CR95HF
13.56-MHz multi-protocol contactless transceiver IC
with SPI and UART serial access
Datasheet - production data
• Communication interfaces with a Host
Controller
– Serial peripheral interface (SPI) Slave
interface
– Universal asynchronous
receiver/transmitter (UART)
– Up to 528-byte command/reception buffer
(FIFO)
• 32-lead, 5x5 mm, very thin fine pitch quad flat
(VFQFPN) ECOPACK®2 package
VFQFPN32 5x5 mm
Applications
Features
Typical protocols supported:
• CR95HF belongs to the ST25 family which
includes all ST’s NFC/RFID tag and reader
products
• ISO/IEC 14443-3 Type A and B tags
• ISO/IEC 15693 tags
• ISO/IEC 18000-3M1 tags
• Operating modes supported:
– Reader/Writer
• NFC Forum tags: Types 1, 2, 3 and 4
• Hardware features
– Dedicated internal frame controller
– Highly integrated Analog Front End (AFE)
for RF communications
– Transmission and reception modes
– Optimized power management
– Tag Detection mode
• ST long-range interface (LRI) tags
• ST short-range interface (SRI) tags
• ST Dual Interface EEPROM
• RF communication @13.56 MHz
– ISO/IEC 14443 Type A and B
– ISO/IEC 15693
– ISO/IEC 18092
– MIFARE® Classic compatible (a) (b)
a. MIFARE and MIFARE Classic are registered
trademarks of NXP B.V. and are used under license.
b. Parity Framing mode is compatible with
MIFARE® Classic requirements. However, access to
Authenticated state must be supported by an external
secure host which embeds the MIFARE® Classic
library.
November 2016
This is information on a product in full production.
DocID018669 Rev 11
1/77
www.st.com
Contents
CR95HF
Contents
1
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.1
Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.2
List of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2
Pin and signal descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3
Power management and operating modes . . . . . . . . . . . . . . . . . . . . . . 11
4
5
3.1
Operating modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
3.2
Startup sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Communication protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.1
Universal asynchronous receiver/transmitter (UART) . . . . . . . . . . . . . . . 14
4.2
Serial peripheral interface (SPI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.2.1
Polling mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.2.2
Interrupt mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.3
Error codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.4
Support of long frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.1
Command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.2
List of commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.3
IDN command (0x01) description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.4
Protocol Select command (0x02) description . . . . . . . . . . . . . . . . . . . . . . 20
5.5
Send Receive (SendRecv) command (0x04) description . . . . . . . . . . . . . 25
5.6
Idle command (0x07) description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.6.1
Idle command parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.6.2
Using LFO frequency setting to reduce power consumption . . . . . . . . . 33
5.6.3
Optimizing wake-up conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
5.6.4
Using various techniques to return to Ready state . . . . . . . . . . . . . . . . 34
5.6.5
Tag detection calibration procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
5.7
Read Register (RdReg) command (0x08) description . . . . . . . . . . . . . . . 37
5.8
Write Register (WrReg) command (0x09) description . . . . . . . . . . . . . . . 38
5.8.1
2/77
Improving RF performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
DocID018669 Rev 11
CR95HF
6
7
Contents
Improving frame reception for ISO/IEC 14443 Type A tags . . . . . . . . . . 40
5.8.3
Improving RF reception for ISO/IEC 18092 tags . . . . . . . . . . . . . . . . . . 40
5.9
BaudRate command (0x0A) description . . . . . . . . . . . . . . . . . . . . . . . . . . 41
5.10
Echo command (0x55) description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Electrical characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
6.1
Absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
6.2
DC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
6.3
Power consumption characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
6.4
SPI characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
6.5
RF characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
6.6
Oscillator characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
7.1
8
5.8.2
VFQFPN32 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Part numbering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Appendix A Additional Idle command description . . . . . . . . . . . . . . . . . . . . . . . 53
Appendix B Example of tag detection calibration process . . . . . . . . . . . . . . . . 54
Appendix C Example of tag detection command using
results of tag detection calibration . . . . . . . . . . . . . . . . . . . . . . . . . 57
Appendix D Examples of CR95HF command code to
activate NFC Forum and ISO/IEC 15693 tags . . . . . . . . . . . . . . . . . 58
D.1
D.2
ISO/IEC 14443 Type A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
D.1.1
NFC Forum Tag Type 1 (Topaz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
D.1.2
NFC Forum Tag Type 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
D.1.3
NFC Forum Tag Type 2 or 4: Using split frames to resolve collisions . . 61
D.1.4
NFC Forum Tag Type 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
D.1.5
NFC Forum Tag Type 4A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
ISO/IEC 14443 Type B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
D.2.1
D.3
NFC Forum Tag Type 4B . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
ISO/IEC 18092 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
D.3.1
NFC Forum Tag Type 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
DocID018669 Rev 11
3/77
4
Contents
CR95HF
D.4
ISO/IEC 15693 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
D.4.1
ISO/IEC 15693 tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
4/77
DocID018669 Rev 11
CR95HF
List of tables
List of tables
Table 1.
