NTP53x2
2
NTAG 5 link - NFC Forum-compliant I C bridge
Rev. 3.3 — 3 July 2020
544533
General description
Optimized for sensor-driven applications, this highly integrated NFC IC creates a secure,
standard-based link from the device to the cloud, in a future proof way to address and
even power sensors.
NTAG 5 link is available in two different variants (see Section 4). NTP5332 supports all
2
features of NTP5312, and on top of these, it offers also I C master features, as well as
AES mutual authentication.
NXP's NTAG 5 link lets designers of sensor-equipped systems add an NFC interface
2
with a wired host interface that’s configurable as an I C master/slave, a pulse width
modulator (PWM), or a general-purpose I/O (GPIO). Operating at 13.56 MHz, it is an
NFC Forum-compliant Type 5 Tag (customer development board is NFC Forum certified
- Certification ID: 58626) that can be read and written by an NFC-enabled device at close
range and by an ISO/IEC 15693-enabled industrial reader over a longer range.
ISO/IEC 15693
1
Product data sheet
COMPANY PUBLIC
l 2C
SRAM
1
0
1
EEPROM
TRANSPARENT I2C MASTER CHANNEL
0
1
0
MCU
e.g
T SENSOR
energy harvesting
data
data
event detection
energy
energy
aaa-034224
Figure 1. NTAG 5 link overview
2
The NTAG 5 link can act as a direct bridge between an NFC-enabled device and any I C
slave, such as a sensor or external memory. This is especially useful in environments
that require zero-power, single-shot measurements.
With NTAG 5 link, the device can connect to the cloud with a single tap. The connection
uses an NFC Forum-compliant data exchange mechanism involving SRAM to ensure
highly interoperable data transfers.
Support for ISO/IEC 15693 lets the NTAG 5 link communicate securely in two ways: with
powerful industrial readers, at a range of up to 60 cm and with NFC-enabled devices
in proximity range. This duality makes it possible for the device to be calibrated and
parameterized automatically while in the factory and then, when put to be used in the
field, safely communicate with contactless devices such as mobile phones.
NTAG 5 link offers 2048 bytes (16384 bits) bytes of memory which can be divided
into three areas, and each area can use a different protection level, varying from no
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
protection to 32-/64-bit password-protected read/write access or up to 128-bit-AES
mutual authentication protected read/write access.
The NTAG 5 link comes with pre-programmed proof-of-origin functionality to verify
authenticity. The ECC-based originality signature can be reprogrammed or locked by the
customer.
The NTAG 5 link can operate without a battery by drawing power from the NFC reader
instead. It supports energy harvesting, which means it can be used to supply power to
other components in the system. When sufficient energy is available, NTAG 5 link can
supply a fixed, configurable voltage level to ensure a stable overall system.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
2 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
Features and benefits
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
NTP53x2
Product data sheet
COMPANY PUBLIC
Reading distance with long-range reader > 60 cm (> 25 inches)
2
Zero-power readout of an I C sensor
Adjustable security levels up to mutual AES authentication (NTP5332 only)
Flexible split between three open and/or protected memory areas
Ensured authenticity of product through value chain
Interoperable data exchange according to NFC Forum standards
Energy-efficient design with reduced bill of material
Interoperable and high performance NFC interface
– ISO/IEC 15693 and NFC Forum Type 5 Tag compliant
– 64-bit Unique IDentifier
Reliable and robust memory
– 2048 bytes (16384 bits) user EEPROM on top of configuration memory
– 256 bytes (2048 bits) SRAM for frequently changing data and pass-through mode
– 40 years data retention
– Write endurance of 1 000 000 cycles
Configurable contact interface
2
– I C slave standard (100 kHz) and fast (400 kHz) mode
2
– NTP5332 offers a Transparent I C master channel (for example, read sensors
without an MCU)
– One configurable event detection pin
2
– Two GPIOs as multiplexed I C lines
– Two Pulse Width Modulation (PWM) channels as multiplexed GPIOs and/or ED pin
– 1.62 V to 5.5 V supply voltage
Scalable security for access and data protection
– Disable NFC interface temporarily
2
– Disable I C interface temporarily
– NFC PRIVACY mode
– Read-only protection as defined in NFC Forum Type 5 Tag Specification
– Full, read-only, or no memory access based on 32-bit password from both interfaces
– Optional 64-bit password protection from NFC perspective
– 128-bit AES authentication as defined in ISO/IEC 15693 for NTP5332
– ECC-based reprogrammable originality signature
Multiple fast data transfer mode
– Pass-through mode with 256 byte SRAM buffer
– Standardized data transfer mode (PHDC, TNEP)
Low-power budget application support
– Energy harvesting with configurable output voltage up to 30 mW
– Low-power standby current typically 0.6 mA
010b
>1.4 mA
RFU
6
NTP53x2
Value
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
36 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Bit
Name
Value
Description
011b
>2.7 mA
100b
>4.0 mA
101b
>6.5 mA
110b
>9.0 mA
111b
>12.5 mA
5
4
DISABLE_
POWER_CHECK
3
2
EH_VOUT_V_SEL
1
0
EH_ENABLE
0b
Only if sufficient power can be harvested, VOUT
will be enabled (default)
1b
Power level will not be checked, VOUT will be
enabled immediately after startup
00b
1.8 V (Default)
01b
2.4 V
10b
3V
11b
RFU
0b
Energy harvesting disabled (default)
1b
Energy harvesting enabled
8.1.3.19 Event detection pin configuration settings
Event detection and field detection functionality define the behavior of the active low ED
pin depending on various events. As this pin is an open-drain active low implementation,
ED pin state ON means that signal is LOW and OFF means that signal is HIGH. More
details can be found in ED section (see Section 8.3.2).
Table 54. Event Detection Configuration Location (ED_CONFIG)
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
3Dh
103Dh
EH_CONFIG
RFU
ED_CONFIG
RFU
Table 55. Event Detection Configuration Register Location (ED_CONFIG_REG)
Block Address
NFC
I C
2
Byte 0
Byte 1
A8h
10A8h
ED_COFIG_REG
Byte 2
Byte 3
RFU
Table 56. Event Detection Definition (ED_CONFIG and ED_CONFIG_REG)
Bit
Name
Value
ED pin
state
7 to 4
RFU
0000b
N/A
3 to 0
Disable ED
0000b
OFF
Event detection pin disabled (default)
NFC Field detect
0001b
ON
NFC field present
OFF
NFC field absent
NTP53x2
Product data sheet
COMPANY PUBLIC
Description
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
37 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Bit
Name
Value
PWM
0010b
2
I C to NFC pass-through
2
NFC to I C pass-through
ED pin
state
ON
Pulse width modulation signal during OFF period
OFF
Pulse width modulation signal during On period
ON
Last byte of SRAM data has been read via NFC; host
can access SRAM again
OFF
• Last byte written by I C, or
• NFC off, or
• VCC is off
ON
Last byte written by NFC; host can read data from
SRAM
OFF
• Last byte has been read from I C, or
• NFC off, or
• VCC off
ON
Arbiter locked access to NFC interface
OFF
Lock to NFC interface released
ON
Length byte(block 1, byte 1) is not ZERO
OFF
Length byte (block 1, byte1) is ZERO
ON
IC is NOT in standby mode
OFF
IC is in standby mode
ON
Start of programming cycle during WRITE command
OFF
Start of response to WRITE command or NFC off
ON
Start of read cycle during READ command
OFF
• End of read access, or
• NFC off
ON
Start of (any) command
OFF
• End of response to command, or
• NFC off
ON
Data read from SYNCH_BLOCK
OFF
Event needs to be cleared by setting b0 of ED_
RESET_REG to 1b or NFC off
ON
Data written to SYNCH_BLOCK
OFF
Event needs to be cleared by setting b0 of ED_
RESET_REG to 1b or NFC off
ON
1101b written to ED_CONFIG
OFF
Event needs to be cleared by setting b0 of ED_
RESET_REG to 1b
2
0011b
2
0100b
Arbiter lock
0101b
NDEF Message TLV
Length
0110b
Stand-by mode
0111b
WRITE command
indication
1000b
READ command
indication
1001b
Start of command
indication
1010b
READ from SYNCH_
BLOCK
1011b
WRITE to SYNCH_
BLOCK
1100b
Software Interrupt
1101b
RFU
1110b
N/A
RFU
1111b
N/A
NTP53x2
Product data sheet
COMPANY PUBLIC
Description
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
38 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 57. Event Detection Clear Register Location (ED_INTR_CLEAR_REG)
Block Address
NFC
I C
2
Byte 0
Byte 1
ABh
10ABh
ED_INTR_
CLEAR_REG
Byte 2
Byte 3
RFU
Table 58. Event Detection Clear Register (ED_INTR_CLEAR_REG)
Bit
7 to 1
0
Name
Value
RFU
all 0b
ED_INTR_CLEAR
Description
1b
write 1b to release ED pin
ED pin is cleared i.e. released when writing 01h to the ED clear register. The bit gets
automatically cleared after clearing the ED pin.
2
8.1.3.20 I C slave configuration settings
2
I C slave functionality can be configured with the following configuration registers from
both interfaces.
2
Table 59. I C Slave Configuration Location
Block Address
Byte 0
Byte 1
Byte 2
Byte 3
I2C_SLAVE_ADDR
I2C_SLAVE_CONFIG
I2C_MASTER_
SCL_LOW
I2C_MASTER_
SCL_HIGH
2
NFC
I C
3Eh
103Eh
2
Table 60. I C Slave Configuration Definition (I2C_SLAVE_ADDR)
Bit
7
6 to 0
Name
Value
RFU
0b
I2C_SLAVE_ADDR
54h
Description
2
I C slave address used in slave configuration
2
Table 61. I C Slave Configuration Definition (I2C_SLAVE_CONFIG)
Bit
7 to 3
Name
Value
RFU
Description
00000b
0b
Slave does not reset if repeated start is received (Default)
1b
I C slave resets internal state machine on repeated start
2
I2C_S_REPEATED_START
1
RFU
0b
0
RFU
0b
2
2
8.1.3.21 I C master clock configuration settings
2
I C Master baud rate and SCL high and low can be configured by the related
configuration values.
2
Details about the formula can be found in I C master section.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
39 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
NOTE: I C master is only available for NTP5332.
2
Table 62. I C Master Clock Settings Configuration Location (I2C_MASTER_CONFIG)
Block Address
Byte 0
Byte 1
Byte 2
Byte 3
I2C_SLAVE_ADDR
I2C_SLAVE_CONFIG
I2C_MASTER_
SCL_LOW
I2C_MASTER_
SCL_HIGH
2
NFC
I C
3Eh
103Eh
2
Table 63. I C Master Clock Configuration Definition (I2C_MASTER_SCL_LOW)
Bit
Name
7
Default
Value
Description
RFU
6 to 0
09h
I2C_MASTER_SCL_LOW
2
I C master configuration SCL low period. Default: 400 kHz,
41%duty cycle.
2
Table 64. I C Master Clock Configuration Definition (I2C_MASTER_SCL_HIGH)
Bit
7
6 to 0
Name
Default
Value
Description
RFU
I2C_MASTER_SCL_HIGH
02h
2
I C master configuration SCL HIGH period. Default: 400
kHz, 41%duty cycle.
8.1.3.22 Device security configuration bytes
NTAG 5 link features scale-able security. The level of security can be selected with
DEV_SEC_CONFIG byte.
SRAM_CONF_PROT is described in Section 8.1.3.23.
PP_AREA_1 is described in Section 8.1.3.24.
Table 65. Device Security Configuration Byte location
Block Address
NFC
2
I C
Byte 0
Byte 1
Byte 2
3Fh
103Fh
DEV_SEC_CONFIG
SRAM_CONF_PROT
PP_AREA_1 (LSB)
Byte 3
PP_AREA_1 (MSB)
The IC security features can be enabled or disabled or can choose different security
options available from NFC perspective:
• AES authentication scheme
• Plain password feature
Table 66. Device Security Byte Definition (DEV_SEC_CONFIG)
Bit
7 to 5
NTP53x2
Product data sheet
COMPANY PUBLIC
Name
Security Lock
Value
Description
010b
block 3Fh with device security configuration bytes is locked
101b
block 3Fh is writeable (default)
other
RFU
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
40 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Bit
Name
4
Value
RFU
3
00b
2
NFC Security
1
Description
0
other
RFU
010b
AES (only applicable for NTP5332 - do NOT use for NTP5312)
101b
plain password (default)
8.1.3.23 SRAM and Configuration protection
Access to complete SRAM and blocks 37h to 54h of configuration area can be restricted
with SRAM_CONFIG_PROT byte.
Table 67. SRAM and Configuration Byte location
Block Address
NFC
2
I C
Byte 0
Byte 1
Byte 2
3Fh
103Fh
DEV_SEC_CONFIG
SRAM_CONF_PROT
PP_AREA_1 (LSB)
Byte 3
PP_AREA_1 (MSB)
Table 68. SRAM and Configuration Protection (SRAM_CONF_PROT)
Bit
7 to 6
5
4
Name
Value
RFU
00b
I2C_CONFIG_W
I2C_CONFIG_R
3
NFC_SRAM_W
2
NFC_SRAM_R
1
NFC_CONFIG_W
0
Description
NFC_CONFIG_R
2
0b
Configuration area is not write protected from I C perspective
(default)
1b
Configuration area is write protected from I C perspective
0b
Configuration area is not read protected from I C perspective
(Default)
1b
Configuration area is read protected from I C perspective
0b
SRAM is not write protected from NFC perspective (Default)
1b
SRAM is write protected from NFC perspective
0b
SRAM is not read protected from NFC perspective (Default)
1b
SRAM is read protected from NFC perspective
0b
Configuration area is not write protected from NFC perspective
(Default)
1b
Configuration area is write protected from NFC perspective
0b
Configuration area is not read protected from NFC perspective
(Default)
1b
Configuration area is read protected from NFC perspective
2
2
2
8.1.3.24 Restricted AREA_1 pointer
The AREA_1 Pointer (PP_AREA_1) can be configured by directly writing PP_AREA_1
byte to configuration memory using WRITE CONFIG command (see Section 8.2.3.2.2).
2
This 16-bit block address is the same for NFC and I C perspective. The default value is
FFFFh.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
41 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 69. Restricted AREA_1 Pointer location
Block Address
Byte 3
NFC
2
I C
Byte 0
Byte 1
Byte 2
3Fh
103Fh
DEV_SEC_CONFIG
SRAM_CONF_PROT
PP_AREA_1 (LSB)
PP_AREA_1 (MSB)
In below example, NFC protection pointer (NFC_PP_AREA_0H) is set to 50h and
PP_AREA_1 is set to 0060h, e.g. PP_AREA_1 (LSB) is 60h and PP_AREA_1 (MSB) is
00h. This example illustrates the view from NFC perspective.
2
From I C perspective Area 1 will be the same, however Area 0-L and Area 0-H may look
2
different depending on I C protection pointer.
Table 70. Memory organization example from NFC perspective
Block
Byte 0
Byte 1
Byte 2
Byte 3
Description
0000h
0001h
0002h
AREA_0-L
...
...
...
...
...
...
...
...
...
...
...
...
...
C0
C1
00h
PROT
004Fh
0050h
0051h
...
AREA_0-H
005Fh
0060h
0061h
...
AREA_1
01FEh
01FFh
Counter
8.1.3.25 Application Family Identifier
The Application Family Identifier (AFI) represents the type of application targeted by the
device and is used to extract from all the ICs present only the ICs meeting the required
application criteria.
AFI can be configured using WRITE AFI command (see Section 8.2.3.9.1) or directly
writing AFI byte to configuration memory using WRITE CONFIG command (see
Section 8.2.3.2.2).
Default value of AFI is 00h.
2
From I C perspective, this byte can be accessed with normal READ and WRITE
2
commands as long as not locked by I C section locks.
Table 71. Application Family Identifier (AFI) location
Block Address
NTP53x2
Product data sheet
COMPANY PUBLIC
NFC
I C
2
Byte 0
55h
1055h
AFI
Byte 1
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
Byte 2
Byte 3
RFU
© NXP B.V. 2020. All rights reserved.
42 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
8.1.3.26 Data Storage Format Identifier
The Data Storage Format Identifier may indicate how the data is structured in the VICC
memory. If not used, this byte shall be set to 00h, which is the default value.
The Data Storage Format Identifier (DSFID) can be configured using WRITE DSFID
command (see Section 8.2.3.9.3) or directly writing DSFID byte to configuration memory
using WRITE CONFIG command (see Section 8.2.3.2.2).
2
From I C perspective, this byte can be accessed with normal READ and WRITE
2
commands as long as not locked by I C section locks.
Table 72. Data Storage Format Identifier (DSFID) location
Block Address
NFC
I C
2
Byte 0
56h
1056h
DSFID
Byte 1
Byte 2
Byte 3
RFU
8.1.3.27 Electronic Article Surveillance ID
The Electronic Article Surveillance ID (EAS ID) can be configured using WRITE EAS
ID (see Section 8.2.3.9.10) command or directly writing EAS_ID byte to configuration
memory using WRITE CONFIG command (see Section 8.2.3.2.2).
Default value of EAS_ID is 0000h.
2
From I C perspective, this byte can be accessed with normal READ and WRITE
2
commands as long as not locked by I C section locks.
Table 73. Electronic Article Surveillance ID (EASID) location
Block Address
NFC
I C
2
Byte 0
Byte 1
57h
1057h
EAS_ID (LSB)
EAS_ID (MSB)
Byte 2
Byte 3
RFU
8.1.3.28 NFC protection pointer
The NFC protection pointer (NFC_PP_AREA_0H) can be configured using PROTECT
PAGE command (see Section 8.2.3.3.6) or directly writing NFC_PP_AREA_0H byte to
configuration memory using WRITE CONFIG command (see Section 8.2.3.2.2).
Default value is FFh.
Table 74. NFC Protection Pointer (NFC PP) location
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
58h
1058h
NFC_
PP_AREA_0H
NFC_PPC
RFU
RFU
In below example, NFC protection pointer is set to 50h. PP_AREA_1 is out side of the
EEPROM area in this example. This example illustrates the view from NFC perspective.
