ST25R95
Datasheet
Near field communication transceiver
Features
•
•
VFQFPN32
(5x5 mm)
•
•
•
Product status link
ST25R95
•
Belonging to ST25 family that includes all NFC/RF ID tag and reader products
from STMicroelectronics
Operating modes supported:
–
Reader/Writer
–
Card emulation (ISO/IEC 14443-3 Type A)
Hardware features
–
Dedicated internal frame controller
–
Highly integrated analog front end (AFE) for RF communications
–
Transmission and reception modes
–
Optimized power management
–
Tag detection mode
–
Field detection mode
RF communication at 13.56 MHz
–
NFC-A / ISO14443A reader mode
–
NFC-B / ISO14443B reader mode
–
NFC-F / FeliCa™ reader mode
–
NFC-V / ISO15693 reader mode
–
NFC-A / ISO14443A card emulation
–
MIFARE® Classic compatible
Communication interfaces with a host controller
–
Serial peripheral interface (SPI) slave interface up to 2 Mbps
–
Up to 528-byte command/reception buffer (FIFO) depending on
communication protocol
32-lead, 5x5 mm, very thin fine pitch quad flat (VFQFPN) ECOPACK2 package
Applications
Typical protocols supported:
•
ISO/IEC 14443-3 Type A and B tags
•
ISO/IEC 15693 tags
•
ISO/IEC 18000-3M1 tags
•
NFC Forum tags: Types 1, 2, 3, 4 and 5
Typical ST25R95 applications include:
•
Consumer electronics
•
Gaming
•
Healthcare
•
Industrial
Typical ST25R95 use cases include:
•
NFC-enabled Wi-Fi® pairing
•
•
•
NFC-enabled Bluetooth® pairing
Data exchange
Communication with NFC/RFID tags (reader mode)
DS12807 - Rev 4 - April 2019
For further information contact your local STMicroelectronics sales office.
www.st.com
ST25R95
Description
1
Description
The ST25R95 is an integrated transceiver IC for contactless applications.
The ST25R95 manages frame coding and decoding in Reader and card emulation modes for standard
applications such as near field communication (NFC), proximity and vicinity standards.
The ST25R95 supports ISO/IEC 14443 Type A communication in reader and card emulation modes, and ISO/IEC
14443 Type B, ISO/IEC15693, and FeliCa in reader mode.The ST25R95 embeds an analog front end to provide
the 13.56 MHz air interface.
The ST25R95 also supports the detection, reading and writing of NFC Forum Type 1, 2, 3, 4, and 5 tags, and an
SPI interface to communicate with the host controller.
Figure 1. ST25R95 application overview
Interrupt Management
ST25R95
1.1
Host
Controller
(MCU)
SPI
Block diagram
Figure 2. ST25R95 block diagram
VPS_Main
27.12 MHz
GND_Dig
XIN
XOUT
ST25R95
AFE IP
Status
registers
Power & Clock
Management
VPS_TX
TX1
Tag
Detector
Digital
Tag/Field Detector
TX2
User interface
Host
(User side)
SPI
Interrupt
Configuration
register
DS12807 - Rev 4
AFE
Signal
Mux
Frame Controller
Timer
FIFO
Accelerators
Encoder/Decoder
Mod/
Demod
Reader
ISO/IEC 14443
Type A and B
ISO/IEC 15693
FeliCa
Card Emulator
ISO/IEC 14443
Type A
GND_TX
RX1
RX2
GND_RX
page 2/61
ST25R95
Clock management
1.2
Clock management
The ST25R95 incorporates two clock sources, a high frequency oscillator (HFO) and a low frequency oscillator
(LFO).
The HFO uses an external 27.12 MHz crystal to generate the internal system clock and the clock for the drivers to
generate the RF field.
The LFO uses an internal 32 kHz RC oscillator to generate a slow system clock for low power operation modes.
In card emulation mode, a built-in clock recovery block is available which recovers the clock from the external HF
field. This block can be selected instead of HFO by setting the ClkRec bit in the Protocol Select command.