Table 2.
Table 3.
Table 4.
Table 5.
Table 6.
Table 7.
Table 8.
Table 9.
Table 10.
Table 11.
Table 12.
Table 13.
Table 14.
Table 15.
Table 16.
Table 17.
Table 18.
Table 19.
Table 20.
Table 21.
Table 22.
Table 23.
Table 24.
Table 25.
Table 26.
Table 27.
Table 28.
Table 29.
Table 30.
Table 31.
Table 32.
Table 33.
Table 34.
Table 35.
Table 36.
Table 37.
Table 38.
Table 39.
Table 40.
List of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
CR95HF pin descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
CR95HF operating modes and states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Select serial communication interface selection table . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Interpretation of flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Possible error codes and their meaning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Format of ResultCode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Examples of ResultCode: Len pairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
List of CR95HF commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
IDN command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
ProtocolSelect command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
List of values for the ProtocolSelect command for different protocols . . . 21
SendRecv command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
List of Send values for the SendRecv command for different protocols . . . . . . . . 26
List of Response values for the SendRecv command for different protocols . . . . 28
Structure of Parity byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Idle command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Idle command structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Summary of Idle command parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
RdReg command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
WrReg command description (Modulation Index and Receiver Gain) . . . . . . . . . . . . . . . . 38
Possible Modulation Index values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Possible Receiver Gain values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
ARC_B default code for available Reader protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
WrReg command description (Timer Window) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
BaudRate command description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Echo command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
DC characteristics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Power consumption characteristics (VPS_Main from 2.7 to 3.3 V) . . . . . . . . . . . . . . . . . . 43
Power consumption characteristics (VPS_TX from 2.7 to 3.3 V) . . . . . . . . . . . . . . . . . . . . 43
Power consumption characteristics (VPS_TX from 4.5 to 5.5 V) . . . . . . . . . . . . . . . . . . . . 44
SPI interface characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Reader characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
HFO 27.12 MHz oscillator characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very thin profile fine pitch
quad flat package mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Ordering information scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Wake-up source register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Wake-up event register. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
DocID018669 Rev 11
5/77
5
List of figures
CR95HF
List of figures
Figure 1.
Figure 2.
Figure 3.
Figure 4.
Figure 5.
Figure 6.
Figure 7.
Figure 8.
Figure 9.
Figure 10.
Figure 11.
Figure 12.
Figure 13.
Figure 14.
Figure 15.
Figure 16.
Figure 17.
Figure 18.
6/77
CR95HF application overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
CR95HF block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
CR95HF pinout description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
CR95HF initialization and operating state change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Power-up sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
UART communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Echo command and response example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Sending command to CR95HF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Polling the CR95HF until it is ready . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Reading data from CR95HF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Reset the CR95HF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Long frame format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Data transfer (in both command and response) when Parity Framing mode is enabled . . 28
SPI timing diagram (Slave mode and CPOL = 0, CPHA = 0) . . . . . . . . . . . . . . . . . . . . . . 45
SPI timing diagram (Slave mode and CPOL = 1, CPHA = 1) . . . . . . . . . . . . . . . . . . . . . . . 46
Typical application with a 27.12 MHz crystal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very thin profile fine pitch
quad flat package outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very thin profile fine pitch
quad flat package recommended footprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
DocID018669 Rev 11
CR95HF
1
Description
Description
The CR95HF is an integrated transceiver IC for contactless applications.
