 INTO interrupt level When set to logic 1 wake up condition is true when P32 INTO is high When set to logic 0 wake up condition is true when P32 INTO is low 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 94 of 224 NXP Semiconductors PN532 C1 8 5 8 4 8 5 8 5 115432 Near Field Communication NFC controller CONFIDENTIAL PCR Control register The Control register is used to perform a firmware reset and clear wake up conditions in the Status register Table 139 PCR Control register address 6203h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol clear wakeup cond soft reset Rest 1 0 0 0 0 0 0 Access R R R R R R R W RW Table 140 Description of PCR Control bits Bit Symbol Description 7102 Reserved 1 clear wakeup cond Clears value of wakeupcond in Status register When set to logic 1 wake up conditions stored in PCR Status register are set to logic 0 Bit is set to logic 0 automatically by hardware 0 soft reset Initiates a firmware reset When set to logic 1 system goes into firmware reset mode Bit is set to logic 0 automatically by hardware after performing fir
206. it configures the functional mode of the P72 pin 1 P7CFGB 1 Out of SPI mode and in conjuction with P7ZCFGAT 1 it configures the functional mode of the P71 pin 0 P7CFGB O In conjuction with P7ZCFGA O it configures the functional mode of P70 IRQ pin Remark When in Hard power down mode the P72 to P70 IRQ pins are forced in quasi bidirectional mode Referring to Figure 7 en n2 e pu 1 e p 0 Ande hd 1 if P7x pin value is 1 and e hd 0 if P7x pin value is 0 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 44 of 224 NXP Semiconductors PN532 C1 8 2 2 3 8 2 2 4 115432 Near Field Communication NFC controller CONFIDENTIAL P7 register Table 64 P7 register SFR address F7h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol Pi Pl P7 0 Reset 1 1 1 1 1 1 1 1 Access RR R R R RW RW RW Table 65 Description of P7 bits Bit Symbol Description 7103 Reserved 2 P7 2 Out of SPI mode Writing to P7 2 writes the corresponding value to the P72 pin according to the configuration mode defined by P7CFGA 2 and P7CFGB 2 Reading from P7 2 reads the state of P72 pin 1 P7 1 Out of SPI mode Writing to P7 1 writes the corresponding value to the P71 pin according to the configuration mode defined by P7CFGA 1 and P7CFGB 1 Reading from P7 1 reads the state of P71 pin 0 P7 0
207. it oriented frames TxLastBits defines the number of bits of the last byte that shall be transmitted A 000b indicates that all bits of the last byte shall be transmitted NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 154 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 16 CIU Coll register EFh or 633Eh Defines the first bit collision detected on the RF interface 115432 Table 204 CIU Coll register address EFh or 633Eh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol ValuesAfterColl CollPosNotValid CollPos Reset 1 0 1 x x X Xx X Access R W R R R R R R R Table 205 Description of CIU Coll bits Bit Symbol 7 ValuesAfterColl 6 5 CollPosNotValid 4to0 CollPos Description If this bit is set to logic 0 all receiving bits will be cleared after a collision This bit shall only be used during bitwise anticollision at 106 kbit s otherwise it shall be set to logic 1 Reserved Set to logic 1 if no Collision is detected or the Position of the collision is out of range of the CollPos 4 0 bits This bit shall only be interpreted in Passive Communication mode at 106 kbit s or ISO IEC 14443A MIFARE Reader Writer mode These bits show the bit position of the first detected collision in a received frame only data bits are interpreted Example 00h indicates a bit collision in the 32 bit
208. ity at the es xd end of the frame carrier clocks Fig 28 Data coding and framing according to ISO IEC 14443A NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 102 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 3 2 FeliCa Reader Writer 115432 The following diagram describes the communication at the physical level Table 146 describes the physical parameters 1 Reader Writer to Card 8 30 ASK Manchester Coded Baud rate 212 to 424 kbit s FeliCa Card _ _ 2 Card to Reader Writer gt 12 ASK load modulation Manchester Coded Baud rate 212 to 424 kbit s Reader Writer Fig 29 FeliCa Reader Writer communication diagram Table 146 Communication overview for FeliCa Reader Writer Communication scheme FeliCa FeliCa higher baud rate Baud rate 212 kbit s 424 kbit s Bit length E DAI 4720s SE 23618 PN532 to Modulation 8 30 ASK 8 30 ASK PICC Card Bit coding Manchester coding Manchester coding PICC Card to Modulation gt 12 ASK gt 12 ASK PN532 Bit coding Manchester coding Manchester coding With appropriate firmware the PN532 can handle the FeliCa protocol The FeliCa Framing and coding must comply with the following table Table 147 FeliCa Framing and Coding Preamble SYNC LEN n Data CRC 00h 00h 00h 00h 00h 00h B2h 4Dh
209. ked into a flip flop and is used in the next state as the increment enable for the upper byte An overflow event in the upper byte will set the corresponding overflow bit in the TO1CON register to logic 1 The upper byte overflow is also clocked into a flip flop to generate the output signals t0 ovf and t1 ovf The overflow flags TFO and TF1 found in register T01 CON are loaded during states S2 and S4 respectively The interrupt controller of the 80C51 scans all requests at state S2 Thus an overflow of TimerO or Timer1 is detected one machine cycle after it occurred When the request is serviced the interrupt routine sets the overflow flag to logic 0 Execution of the interrupt routine starts on the fourth machine cycles following the timer overflow When Timer0 1 receives the acknowledge from the CPU the overflow flag TFO in register T01CON is set to logic 0 e two machine cycles later the overflow flag TF1 in register T01CON is set to logic 0 If during the same machine cycle an overflow flag is set to logic 0 due to a CPU acknowledge and set to logic 1 due to an overflow the set to logic 1 is the strongest Timer2 description Timer2 supports a subset of the standard Timer2 found in the 8052 microcontroller Timer2 can be configured into 2 functional modes via the T2CON and T2MOD registers e Modet Auto reload up down counting Mode2 Baud rate generation for Debug UART Timer2 can operate either as a timer or as an event cou
210. l i c wu GPIRQ SPI on HSU_on lee wu intl en intO en en wu en en en en Reset 0 0 0 0 0 0 0 0 Access RW RW RW RW RW R RW RW Table 144 Description of PCR Wakeupen bits Bit Symbol Description 7 Pc wu en 12C wake up source enable When set to logic 1 I C event recognition of its own address can wake up PN532 See Table 90 on page 64 to enable the corresponding event 6 GPIRQ wu en General Purpose IRQ wake up source enable When set to logic 1 a GPIRQ event can wake up PN532 5 SPlon en SPI wake up source enable When set to logic 1 a SPI event can wake up PN532 4 HSU on en HSU wake up source enable When set to logic 1 an HSU event can wake up PN532 See Table 114 on page 76 to enable the corresponding event 3 CIU wu en Contactless Interface Unit wake up source enable When set to logic 1 a CIU event RF detected or NFC WI event can wake up PN532 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 96 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Table 144 Description of PCR Wakeupen bits continued Bit Symbol Description 2 Reserved 1 inti en P33 INT1 wake up source enable When set to logic 1 a P33 INT1 event can wake up PN532 O intO en P32 INTO wake up source enable When set to logic 1 a P32 INTO event can wake up PN532 115432 NXP B V 2007 All rights reserved Pr
211. l rights reserved For more information please visit http www nxp com For sales office addresses please send an email to salesaddresses nxp com Date of release 3 December 2007 Document identifier 115432
212. l value Lower 8 bits 1 Reserved 1 CIU TestSel1 General test signals configuration 1 CIU TestSel2 General test signals configuration and PRBS control 1 CIU TestPinEn Enables test signals output on pins 1 CIU TestPinValue Defines the values for the 8 bit parallel bus when it is used as I O bus 1 CIU TestBus Shows the status of the internal test bus 1 CIU AutoTest Controls the digital self test 1 CIU Version Shows the CIU version 1 CIU_AnalogTest Controls the pins AUX1 and AUX2 1 CIU TestDAC1 Defines the test value for the TestDAC1 1 CIU TestDAC2 Defines the test value for the TestDAC2 1 CIU TestADC Show the actual value of ADC and Q 1 Reserved for tests 1 Reserved for tests 1 Reserved for tests 1 CIU RFlevelDet Power down of the RF level detector 1 CIU SIC CLK en Enables the use of secure IC clock on P34 SIC CLK NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 143 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 CIU register description 8 6 23 1 CIU register bit behavior Depending of the functionality of a register the access condition to the bits can vary The following table describes the access conditions Table 175 Behavior of register bits Abbreviation Behavior Description R W Read and These bits can be written and read by the 80C51 Since they are used Write only for control means there con
213. le 173 Contactless Interface Unit SFR memory map 142 Table 174 Contactless Interface Unit extension memory MAD vate edewd eevee Ghana 142 Table 175 Behavior of register bits 144 Table 176 CIU_SIC_CLK_en register address 6330h bit allocatiori isle cie expen 144 Table 177 Description of CIU SIC CLK enbits 144 Table 178 CIU Command register address D1h or 6331h bit allocation llle 145 Table 179 Description of CIU Command bits 145 Table 180 CIU CommlEn register address D2h or 6332h bit allocation 0 2200000 146 Table 181 Description of CIU_CommlEn bits 146 Table 182 CIU_DivlEn register address D3h or 6333h bit allocation 000000 cee ee eens 146 Table 183 Description of CIU_DivlEn bits 146 Table 184 CIU_Commlrg register address D4h or 6334h bit allocation llle 147 Table 185 Description of CIU_CommIRQ bits 147 Table 186 CIU_Divirq register address D5h or 6335h bit allocation ee rrea a e cee eee eee 148 Table 187 Description of CIU Divlrq bits 148 Table 188 CIU Error register address D6h or 6336h bit allocation lslsllllsellsssns 149 Table 189 Description of CIU Error bits 149 Table 190 CIU Status1 register address DFh or 6337h bit allocation 20000055 150 Table 191 Description of CIU_Status1 bits 150 Table 192 CIU_Status2 register address E9h or 6338h
214. ler CONFIDENTIAL FeliCa Card operating mode With appropriate firmware the PN532 can handle the FeliCa protocol The following diagram describes the communication at the physical level Table 153 describes the physical parameters 1 Reader Writer to Card 8 30 ASK Manchester Coded Baud rate 212 to 424 kbit s FeliCa Reader Writer 2 Card to Reader Writer gt 12 ASK load modulation Manchester Coded Baud rate 212 to 424 kbit s Card operating mode Fig 35 FeliCa card operating mode communication diagram Table 153 Communication overview for FeliCa Card operating mode Communication scheme FeliCa FeliCa higher baud rate Baud rate 212 kbit s 424 kbit s Bit length mir 4 72s A 2 36us Reader Writer to Modulation 8 30 ASK 8 3096 ASK PN532 Bit coding Manchester coding Manchester coding PN532 to Modulation gt 12 ASK gt 12 ASK Reader Writer Bitcoding Manchester coding Manchester coding Overall CIU block diagram The PN532 supports different contactless communication modes The CIU supports the internal 80C51 for the different selected communication schemes such as Card Operation mode Reader Writer Operating mode or NFCIP 1 mode up to 424 kbit s The CIU generates bit and byte oriented framing and handles error detection according to these different contactless protocols Higher transfer speeds up to 3 39 Mbit s can be handled by the digital part of the CI
215. lled to ground Table 155 Settings for TX2 TX2 Force TX2CW InVTx2 InvTx2 Envelope RFEn 100ASK RFON RFOFF 0 X 0 X 0 1 1 X 0 j Oj O Oj O TX2 GsPMos GsNMos Remarks ModGsNOff If Tx2RFEn is set to logic 0 the pin TX2 is forced to 0 or 1 depending on CWGsNOff the InvTx2RFOFF bit The bit ForceASK100 has no effect The signal Envelope modulates the transconductance value CWGsNOff When Tx2CW bit is set the transconductance values are always 0 0 1 ModGsP 1 CWGsP 0 0 1 CWGsP 1 CWGsP IVLLN3GIJNOO 49 01 U09 D4N uoneorunuiuo pjJarJ Je9N LO c SNd SJ0 onpuooliulesS dXN Jays ejep 1onpoJd 2002 1equie eq c eH peAJese siuBu Ily 4002 8 dXN vec Jo vL Table 155 Settings for TX2 continued TX2 Force TX2CW InVTx2 InvTx2 Envelope TX2 GsPMos GsNMos Remarks RFEn 100ASK RFON RFOFF 1 0 0 0 X 0 RF ModGsP ModGsNOn When TX2RFEn is set to logic 1 and Force100ASK set to logic 0 the RF OMGeh CH On Dire alin te uae OR Ra NEN 1 X 0 RF n ModGsP ModGsNOn independent of Envelope 1 RF n CWGsP CWGsNOn 1 0 X X RF CWGsP CWGsNOn 1 X X RF n CWGsP CWGsNOn 1 0 0 X 0 0 ModGsNOn If TX2RFEn is set to logic 1 and TX2CW to logic 0 the bit Force100ASK 1 RF CWGsP CWGsNOn_ has effect when Envelope is set to logic 0 TX2 is pulled to ground 1 X 0 0 ModGsNOn 1 RF n CWGsP CWGsNOn 1 0 X X RF CWGsP CWGsNOn 1 X X RF n CWGsP CWGsNOn SJ0 onpuooliulesS dXN J9j 041u09
216. llocation llle 158 Table 211 Description of CIU_RxMode bits 158 Table 212 CIU TxControl register address 6304h bit allocation 00000 cc eee eee 159 Table 213 Description of CIU_TxControl bits 159 Table 214 CIU_TxAuto register address 6305h bit allocation 000020 cee eee 160 Table 215 Description of CIU_TxAuto bits 160 Table 216 CIU_TxSel register address 6306h bit allocation ierre antera a cee eee 161 Table 217 Description of CIU_TxSel bits 161 Table 218 CIU_RxSel register address 6307h bit allocation 2 2 2 in RR RR 162 Table 219 Description of CIU_RxSel bits 162 Table 220 CIU_RxThreshold register address 6308h bit allocation 2000020 cee eee 163 Table 221 Description of CIU_RxThreshold bits 163 Table 222 CIU_Demod register address 6309h bit allocation sisene Ee a eee 163 Table 223 Description of CIU_Demod bits 163 Table 224 CIU_FelNFC1 register address 630Ah bit allocation snp gen 164 Table 225 Description of CIU FelNFC1 bits 164 Table 226 CIU FelNFC2 register address 630Bh bit allocation 0000000 cee eee 165 Table 227 Description of CIU FelNFC2 bits 165 Table 228 CIU_MifNFC register address 630Ch bit allocation i 54 steer Seca RR ate 166 Table 229 Description of CIU_MifNFC bits 166 Table 230 CIU_ManualRCV register address 630Dh bit allocation 2x eeu 16