1.3
Power supply
The ST25R95 has two power supply pins:
•
VPS: supply of digital and analog blocks
•
VPS_TX: direct supply of the driver stage
1.4
List of terms
Table 1. List of terms
Term
Meaning
AFE
Analog front end
DAC
Digital analog converter
FDT
Frame delay time
FWT
Frame waiting time
GND
Ground
HFO
High frequency oscillator
LFO
Low frequency oscillator
MCU
MIFARE
Microcontroller unit
(1)
Communication protocol
NFC
Near field communication
RFID
Radio frequency identification
RFU
Reserved for future use
RWT
Response waiting time
SPI
Serial peripheral interface
tL
Low frequency period
tREF
Reference time
WFE
Wait for event
1. MIFARE® and MIFARE® Classic are registered trademarks of NXP BV.
DS12807 - Rev 4
page 3/61
ST25R95
Pin and signal descriptions
2
Pin and signal descriptions
TX1
NC
NC
NC
NC
XIN
XOUT
GND_TX
VPS_TX
Figure 3. ST25R95 pinout description
25
1
TX2
NC
NC
NC
GND
NC
ST_R1
RX1
SSI_1
RX2
SSI_0
NC
SPI_SS
IRQ_OUT
VPS
IRQ_IN
NC
NC
SPI_MOSI
SPI_MISO
17
9
ST_R0
GND_RX
SPI_SCK
Note: Shaded area represents the dissipation pad (it must be connected to ground).
DS12807 - Rev 4
page 4/61
ST25R95
Pin and signal descriptions
Table 2. ST25R95 pin descriptions
Pin
Pin name
Type (1)
Main function
Alternate function
1
TX1
O
Driver output 1
-
2
TX2
O
Driver output 2
-
3
NC
-
Not connected
-
4
NC
-
Not connected
-
5
RX1
I
Receiver input 1
-
6
RX2
I
Receiver input 2
-
7
NC
-
Not connected
-
8
GND_RX
P
Ground (analog)
-
9
ST_R0
O
ST reserved (2)
-
10
NC
-
Not connected
-
11
NC
-
Not connected
-
12
IRQ_IN
I (3)
Interrupt input
-
13
VPS
Main power supply
-
14
IRQ_OUT
O (4)
Interrupt output
-
15
SPI_SS
I (5)
SPI slave select (active low)
-
16
SPI_MISO
O (5)
SPI data, slave output
-
17
18
19
20
SPI_MOSI
SPI_SCK
SSI_0
SSI_1
P
I
(5)
(5)
SPI data, slave input
I
(6)
SPI serial clock
-
I
(5)
Select serial communication interface
-
I
(5)
Select serial communication interface
-
I
(7)
ST reserved
-
-
21
ST_R1
22
GND
P
Ground (digital)
-
23
NC
-
Not connected
-
24
NC
-
Not connected
-
25
NC
-
Not connected
-
26
NC
-
Not connected
-
27
NC
-
Not connected
-
28
NC
-
Not connected
-
29
XIN
-
Crystal oscillator input
-
30
XOUT
-
Crystal oscillator output
-
31
GND_TX
P
Ground (RF drivers)
-
32
VPS_TX
P
Power supply (RF drivers)
-
1. I: Input, O: Output, and P: Power
2. Must add a capacitor to ground (~1 nF).
3. Pad internally connected to a very weak pull-up to VPS.
4. Pad internally connected to a weak pull-up to VPS.
5. Must not be left floating.
6. Pad internally connected to a weak pull-down to GND.
7. Pad input in High impedance. Must be connected to VPS.
DS12807 - Rev 4
page 5/61
ST25R95
Power management and operating modes
3
Power management and operating modes
3.1
Operating modes
The ST25R95 has two operating modes: Wait for event (WFE) and Active. In Active mode, the ST25R95
communicates actively with a tag or an external host (an MCU, for example). WFE mode includes four low
consumption states: Power-up, Hibernate, Sleep/Field detector and Tag detector.
The ST25R95 can switch from one mode to another.
Table 3. ST25R95 operating modes and states
Mode
State
Description
This mode is accessible directly after POR.
Power-up
Hibernate
Low level on IRQ_IN pin (longer than 10 µs) is the only wakeup source. LFO (low-frequency
oscillator) is running in this state.
Lowest power consumption state. The ST25R95 has to be woken-up in order to
communicate. Low level on IRQ_IN pin (longer than 10 µs) is the only wakeup source.
Low power consumption state. Wakeup source is configurable:
Sleep/Field
Wait for event detector
(WFE)
•
Timer
•
IRQ_IN pin
•
SPI_SS pin
•
Field Detector
LFO (low-frequency oscillator) is running in this state.