The CR95HF manages frame coding and decoding in Reader mode for standard
applications such as near field communication (NFC), proximity and vicinity standards.
The CR95HF embeds an Analog Front End to provide the 13.56 MHz Air Interface.
The CR95HF supports ISO/IEC 14443 Type A and B, ISO/IEC 15693 (single or double
subcarrier) and ISO/IEC 18092 communication protocols.
The CR95HF also supports the detection, reading and writing of NFC Forum Type 1, 2, 3
and 4 tags.
Figure 1. CR95HF application overview
Interrupt Management
CR95HF
Host
Controller
(MCU)
SPI
UART
1.1
Block diagram
Figure 2. CR95HF block diagram
27.12 MHz
VPS_Main
GND_Dig
XIN
XOUT
VPS_TX
CR95HF
AFE IP
Status
registers
Host
(User
Side)
Power & Clock
Management
Digital
Tag
Detector
Tag
Detector
AFE
User interface
Frame Controller
Reader
Mod/
Demod
Timer
Accelerators
TX2
GND_TX
Signal
Mux
SPI
UART
Interrupt
TX1
RX1
ISO/IEC 14443
Type A and B
ISO/IEC 15693
ISO/IEC 18092
Configuration
register
FIFO
Encoder/Decoder
RX2
GND_RX
DocID018669 Rev 11
7/77
10
Description
1.2
CR95HF
List of terms
Table 1. List of terms
Term
8/77
Meaning
DAC
Digital analog converter
GND
Ground
HFO
High frequency oscillator
LFO
Low frequency oscillator
MCU
Microcontroller unit
NFC
Near Field Communication
RFID
Radio Frequency Identification
RFU
Reserved for future use
SPI
Serial peripheral interface
tL
Low frequency period
tREF
Reference time
UART
Universal asynchronous receiver-transmitter
WFE
Wait For Event
DocID018669 Rev 11
CR95HF
Pin and signal descriptions
25
1
TX1
NC
NC
NC
NC
XIN
XOUT
GND_TX
Figure 3. CR95HF pinout description
VPS_TX
2
Pin and signal descriptions
TX2
NC
NC
NC
GND
NC
ST_R1
RX1
SSI_1
RX2
SSI_0
NC
SPI_SCK
GND_RX
17
9
SPI_MISO
SPI_SS
UART_TX / IRQ_OUT
VPS
UART_RX / IRQ_IN
NC
NC
ST_R0
Shaded area represents the dissipation pad.
(Must be connected to ground.)
SPI_MOSI
Table 2. CR95HF pin descriptions
Pin
Pin name
Type(1)
Main function
1
TX1
O
Driver output 1
2
TX2
O
Driver output 2
3
NC
Not connected
4
NC
Not connected
5
RX1
I
Receiver input 1
6
RX2
I
Receiver input 2
7
NC
8
GND_RX
P
Ground (analog)
9
ST_R0
O
ST Reserved(2)
10
NC
Not connected
11
NC
Not connected
Alternate function
Not connected
DocID018669 Rev 11
9/77
10
Pin and signal descriptions
CR95HF
Table 2. CR95HF pin descriptions (continued)
Pin
Pin name
12
UART_RX / IRQ_IN
13
VPS
14
15
UART_TX / IRQ_OUT
SPI_SS
Type(1)
Main function
(3)
UART receive pin
P
Main power supply
I
O
(5)
(6)
I
(6)
(4)
UART transmit pin
SPI Slave Select (active low)
16
SPI_MISO
O
17
SPI_MOSI
I (6)
SPI Data, Slave Input (6)
18
SPI_SCK
I (7)
SPI serial clock
19
SSI_0
I (6)
Select serial communication
interface
20
SSI_1
I (6)
Select serial communication
interface
21
ST_R1
I (8)
ST Reserved
22
GND
23
NC
Not connected
24
NC
Not connected
25
NC
Not connected
26
NC
Not connected
27
NC
Not connected
28
NC
Not connected
29
XIN
Crystal oscillator input
30
XOUT
Crystal oscillator output
31
GND_TX
P
Ground (RF drivers)
32
VPS_TX
P
Power supply (RF drivers)
P
SPI Data, Slave Output
Ground (digital)