217. logic 1 e NFCIP 1 106 212 and 424 kbps active communication mode This command is changing automatically to Transceive The FIFO contains the ATR_REQ frame The bit TargetActivated in the register CIU_Status2 is set to logic 0 For 106 kbps only the first byte in the FIFO indicates the start byte FOh and the CRC is added into the FIFO SO IEC 14443A MIFARE Card Operating mode The MIFARE anticollision is finished and the command has automatically changed to Transceive The FIFO contains the first command after the Select The bit TargetActivated in the register CIU_Status2 is set to logic 1 FeliCa Card Operating mode The FeliCa polling command is finished and the command has automatically changed to Transceive The FIFO contains the command after the Polling in the FeliCa protocol The bit TargetActivated in the register CIU_Status2 is set to logic 1 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 137 of 224 NXP Semiconductors PN532 C1 8 6 20 13 8 6 20 14 115432 Near Field Communication NFC controller CONFIDENTIAL MFAuthent command This command handles the MIFARE authentication in Reader Writer mode to enable a secure communication to any MIFARE 1 KB and MIFARE 4 KB emulation card The following data shall be written to the FIFO before the command can be activated Authentication command code 60h for key A 61h for key B Block address Sector key
218. ls to be I O on P70 IRQ RSTOUT N P35 P34 SIC CLK P33 INT1 P32 INTO P31 UART_TX and P30 UART RX pins Table 270 CIU TestPinValue register address 6324h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol useio TestPinValue 6 0 Reset 0 0 0 o o o o0 0 Access R W R W RW RW RW RW RW RW Table 271 Description of CIU TestPinValue bits Bit Symbol Description 7 useio Set to logic 1 this bit enables the I O functionality for the internal test bus on the pins P70_IRQ MSB RSTOUT P35 P34 SIC CLK P33 INT1 P32 INTO P31 UART_TX P30 UART RX LSB Note Before using P34 SIC CLK as a test output the SVDD switch should be closed See register address 6106h 6t00 TestPinValue 6 0 UselO set to logic 1 Read or write the value of the test bus UselO set to logic 0 Read 000 0000 No write 8 6 23 50 CIU TestBus register 6325h Shows the status of the internal test bus Table 272 CIU TestBus register address 6325h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TestBus 7 0 Reset X X X X X x x x Access R RH R R R R R Table 273 Description of CIU TestBus bits Bit Symbol Description 7100 TestBus 7 0 Shows the status of the internal test bus The test bus is selected by the register CIU TestSel2 See Section 8 6 21 2 CIU test bus on page 140 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 182 of 224
219. m data through the field Table 159 Data rng register address 6105h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol data rng Rest X X X xX X xX FX X Access RW RW R W RW RW R W RW RW Table 160 Description of Data rng bits Bit Symbol Description 7100 data rng Random number data register The Control switch rng register can also be used to control the behavior of the SVDD switch Table 161 Control switch rng register address 6106h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol hide svdd sic switch sic switch cpu need random _sig overload en rng dataready Reset 0 1 0 0 9 0 o 1 Access R RW R RW R RW RW R Table 162 Description of Control switch rng bits Bit Symbol Description 7 Reserved 6 hide svdd sig Configure the internal state of SIGIN and P34 in an idle state This bit can be used to avoid spikes on SIGIN and P34 when the SVDD switch becomes enabled or disabled When set to logic 0 the internal state of SIGIN and P34 signals are driven by respectively the pads SIGIN and P34 When set to logic 1 the internal state of SIGIN is fixed to 0 and the internal state of P34 is fixed set to logic 1 5 sic switch overload State of the current limitation of the SVDD switch When set to logic 0 it indicates that the current consumption into the SVDD switch does no exceed the limit When set to logic 1 the current limitation of the SVDD swit
220. mand see Section 8 6 20 12 AutoColl command on page 136 The mode detector is reset when no external RF field is detected by the RF level detector The data mode detector could be switched off during the Autocoll command by setting the bit ModeDetOff in the register Mode to logic 1 see Table 207 on page 156 sfr rd str wr host rd host wr Address Data in Data out CL UART d Registers Register settings for the detected mode cluart clk ciuart reset NFC 106 kbit s ISO IEC 14443A NFC Q 212 kbit s FeliCa NFC Q 424 kbit s FeliCa Data Mode Detector CPU access interface test control Receiver 1 Q Demodulator Fig 38 Data mode detector NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 119 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 12 Serial data switch 8 6 12 1 115432 Two main blocks are implemented in the CIU A digital block comprising state machines coder and decoder logic and an analog block with the modulator and antenna drivers receiver and amplifier The Serial Data Switch is the interface between these two blocks The Serial Data Switch can route the interfacing signals to the pins SIGIN and SIGOUT SIGOUT and SIGIN are mainly used to enable the NFC WI S C interface in the secure IC to emulate card functionality with the PN532 SIGIN is capable of processing a
221. ms the MIFARE 1 KB or MIFARE 4 KB emulation authentication in MIFARE Reader Writer mode only Soft Reset 1111 Resets the CIU 8 6 20 4 Idle command The CIU is in idle mode This command is also used to terminate the actual command 8 6 20 5 Config command To configure the automatic MIFARE Anticollision FeliCa Polling and NFCID3 the data used for these transactions have to be stored internally All the following data have to be written to the FIFO in this order SENS RES 2 bytes in order byteO byte1 e NFCID1 3 Bytes in order byteO byte1 byte 2 the first NFCID1 byte if fixed to 08h and the check byte is calculated automatically SEL RES 1 byte Polling response 2 bytes shall be 01h FEh 6 bytes NFCID2 8 bytes Pad 2 bytes system code e NFCID3 1 byte In total 25 bytes which are transferred into an internal buffer with the Config command The complete NFCID3 is 10 bytes long and consist of the 3 NFCID1 bytes the 6 NFCID2 bytes and the NFCID3 byte listed above 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 133 of 224 NXP Semiconductors PN532 C1 8 6 20 6 8 6 20 7 8 6 20 8 8 6 20 9 115432 Near Field Communication NFC controller CONFIDENTIAL To read out this configuration after it has been loaded the command Config with an empty FIFO buffer has to be started In this case the 25 bytes are transferred from the internal buffer
222. munication overview for ISO IEC 14443A MIFARE Reader Writer Communication scheme ISO IEC 14443A MIFARE Higher Baud Rate MIFARE Baud rate 106 kbit s 212 kbit s 424 kbit s Bit length 128 64 32 maamme Riga le m eo PN532 to Modulation 10096 ASK 100 ASK 100 ASK PICC Card Bit coding Modified Miller Modified Modified coding Miller coding Miller coding PICC Card to Modulation Subcarrier load Subcarrier load Subcarrier load PN532 modulation modulation modulation Subcarrier 13 56 MHzA 6 13 56 MHz 6 13 56 MHzy 6 frequency Bit coding Manchester coding BPSK BPSK The internal CRC co processor calculates the CRC value according the data coding and framing defined in the ISO IEC 14443A part 3 and handles parity generation internally according to the transfer speed With appropriate firmware the PN532 can handle the complete ISO IEC 14443A MIFARE protocol NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 101 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL Current ISO 14443 A Framing at 106 kbit s Start 8bitdata 8bitdata j 8bitdata ea tea odd odd Start Bit is 1 Par oo Par MIFARE Higher Baudrate Framing for 212 424 kbit s Start LOUM Sbitdata 8bitdata J 8Sbitdaia ez M e Un odd odd Burst of Start Bit is 0 Par Par Even par
223. mware reset sequence PCR Status register The PCR Status register stores the state of the 8 wake up events reported within 7 flags Remark The following status bits are not masked by the corresponding enable bit of the PCR Wakeupen register see Table 143 But if not enabled the event does not wake up the PN532 Remark Be careful when handling the status register not all the status events are latched Therefore it be possible that the status register does not indicate any wake up event when reading this register after wake up Remark There is no priority management More than one wake up event may be signalled in the register Therefore it may not be possible to detect the source of the wake up event by reading this register Table 141 PCR Status register address 6204h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol i c wu gpirq_wu SPI wu HSU wu CIU wu inti wu intO wu Rest 0 0 0 0 0 0 0 0 Access R R R R R R R B An event on a given wake up condition is flagged by a logic 1 in the associated bit field NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 95 of 224 NXP Semiconductors PN532 C1 8 5 8 6 115432 Near Field Communication NFC controller CONFIDENTIAL Table 142 Description of PCR Status bits Bit Symbol Description 7 Pc wu I C wake up event on its own address Set to logic 1 when PN532 woke up due to recognition of it
224. n Active Communication mode the counter starts immediately after the external RF field is switched on 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 162 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 24 CIU RxThreshold register 6308h Selects thresholds for the bit decoder 8 6 23 25 115432 Table 220 CIU RxThreshold register address 6308h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol MinLevel 3 0 Collevel 2 0 Reset 1 0 0 0 0 1 0 0 Access RW RW RW RW R RW RW RW Table 221 Description of CIU RxThreshold bits Bit 3 Symbol 7104 MinLevel 3 0 2100 Collevel 2 0 Description Defines the minimum signal strength at the decoder input that shall be accepted If the signal strength is below this level it is not evaluated Reserved Defines the minimum signal strength at the decoder input that has to be reached by the weaker half bit of the Manchester coded signal to generate a bit collision relatively to the amplitude of the stronger half bit CIU Demod register 6309h Defines demodulator settings Table 222 CIU Demod register address 6309h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol AddiQ 1 0 FxiQ TauRev 1 0 TauSync 1 0 Reset 0 1 0 0 1 1 oO 1 Access RW RW RW R R W RW RW R W Table 223 Description of CIU Demod bi
225. n I C peripheral which functionality is to wake up the PN532 from Soft Power Down mode Before entering the Soft Power Down mode the following actions must be taken Enable the block and select the wake up conditions see Table 90 on page 64 Enable the I C wake up event in the PCR see Table 143 on page 96 Once in Soft Power Down mode the wake up block will monitor the 1 C bus If it recognizes its own address and the command type is valid read only write only or both depending of settings in register i c wu control see Table 90 on page 64 the wake up block will generate an acknowledge stretch P50_SCL configure the I C interface in Slave Transmitter or Slave Receiver mode depending on the command Finally i c on is set to logic 1 which initiates the wake up sequence see Section 8 5 Power clock and reset controller on page 89 When the microcontroller has been woken up the firmware must identify the wake up source and must disable the wake up block see Table 90 on page 64 to use I C It is now the I2C peripheral which stretches P50 SCL To enable wake up on GC W the LSB bit of IICADR should be set to logic 1 see Table 88 on page 64 The wake up block and the wake up on a write command should be enabled before entering in Soft Power Down mode When the wake up on GC W condition is recognized the behavior is the same as described above NXP B V 2007 All rights reserved Product data sheet
226. n for case Sel_overcurrent1 Sel overcurrentO 1 Table 294 Overcurrent detection characteristics Symbol Parameter Conditions Min Typ Max Unit lovercurrent Ipvpp threshold for overcurrent detection Sel_overcurrent1 0 300 mA Sel_overcurrent0 0 Sel_overcurrent1 0 210 mA Sel_overcurrentO 1 Sel overcurrent1 1 180 mA Sel overcurrent0zO0 Sel overcurrent1 1 150 mA Sel overcurrentO 1 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 195 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 3 Current consumption characteristics 115432 Table 295 Current consumption characteristics Symbol Parameter Conditions Min Typ Max Unit Iupp Hard Power Down current VBAT 3 4 V 6 2 uA PVDD 3 V Ispp Soft Power Down current VBAT 3 6 V SIE 25 45 pA PVDD 3V RF level detector ON Ispp Soft Power Down current VBAT 3 6 V Dir 18 40 pA PVDD 3V RF level detector OFF lAVDD Analog supply current VBAT 3 4 V 3 10 mA PVDD 3V IPvpp Pad supply current 2 0 5 45 mA Isvbp Secure IC supply current Switch closed 3 3 30 mA Itvpp Transmitter supply current Continuous wave I 60 100 mA VBAT 3 4 V lvBAT Total supply current Continuous wave alie 150 mA VBAT 3 4 V 1 2 3 4 5 6 7 Typical value using a complementary driver configuration and an antenna matched to 40 O between TX1 and TX2 at 13 56 MHz
227. n the FIFO Table 196 CIU FlFOLevel register address EBh or 633Ah bit allocation Bit 7 6 5 4 3 2 1 0 Symbol FlushBuffer FIFOLevel 6 0 Reset 0 o o o o o o o Access w R R OR R R R Table 197 Description of CIU FIFOLevel bits Bit Symbol Description 7 FlushBuffer Set to logic 1 this bit clears the internal FIFO buffer s read and write pointer and the bit BufferOvfl in the CIU Error register immediately Reading this bit will always return logic 0 6t00 FIFOLevel 6 0 Indicates the number of bytes stored in the FIFO buffer Writing to the CIU FIFOData Register increments reading decrements FIFOLevel NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 152 of 224 NXP Semiconductors PN532 C1 8 6 23 13 8 6 23 14 115432 Near Field Communication NFC controller CONFIDENTIAL CIU WaterLevel register ECh or 633Bh Defines the thresholds for FIFO under and overflow warning Table 198 CIU WaterLevel register address ECh or 633Bh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol WaterLevel 6 0 Reset 0 0 0 0 1 0 0 0 Access R R R W R W RW RW R W R W Table 199 Description of CIU WaterLevel bits Bit Symbol Description 7to6 Reserved 5to0 WaterLevel 5 0 This register defines a threshold to indicate a FIFO buffer over or underflow to the 80C51 The HiAlert bit in CIU Status1 register is se
228. ng diagram 0 00 e eee 210 lC timing diagram 0 0 0 c eee eee 211 Application diagram of PN532 212 Package outline HVQFN40 SOT618 1 213 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 221 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 21 Contents 1 General description Lse 1 8 2 2 GPIO registers description 44 2 Features sss 3 8 2 2 1 P7CFGA register 02 0000 44 3 Applications ls 4 8 2 2 2 P7CFGBregister 000 44 4 Quick referen e dat 4 8 2 2 3 P7 register llle 45 Od up MEL EL LEM DE 8 2 2 4 P3CFGAregister 0000 45 5 Ordering information 5 8225 P3CFGBregister 0 0 00 46 6 Block diagram eeeeeeeee 6 8 226 PSregister 00ec ee eee eee 47 7 Pinning information Lee 7 8 3 Host interfaces llle lessen 48 7 1 PINNINg ux rire etia aunaren 7 8 3 1 Multi InterFace MIF description 48 7 2 Pin description 00000 cece eee 8 8 3 1 1 MIF register 0 22 000 cee ee eee 49 8 Functional description 10 8 3 1 2 Configuration modes of the host interface 8 1 BOGS RENNES 10 DUS oe ete aha Heino i totu 49 Dp 8 1 1 PN532 memory map 20000 11 8 3 2 Ee interface HELL