Table 75. Memory organization example
Block
Byte 0
Byte 1
Byte 2
0000h
NTP53x2
Product data sheet
COMPANY PUBLIC
Byte 3
Description
AREA_0-L
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
43 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Block
Byte 0
Byte 1
Byte 2
Byte 3
...
...
...
...
...
...
...
...
C0
C1
00h
PROT
Description
0001h
0002h
...
004Fh
0050h
0051h
...
AREA_0-H
01FEh
01FFh
Counter
8.1.3.29 NFC Protection Pointer Conditions
The NFC Protection Pointer Conditions (NFC PPC) can be configured using PROTECT
PAGE command (see Section 8.2.3.3.6) or directly writing NFC_PPC byte to
configuration memory using WRITE CONFIG command (see Section 8.2.3.2.2) as
defined in table below.
Table 76. NFC Protection Pointer Conditions (NFC_PPC) location
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
58h
1058h
NFC_PP_AREA_0H
NFC_PPC
RFU
RFU
Table 77. NFC Protection Pointer Configuration (NFC_PPC)
Bit
Name
Value
7
RFU
0b
6
RFU
0b
5
Write AREA_0_H
Read AREA_0_H
4
Description
0b
AREA_0-H is not write protected (Default)
1b
AREA_0-H is write protected
0b
AREA_0-H is not read protected (Default)
1b
AREA_0-H is read protected
3
RFU
0b
2
RFU
0b
Write AREA_0_L
0b
AREA_0-L is not write protected (Default)
1b
AREA_0-L is write protected
0b
AREA_0-L is not read protected (Default)
1b
AREA_0-L is read protected
1
Read AREA_0_L
0
8.1.3.30 NFC lock bytes
User blocks can be blocked from writing by the NFC interface. These bits are one time
programmable. Once written to 1b, they cannot be changed back to 0b. Each bit locks
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
44 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
one block of user memory area (e.g., bit 0 of byte 0 locks block 0).These bytes can be
2
written by NFC and I C. The access to these bytes for the particular interface can be
restricted by configuring the device SECTION_LOCK (see Table 80).
Table 78. NFC Lock Block Configuration location
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
6Ah
106Ah
NFC_LOCK_BL00
NFC_LOCK_BL01
RFU
RFU
...
...
...
...
RFU
RFU
89h
1089h
NFC_LOCK_BL62
NFC_LOCK_BL63
RFU
RFU
2
8.1.3.31 I C lock bytes
2
User blocks can be blocked from writing by the I C interface. These bits are one time
programmable. Once written 1b, they cannot be changed back to 0b. Each bit locks 4
blocks of user memory area (e.g., bit 0 of byte 0 locks blocks 0, 1, 2 and 3).These bytes
2
can be written by NFC and I C. The access to these bytes for the particular interface can
be restricted by configuring the device configuration section locks bytes (see Table 80).
2
I2C_LOCK_BL00 – bit 0 – will lock user blocks 0,1,2,3 from I C perspective.
2
Table 79. I C Lock Block Configuration location
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
8Ah
108Ah
I2C_LOCK_BL00
I2C_LOCK_BL01
RFU
RFU
...
...
...
...
RFU
RFU
91h
1091h
I2C_LOCK_BL14
I2C_LOCK_BL15
RFU
RFU
8.1.3.32 Device configuration section lock bytes
Lock bits are provided to lock different sections of the configuration area. 16 bits for
each interface are provided to define access conditions for different sections of the
configuration area.
First column in the configuration memory table (see Table 11) defines the affiliated blocks
of each section.
Table 80. Device configuration section lock bytes location
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
92h
1092h
NFC_LOCK_0
RFU
93h
1093h
NFC_LOCK_1
RFU
94h
1094h
I2C_LOCK_0
RFU
95h
1095h
I2C_LOCK_1
RFU
Byte 3
These section lock configurations are provided to allow customer to initialize NTAG 5 link
2
during customer configuration from either I C or NFC interface. After the configuration
is done, it is recommended to write the appropriate lock conditions and lock the device
configuration bytes.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
45 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
These lock bytes take the highest priority above all locks. Different section access
conditions have to be chosen appropriately, so that the other interface does not change
and corrupt the other interface security configuration.
If I2C_LOCK_0 and NFC_LOCK_0 bits are set to 1b, then the lock bytes cannot be
updated and gets locked permanently. If any interface is not locked i.e. any one of the
I2C_LOCK_0 and NFC_LOCK_0 bits are 0b, then the particular interface can unlock the
other.
Table 81. NFC configuration section lock byte 0 definition (NFC_SECTION_LOCK_0)
Bit
Name
7
Section 7
6
Section 6
5
Section 5
4
Section 4
3
Section 3
2
Section 2
1
Section 1
0
Section 0
Value
Description
0b
Section 7 is writable by NFC
1b
Section 7 is not writable by NFC
0b
Section 6 is writable by NFC
1b
Section 6 is not writable by NFC
0b
Section 5 is writable by NFC
1b
Section 5 is not writable by NFC
0b
Section 4 is writable by NFC
1b
Section 4 is not writable by NFC
0b
Section 3 is writable by NFC
1b
Section 3 is not writable by NFC
0b
Section 2 is writable by NFC
1b
Section 2 is not writable by NFC
0b
Section 1 is writable by NFC
1b
Section 1 is not writable by NFC
0b
Section 0 is writable by NFC
1b
Section 0 is not writable by NFC
Table 82. NFC configuration section lock Byte 1 definition (NFC_SECTION_LOCK_1)
Bit
NTP53x2
Product data sheet
COMPANY PUBLIC
Name
7
Section 8
6
Section 6
5
Section 5
4
Section 4
3
Section 3
2
Section 2
Value
Description
0b
Section 8 is writable by NFC
1b
Section 8 is not writeable by NFC
0b
Section 6 is readable by NFC
1b
Section 6 is not readable by NFC
0b
Section 5 is readable by NFC
1b
Section 5 is not readable by NFC
0b
Section 4 is readable by NFC
1b
Section 4 is not readable by NFC
0b
Section 3 is readable by NFC
1b
Section 3 is not readable by NFC
0b
Section 2 is readable by NFC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
46 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Bit
Name
1
Section 1
0
Section 0
Value
Description
1b
Section 2 is not readable by NFC
0b
Section 1 is readable by NFC
1b
Section 1 is not readable by NFC
0b
Section 0 is readable by NFC
1b
Section 0 is not readable by NFC
2
Table 83. I C configuration section lock byte 0 definition (I2C_SECTION_LOCK_0)
Bit
Name
7
Section 7
6
Section 6
5
Section 5
4
Section 4
3
Section 3
2
Section 2
1
Section 1
0
Section 0
Value
Description
2
0b
Section 7 is writable by I C
1b
Section 7 is not writable by I C
0b
Section 6 is writable by I C
1b
Section 6 is not writable by I C
0b
Section 5is writable by I C
1b
Section 5 is not writable by I C
0b
Section 4 is writable by I C
1b
Section 4 is not writable by I C
0b
Section 3 is writable by I C
1b
Section 3 is not writable by I C
0b
Section 2 is writable by I C
1b
Section 2 is not writable by I C
0b
Section 1 is writable by I C
1b
Section 1 is not writable by I C
0b
Section 0 is writable by I C
1b
Section 0 is not writable by I C
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
Table 84. I C configuration section lock byte 1 definition (I2C_SECTION_LOCK_1)
Bit
NTP53x2
Product data sheet
COMPANY PUBLIC
Name
7
Section 8
6
Section 6
5
Section 5
4
Section 4
3
Section 3
Value
Description
2
0b
Section 8 writable by I C
1b
Section 8 is not writeable by I C
0b
Section 6 is readable by I C
1b
Section 6 is not readable by I C
0b
Section 5is readable by I C
1b
Section 5 is not readable by I C
0b
Section 4 is readable by I C
1b
Section 4 is not readable by I C
0b
Section 3 is readable by I C
2
2
2
2
2
2
2
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
2
© NXP B.V. 2020. All rights reserved.
47 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Bit
Name
2
Section 2
1
Section 1
0
Section 0
Value
Description
2
1b
Section 3 is not readable by I C
0b
Section 2 is readable by I C
1b
Section 2 is not readable by I C
0b
Section 1 is readable by I C
1b
Section 1 is not readable by I C
0b
Section 0 is readable by I C
1b
Section 0 is not readable by I C
2
2
2
2
2
2
Note: Section 7 (default SRAM content) and Section 8 (Device configuration lock bytes)
are always readable.
2
In case of not readable and/or not writeable, IC responds with an NACK from I C
perspective and with an error from NFC perspective, when trying to access locked
sections.
8.1.4 Session registers
After POR, the content of the configuration settings (see Section 8.1.3) is loaded
into the session register. The values of session registers can be changed during a
session. Change to session registers take effect immediately, but only for the current
communication session. After POR, the session registers values will again contain the
configuration register values as before.
To change the default behavior, changes to the related configuration bytes are needed,
but the related effect will only be visible after the next POR.
Session registers starting from block A3h until the end may be write protected with
LOCK_REGISTER bit.
2
Reading and writing the session registers via I C can only be done with READ
REGISTER and WRITE REGISTER commands.
Most of the parameters are defined in the configuration memory section.
Table 85. Session Register Location
Block Address
NFC
2
I C
A0h
10A0h
A1h
10A1h
A2h
10A2h
A3h
10A3h
NTP53x2
Product data sheet
COMPANY PUBLIC
Byte 0
Byte 1
Byte 2
STATUS_REG
Byte 3
RFU
Remark
Status
Register (see
Section 8.1.4.1)
Configuration (see
Section 8.1.4.2)
CONFIG_REG
SYNC_DATA_BLOCK_REG
RFU
Block
Address (see
Section 8.1.4.3)
PWM_GPIO_CONFIG_REG
RFU
PWM and GPIO
Configuration(see
Section 8.1.4.4)
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
48 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Block Address
2
Byte 0
Byte 1
Byte 2
Byte 3
Remark
NFC
I C
A4h
10A4h
PWM0_ON_OFF_REG
PWM1
Configuration (see
Section 8.1.4.5)
A5h
10A5h
PWM1_ON_OFF_REG
PWM1
Configuration (see
Section 8.1.4.5)
WDT_CONFIG_REG
RFU
Watch Dog Timer
Configuration (see
Section 8.1.4.6)
A6h
10A6h
A7h
10A7h
EH_CONFIG_REG
RFU
Energy Harvesting
Configuration (see
Section 8.1.4.7)
A8h
10A8h
ED_CONFIG_REG
RFU
Event detection
functionality (see
Section 8.1.4.8)
2
I2C_SLAVE_CONFIG_REG
I C Slave
Configuration (see
Section 8.1.4.9)
RFU
A9h
10A9h
AAh
10AAh
RESET_
GEN_REG
RFU
Reset
Register (see
Section 8.1.4.10)
ABh
10ABh
ED_INTR_
CLEAR_REG
RFU
Clear Event
Detection (see
Section 8.1.4.11)
RFU
I C Master
Configuration (see
Section 8.1.4.12)
ACh
10ACh
2
I2C_M_S_
ADD_REG
I2C_M_LEN_REG
RFU
2
I2C_M_
STATUS_REG
I C Master
Configuration (see
Section 8.1.4.12)
RFU
ADh
10ADh
AEh
10AEh
RFU
AFh
10AFh
RFU
8.1.4.1 Status register
Different status of NTAG 5 link can be known by reading status register. The status
register can be read by READ_CONFG.
Some of the registers may be cleared. Setting status bits to 1b is not possible at all.
Table 86. Status Register Location
Block Address
NTP53x2
Product data sheet
COMPANY PUBLIC
NFC
I C
2
Byte 0
Byte 1
A0h
10A0h
STATUS0_REG
STATUS1_REG
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
Byte 2
Byte 3
RFU
© NXP B.V. 2020. All rights reserved.
49 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 87. Status 0 Register
Bit
7
6
5
4
3
Access
Name
2
NFC
EEPROM_WR_BUSY
EEPROM_WR_ERROR
SRAM_DATA_READY
SYNCH_BLOCK_WRITE
SYNCH_BLOCK_READ
I C
R
Value
R
R/W
R/W
R
0b
EEPROM is not busy
1b
EEPROM is busy (programming cycle
ongoing)
0b
all data written successfully
1b
EEPROM write error happened. This bit
needs to be cleared.
0b
data not yet ready used in pass-through
mode
1b
data ready, used in pass-through mode
0b
data has NOT been written to SYNCH_
BLOCK
1b
data had been written to SYNCH_BLOCK
0b
data has NOT been read from SYNCH_
BLOCK
1b
data had been read from SYNCH_BLOCK
0b
I C to NFC pass-through direction
1b
NFC to I C pass-through direction
0b
VCC supply not present
1b
VCC supply available
0b
No NFC field present
1b
NFC field present
R
R
R/W
R
R/W
2
PT_TRANSFER_DIR
R
R
1
VCC_SUPPLY_OK
R
R
0
NFC_FIELD_OK
R
R
Description
2
2
Table 88. Status 1 Register
Bit
Access
Name
2
NFC
I C
7
VCC_BOOT_OK
R
R
6
NFC_BOOT_OK
R
R
5
RFU
R
R
4
GPIO1_IN_STATUS
R
R
3
GPIO0_IN_STATUS
R
R
NTP53x2
Product data sheet
COMPANY PUBLIC
Value
Description
0b
VCC boot not done
1b
VCC boot done
0b
NFC boot not done
1b
NFC boot done
0b
1b
0b
GPIO_1 input is LOW
1b
GPIO_1 input is HIGH
0b
GPIO_0 input is LOW
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
50 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Bit
Access
Name
2
NFC
I C
2
RFU
R
R
1
I2C_IF_LOCKED
R
R/W
0
NFC_IF_LOCKED
R
R
Value
Description
1b
GPIO_0 input is HIGH
0b
1b
2
0b
I C Interface not locked by arbiter
1b
Arbiter locked to I C
0b
NFC interface not locked by arbiter
1b
Arbiter locked to NFC
2
8.1.4.2 Configuration register
On POR all CONFIG bits (see Section 8.1.3.13) are copied to CONFIG_REG. Some
of these features may be changed with CONFIG_REG bits during a session. These
2
features are valid at once. Most of them are just read only from NFC and/or I C
perspective.
Table 89. Configuration Register Location (CONFIG_REG)
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
A1h
10A1h
CONFIG_0_REG
CONFIG_1_REG
CONFIG_2_REG
RFU
Table 90. Configuration Definition (CONFIG_0_REG)
Bit
Access
Name
2
NFC
I C
Value
Description
0b
SRAM copy on POR disabled
1b
SRAM copy on POR enabled
7
SRAM_COPY_EN
R
R
6
RFU
R
R
0b
NFC interface enabled
5
DISABLE_NFC
R
R/W
1b
NFC interface disabled, no response to
NFC commands
4
RFU
R
R
0b
3
RFU
R
R
0b
2
RFU
R
R
0b
1
RFU
R
R
0b
0
AUTO_STANDBY_MODE_EN
R
R/W
NTP53x2
Product data sheet
COMPANY PUBLIC
0b
0b
Normal Operation Mode
1b
IC enters standby mode after boot if there
is no RF field present automatically.
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
51 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 91. Configuration Definition (CONFIG_1_REG)
Bit
Name
Access
2
NFC acc.
I C acc.
Value
7
RFU
R
R
0b
6
RFU
R
R
0b
5
USE_CASE_CONF
R
R
4
3
ARBITER_MODE
R
R/W
2
1
SRAM_ENABLED
R
R
0
PT_TRANSFER_DIR
R
R/W
Description
2
00b
I C slave
01b
I C master
10b
GPIO/PWM
11b
All host interface functionality disabled and
pads are in 3-state mode
00b
Normal Mode
01b
SRAM mirror mode
10b
SRAM passes through mode
11b
SRAM PHDC mode
0b
SRAM is not accessible
1b
SRAM is accessible
0b
Data transfer direction is I C to NFC
1b
Data transfer direction is NFC to I C
2
2
2
Table 92. Configuration Definition (CONFIG_2_REG)
Bit
Name
Access
NFC acc.
Value
I C acc.
7
GPIO1_IN
R
R
6
5
GPIO0_IN
R
R
4
3
EXTENDED_COMMANDS_
SUPPORTED
R
R
2
LOCK_BLOCK_COMMAND_
SUPPORTED
R
R
1
GPIO1_SLEW_RATE
R
R
0
GPIO0_SLEW_RATE
R
R
NTP53x2
Product data sheet
COMPANY PUBLIC
Description
2
00b
Receiver disabled
01b
Plain input with weak pull-up
10b
Plain input
11b
Plain input with weak pull-down
00b
Receiver disabled
01b
Plain input with weak pull-up
10b
Plain input
11b
Plain input with weak pull-down
0b
Extended commands are disabled
1b
Extended commands are supported
0b
Lock block commands are disabled
1b
Lock block commands are supported
0b
Low-Speed GPIO
1b
High-Speed GPIO
0b
Low-Speed GPIO
1b
High-Speed GPIO
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
52 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
8.1.4.3 Synchronization block register
The terminator block maybe changed during one session from both interfaces (see
Section 8.1.3.14). Both interfaces do have read and write access.
8.1.4.4 Pulse Width Modulation and GPIO configuration register
These session register bytes define the various configurations for GPIO/PWM use case
(see Section 8.1.3.13). From NFC perspective IN_STATUS bits are read only, all others
2
maybe changed during a session. From I C perspective, all bits are read only. For details
refer to Section 8.3.3 and Section 8.3.4.
Table 93. PWM and GPIO Configuration Register Location (PWM_GPIO_CONFIG_REG)
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
A3h
10A3h
PWM_GPIO_
CONFIG_0_REG
PWM_CONFIG_
1_REG
Byte 3
RFU
Table 94. PWM and GPIO Configuration Register Definition (PWM_GPIO_CONFIG_0_REG)
Bit
Access
Name
Value
2
NFC acc.
I C acc.
