Features
•
•
•
•
•
•
•
•
•
13.56 MHz RFID Chip for Cards or Tags
2048-bit Read/Write RFID EEPROM
ISO 14443-2 Type B Compliant
Full ISO 14443-3 Compliant Anticollision
100,000 Write Cycle Reliability
3 ms Write Time
Password and Lockwrite Protection
82 pF Tuning Capacitor
0 – 70°C Operation
Description
The AT88RF020 is a low-end 13.56 MHz RFID (Radio Frequency IDentification)
device that includes an on-chip EEPROM-based (nonvolatile) memory. The wireless
interface complies with Type B operation of ISO/IEC 14443. The specific sections of
compliance are 14443-1, as well as 14443-2:1999(E) (dated 5/2/00) and 14443-
3:2000(E) (dated 7/13/00).
This device is designed to be used in applications where one or more RFID devices
will be simultaneously placed within an intelligent reader/writer RF field. Communica-
tion between the RF reader/writer and this device will take place through the use of
the featured anticollision command set supported by this device.
The memory contains a total of 2048 bits, organized as 32 64-bit pages. Write opera-
tions are designed to complete in less than three milliseconds (ms). The endurance
rating for the memory is 100,000 write cycles per byte.
This device supports these security features: password checking, data locking, a one-
way counter and a guaranteed unique serial number.
The AT88RF020 includes an on-chip internal tuning capacitor that enables it to oper-
ate with a single external coil antenna. This antenna completes the RFID channel.
Figure 1.
Block Diagram
13.56 MHz,
2048-bit RFID
EEPROM
AT88RF020
Bridge
Rectifier
Regulator
EEPROM
Clock
Extraction
Data
Modulation
Control
Rev. 2010C–RFID–2/06
1
All bits are sent to or read from the chip least significant bit first. Bit fields listed in this
document are listed with the LSB on the left and the MSB on the right. Multibyte informa-
tion is sent to the chip least significant byte first.
The first byte sent to the chip is stored in memory at the lowest address, and the internal
address is incremented for subsequent bytes. Information is read from the memory and
transmitted by the chip in exactly the same order in which it was written: the first bit writ-
ten is the first bit read.
This specification follows the nomenclature found within the ISO/IEC 14443 document.
Proximity Coupling Device (PCD) is the reader/writer, and Proximity Integrated Circuit
Card (PICC) is the tag/card. ETU refers to Elementary Time Unit, which is the time
required to transmit or receive one bit. One ETU is equal to 128 carrier cycles (9.439
µs). RFU refers to any feature, item, bit field or bit that is held as Reserved for Future
Use. When the reader/writer sends data to this device, RFU bits should always be “0”.
When this device sends data to the reader/writer, RFU bits are undefined.
Memory Map
Table 1.
Memory Map
Byte 0
Page 0
Page 1
Page 2
Page 3
Page 4
...
...
...
Page 31
—
—
The memory array within this device is organized as shown in Table 1.
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
Byte 7
Pseudo Unique PICC ID
Application Data
Signature
Password
—
—
—
—
—
LockBits
Reserved
Counter
—
—
—
—
—
—
—
—
—
Bytes marked “–” in Table 1 are user-defined and will be set to 0x00 upon shipment from
Atmel. The chip accesses these bytes using specific commands described later in this
document.
A total of 1904 bits (238 bytes) are available for user-defined purposes, including the
Reserved and Signature fields but excluding the PUPI, LockBits, Counter and Password
fields in the above memory map.
The fields named above are defined as follows:
Pseudo Unique PICC Identifier:
This PUPI field is a unique serial number permanently
written into the device’s nonvolatile memory at the Atmel factory during wafer probe/test.
It cannot be modified and is guaranteed to be unique for all AT88RF020 devices. Cus-
tomers desiring serial numbers longer than 32 bits are expected to use other locations
within the memory, including the Reserved field within Page 1.
Application Data:
This field is transmitted unmodified from the card to the reader/writer
as part of the ATQB command response.
Counter:
This field is automatically incremented by the device whenever the COUNT
instruction
is executed. It is factory set to the value of zero upon shipment from Atmel.
2
AT88RF020
2010C–RFID–2/06
AT88RF020
Signature:
This field is written unmodified into the first six bytes of Page 2 via the
COUNT instruction. It is expected that this value will be related to the count and may be
encrypted by the reader/writer. In this manner, the Counter and Signature fields together
can provide an additional level of security from tampering.
Pages 0, 1 and 2 can always be read by the system; Page 3 may never be read by the
system; and all remaining pages can be read only after the proper password has been
sent to the chip. The LockBits field within Page 0 can be modified only through the use
of the LOCK command and only after the proper password has been sent to the chip.
The contents of Page 2 can only be modified using the COUNT command—again, only
after the proper password has been sent to the chip.
All other pages (1 and 3 through 31) can be written to only after the proper password
has been validated by the chip. The first four bytes of Page 0 comprise the serial num-
ber (PUPI) and, although the adjacent LockBits field is updateable, the serial number
can never be changed during any kind of operation.
Communications
The electrical signaling of the chip is fully compatible with ISO 14443-2, “Radio Fre-
quency Power and Signal Interface,” version 1999(e) for Type B only. Anticollision
operation and frame formatting is compatible with ISO 14443-3 Type B, “Initialization
and Anticollision,” version 2000(e), Type B only.
All data sent between the PICC and PCD is sent as characters (see ISO 14443-3, sec-
tion 7.1.1). The character is composed of a start bit (logic “0”), 8 bits of data and a stop
bit (logic “1”).