229. ng to the FeliCa or ISO IEC 14443A MIFARE card interface scheme The PN532 generates the load modulation signals either from its transmitter or from the LOADMOD pin driving an external active circuit A complete secure card functionality is only possible in combination with a secure IC using the NFC WI S C interface Compliant to ECMA 340 and ISO IEC 18092 NFCIP 1 Passive and Active communication modes the PN532 offers the possibility to communicate to another NFCIP 1 compliant device at transfer speeds up to 424 kbit s The PN532 handles the complete NFCIP 1 framing and error detection The PN532 transceiver can be connected to an external antenna for Reader Writer or Card PICC modes without any additional active component founded by Philips NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL The PN532 supports the following host interfaces e SPI e IC e High Speed UART HSU An embedded low dropout voltage regulator allows the device to be connected directly to a battery In addition a power switch is included to supply power to a secure IC 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 2 of 224 NXP Semiconductors PN532 C1 2 Features 115432 Near Field Communication NFC controller CONFIDENTIAL 80C51 microcontroller core with 40 KB ROM and 1 KB RAM Highly integrated demodulator and decoder Buffered output drivers to connect
230. nter Timer2 registers Timer2 contains six Special Function Registers SFRs which can be accessed by the CPU Table 34 Timer2 SFR register List Name Size SFR Description Access bytes address T2CON 1 C8h Timer2 control register R W T2MOD 1 C9h Timer2 mode register R W RCAP2L 1 CAh Timer2 reload lower byte R W RCAP2H 1 CBh Timer2 reload upper byte R W T2L 1 CCh Timer2 timer counter lower byte R W T2H 1 CDh Timer2 timer counter upper byte R W Timer2 registers can be written to by either hardware or firmware If both the hardware and firmware attempt to update the registers T2H T2L RCAP2H or RCAP2L during the same machine cycle the firmware write takes precedence A firmware write occurs in state S6 of the machine cycle NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 27 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Each increment or decrement of Timer2 occurs in state S1 except when in baud rate generation mode and configured as a counter In this mode Timer2 increments on each clock cycle When configured as a timer Timer2 is incremented every machine cycle Since a machine cycle consists of 6 clock periods the count rate is 1 6 of the CPU clock frequency 8 1 7 2 T2CON register The register is used to control Timer2 and report its status Table 35 Timer2 T2CON register SFR address C8h bit allocation Bit
231. nterfaces 203 Table 308 Input open drain output pin characteristics for P50 SCL for I C interface 203 Table 309 Input output pin characteristics for MOSI HSU TX for HSU and SPI Interfaces 204 Table 310 Input open drain output pin characteristics for SDA for I C interface 05 204 Table 31 1 Input output pin characteristics for MISO P71 and SCK P72 llle en 205 Table 312 Input output pin characteristics for SIGIN 205 Table 313 Output pin characteristics for SIGOUT 206 Table 314 Output pin characteristics for LOADMOD 206 Table 315 Input pin characteristics for RX 207 Table 316 Output pin characteristics for AUX1 AUX2 208 Table 317 Output pin characteristics for TX1 TX2 208 Table 318 Reset duration time 209 Table 319 SPI timing specification 210 Table 320 I2C timing specification 211 Table 321 Abbreviations 2 00 20000 214 Table 322 Revision history asasa asana anaana 215 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 220 of 224 NXP Semiconductors PN532 C1 20 Figures Fig 1 Fig 2 Fig 3 Fig 4 Fig 5 Fig 6 Fig 7 Fig 8 Fig 9 Fig 10 Fig 11 Fig 12 Fig 13 Fig 14 Fig 15 Fig 16 Fig 17 Fig 18 Fig 19 Fig 20 Fig 21 Fig 22 Fig 23 Fig 24 Fig 25 Fig 26 Fig 27
232. nto two 8 bit registers See also the CIU_CRCResultLSB register Note Setting the bit MSBFirst in CIU Mode register reverses the bit order the byte order is not changed Table 234 CIU CRCResultMSB register address 6311h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol CRCResultMSB 7 0 Reset 1 1 1 top 4 1 1 1 Access R R R R R R R R Table 235 Description of CIU CRCResultMSB bits Bit Symbol Description 7to0 CRCResultMSB 7 0 This register shows the actual value of the most significant byte of the CRC calculation It is valid only if CRCReady bit in CIU_Status1 register is set to logic 1 CIU CRCResultLSB register 6312h Shows the actual LSB values of the CRC calculation Note The CRC is split into two 8 bit registers See also the CIU_CRCResultMSB register Note Setting the bit MSBFirst in CIU Mode register reverses the bit order the byte order is not changed Table 236 CIU CRCResultLSB register address 6312h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol CRCResultLSB 7 0 Reset 1 i T a 1 1 a MN E Access R R R R R R R R Table 237 Description of CIU CRCResultLSB bits Bit Symbol Description 7to0 CRCResultLSB 7 0 This register shows the actual value of the most significant byte of the CRC register It is valid only if CRCReady bit in CIU Status1 register is set to logic 1 NXP B V 2007 All rights reserved Product data sheet Rev 3 2
233. oduct data sheet Rev 3 2 3 December 2007 97 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 Contactless Interface Unit CIU The PN532 CIU is a modem for contactless communication at 13 56 MHz It supports 6 different operating modes ISO IEC 14443A MIFARE Reader Writer FeliCa Reader Writer SO IEC 14443B Reader Writer SO IEC 14443A MIFARE Card 1 KB or MIFARE 4 KB emulation FeliCa Card emulation SO IEC 18092 ECMA 340 NFCIP 1 Peer to Peer The CIU implements a demodulator and decoder for signals from ISO IEC 14443A MIFARE compatible cards and transponders The CIU handles the complete ISO IEC 14443A framing and error detection Parity amp CRC The CIU supports MIFARE 1 KB or MIFARE 4 KB emulation e g MIFARE 1 KB or MIFARE 4 KB emulation products The CIU supports contactless communication using MIFARE Higher transfer speeds up to 424 kbit s in both directions The CIU can demodulate and decode FeliCa coded signals The CIU digital part handles the FeliCa framing and error detection The CIU supports contactless communication using FeliCa Higher transfer speeds up to 424 kbit s in both directions The CIU supports layers 2 and 3 of the ISO IEC 14443 B Reader Writer communication scheme except anticollision which must be implemented in firmware as well as upper layers In card emulation mode the CIU is able to answer to a Reader Writer command either
234. of preamble Sync Data bits and CRC 1111 Test bus bit as defined by the TstBusBitSel in Table 265 on page 180 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 184 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL Table 279 Description of CIU AnalogTest bits continued Bit Symbol 3to0 AnalogSelAux2 3 0 Description Controls the AUX2 pin Note All test signals are described in Section 8 6 21 3 Test signals at pin AUX on page 141 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Tristate DAC output register CIU TestDAC2l l DAC output test signal corr1 2 DAC output test signal corr2l l DAC output test signal MinLevell2 DAC output ADC 2 DAC output ADC Ql DAC output ADC combined with ADC Ql Test signal for production test secure IC clock ErrorBusBit as described in Table 177 on page 144 Low TxActive At 106 kbit s High during Start bit Data bits Parity and us kbit s and 424 kbit s High during Preamble Sync Data bits and CRC RxActive At 106 kbit s High during Data bits Parity and CRC At 212 kbit s and 424 kbit s High during Data bits and CRC Subcarrier detected At 106 kbit s not applicable At 212 kbit s and 424 kbit s High during last part of preamble Sync Data bits and CRC Test bus bit as defined by the TstBusBitSel in Table 26
235. ondition followed by a START condition will be transmitted STO flag will be set to logic 0 Data byte will be transmitted ACK bit will be received Repeated START will be transmitted STOP condition will be transmitted STO flag will be set to logic 0 STOP condition followed by a START condition will be transmitted STO flag will be set to logic 0 Data byte will be transmitted ACK bit will be received Repeated START will be transmitted STOP condition will be transmitted STO flag will be set to logic 0 STOP condition followed by a START condition will be transmitted STO flag will be set to logic 0 Data byte will be transmitted ACK bit will be received Repeated START will be transmitted STOP condition will be transmitted STO flag will be set to logic 0 STOP condition followed by a START condition will be transmitted STO flag will be set to logic 0 I C bus will be released a Slave mode will be entered A START condition will be transmitted when the bus becomes free IVLLN3GIJNOO J9j 041u09 54N uoneoiunuiuo p Je9N LO c SNd SJ0 onpuooliulesS dXN e rSLL Table 81 1 C Master Receiver Mode status codes Status Status of the I C Bus and Application firmware Response Next Action Taken By the I2C interface Hardware E the I2C interface Hardware To from PCDAT TO lCCON STA STO si AA 1002 1equie2eg z Ady 1eeus ejep jonpoud vec 10 6S peAJese Syu Ily 2002 8 dXN
236. onductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 8 CIU Error register D6h or 6336h Error flags showing the error status of the last command executed Table 188 CIU Error register address D6h or 6336h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol WrErr TempErr RFErr BufferOvfl CollErr CRCErm ParityErr ProtocollErr Reset 0 0 oO 0 o o 0 0 Access R R R R R R R R Table 189 Description of CIU Error bits Bit Symbol Description 7 WrErr Set to logic 1 when data is written into the FIFO by the 80C51 during the AutoColl command or MFAuthent command or if data is written into the FIFO by the 80C51 during the time between sending the last bit on the RF interface and receiving the last bit on the RF interface 6 TempErrl Set to logic 1 if the internal temperature sensor detects overheating In this case the antenna drivers are switched off automatically 5 RFErr Set to logic 1 if in active communication mode the counterpart does not switch on the RF field in time as defined in NFCIP 1 standard Note RFErr is only used in active communication mode The bit RxFraming or the bit TxFraming has to be set to 01h to enable this functionality 4 BufferOvfl Set to logic 1 if the 80C51 or if the internal state machine e g receiver tries to write data into the FIFO buffer although the FIFO buffer is already full 3 OollErr Set to logic 1 if a bit collision
237. ontroller CONFIDENTIAL 8 5 8 3 ILR register The Interrupt Level Register is used to program the level of the external interrupts Firmware can write to this register at any time Table 137 PCR ILR register address 6202h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol porpulse enable pdselif gpirq level int1 level intO level latched Reset 0 1 0 0 0 0 0 0 Access R RW R R W R RW R W R W Table 138 Description of PCR ILR bits Bit Symbol Description 7 Reserved 6 porpulse latched Indicates that a reset has been generated When set to logic 1 indicates that the system has been reset The firmware can write a 0 during the firmware reset sequence 5 Reserved 4 enable paselif Indicates that a reset has been generated When set to logic 1 P33_INT1 directly controls state of host interface pins f P33 INT1 is set to logic 1 host interface output pins are driven according to selected interface protocol f P33 INT1 is set to logic 0 host interface output pins are set into high impedance state When set to logic 0 P33_INT1 does not control host interface pins Their state is determined by selected interface protocol enable pdselif P33 INT1 State of host interface pins 0 x Active 1 0 High Impedance 1 1 Active 3 s Reserved 2 gpirq level Selects gpirq interrupt level When set to logic 1 wake up condition is true when gpirq is high When set to logic 0 wake up condition
238. output voltage Push pull mode low level output voltage Input mode high level input current Input mode low level input current Input leakage current Input capacitance Load capacitance Rise and fall times Conditions PVpp 3 V lou 4mA PVpp 1 8 V lou 2 mA PVpp 23V loi 4 mA PVpp 1 8 V loi 2 mA Vj DVpp Vi 0V RSTPD N 04 V PVpp 3 V Vou 0 8 x PVpp VoL 0 2 x PVpp Cout 30 pF PVpp 1 8 V Vou 0 7x PVpp VoL 0 3 x PVpp Cout 30 pF Min iH 0 7 x PVpp 0 0 7 x PVpp 0 7 x PVpp Typ Max Unit PVpp V 0 3 x PVpp V PVpp V PVpp V 0 3 xPVpp V 0 3 x PVpp V 1 uA 1 uA 1 uA 2 5 pF 30 pF 13 5 ns 10 8 ns 1 To minimize power consumption when in Soft Power Down mode the limit is PVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V 3 Data at PVDD 1 8V are only given from characterization results NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 200 of 224 NXP Semiconductors PN532 C1 12 11 115432 Near Field Communication NFC controller CONFIDENTIAL Input output pin characteristics for P30 UART RX P31 UART TX P32 INTO P33 INT1 Table 304 Input output pin characteristics for P30 UART RX P31 UART TX P32 INTO P33 INT1 Symbol Parameter Conditions Min Typ Max Unit Vin High level input voltage O1 0 7 x PVpp PVpp V Vit Low level input volt
239. output voltage lou 4 mA VoL Push pull mode low level VBAT 3 4 V 0 0 4 V output voltage loL 4 mA li Input mode high level Vi SVpp 1 1 uA input current lit Input mode low level input Vi 2 0 V 1 1 uA current l eak Input leakage current RSTPD N20 4V 1 1 uA Cin Input Capacitance 2 5 pF Cout Load Capacitance 30 pF trise fall Rise and fall times Vear 3 4 V 13 5 ns Vou 0 8 x SVpp VoL 0 2 x SVpp Cou t 30 pF 1 To minimize power consumption when in Soft Power Down mode the limit is SVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V Input output pin characteristics for P35 Table 306 Input output pin characteristics for P35 Symbol Parameter Conditions Min Typ Max Unit Vin High level Input voltage 0l 0 7 x DVpp DVpp V Vit Low level Input voltage 21 o 0 3 x DVpp V VoH High level output voltage VBAT 3 4 V DVpp 0 4 DVpp V lon 4 mA VoL Low level output voltage VBAT 3 4 V 0 0 4 V lo 4 mA liq High level input current Vj DVpp 1 1 uA liL Low level input current Vi O0V 1 1 uA lLeak Input leakage current RSTPD_N 0 4 V 1 1 uA Cin Input Capacitance 2 5 pF Cout Load Capacitance 30 pF trise fall Rise and fall times Vegar 3 4 V 16 5 ns Vou DVpp 0 4 VoL 0 4 Cou t 30 pF 1 To minimize power consumption when in Soft Power Down mode the limit is DVpp 0 4 V 2 To minimize power consumption when in Soft Power Down mode the limit is 0 4 V NXP