1. I: Input, O: Output, and P: Power
2. Must add a capacitor to ground (~1 nF).
3. Pad internally connected to a Very Weak Pull-up to VPS.
4. We recommend connecting this pin to the VPS pin using a 3.3 kOhm pull-up resistor.
5. Pad internally connected to a Weak Pull-up to VPS.
6. Must not be left floating.
7. Pad internally connected to a Weak Pull-down to GND.
8. Pad input in High Impedance. Must be connected to VPS.
10/77
DocID018669 Rev 11
Alternate function
Interrupt input
Interrupt output
CR95HF
Power management and operating modes
3
Power management and operating modes
3.1
Operating modes
The CR95HF has 2 operating modes: Wait for Event (WFE) and Active. In Active mode, the
CR95HF communicates actively with a tag or an external host (an MCU, for example). WFE
mode includes four low consumption states: Power-up, Hibernate, Sleep and Tag Detector.
The CR95HF can switch from one mode to another.
Table 3. CR95HF operating modes and states
Mode
Wait For
Event
(WFE)
State
Description
Power-up
This mode is accessible directly after POR.
Low level on IRQ_IN pin (longer than 10 µs) is the only wakeup
source. LFO (low-frequency oscillator) is running in this state.
Hibernate
Lowest power consumption state. The CR95HF has to be woken-up
in order to communicate. Low level on IRQ_IN pin (longer than 10
µs) is the only wakeup source.
Sleep
Low power consumption state. Wakeup source is configurable:
– Timer
– IRQ_IN pin
– SPI_SS pin
LFO (low-frequency oscillator) is running in this state.
Tag Detector
Low power consumption state with tag detection. Wakeup source is
configurable:
– Timer
– IRQ_IN pin
– SPI_SS pin
– Tag detector
LFO (low-frequency oscillator) is running in this state.
Ready
In this mode, the RF is OFF and the CR95HF waits for a command
(PROTOCOLSELECT, ...) from the external host via the selected serial
interface (UART or SPI).
Reader
The CR95HF can communicate with a tag using the selected
protocol or with an external host using the selected serial interface
(UART or SPI).
Active
Hibernate, Tag Detector, and Sleep states can only be activated by a command from the
external host. As soon as any of these three states are activated, the CR95HF can no
longer communicate with the external host. It can only be woken up.
The behavior of the CR95HF in 'Tag Detector' state is defined by the Idle command.
DocID018669 Rev 11
11/77
76
Power management and operating modes
CR95HF
Figure 4. CR95HF initialization and operating state change
Supply off
POR
POR sequence
Wake-up event
Idle command
Protocol Select
WFE
Hibernate
Power-up
IRQ_IN
Sleep
IRQ_IN
Serial I/F
selection
SPI
Reset
Tag Detector
IRQ_IN
(& Calibration )
TimeOut
Tag Detection
Active
Ready
3.2
Protocol Select
Reader
Startup sequence
After the power supply is established at power-on, the CR95HF waits for a low pulse on the
pin IRQ_IN (t1) before automatically selecting the external interface (SPI or UART) and
entering Ready state after a delay (t3).
Figure 5. Power-up sequence
T
603
33)?
T
33)?
)21?).
T
T
&IRSTVALID
COMMAND
T
-36
1. Note for pin SSI0: - - - SPI selected, –––– UART selected
2. Pin IRQ_IN low level < 0.2 VPS_Main.
Note:
12/77
When CR95HF leaves WFE mode (from Power-up, Hibernate, Tag Detector, or Sleep)
following an IRQ_IN/RX low level pulse, this pulse is NOT interpreted as the UART start bit
character.
