EM4056B6WP11

EM MICROELECTRONIC - MARIN SA EM4056 2KBIT Read/Write with ANTICOLLISION Contactless Identification Device Description The EM4056 is a CMOS integrated circuit intended for use in contactless Read/Write transponders. The user’s configurable 2 kbits EEPROM memory contained in the chip is organised in 125 words of 16 bits, each word can be irreversibly protected against reading or/and writing attempts. The user can define a password and protect part or all of the memory. Serial and identification numbers are laser programmed during IC manufacturing. A reserved application numbering may be made available and customer specific on request. The EM4056 transmits its data towards the reader by amplitude modulation of the magnetic field and receives the commands from the reader in a similar way. Simple set of commands allow the dialogue between the EM4056 and the reader. Read and write commands access directly to an address of memory. The EM4056 has a built-in anticollision protocol which allows an unlimited number of transponders in the reader field to dialogue simultaneously. The transmission antenna is the only external element required, all the other elements are integrated on chip. • • • • • • • • • • • • • • Programmable PIN coverage of the memory (0, 25, 50, 75 or 100 %) Power check for EEPROM Write operation Reader Talk First communication protocol Data transmission performed by Amplitude Modulation (ASK) and Biphase (CDP) coding Data rate 2 KBauds (Bit Period = 64 periods of carrier frequency) 100 to 150kHz carrier frequency Long range Read/Write operations Block check of data transmission (CRC) Anticollision protocol based on unique ID number(unlimited number of tags) PIN Code identification linked with counter of false attempts On chip arithmetic operation (addition, comparison of secret and non secret data, etc.) 340pF ± 3% on chip Resonant Capacitor No external supply buffer capacitance On chip Rectifier and Voltage Limiter Applications • • • • • • Ticketing Hands free Access control Prothesis identification Prepayment devices Manufacturing automation with portable database Industrial logistics Features • • • 2 kBits EEPROM organized in 125 words of 16 bits 3 words of 16 Bits Laser ROM for application number and serial number Programmable (OTP) Read and/or Write Protection on every word Typical Operating Configuration C2 L C1 EM4056 Typical value for inductance L is 4.78mH at fO = 125 KHz Fig. 1 Copyright © 2005, EM Microelectronic-Marin SA 1 www.emmicroelectronic.com EM4056 Block Diagram Analog Circuit Antenna (Coil) CLK Logic Circuit Serial Output EEPROM Power Supply Addressing Memory Laser ROM 3x16 bit Safety (incl. PIN Code) 125kHz EM coupling Modulator Adder Write/Read Protection (OTP) Anticollision Demodulator 125 x 16 bit EEPROM Serial Input Fig. 2 System Principle 125kHz EM coupling Reader EM4056 Command Mode Reader Oscillator Reader Coil Modulator RS232 Serial Interface Decoder Demodulator Reader Coil Transponder Coil Answer Mode Transponder Coil Reader Coil Fig. 3 Copyright © 2005, EM Microelectronic-Marin SA 2 www.emmicroelectronic.com EM4056 Absolute Maximum Ratings Parameter Voltage on Power Supply pads Voltage on other pads Max. AC peak current induced on COIL1 and COIL2 Storage temperature Operating temperature Electrostatic discharge max. to MIL-STS-883C method 3015 Symbol VDD VPAD ICOIL TSTORE TOP VESD Min. -0.3 Max. 6.0 Units V Handling Procedures This device has built-in protection against high static voltages or electric fields; however, anti-static precautions must be taken as for any other CMOS component. Unless otherwise specified, proper operation can only occur when all terminal voltages