7
SDA_GPIO1_OUT_STATUS
R/W
R
6
SCL_GPIO0_OUT_STATUS
R/W
R
5
SDA_GPIO1_SDA_IN_STATUS
R
R
4
SCL_GPIO0_IN_STATUS
R
R
3
SDA_GPIO1
R/W
R
2
SCL_GPIO0
R/W
R
1
SDA_GPIO1_PWM1
R/W
R
0
SCL_GPIO0_PWM0
R/W
R
NTP53x2
Product data sheet
COMPANY PUBLIC
Description
0b
Output status on pad is LOW
1b
Output status on pad is HIGH
0b
Output status on pad is LOW
1b
Output status on pad is HIGH
0b
1b
0b
1b
Input status
Input status
0b
Output
1b
Input
0b
Output
1b
Input
0b
GPIO
1b
PWM
0b
GPIO
1b
PWM
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
53 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 95. PWM and GPIO Configuration Register Definition (PWM_GPIO_CONFIG_1_REG)
Bit
7
6
5
4
Name
Access
Value
Description
2
NFC
Acc.
I C Acc.
PWM1_PRESCALE
R/W
R
00b
Pre-scalar configuration for PWM1 channel
PWM0_PRESCALE
R/W
R
00b
Pre-scalar configuration for PWM0 channel
00b
6-bit resolution
01b
8-bit resolution
10b
10-bit resolution
11b
12-bit resolution
00b
6-bit resolution
01b
8-bit resolution
10b
10-bit resolution
11b
12-bit resolution
3
PWM1_RESOLUTION_CONF
R/W
R
2
1
PWM0_RESOLUTION_CONF
R/W
R
0
8.1.4.5 Pulse Width Modulation duty cycle register
The PWM duty cycle maybe changed during one session from NFC perspective (see
Section 8.1.3.16).
2
2
As long as the I C slave use case is enabled, these settings can also be done from I C
perspective.
8.1.4.6 Watch Dog Timer register
Watch Dog Timer register settings are read only (see Section 8.1.3.17).
8.1.4.7 Energy harvesting register
Energy harvesting registers may be used to enable energy harvesting during one
NFC session. In this case, EH_ENABLE bit of EH_CONFIG byte in block 3Dh is set
to 0b. Required EH_VOUT_I_SEL and EH_VOUT_V_SEL need to be set in that
EH_CONFIG byte. Desired energy harvesting mode (EH_MODE) needs to be configured
in CONFIG_0 byte of block 37h. In case of energy harvesting is enabled already during
boot (EH_ENABLE bit of EH_CONFIG is 1b), or energy harvesting is not used at all, this
register byte gives no information.
Setting EH_TRIGGER to 1b is needed to trigger power detection.
Polling for bit EH_LOAD_OK should be used to check, if sufficient energy is available.
Only if EH_LOAD_OK = 1b, energy harvesting may be enabled via session registers by
writing 09h to this byte.
2
There is only read only access from I C perspective.
Details can be found in energy harvesting section (see Section 8.5).
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
54 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 96. Energy Harvesting Configuration Register Location (EH_CONFIG_REG)
Block Address
NFC
I C
2
Byte 0
Byte 1
A7h
10A7h
EH_COFIG_REG
Byte 2
Byte 3
RFU
Table 97. Energy Harvesting Register Value Definition EH_CONFIG_REG)
Access
Bit
7
6 to 4
3
2 to 1
0
Name
2
NFC
Acc.
I C Acc.
EH_LOAD_OK
R
R
RFU
R
R
EH_TRIGGER
R/W
RFU
EH_ENABLE
Value
0b
Field is not sufficient to provied configured
power on VOUT. Do not enable energy
harvesting.
1b
Minimum desired energy available.
VOUT may be enabled. As soon as
EH_ENABLE is set to 1b, this bit gets
cleared automatically.
0b
When reading, this byte this bit is RFU and
the value is undefined and may be 0b or
1b.
1b
When writing to this byte, this bit needs to
be set to 1b always
0b
Energy Harvesting disabled (default)
1b
Energy Harvesting enabled
R
R
R
R/W
R
Description
8.1.4.8 Event detection register
Event detection and field detection functionality define the behavior of the ED pin
depending on various events. Indicated event may be changed during one session from
both interfaces. More details can be found in ED section (see Section 8.3.2).
2
8.1.4.9 I C slave register settings
2
I C slave settings can be read out from both interfaces.
2
I C interface can be disabled via NFC interface only. Repeated start functionality can be
2
enabled via I C interface only.
2
Table 98. I C Slave Configuration Register Location
Block Address
NFC
I C
2
Byte 0
Byte 1
A9h
10A9h
I2C_SLAVE_
ADDR_REG
I2C_SLAVE_
CONFIG_REG
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
Byte 2
Byte 3
RFU
© NXP B.V. 2020. All rights reserved.
55 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
Table 99. I C Slave Configuration Definition (I2C_SLAVE_ADDR_REG)
Bit
7
6 to 0
Access
Name
NFC
I C
2
Value
R
R
0b
R
R
54h
RFU
2
I 2_SLAVE_ADDR
Description
2
I C slave address used in slave
configuration
2
Table 100. I C Slave Configuration Definition (I2C_SLAVE_CONFIG_REG)
Bit
7 to 5
4
Name
Access
Value
Description
2
NFC
I C
RFU
R
R
000b
I2C_WDT_EXPIRED
R
R
0b
WDTdid not expire in previous
transaction
1b
Previous transaction was not
successful. WDT expired. This bit
gets cleared automatically, when new
transaction is triggered.
3
I2C_SOFT_RESET
2
I2C_S_REPEATED_
START
1
RFU
0
DISABLE_I C (see
Section 8.3.1.1.6)
2
2
R/W
R/W
0b
Setting this bit to 1b, resets the I C
state machine and relases th SCL/
SDA lines. This bit gets cleared
automatically.
R
R/W
0b
Slave does not reset if repeated start is
received (Default)
1b
I C slave resets internal state machine
on repeated start
2
R
R
0b
R/W
R
0b
I C interface enabled (default)
1b
I C interface disabled
2
2
8.1.4.10 System reset generation
System reset can be generated by both the interfaces by writing to RESET_GEN_REG
register using WRITE CONFIG command (see Section 8.2.3.2.2). Writing E7h will trigger
the system reset. This byte gets automatically reset after the system reset.
Table 101. RESET_GEN_REG location
Block Address
NFC
I C
2
Byte 0
Byte 1
AAh
10AAh
RESET_GEN_REG
Byte 2
Byte 3
RFU
8.1.4.11 Clear event detection register
Event detection pin is cleared i.e. released when writing 01h to the Clear Event Detection
2
Register from NFC or I C interface. The bit gets cleared after releasing the ED pin
automatically. Other values are RFU.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
56 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 102. ED_INTR_CLEAR_REG location
Block Address
NFC
I C
2
Byte 0
Byte 1
ABh
10ABh
ED_INTR_
CLEAR_REG
Byte 2
Byte 3
RFU
2
8.1.4.12 I C master status registers
2
2
I C master status can be checked by reading I C master session register bits from NFC
2
perspective. There is no write access to these registers. Details can be found in I C
master section.
2
NOTE: In I C master mode there is no access to the registers from I²C perspective.
2
NOTE: I C master is only available for NTP5332.
2
Table 103. I C Master Configuration Register Location
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
ACh
10ACh
I2C_M_S_ADD_REG
I2C_M_LEN_REG
RFU
RFU
ADh
10ADh
I2C_M_STATUS_REG
2
RFU
2
Table 104. I C Slave Address used in I C master transaction (I2C_M_S_ADD_REG)
Bit
Name
7
Access
NFC
I C
R
R
I2C_M_RS_EN
6 to 0
Value
I2C_M_S_ADD
Description
2
R
R
0b
STOP condition generated at the end of
transaction
1b
no STOP condition generated
00h
I C slave of last addressed slave
2
2
Table 105. I C Master Data Length Definition (I2C_M_LEN_REG)
Bit
Name
7 to 0
Value
Description
all 0b
Codes the data length written to or read from I C slave during last
2
I C transaction. Data length in bytes is I2C_M_LEN_REG plus 1.
I2C_M_LEN_REG
2
2
Table 106. I C Master Status Definition (I2C_M_STATUS_REG)
Access
Bit
7 to 4
Name
RFU
3
I2C_M_WDT_EXPIRED
NTP53x2
Product data sheet
COMPANY PUBLIC
NFC
I C
2
Value
R
R
0000b
R
R
0b
WDT did not expire in last transaction
1b
WDT expired in last transaction. This bit resets
automatically, when new transaction is triggered.
Description
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
57 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Access
Bit
Name
2 to 1
NFC
I C
2
Value
R
R
00b
Reset value, automatically when new transaction
starts
01b
Address NAK
10b
Data NAK
11b
Transaction successful
0b
I C Master interface ready. No transaction ongoing
1b
I C Master interface busy. Transaction ongoing
I2C_M_TRANS_STATUS
0
R
I2C_M_BUSY
R
Description
2
2
8.1.5 SRAM
For frequently changing data, a volatile memory of 256 bytes with unlimited write
endurance is built in. The 256 bytes are mapped in a similar way as done in the
EEPROM, i.e., 256 bytes are seen as 64 pages of 4 bytes.
SRAM is only available when supplied by VCC and SRAM_ENABLE bit is set to 1b.
The SRAM can be mirrored in the User Memory from block 00h to 3Fh for access from
both interfaces as illustrated in the table below. This allows using NFC Forum read and
write commands to access the SRAM.
The lock block condition (e.g. user EEPROM blocks are set to read-only) is not valid for
the mirrored SRAM.
The access conditions (e.g. first blocks of user EEPROM are password protected) are
valid for the mirrored SRAM, too, for both interfaces.
The access conditions for READ SRAM and WRITE SRAM commands can be restricted
with SRAM_CONF_PROT security bits.
2
From I C perspective, SRAM is located in blocks 2000h to 203Fh and can be accessed
at any time without any protection.
NOTE: SRAM values are not initialized during boot and may have arbitrary data.
Table 107. SRAM mirroring
Block Address
Byte 0
Byte 1
Byte 2
Byte 3
:
:
NFC
I C
00h
0000h
01h
0001h
02h
0002h
03h
0003h
:
:
3Fh
003Fh
SRAM
40h
0040h
EEPROM
:
:
1FEh
01FEh
NTP53x2
Product data sheet
COMPANY PUBLIC
Description
2
SRAM
:
:
:
:
:
:
When SRAM is mirrored to
user memory, READ and
WRITE commands address
SRAM
From block 40h onwards,
READ and WRITE
commands always address
EEPROM
EEPROM
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
58 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Block Address
Byte 0
Byte 1
Byte 2
Byte 3
Description
C0
C1
00h
PROT
Counter
2
NFC
I C
1FFh
N/A
In the pass-through mode, READ and WRITE SRAM commands should be used to
transfer data between the two interfaces.
After POR the SRAM can be pre-loaded with default data (e.g. NDEF message)
depending on SRAM_COPY_ENABLE bit in CONFIG register. If SRAM_COPY_ENABLE
bit and SRAM_ENABLE both are set to 1b, then the copy feature will be triggered after
POR. The startup time depends upon the number of bytes (maximum 64) to be copied.
In the table below, an example is illustrated where 48 bytes are copied to the SRAM on
POR.
Table 108. SRAM mirroring with default content
Block
Byte 0
Byte 1
Byte 2
Byte 3
0
SRAM_DEF00
SRAM_DEF01
SRAM_DEF02
SRAM_DEF03
:
11
Description
...SRAM_DEF...
SRAM_DEF44
SRAM_DEF45
12
SRAM_DEF46
SRAM_DEF47
SRAM
:
:
:
:
63
SRAM
64
EEPROM
:
:
:
510
When SRAM is mirrored and
SRAM_COPY_BYTES is equal
to 30h, 48 bytes will be copied to
SRAM after POR automatically
Rest of mirrored SRAM will be
random data
:
From block 64 onwards again
EEPROM will be addressed
:
:
00h
PROT
EEPROM
511
C0
C1
Counter
Table 109. SRAM COPY BYTES (SRAM_COPY_BYTES)
Block Address
2
NFC
I C
3Ch
103Ch
Byte 0
Byte 1
WDT_CONFIG
Byte 2
Byte 3
WDT_ENABLE
SRAM_COPY_BYTES
Table 110. SRAM_COPY_BYTES Definition
Bit
Name
Description
7 to 6
RFU
RFU
5 to 0
SRAM_COPY_BYTES
6-bit length field. Defines the number of bytes (SRAM_COPY_BYTES + 1)
to be copied from CONFIG memory to SRAM at startup. Maximum is 3Fh.
Higher values are RFU. Default all bits are 0b.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
59 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 111. SRAM Default Content location
Block Address
Byte 0
Byte 1
Byte 2
Byte 3
SRAM_DEF00
SRAM_DEF01
SRAM_DEF02
SRAM_DEF03
2
NFC
I C
45h
1045h
...
...
54h
1054h
...SRAM_DEF...
SRAM_DEF60
SRAM_DEF61
SRAM_DEF62
SRAM_DEF63
8.2 NFC interface
The definition of the NFC interface is according to the ISO/IEC 15693 and NFC Forum
Type 5 Tag. The details of passive communication mode are described in Section 8.2.1.
Supported bitrates for different modes and communication directions are listed in tables
below.
Table 112. Bit rates from reader to tag
Mode
Condition
1.66 kbps
26 kbps
passive
NFC only
yes
yes
passive
VCC supplied
yes
yes
Table 113. Bit rates from tag to reader
Mode
Condition
6 kbps
26 kbps
53 kbps
passive
single subcarrier
yes
yes
yes
passive
dual subcarrier
yes
yes
no
8.2.1 Passive communication mode
Main uses cases for passive communication mode are Smart Metering, Home
automation and in the box configuration. With antenna sizes of Class 4 or bigger, energy
harvesting on the one side and long-distance read/write access to the EEPROM is
possible in a very efficient way.
8.2.2 State diagram and state transitions
The state diagram illustrates the different states and state transitions of NTAG 5 link.
The SELECTED SECURE state is only available for NTP5332, when AES security is
enabled.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
60 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
out of field
POWER-OFF
in field
SELECTED
SECURE
READY
QUIET
SELECTED
aaa-035481
Figure 6. State Machine and State Transitions
8.2.2.1 POWER-OFF state
8.2.2.1.1 State transitions from and to POWER-OFF state
If NFC field is switched off or below, HMIN NTAG 5 link goes to POWER-OFF state.
POWER-OFF state will be left to READY state no later than 1 ms after NTAG 5 link is
powered by an NFC field greater than HMIN.
NOTE: When loading default data to mirrored SRAM, start-up time, dependent on the
pre-loaded bytes, might be greater than 1 ms.
8.2.2.2 READY state
8.2.2.2.1 Transitions between READY and SELECTED state
Transition from READY to SELECTED state is done when
• receiving a SELECT command with a matching UID
8.2.2.2.2 Transitions between READY and QUIET state
Transition from READY to QUIET state is done when
• receiving a STAY QUIET command with a matching UID
• receiving a (FAST) INVENTORY READ command (extended mode) with Quiet_Flag
set
8.2.2.2.3 Transitions between READY and SELECTED SECURE state
Transition from READY to SELECTED SECURE state is done when
• mutual authentication with AUTHENTICATE command with a matching UID was
successful
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
61 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
8.2.2.2.4 Commands which stay in READY state
NTAG 5 link stays in READY state when
• receiving any other command where Select_Flag is not set
8.2.2.3 SELECTED state
8.2.2.3.1 Transitions between SELECTED and READY state
Transition from SELECTED to READY state is done by
• receiving a RESET TO READY command where Select_Flag is set
• receiving a SELECT command with a different UID
8.2.2.3.2 Transitions between SELECTED and QUIET state
Transition from SELECTED to QUIET state is done when
• receiving a STAY QUIET command with a matching UID
8.2.2.3.3 Transitions between SELECTED and SELECTED SECURE state
Transition from SELECTED to SELECTED SECURE state is done by
• mutual authentication with AUTHENTICATE command with Select_Flag set was
successful
8.2.2.3.4 Transitions between SELECTED and NFC PRIVACY mode
Transition from SELECTED to NFC PRIVACY mode is done by
• receiving an ENABLE NFC PRIVACY command
8.2.2.3.5 Commands which stay in SELECTED state
NTAG 5 link stays in SELECTED state when
• receiving any other command where Select_Flag is set
8.2.2.4 SELECTED SECURE state
8.2.2.4.1 Transitions between SELECTED SECURE and READY state
Transition from SELECTED SECURE to READY state is done by
•
•
•
•
receiving a RESET_TO_READY command where Select_Flag is set
receiving a SELECT command with a different UID
receiving a CHALLENGE command
receiving a new AUTHENTICATE command
8.2.2.4.2 Transitions between SELECTED SECURE and QUIET state
Transition from SELECTED to QUIET state is done when
• receiving a STAY QUIET command with a matching UID
8.2.2.4.3 Transitions between SELECTED SECURE and SELECTED state
Transition from SELECTED to SELECTED SECURE state is done by
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
62 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
• receiving a SELECT command with a matching UID
8.2.2.4.4 Commands which stay in SELECTED SECURE state
NTAG 5 link stays in SELECTED SECURE state when
• receiving READBUFFER command
• receiving any other command where Select_Flag is set
8.2.2.5 QUIET state
8.2.2.5.1 Transitions between QUIET and READY state
Transition from QUIET to READY state is done by
• receiving a RESET_TO_READY command
8.2.2.5.2 Transitions between QUIET and SELECTED state
Transition from QUIET to SELECTED state is done by
• receiving a SELECT command with a matching UID
8.2.2.5.3 Transitions between QUIET and SELECTED SECURE state
Transition from QUIET to SELECTED SECURE state is done when
• mutual authentication with AUTHENTICATE command with a matching UID was
successful
8.2.2.5.4 Commands which stay in QUIET state
NTAG 5 link stays in QUIET state when
• receiving any other command where Addressed_Flag is set AND Inventory_Flag is not
set
8.2.3 Command set
ISO/IEC 15693 mandatory commands are
• INVENTORY
• STAY QUIET
NFC Forum Type 5 Tag mandatory commands are
• READ SINGLE BLOCK
• WRITE SINGLE BLOCK
• LOCK SINGLE BLOCK
On top of those, all optional commands of ISO/IEC 15693 are implemented. Several
customer-specific commands are implemented to, e.g., improve overall transaction time.
These custom commands all use NXP manufacturer code 04h.
A complete list of all supported commands is given in below table.