DocID018669 Rev 11
CR95HF
Power management and operating modes
Figure 5 shows the power-up sequence for a CR95HF device; where,
•
•
•
•
•
Note:
t0 is the initial wake-up delay
t1 is the minimum interrupt width
t2 is the delay for the serial interface selection
t3 is the HFO setup time (tSU(HFO))
t4 is the VPS ramp-up time from 0V to VPS
100 µs (minimum)
10 µs (minimum)
250 ns (typical)
10 ms (maximum)
10 ms (max. by design validation)
VPS must be 0V before executing the start-up sequence.
The serial interface is selected after the following falling edge of pin IRQ_IN when leaving
from POR or Hibernate state.
Table 4 lists the signal configuration used to select the serial communication interface.
Table 4. Select serial communication interface selection table
Pin
Serial interface
SSI_0
UART: 0
SPI: 1
SSI_1
UART: 0
SPI: 0
DocID018669 Rev 11
13/77
76
Communication protocols
CR95HF
4
Communication protocols
4.1
Universal asynchronous receiver/transmitter (UART)
The host sends commands to the CR95HF and waits for replies. Polling for readiness is not
necessary. The default baud rate is 57600 baud. The maximum allowed baud rate is
2 Mbps.
Figure 6. UART communication
Sending commands to the CR95HF
CMD
LEN
DATA
DATA
Several data bytes
Receiving data from the CR95HF
Resp Code
LEN
DATA
DATA
Several data bytes
When sending commands, no data must be sent if the LEN field is zero.
When receiving data from the CR95HF, no data will be received if the LEN field is zero.
The formats of send and receive packets are identical.
If an ECHO command is sent, only one byte (0x55) is sent by the host.
Figure 7 shows an example of an ECHO command.
Figure 7. ECHO command and response example
CR95HF
Internal
Clock
0
1
2
3
4
5
6
7
Host to CR95HF
RX (Echo 0x55)
0
(Start)
1
0
1
0
1
0
1
0
1
1
(Stop)
TX
CR95HF to Host
RX
TX (Echo 0x55)
0
(Start)
1
0
1
0
1
0
1
0
1
1
(Stop)
Ai18122a
Caution:
UART communication is LSB first. Stop bit duration is two Elementary Time Units
(ETUs).
Note:
1
When CR95HF leaves WFE mode (from Power-up, Hibernate, Sleep Detector or Tag
Detector) following an |RQ_IN/RX low level pulse, this pulse is NOT interpreted as the UART
start bit character.
2
If the user loses UART synchronization, it can be recovered by sending an ECHO command
until a valid ECHO reply is received. Otherwise, after a maximum of 528 ECHO commands,
14/77
DocID018669 Rev 11
CR95HF
Communication protocols
CR95HF will reply with an error code meaning its input buffer is full. The user can now
restart a UART exchange.
4.2
Serial peripheral interface (SPI)
4.2.1
Polling mode
In order to send commands and receive replies, the application software has to perform 3
steps.
1. Send the command to the CR95HF.
2. Poll the CR95HF until it is ready to transmit the response.
3. Read the response.
The application software should never read data from the CR95HF without being sure that
the CR95HF is ready to send the response.
The maximum allowed SPI communication speed is fSCK.
A Control byte is used to specify a communication type and direction:
•
0x00: Send command to the CR95HF
•
0x03: Poll the CR95HF
•
0x02: Read data from the CR95HF
•
0x01: Reset the CR95HF
The SPI_SS line is used to select a device on the common SPI bus. The SPI_SS pin is
active low.
When the SPI_SS line is inactive, all data sent by the Master device is ignored and the
MISO line remains in High Impedance state.