240. ow Hard Power Down mode HPD When RSTPD N is set to logic 0 the PN532 goes into Hard Power Down HPD mode The PN532 goes into reset and the RSTOUT_N signal is driven low The power consumption is at the minimum DVDD is tied to ground and ports are disconnected from their supply rails When in Hard Power Down mode the GPIO pins are forced in quasi bidirectional mode Referring to Figure 7 on page 41 en n2 e pu 1 e_p 0 e_hd 1 if GPIO pin value is 1 and e hd 0 if GPIO pin value is 0 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 90 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 5 4 Soft Power Down mode SPD In order to initiate the Soft Power Down mode with minimal power consumption the firmware should Configure I Os to minimize power consumption Be careful that for P32 INTO referring to Section 8 2 1 Pad configurations description on page 40 e hd is forced to logic 1 Shut down unused functions Contactless Interface Unit with bit Power down of SFR register D1h see Table 179 on page 145 Disable the SVDD switch see Table 129 on page 88 Power down the RF level detector if RF wake up is not enabled see Table 287 on page 187 Enable relevant wake up sources Disable unwanted interrupts Assert bit CPU PD in register PCON see Table 7 on page 16
241. p cond soft reset 6204h PCR Status i c wu gpirqg wu SPI wu HSU wu CIU wu Reserved int wu intO wu 6205h PCR Wakeupen f c wu en GPIRQ wu en SPI on en HSU on en CIU wu en Reserved int1 en intO en 6206h to Reserved 6300h 6301h CIU_Mode MSBFirst DetectSync TXWaitRF RxWaitRF PolSigin ModeDetOff CRCPreset 1 0 6302h CIU TxMode TxCRCEn TxSpeed 2 0 InvMod TxMix TxFraming 1 0 6303h CIU RxMode RXCRCEn RxSpeed 2 0 RxNoErr RxMultiple RxFraming 1 0 6304h CIU TxControl InvTx2RFon InvTx1RFon InvTx2RFoff InvTx1 RFoff Tx2CW CheckRF Tx2RFEn Tx1RFEn 6305h CIU TxAuto AutoRFOFF Force100ASK AutoWakeUp Reserved CAOn InitialRFOn Tx2RFAutoEn Tx1RFAutoEn 6306h CIU_TxSel LoadModSel 1 0 DriverSel 1 0 SigOutSel 3 0 6307h CIU RxSel UartSel 1 0 RxWait 5 0 6308h CIU RxThreshold MinLevel 3 0 Reserved Collevel 2 0 6309h CIU Demod AddlQ 1 0 FixIQ Reserved TauRcv 1 0 TauSync 1 0 630Ah CIU FelNFC1 FelSyncLen 1 0 DataLenMin 5 0 630Bh CIU FelNFC2 WaitForSelected ShortTimeSlot DataLenMax 5 0 630Ch CIU MifNFC SensMiller 2 0 TauMiller 1 0 MFHalted TxWait 1 0 sia sibei paepuels 78 IVLLN3GIJNOO 19 01 U09 94N uoneorunuiuo pJ8rJ Je9N LO c SNd SJ0 onpuooiulesS dXN 200z 1equie2eg z eg 1eeus ejep jonpoud vec 10 68L e rSLL peAJese siuBu Ily 2002 8 dXN Table 288 Standard registers mapping continued
242. page 117 and requires the transmitter to be activated When activated by asserting bit 0 the detector will monitor the current consumption through the internal low dropout voltage regulator Any violation to the current limits will be reported via bits 7 and 6 of the register NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 116 of 224 NXP Semiconductors PN532 C1 8 6 9 2 115432 Near Field Communication NFC controller CONFIDENTIAL Several levels of detection can be programmed through the register to offer a large panel of compatibility to different type of antennas The high current threshold can be programmed from 40 mA to 150 mA with 15 mA steps total current consumption of the IC The low current threshold can be programmed from 5mA to 35 mA with 10 mA step total current consumption of the IC There is no dedicated pin for the output of the detector The result of the detection is to be read out from the antenna test register Cases 1 and 2 If the antenna and or the tuning network are not connected the TVDD current is higher than the nominal one The antenna detector detects this higher consumption and the andet up bit in andet control register is set to high Case 3 If the EMC filter is not correctly connected the current within TVDD is lower than the nominal one The antenna detector detects this lower consumption and the andet bot bit in andet control register i
243. ped count frozen NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 24 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL Table 25 Description of TO1MOD bits continued Bit Symbol Description 3 GATEO TimerO gate control Set by firmware only When set to logic 1 TimerO is enabled only when P32 INTO is high and bit TRO of register TO1CON is set When set to logic 0 TimerO is enabled 2 C TO TimerO timer counter selector Set by firmware only When set to logic 1 TimerO is set to counter operation When set to logic 0 TimerO is set to timer operation 1100 M 01 00 TimerO mode Set by firmware only Mode 0 MO1 0 and MOO 0 8192 timer TOL acts as a 5 bit prescaler e Mode 1 M01 0 and MOO 1 16 bit timer counter TOH and TOL are cascaded Mode 2 M01 1 and MOO 0 8 bit auto reload timer counter TOH stores value to be reloaded into TOL each time TOL overflows e Mode 3 MO1 1 and MOO 1 Timer0 split into two 8 bit timer counters TOH and TOL TOH is controlled by the control bit of Timer1 bit TR1 of register TO1CON TOL is controlled by standard TimerO control IP32 INTO OR NOT GATEO AND bit TRO 8 1 6 4 TOL and TOH registers 115432 These are the actual timer counter bytes for Timer0 TOL is the lower byte TOH is the upper byte Table 26 Timer0 1 TOL register SFR a
244. red by a falling edge on P32 INTO When set to logic 0 InterruptO triggered by a low level on P32 INTO 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 23 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 6 3 TO1MOD register 115432 This register is used to configure Timer0 1 Table 24 Timer 0 1 TO1MOD register SFR address 89h bit allocation Bit 7 6 5 4 3 2 1 Symbol GATE1 C Ti M11 M10 GATEO C TO M01 Rest 0 0 0 0 0 0 0 Access R W R W R W R W R W R W R W Moo R W Table 25 Description of TO1MOD bits Bit Symbol Description 7 GATE1 Timer1 gate control Set by firmware only When set to logic 1 Timer1 is enabled only when P33_INT1 is high and bit TR1 of register TO1CON is set When set to logic 0 Timer1 is enabled 6 C T1 Timer1 timer counter selector Set by firmware only When set to logic 1 Timer1 is set to counter operation When set to logic 0 Timer1 is set to timer operation 5104 M 11 10 Timer1 mode Set by firmware only e Mode 0 M11 0 and M10 0 8192 counter TiL serves as a 5 bit prescaler Mode 1 M11 2 0 and M10 1 16 bit timer counter T1H and T1L are cascaded e Mode 2 M11 1 and M10 0 8 bit auto reload timer counter T1H stores value to be reloaded into T1L each time T1L overflows e Mode 3 M11 1 and M10 1 Timer1 is stop
245. register is enabled The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 80 of 224 NXP Semiconductors PN532 C1 115432 Near Field Communication NFC controller CONFIDENTIAL Remark The following figure explains how bits CPOL and CPHA can be used SCK CPOL 2 L VS VJ bur SCK CPOL 1 _ LI V V NE E NSS A CPHA 0 Cycle A 1 _ e MOSI Bin XBt2 Y ers Vers Y Bts Yee X it7 Bite I MISO pitt Y Bit2 Bit4 Bite Y Bit7 Bite CPHA 1 ag MOSI E Bit 2 X Bit 3 Bit 4 X Bit 5 X Bit 6 X Bit7 X Bits Y C Fig 18 SPI Data transfer format Product data sheet NXP B V 2007 All rights reserved Rev 3 2 3 December 2007 81 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 5 7 SPlstatus register 115432 The SPlstatus register is byte addressable It contains bits which are used to monitor the status of the SPI interface including normal functions and exception conditions The primary purpose of this register is to detect completion of a data transfer The remaining bits in this register are exception condition indicators Table 124 SPlstatus register SFR address AAh
246. register list Name Size SFR Description R W bytes address SPlcontrol 1 A9h SPI control bits R W SPlstatus 1 AAh SPI Status Error bits R 8 3 5 1 Shift register pointer A shift register is used to address the SPI interface The value loaded in this register is either the first byte of the FIFO manager or the SPI status register The first byte received from the host will contain the address of the register to access SPI status or FIFO manager FDATA and also whether it is a SPI write or read This character is managed by hardware The bits used to define these operations are the 2 LSBs of the first byte Table 121 SPI operation Bit 1 Bit 0 Operation 0 0 No effect 0 1 FIFO manager write access 1 0 SPI Status register read access 1 1 FIFO manager read access STATUS or DATA Decoded output of First byte FIFO manager lt gt FDATA SHIFT REGISTER Fig 14 Memory manager shift register management 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 78 of 224 NXP Semiconductors PN532 C1 8 3 5 2 8 3 5 3 8 3 5 4 115432 Near Field Communication NFC controller CONFIDENTIAL Protocol Once the FIFO is full enough see FIFO manager thresholds in Table 91 on page 66 the CPU sets bit READY in the SPI Status register to logic 1 Polling the SPI Status register the host is informed of the READY flag and can start the data tr
247. regulator tracks VBAT with a variable delta It continues to reject any noise on the VBAT line via the use of an internal band gap reference PVDD VBAT DVDD High or Low Speed Analog RF detected Regulator Logic RSTPD N Command Level shifter Bandgap SuperVisor Fig 20 LDO block diagram 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 84 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 4 1 2 LDO with offset The LDO generates DVDD When RSTPD N is high and PVDD is above 1 6 V this voltage is defined by VBAT 3 4V DVDD is fixed at 3V and bursts on VBAT up to 400 mV are suppressed e 3 4V gt VBAT gt 2 5V DVDD follows VBAT with an offset which decreases with VBAT from 400mV at 3 4V to OmV at 2 5V e 2 5V gt VBAT gt 2 35V DVDD VBAT e 2 35V gt VBAT DVDD and the PN532 is in reset 5 5V 3 4V 3 0V 2 5V 2 35V few mA LDO current consumption 4 5uA Je Fig 21 Graph of DVDD versus VBAT with offset When the PN532 is in Soft Power Down mode bursts rejection is no longer present and the behavior then becomes 5 5V 3 3V 3 0V 2 35V LDO current consumpti Fig 22 Graph of DVDD versus VBAT in Soft Power Down mode with offset 115432 NXP B V 2007 All rights reserved Prod
248. riting a new command code into the CIU Command register e g the Idle command NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 132 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 20 3 Commands overview Table 167 Command overview Command Command code Action Idle 0000 No action cancels current command execution Config 0001 Configures the CIU for FeliCa MIFARE and NFCIP 1 communication Generate 0010 Generates 10 byte random ID number RandomID CalcCRC 0011 Activates the CRC co processor or perform self test Transmit 0100 Transmits data from the FIFO buffer NoCmdChange 0111 No command change This command can be used to modify different bits in the CIU Command register without touching the command e g Power down bit Receive 1000 Activates the receiver circuitry SelfTest 1001 Activates the self test Not described in this chapter Transceive 1100 If bit Initiator in the register CIU Control is set to logic 1 Transmits data from FIFO buffer to the antenna and activates automatically the receiver after transmission is finished If bit Initiator in the register CIU Control is set to logic 0 Receives data from antenna and activates automatically the transmitter after reception AutoColl 1101 Handles FeliCa polling Card operating mode only and MIFARE anticollision Card operating mode only MFAuthent 1110 Perfor
249. rrorbusbitenable Set to logic 1 enable the error source selected by Errorbusbitsel on AUX pads according to SelAux1 and SelAux2 bits code 1010b 2100 Errorbusbitsel 2 0 Define the error source on ErrorBusBit Value Description 000 selects ProtocollErr on test bus 001 selects ParityErr on test bus 010 selects CRCErr on test bus 011 selects CollErr on test bus 100 selects BufferOvfl on test bus 101 selects RFErr on test bus 110 selects TempErr on test bus 111 selects WrErr on test bus 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 144 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 3 CIU Command register D1h or 6331h 115432 Starts and stops the command execution Table 178 CIU Command register address D1h or 6331h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol RevOff Power down Command Reset 0 Oo 1 0 0 0 oO 0 Access R O R RW DY DY DY DY Dy Table 179 Description of CIU Command bits Bit Symbol Description 7106 Reserved 5 RcvOff Set to logic 1 the analog part of the receiver is switched off 4 Power down Set to logic 1 the CIU Power down mode is entered This means internal current consuming blocks of the contactless analog module are switched off except for the RF level detector Set to logic 0 the PN532 starts the wake up procedure During this procedure this bit
250. s see Table 112 on page 75 For the SPI interrupts see Table 122 on page 80 4 IE1 4 I C interrupt enable When set to logic 1 enables 12C interrupt See Table 77 on page 54 3 IE1 3 CIU interrupt 0 enable When set to logic 1 enables CIU interrupt 0 CIU IRQ O0 See Table 190 on page 150 2 IE1 2 CIU interrupt 1 enable When set to logic 1 enables the CIU interrupt 1 CIU IRQ 1 See Table 190 on page 150 1 Reserved This bit must be set to logic 0 0 IE1 0 LDO overcurrent interrupt enable When set to logic 1 enables the LDO overcurrent detection interrupt See Table 127 on page 87 Interrupt prioritization IPO and IP1 registers Each interrupt source can be individually programmed to be one of two priority levels by setting or clearing a bit in the interrupt priority registers IPO and IP1 If two interrupt requests of different priority levels are received simultaneously the request with the high priority is serviced first On the other hand if the interrupts are of the same priority precedence is resolved by comparing their respective conflict resolution levels see Table 9 on page 16 for details The processing of a low priority interrupt can be interrupted by one with a high priority A RETI Return From Interrupt instruction jumps to the address immediately succeeding the point at which the interrupt was serviced The instruction found at the return address will be executed prior to servicing any pending
251. s ejep jonpoud vec 10 88L e rSLL peAJese siuBu Ily 2002 8 dXN Table 288 Standard registers mapping Register Register Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Biti BitO address name 6000h to Reserved 6102h 6103h Config 10_11 int1 pol Reserved pad I1 Reserved pad I0 enselif Selif 1 0 6104h Observe testbus Reserved observe ciu 6105h Data rng data rng 6106h Control switch rng Reserved hide svdd sig Sic switch overload sic switch en Reserved cpu need rng random dataready Reserved 6107h GPIRQ gpirq level P71 gpirq level P50 gpirq level P35 gpirq level P34 gpirg enable P71 gpirg enable P50 gpirq enable P35 gpirg enable P34 6108h Reserved 6109h LDO Reserved overcurrent status sel overcurrent 1 0 enoffset soft highspeedreg control highspeedreg 610Ah i c wu control Reserved i c wu en wr i c wu en rd i c wu en 610Bh Reserved 610Ch Andet control andet bot andet up andet ithl 1 0 andet ithh 2 0 andet en 610Dh Reserved 610Eh NFC WI control Reserved nfc wi status Reserved nfc wi en act req im nfc wi en clk 610Fh to Reserved 61FFh 6200h PCR CFR Reserved cpu freq 1 0 6201h PCR CER Reserved hsu enable Reserved 6202h PCR ILR Reserved porpulse latched Reserved enable pdselif Reserved gpirq level int level intO level 6203h PCR Control Reserved clear wakeu