Table 114. NFC command set supported by NTAG 5 link
Code ISO/IEC 15693 NFC Forum T5T
01h
Mandatory
NTP53x2
Product data sheet
COMPANY PUBLIC
Mandatory
Command name
INVENTORY (see ISO/IEC 15693 and Digital Protocol)
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
63 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Code ISO/IEC 15693 NFC Forum T5T
Command name
02h
Mandatory
Mandatory
STAY QUIET (see ISO/IEC 15693) and Type 5 Tag SLPV_REQ)
20h
Optional
Mandatory
READ SINGLE BLOCK (see ISO/IEC 15693 and Type 5 Tag READ_SINGLE_BLOCK_REQ)
21h
Optional
Mandatory in READ/WRITE
state
WRITE SINGLE BLOCK (see ISO/IEC 15693 and Type 5 Tag WRITE_SINGLE_BLOCK_REQ)
22h
Optional
Optional
LOCK BLOCK (see ISO/IEC 15693 and Type 5 Tag LOCK_SINGLE_BLOCK_REQ)
23h
Optional
Optional
READ MULTIPLE BLOCKS ( ISO/IEC 15693 and Type 5 Tag READ_MULTIPLE_BLOCK_REQ)
25h
Optional
Optional
SELECT (see ISO/IEC 15693 and Type 5 Tag - SELECT_REQ)
26h
Optional
Not defined
RESET TO READY (see ISO/IEC 15693)
27h
Optional
Not defined
WRITE AFI (see ISO/IEC 15693)
28h
Optional
Not defined
LOCK AFI (see ISO/IEC 15693)
29h
Optional
Not defined
WRITE DSFID (see ISO/IEC 15693)
2Ah
Optional
Not defined
LOCK DSFID (see ISO/IEC 15693)
2Bh
Optional
Not defined
GET SYSTEM INFORMATION (see ISO/IEC 15693)
2Ch
Optional
Not defined
GET MULTIPLE BLOCK SECURITY STATUS (see ISO/IEC
15693)
2Dh
Optional
Not defined
FAST READ MULTIPLE BLOCKS (see ISO/IEC 15693)
30h
Optional
Mandatory when supporting 2
byte addressing
EXTENDED READ SINGLE BLOCK (see ISO/IEC 15693 and
Type 5 Tag - EXTENDED_READ_SINGLE_BLOCK_REQ)
31h
Optional
Mandatory when supporting
2 byte addressing in READ/
WRITE state
EXTENDED WRITE SINGLE BLOCK (see ISO/IEC 15693 and
Type 5 Tag - EXTENDED_WRITE_SINGLE_BLOCK_REQ)
32h
Optional
Optional
EXTENDED LOCK BLOCK (see ISO/IEC 15693 and Type 5 Tag
- EXTENDED_LOCK_SINGLE_BLOCK_REQ)
33h
Optional
Optional
EXTENDED READ MULTIPLE BLOCK ( ISO/IEC 15693 and
Type 5 Tag - EXTENDED_READ_MULTIPLE_BLOCK_REQ)
35h
Optional
Not defined
AUTHENTICATE (see ISO/IEC 15693) is only available in AES
mode
39h
Optional
Not defined
CHALLENGE (see ISO/IEC 15693) is only available in AES
mode
3Ah
Optional
Not defined
READBUFFER (see ISO/IEC 15693) is only available in AES
mode
3Bh
Optional
Not defined
EXTENDED GET SYSTEM INFORMATION (see ISO/IEC
15693)
3Ch
Optional
Not defined
EXTENDED GET MULTIPLE BLOCK SECURITY STATUS (see
ISO/IEC 15693)
3Dh
Optional
Not defined
FAST EXTENDED READ MULTIPLE BLOCKS (see ISO/IEC
15693)
A0h
Custom
Not defined
INVENTORY READ (see Section 8.2.3.5.1)
A1h
Custom
Not defined
FAST INVENTORY READ (see Section 8.2.3.5.2)
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
64 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Code ISO/IEC 15693 NFC Forum T5T
Command name
A2h
Custom
Not defined
SET EAS (see Section 8.2.3.9.5)
A3h
Custom
Not defined
RESET EAS (see Section 8.2.3.9.6)
A4h
Custom
Not defined
LOCK EAS (see Section 8.2.3.9.7)
A5h
Custom
Not defined
EAS ALARM (see Section 8.2.3.9.8)
A6h
Custom
Not defined
PROTECT EAS/AFI (see Section 8.2.3.9.9)
A7h
Custom
Not defined
WRITE EAS ID (see Section 8.2.3.9.10)
ABh
Custom
Not defined
GET NXP SYSTEM INFORMATION (see Section 8.2.3.9.14)
B2h
Custom
Not defined
GET RANDOM NUMBER (see Section 8.2.3.3.1)
B3h
Custom
Not defined
SET PASSWORD (see Section 8.2.3.3.2)
B3h
Custom
Not defined
DISABLE NFC PRIVACY (see Section 8.2.3.3.10)
B4h
Custom
Not defined
WRITE PASSWORD (see Section 8.2.3.3.3)
B5h
Custom
Not defined
LOCK PASSWORD (see Section 8.2.3.3.4)
B6h
Custom
Not defined
PROTECT PAGE (see Section 8.2.3.3.6)
B7h
Custom
Not defined
LOCK PAGE PROTECTION CONDITION (see
Section 8.2.3.3.7)
B9h
Custom
Not defined
DESTROY (see Section 8.2.3.3.8)
BAh
Custom
Not defined
ENABLE NFC PRIVACY (see Section 8.2.3.3.9)
BBh
Custom
Not defined
64 BIT PASSWORD PROTECTION (see Section 8.2.3.3.5)
BDh
Custom
Not defined
READ SIGNATURE (see Section 8.2.3.7.1)
C0h
Custom
Not defined
READ CONFIGURATION (see Section 8.2.3.2.1)
C1h
Custom
Not defined
WRITE CONFIGURATION (see Section 8.2.3.2.2)
C2h
Custom
Not defined
PICK RANDOM UID (see Section 8.2.3.9.15)
D2h
Custom
Not defined
READ SRAM (see Section 8.2.3.6.1)
D3h
Custom
Not defined
WRITE SRAM (see Section 8.2.3.6.2)
D4h
Custom
Not defined
WRITE I2C (see Section 8.2.3.8.1)
D5h
Custom
Not defined
READ I2C (see Section 8.2.3.8.2)
All command/responses are sent/received in the request/response format as defined in
ISO/IEC 15693 and NFC Forum Type 5 Tag specification.
8.2.3.1 Commands for state transitions
Following commands are implemented for all possible state transitions according to ISO/
IEC 15693.
•
•
•
•
INVENTORY
STAY QUIET
SELECT
RESET TO READY
On top of these commands, NTAG 5 link offers
• INVENTORY READ in extended mode (see Section 8.2.3.5.1)
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
65 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
• FAST INVENTORY READ in extended mode (see Section 8.2.3.5.2)
• AUTHENTICATE to move to SELECTED SECURE state (see Section 8.2.3.4.4)
8.2.3.2 Configuration operations
8.2.3.2.1 READ CONFIGURATION
Command code = C0h
The READ CONFIG command returns configuration memory content starting with the
first block defined by the Block Address and reads Number of Blocks + 1 configuration
blocks.
Access to the configuration blocks depends on the status and definition of the related
block within the configuration memory (see Section 8.1.3).
If one of the requested configuration blocks is not accessible due to the actual status,
NTAG 5 link will respond with Error_flag set.
A READ CONFIG command can read one or multiple blocks of the following areas of the
configuration memory within one command execution:
• Block 00h to block 17h
• Keys can only be read separately if "NOT active" or after a mutual authentication with a
key with the Crypto Config privilege set in "active" state
Key0: block 20h-23h
Key1: block 24h-27h
Key2: block 28h-2Bh
Key3: block 2Ch-2Fh
• rest of configuration memory
Only Option_flag = 0b is supported.
Table 115. READ CONFIG request format
Flags
READ CONFIG Manuf. code
UID
8 bits
8 bits
64 bits
(optional)
8 bits
Block Address Number of
Blocks
CRC16
8 bits
16 bits
8 bits
Table 116. READ CONFIG response format when Error_flag is NOT set
Flags
Data
CRC16
8 bits
(Number of blocks + 1) times
32 bits
16 bits
Table 117. READ CONFIGURATION response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.2.2 WRITE CONFIGURATION
Command code = C1h
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
66 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
The WRITE CONFIG command writes the 4 byte data to the requested block address of
the configuration memory.
Access to the configuration blocks depends on the status and definition of the related
block within the configuration memory (see Section 8.1.3).
If the requested configuration block is not write accessible due to the actual status, NTAG
5 link will respond with Error_flag set.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 118. WRITE CONFIG request format
Flags
WRITE
CONFIG
Manuf.
code
UID
Block
Address
8 bits
8 bits
8 bits
64 (optional) 8 bits
Data
CRC16
32 bits
16 bits
Table 119. WRITE CONFIG response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 120. WRITE CONFIG response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.3 PWD Authentication
NTAG 5 link can be configured to be used for plain password authentication.
8.2.3.3.1 GET RANDOM NUMBER
Command code = B2h
The GET RANDOM NUMBER command is required to receive a 16-bit random number.
The passwords that will be transmitted with the SET PASSWORD, ENABLE/DISABLE
NFC PRIVACY and DESTROY commands have to be calculated with the password and
the random number (see Section 8.2.3.3.2).
Table 121. GET RANDOM NUMBER request format
Flags
GET RANDOM
NUMBER
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
Table 122. GET RANDOM NUMBER response format when Error_flag is NOT set
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
Random_Number
CRC16
8 bits
16 bits
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
67 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 123. GET RANDOM NUMBER response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.3.2 SET PASSWORD
Command code = B3h
The SET PASSWORD command enables the different passwords to be transmitted to
the IC to access the different protected functionalities of the following commands. The
SET PASSWORD command has to be executed just once for the related password if the
IC is powered.
Remark: The SET PASSWORD command can only be executed in addressed or
selected mode and the timing of the SET PASSWORD command is write alike.
The XOR password has to be calculated with the password and two times the received
random number from the last GET RANDOM NUMBER command:
XOR_Password[31:0] = Password[31:0] XOR {Random_Number[15:0],
Random_Number[15:0]}.
The different passwords are addressed with the password identifier.
Only Option_flag = 0b is supported.
Table 124. SET PASSWORD request format
Flags
SET
PASSWORD
Manuf. code
UID
8 bits
8 bits
8 bits
64 bits
(optional)
Password
identifier
XOR password CRC16
8 bits
32 bits
16 bits
Table 125. Password Identifier
Password Identifier
Password
01h
Read
02h
Write
04h
see Section 8.2.3.3.10
08h
Destroy
10h
EAS/AFI
40h
Read from AREA_1
80h
Write to AREA_1
Table 126. SET PASSWORD response format when Error_flag is NOT set
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
CRC16
8 bits
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
68 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 127. SET PASSWORD response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
Remark: If the IC receives an invalid password, it will not execute any following
command until a Power-On Reset (POR) (NFC reset) is executed.
8.2.3.3.3 WRITE PASSWORD
Command code = B4h
The WRITE PASSWORD command enables a new password to be written into
the related memory if the related old password has already been transmitted with
a SET PASSWORD command and the addressed password is not locked (see
Section 8.2.3.3.4).
Remark: The WRITE PASSWORD command can only be executed in addressed or
SELECTED mode. The new password takes effect immediately which means that the
new password has to be transmitted with the SET PASSWORD command to access
protected blocks/pages.
The different passwords are addressed with the password identifier as defined in
Table 125.
The timing of the command is write-alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 128. WRITE PASSWORD request format
Flags
WRITE
PASSWORD
Manuf. code
UID
8 bits
8 bits
8 bits
64 bits
(optional)
Password
identifier
Password
CRC16
8 bits
32 bits
16 bits
Table 129. WRITE PASSWORD response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 130. WRITE PASSWORD response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.3.4 LOCK PASSWORD
Command code = B5h
The LOCK PASSWORD command enables the addressed password to be locked if the
related password has already been transmitted with a SET PASSWORD command. A
locked password cannot be changed.
The different passwords are addressed with the password identifier (see Table 125).
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
69 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 131. LOCK PASSWORD request format
Flags
LOCK
PASSWORD
Manuf. code
UID
Password
identifier
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
8 bits
16 bits
Table 132. LOCK PASSWORD response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 133. LOCK PASSWORD response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.3.5 64 BIT PASSWORD PROTECTION
Command code = BBh
The 64-bit PASSWORD PROTECTION command enables NTAG 5 link to be instructed
that both, Read and Write passwords are required to get access to password protected
blocks. This mode can be enabled if the Read and Write passwords have been
transmitted first with a SET PASSWORD command.
If the 64-bit password protection is enabled, both passwords are required for read & write
access to protected blocks.
Once the 64-bit password protection is enabled, a change back to 32-bit password
protection (read and write password) is not possible.
Remark: A retransmission of the passwords is not required after the execution of the 64bit PASSWORD PROTECTION command.
Remark: The 64-bit PASSWORD PROTECTION does not include the 16-bit counter
block.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 134. 64 BIT PASSWORD PROTECTION request format
Flags
64 BIT PASSWORD
PROTECTION
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
70 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 135. 64 BIT PASSWORD PROTECTION response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 136. 64 BIT PASSWORD PROTECTION response format when Error_flag is NOT set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.3.6 PROTECT PAGE
Command code = B6h
The PROTECT PAGE command defines the protection pointer address of the user
memory to divide the user memory into two arbitrarily sized pages and defines the
access conditions for the two pages.
The protection pointer address defines the base address of the higher user memory
segment Page 0-H. All block addresses smaller than the protection pointer address are in
the user memory segment Page 0-L.
Table below shows an example of the user memory segmentation with the protection
pointer address NFC_PP_AREA_0H 14h.
Remark: In the example below PP_AREA_1 is pointing outside the user memory.
Table 137. Memory organization
Block
Byte 0
Byte 1
Byte 2
Byte 3
:
:
:
:
Description
00h
01h
02h
:
Page 0-L
12h
13h
14h
Page 0-H
15h
:
:
:
:
:
1FFh
C0
C1
00
Protection
Counter
Remark: If the protection pointer address is set to block 0, the entire user memory is
defined as Page 0-H.
The access conditions and the protection pointer address can be changed under the
following circumstances for plain password mode:
• The related passwords (Read and Write password) have been transmitted first with the
SET PASSWORD command.
• The page protection condition is not locked (see Section 8.2.3.3.7)
The access conditions and the protection pointer address can be changed under the
following circumstances for AES mode:
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
71 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
• The Global Crypto Header is set to "Deactivated" or
• if the Global Crypto Header is not set to "Deactivated" and a valid mutual authentication
with a key with read and write privileges has been executed before and the page
protection condition is not locked (see Section 8.2.3.3.7).
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 138. PROTECT PAGE request format
Flags
PROTECT
PAGE
Manuf.
code
8 bits
8 bits
8 bits
UID
64 bits
(optional)
Protection
pointer
address
Extended
protection
status
CRC16
8 bits
8 bits
16 bits
Remark: The IC only accepts protection pointer address values from 00h to FFh. The
block containing the 16-bit counter is excluded from the standard user memory protection
scheme.
Table 139. Extended Protection status byte
Bit
Name
Value
7
RFU
0b
6
RFU
0b
5
WH
4
RH
3
RFU
0b
2
RFU
0b
1
WL
0
RL
Description
0b
Page 0-H is not write protected
1b
Page 0-H is write protected
0b
Page 0-H is not read protected
1b
Page 0-H is read protected
0b
Page 0-L is not write protected
1b
Page 0-L is write protected
0b
Page 0-L is not read protected
1b
Page 0-L is read protected
Table 140. Protection status bits definition in plain password mode
WH/WL
NTP53x2
Product data sheet
COMPANY PUBLIC
RH/RL 32-bit Protection
64-bit Protection
0b
0b
Public
Public
0b
1b
Read and Write protected by the
Read password
Read and Write protected by the
Read plus Write password
1b
0b
Write protected by the Write password Write protected by the Read plus
Write password
1b
1b
Read protected by the Read
password and Write protected by the
Read and Write password
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
Read and Write protected by the
Read plus Write password
© NXP B.V. 2020. All rights reserved.
72 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 141. Protection status bits definition in AES mode
WH/WL
RH/RL
Protection
0b
0b
Public
0b
1b
Read and Write protected: Mutual authentication with a key with
read privilege is required
1b
0b
Write protected: Mutual authentication with a key with write
privilege is required
1b
1b
Read and Write protected: Mutual authentication with a key with
read and write privileges is required
Table 142. PROTECT PAGE response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 143. PROTECT PAGE response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
The information about the stored settings of the protection pointer address and access
conditions can be read with the GET NXP SYSTEM INFORMATION command (see
Section 8.2.3.9.14).
8.2.3.3.7 LOCK PAGE PROTECTION CONDITION
Command code = B7h
The LOCK PAGE PROTECTION CONDITON command locks the protection pointer
address and the status of the page protection conditions.
The LOCK PAGE PROTECTION CONDITON command can be successfully executed
under the following circumstances:
• The Global Crypto Header is set to "Deactivated".
• If the Global Crypto Header is not set to "Deactivated" and a valid mutual
authentication with a key with read and write privileges has been executed before.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 144. LOCK PAGE PROTECTION CONDITION request format
Flags
LOCK PAGE
PROTECTION
CONDITION
Manuf. code
UID
Protection
pointer address
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
8 bits
16 bits
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
73 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 145. LOCK PAGE PROTECTION CONDITION response format when Error_flag is NOT
set
Flags
CRC16
8 bits
16 bits
Table 146. LOCK PAGE PROTECTION CONDITION response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
Remark: If the transmitted protection pointer address does not match with the stored
address the IC will respond according to the error handling.
8.2.3.3.8 DESTROY
Command code = B9h
In plain password mode the DESTROY command disables NTAG 5 link if the destroy
password is correct. This command is irreversible and NTAG 5 link will never respond to
2
any command neither NFC nor I C again.
The DESTROY command can only be executed in addressed or SELECTED mode.
The XOR password has to be calculated with the password and two times the received
random number from the last GET RANDOM NUMBER command:
XOR_Password[31:0] = Password[31:0] XOR {Random_Number[15:0],
Random_Number[15:0]}.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
NOTE: In AES mode, Mutual Authentication with Purpose_MAM2 = 1011b needs to be
executed to destroy NTAG 5 link.