are kept within the voltage range. Unused inputs must always be tied to a defined logic voltage level. VSS - 0.3 VDD+ 0.3 V - 30 + 30 mAp -55 -40 +125 +85 1000 oC oC V Operating Conditions Parameter Max. AC Voltage on COIL Max. AC coil current Carrier frequency Symbol Min VCOIL ICOIL fCOIL TOP -10 100 -40 Max (Note 1) +10 150 +85 Units Vpp mAp kHz °C Stresses above these listed maximum ratings may cause permanent damages to the device. Exposure beyond specified operating conditions may affect device reliability or cause malfunction. Operating temperature Note 1: Defined by forcing 10mA on Coil1-Coil2 Electrical Characteristics Unless otherwise specified : VDD = 4.0 V, VSS = 0 V, TOP = 25°C, VCOIL = 4.5 Vpp, fCOIL = 125 KHz Sine wave Parameter Supply voltage (not regulated) Supply voltage (regulated) Min. EEPROM Read voltage Min. EEPROM Write voltage EEPROM Read current EEPROM Write current Power check EEPROM write current EEPROM pwr check threshold voltage EEPROM data endurance EEPROM retention Voltage drop modulator (note 3) Symbol VPOS-REG Conditions VPOS-REG = max (note 1) Min 3.4 2.5 2.5 Typ Max (Note1) VDD VRD VWR IRD IWR IPWCHK VPWCHK NCY TRET on VON CCOIL VPRH TMONO VCLK1min VCLK2min 4.3 Unit V V V V Read mode Write mode Read mode Write mode VDD = 4.0 V (note 2) 19 60 70 2.52 2.75 25 80 95 3.10 µA µA µA V cycle year Erase all / Write all TOP = 55oC after 105 cycles ICOIL = 100 µA ICOIL = 5 mA 105 10 0.50 2.50 330 340 2.0 25 50 350 2.6 85 4.5 1.0 VCOIL- VSS V V pF V µs Vpp Vpp Resonance capacitor POR voltage (high) MONOFLOP delay Min. voltage of clock extractor 1 (note 4) VDD rising Vcoil1-coil2 (min for extraction) Vcoil1-coil2 (min for extraction) Min. voltage of clock extractor 2 (note 5) Note 1: Max. supply voltage (not regulated) is defined by forcing a DC current 10 mAp in pins COIL1-COIL2 Note 2: The circuit is not functional under low level POR voltage Note 3: Based on 1000 hours measurement at 150oC Note 4: Uplink Note 5: downlink Copyright © 2005, EM Microelectronic-Marin SA 3 www.emmicroelectronic.com EM4056 Timing Characteristics Parameter Emission Bit Period Symbol Tb0 Tb1 Tab Reception Bit Period Reception Bit Period Arbitration Select processing time Read processing time Write processing time Arb1 processing time Arb2 processing time Arbitration format duration Read Rom format duration Select format duration Prot format duration Read format duration Write format duration Comp format duration Login format duration EEPROM Write duration Tbit Tbitarb Tsp Trp Twp Ta1p Ta2p Tarb Tro Ts Tp Tr Tw Tc Tl Tee VDD = 3V Conditions Modulation duration Bit 0 Bit 1 Start bit 8 Typ ON OFF ON 26 36 16 64 32 190 126 3134 62 10 115 24.5 19.1 32.2 20.3 36.6 16.6 35.1 20.0 8 8 8 RF periods RF periods RF periods RF periods RF periods RF periods RF periods ms Units RF periods Functional Description General The EM4056 has a read enable bit (RdEn) realised with a flip-flop cell. If the RdEn bit is set to « 0 », the transponder is always allowed to answer otherwise it answers only on special commands. At power on, the default value of the RdEn bit is 0. Therefore, after switching the field on, the RdEn bit of all known tags may be set by the reader in order to separate them in two groups. The block check sequence uses a 8 bits CRC which is the same polynom for all CRC blocks. In addition, the CRC block from the EM4056 to the reader is sent in the format of the BitVal frame (see arbitration mode) to increase the error detection rate in the reader. Memory organisation Address Bit 17 0000000 0000010 Read Prot Write Prot Bit 0 is defined as the first bit output 1 LASER ROM (3 * 18) Bit 0 EEPROM (123 * 18) 1111110 1111111 Configuration