Low power consumption state with tag detection. Wakeup source is configurable:
Tag detector
•
Timer
•
IRQ_IN pin
•
SPI_SS pin
•
Tag detector
LFO (low-frequency oscillator) is running in this state.
Active
Ready
In this mode, the RF is OFF and the ST25R95 waits for a command (ProtocolSelect, ...) from
the external host via the selected serial interface (SPI).
Reader
The ST25R95 can communicate with a tag using the selected protocol or with an external
host using the SPI interface.
Card
emulation
The ST25R95 can communicate as a Card or Tag with an external reader. The Card or Tag
application is located in the Host and communicates with the ST25R95 via the SPI interface.
Hibernate, Tag detector and Sleep/Field detector states can only be activated by a command from the external
host. As soon as any of these three states are activated, the ST25R95 can no longer communicate with the
external host. It can only be woken up.
The behaviour of the ST25R95 in 'Tag detector' state is defined by the Idle command.
DS12807 - Rev 4
page 6/61
ST25R95
Startup sequence
Figure 4. ST25R95 initialization and operating state change
Supply off
WAIT FOR EVENT
Sleep / Field detector
Power-up
Tag detector
Hibernate
Serial I/F
selection
N
_I
Q
IR
pu
e
ls
IDLE
command
Wake-up
ACTIVE
Protocol
Select code
Card Emulator
3.2
Protocol
Select code
READY
Reader
Startup sequence
After the power supply is established at power-on, the ST25R95 waits for a low pulse on the pin IRQ_IN (t1)
before automatically selecting the external interface (SPI) and entering Ready state after a delay (t3).
Figure 5. Power-up sequence
t4
VPS
0V
SSI_0
t1
SSI_1
IRQ_IN
t0
t3
First valid command
t2
1.
DS12807 - Rev 4
Pin IRQ_IN low level < 0.2 VPS_Main.
page 7/61
ST25R95
Startup sequence
Figure 5 shows the power-up sequence for a ST25R95 device; where:
Note:
•
t0 is the initial wake-up delay
100 μs (minimum)
•
t1 is the minimum interrupt width
10 µs (minimum)
•
t2 is the delay for the serial interface selection
250 ns (typical)
•
t3 is the HFO setup time (tSU(HFO))
10 ms (maximum)
•
t4 is the VPS ramp-up time from 0V to VPS
10 ms (max. by design validation)
VPS must be 0V before executing the start-up sequence.
The serial interface is selected after the following falling edge of pin IRQ_IN when leaving from POR or
Hibernate state.
Table 4 lists the signal configuration used to select the SPI communication interface.
Table 4. Select serial communication interface selection table
DS12807 - Rev 4
Pin
SPI interface
SSI_0
1
SSI_1
0
page 8/61
ST25R95
Communication protocols
4
Communication protocols
4.1
Serial peripheral interface (SPI)
4.1.1
Polling mode
To send commands and receive replies, the application software has to perform three steps.
1.
Send the command to the ST25R95.
2.
Poll the ST25R95 until it is ready to transmit the response.
3.
Read the response.
After a command, the application software needs to wait for the ST25R95 to be ready to send the response. Not
following this procedure may cause unpredictable behaviour.
The maximum allowed SPI communication speed is fSCK. The ST25R95 supports SPI communication configured
for CPOL = CPHA = 1 and SPI communication configured for CPOL = CPHA = 0.
A control byte is used to specify a communication type and direction:
•
0x00: Send command to the ST25R95
•
0x03: Poll the ST25R95
•
0x02: Read data from the ST25R95
•
0x01: Reset the ST25R95
The SPI_SS line is used to select a device on the common SPI bus. The SPI_SS pin is active low.
When the SPI_SS line is inactive, all data sent by the Master device is ignored and the MISO line remains in High
Impedance state.
In Slave mode, the phase and polarization are defined with CPOL = 1 and CPHA = 1 or CPOL = 0 and CPHA = 0.
Figure 6. Sending command to ST25R95
MOSI
00 0 0 0 0 0 0
CMD
LEN
DATA
Several data bytes
Control Byte
MISO
DATA
XX XX XX XX
XX XX XX XX
XX XX XX XX
XX XX XX XX
XX XX XX XX
Figure 7. Polling the ST25R95 until it is ready
MOSI
00 0 0 0 0 1 1
XXX X X X11
Control Byte
MISO
XXX X X XXX
0 0 0 0 0 XXX
XXX X X X11
XXX X X X11
Flag
Flag
0 0 0 0 0 XXX
0 0 0 0 1 XXX
Flags are polled until data is ready (Bit 3 is set when data is ready)
DS12807 - Rev 4
page 9/61
ST25R95
Serial peripheral interface (SPI)
Table 5. Interpretation of flags
Bit
[7:4]
Meaning (application point of view)
Not significant
3
Data can be read from the ST25R95 when set.