Table 147. DESTROY request format
Flags
DESTROY
Manuf. code
UID
XOR password
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
16 bits
Table 148. DESTROY response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 149. DESTROY response format when Error_flag is set
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
74 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
8.2.3.3.9 ENABLE NFC PRIVACY
Command code = BAh
The ENABLE NFC PRIVACY command in plain password mode enables NFC PRIVACY
mode (see Section 8.7) for NTAG 5 link if the Privacy password is correct.
The XOR password has to be calculated with the password and two times the received
random number from the last GET RANDOM NUMBER command:
XOR_Password[31:0] = Password[31:0] XOR {Random_Number[15:0],
Random_Number[15:0]}.
To get out of the NFC PRIVACY mode, the valid Privacy password has to be transmitted
to the IC with the DISABLE NFC PRIVACY command.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
NOTE: In AES mode, Mutual Authentication with Purpose_MAM2 = 1001b needs to be
executed to enable the NFC PRIVACY mode for NTAG 5 link.
Table 150. ENABLE NFC PRIVACY request format
Flags
SET
PASSWORD
IC Mfg
code
8 bits
8 bits
8 bits
UID
64 bits
optional
XOR
password
CRC16
32 bits
16 bits
Table 151. ENABLE NFC PRIVACY response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 152. ENABLE NFC PRIVACY response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.3.10 DISABLE NFC PRIVACY
Command code = B3h
The DISABLE NFC PRIVACY command moves the NTAG 5 link out of the NFC
PRIVACY mode.
Remark: The timing of the DISABLE PRIVACY command is write alike.
The XOR password has to be calculated with the password and two times the received
random number from the last GET RANDOM NUMBER command:
XOR_Password[31:0] = Password[31:0] XOR {Random_Number[15:0],
Random_Number[15:0]}.
The Privacy identifier is 04h.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
75 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Option_flag = 1b and Option_flag = 0b are supported.
Table 153. DISABLE NFC PRIVACY request format
Flags
SET
Manuf.
PASSWORD code
8 bits
8 bits
8 bits
UID
64 bits
(optional)
Privacy
identifier
XOR
password
CRC16
8 bits
32 bits
16 bits
Table 154. DISABLE NFC PRIVACY response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 155. DISABLE NFC PRIVACY response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
Remark: If the IC receives an invalid password, it will not execute any following
command until a Power-On Reset (POR) (NFC reset) is executed.
8.2.3.4 AES Authentication
8.2.3.4.1 Introduction
NXP implements a scalable security approach. This means, during lifetime the security
level may be changed. In production, NXP configures the IC, that plain password mode
is enabled. With the DEV_SEC_CONFIG byte (see Table 66) AES mutual authentication
may be activated. Only in case NFC Security is set to AES mode following commands
and AES mutual authentication is enabled. To lock the security level, the Security Lock
bits need to be set to 010b (see Table 66).
NOTE: AES authentication mode and this flexibility is only available for NTP5332.
8.2.3.4.2 PROTECT PAGE
See Section 8.2.3.3.6
8.2.3.4.3 LOCK PAGE PROTECTION CONDITION
See Section 8.2.3.3.7
8.2.3.4.4 AUTHENTICATE
As defined in ISO/IEC 15693 and ISO/IEC 29167-10.
Command code = 35h
CSI code= 00h (AES Crypto Suite)
The AUTHENTICATE command allows the interrogator to perform the following
authentication procedures as defined in ISO/IEC 15693:
• Tag Authentication (TAM1)
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
76 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
• Mutual Authentication (MAM1, MAM2)
After receiving a valid AUTHENTICATE command, NTAG 5 link calculates the response
and as soon as the calculation is finalized, the response with the result of the crypto
calculation (b3 flag is set) is sent. Only for tag authentication the calculation result is
additionally stored in the response buffer (b2 flag is set).
NTAG 5 link supports the Crypto Suite AES128 as defined in ISO/IEC 29167-10.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 156. AUTHENTICATE request format
Flags
AUTHENTICATE
8 bits
8 bits
UID
64 bits (optional)
CSI
Message
CRC16
8 bits
Depending on
TAM1 (96 bit),
MAM1 (96 bit) or
MAM2 (136 bit)
16 bits
Table 157 defines the response of NTAG 5 link to an AUTHENTICATE command.
For more detailed information, refer to ISO/IEC 29167-10.
Table 157. AUTHENTICATE response format when Error_flag is NOT set(in process reply)
Flags
Barker Code
TResponse
CRC16
8 bits (b2 and b3 is set)
8 bits (Done flag is set)
Depending on TAM1 (128
bit), MAM1(176 bit) or MAM2 16 bits
(0 bit)
Table 158. AUTHENTICATE response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
Tag Authentication (TAM1)
Table 159 defines the message within the AUTHENTICATE command for tag
authentication (TAM1).
For more detailed information, refer to ISO/IEC 29167-10.
Table 159. Message format for TAM1
AuthMethode
CustomData
TAM1_RFU
KeyID
IChallenge_TAM1
# of bits
2
1
5
8
80
Description
00b
0b
00000b
[7:0]
random interrogator challenge
Table 160 defines the response of NTAG 5 link to an AUTHENTICATE command.
For more detailed information, refer to ISO/IEC 29167-10.
Table 160. TResponse for TAM1
TResponse TAM1 (128 bit)
AES-ECB-ENC(Key[KeyID].ENC_key,C_TAM1[15:0] || TRnd_TAM1[31:0] || IChallenge_TAM1[79:0])
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
77 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Mutual Authentication (MAM1, MAM2)
The mutual authentication is a two-pass authentication procedure. The first
AUTHENTICATE command (MAM1) is executing the tag authentication and gets
the challenge from NTAG 5 link. The second AUTHENTICATE command (MAM2) is
executing the interrogator authentication.
Table 161 defines the message within the AUTHENTICATE command for mutual
authentication (MAM1).
For more detailed information, refer to ISO/IEC 29167-10.
Table 161. Message format for MAM1
AuthMethode
Step
MAM1_RFU
KeyID
IChallenge_MAM1
# of bits
2
2
4
8
80
Description
10b
00b
0000b
[7:0]
random interrogator challenge
Table 162 defines the response of NTAG 5 link to an AUTHENTICATE command for
MAM1.
For more detailed information, refer to ISO/IEC 29167-10.
Table 162. TReseponse for MAM1
TResponse MAM1 (176 bit)
AES-ECB-ENC(Key[KeyID].ENC_key,C_TAM1[15:0] || TChallenge_MAM1[31:0] || IChallenge_TAM1[79:0]) || TChallenge_
MAM1[79:32]
Table 163 defines the message within the AUTHENTICATE command for mutual
authentication (MAM2).
For more detailed information, refer to ISO/IEC 29167-10.
Table 163. Message format for MAM2
AuthMethode
Step
MAM2_RFU
IResponse
# of bits
2
2
4
128
Description
10b
01b
0000b
AES-DEC(, Key[KeyID].ENC_key,C_
MAM2[11:0] || Purpose_MAM2[3:0] ||
IChallenge_MAM1[31:0] || TChallenge_
MAM1[79:0])
Table 164 defines valid values for Purpose_MAM2 for NTAG 5 link.
Table 164. Definition of Purpose_MAM2
Standard
NXP specific
NTP53x2
Product data sheet
COMPANY PUBLIC
Purpose_MAM2
Description
0000b
Mutual Authentication
all other 0xxxb
RFU
1000b
Disable NFC Privacy Mode until NFC field reset
1001b
Enable NFC Privacy Mode
1010b
Disable NFC Privacy Mode
1011b
Destroy NTAG 5 link
all other 1xxxb
RFU
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
78 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 165 defines the response of NTAG 5 link to an AUTHENTICATE command for
MAM2.
For more detailed information, refer to ISO/IEC 29167-10.
Table 165. TReseponse for MAM2
TResponse MAM2 (0 bit)
Empty message (no data)
8.2.3.4.5 CHALLENGE
As defined in ISO/IEC 15693 and ISO/IEC 29167-10.
Command code = 39h
CSI code= 00h (AES Crypto Suite)
The CHALLENGE command transmits the message (challenge) to NTAG 5 link to
authenticate as defined in ISO/IEC 15693.
The CHALLENGE command can only be executed in the READY state and in not
addressed mode.
After receiving a valid CHALLENGE command, NTAG 5 link starts with the crypto
calculation.
If the calculation is finalized, NTAG 5 link will respond to a valid READBUFFER
command with the result of the crypto calculation based on the previous CHALLENGE
command message.
NTAG 5 link supports the Crypto Suite AES128 as defined in ISO/IEC 29167-10.
Only Option_flag = 0b is supported.
Table 166. CHALLENGE request format
Flags
CHALLENGE
UID
CSI
Message
CRC16
8 bits
8 bits
64 bits (optional)
8 bits
96 bits
16 bits
Table 167 defines the message within the CHALLENGE command.
For more detailed information, refer to ISO/IEC 29167-10.
Table 167. Message format
AuthMethode
CustomData
TAM1_RFU
KeyID
IChallenge_TAM1
# of bits
2
1
5
8
80
Description
00b
0b
00000b
[7:0]
random interrogator challenge
No response is sent on a CHALLENGE command.
For more detailed information, refer to ISO/IEC 29167-10.
8.2.3.4.6 READBUFFER
As defined in ISO/IEC 15693 and ISO/IEC 29167-10.
Command code = 3Ah
The READBUFFER command allows the interrogator to request the crypto calculation
result based on a valid previous CHALLENGE command from NTAG 5 link.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
79 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
NTAG 5 link supports the Crypto Suite AES128 as defined in ISO/IEC 29167-10.
Only Option_flag = 0b is supported.
Table 168. READBUFFER request format
Flags
READBUFFER
UID
CRC16
8 bits
8 bits
64 bits (optional)
16 bits
For more detailed information, refer to ISO/IEC 29167-10.
Table 169 and Table 170 defines the response of NTAG 5 link to a READBUFFER
command.
For more detailed information, refer to ISO/IEC 29167-10.
Table 169. READBUFFER response format when Error_flag is NOT set
Flags
TResponse
CRC16
8 bits
128 bits
(see Table 122)
16 bits
Table 170. TResponse
TResponse
AES-ECB-ENC(Key[KeyID].ENC_key,C_TAM1[15:0] || TRnd_TAM1[31:0] || IChallenge_TAM1[79:0])
Table 171. READBUFFER response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.5 Memory operations
Following commands are implemented for accessing user memory according to ISO/IEC
15693.
•
•
•
•
•
•
•
•
READ SINGLE BLOCK
WRITE SINGLE BLOCK
LOCK BLOCK
READ MULTIPLE BLOCKS up to 3Fh blocks
EXTENDED READ SINGLE BLOCK
EXTENDED WRITE SINGLE BLOCK
EXTENDED LOCK BLOCK
EXTENDED READ MULTIPEL BLOCKS up to 3Fh blocks
On top of these commands, NTAG 5 link offers INVENTORY READ and FAST
INVENTORY READ
8.2.3.5.1 INVENTORY READ
Command code = A0h
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
80 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
When receiving the INVENTORY READ request, NTAG 5 link performs the same as the
anti-collision sequence, with the difference that instead of the UID and the DSFID, the
requested response is defined by additional options.
The INVENTORY READ command provides two modes which are defined by the most
significant bit of the mask length byte as follows:
• Standard mode (most significant bit of mask length byte equal 0b)
(see Section 8.2.3.5.1.1)
• Extended mode (most significant bit of mask length byte equal 1b)
The extended mode offers additional features to optimize the inventory procedure for
different requirements (see Section 8.2.3.5.1.2)
The INVENTORY READ command may also be transmitted in addressed or SELECTED
mode. Then the command behaves similar to a READ or READ MULTIPLE BLOCK (see
Section 8.2.3.5.1.3).
8.2.3.5.1.1
Standard mode
If most significant bit of mask length byte is equal 0b the INVENTORY READ command
is used in the standard mode.
If the Inventory_flag is set to 1b and an error is detected, NTAG 5 link remains silent.
If the Option flag is set to 0b, n blocks of data are transmitted. If the Option flag is set to
1b, n blocks of data and the part of the UID which is not part of the mask are transmitted.
The request contains:
•
•
•
•
•
•
•
•
•
Flags
INVENTORY READ command code
IC manufacturer code
AFI (if AFI_flag is set to 1b)
Mask length (most significant bit equal 0b)
Mask value (if mask length > 00h)
First block number to be read
Number of blocks to be read
CRC 16
Table 172. INVENTORY READ request format
Flags
INVENTORY Manuf.
READ
code
8 bits
8 bits
8 bits
AFI
8 bits
(optional)
Mask
length
Mask value First block
number
Number of
blocks
CRC16
8 bits
0 to 8 bytes 8 bits
8 bits
16 bits
If the Inventory_flag is set to 1b, only NTAG 5 link in the READY or SELECTED
(SECURE) state will respond (same behavior as in the INVENTORY command). The
meaning of Flags bits 7 to 4 is as defined in ISO/IEC 15693.
The INVENTORY READ command can also be transmitted in the addressed or
SELECTED mode (see Section 8.2.3.5.1.3).
The number of blocks in the request is one less than the number of blocks that NTAG 5
link returns in its response.
If the Option_flag in the request is set to logic 0b the response contains:
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
81 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 173. INVENTORY READ response format: Option flag logic 0b
Flags
Data
CRC16
8 bits
Number of blocks times 32 bits 16 bits
NTAG 5 link reads the requested block(s) and sends back their value in the response.
The mechanism and timing of the INVENTORY READ command performs the same as
the INVENTORY command which is defined in ISO/IEC 15693.
If the Option_flag in the request is set to logic 1b, the response contains:
Table 174. INVENTORY READ response format: Option flag logic 1b
Flags
8 bits
Rest of UID which is not
part of
the mask and slot number
Data
CRC16
0 to 64 bit, always a multiple
of 8 bits
Number of blocks times 32
bits
16 bits
NTAG 5 link reads the requested block(s) and sends back their value in the response.
Additionally the bytes of the UID, which are not parts of the mask and the slot number
in case of 16 slots, are returned. Instead of padding with zeros up to the next byte
boundary, the corresponding bits of the UID are returned. The mechanism and timing
of the INVENTORY READ command perform the same as the INVENTORY command
which is defined in ISO/IEC 15693.
Remark: The number of bits of the retransmitted UID can be calculated as follows:
• 16 slots: 60 bits (bit 64 to bit 4) - mask length rounded up to the next byte boundary
• 1 slot: 64 bits - mask length rounded up to the next byte boundary
Remark: If the sum of first block number and number of blocks exceeds the total
available number of user blocks, the number of transmitted blocks is less than the
requested number of blocks. This means that the last returned block is the highest
available user block, followed by the 16-bit CRC and the EOF.
Example: mask length = 30 bits
Returned: bit 64 to bit 4 (30 bits) = 30 gives 4 bytes
Table 175. Example: mask length = 30
Byte 0
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
mask value including padding with zeros
Byte 6
-
returned value
8.2.3.5.1.2
Byte 7
UID
transmitted by
interrogator
transmitted by NTAG 5
link
Extended Mode
If the most significant bit of the Mask Length byte is equal 1b the response format is
defined by the extended option byte.
The request contains:
•
•
•
•
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
Inventory Read command code
IC Manufacturer code
AFI (if the AFI flag is set to 1b)
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
82 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
•
•
•
•
•
•
Mask length (most significant bit equal 1b)
Extended Options
Mask value (if mask length > 0)
First Block Number to be read, if specified in extended options byte
Number of Blocks to be read, if specified in extended options byte
CRC 16
Table 176. Inventory Read (extended mode) request format
Flags
INVENTORYManuf.
READ
code
8 bits
8 bits
8 bits
AFI
8 bits
(optional)
Mask
Length
ext.Optio
ns
Mask
Value
8 bits
8 bits
0 to 64 bits
First
block
number
Number
of blocks
8 bits
(optional)
8 bits
(optional)
CRC 16
16 bits
If the Inventory_flag is set to 1b, only NTAG 5 link in the READY or SELECTED
(SECURE) state will respond (same behavior as in the INVENTORY command). The
meaning of flags 5 to 8 is in accordance with table 5 in ISO/IEC 15693.
The INVENTORY READ command can also be transmitted in the addressed or
SELECTED mode (see Section 8.2.3.5.1.3).
Table 177. Extended options
Bit
Name
Value Feature
7
RFU
0
6
RFU
0
5
QUIET
4
0
remain in current state
1
go to QUIET state after response
0
NTAG 5 link will add the user memory blocks in the response
as requested with first block number byte and number of blocks
byte in the command
1
No user memory data is requested, first block number byte and
number of blocks byte shall not be transmitted in the command
0
Custom ID (CID) will be NOT transmitted in the response
1
Custom ID (CID) will be transmitted in the response
0
No CID is transmitted in the command
1
16-bit CID will be transmitted in the command and only NTAG 5
link with the same CID will respond
0
UID will be transmitted as in regular mode (truncated reply
depending on least significant 7 bits value of mask length and
the mask value)
1
Complete UID will be transmitted (independent from mask
length)
0
NTAG 5 link responds independent from the EAS status
1
Respond only, when EAS is enabled
SKIP_DATA
3
CID_RESPONSE
2
CID_COMPARE
1
UID_MODE
0
EAS_MODE
If the Option_flag in the request is set to 1b the response contains the truncated or
complete UID depending on the extended option UID_MODE bit.
If the Option_flag in the request is set to 0b the UID is not part of the response.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
83 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 178. Inventory Read (extended mode) response format: Option_flag 1b
Flags
Optional truncated UID OR
complete UID
Optional data
CRC16
8 bits
0 to 64 bits
Block length
16 bits
Multiple of 8 bits
Repeated as needed
The mechanism and timing of the INVENTORY READ command performs the same as
at the INVENTORY command which is defined in ISO/IEC 15693.