Word PIN Word Config Word definition + Laser Rom area definition Fig.4 The Read Protected and the Write Protected bit are OTP bit. Once written to one, it is definitively locked. No possibility to erase them to zero. Copyright © 2005, EM Microelectronic-Marin SA 4 www.emmicroelectronic.com EM4056 ROM organisation Address 0000000 0000001 0000010 bit17 B15 B31 L7 Datas bit2 B0 B16 C0 Wp bit1 1 1 1 Rp bit0 0 0 0 L0 C7 B31-B0 unique code number. L7-L0 8-bit customer ID, standard version = 65hex, 101dec. C7 – C0 CRC calculated on bits B31 to B0 and L7 to L0. (CRC block diagram see figure 4). Note : EM4056 with different customer ID will also have a different unique code number. Commands structure Command ReadRom SelToggle SelTag DeselTag Prot Read Write Add Comp Start Arbitration Continue if “0” Continue if “1” Abort Arbitration Code 0010 LSB 0100 0101 0110 1000 1010 1100 1101 1110 0001 00 11 01 or 10 MSB CRC Block Diagram 7 MSB X7 65 X5 4 X4 321 X1 0 LSB X0=1 Data Input Exclusive OR X Shift Register CRC Generating polynomial = X7+X5+X4+X+1 Fig. 5 In uplink the CRC is calculated on all bits of the command (startbit excluded), MSB first. In dowlink the CRC is calculated on all bits of the answer, first bit sent by the chip first. Copyright © 2005, EM Microelectronic-Marin SA 5 www.emmicroelectronic.com EM4056 ReadRom A ReadRomEn command enables only transponders in the field with RdEn bit set to « 0 » to answer. With this command, the address of a single new tag entered in the field can be detected because all known transponders are not allowed to answer if they are deactivated by the RdEn bit (RdEn=1). If more than one transponder answer a CRC error will be detected and it becomes necessary to perform an arbitration to find all new transponder addresses. The command is faster than a full arbitration cycle for new tags. The ReadRomEn command frame consists of three blocks and has a constant length of 13 bits. The Start bit allows the transponder to synchronise to the new command frame. After the Start bit, the frame contains four bits for the Command. A CRC block of 8 bits is calculated over the Command and appended to the end. The transponder frame has a length of 40 bits and starts with the 32 bits ROM block. A CRC block of 8 bits is calculated over the transponder address (ROM) and appended to the end. 1 bit Reader Start 4 bits MSB ReadRom 8 bits X8 CRC 32 bits MSB ROM 8 bits X8 CRC Fig. 6 Transponder tsp SelToggle A SelToggle command addresses a transponder and toggles the RdEn bit (0→1 or 1→0). The transponder returns a frame with the changed value of RdEn bit followed by a CRC. The SelToggle command frame consists of four blocks and has a constant length of 45 bits. The Start bit allows the transponder to synchronise to the new command frame. After the Start bit the frame contains four bits for the Command. Next to the Command, a sequence of 32 bits follows with the transponder address. A CRC block of 8 bits is calculated over the Command and the transponder address and appended to the end. The transponder frame has a length of 10 bits and starts with the RdEn bit and the "not RdEn" bit. A CRC block of 8 bits is calculated over the RdEn and the "not RdEn" and appended to the end. 1 bit Reader Start 4 bits MSB SelToggle 32 bits MSB ROM 8 bits X8 CRC 2 bits 8 bits X8 CRC Fig. 7 Transponder tsp RdEn nRdEn SelTag The SelTag command address a transponder with its 32 bit address (ROM) and set the flag Select to 1. After this command, the selected transponder can answer to commands : Read, Write, Prot, Add, Comp and Login. 