2
Data can be sent to the ST25R95 when set.
[1:0]
Not significant
Figure 8. Reading data from ST25R95
MOSI
00 0 0 0 0 1 0
X X XXXX XX X XXXX X X X X X XXX XXX X X XXX XXX
Control Byte
MISO
X X XXX XXX
Resp code
LEN
DATA
DATA
Several data bytes
Data must be sampled at the rising edge of the SCK signal.
‘Sending’, ‘Polling’ and ‘Reading’ commands must be separated by a high level of the SPI_SS line. For example,
when the application needs to wait for data from the ST25R95, it asserts the SPI_SS line low and issues a
‘Polling’ command. Keeping the SPI_SS line low, the Host can read the Flags Waiting bit which indicates that the
ST25R95 can be read. Then, the application has to assert the SPI_SS line high to finish the polling command.
The Host asserts the SPI_SS line low and issues a ‘Reading’ command to read data. When all data is read, the
application asserts the SPI_SS line high.
The application is not obliged to keep reading Flags using the Polling command until the ST25R95 is ready in one
command. It can issue as many 'Polling' commands as necessary. For example, the application asserts SPI_SS
low, issues 'Polling' commands and reads Flags. If the ST25R95 is not ready, the application can assert SPI_SS
high and continue its algorithm (measuring temperature, communication with something else). Then, the
application can assert SPI_SS low again and again issue 'Polling' commands, and so on, as many times as
necessary, until the ST25R95 is ready. Alternatively the application can also poll the IRQ_OUT pin (see
Section 4.1.2 Interrupt mode).
Note:
At the beginning of communication, the application does not need to check flags to start transmission. The
ST25R95 is assumed to be ready to receive a command from the application.
Figure 9. Reset the ST25R95
MOSI
00 0 0 0 0 0 0
Control Byte 01
MISO
X X XX X X X
To reset the ST25R95 using the SPI, the application sends the SPI Reset command (control byte 01, see
Figure 9. Reset the ST25R95) which starts the internal controller reset process and puts the ST25R95 into
Power-up state. The ST25R95 will wake up when pin IRQ_IN goes low. The ST25R95 reset process is delayed
until when the SPI_SS pin returns to high level.
Caution:
DS12807 - Rev 4
SPI communication is MSB first.
page 10/61
ST25R95
Error codes
4.1.2
Interrupt mode
When the ST25R95 is ready to send back a reply, it sends an Interrupt Request by setting a low level on pin
IRQ_OUT, which remains low until the host reads the data.
The application can use the Interrupt mode to skip the polling stage.
4.2
Error codes
Table 6. Possible error codes and their meaning
Code
Name
Meaning
0X63
EEmdSOFerror23
SOF error in high part (duration 2 to 3 etu) in ISO/IEC 14443B
0x65
EEmdSOFerror10
SOF error in low part (duration 10 to 11 etu) in ISO/IEC 14443B
0x66
EEmdEgt
Error Extennded Guard Time error in ISO/IEC 14443B
0x67
ETr1 Too Big
Too long TR1 send by the card, reception stopped in ISO/IEC 14443BT
0x68
ETr1Too small
Too small TR1 send by the card in ISO/IEC 14443B
0x71
EinternalError
Wong frame format decodes
0x80
EFrameRecvOK
Frame correctly received (additionally see CRC/Parity information)
0x82
EInvalidCmdLen
Invalid command length
0x83
EInvalidProto
Invalid protocol
0x85
EUserStop
Stopped by user (used only in Card mode)
0x86
ECommError
Hardware communication error
0x87
EFrameWaitTOut
Frame wait time out (no valid reception)
0x88
EInvalidSof
Invalid SOF
0x89
EBufOverflow
Too many bytes received and data still arriving
0x8A
EFramingError
if start bit = 1 or stop bit = 0
0x8B
EEgtError
EGT time out
0x8C
EInvalidLen
Valid for FeliCa™, if Length >> Frame sent by the Host to ST25R95
>0x02 02 01 07
1: Wait for SOF
L 100 S: >>>0x02 02 01 21
0: 100% modulation (100)
1: 10% modulation (10)
0: Single subcarrier (S)
1: Dual subcarrier (D)
L 100 D: >>>0x02 02 01 23
L 10 S: >>>0x02 02 01 25
L 10 D: >>>0x02 02 01 27
In these examples, the CRC is
automatically appended.