If the UID is requested in the truncated format the retransmitted UID can be calculated as
follows:
16 slots: 64 - 4 - mask length rounded up to the next byte boundary
1 slot: 64 - mask length rounded up to the next byte boundary
Example: mask length = 30 Returned: 64 - 4 - 30 = 30 gives 4 bytes
Table 179. Example
Byte 0
Byte 1
Byte 2
Byte 3
Byte 4
Byte 5
Byte 6
UID
transmitted by
Interrogator
mask value incl. padding with zeros
returned value
8.2.3.5.1.3
Byte 7
transmitted by NTAG 5
link
Addressed and SELECTED mode
The INVENTORY READ command can also be transmitted in the addressed or
SELECTED mode. In this case, the Inventory_flag is set to 0 and the meaning of flags 7
to 4 is in accordance with ISO/IEC 15693.
In the addressed or selected mode, the INVENTORY READ command behaves similar to
a READ or READ MULTIPLE BLOCK command.
In the addressed mode, it is recommended to address the IC with a mask length of 64
and to transmit the complete UID in the mask value field.
In the selected mode (IC has been selected with a valid SELECT command before), it is
recommended to address the IC with a mask length of 0 (and do not transmit the mask
value field).
Remark: If the INVENTORY READ command is used in the addressed or selected
mode, the AFI shall not be transmitted and the IC will only respond in the first-time slot.
8.2.3.5.2 FAST INVENTORY READ
Command code = A1h
When receiving the FAST INVENTORY READ command, NTAG 5 link behaves the
same as the INVENTORY READ command with the following exceptions:
The data rate in the direction NTAG 5 link to the reader is twice as defined in ISO/IEC
15693 depending on the Datarate_flag 53 kbit (high data rate) or 13 kbit (low data rate).
The data rate from the reader to NTAG 5 link and the time between the rising edge of the
EOF from the reader to NTAG 5 link remains unchanged (stays the same as defined in
ISO/IEC 15693).
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
84 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Only the single subcarrier mode is supported for the response to the FAST INVENTORY
READ command.
8.2.3.6 SRAM operations
When SRAM is mirrored to user EEPROM address space, standard READ BLOCK and
WRITE BLOCK commands can be used. To have a more efficient way to access the 256
bytes SRAM, READ SRAM and WRITE SRAM are implemented
8.2.3.6.1 READ SRAM
Command code = D2h
This command can only be used, when NTAG 5 link is powered via VCC end
SRAM_ENABLE bit (see Table 38) is set to 1b.
When receiving READ SRAM desired SRAM blocks will be returned.
NTAG 5 link returns only the requested blocks. The blocks are numbered from 00h to
3Fh. The number of blocks in the request is one less than the number of blocks that
NTAG 5 link returns in its response. EXAMPLE: A value of 06h in the "Number of Blocks"
field requests to read 7 blocks. A value of 00h requests to read a single block from
SRAM.
If SRAM is read or write protected a valid authentication needs to be proceeded.
It is recommended to use this command in pass-through mode.
Only Option_flag = 0b is supported.
Table 180. READ SRAM request format
Flags
READ
SRAM
Manuf.
code
8 bits
8 bits
8 bits
UID
64 bits
(optional)
Block
Address
Number of
Blocks
CRC16
8 bits
8 bits
16 bits
Table 181. READ SRAM response format when Error_flag is NOT set
Flags
Block Security Status (optional) + Data
CRC16
8 bits
(Number of Blocks+1) x 32 bits Data
16 bits
Block Security Status and Data bytes repeat as a duple.
Table 182. READ SRAM response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.6.2 Write SRAM
Command code = D3h
This command can only be used, when NTAG 5 link is powered via VCC end
SRAM_ENABLE bit (see Table 38) is set to 1b.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
85 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
When receiving WRITE SRAM desired SRAM blocks will be written to the SRAM. It is
recommended to use this command in pass-through mode because of performance
reasons.
If SRAM is write protected a valid authentication needs to be preceded.
The blocks are numbered from 00h to 3Fh. The number of blocks in the request is one
less than the number of blocks that the VICC shall write. E.g., to write one block to SRAM
Number of Blocks is coded as 00h.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 183. WRITE SRAM request format
Flags
WRITE
SRAM
IC Mfg
code
8 bits
8 bits
8 bits
UID
64 bits
(optional)
Block
Address
Number of
blocks
8 bits
8 bits
Data
CRC16
(Number of
blocks + 1)
times 32 bits
16 bits
Table 184. WRITE SRAM response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 185. WRITE SRAM response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.7 Originality Signature
8.2.3.7.1 READ SIGNATURE
Command code = BDh
The READ SIGNATURE command returns an IC-specific, 32 byte ECC signature. How
to change and / or lock the originality signature is described in Section 8.8.
Only Option_flag = 0b is supported.
Table 186. READ SIGNATURE request format
Flags
READ
SIGNATURE
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
Table 187. READ SIGNATURE response format when Error_flag is NOT set
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
Originality Signature
CRC16
8 bits
256 bits
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
86 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 188. READ SIGNATURE response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
Details on how to validate the signature is provided in AN11350.
2
8.2.3.8 I C Transparent Channel
2
2
NTAG 5 link offers an NFC to I C bridge. With this mode, different I C slaves (e.g.,
2
sensors) can be connected without a microcontroller. There shall be no other active I C
master on the same bus. The needed power for the sensors may be provided with NTAG
5 link energy harvesting capability.
2
I C master communication can do maximum 256 bytes to read from, and write to the
connected slave.
2
I C master clock speed needs to be configured with I2C_MASTER_SCL_LOW and
2
I2C_MASTER_SCL_HIGH (see Table 62). I C slave address will be selected directly
2
2
within WRITE I C and READ I C command.
SRAM needs to be enabled by setting SRAM_ENABLE bit (see Table 38) to 1b.
2
Basic principle for triggering an I C write to the connected slave is illustrated in the figure
below. NFC reader will get the response immediately, and then polls for the status of the
2
I C transaction (see Table 106).
2
Details of the NFC command WRITE I C can be found in Section 8.2.3.8.1.
NOTE: This feature is only available for NTP5332.
RF
READER
RF sends custom I2C write
command and sends Payload
along with the command for
I2C Write transaction.
RF polls for I2C Master
session registers to know
the current I2C
transaction status.
IC initiates I2C
transaction. I2C Master
sends I2C write
command to the
specified slave address.
I2C
INTERFACE
RF to I2C Master read communication sequences
aaa-035483
2
Figure 7. I C Master write principle
2
Basic principle for triggering an I C read and getting the response of the connected slave
is illustrated in the figure below. Again the NFC reader will get a response immediately,
2
and then polls for the status of the I C transaction (see Table 106). Finally the result can
be read from SRAM.
2
Details of the NFC command READ I C can be found in Section 8.2.3.8.2
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
87 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
RF
READER
RF polls for I2C Master
session registers to know
the current I2C
transaction status.
RF sends custom I2C read
command.
IC initiates I2C
transaction. I2C Master
sends I2C read
command to the
specified slave address.
I 2C
INTERFACE
RF reads data
from SRAM.
IC stores
the data
in SRAM.
RF to I2C Master read communication sequences
aaa-035482
2
Figure 8. I C Master read principle
2
8.2.3.8.1 WRITE I C
Command code = D4h
2
2
WRITE I C command is used to trigger an I C master write command (R/W bit is 0b) on
2
the I C bus.
Command parameters:
2
2
• I C param contains I C slave address and STOP condition option.
• Data length N byte codes the length of bytes to be sent to the slave. N+1 bytes need to
be put in the Data field and will be sent to the slave. E.g., to send one byte, 00h needs
to be coded.
2
• Data field contains the data to be sent to the I C slave. Minimum number of bytes is 1
byte, maximum is 256 bytes.
If SRAM is read or write protected a valid authentication needs to be preceded.
Response to this command will follow immediately.
2
2
To check the status and result of the WRITE I C command, I C Master Status Registers
ADh should be checked (see Table 106).
Only Option_flag = 0b is supported.
2
Table 189. WRITE I C request format
2
2
Flags
WRITE I C
Manuf. code
UID
I C param
Data length
N
Data
CRC16
8 bits
8 bits
8 bits
64 bits
(optional)
8 bits
8 bits
(N+1) x 8 bits 16 bits
2
Table 190. I C param byte
2
I C param bit
Status
7
Disable STOP condition
6 to 0
2
I C Address
NTP53x2
Product data sheet
COMPANY PUBLIC
Value
Description
0b
STOP condition will be generated at the end of transaction
1b
STOP condition will be omitted at the end of transaction
xxh
7-bit I C slave address of connected slave
2
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
88 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
Table 191. WRITE I C response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
2
Table 192. WRITE I C response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
2
8.2.3.8.2 READ I C
Command code = D5h
2
2
READ I C command is used to trigger an I C master read command (R/W bit is 1b) on
2
the I C bus.
Command parameters:
2
2
• I C param contains I C address and STOP condition option
• Data length N byte codes the length of bytes to be read from the slave. N+1 bytes will
be read from the slave. E.g., to read one byte 00h needs to be coded. Maximum is
FFh, which means 256 bytes will be read.
Response to this command will follow immediately.
2
The status register Table 106 indicates when the I C read command is completed.
2
To get the response of the addressed I C slave device, the READ SRAM (see
Section 8.2.3.6.1) command is used.
Only Option_flag = 0b is supported.
2
Table 193. READ I C request format
2
Flags
READ
2
I C
IC Mfg
code
UID
I C
param
Data length
CRC16
8 bits
8 bits
8 bits
64 bits
optional
8 bits
8 bits
16 bits
2
Table 194. I C param byte
Bit
7
6 to 0
Status
Value Description
Disable STOP condition
2
I C Address
0b
STOP condition will be generated at the end of transaction
1b
STOP condition will be omitted at the end of transaction
xxh
7-bit I C slave address of connected slave
2
2
Table 195. READ I C response format when Error_flag is NOT set
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
CRC16
8 bits
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
89 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
Table 196. READ I C response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.9 Other
8.2.3.9.1 WRITE AFI
As defined in ISO/IEC 15693.
8.2.3.9.2 LOCK AFI
As defined in ISO/IEC 15693.
8.2.3.9.3 WRITE DSFID
As defined in ISO/IEC 15693.
8.2.3.9.4 LOCK DSFID
As defined in ISO/IEC 15693.
8.2.3.9.5 SET EAS
Command code = A2h
The SET EAS command enables the EAS mode if the EAS mode is not locked.
If the EAS mode is password protected the EAS password has to be first transmitted with
the SET PASSWORD command.
If AES authentication scheme is enabled and EAS mode is protected, a valid mutual
authentication with a key with the EAS/AFI privilege set has to executed before.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 197. SET EAS request format
Flags
SET EAS
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
Table 198. SET EAS response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 199. SET EAS response format when Error_flag is set
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
90 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
8.2.3.9.6 RESET EAS
Command code = A3h
The RESET EAS command disables the EAS mode if the EAS mode is not locked.
If the EAS mode is password protected the EAS password has to be first transmitted with
the SET PASSWORD command.
If AES authentication scheme is enabled and EAS mode is protected a valid mutual
authentication with a key with the EAS/AFI privilege set has to executed before.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 200. RESET EAS request format
Flags
RESET EAS
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits optional
16 bits
Table 201. RESET EAS response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 202. RESET EAS response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.9.7 LOCK EAS
Command code = A4h
The LOCK EAS command locks the current state of the EAS mode and the EAS ID.
If the EAS mode is password protected the EAS password has to be first transmitted with
the SET PASSWORD command.
If AES authentication scheme is enabled and EAS mode is protected a valid mutual
authentication with a key with the EAS/AFI privilege set has to executed before.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 203. LOCK EAS request format
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
LOCK EAS
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
91 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 204. LOCK EAS response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 205. LOCK EAS response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.9.8 EAS ALARM
Command code = A5h
The EAS ALARM command can be used in the following configurations:
• Option_flag is set to 0b:
EAS ID mask length and EAS ID value shall not be transmitted.
If the EAS mode is enabled, the EAS response is returned from the IC.
• Option_flag is set to 1b:
Within the command, the EAS ID mask length has to be transmitted to identify how
many bits of the following EAS ID value are valid (multiple of 8-bits). Only those ICs will
respond with the EAS sequence which have stored the corresponding data in the EAS
ID configuration (selective EAS) and if the EAS Mode is set.
If the EAS ID mask length is set to 00h, the IC will answer with its EAS ID.
Table 206. EAS ALARM Request format
Flags
EAS ALARM
Manuf. code
UID
EAS ID mask
length
8 bits
8 bits
8 bits
64 bits
(optional)
8 bits (optional)
EAS ID value
CRC16
0, 8 or 16 bits
(optional)
16 bits
If an error is detected the IC remains silent.
Option_flag is set to 0b or Option_flag is set to logic 1b and the EAS ID mask length is
not equal to 00h:
Table 207. EAS ALARM Response format (Option flag logic 0)
Flags
EAS sequence
CRC16
8 bits
256 bits
16 bits
EAS sequence (starting with the least significant bit, which is transmitted first; read from
left to right):
11110100 11001101 01000110 00001110 10101011 11100101 00001001 11111110
00010111 10001101 00000001 00011100 01001011 10000001 10010010 01101110
01000001 01011011 01011001 01100001 11110110 11110101 11010001 00001101
10001111 00111001 10001011 01001000 10100101 01001110 11101100 11110111
Option_flag is set to 1b and the EAS ID mask length is equal to 00h:
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
92 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 208. EAS ALARM Response format(Option flag logic 1)
Flags
EAS ID value
CRC16
8 bits
16 bits
16 bits
Table 209. EAS ALAMR response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
If the EAS mode is disabled, the IC remains silent.
Remark: NTAG 5 link in the QUIET state will not respond to an EAS ALARM command
except the addressed flag is set.
8.2.3.9.9 PROTECT EAS/AFI
Command code = A6h
In plain password mode the PROTECT EAS/AFI command enables the password
protection for EAS and/or AFI if the EAS/AFI password is first transmitted with the SET
PASSWORD command.
In AES mode, the PROTECT EAS/AFI command enables the protection for EAS and/or
AFI if a valid mutual authentication with the EAS/AFI privilege has been executed before.
Option_flag set to 0b: EAS will be protected.
Option_flag set to 1b: AFI will be protected.
Both protections (AFI and EAS) can be enabled separately.
Once the EAS/AFI protection is enabled, it is not possible to change back to unprotected
EAS and/or AFI.
The timing of the command is write-alike as of write commands with Option_flag set to
0b.
Note: Option_flag is only related to the parameter to be locked, and NOT to the response
behavior.
Table 210. PROTECT EAS/AFI request format
Flags
PROTECT EAS/AFI
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
Table 211. PROTECT EAS/AFI response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 212. PROTECT EAS/AFI response format when Error_flag is set
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
93 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
8.2.3.9.10 WRITE EAS ID
Command code = A7h
The command WRITE EAS ID enables a new EAS Identifier to be stored in the
corresponding configuration memory.
If EAS is password protected (for Set and Reset EAS) the EAS password has to be first
transmitted with the SET PASSWORD command.
If AES mode is enabled and the EAS is protected a valid mutual authentication with a key
with the EAS/AFI privilege set has to executed before.
The timing of the command is write alike.
Option_flag = 0b and Option_flag = 1b is supported and is in accordance with ISO/IEC
15693 write-alike commands.
Table 213. WRITE EAS ID request format
Flags
WRITE EAS ID
Manuf. code
UID
EAS ID value
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
16 bits
Table 214. WRITE EAS ID response format when Error_flag is NOT set
Flags
CRC16
8 bits
16 bits
Table 215. WRITE EAS ID response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.9.11 GET MULTIPLE BLOCK SECURITY STATUS
As defined in ISO/IEC 15693.
8.2.3.9.12 GET SYSTEM INFORMATION
As defined in ISO/IEC 15693.
The TAG type of NTAG 5 link is "01h".
8.2.3.9.13 EXTENDED GET SYSTEM INFORMATION
As defined in ISO/IEC 15693 and ISO/IEC 29167-10.
Command code = 3Bh
8.2.3.9.14 GET NXP SYSTEM INFORMATION
Command code = ABh
The GET NXP SYSTEM INFORMATION command provides information about the IC
access conditions and supported features.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
94 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 216. GET NXP SYSTEM INFORMATION request format
Flags
Get NXP System Info
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
Table 217. GET NXP SYSTEM INFORMATION response format when Error_flag is NOT set
Flags
PP
pointer
PP
condition
Lock bits
Feature
flag
CRC16
8 bits
8 bits
8 bits
8 bits
32 bits
16 bits
On a valid received command the IC responds with detailed information:
PP pointer byte contains the block address of the protection pointer.
PP condition byte contains information about the access condition to Page H and Page L.
Table 218. Protection Pointer condition byte
Bit
Name
Value
7
RFU
0b
6
RFU
0b
5
WH
4
RH
3
RFU
0b
2
RFU
0b
1
WL
0
RL
Description
0b
Page 0-H is not write protected
1b
Page 0-H is write protected
0b
Page 0-H is not read protected
1b
Page 0-H is read protected
0b
Page 0-L is not write protected
1b
Page 0-L is write protected
0b
Page 0-L is not read protected
1b
Page 0-L is read protected
Lock bits byte contains information about permanently locked features.
Table 219. Lock bits byte
Bit
7 to 4
Name
Value
Description
RFU
0b
3
NFC_PP_AREA_0H and
NFC_PPC
0b
NFC_PP_AREA_0H and NFC_PPC is NOT locked
1b
NFC_PP_AREA_0H and NFC_PPC is locked
2
DSFID
0b
DSFID is NOT locked
1b
DSFID is locked
1
EAS
0b
EAS is NOT locked
1b
EAS is locked
0
AFI
0b
AFI is NOT locked
1b
AFI is locked
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
95 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Feature flag byte contains information about supported features (related bit is 1b) of
NTAG 5 link. With this response, it is possible to distinguish the different NTAG 5 family
members.