1 bit Reader Start 4 bits MSB SelTag 32 bits MSB ROM 8 bits X8 CRC 2 bits 8 bits X8 CRC Fig. 8 Transponder tsp Sel nSel Copyright © 2005, EM Microelectronic-Marin SA 6 www.emmicroelectronic.com EM4056 DeselTag The DeselTag command address a transponder with its 32 bit address (ROM) and reset the flag Select to 0. 1 bit Reader Start 4 bits MSB DeselTag 32 bits MSB ROM 8 bits X8 CRC 2 bits X8 Transponder tsp Sel nSel CRC Fig. 9 8 bits Prot Prot command for writing the 2 (OTP) protection bit (read and write) at the specified address. 1 bit Reader Start 4 bits MSB Prot 8 bits MSB Address 2 bits MSB Wp/Rp 8 bits X8 CRC 2 bits Transponder twp WOk nWOk 8 bits X8 CRC Fig. 10 Wp=1, the specified address is protected against writing. Rp=1, the specified address is protected against reading. WOk=1, the protection bit has been successfully written to one. Read Read command to get a 16-bit word located at the specified address. If the address is read protected, the circuit transmits a 65535 value. 1 bit Reader Start 4 bits MSB Read 8 bits MSB Address 8 bits X8 CRC 16 bits 3 bits 8 bits MSB X8 trp Datas Prot CRC Prot = (Wp / Rp / Suc) Fig. 11 Transponder Datas 12345 dec 65535 dec 65535 dec 65535 dec Rp 0 0 1 0 Suc 0 0 x 1 Definition Data = 12345 Data = 65535 Read protected Read protected by PIN Wp=1, the specified address is protected against writing. Rp=1, the specified address is protected against reading. Suc=1, the specified address is protected by the PIN against reading. Copyright © 2005, EM Microelectronic-Marin SA 7 www.emmicroelectronic.com EM4056 Write Write command for 16 bits of data at the specified address. 1 bit Reader Start 4 bits MSB Write 8 bits MSB Address 16 bits MSB Datas 8 bits X8 CRC 2 bits Transponder twp WOk nWOk 8 bits X8 CRC Fig. 12 WOk=1, the write operation has been successfully executed. When a word is written at the address (Adr 126), where the configuration is located this command is restricted to write the uppermost data (Dat_15 à Dat_4), the lower address (Dat_3 to Dat_0) being reserved for safeguarding the PIN counter. The data at the address of the configuration are: 15 Z_Suc[2:0] 0 M_Suc No_Ant Sec Conf[2:0] NU NU NU Alm Pin[2:0] Fig. 13 where : • M_suc : selects a internal mode for which no reading nor writing can extract or engrave valid data into the area of the memory presently protected by the PIN code. M_suc=1, area of memory is protected by PIN. • Z_suc[2 :0] : determines the address area which is protected by the PIN code. (0% [000], 25%[100], 50%[101], 75 %[110] or 100%[111]). Z_suc[2:0] 000 100 101 110 111 • • • • • Area protected 00 % 25 % 50 % 75 % 100 % Addresses protected None, incl. PIN Word 127 – Word 96 Word 95 – Word 64 Word 63 – Word 32 Word 31 – Word 0 No_Ant : selects the bit "Egal_ROM" and disables the anticollision mode. No_Ant=1, no anticollision, the tag is always selected (Sel=1). Sec=1, enables the counter of false attempts for the password (PIN). Sec=0, counter is disabled. Conf[2 :0] : represents the maximum number of attempts for finding a valid PIN before definitive lock of the card for writing. Pin[2 :0] : represents the number of remaining attempts for finding the correct PIN. Alm : alarm bit indicates a permanent lock of the card against write attempts. This bit is activated as soon as the number of PIN erroneous introduction is surpassed. Copyright © 2005, EM Microelectronic-Marin SA 8 www.emmicroelectronic.com EM4056 Add Add command to add one 16-bit data word to another 16-bit data word pointed by the specified address, this command writes the sum at the specified address. It is possible to add a value to an already protected memory location that has been protected against reading, but not to a memory location that has been protected against writing attempts. 