Figure 8. Sending command to CR95HF
MOSI
00000000
CMD
LEN
DATA
Several data bytes
Control Byte
MISO
DATA
XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
Figure 9. Polling the CR95HF until it is ready
MOSI
00000011
XXXXXX11
Control Byte
MISO
XXXXXXXX
00000XXX
XXXXXX11 XXXXXX11
Flag
Flag
00000XXX
00001XXX
Flags are polled until data is ready (Bit 3 is set when data is ready)
DocID018669 Rev 11
15/77
76
Communication protocols
CR95HF
Table 5. Interpretation of flags
Bit
[7:4]
Meaning (Application point of view)
Not significant
3
Data can be read from the CR95HF when set.
2
Data can be sent to the CR95HF when set.
[1:0]
Not significant
Figure 10. Reading data from CR95HF
MOSI
00000010
XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
Control Byte
MISO
XXXXXXXX
Resp Code
LEN
DATA
DATA
Several data bytes
Data must be sampled at the rising edge of the SCK signal.
‘Sending’, ‘Polling’ and ‘Reading’ commands must be separated by a high level of the
SPI_SS line. For example, when the application needs to wait for data from the CR95HF, it
asserts the SPI_SS line low and issues a ‘Polling’ command. Keeping the SPI_SS line low,
the Host can read the Flags Waiting bit which indicates that the CR95HF can be read. Then,
the application has to assert the SPI_SS line high to finish the polling command. The Host
asserts the SPI_SS line low and issues a ‘Reading’ command to read data. When all data is
read, the application asserts the SPI_SS line high.
The application is not obliged to keep reading Flags using the Polling command until the
CR95HF is ready in one command. It can issue as many 'Polling' commands as necessary.
For example, the application asserts SPI_SS low, issues 'Polling' commands and reads
Flags. If the CR95HF is not ready, the application can assert SPI_SS high and continue its
algorithm (measuring temperature, communication with something else). Then, the
application can assert SPI_SS low again and again issue 'Polling' commands, and so on, as
many times as necessary, until the CR95HF is ready.
Note that at the beginning of communication, the application does not need to check flags to
start transmission. The CR95HF is assumed to be ready to receive a command from the
application.
Figure 11. Reset the CR95HF
MOSI
00000001
Control Byte 01
MISO
XXXXXXXX
To reset the CR95HF using the SPI, the application sends the SPI Reset command (Control
Byte 01, see Figure 11) which starts the internal controller reset process and puts the
CR95HF into Power-up state. The CR95HF will wake up when pin IRQ_IN goes low. The
CR95HF reset process only starts when the SPI_SS pin returns to high level.
Caution:
16/77
SPI communication is MSB first.
DocID018669 Rev 11
CR95HF
4.2.2
Communication protocols
Interrupt mode
When the CR95HF is configure to use the SPI serial interface, pin IRQ_OUT is used to give
additional information to user. When the CR95HF is ready to send back a reply, it sends an
Interrupt Request by setting a low level on pin IRQ_OUT, which remains low until the host
reads the data.
The application can use the Interrupt mode to skip the polling stage.
Caution:
SPI communication is MSB first.
4.3
Error codes
Table 6. Possible error codes and their meaning
Code
Name
Meaning
0X63
EEmdSOFerror23
SOF error in high part (duration 2 to 3 etu) in ISO/IEC 14443B
0x65
EEmdSOFerror10
SOF error in low part (duration 10 to 11 etu) in ISO/IEC 14443B
0x66
EEmdEgt error
Extennded Guard Time error in ISO/IEC 14443B
0x67
ETr1 Too Big Too long
TR1 send by the card, reception stopped in ISO/IEC 14443BT
0x68
ETr1Too small Too
small
TR1 send by the card in ISO/IEC 14443B
0x71
EinternalError
Wrong frame format decodes
0x80
EFrameRecvOK
Frame correctly received (additionally see CRC/Parity
information)
0x85
EUserStop
Stopped by user (used only in Card mode)
0x86
ECommError
Hardware communication error
0x87
EFrameWaitTOut
Frame wait time out (no valid reception)
0x88
EInvalidSof
Invalid SOF
0x89
EBufOverflow
Too many bytes received and data still arriving
0x8A
EFramingError
if start bit = 1 or stop bit = 0
0x8B
EEgtError
EGT time out
0x8C
EInvalidLen
Valid for ISO/IEC 18092, if Length >> Frame sent by the Host to CR95HF
>0x0100
0x02 02 01 07
L 100 S: >>>0x02 02 01 21
L 100 D: >>>0x02 02 01 23
L 10 S: >>>0x02 02 01 25
L 10 D: >>>0x02 02 01 27
In these examples, the CRC is
automatically appended.