252. s own I C address appearing on IC interfacel l 6 gpirq wu gpirq wake up event or function of P34 P35 P50 SCL and P71 signals when enabled and level controlled Set to logic 1 when PN532 woke up from a GIRQ event GPIRQ at logic 0 2I 5 SPI wu SPI wake up event spi on signal Set to logic 1 when PN532 woke up from a SPI event NSS at logic 0 21 4 HSU wu HSU wake up event hsu on signal Set to logic 1 when PN532 woke up from a HSU event 5 rising edges on HSU RX l1 3 ClU_wu Contactless wake up event RF detected signall l or NFC WI eventi Set to logic 1 when PN532 woke up from a Contactless interrupt Reserved 1 inti wu P33 INT1 wake up event Set to logic 1 when the system woke up from a P33 INT1 interrupt 21 O intO wu P32 INTO wake up event Set to logic 1 when the system woke up from a P32 INTO interrupt 2l 1 This wake up event is latched The firmware must set the status byte to logic 0 after reading it by writing a logic 1 to bit clear wakeup cond in register PCR Control 2 If this wake up event does not last up to the CPU clock is available it will not be available within the status register it is not latched when no CPU clock is available and it directly reflects the state of the event PCR Wakeupen register Register Wakeupen allows the selection of different wake up events Table 143 PCR Wakeupen register address 6205h bit allocation Bit 7 6 5 4 3 2 1 0 Symbo
253. s set to high To have this functionality working properly it is needed to have the transmitter generating some HF in the antenna Antenna presence detector register Table 157 andet control register address 610Ch bit allocation Bit 7 6 5 4 3 2 1 0 Symbol andet_bot andet_up X andet ithl 1 0 andet ithh 2 0 andet en Reset 0 0 0 0 0 0 0 0 Access RoR RW RW RW RW RW RW Table 158 Description of andet control bits Bit Symbol 7 andet bot 6 andet up 5104 andet ithl 1 0 Description A too low power consumption has been detected A too high power consumption has been detected Set the low current consumption threshold to be detected Define the overcurrent threshold 00 do not use 01 do not use 10 25 mA 11 35 mA Set the high current consumption threshold to be detected 000 45 mA 001 60 mA 010 75 mA 011 90 mA 100 105 mA 101 120 mA 110 130 mA 111 150 mA Enable the detection of the antenna presence detector functionality 3 to 1 andet_ithh 2 0 0 andet_en NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 117 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 10 Random generator 115432 The random generator is used to generate various random number needed for the NFCIP 1 protocol as well as for MIFARE security It can also be used for test purpose by generating rando
254. s started the CIU Command register changes its value to the Idle command and the IdlelRq bit is set Starting the Idle Command by the 80C51 does not set IdlelRq bit 3 HiAltertIRq Set to logic 1 when HiAlert bit in CIU_Status1 register is set to logic 1 In opposition to HiAlert HiAlertlRq stores this event and can only be reset by Set1 bit 2 LoAlertlRq Set to logic 1 when LoAlert bit in CIU Status1 register is set In opposition to LoAlert LoAlertlRq stores this event and can only be reset by Set1 bit 1 ErrlRq Set to logic 1 if any error flag in the CIU Error register is set O TimerlRq Set to logic 1 when the timer decrements the TimerValue register to zero 1 Remark All bits in the register CIU Commlrq shall be set to logic 0 by firmware NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 147 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 7 CIU Divilrq register D5h or 6335h 115432 Contains miscellaneous interrupt request flags These bits are latched Table 186 CIU_Divirq register address D5h or 6335h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol Se2 SiginActlrq ModelRq CRCIRq RfOnlRq RfOfflRq Reset 0 0 oO X 0 0 X X Access Ww DY DY DY DY DY Table 187 Description of CIU_Divirq bits Bit Symbol Description 7 Set2 When set to logic level 0 during write operation
255. s using Timer2 Debug UART mode 1 and 3 Timer2 has a programming mode to function as baud rate generator for the Debug UART In this mode the baud rate is given by formula Baud rate using Timer2 7 feik 16 x 65536 T2RCH T2RCL When rewriting this formula the value for the Timer2 reload values T2RCH L is calculated from the desired baud rate as follows Reload value T2RCH L 8 feik 16 x Baudrate 65536 For details on programming Timer2 to function as baud rate generator for the Debug UART see Section 8 1 7 Timer2 description on page 27 Note the frequency fea is the internal microcontroller frequency If there is no clock divider then folk fosc The next table lists the maximum baud rates when using Timer2 Table 58 Maximum baud rates using Timer2 Reload value T2RCH L fck divided by Baud rate Unit 6 78 18 56 27 12 MHz FFFF 16 424 847 5 1695 kb s General purpose lOs configurations This chapter describes the different configurations for the IO pads P72 alternate function SCK P71 alternate function MISO P70 IRQ P35 P34 alternate function SIC CLK P33 INT1 P32 INTO P31 alternate function UART TX P30 alternate function UART_RX Note that in Hard Power Down mode these ports are disconnected from their supply rail For a given port x there are three configuration registers PxCFGA n PxCFGB n Px n NXP B V 2007 All rights reserved Product data she
256. s will prevent the 12C interface from entering a Slave mode The Master transmitter mode may now be entered by setting the STA bit The I C interface logic will then test the I2C bus and generate a start condition as soon as the bus becomes free When a START condition is transmitted the serial interrupt flag SI is set to logic 1 and the status code in the status register I CSTA will be 08h This status code must be used to vector to an interrupt service routine that loads I2CDAT with the Slave address and the data direction bit SLA W The SI bit in IICCON must then be set to logic 0 before the serial transfer can continue When the Slave address and the direction bit have been transmitted and an acknowledgment bit has been received the serial interrupt flag SI is set to logic 1 again and a number of status codes in I CSTA are possible The appropriate action to be taken for any of the status codes is detailed in Table 80 on page 58 After a repeated start condition state 10h the 12C interface may switch to the Master receiver mode by loading I CDAT with SLA R Master receiver mode As a Master the I C logic will generate all of the serial clock pulses and the START and STOP conditions A transfer is ended with a STOP condition or with a repeated START condition Since a repeated START condition is also the beginning of the next serial transfer the 1 C bus will not be released NXP B V 2007 All rights reserved Prod
257. scription 7t00 hsu counter 7 0 In conjunction with HSU_PRE defines the HSU baud rate Baud rate fok hsu prescaler 1 hsu counter Here is a table of recommendation for some data rates Table 119 Recommendation for HSU data rates Targeted data HSU CNT HSU PRE Real HSU Min Max rate value value freq recommended recommended Host HSU freq Host HSU freq 9 600 0x71 0x18 9516 9 326 9 706 19 200 0x9D 0x08 19 193 18 810 19 576 38 400 0x65 0x06 38 359 37 592 39 126 57 600 0x9D 0x02 57 579 56 428 58 730 115 200 OxEB 0x00 115 404 113 096 117 712 230 400 0x76 0x00 229 831 225 234 234 427 460 800 Ox3B 0x00 459 661 450 467 468 854 921 600 0x1D 0x00 935 172 916 468 953 875 1 288 000 0x15 0x00 1 291 429 1 265 600 1 317 257 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 77 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 3 5 Serial Parallel Interface SPI The SPI has the following features Compliant with Motorola de facto Serial Peripheral Interface SPI standard Synchronous Serial Half Duplex communication 5 MHz max Slave configuration 8 bits bus interface Through the SPI interface the host can either access the FIFO manager acting as data buffer or the SPI status register This selection is made through the hereafter described protocol The SPI interface is managed by 2 SFRs Table 120 SPI SFR
258. secure IC communication RSTPDN 38 PVDD Reset and Power Down When low internal current sources are switched off the oscillator is disabled and input pads are disconnected from the outside world The internal reset phase starts on the negative edge on this pin DVDD 39 O Internal digital power supply VBAT 40 PWR Main external power supply 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 9 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 Functional description 8 14 80C51 The PN532 is controlled via an embedded 80C51 microcontroller core for more details http Awww standardics nxp com support documents microcontrollers scope 80C51 Its principle features are listed below e 6 clock cycle CPU One machine cycle comprises 6 clock cycles or states S1 to S6 An instruction needs at least one machine cycle ROM interface e RAM interface to embedded IDATA and XRAM memories see Figure 4 on page 11 Peripheral interface PIF Power control module to manage the CPU power consumption Clock module to control CPU clock during Shutdown and Wake up modes e Port module interface to configure I O pads Interrupt controller Three timers Debug UART The block diagram describes the main blocks described in this 80C51 section Fig 3 PN532 80C51 block description 115432 NXP B V 2007 All rights reserv
259. sheet Rev 3 2 3 December 2007 172 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 35 CIU_TxBitPhase register 6315h Adjust the bit phase at 106 kbit s during transmission Table 242 CIU TxBitPhase register address 6315h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol RcvClkChange TxBitPhase 6 0 Reset 1 0 0 o 6o 4 1 1 Access R W RW RW RW RW RW RW R W Table 243 Description of CIU TxBitPhase bits Bit Symbol Description 7 RcvClkChange Set to logic 1 the demodulator s clock is derived from the external RF field 6t00 TxBitPhase 6 0 TXBitPhase 6 0 in addition with TxWait bits register 63 OCh define a delay to adjust the bit synchronization during Passive Communication mode at 106 kbit s and in ISO IEC 14443A MIFARE Reader Writer mode TxBitphase 6 0 are representing a delay in number of carrier frequency clock cycles Note The ranges to be used for TxWait 1 0 and TxBitPhase 6 0 are between TXWait 01b and TxBitPhase 1Bh equivalent to an added delay of 20 clock cycles and TXWait 01b and TxBitPhase 7Fh equivalent to an added delay of 120 clock cycles TxWait 10b and TxBitPhase 00h equivalent to an added delay of 121 clock cycles and TxWait 10b and TxBitPhase OFh equivalent to an added delay of 136 clock cycles Note The delay can vary depending of antenna circuits Note When DriverSel 01b t
260. size tuning and power supply Typical operating distance in ISO IEC 14443A MIFARE card or FeliCa card operation mode of about 100 mm depending on the antenna size tuning and the external field strength Supports MIFARE 1 KB or MIFARE 4 KB emulation encryption in Reader Writer mode Supports MIFARE higher data rate at 212 kbit s and 424 kbit s Supports contactless communication according to the FeliCa scheme at 212 kbit s and 424 kbit s Support of the NFC WI S C interface 64 byte send and receive FIFO buffer Programmable timer CRC Co processor Internal self test and antenna presence detector 2 interrupt sources Adjustable parameters to optimize the transceiver performance according to the antenna characteristics NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 99 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 2 Simplified block diagram Data Mode Detector CL UART Level Switch Detector Antenna Contactless Interface Unit Fig 26 Simplify Contactless Interface Unit CIU block diagram The Analog Interface handles the modulation and demodulation of the analog signals according to the Card emulation mode Reader Writer mode and NFCIP 1 mode communication scheme The RF level detector detects the presence of an external RF field delivered by the antenna to the RX pin The data mode detec
261. smitter Master Receiver Slave Receiver Slave Transmitter Two types of data transfers are possible on the I C bus Data transfer from a Master transmitter to a Slave receiver The first byte transmitted by the Master is the Slave address Next follows a number of data bytes The Slave returns an acknowledge bit after each received byte Data transfer from a Slave transmitter to a Master receiver The first byte the Slave address is transmitted by the Master The Slave then returns an acknowledge bit Next follows the data bytes transmitted by the Slave to the Master The Master returns an acknowledge bit after each received byte except the last byte At the end of the last received byte a not acknowledge is returned In a given application the I C interface may operate as a Master or as a Slave In the PN532 the I C is typically configured as a Slave because the host is Master 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 50 of 224 NXP Semiconductors PN532 C1 8 3 2 2 8 3 2 3 115432 Near Field Communication NFC controller CONFIDENTIAL In the Slave mode the I C interface hardware looks for its own Slave address and the general call address If one of these addresses is detected an interrupt is requested When the PN532 microcontroller wishes to become the bus Master the hardware waits until the bus is free before the Master mode is entered so that a
262. stBits 2 0 EFh CIU Coll ValuesAfterColl CollPosNotValid CollPos Fonli B register B 7 0 IVLLN3GIJNOO J9j 041u09 94N uoneorunuiu pJ8rJ Je9N LO c SNd SJ0 onpuooliulesS dXN 1002 1equie2eg z ed 1eeus ejep jonpoud Vcc 10 E61 e rSLL peniesei siuDu Ily 2002 A A dXN Table 289 SFR registers mapping continued SFR Register name Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Biti Bito address F1h to F3h Reserved F4h P7FGA P7CFGA 2 P7CFGA 1 P7CFGA 0 F5h P7FGB P7CFGB 2 P7CFGB 1 P7CFGBJ O0 F6h Reserved F7h P7 P7 2 P7 1 P7 0 F8h IP1 IP1 7 IP1 5 IP1 4 IP1 3 IP1 2 F9h Reserved Fant XRAMP XRAMP 4 0 FBh Reserved FCh P3FGA P3CFGA 5 P3CFGAI4 P3CFGA 3 P3CFGA 2 P3CFGA 1 P3CFGA O0 FDh P3FGB P3CFGB 5 P3CFGBI4 P3CFGB 3 P3CFGB 2 P3CFGB 1 P3CFGB O FEh to FFh Reserved 1 This register is not described in this document as it is a standard 80C51 register IVLLN3GIJNOO J9 043u09 94N uoneorunuiu pJ8rJ Je9N SJ0 onpuooliulesS dXN LO c SNd NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 9 Limiting values Table 290 Limiting values In accordance with the Absolute Maximum Rating System IEC 60134 Symbol Parameter Conditions Min Max Unit PVpp Supply Voltage 0 5 4 V VBAT Power Supply Voltage 0 5 60 V Piot Total power dissipation 500 mW
263. stance Note The conductance value is binary weighted Note During CIU Power down mode if DriverSel 1 0 is not equal to 01b CWGsP 5 is set to logic 1 This is not readable in the register 8 6 23 39 CIU ModGsP register 6319h Defines the driver P output conductance for the time of modulation Table 250 CIU ModGsP register address 6319h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol ModGsP 5 0 Reset 0 0 141 0 0 0 0 O0 Access R R RW RW RW RW RW RW Table 251 Description of CIU ModGsP bits Bit Symbol 7106 5to0 ModGsP 5 0 Description Reserved The value of this register defines the conductance of the output P driver for the time of modulation This may be used to regulate the modulation index Note The conductance value is binary weighted Note During CIU Power down mode if DriverSel 1 0 is not equal to 01b ModGsPJ5 is set to logic 1 This is not readable in the register Note If Force100ASK in CIU TxAuto register is set to logic 1 the ModGsP 5 0 setting has no effect 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 176 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 40 CIU TMode register 631Ah Defines settings for the internal timer Table 252 CIU TMode register address 631Ah bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TAuto TGated 1 0