Table 220. Feature flags byte 0
Bit
Name
Description
NTAG 5
7
CID
Customer ID supported (see Section 8.1.3.3)
1b
6
EAS IR
EAS selection supported by extended mode in INVENTORY
READ command (see Section 8.2.3.5.1)
1b
5
INVENTORY READ EXT
Extended mode supported by INVENTORY READ command
(see Section 8.2.3.5.1)
1b
4
AFI PROT
AFI protection supported (see Section 8.2.3.9.9)
1b
3
EAS PROT
EAS protection supported (see Section 8.2.3.9.9)
1b
2
EAS ID
EAS ID supported by EAS ALARM command (see
Section 8.2.3.9.10)
1b
1
COUNTER
NFC Counter supported (see Section 8.1.2.1)
1b
0
UM PROT
User memory protection supported (see Section 8.2.3.3.6)
1b
Table 221. Feature flags byte 1
NTAG 5
Bit
NTP5210
NTP5312
NTP5332
NTA5332
0b
1b
Name
Description
7
HIGH BITRATES
high bitrates supported (see Section 8.2)
6
WRITE CID
Write and Lock CID enabled (see Section 8.1.3.3)
1b
5
DESTROY
DESTROY feature supported (see Section 8.2.3.3.8)
1b
4
NFC PRIVACY
NFC Privacy mode supported (see Section 8.2.3.3.9)
1b
3
RFU
2
PERS QUIET
1
RFU
0
ORIG SIG
0b
PERSISTENT QUIET feature supported
0b
0b
Originality signature supported (see Section 8.1.3.1)
1b
Table 222. Feature flags byte 2
NTAG 5
Bit
7 to 3
Name
Description
NTP5210
NTP5312
RFU
NTP5332
NTA5332
all 0b
2
KEY PRIV
Key privileges supported (see
Section 8.1.3.8)
0b
1b
1
MUTUAL AUTH
Mutual Authentication feature supported (see
Section 8.6.4)
0b
1b
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
96 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
NTAG 5
Bit
0
Name
Description
TAG AUTH
Tag Authentication feature supported (see
Section 8.6.4)
NTP5210
NTP5312
NTP5332
NTA5332
0b
1b
Table 223. Feature flags byte 3
NTAG 5
Bit
7
Name
Description
EXT FLAG
Additional 32 bits feature flags are
transmitted
NTP5210
NPT5332
NTA5332
NTP5312
0b
00b only NFC interface available
6-5
01b GPIO/ED host interface
Interface
01b
10b RFU
11b
2
11b GPIO and I C host interface
4
3 to 0
RFU
0b
NUM KEYS
Number of Keys
4h
0h
Table 224. GET NXP SYSTEM INFORMATION response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
8.2.3.9.15 PICK RANDOM ID
Command code = C2h
In AES mode the PICK RANDOM ID commandinstructs NTAG 5 link in NFC PRIVACY
Mode to generate a random ID. After a valid PICK RANDOM ID command, the IC will
respond with that random ID on following INVENTORY commands or GET SYSTEM
INFORMATION command until an RF reset to allow an anti-collision procedure.The
random ID will include the CID to identify the group-password or group-key to disable the
privacy mode.
Only Option_flag = 0b is supported.
Table 225. PICK RANDOM ID request format
Flags
Pick Random ID
Manuf. code
UID
CRC16
8 bits
8 bits
8 bits
64 bits (optional)
16 bits
Table 226. PICK RANDOM ID response format when Error_flag is NOT set
NTP53x2
Product data sheet
COMPANY PUBLIC
Flags
CRC16
8 bits
16 bits
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
97 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 227. PICK RANDOM ID response format when Error_flag is set
Flags
Error Code
CRC16
8 bits
8 bits
16 bits
After a successful PICK_RANDOM_ID the NTAG 5 link will respond on an INVENTORY
command with a random ID as defined in the table below.
Table 228. Random ID
MSB
LSB
63:56
55:48
47:40
39:32
31:24
23:16
15:0
E0h
04h
00h
00h
CID_1
CID_0
16-bit random
ID
8.2.4 Data integrity
Following mechanisms are implemented in the contactless communication link between
reader and NTAG 5 link to ensure very reliable data transmission:
•
•
•
•
16-bit CRC per block
Bit count checking
Bit coding to distinguish between logic 1, logic 0, and no information
Channel monitoring (protocol sequence and bit stream analysis)
8.2.5 Error Handling
8.2.5.1 Transmission Errors
According to ISO/IEC 15693 NTAG 5 link will not respond if a transmission error (CRC,
bit coding, bit count, wrong framing) is detected and will silently wait for the next correct
received command.
8.2.5.2 Not supported commands or options
If the received command or option is not supported, the behavior depends on the
addressing mechanism.
• Non-Addressed Mode
NTAG 5 link remains silent
• Addressed or selected Mode
NTAG 5 link responds with error code 0Fh (no information given, or error code not
supported).
If the Inventory flag or the Protocol Extension flag is set, the IC will not respond if the
command or option is not supported.
• Parameter out of range
– Read alike commands
If the sum of the first block number and the number of blocks exceeds the total
available number of user blocks, the number of transmitted blocks is less than the
requested number of blocks. This means that the last returned block is the highest
available user block, followed by the 16-bit CRC and the EOF.
– Write alike commands
If the address of a block to be written does not exist or a block to be written is locked,
the behavior of the IC depends on the addressing mechanism.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
98 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
– Non-Addressed Mode
NTAG 5 link remains silent.
– Addressed or SELECTED Mode
NTAG 5 link responds with error code 0Fh (no information given, or error code not
supported).
8.3 Wired Interface
NTAG 5 link has not only an NFC interface, but also a wired interface. Details are
described in following clauses.
2
8.3.1 I C interface
2
The definition of the I C interface is according to the UM10204. The details of slave and
master mode are described in Section 8.3.1.1 and Section 8.3.1.2.
2
NOTE: I C master mode is only available for NTP5332.
8.3.1.1 Slave mode
2
For details about I C interface, refer to UM10204.
2
The I C slave interface supports both standard (up to 100 kHz) and fast mode (up to
400 kHz) communication speeds for both read and write. Implementation will be a so2
called asynchronous interface which uses the SCL clock for the I C protocol handling
after which the data is synchronized to the system clock for memory access. NTAG 5 link
can be used in multi-master/multi-slave applications.
SCL
SDA
Start
Condition
SCL
1
SDA
MSB
SDA
Input
2
SDA
Change
Stop
Condition
3
7
8
9
ACK
Start
Condition
SCL
1
SDA
MSB
2
3
7
8
9
ACK
Stop
Condition
001aao231
2
Figure 9. I C bus protocol
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
99 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
NTAG 5 link supports the I C protocol defined in UM10204. Any device that sends data
onto the bus is defined as a transmitter, and any device that reads the data from the bus
is defined as a receiver. The device that controls the data transfer is known as the "bus
master", and the other as the "slave" device. A data transfer can only be initiated by the
bus master, which will also provide the serial clock for synchronization.
8.3.1.1.1 Start condition
Start is identified by a falling edge of Serial Data (SDA), while Serial Clock (SCL) is
stable in the high state. A Start condition must precede any data transfer command.
NTAG 5 link continuously monitors SDA (except during a Write cycle) and SCL for a Start
condition, and will not respond unless one is given.
8.3.1.1.2 Stop condition
Stop is identified by a rising edge of SDA while SCL is stable and driven high. A Stop
condition terminates communication between NTAG 5 link and the bus master. A Stop
condition at the end of a Write command triggers the internal write cycle.
8.3.1.1.3 Acknowledge bit (ACK)
The acknowledge bit is used to indicate a successful byte transfer. The bus transmitter,
whether it is the bus master or slave device, releases Serial Data (SDA) after sending 8
bits of data. During the ninth clock pulse period, the receiver pulls Serial Data (SDA) low
to acknowledge the receipt of the 9th data bits.
8.3.1.1.4 Data input
During data input, the IC samples SDA on the rising edge of SCL. For correct device
operation, SDA must be stable during the rising edge of SCL, and the SDA signal must
change only when SCL is driven low.
8.3.1.1.5 Addressing
To start communication between a bus master and NTAG 5 link, the bus master must
initiate a Start condition. Following this initiation, the bus master sends the device
2
address. The IC address from I C consists of a 7-bit device identifier (see Table 229 for
default value).
2
As long as I C address is 7 bit long, the 8th bit (least significant bit) is used as the Read/
Write bit (R/W). This bit is set to 1b for Read and 0b for Write operations.
If a match occurs on the device address, the IC gives an acknowledgment on SDA during
the 9th bit time. If the IC does not match the device select code, it deselects itself from
the bus and clears the register I2C_IF_LOCKED (see Table 88).
2
2
Table 229. Default NTAG 5 I C address from I C
Device address
b6
Value
[1]
1
b5
[1]
0
[1]
b4
1
[1]
b3
0
[1]
b2
1
[1]
b1
0
[1]
b0
0
[1]
Initial values - can be changed.
2
2
The I C address of NTAG 5 link (Configuration Byte) can be modified by the NFC and I C
interface.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
100 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
8.3.1.1.6 Disable I C Interface
2
NTAG 5 link offers the option to disable the I C interface temporarily using the session
2
register bit DISABLE_I C (see Table 100). With this feature, the NFC Device can easily
get exclusive access to EEPROM.
This feature can be enabled via the NFC interface during the session by setting related
session bit.
8.3.1.2 Master mode of NTP5332
2
2
2
NTAG 5 link can be configured in I C master mode. Using I C Master interface, I C slave
device like sensors or memories can be connected to NTAG 5 link without an external
2
microcontroller. Using energy harvesting capability, I C device can be powered by NTAG
5 link .
2
2
When using I C master mode, it must be ensured, that there is no other active I C master
2
on the same bus. The USE_CASE_CONF needs to be set to I C master (01b) and
SRAM needs to be enabled in CONFIG_1 byte (see Table 38).
The used clock speed can be configured by setting I2C_MASTER_SCL_LOW and
I2C_MASTER_SCL_HIGH (see Section 8.1.3.21).
2
To communicate with the connected I C slave device two custom commands are
implemented.
• WRITE I2C (see Section 8.2.3.8.1)
• READ I2C (see Section 8.2.3.8.2)
2
The response from the READ I C command will be stored in the SRAM and can be read
(see Section 8.2.3.6.1) afterwards from NFC perspective. Due to the 256 byte SRAM,
2
only 256 bytes can be written / read at once to / from the I C interface.
Of course, all other NFC commands are working in master mode and the user memory
as well as configuration memory is accessible from NFC perspective.
2
WARNING: When enabling I C master mode and disabling NFC interface in parallel,
NTAG 5 link gets disabled for current session.
Implementation details can be found in AN12368.
8.3.1.3 Watch Dog Timer
2
A programmable watchdog timer is implemented to unlock the I C host from NTAG 5
link latest after a defined maximum time period. The host itself will not be notified of this
event directly but the NFC status register is updated accordingly.
On default Watch Dog Timer is enabled with a value of 0848h (~20 ms) but the watchdog
timer can be freely set with WDT_CONFIG from 0000h (9.434 μs) up to (FFFFh+1) *
9.434 µs (~618 ms). It is recommended to keep this time as short as possible, by setting
2
the value above, but close to the maximum needed I C transaction time.
The timer is only active, when WDT_ENABLE is set to 1b and the IC is VCC powered.
2
The timer starts ticking when the I C communication starts. The Watch Dog Timer
2
ensures, that I C interface gets released after the configured time period in any case.
2
In the case where the I C communication has completed before the end of the timer and
the status register I2C_IF_LOCKED was not cleared by the host, it will be cleared when
defined watchdog time elapses.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
101 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
NOTE: If WDT_CONFIG configured time elapses before ongoing I C communication is
2
finished, WDT will release SDA line in between of ongoing I C communication.
The timer is reset automatically, when I2C_IF_LOCKED gets cleared, or the IC is not VCC
powered.
2
In I C master use case, watchdog timer is always enabled independently of
WDT_ENABLE. It is important to set WDT_CONFIG in accordance with maximum
execution time.
8.3.1.4 Command Set
2
NTAG 5 link offers an easy to use I C command set.
• WRITE MEMORY and READ MEMORY to access user and configuration memory
• WRITE MEMORY to present the related password, when password authentication from
2
I C perspective is enabled
• WRITE REGISTER and READ REGISTER to access session registers
In Figure 10 the access to EEPROM with READ MEMORY and WRITE MEMORY is
illustrated and following symbols are used:
2
• START: I C Start condition as defined in Section 8.3.1.1.1.
• SL_AD: 7-bit slave address (msb aligned) plus (lsb) R/W bit as defined in
Section 8.3.1.1.5
• BL_AD1 (MSB) / BL_AD0 (LSB): 16-bit block address
• A/N: Acknowledge / NAK as defined in Section 8.3.1.1.3
• DATA 0, DATA 1, … , DATA N: Data bytes to be read or written.
N shall be 3 for writing to EEPROM
N shall be multiple of 4 reduced by 1; maximum 255 for writing to SRAM
N is any number for reading data. NTAG 5 link will respond until host's NACK.
• Stop: Stop condition as defined in Section 8.3.1.1.2
Read Data
HOST
START
SL_AD W
SLAVE
BL_ AD1
A
BL_ AD0
A
STOP
START SL_AD
R
A
A
A
DATA 0
A
DATA 1
A
DATA 2
A/N STOP
DATA N
Write Data
HOST
SLAVE
START
SL_AD W
BL_ AD1
A
BL_ AD0
A
DATA 0
A
DATA 1
A
DATA 2
A
DATA 3
A
STOP
A
aaa-035477
Figure 10. READ MEMORY and WRITE MEMORY command
In Figure 11 the access to Registers with READ REGISTER and WRITE REGISTER is
illustrated and following symbols are used:
2
• START: I C Start conditions as defined in Section 8.3.1.1.1.
• SL_AD: 7-bit slave address (msb aligned) plus (lsb) R/W bit as defined in
Section 8.3.1.1.5
• BL_AD1 (MSB) | BL_AD0 (LSB): 16-bit register block address
• REGA: 8-bit register address
• MASK: 8-bit control register bit mask. Only if corresponding control bit is set to 1b, the
register bit will be overwritten.
• A/N: Acknowledge / Not Acknowledge as defined in Section 8.3.1.1.3
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
102 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
• REGDAT: 8-bit register data to read/write
• STOP: Stop condition as defined in Section 8.3.1.1.2
Read Data
HOST
START
SL_AD W
SLAVE
BL_AD1
A
BL_AD0
A
REGA
A
STOP
START SL_AD
R
A/N STOP
A REGDATA
A
Write Data
HOST
START
SLAVE
SL_AD W
BL_AD1
A
BL_AD0
A
REGA
A
MASK
A
REGDATA
A
STOP
A
aaa-035478
Figure 11. READ REGISTER and WRITE REGISTER command
8.3.1.5 Error Handling
In case of any detected error, NTAG 5 link in slave mode responds with a NACK:
• Memory Write
– EEPROM
generated on the fourth data byte if the block is not writable
– SRAM
generated on the first byte if the block is not writable
– Arbiter locked to NFC interface, or
– EEP cycle ongoing, or
2
– I C interface disabled
generate on block address BL_AD0
• Memory Read
– EEPROM/SRAM
returned data will be FFh if the access is to restricted region
– Arbiter locked to NFC interface, or
– EEP cycle ongoing, or
2
– I C interface disabled
generate on block address BL_AD0
• Register Access
Registers are always accessible. NACK will only be generated:
– DATA NACK due to register write command to trigger system reset
2
– NACK for register read/write command on BL_AD0 if I C interface is disabled
8.3.2 Event detection
The event detection feature provides the capability to trigger an external device (e.g.,
µController) or switch on the connected circuitry by an external power management unit
depending on activities on the NFC interface. On top this active low pin can be used as
2
one of the two possible PWM channels to offer I C and PWM functionality.
As the event detection pin functionality is operated via NFC field power, VCC supply for
the IC itself is only required when ED pin is used as PWM channel.
NOTE: In some cases VOUT pin might be used as field detection trigger.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
103 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
The configurable events indicated at event detection pin are:
•
•
•
•
•
•
•
The presence/absence of the NFC field
Data read/written in pass-through mode
Arbiter locked/unlocked EEPROM to NFC interface
NDEF Message TLV length field is ZERO/non-ZERO
IC is/is not in standby mode
Dedicated config bit is ZERO
Write/Read command ongoing
Event detection pin is an active LOW signal. Due to open-drain implementation an
external pull-up resistor shall be used on this pin.
How to use the event detection pin in applications is described in AN11203.
8.3.3 GPIO
2
I C pins (SCL/SDA) are multiplexed and can be used as general-purpose input/
2
output pins linked to configuration/session bits. When configured as GPIO pins, I C
communication is not possible anymore.
At POR, the GPIO are set to high-impedance state. When configuration is read, the pins
are controlled to behave as per the configuration.
GPIOs can be configured to be either input or output (see Section 8.1.3.15). In input
mode, the status of the pad will be available in one of the session register bits. In output
mode status depends on the session register/config bits content.
How to use the GPIO pins in applications is described in AN11203.
8.3.4 PWM
2
I C pins (SDA/SCL) and ED pin are multiplexed and can be used as a pulse width
2
modulation output. I C pins have push-pull architecture, ED pin is an open-drain
implementation, which means the PWM signal gets inverted.
PWM resolution, pre-scalar factor (see Section 8.1.3.15) as well as duty cycle can be
configured using configuration bytes (see Section 8.1.3.16).
The pulse width modulation resolution (PWMx_RESOLUTION_CONF) defines the
maximum number of pulses that are available in the given PWM period. PWM resolution
can be set independently for both outputs to either 6, 8, 10 or 12 bits.
The 2-bit PWMx_PRESCALE value divides the PWM input frequency (1695 kHz) by a
factor of 1, 2, 4 or 8.
Table 230. Pulse Width Modulation Frequency
Resolution
NTP53x2
Product data sheet
COMPANY PUBLIC
Pre-scalar
00b
01b
10b
12 bit
413 Hz
206 Hz
103 Hz
52 Hz
10 bit
1.7 kHz
825.0 Hz
412.6 Hz
206.2 Hz
8 bit
6.6 kHz
3.3 kHz
1.7 kHz
825.0 Hz
6 bit
26.4 kHz
13.2 kHz
6.6 kHz
3.3 kHz
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
11b
© NXP B.V. 2020. All rights reserved.
104 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
PWMx_ON and PWMx_OFF defines the starting point and end point of the PWMx output
is asserted to HIGH.
To calculate proper PWMx_ON (start of HIGH level) and PWMx_OFF (end of HIGH level)
values, PWMx_RESOLUTION_CONF value and PWM_PRESCALE values need to be
set to achieve desired PWM frequency. As an example 12-bit resolution is chosen. Duty
cycle shall be set to 20 % and start time shall be 10 % offset.