1 bit Reader Start 4 bits MSB Add 8 bits MSB Address 16 bits MSB Datas 8 bits X8 CRC 2 bits 8 bits X8 CRC Fig. 14 Transponder twp WOk nWOk Comp Compares a 16 bits data word with another word pointed by the specified address. It is possible to perform a comparison with a value pointed by a read protected address. But it is impossible to compare a value with another one in the opaque area without entering the PIN. In the case of PIN violation, the result of the comparison is always false. Ega=1, comparison successful. 1 bit Reader Start 4 bits MSB Comp 8 bits MSB Address 16 bits MSB Datas 8 bits X8 CRC 2 bits 8 bits X8 CRC Fig. 15 Transponder trp Ega nEga Login Compares a 16 bit data word with the PIN word at the address 127. When a PIN comparison is made (Adr 127) and the identity is established, a write operation occurs in the EEPROM, PIN = CONF , the success bit is released (SUC = 0), the PIN counter is decremented (PIN = PIN - 1) and the corresponding new value is written in the EEPROM. After n erroneous attempts (PIN=0), the ALM bit is set (ALM = 1), and written in the EEPROM. Since that moment the entire memory is irreversibly locked. The unprotected data words (Rp=0) remain accessible for reading the information they are containing. 1 bit Reader Start 4 bits 16 bits 8 bits MSB LSB MSB LSB X8 1 Login Datas CRC 4 bits Transponder twp Ega nEga WOk nWOk 8 bits X8 1 CRC Fig. 16 Ega=1, password ok. Wok=1, writing operation successful. Copyright © 2005, EM Microelectronic-Marin SA 9 www.emmicroelectronic.com EM4056 Arbitration commands The arbitration mode is a sophisticated command avoiding collisions among transponders. The arbitration method is based on the method of multiprocessor bus arbitration. This feature allows the identification of a transponder out of a group, even if they entered the electromagnetic field at the same time. At each arbitration, the reader detects one address of a new transponder. The arbitration session starts with a special StartArbitration command. If the RdEn bit of the transponder is « 0 », then the transponder belongs to the active group. The arbitration commands will only act on the transponders of the active group. StartArbitration After the Start bit, the reader sends a command field which indicates the beginning of an arbitration cycle. An 8 bits CRC block calculated over the StartArbitration command completes this information. The transponder returns the first BitVal frame corresponding to the LSB of its 32 bits addresses. Start of arbitration 1 bit Reader Start Transponder 4 bits MSB Start_Arbit 8 bits MSB CRC ta1p 2 bits MSB Start Continue ta2p Fig. 17 1 bit 6 bits Bit0 Bit0 X X Bit1 Bit1 LSB ROM BitVal Frame The BitVal frame consists of 6 bits. If the Nth bit of its address is logic « 0 », the transponder sends two « 0 » at the position Bit0. If the Nth bit of its address is logic « 1 », the transponder sends two « 0 » at the positions Bit1. The bit repetition increases the transmission reliability. The response value of the different transponders is coded with the time position of the answer. Therefore no answer conflicts are generated. Note: Reception Bit Period is 32 RFclocks for all the arbitration (BitVal frame and CRC). BitVal frame Bit0 Bit0 32 Rf period X X Bit1 Bit1 BitVal = 0 0 0 X X X X BitVal = 1 X X X X 0 0 Fig. 18 Copyright © 2005, EM Microelectronic-Marin SA 10 www.emmicroelectronic.com EM4056 Continue command After receiving the BitVal frame from the different transponders in the field the reader decides whether the tags with « 0 » or « 1 » should continue the arbitration process and communicates this with the Continue frame. The transponders whose last BitVal was not identical with the