264. ster CIU Status1 when HiAlert in the same register changes to logic 1 The flag HiAlert is set to logic 1 if only WaterLevel 5 0 bits as set in register CIU WaterLevel or less can be stored in the FIFO buffer It is generated by the following equation HiAlert 64 FIFOLenght WaterLevel The flag LoAlert is set to logic 1 if WaterLevel 5 0 bits as set in register CIU WaterL evel or less are actually stored in the FIFO buffer It is generated by the following equation LoAlert FIFOLenght WaterLevel NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 128 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 17 CIU timer 115432 A timer unit is implemented in the CIU CIU timer The 80C51 use CIU timer to manage timing relevant tasks for contactless communication CIU timer may be used in one of the following configurations Timeout Counter e Watch Dog Counter e Stop Watch Programmable One Shot Periodical Trigger CIU timer can be used to measure the time interval between two events or to indicate that a specific event occurred after a specific time CIU timer can be triggered by events which will be explained in the following but it does not itself influence any internal event e g A timeout during data reception does not influence the reception process automatically Furthermore several timer related bits
265. still shows a logic 1 A logic 0 indicates that the PN532 is ready for operations see Section 8 6 19 2 CIU Power down on page 131 Note The Power down bit can not be set when the SoftReset command has been activated 3to0 Command Activates a command according the Command Code Reading this register shows which command is actually executed See Section 8 6 20 CIU command set on page 132 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 145 of 224 NXP Semiconductors PN532 C1 8 6 23 4 8 6 23 5 115432 Near Field Communication NFC controller CONFIDENTIAL CIU CommlEn register D2h or 6332h Control bits to enable and disable the passing of interrupt requests Table 180 CIU CommlEn register address D2h or 6332h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol z TxIEn RXIEn IdlelEn HiAlertlEn LoAlertlEn ErlEn TimerlEn Reset o oO 0 0 0 0 0 0 Access R RW RW R W R W R W RW RW Table 181 Description of CIU CommlEn bits Bit Symbol Description 7 Reserved 6 TxIEn When set to logic 1 allows the transmitter interrupt request indicated by bit TxIRq to be propagated to CIU IRQ 1 5 RxIEn When set to logic 1 allows the receiver interrupt request indicated by bit RxIRq to be propagated to CIU IRQ 1 4 IdlelEn When set to logic 1 allows the idle interrupt request indicated by bit IdlelRq to be propagated to CIU_IRQ_O
266. subcarrier frequency of 847 5 kHz generated by the secure IC Fig 45 Signal shape for SIGIN in NFC WI mode 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 124 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 13 3 NFC WI S C initiator mode The PN532 includes 2 counters of 127 and 31 with digital filtering to enable activation from the secure IC ACT REQ Si or the command to go from data to command mode ESC_REQ Table 163 NFC_WI_conirol register address 610Eh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol nfc_wi_status nfc_wi_en nfc wi en act req im clk Reset 0 0 0 0 0 9 0 0 Access R R R R RW RW RW Table 164 Description of NFC WI control bits Bit Symbol Description 7104 Reserved 3 nfc wi status Indicates a NFC WI counter has reached its limit Set to logic 1 when the counter has reached its limit It can also be used as an interrupt for the 80C51 if the IEO 6 bit is set to logic 1 see Table 10 on page 17 2 Reserved 1 nfc wi en act req im Selection of the NFC WI counter This bit is used to select the 31 or 127 counter When set to logic 0 the 31 counter is selected When set to logic 1 the 127 counter is selected 0 nfc wi en clk Enable the NFC WI counters on SIGIN When set to logic 1 the counters can run and count the clock cy
267. switched on meaning the CIU can be accessed by a second NFC device as a NFCIP 1 target Note In case the bit InitialRFOn has been set to logic 1 when the drivers were already switched on it is needed either to set InitialRFOn to logic 0 before setting the bits Tx1RFEn and Tx2RFEn in the register CIU TxControl to logic 0 or to set also the bits Tx1RFAutoEn and Tx2RFAutoEn in the register CIU TxAuto to logic 0 CIU command set General description The CIU behavior is determined by an internal state machine capable to perform a certain set of commands Writing the according command code to the CIU Command register starts the commands Arguments and or data necessary to process a command are mainly exchanged via the FIFO buffer General behavior Each command that needs a data stream or data byte stream as input will immediately process the data it finds in the FIFO buffer An exception to this rule is the Transceive command Using this command the transmission is started with the StartSend bit in CIU_BitFraming register Each command that needs a certain number of arguments will start processing only when it has received the correct number of arguments via the FIFO buffer The FIFO buffer is not cleared automatically at command start Therefore it is also possible to write the command arguments and or the data bytes into the FIFO buffer and start the command afterwards Each command may be interrupted by the 80C51 by w
268. t 108 Card operating modes 109 ISO IEC 14443A MIFARE card operating MOJE enne dene RE Rd FUR EROR ae 109 FeliCa Card operating mode 110 Overall CIU block diagram 110 Transmitter control 2 112 RF level detector 225 115 Antenna presence self test 116 Principle s Gerena e SRL aes 116 Antenna presence detector register 117 Random generator 2 118 Data mode detector 119 Serial data switch 0 120 Serial data switch for driver and loadmod 120 NFC WI S C interface support 122 Signal shape for FeliCa NFC WI S C interface SUPPORT spc ence ix Rr eR RR Re Reo eed 123 Signal shape for ISO IEC14443A and MIFARE NFC WI S C support 000 124 NFC WI S C initiator mode 125 Hardware support for FeliCa and NFC pollirigi 2E we cet eee eee 125 Polling sequence functionality for initiator 125 Polling sequence functionality for target 126 Additional hardware support for FeliCa and NEG ist eit i el ES 126 Near Field Communication NFC controller 8 6 15 8 6 16 8 6 16 1 8 6 16 2 8 6 16 3 8 6 17 8 6 18 8 6 18 1 8 6 19 8 6 19 1 8 6 19 2 8 6 19 3 8 6 20 8 6 20 1 8 6 20 2 8 6 20 3 8 6 20 4 8 6 20 5 8 6 20 6 8 6 20 7 8 6 20 8 8 6 20 9 8 6 20 10 8 6 20 11 8 6 20 12 8 6 20 13 8 6 20 14 8 6 21 8 6 21 1 8 6 21 2
269. t 1 Thebit IE1 7 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 20 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 1 6 Timer0 1 description 8 1 6 1 115432 Timer0 1 are general purpose timer counters Timer0 1 has the following functionality Configurable edge or level detection interrupts Timer or counter operation e 4timer counter modes Baud rate generation for Debug UART Timer0 1 comprises two 16 bit timer counters TimerO and Timer1 Both can be configured as either a timer or an event counter Each of the timers can operate in one of four modes Mode 0 13 bit timer counter Mode 1 16 bit timer counter Mode 2 8 bit timer counter with programmable preload value e Mode 3 two individual 8 bit timer counters TimerO only In the timer function the timer counter is incremented every machine cycle The count rate is 1 6 of the CPU clock frequency CPU CLK In the counter function the timer counter is incremented in response to a 1 to 0 transition on the input pins P34 SIC CLK TimerO or P35 Timer1 In this mode the external input is sampled during state S5 of every machine cycle If the associated pin is at logic 1 for a machine cycle followed by logic 0 on the n
270. t 1 The 80C51 has to configure the CIU with the correct polling response parameters for the Polling command 2 To activate the automatic polling in target mode the AutoColl Command has to be activated 3 The CIU receives the polling command send out by an initiator and answers with the polling response The timeslot is selected automatically The timeslot itself is randomly generated but in the range 0 to TSN which is defined by the polling command The CIU compares the system code stored in byte 17 and 18 of the Config Command with the system code received with the polling command by an initiator If the system code is equal the CIU answers according to the configured polling response The system code FF hex acts as a wildcard for the system code bytes i e a target of a system code 1234 hex answers to the polling command with one of the following system codes 1234 hex 12FF hex FF34 hex or FFFF hex If the system code does not match no answer is sent back by the PN532 If a valid command which is not a Polling command is received by the CIU no answer is sent back and the command AutoColl is stopped The received frame is stored in the FIFO 8 6 14 3 Additional hardware support for FeliCa and NFC Additionally to the polling sequence support for the FeliCa mode the PN532 supports the check of the LEN byte The received LEN byte is checked by the registers CIU FelNFC1 and CIU FelNFC2 DataLenMin in register CIU_FelNFC1 de
271. t to logic 1 otherwise the value CWGsNOff in the register CIU_GsNOff is used 3to0 ModGsNOn 3 0 The value of this register defines the conductance of the output N driver for the time of modulation and when the PN532 generates the RF field This may be used to regulate the modulation index Note The conductance value is binary weighted Note During CIU Power down mode if DriverSel 1 0 is not equal to 01b ModGsNOn 3 is set to logic 1 This is not readable in the register Note The value of the register is only used if RF is generated by the driver either Tx1RFEn or Tx2RFEn is set to logic 1 otherwise the value ModGsNOff in the register CIU GsNOff is used NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 175 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 38 CIU CWGsP register 6318h Defines the conductance of the P driver Table 248 CIU CWGsP register address 6318h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol 2 CWGsP 5 0 Reset 0 o 1 o o o 0 0 Access R ORW RW RW RW RW RW Table 249 Description of CIU CWGsP bits Bit Symbol 7106 5to0 CWGSsP 5 0 Description Reserved The value of this register defines the conductance of the output P driver during times of no modulation This may be used to regulate the output power and subsequently current consumption and operating di
272. t to logic 1 if the remaining number of bytes in the FIFO buffer space is equal or less than the defined WaterLevel 5 0 bits The LoAlert bit in CIU_Status1 register is set to logic 1 if equal or less than WaterLevel 5 0 bits are in the FIFO Remark For the calculation of the HiAlert and LoAlert see Table 191 on page 150 CIU Control register EDh or 633Ch Contains miscellaneous control bits Table 200 CIU Control register address EDh or 633Ch bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TStopNow TStartNow WrNFCIP 1IDtoFIFO Initiator 2 RxLastBits 2 0 Reset OO 8 0 0 o o0 0 0 0 Access w W DY RW R R R R Table 201 Description of CIU Control bits Bit Symbol Description 7 TStopNow Set to logic 1 the timer stops immediately Reading this bit will always return logic 0 6 TStartNow Set to logic 1 the timer starts immediately Reading this bit will always return logic O 5 WrNFCIP 1IDtoFIFO Set to logic 1 the internal stored NFCID3 10 bytes is copied into the FIFO Afterwards the bit is set to logic O automatically 4 Initiator Set to logic 1 the PN532 acts as Initiator or Reader Writer otherwise it acts as Target or a Card 3 Reserved 2t00 RxLastBits 2 0 Shows the number of valid bits in the last received byte If set to 000b the whole byte is valid NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 153 of 224 NXP Semiconductors PN
273. tely by setting the Power down bit in the register CIU Command All CIU blocks are switched off except the 27 12 MHz oscillator and the RF level detector All registers and the FIFO will keep the content during CIU Power down If the bit AutoWakeUp in the register CIU TxAuto is set and an external RF field is detected the CIU Power down mode is left automatically After setting bit Power down to logic 0 in the register CIU Command it needs 1024 clocks cycle until the CIU Power down mode is left indicated by the Power down bit itself Setting it to logic O does not immediately set it to logic 0 It is automatically set to logic O by the CIU when the CIU Power down mode is left When in CIU Power down mode and DriverSel 1 0 is no set to 00b see Table 217 on page 161 to ensure a minimum impedance at the transmitter outputs the CWGsNOn 3 CWGsNOff 3 ModGsNOr 3 ModGsNOff 3 CWGsP 5 ModGsP 5 bits are set to logic 1 but it is not readable in the registers 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 131 of 224 NXP Semiconductors PN532 C1 8 6 19 3 8 6 20 8 6 20 1 8 6 20 2 115432 Near Field Communication NFC controller CONFIDENTIAL Transmitter Power down The Transmitter Power down mode switches off the internal antenna drivers to turn off the RF field by setting the bits Tx1RFEn and Tx2RFEn in the register CIU TxControl to logic 0 The receiver is still
274. tent is not influenced by internal state machines e g CIU CommlEn may be written and read by the CPU It will also be read by internal state machines but never changed by them DY DYnamic These bits can be written and read by the 80C51 Nevertheless they may also be written automatically by CIU internal state machines e g the commands in the CIU Command register change their values automatically after their execution R Readonly These registers hold flags which value is determined by CIU internal states only e g the CRCReady register can not be written from external but shows CIU internal states W Write only These registers are used for control means only They may be written by the 80C51 but can not be read Reading these registers returns always logic 0 Reserved These registers are not implemented or reserved for NXP testing use 8 6 23 2 CIU SIC CLK en register 6330h Enables the use of P34 SIC CLK as secure IC clock Table 176 CIU SIC CLK en register address 6330h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol sic ck p34 en Errorbusbitenable _Errorbusbitsel 2 0 Reset 0 o o Oo 0 o 0 0 Access R W R R R R W RW RW RW Table 177 Description of CIU SIC CLK en bits Bit Symbol Description 7 sic clk p34 en Set to logic 1 this bit configures P34 SIC CLK to be used as secure IC clock SIC CLK Set to logic 0 P34 SIC CLK is in normal mode P34 6104 Reserved 3 E