Between characters is an extra guard time (EGT) that must not exceed 6 ETUs (~57
microseconds (µs)) for data sent to the PICC and will be two ETUs for data sent to the
PCD (see ISO 14443-3, section 7.1.2).
The PICC will automatically resynchronize character reception (internal clocks) with the
start bit of each incoming character.
Groups of characters exchanged between the PCD and PICC comprise a frame, which
is delimited by a Start of Frame (SOF) and an End of Frame (EOF) signal protocol (see
ISO 14443-3, sections 7.1.3–7.1.5).
After the READ command has been received by the PICC, the PICC will respond with
the data frame following a delay of 8 ETUs (~75.5 µs) and transmit a sub carrier for a
period of 10 ETUs (~94.4 µs) with no phase changes (see ISO 14443-3, section 7.1.6,
and ISO 14443-2, section 9.2.5.).
Note:
This device ignores attempts to reduce the minimum TR0 and TR1 values from the ISO
14443-2 defaults as may be specified by the PCD in the ATTRIB command (see ISO
14443-3, sections 7.10.3.1 and 7.10.3.2.).
Command/Data
Transmission Frame
CRC
A 2-byte CRC code is included in all frame transmissions. The CRC polynomials are
defined as:
x
16
+ x
12
+ x
5
+ x
0
This is a hex polynomial of 1021. The CRC register is initialized to 0xFFFF. When
receiving information from the system, the device computes the CRC on the incoming
command, data and CRC bytes (start/stop bits, SOT, EOT and EGT are ignored). When
the last bit of the CRC has been received, the value in the CRC register should be
0x0000. When the device transmits data, the CRC is computed based on all outgoing
data bits.
3
2010C–RFID–2/06
Anticollision
Anticollision is implemented as per ISO 14443-3, Type B (see ISO 14443-3, sections 7.3
and 7.4). There are four primitive commands that support the anticollision scheme:
REQB/WUPB, SlotMARKER, ATTRIB and HLTB.
This 5-byte command (see ISO 14443-3, section 7.7) is used for the PCD to probe the
field for PICCs or to wake up PICCs that are in the HALT state. The first byte must be a
fixed 0x05. This chip will respond only to values of 0x00 or 0x01 in the second (AFI)
byte. Bit 3 of the third byte is used to select between REQB and WUPB commands,
while Bits 0–2 are used to set N, which is used for the command response (ATQB). If
the PICC receives a WUPB command with an invalid AFI code, then it will remain in the
HALT state.
When the PICC receives one of these commands properly encoded, it will generate a
random number (R) of up to four bits, according to the value of N passed by the PCD
and specified in Table 13 of ISO 14443-3 and in Table 2 on page 4. If N = 1 or the ran-
dom number generator selects R = 1, then the PICC will send an ATQB and listen for
REQB/WUPB, ATTRIB and HLTB commands. Otherwise, it will wait for the Slot-
MARKER command that matches the value R selected by the random number
generator.
Table 2.
Command Codes
Binary Code (in cmd)
000
100
010
110
001
N
1
2
4
8
16
Size of R (in bits)
–
1
2
3
4
REQB/WUPB Command
The response to both of these commands is an ATQB packet. This format is as speci-
fied in ISO 14443-3, section 7.9.1, with the following values:
PUPI:
Application Data:
Protocol Info:
As stored in memory (unique serial number)
As stored in memory
0x00, 0x00, 0x41
(Bit_rate_capability: 106 Kbps only)
(Max_frame_size: 16)
(Protocol type: not compliant with 14443-4)
(FWI: Frame Waiting Time minimal, 4.8 ms)
(ADC: Application Data Coding is proprietary)
(FO: Only CID (Card Identifier) supported by PICC)
ATTRIB Command
The ATTRIB command is used to select among all the chips that may have responded
to a given REQB/WUPB command. The chip will respond to ATTRIB commands from
11 to 16 bytes in length where the 2nd, 3rd, 4th and 5th bytes exactly match the PUPI
stored in the memory. If the chip responds to the ATTRIB command, it enters the
ACTIVE state where the data transfer commands described above will be honored.
4
AT88RF020
2010C–RFID–2/06
AT88RF020
The PICC ignores all the PARAM bytes with the exception of the least significant four
bits of PARAM4, which are stored within the chip as the CID for future responses. Any
higher layer INF command is also ignored.
The PICC response to a valid ATTRIB command is always three bytes long. The first
byte contains the CID in the lower nibble and 0x0 in the upper nibble. The next two bytes
are the CRC.
HLTB Command
The HLTB command is used to set the PICC to the HALT state, after which only the
WUPB command will be acknowledged. The format of this 7-byte command is 0x50,
PUPI (4 bytes), CRC (2 bytes). The chip always responds to a valid HLTB command
with the 3-byte sequence: 0x00, CRC_0 and CRC_1. The HLTB command is not valid if
the PICC is in the ACTIVE state (see ISO 14443-3 sections 7.4.7 and 7.12 for additional
information).
The SlotMARKER command provides a way for the reader to query those cards for
which the generated random number R is greater than 1. It is a 3-byte command, the
last two of which are the CRC bytes. The least significant nibble of the first byte is the
slot number, and if this matches the generated random number, then the ATQB
response is generated. The chip will truncate the slot number field to match the value of
N provided in the REQB command. The most significant nibble of this command is fixed
at 0xA.
SlotMARKER Command
5
2010C–RFID–2/06