Start Time 10 %: 2
12
* 10/100= 4096 * 10/100 = ~410 -> PWMx_ON = 19Ah
PWM Duty Cycle 20 %: 2
= 1229 = 4CDh
0
12
* 20/100= 4096 * 20/100 = ~819 -> PWMx_OFF = 410 + 819
819
PWM_ON
4095 0
410
PWM_OFF
819
4095
410
1229
1229
aaa-035480
Figure 12. Pulse Width Modulation Example
How to use PWM in applications is described in AN11203.
8.3.5 Standby mode
To minimize overall current consumption, when the IC is supplied via VCC NTAG 5 link
2
can be set to standby mode by writing related session bit form NFC or I C perspective.
The IC will leave standby mode according to configuration when NFC field is detected,
automatically, or HPD pin gets pulled to HIGH for at least 20 µs and released again. In
standby mode the current is typically less than 6 µA.
Worst case standby current consumption values can be found in Section 10.1 table.
In case SDA/SCLGPIO/PWM pins are not used the pins can be left floating. However, to
ensure lowest standby current, following settings are needed:
CONFIG bytes USE_CASE_CONF shall be set in any case to GPIO/PWM, both pins
SDA_GPIO1 and SCL_GPIO0 shall be set as input using weak pull-up (GPIOx_IN in).
Block 37h: CONFIG_1, USE_CASE_CONF shall be set to GPIO/PWM (10b) and
CONFIG, GPIOx_IN, both shall be set to plain input with weak pullup (01b).
Block 39h: PWM_GPIO_CONFIG_0, SDA_GPIO1 and SCL_GPIO0 shall both be set to
1b to define them as general-purpose input.
8.3.6 Hard power-down mode
In hard power-down mode NTAG 5 link is switched off using hard power down pin. When
pulled to HIGH, the hard power down current is typically less than 0.25 µA. This mode
can only be left by connecting HPD pin to ground.
There is no hard power-down mode, when using SO8 packaged version of NTAG 5 link.
Worst case hard power down current consumption values can be found in Section 10.1
table.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
105 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
2
8.4 Arbitration between NFC and I C interface
There are different modes implement to ensure access to the EEPROM and described in
detail hereafter. Two status bits (I2C_IF_LOCKED and NFC_IF_LOCKED) are provided
to show the status of arbiter.
Details about the different arbitrations modes can be found in AN12364.
8.4.1 NFC Mode
If NTAG 5 link is only powered by NFC, arbiter needs only to lock to the NFC interface
if the IC receives a valid NFC command. After completion of the NFC command,
NFC_IF_LOCKED will be cleared automatically.
2
8.4.2 I C Mode
2
If NTAG 5 link is only powered by VCC, arbiter needs only to lock to the I C interface
if the IC is correctly addressed for the memory access. The host needs to clear
I2C_IF_LOCKED. Otherwise, the bit will be cleared automatically if the watchdog timer
expires.
2
In I C mode, availability of the SRAM as part of the memory depends on
SRAM_ENABLE bit.
8.4.3 Normal Mode
If NTAG 5 link is powered by NFC and VCC, arbiter locks interface on a first come first
serve principle.
2
When receiving a valid NFC command and access is not locked to I C, then the arbiter
locks to the NFC interface. After completion of the NFC command, the lock will be
released automatically. The host can access the registers at any time. Only access to
EEPROM is locked.
2
When NTAG 5 link is correctly addressed by its I C address for the memory access and
2
access is not locked to NFC, then the arbiter locks to the I C interface. The host needs
to clear the lock actively. If not, the lock will be released automatically as soon as the
watchdog timer expires. NFC reader can access the registers at any time. Only access to
EEPROM is locked.
In this mode, availability of the SRAM depends on SRAM_ENABLE bit.
How to exchange data based on NDEF messages is defined in NFC Forum Tag NDEF
Exchange Protocol (TNEP) Specification.
8.4.4 SRAM Mirror Mode
In this mode arbiter works like in normal mode with the exception, that SRAM is used
instead of EEPROM.
8.4.5 SRAM Pass-Through Mode
2
In this mode, the NTAG 5 link transfers data from NFC to I C and vice versa using the
SRAM. The arbiter switches automatically between the two interfaces when accessing
the terminator block (last block of SRAM).
Details can be found in AN12364.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
106 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
8.4.6 SRAM PHDC Mode
This mode is similar to SRAM mirror mode. This mode needs to be enabled, when PHDC
communication scheme as defined in NFC Forum PHDC specification shall be used.
NFC will always get a response when accessing SRAM.
8.5 Energy harvesting
NTAG 5 link provides the capability to supply external low-power devices with energy
harvested from the NFC field of an NFC device.
When DISABLE_POWER_CHECK bit is set to 0b, minimum provided output power can
be configured by setting desired voltage and minimum required output current in the
related configuration bytes (see Section 8.1.3.18).
WARNING: Sufficient RF field is required when DISABLE_ POWER_CHECK is
set to 0b to have access to EEPROM. As long as NTAG 5 link detects too less
energy to be harvested from the field only INVENTORY command and READ/WRITE
CONFIGURATION to access session registers will be handled. This feature ensures
a stable system, as the host will only be supplied if there is sufficient energy available.
However, during design phase we recommend disabling this power check.
The provided output power in general of course depends on many parameters like the
strength of the NFC field, the antenna size, or the distance from the NFC device. The
design ensures with the right settings, that VOUT is only enabled, when sufficient energy
can be harvested from the NFC field.
1.8 V, 2.4 V or 3 V output voltage can be selected by coding EH_VOUT_V_SEL
accordingly.
Minimum required load current can be coded in EH_VOUT_I_SEL configuration field.
VOUT and VCC need to be connected as soon as energy harvesting is used. Otherwise
there is no EEPROM access possible from NFC perspective and status registers may
contain invalid information.
Appropriate capacitor dependent on load needs to be placed between VOUT and ground
to close energy gaps during miller pauses. An example circuit is illustrated in the figure
below.
VOUT pin shall be kept floating (not connected) in case energy harvesting feature is not
used. If energy harvesting is disabled, pin will be connected to GND internally.
With EH_ENABLE configuration bit st to 1b, energy harvesting will be enabled after boot,
automatically and all energy harvesting-related session register bits are meaningless.
When enabling energy harvesting via session registers, EH_MODE, EH_VOUT_SEL
and EH_IOUT_SEL needs to be configured properly in the related configuration bytes.
EH_ENABLE configuration bit need to be 0b in this case.
After boot, session registers can be used to first trigger current detection by setting
EH_TRIGGER to 1b, then poll for EH_LOAD_OK that gets 1b and finally set
EH_TRIGGER and EH_ENABLE to 1b, or directly enable energy harvesting by setting
EH_TRIGGER and EH_ENABLE bit to 1b (see Table 97).
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
107 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
VOUT configurable to 1.8 V, 2.4 V or 3 V
1 µF
Rpu
VCC
tuning cap
VOUT
VDD
LA
HOST
LB
ED
GND
GND
optional open drain control
signal to control host
aaa-035476
Figure 13. Energy harvesting example circuit
How to use energy harvesting in applications is described in AN12365.
8.6 Security
NTAG 5 link implements different levels to protect data. The easiest, but efficient method
is to lock EEPROM to read only.
With the plain password authentication scheme, the memory can be split in three
different parts with different access conditions.
With NTP5332's mutual AES authentication the memory is split in three different parts
again, but with the advantage, that the password will never be transmitted in plain text.
Configuration area and SRAM can be protected from both interfaces as well.
Further implementation details can be found in AN12366.
8.6.1 Locking EEPROM to read only
Independent on the split of the memory, the user memory may be locked to read-only.
If the user EEPROM shall stay in read/write state, the LOCK BLOCK command can be
disabled (see Table 39) and lock block sections can be locked (see Table 80). With these
features, it can be ensured, NTAG 5 link stays in read/write state.
Locking the complete EEPROM to read-only as defined in NFC Forum Type 5 Tag
specification is quite time consuming. Every single block needs to be addressed by a
LOCK BLOCK command (see Section 8.2.3.5). To accelerate this locking, NTAG 5 link
stores the information in the configuration area. With this feature, locking the EEPROM
can be accelerated by a factor of 16. Note, that these bits are one time programmable
(see Section 8.1.3.30) and blocks are indicated as locked in the Get Multiple Block
Security Status response.
2
As long as I C Lock Block Configuration bytes are not set to 1b, the user EEPROM may
2
still be modified from I C perspective.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
108 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
Table 231. NFC Lock Block Configuration location
Block Address
NFC
I C
2
Byte 0
Byte 1
6Ah
106Ah
NFC_LOCK_BL0
NFC_LOCK_BL1
...
...
...
...
89h
1089h
NFC_LOCK_BL62
NFC_LOCK_BL63
Byte 2
Byte 3
RFU
RFU
2
Table 232. I C Lock Block Configuration location
Block Address
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
8Ah
108Ah
I2C_LOCK_BL0
I2C_LOCK_BL1
RFU
RFU
8Bh
108Bh
I2C_LOCK_BL2
I2C_LOCK_BL3
RFU
RFU
8.6.2 Memory Areas
The memory may be split into three different configurable areas with different access
conditions.
Highest priority has the 16-bit Protection Pointer PP_AREA_1. It splits the memory into
an AREA_0 and an AREA_1 at the address configured with the PP_AREA_1.
Restricted area AREA_1, starting from block address PP_AREA_1 is automatically
protected by the AREA_1 read and AREA_1 write password in plain password mode.
In AES mode, a key with read and write privilege is needed to be able to access the
restricted area.
2
2
To enable password protection to AREA_1 from I C perspective, I C passwords need to
2
be enabled by setting I C key header (I2C_KH) to active. In that case AREA_1 read and
write passwords need to be presented to NTAG 5 link.
2
The split configured with the 16-bit Protection Pointer is the same for both, NFC and I C
perspective.
The area below this address can be split into two more areas with the 8-bit
NFC_PP_AREA_0-H (see Section 8.1.3.28) and the 8-bit I2C_PP_AREA_0-H (see
2
Section 8.1.3.11), independently of the NFC and I C perspective.
NFC AREA_0-L, usually used to store NDEF messages, starts from block 0. NFC
AREA_0-H, usually used as password protected area to store private data, starts from
block address configured by the 8-bit NFC_PP_AREA_0H and ends just before the block
addressed with the PP_AREA_1 configuration byte. If PP_AREA_1 points outside the
addressable memory space, only AREA_0-L and AREA_0-H are available.
2
2
I C AREA_0-L starts from block 0. I C AREA_0-H, starts from the block address
configured by the 8-bit I2C_PP_AREA_0H.
The concept is illustrated in the Figure below and further details can be found in
AN12366.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
109 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
NFC
AREA_0-L
I 2C
AREA_0-L
8 - bit I2C_PP
8 - bit
NFC_PP_AREA_0-H
NFC
AREA_0-H
I 2C
AREA_0-L
16 - bit
PP_AREA_1
AREA_1
COUNTER
aaa-035479
Figure 14. Concept of memory areas
8.6.3 Plain password authentication
NTAG 5 link implements plain password authentication scheme from NFC perspective.
In summary, seven 32-bit passwords are available from NFC perspective.
•
•
•
•
•
•
•
Read
Write
Restricted AREA_1 Read
Restricted AREA_1 Write
Destroy
NFC Privacy password (is used to come out of NFC PRIVACY mode)
EAS/AFI protection
64-bit password protection can be enabled for read and write operations.
A 32-bit password is used to authenticate, before doing memory operations. The
mechanism is easy to use. After setting and locking the password, and setting right
access conditions in initialization phase, the NFC Device needs to fetch a random
number from the ICs. XORing the plain password and this random number results in
used password to authenticate.
2
From I C perspective, plain password authentication can be enabled with two 32-bit
passwords for the restricted AREA_1 and two for the rest of user EEPROM.
To resist brute force attacks, a negative authentication counter can be enabled.
How to use plain password authentication in applications is described in AN12366.
8.6.4 AES authentication
NTP5332 version of NTAG 5 link implements AES authentication from NFC perspective.
Highest security level of NTAG 5 link is AES mutual authentication based on the Crypto
Suite AES128 as defined in ISO/IEC 29167-10. A 128-bit password is used to (mutual)
authenticate, before doing memory operations.
2
From I C perspective, only plain password authentication can be enabled.
How to use AES authentication in applications is described in AN12366.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
110 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
8.7 NFC privacy mode
In the privacy mode, the NTAG 5 link is not traceable by its UID neither by data stored
in the user memory. All NTAG 5 link in the NFC PRIVACY mode will respond to an
Inventory command with the UID E0 04 00 00 00 00 00 00, consequently also the user
memory is NOT accessible.
NTOE: An anti-collision procedure is not possible in plain password mode.
In plain password mode ENABLE NFC PRIVACY Mode command (see
Section 8.2.3.3.9) with a valid privacy password is used to set NTAG 5 link to this mode
and DISABLE NFC PRIVACY (see Section 8.2.3.3.10) is used to disable it again.
In AES mode, a valid mutual authentication (see Section 8.2.3.4.4) with the vendorspecific Purpose_MAM2[3:0] (see Table 164) and a key with the privacy privilege set to
1b is needed to enable using Purpose_MAM2 = 1001b and disable the NFC PRIVACY
mode using Purpose_MAM2 = 1000b until next NFC field reset or 1010b permanently.
NTAG 5 link in NFC PRIVACY mode only support following commands:
•
•
•
•
•
•
•
•
INVENTORY
SELECT
STAY QUIET
RESET TO READY
PICK RANDOM ID (in AES mode to allow an anti-collision procedure)
GET RANDOM NUMBER
DISABLE NFC PRIVACY in plain password mode
AUTHENTICATE
8.8 Programmable Originality signature
NTAG 5 link original signature is based on standard Elliptic Curve Cryptography (curve
name secp128r1), according to the ECDSA algorithm. The use of a standard algorithm
and curve ensures easy software integration of the originality check procedure in NFC
devices without specific hardware requirements.
The UID is signed with an NXP private key and the resulting 32 byte signature is stored
in the configuration memory during IC production.
The originality signature is stored in the configuration memory block 00h to block 07h.
Table 233. 32 Byte Originality Signature
Block Address
NTP53x2
Product data sheet
COMPANY PUBLIC
NFC
I C
2
Byte 0
Byte 1
Byte 2
Byte 3
00h
1000h
SIG0 (LSB)
SIG1
SIG2
SIG3
01h
1001h
SIG4
SIG5
SIG6
SIG7
02h
1002h
SIG8
SIG9
SIG10
SIG11
03h
1003h
SIG12
SIG13
SIG14
SIG15
04h
1004h
SIG16
SIG17
SIG18
SIG19
05h
1005h
SIG20
SIG21
SIG22
SIG23
06h
1006h
SIG24
SIG25
SIG26
SIG27
07h
1007h
SIG28
SIG29
SIG30
SIG31 (MSB)
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
111 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
This signature can be retrieved using the READ_SIGNATURE command or with
the READ CONFIG command and can be verified in the NFC device by using the
corresponding ECC public key provided by NXP. In case the NXP public key is stored
in the reader device, the complete signature verification procedure can be performed
offline.
To verify the signature (for example with the use of the public domain crypto library
OpenSSL) the tool domain parameters shall be set to secp128r1, defined within the
standards for elliptic curve cryptography SEC.
NTAG 5 link provides the possibility to customize the originality signature to personalize
the IC individually for specific application. At delivery, the NTAG 5 link is pre-programmed
with the NXP originality signature described above. This signature is unlocked in the
dedicated memory. If needed, the signature can be reprogrammed with a custom-specific
signature using the WRITE CONFIG command during the personalization process by
the customer. The signature can be permanently locked afterwards by setting the Config
Header to “locked” with the WRITE CONFIG command to avoid further modifications.
In any case, it is recommended to permanently lock the originality signature during the
initialization process by setting the Config Header to lock with the WRITE CONFIG
command.
How to use and verify Originality Signature in applications is described in AN11350.
How to generate Originality Signature is described in AN11859.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
112 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
9
Limiting values
Table 234. Limiting values In accordance with the Absolute Maximum Rating System (IEC 60134).
Symbol
Parameter
Conditions
Tstg
storage temperature
all packages
Tj
junction temperature
Tj
VESD
Min
Max
Unit
-65
+150
°C
EEPROM write operation
-
+95
°C
junction temperature
EEPROM read, SRAM and
register operation
-
+115
°C
electrostatic discharge voltage
charged device model (CDM)
-2
2
kV
-2
2
kV
[1]
human body model (HBM)
[2]
VCC
supply voltage
on pin VCC
-0.5
7.15
V
Vi
input voltage
on pin SDA, SCL,ED, HPD
-0.5
7.15
V
VI (RF)
RF input voltage
on pin LA/LB
-0.5
5.2
Vp
Vi
input voltage
on pin LA; LB is 0 V; sine wave
of 13.56 MHz
-0.5
5.2
Vp
on pin LB; LA is 0 V; sine wave
of 13.56 MHz
-0.5
5.2
Vp
La/Lb; peak
-168
168
mA
Ii(max)
[1]
[2]
maximum input current
According to ANSI/ESDA/JEDEC JS-002.
According to ANSI/ESDA/JEDEC JS-001.
NTP53x2
Product data sheet
COMPANY PUBLIC
All information provided in this document is subject to legal disclaimers.
Rev. 3.3 — 3 July 2020
544533
© NXP B.V. 2020. All rights reserved.
113 / 133
NTP53x2
NXP Semiconductors
2
NTAG 5 link - NFC Forum-compliant I C bridge
10 Characteristics
10.1 Static Characteristics
Table 235. Characteristics
Symbol
Parameter
Conditions
Min
fi
input frequency
ISO/IEC 15693
Ci
input capacitance
LA-LB, Pin capacitance,
VLA-LB @ 1.8Vp, Network
Analyzer (13.56 MHz)
@Room temp
Ri
Impedance from LA to LB
Typ
Max
Unit
General
13.553
13.56
13.567
MHz
-
15
-
pF
VLALB=1.8Vpp
30
-
-
kΩ
Operating conditions
Tamb
ambient temperature
Tj
工商网监
湘ICP备2023018690号