Append CRC if set to ‘1’.
(1)
DocID018669 Rev 11
21/77
76
Commands
CR95HF
Table 12. List of values for the PROTOCOLSELECT command for different
protocols (continued)
Parameters
Protocol
Code
Examples of commands
Byte
ISO/IEC 14443
Type A
NFC Forum Tag
Type 1
(Topaz)
NFC Forum Tag
Type 2
NFC Forum Tag
Type 4A
22/77
Bit
Function
7:6
Transmission data rate
00: 106 Kbps
01: 212 Kbps (2)
10: 424 Kbps
11: RFU
5:4
Reception data rate
00: 106 Kbps
01: 212 Kbps (2)
10: 424 Kbps
11: RFU
3
RFU
2:0
RFU
1
7:0
PP
2
7:0
MM
3
7:0
DD (optional to PP:MM)
4
7:0
ST Reserved (Optional)
5
7:0
ST Reserved (Optional)
0
0x02
DocID018669 Rev 11
>>>0x02020200: ISO/IEC
14443 Type A tag, 106 Kbps
transmission and reception
rates, Time interval 86/90
Note that REQA, WUPA,
Select20 and Select70
commands use a fixed interval
of 86/90 µs between a request
and its reply. Other commands
use a variable interval with
fixed granularity.
Refer to the ISO/IEC 14443
standard for more details.
These 5 bytes are optional. The
default PP:MM:DD value is 0
(corresponds to FDT 86/90µs) .
For other values, FDT =
(2^PP)*(MM+1)*(DD+128)
*32/13.56 µs
CR95HF
Commands
Table 12. List of values for the PROTOCOLSELECT command for different
protocols (continued)
Parameters
Protocol
Code
Examples of commands
Byte
Bit
7:6
Transmission data rate
00: 106 Kbps
01: 212 Kbps
10: 424 Kbps
11: 848 Kbps
5:4
Reception data rate
00: 106 Kbps
01: 212 Kbps
10: 424 Kbps
11: 848 Kbps
3:1
RFU
0
0
ISO/IEC 14443
Type B
0x03
NFC Forum Tag
Type 4B
Function
>>>0x02020301:
ISO/IEC 14443 Type B tag with
CRC appended
Append CRC if set to ‘1’.
(1)
These 9 bytes are optional.
Default value of PP:MM:DD is 0
and corresponds to FWT
~302µs.
FWT =
(2^PP)*(MM+1)*(DD+128)*
32/13.56 µs
1
7:0
PP
2
7:0
MM
3
7:0
DD (optional to PP:MM)
5:4
7:0
TTTT (Optional)
TR0 = TTTT/FC (LSB first),
default 1023 = 0x3FF
6
7:0
YY (Optional)
PCD Min TR1 (Min_TR1 = 8 *
XX / fS), default = 0
7
7:0
ZZ (Optional)
PCD Max TR1 (Max_TR1 = 8 *
ZZ / fS), default = 26 = 0x1A
8
7:0
ST Reserved (Optional)
9
7:0
ST Reserved (Optional)
DocID018669 Rev 11
23/77
76
Commands
CR95HF
Table 12. List of values for the PROTOCOLSELECT command for different
protocols (continued)
Parameters
Protocol
Code
Examples of commands
Byte
Bit
7:6
Transmission data rate
00: RFU
01: 212 Kbps
10: 424 Kbps
11: RFU
5:4
Reception data rate
00: RFU
01: 212 Kbps
10: 424 Kbps
11: RFU
3:1
RFU
0
0
ISO/IEC 18092
NFC Forum Tag
Type 3
7:5
0x04
Function
4
1
3:0
Append CRC if set to ‘1’.