275. tent right on that standards A license for the portfolio of the NFC Standards patents of NXP B V needs to be obtained at Via Licensing the pool agent of the NFC Patent Pool e mail info vialicensing com NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 5 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 6 Block diagram Power Distribution Power Clock Reset controller PCR Host interfaces Contactless Interface Unit CIU osan oscou M o uo ao Teo Fig 1 Block diagram of PN532 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 6 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 7 Pinning information 7 1 Pinning E Peg et hfs wuwa 222589585 zc sj B E e b b e i E 115432 Dwss t CIF SOK PT2 LoAnwon 2 Cag Miso ert CIN moi SDA HSU TX Ta 4 CST Nas P5 Sc HSU RX Fig 2 Pin configuration for HVQFN 40 SOT618 1 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 7 of 224 NXP Semiconductors PN532 C1 115432 7 2 Pin description Table 3 PN532 Pin description Near Field Communication NFC controller CONFIDENTIAL Symbol Pin Type Ref DVSS 1 LOADMOD 2 TVSS1 3 TX
276. ter E9h or 6338h Contain status flags of the receiver transmitter and Data Mode Detector Table 192 CIU Status2 register address E9h or 6338h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol TempSensClear RFFreqOK TgActivated MFCrypto1On ModemState 2 0 Reset 0 0 0 0 0 0 0 0 Access R W R R DY DY R R R Table 193 Description of CIU_Status2 bits Bit Symbol Description 7 TempSensClear Set to logic 1 this bit clears the temperature error if the temperature is below the alarm limit of 125 C 6 Reserved 5 RFFreqOK Indicates if the frequency detected at the RX pin is in the range of 13 56 MHz Set to logic 1 if the frequency at the RX pin is in the range 12 MHz RX pin frequency 15 MHz Note The value of RFFreqOK is not defined if the external RF frequency is in the range of 9 to 12 MHz or in the range of 15 to 19 MHz 4 TgActivated Set to logic 1 if the Select command is received correctly or if the Polling command was answered Note This bit can only be set during the AutoColl command in Passive Communication mode or Card operating modes Note This bit is set to logic 0 automatically by switching off the RF field 3 MFOrypto1On Set to logic 1 MIFARE Crypto1 unit is switched on and therefore all data communication with the card is encrypted This bit can only be set to logic 1 by a successful execution of the MFAuthent command This is only valid in Reader Writer mode
277. teristics Symbol Parameter Conditions Min Typ Max Unit landetH Ipypp upper current threshold for andet ithh 2 0 000b 31 56 mA antenna presence detection andet ithh 2 0 001b 42 74 mA andet ithh 2 0 2 010b 52 92 mA andet ithh 2 0 2 011b 63 110 mA andet ithh 2 0 100b 73 128 mA andet ithh 2 0 101b 84 146 mA andet ithh 2 0 110b 94 164 mA andet ithh 2 0 111b 105 182 mA 12 5 Typical 27 12 MHz Crystal requirements Table 298 Crystal requirements Symbol Parameter Conditions Min Typ Max Unit fxTAL XTAL frequency 27 107 27 2 27 133 MHz ESR Equivalent series 50 Q resistance Cioap Load capacitance 10 pF PxrAL Drive level 100 uW 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 197 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 6 Pin characteristics for 27 12 MHz XTAL Oscillator OSCIN OSCOUT Table 299 Pin characteristics for 27 12 MHz XTAL Oscillator OSCIN OSCOUT Symbol CinoscIN Parameter OSCIN Input Capacitance Vouoscour High level output voltage VoLtoscout Low level output voltage Cinoscout OSCOUT Input Capacitance foscin Drec litter Clock Frequency Duty Cycle of Clock Frequency Jitter of Clock Edges Conditions AVpp 2 8 V VDC 0 65 V VAC 0 9 Vpp with appropriate quartz and capacitances values with appropriate quartz and capacitances
278. the bit set to logic 1 in the write command are written to logic 0 in the register When set to logic level 1 during write operation the bit set to logic 1 in the write command are written to logic 1 in the register 6105 Reserved 4 SiginActlrq Set to logic 1 when SIGIN is active See Section 8 6 13 NFC WI S2C interface support on page 122 This interrupt is set to logic 1 when either a rising or falling edge is detected on SIGIN 1 3 ModelRq Set to logic level 1 when the mode has been detected by the Data Mode Detector Note The Data Mode Detector can only be activated by the AutoColl command and is terminated automatically having the detected the communication mode Note The Data Mode Detector is automatically restarted after each RF reset 2 CRCIRq Set to logic level 1 when the CRC command is active and all data are processed 1 RfOnIRq Set to logic level 1 when an external RF field is detected 11l2 0 RfOfflRq Set to logic level 1 when an present external RF field is switched off 1 At power up after reset modes including Hard Power Down the logical value of this bit is undefined 2 After Power Down bit of Table 181 on page 146 goes from logic 1 to logic O after pd rfleveldet bit of Table 286 on page 187 goes from logic 1 to logic 0 the logical value of this bit is undefined NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 148 of 224 NXP Semic
279. the same time but one after the other 5 EN WCOL IRQ ENable Write COLlision IRQ When set to logic 1 the WCOL IRQ is enabled The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 4 EN TWLL IRQ ENable Transmit WaterlLevelLow IRQ When set to logic 1 the TWLL IRQ is enabled The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 3 EN TFF IRQ ENable Transmit FIFO Full IRQ When set to logic level 1 the TFF_IRQ is enabled The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 2 EN RWLH IRQ ENable Receive WaterLevel High IRQ When set to logic 1 the RWLH IRQ is enabled The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 1 EN ROVR IRQ ENable Read OVeRrun IRQ When set to logic 1 the ROVR IRQ is enabled The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 0 EN RFF IRQ ENable Receive FIFO Full IRQ When set to logic 1 the RFF_IRQ is enabled The bit IE1 5 of register IE1 see Table 13 on page 18 has also to be set to logic 1 to enable the corresponding CPU interrupt 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December
280. these states is entered a serial interrupt is requested SI 1 this can happen in any CPU cycle and a valid status code will be present in IICSTA This status code will remain present in IICSTA until SI is set to logic O by firmware Note that I2CSTA changes one CPU CLK clock cycle after SI changes so the new status can be visible in the same machine cycle SI changes or possibly in one out of six CPU states the machine cycle after that This should not be a problem since you should not read I CSTA before either polling SI or entry of the interrupt handler which in itself takes several machine cycles Table 78 I2CSTA register SFR address D9h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol ST 7 0 Reset 1 1 1 4 32 Oo Access R R R R R R R Table 79 Description of I2CSTA bits Bit Symbol Description 7to0 ST 7 0 Encoded status bit for the different functional mode Several Status codes are returned in a certain mode Master Transmitter Master Receiver Slave Transmitter Slave Receiver plus some miscellaneous status codes that can be returned at any time SI 1 gt ST 7 0 status F8 SI 1 0 gt ST 7 0 SI SI 0 gt ST 7 0 F8 Fig 11 I C state machine of status behavior NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 57 of 224 1002 1equie2eg z NOY 1eeus ejep jonpoud vee 10 8S e
281. tion when in Soft Power Down mode the limit is 0 4 V 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 205 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller 12 18 Output pin characteristics for SIGOUT Table 313 Output pin characteristics for SIGOUT 12 19 115432 CONFIDENTIAL Symbol Parameter Conditions Min Typ Max Unit Vou High level output voltage DVpp 0 1 lt SVpp lt DVpp SVpp 0 4 SVpp V lou 4mA VoL Low level output voltage DVpp 0 1 lt SVpp lt DVpp 0 04 V lot 4mA lLeak Input leakage current RSTPD_N 0 4 V 1 1 uA Cin Input Capacitance 2 5 pF Cout Load Capacitance 30 pF trisefal Rise and fall times VBAT 3 4 V 9 ns Vou 0 8 x SVpp VoL 0 2x SVpp Cout 30 pF Output pin characteristics for LOADMOD Table 314 Output pin characteristics for LOADMOD Symbol Parameter Conditions Min Typ Max Unit Vou High level output voltage VBAT 3 4 V DVpp 0 4 DVpp V lou 4mA VoL Low level output voltage VBAT 3 4 V 0 0 4 V lo 4mA Cout Load Capacitance 10 pF trise fall Rise and fall times VBAT 3 4 V 4 5 ns Vou 0 8 x DVpp VoL x20 2x DVpp Cout 10 pF NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 206 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 20 Input pin characteristics for RX Table 315
282. tions 00 2000005 216 8 6 23 55 CIU_TestDAC2 register 632Ah 186 17 3 Disclaimers 200002e eee 216 8 6 23 56 CIU_TestADC register 632Bh 186 17 4 Trademarks 200000e eee eee 216 8 6 23 57 CIU RFlevelDet register 632Fh ra 187 18 Contact information s 216 8 7 Registers map seen 187 19 Taebles nnn nee 217 8 7 1 Standard registers lulu 188 20 Fi 221 872 SFRregisters 0 0 eee 191 OUTES es coante Soe eae eae ere aa 9 Limiting values sees eee 194 21 Contents sci liie nna 222 10 Recommended operating conditions 194 11 Thermal characteristics 194 12 Characteristics llesesesse 195 12 1 Power management characteristics 195 12 2 Overcurrent detection 195 12 3 Current consumption characteristics 196 12 4 Antenna presence self test thresholds 197 12 5 Typical 27 12 MHz Crystal requirements 197 12 6 Pin characteristics for 27 12 MHz XTAL Oscillator OSCIN OSCOUT 5 198 12 7 RSTPD N input pin characteristics 198 12 8 Input pin characteristics for IO and I1 199 12 9 RSTOUT N output pin characteristics 199 Please be aware that important notices concerning this document and the product s described herein have been included in section Legal information founded by NXP B V 2007 Al
283. tivates the NSS SCL HSU_RX rising edge counter When the counter is 5 then a signal hsu on is activated This signal is one of the possible wake up events from Soft Power Down mode in the PCR block The firmware shall set this bit to logic 1 just before requesting a Soft Power Down mode The bit HSU on en of register PCR Wakeupen see Table 144 on page 96 has also to be set to logic 1 to enable the corresponding PN532 wake up 6 start frame Enables the preamble filter for next frame When set to logic 1 this bit indicates that a new frame is coming This re activates the preamble filter when enabled meaning that the first 00 00 FF characters will not be sent to the FIFO manager 5 4 tx stopbit 1 0 Defines the number of stop bit during transmission These 2 bits define the number of Stop bit s inserted at the end of the transmitted frame The number of Stop bit s transmitted is equal to tx stopbit 1 3 rx stopbit Defines the number of stop bit during reception This bit defines the number of Stop bit s inserted at the end of the received frame The number of Stop bit s expected in reception is equal to rx stopbit 1 2 txen Enables the transmission of HSU When set to logic 1 this bit enables the transmission of characters When set to logic 0 the transmission is disabled only after the completion of the current transmission 1 rx_en Enables the reception of the HSU When set to logic 1 this bit enables the reception of
284. to the FIFO The CIU has to be configured after each power up before using the automatic Anticollision Polling function AutoColl command During a Hard Power Down RSTPD N set to logic 0 this configuration remains unchanged This command terminates automatically when finished and the active command is Idle Generate RandomID command This command generates a 10 byte random number stored in the internal 25 bytes buffer and overwrites the 10 NFCID3 bytes This random number might be used for fast generation of all necessary ID bytes for the automatic Anticollision Polling function Note To configure the CIU Config command has to be used first This command terminates automatically when finished and the active command is Idle CalcCRC command The content of the FIFO is transferred to the CRC co processor and a CRC calculation is started The result is stored in the CRCResult register The CRC calculation is not limited to a dedicated number of bytes The calculation is not stopped when the FIFO gets empty during the data stream The next byte written to the FIFO is added to the calculation The preset value of the CRC is defined by the CRCPreset bits of the register CIU Mode and the chosen value is loaded to the CRC co processor when the command is started This command has to be terminated by firmware by writing any command to the CIU Command register e g the Idle command If SelfTest in register CIU_AutoTest is set to logic 1 th
285. tor detects a ISO IEC 14443 A MIFARE FeliCa or NFCIP 1 mode in order to prepare the internal receiver to demodulate signals which are sent to the PN532 The NFC WI S C interface supports communication to secure IC It also supports digital signals for transfer speeds above 424 kbit s The CL UART handles the protocol requirements for the communication schemes in co operation with the appropriate firmware The FIFO buffer allows a convenient data transfer from the 80C51 to the CIU and vice versa 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 100 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 3 Reader Writer modes 8 6 3 1 115432 All indicated modulation indices and modes in this chapter are system parameters This means that beside the IC settings a suitable antenna tuning is required to achieve the optimal performance ISO IEC 14443A Reader Writer The following diagram describes the communication on a physical level the communication overview in the Table 145 describes the physical parameters 1 PCD to PICC 100 ASK Miller Coded Transfer speed 106 to 424 kbit s ISO IEC 14443A Card PICC 2 PICC to PCD Subcarrier Load modulation Manchester Coded or BPSK Transfer speed 106 to 424 kbit s Reader Writer Fig 27 ISO IEC 14443A MIFARE Reader Writer communication diagram Table 145 Com
286. ts Bit 7106 3102 1to0 Symbol AdalQ 1 0 FixlQ TauRcv 1 0 Description Defines the use of and Q channel during reception Note FixIQ has to be set to logic 0 to enable the following settings ValueDescription 00Select the stronger channel 01Select the stronger and freeze the selected during communication 10Combines the and Q channel 11RFU If set to logic 1 and AddIQ 0 is set to logic 0 the reception is fixed to channel If set to logic 1 and AddIQ 0 is set to logic 1 the reception is fixed to Q channel Reserved Changes time constant of internal PLL during data receiving Note If set to 00h the PLL is frozen during data receiving TauSync 1 0 Changes time constant of internal PLL during burst out of data reception NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 163 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 26 CIU_FelNFC1 register 630Ah 115432 Defines the length of the FeliCa Sync bytes and the minimum length of the received frame Table 224 CIU FelNFC1 register address 630Ah bit allocation Bit 7 6 5 4 3 2 1 0 Symbol FelSyncLen 1 0 DataLenMin 5 0 Rest 0 0 0 0 0 0 0 0 Access RW RW RW RW RW RW RW RW Table 225 Description of CIU FelNFC1 bits Bit Symbol Description 7to6 FelSyncLen 1 0 Defines the length of the Sync bytes Value