confirmation in the Continue frame stop the arbitration process and wait for a new command. Arbitration in progress 1 bit Reader Start 2 bits MSB Continue 6 bits Bit0 Bit0 X X Bit1 Bit1 nth BitVal ta2p 2 bits MSB Start Continue 6 bits Bit0 Bit0 X X Bit1 Bit1 n+1th BitVal 1 bit Transponder ta1p ta1p Fig. 19 When the Continue frame of the 32nd bit is processed, only one transponder is left. This new identified tag sets the RdEn bit to 1 and belongs no longer to the active group. The arbitration cycle is completed by a transponder frame for selective commands (RdEn,CRC). The CRC is calculated like a transponder frame for general commands. This means the CRC is calculated over ROM and RdEn of the transponder in order to increase the reliability of the arbitration. End of arbitration 1 bit Reader Start 2 bits MSB Continue 6 bits Bit0 Bit0 X X Bit1 Bit1 32th BitVal 2 bits MSB Start Continue 8 bits MSB CRC 1 bit Transponder ta1p ta2p ta1p Fig. 20 To identify the address of a transponder, it takes 115 ms (including overhead as mentioned before). That makes it possible to detect about 8.7 new transponders per second, independent of the number of transponders in the electromagnetic field. Copyright © 2005, EM Microelectronic-Marin SA 11 www.emmicroelectronic.com EM4056 Example of Arbitration protocol * Read ROM No CRC error ? Yes Reset flag Read next bit (from LSB to MSB) Yes 0 and 1 ? No Set flag Yes 0? No Chosen bit: 0 Chosen bit: 0 Chosen bit: 1 No MSB ? Yes Chosen bit: 1 No Flag set ? Yes All tags are identified *patented by Biel School of Negineering, MicroLab I3S Fig. 21 Copyright © 2005, EM Microelectronic-Marin SA 12 www.emmicroelectronic.com EM4056 Pad Assignment Pin 1 2 3 4 5 6 7 8 Name C1 VPOS VDD VSS TEST C2 Description coil connection unregulated positive supply positive supply 7 2607 6 169 5 4 3 Pad Location TEST_CLK test pad with pull down 1673 2 1850 TEST_OUT test pad output negative supply test pad with pull down coil connection 409 1955 3175 7 EM4056 8 1 151 666 525 Y 2159 X C1, C2 pad size : 200 X 600 Other pads size : 100 X 100 All dimensions in µm Fig. 22 Package Information CID Package FRONT VIEW PCB Package Y Z J K TOP VIEW B D MARKING AREA A R e C2 C1 SYMBOL A B D e F g J K R MIN 8.2 3.8 5.8 0.38 1.25 0.3 0.42 0.115 0.4 TYP 8.5 4.0 6.0 0.5 1.3 0.4 0.44 0.127 0.5 MAX 8.8 4.2 6.2 0.62 1.35 0.5 0.46 0.139 0.6 X Dimensions are in mm SYMBOL X Y Z C2 MIN C1 TYP 8.0 4.0 MAX 1.0 F g F Dimensions are in mm Fig. 23 Fig. 24 Copyright © 2005, EM Microelectronic-Marin SA 13 www.emmicroelectronic.com EM4056 Ordering Information Part Number EM4056B6WW11E EM4056B6WP11 EM4056B6CI2LC EM4056B6CB2RC Bit coding Bi-phase Bi-phase Bi-phase Bi-phase Cycle/ bit 64 64 64 64 Package / Die Form Unsawn wafer, 11mils thickness Die in waffle pack, 11mils thickness CID package, 2 pins (length = 2.5mm) PCB package, 2 pins Delivery Form / Bumping With gold bumps No bumps Bulk Bulk For other packages, please contact EM Microelectronic-Marin SA Product Support Check our Web Site under Products/RF Identification section. Questions can be sent to cid@emmicroelectronic. com EM Microelectronic-Marin SA (EM) makes no warranty for the use of its products, other than those expressly contained in the Company's standard warranty which is detailed in EM's General Terms of Sale located on the Company's web site. EM assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of EM are granted in connection with the sale of EM products, expressly or by implications. EM's products are not authorized for use as components in life support devices or systems. © EM Microelectronic-Marin SA, 04/05, Rev. E Copyright © 2005, EM Microelectronic-Marin SA 14 www.emmicroelectronic.com