(1)
RFU
0: FWT = 2.4 ms
1: FWT is specified by
PP:MM bits
Slot counter
0: 1 slot
1: 2 slots
…
F: 16 slots
2
7:0
PP
3
7:0
MM
4
7:0
DD (optional to PP:MM)
1. It is recommended to set this bit to ‘1’.
2. Not characterized.
24/77
DocID018669 Rev 11
>>>0x02020451:
ISO/IEC18092 tag, 212 Kbps
transmission and reception
rates with CRC appended.
Parameter ‘Slot counter’ is not
mandatory. If it is not present, it
is assumed that SlotCounter =
0x00 (1 slot)
For device detection
commands, byte 1 bit 4 must
be set to ‘0’. In this case, the
FWT is 2.4 ms for the 1st slot
and 1.2 ms more for each
following slot, if slot counter is
specified.
If slot counter = 0x10, the
CR95HF does not respect reply
timings, but polls incoming data
and searches a valid response
during ~8.4 ms.
These 3 bytes are optional.
Default value PP:MM:DD: is 0
and corresponds to RWT
~302µs.
RWT = (2^PP)*(MM+1)*
(DD+128)*32/13.56µs
CR95HF
5.5
Commands
Send Receive (SendRecv) command (0x04) description
This command sends data to a contactless tag and receives its reply.
Before sending this command, the Host must first send the PROTOCOLSELECT command to
select an RF communication protocol.
If the tag response was received and decoded correctly, the field can contain
additional information which is protocol-specific. This is explained in Table 14.
Table 13. SENDRECV command description
Direction
Host to
CR95HF
CR95HF to
Host
Data
0x04
Command code
Length of data
Data to be sent
0x80
Result code
Length of data
CR95HF to
Host
Comments
Example
See Table 14 and Table 18 for detailed
examples.
0x0803620100
Reads the Wake-up event register.
>> CR95HFDLL_SENDRECV, 02 00 A4040007D2760000850100 28
> CR95HFDLL_SENDRECV, 03 00 A4000002E103 28
> CR95HFDLL_SENDRECV, 02 00 B000000F 28
> CR95HFDLL_SENDRECV, 03 00 A40000020001 28
> CR95HFDLL_SENDRECV, 02 00 B0000002 28
> CR95HFDLL_SENDRECV, 03 00 A40000020001 28
> CR95HFDLL_SENDRECV, 02 00 B0000215 28
> CR95HFDLL_STCMD, 01 02020000
> CR95HFDLL_STCMD, 01 020403010180
> CR95HFDLL_STCMD, 01 090468010130
> CR95HFDLL_STCMD, 01 04 03 050000
> CR95HFDLL_STCMD, 01 04 09 1D AABBCCDD00070100
> CR95HFDLL_SENDRECV,
02
00 A4 040007D2760000850100
> CR95HFDLL_SENDRECV, 03 00 A4 0000 02 E103
> CR95HFDLL_SENDRECV, 02 00 B0 0000 0F
> CR95HFDLL_SENDRECV, 03
00 A4 0000 02 0001
> CR95HFDLL_SENDRECV, 02 00 B0 0000 02
> CR95HFDLL_SENDRECV, 03 00 A4 0000 02 0001
> CR95HFDLL_SENDRECV, 02 00 B0 0002 13
> CR95HFDLL_STCMD, 01 02020000
> CR95HFDLL_STCMD, 01 02020451
> CR95HFDLL_STCMD, 01 090468010150
> CR95HFDLL_STCMD, 01 09040A0102A1
> CR95HFDLL_STCMD, 01 04 05 00FFFF0000
> CR95HFDLL_STCMD, 01 02020105
> CR95HFDLL_STCMD, 01 090468010150
> CR95HFDLL_STCMD, 01 0403 260100
DocID018669 Rev 11
73/77
76
Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags
CR95HF
> CR95HFDLL_SENDRECV, 022B
> CR95HFDLL_STCMD, 01 02020105
> CR95HFDLL_STCMD, 01 090468010150
> CR95HFDLL_STCMD, 01 0403 260100
> CR95HFDLL_SENDRECV, 0A2B
工商网监
湘ICP备2023018690号