287. ts reserved Product data sheet Rev 3 2 3 December 2007 45 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 2 2 5 P3CFGB register 115432 Table 68 P3CFGB register SFR address FDh bit allocation Bit 7 6 5 4 3 2 1 0 Symbol PSCFGB P3CFGB P3CFGB P3CFGB P3CFGB P3CFGB Oe ei dl Reset 0 0 0 0 o o 0 0 Access R R RAW RW RW RW PRW RW Table 69 Description of P3CFGB bits Bit Symbol Description 7106 Reserved 5 P3CFGB 5 In conjuction with PSCFGA 5 it configures the functional mode of P35 4 P3CFGB 4 In conjuction with PSCFGA 4 it configures the functional mode of P34 3 P3CFGB 3 In conjuction with PSCFGA 3 it configures the functional mode of P33_INT1 2 PSCFGB 2 In conjuction with PSCFGA 2 it configures the functional mode of P32 INTO l1 1 PSCFGB 1 In conjuction with PSCFGA 1 it configures the functional mode of P31 0 PS3CFGB 0 In conjuction with PSCFGA O it configures the functional mode of P30 1 When CPU PD is set to logic 1 see Table 7 on page 16 for P32 INTO and referring to Section 8 2 1 e hd is forced to logic 1 Remark When in Hard power down mode the P35 to P30 pins are forced in quasi bidirectional mode Referring to Figure 7 en n2 e pu 1 e p 0 Ande hd 1 if P3x pin value is 1 and e hd 0 if P3x pin value is 0 NXP B V 2007 All rights reserved
288. uct data sheet Rev 3 2 3 December 2007 51 of 224 NXP Semiconductors PN532 C1 8 3 2 4 115432 Near Field Communication NFC controller CONFIDENTIAL The first byte transmitted contains the Slave address of the transmitting device 7 bit SLA and the data direction bit In this case the data direction bit R W will be logic 1 R 12C data are received via SDA while P50 SCL outputs the serial clock IC data are received 8 bits at a time After each byte is received an acknowledge bit is transmitted START and STOP conditions are output to indicate the beginning and end of a serial transfer In the Master receiver mode a number of data bytes are received from a Slave transmitter The transfer is initialized as in the Master transmitter mode When the START condition has been transmitted the interrupt service routine must load I2 CDAT with the 7 bit Slave address and the data direction bit SLA R The SI bit in I1CCON must then be set to logic 0 before the serial transfer can continue When the Slave address and the data direction bit have been transmitted and an acknowledgment bit has been received the serial interrupt flag SI is set to logic 1 again and a number of status codes are possible in I CSTA The appropriate action to be taken for each of the status codes is detailed in Table 81 on page 59 After a repeated start condition state 10h the I2C interface may switch to the Master transmitter mode by loading IACDAT wit
289. uct data sheet Rev 3 2 3 December 2007 85 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 4 1 3 LDO without offset The LDO generates DVDD but any voltage fluctuation on VBAT is not compensated for When RSTPD Nis high and PVDD is above 1 6 V this voltage is defined by e VBAT gt 3 0V DVDD 3 V e 3 0V gt VBAT gt 2 35V DVDD VBAT e 2 35V gt VBAT DVDD and the PN532 is in reset 5 5V 3 3V 3 0V 2 35V jfew mA LDO current consumption Jj 5uA Fig 23 Graph of DVDD versus VBAT without offset When in Soft Power Down mode the behavior is the same as that with offset See Figure 22 on page 85 8 4 1 4 LDO overcurrent detection The LDO integrates an overcurrent detector When the current on VBAT exceeds a programmable threshold an error bit is set See Table 126 on page 87 If IE1 0 is set to logic 1 see Table 13 on page 18 an 80C51 interrupt will be asserted when an overcurrent is detected 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 86 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 4 1 5 LDO register Table 126 LDO register address 6109h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol overcurrent_ sel_overcurrent 1 0 enoffset soft control status highspeedreg highspeedreg Reset 0 0 0 0 0
290. uctions There are two access modes 16 bit data pointer DPTR the full XRAM address space can be accessed paging mechanism the upper address byte is stored in the SFR register XRAMP the lower byte is stored in either R1 or RO The Figure 5 illustrates both mechanisms NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 14 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL XRAM FFh 00h FFh 00h AU e 40 kB Reserved FFh 00h FFh 00h FFh 00h FFh 00h FFh 00h FFh 00h FFh 00h FFh 8000H 00h 7FFFH XRAMP 5Fh Peripheral 32 oth FFh 00h MOVX Ri A MOVX A Ri MOVX A DPTR Nh MOVX DPTR A XRAMP 5Eh Peripheral 31 i PERIPHERAL i AREA XRAMP 42h Peripheral 3 FFh 00h FFh 00h FFh 00h FFh 00h FFh 00h XRAMP 41h Peripheral 2 6000H XRAMP 40h Peripheral 1 BFFFH XRAMP 3Fh XRAMP 3Eh XRAM XRAMP 02h ii 00h FFh 00h FFh 00h XRAMP 01h XRAMP 00h Y 0000H Fig 5 Indirect addressing of XRAM memory space 8 1 3 Program memory PN532 program memory ranges from 0000h to 9FFFh which is physically mapped to the 40 KB ROM 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 15 of 224 NXP Semiconductors PN532 C1
291. udrate 35 i 8 1 8 7 Mode1and3baudrates 36 8 3 5 oat dodi nantes SP opeta sinaeg Us 8 1 8 8 Baud rates using Timert Debug UART mode 1 8 3 5 1 Shift register pointer 78 e IMMMMMMEMENMENNM CONNU 36 8 3 5 2 Protocol ce 79 8 1 8 9 Baud rates using Timer2 Debug UART mode 1 8 3 5 8 SPI status register read 79 ANG 3j coeds aaa aE A AEEA 38 8 3 5 4 FIFO manager read acceSS 79 8 2 General purpose lOs configurations 38 eee ae seins ai Hs a nL 8 2 1 Pad configurations description 40 Dr nu Ule fel trauen bdo dta 824 1 Open drain 22 ccc cece cece acna 40 8 8 5 7 SPlstatus register 0 82 8 2 1 2 Quasi Bidirectional sisse 4 894 ap AU uU QN TREE E 83 82 13 Input 42 8 4 1 Low drop out voltage regulator 84 M Cd MN 8 4 1 1 LDO block diagram 84 2 1 pull output 2 2 2 000 Bee OPOS PUN Up 3 8442 LDO with offset cesses 85 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 222 of 224 NXP Semiconductors PN532 C1 8 4 1 3 8 4 1 4 8 4 1 5 8 4 2 8 5 1 8 5 2 8 5 3 8 5 4 8 5 5 8 5 7 8 5 8 8 5 8 1 8 5 8 2 8 5 8 3 8 5 8 4 8 5 8 5 8 5 8 6 8 6 1 8 6 2 8 6 3 8 6 3 1 8 6 3 2 8 6 3 3 8 6 4 8 6 4 1 8 6 4 2 8 6 4 3 8 6 4 4 8 6 5 8 6 5 1 8 6 5 2 8 6 6 8 6 7 8 6 8 8 6 9 8 6
292. ued Bit 2 Symbol Description RB8 Receive data bit Set by hardware and by firmware When set to logic 1 In modes 2 or 3 the hardware stores the 9th data bit that was received in RB8 In mode 1 the hardware stores the stop bit that was received in RB8 In mode 0 the hardware does not change RB8 TI Transmit interrupt flag 3l TI must be set to logic 0 by firmware In modes 2 or 3 when transmitting the hardware sets to logic 1 the transmit interrupt flag TI at the end of the 9th bit time In modes 0 or 1 when transmitting the hardware sets to logic 1 the transmit interrupt flag TI at the end of the 8th bit time RI Receive interrupt flag 3l RI must be set to logic 0 by firmware In modes 2 or 3 when receiving the hardware sets to logic 1 the receive interrupt flag 1 clock period after sampling the 9th data bit if SM2 1 setting RI can be blocked see bit description of SM2 above In mode 1 when receiving the hardware sets to logic 1 the receive interrupt flag 1 clock period after sampling the stop bit 2l In mode 0 when receiving the hardware sets to logic 1 RI at the end of the CPU state 1 of the 9th machine cycle after the machine cycle where the data reception started by a write to SOCON 1 2 3 If SM2 is set to logic 1 loading RB8 can be blocked see bit description of SM2 above If SM2 is set to logic 1 setting RI can be blocked see bit description of SM2 above The bit IEO 4 of register IEO see T
293. values with appropriate quartz and capacitances values Min Typ Max Unit 2 pF 1 1 V 0 2 V 2 pF m 27 12 MHz Ol 45 50 55 96 0 10 ps RMS 1 ensure minimum distance between the pins and the components 12 7 RSTPD N input pin characteristics Table 300 RSTPD N input pin characteristics See the Figure 51 on page 212 for example of appropriate connected components The layout should Symbol Vin Parameter High level input voltage High level input voltage Low level input voltage Low level input voltage High level input current Low level input current Input capacitance Conditions PVDD gt 1 6V PVDD 0 4 V see Section 8 4 on page 83 PVDD 1 6V PVDD lt 0 4 V see Section 8 4 on page 83 Vi PVpp Vy 0V Min 0 9 x PVpp 0 65 x VBAT Typ Max Unit 36 V 3 6 V 04 V 04 V 1 uA 1 uA 2 5 pF 115432 NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 198 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 12 8 Input pin characteristics for I0 and l1 Table 301 Input pin characteristics for I0 11 and TESTEN Symbol Parameter Conditions Min Typ Max Unit Vin High level input voltage 1 0 7 x DVpp DVpp V ViL Low level input voltage 210 0 3xDVpp V li High level input current Vj DVpp 1 1 uA I0 and l1 lit Low level input current Vi 0V 1 1 uA Cin Input capacitance 2 5 pF
294. ved Product data sheet Rev 3 2 3 December 2007 183 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 53 CIU AnalogTest register 6328h Controls the pins AUX1 and AUX2 Table 278 CIU AnalogTest register address 6328h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol AnalogSelAux1 3 0 AnalogSelAux2 3 0 Reset 0 o o 0 0 0 0 0 Access R W RW O RW RW RW RW RW RW Table 279 Description of CIU AnalogTest bits Bit Symbol Description 7104 AnalogSelAux1 3 0 Controls the AUX1 pin Note All test signals are described in Section 8 6 21 3 Test signals at pin AUX on page 141 0000 Tristate 0001 DAC output register CIU_TestDAC1 0010 DAC output test signal corr1 0011 DAC output test signal corr2l 0100 DAC output test signal MinLevell 0101 DAC output ADC l1 0110 DAC output ADC Ql 0111 DAC output ADC combined with ADC Q 1 1000 Test signal for production test 1001 secure IC clock 1010 ErrorBusBit as described in Table 177 on page 144 1011 Low 1100 TxActive At 106 kbit s High during Start bit Data bits Parity and d kbit s and 424 kbit s High during Preamble Sync Data bits and CRC 1101 RxActive At 106 kbit s High during Data bits Parity and CRC At 212 kbit s and 424 kbit s High during Data bits and CRC 1110 Subcarrier detected At 106 kbit s not applicable At 212 kbit s and 424 kbit s High during last part
295. verted InvTx2RFoff Setto logici and Tx2RFEn set to logic 0 TX2 output signal is inverted InvTx1RFoff Setto logici and Tx1RFEn set to logic 0 TX1 output signal is inverted of a 0o Tx2CW Set to logic 1 the output signal on pin TX2 will deliver continuously the un modulated 13 56 MHz energy carrier Set to logic 0 Tx2CW is enabled to modulate of the 13 56 MHz energy carrier 2 CheckRF Set to logic 1 TX2RFEn and Tx1RFEn can not be set if an external RF field is detected Only valid when using in combination with Tx2RFAutoEn and TX1RFAutoEn bits in CIU_TxAuto register 1 Tx2RFEn Set to logic 1 the output signal on pin TX2 will deliver the 13 56 MHz energy carrier modulated by the transmission data 0 DdRFEn Set to logic 1 the output signal on pin TX1 will deliver the 13 56 MHz energy carrier modulated by the transmission data NXP B V 2007 All rights reserved Product data sheet Rev 3 2 3 December 2007 159 of 224 NXP Semiconductors PN532 C1 Near Field Communication NFC controller CONFIDENTIAL 8 6 23 21 CIU TxAuto register 6305h Controls the setting of the antenna driver Table 214 CIU TxAuto register address 6305h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol Auto Force AutoWakeUp CAOn InitialRFOn Tx2 Td RFOFF 100ASK RFAutoEn RFAutoEn Reset 0 0 0 0 o0 0 0 0 Access R W RW RW R RW ORW RW Table 215 Description of CIU TxAuto bits Bit Symbol Descript
296. xceeding 40 mA triggers the limiter and the status bit sic switch overload is set Near Field Communication NFC controller CONFIDENTIAL Register Control switch rng also controls the random generator within the Contactless Interface Unit CIU Table 128 Control switch rng register address 6106h bit allocation Bit 7 6 5 4 3 2 1 0 Symbol hide svdd sic switch sic switch cpu need random sig overload en rng dataready Rest 0 1 0 0 EX 0 0 1 Access R RW R RW R RW RW R Table 129 Description of Control switch rng bits Bit 7 6 Symbol hide svdd sig sic switch overload sic switch en cpu need rng random dataready Description Reserved Configures internal state of input signals SIGIN and P34 when idle This bit can be used to avoid spikes on SIGIN and P34 when the SVDD switch is enabled or disabled When set to logic 0 internal state of SIGIN and P34 are driven by pads SIGIN and P34 respectively When set to logic 1 internal state of SIGIN is set to logic 0 and internal state of P34 is set to logic 1 Indicates state of SVDD switch current limiter When set to logic 0 indicates that current consumption through SVDD switch does not exceed limit 40mA When set to logic 1 the SVDD switch current limiter is activated Enables or disables power to SVDD switch When set to logic 0 SVDD switch is disabled and SVDD output is tied to the ground When set to logic
297. y handles the MIFARE activation and the FeliCa polling in the Card Operation mode The bit Initiator in the CIU Control register has to be set to logic 0 for correct operation During this command Mode Detector is active if not deactivated by setting the bit ModeDetOff in the CIU Mode register After Mode Detector detects a mode the mode dependent registers are set according to the received data In case of no external RF field this command resets the internal state machine and returns to the initial state but it will not be terminated When the Autocoll command terminates the Transceive command gets active During Autocoll command e The CIU interrupt bits except RfOnIRq RfOfflRq and SIGINActIRq see Table 187 on page 148 are not supported Only the last received frame will serve the CIU interrupts During ISO IEC 14443A activation TXCRCEn and RxCRCEn bits are defined by the AutoColl command The changes cannot be observed at the CIU_TxMode and CIU_RxMode registers When the Transceive command is active the value of the bits is relevant e During Felica activation polling TXCGRCEn and RxCRCEn bits are always relevant and are not overruled by the Autocoll command Their value must be set to logic 1 according the FeliCa protocol Note Pay attention that the FIFO will also receive the two CRC check bytes of the last command even if they are already checked and correct and if the state machine Anticollision and Select routine h

Download Pdf Manuals

image

Related Search

Related Contents

Téléchargez le manuel de directives    Omega 111.25.23.60.55.003 watch  TWIN Option Full Release  Gebruiksaanwijzing W-3010 Dustec®    ASSMANN Electronic AK-126007 SATA cable  ワンケーブル電源ユニット4CH用 KN-VP04 仕様書  

Copyright © All rights reserved.
Failed to retrieve file