0: no CRC appended
1: automatically append CRC
Transmission data rate
00: 106 Kbps
7:6
01: 212 Kbps
10: 424 Kbps
11: RFU
0
ISO/IEC 14443 Type A
Reception data rate
00: 106 Kbps
NFC Forum Tag Type 1
(Topaz)
5:4
0x02
>>>0x02020200: ISO/IEC 14443
Type A tag, 106 Kbps transmission and
reception rates, FDT 86/90 µs
01: 212 Kbps
10: 424 Kbps
NFC Forum Tag Type 2
11: RFU
NFC Forum Tag Type
4A
3:0
RFU
PP
1
7:0
(0x00 - 0x0E, other values RFU)
When there is PP, MM must also be
provided.
DS12807 - Rev 4
2
7:0
MM
3
7:0
DD (0x00 - 0x7F, other values RFU)
These 3 bytes are optional. The default
PP:MM:DD value is 0
(corresponds to FDT 86/90µs).
For other values, FDT = (2^PP)*(MM
+1)*(DD+128) *32/13.56 µs
page 15/61
ST25R95
Protocol select command (0x02) description
Protocol
Code
Parameters
Byte
Bit
Function
Examples of commands
Transmition data rate
00: 106 Kbps
7:6
01: 212 Kbps
10: 424 Kbps
11: 428 Kbps
Reception data rate
00: 106 Kbps
0
5:4
01: 212 Kbps
>>>0x02020301:
ISO/IEC 14443 Type B tag with CRC
appended
10: 424 Kbps
11: 848 Kbps
3:1
ISO/IEC 14443 Type B
NFC Forum Tag Type
4B
0x03
0
RFU
0: no CRC appended
1: automatically append CRC
PP
DS12807 - Rev 4
These 9 bytes are optional. Default
value of PP:MM:DD is 0 and
corresponds to FWT ~302µs.
1
7:0
(0x00 - 0x0E, other values RFU) When
there is PP, MM must also be provided.
2
7:0
MM
3
7:0
DD (0x00 - 0x7F, other values RFU)
5:4
7:0
TTTT (Optional)
6
7:0
YY (Optional)
PCD Min TR1 (Min_TR1 = 8 * XX / fS),
default = 0
7
7:0
ZZ (Optional)
PCD Max TR1 (Max_TR1 = 8 * ZZ / fS),
default = 26 = 0x1A
FWT = (2^PP)*(MM+1)*(DD+128)*
32/13.56 µs
TR0 = TTTT/FC (LSB first),
default 1023 = 0x3FF
page 16/61
ST25R95
Protocol select command (0x02) description
Protocol
Code
Parameters
Byte
Bit
Function
Examples of commands
Transmission data rate
00: 106 Kbps
7:6
01: 212 Kbps
10: 424 Kbps
11: RFU
Reception data rate
0
5:4
FeliCa
NFC Forum Tag Type 3
00: RFU
>>>0x02020451:
01: 212 Kbps
FeliCa tag, 212 Kbps transmission and
reception rates with CRC appended.
10: 424 Kbps
0x04
11: RFU
3:1
0
1
7:0
2
7:0
RFU
0: no CRC appended
1: automatically append CRC
RFU must be set to 0x10
PP
3
Note:
DS12807 - Rev 4
7:0
(0x00 - 0x0E, other values RFU) When
there is PP, MM must also be provided.
MM
These 2 bytes are optional. The default
PP:MM value is 0
(corresponds to RWT ~302µs).
RWT = (2^PP)*(MM+1)*4096/13.56 µs
The protocol select command for Felica does not contain a DD parameter.
page 17/61
ST25R95
Protocol select command (0x02) description
Table 13. List of values for different protocols (card emulation)
Protocol (Card)
Code
Parameters
Byte
Bit
Examples of commands
Comments
Function
Transmission data rate
00: 106 Kbps
7:6
01: RFU
10: RFU
11: RFU
Reception data rate
00: 106 Kbps
5:4
ISO/IEC 14443
Type A
0x12
01: RFU
10: RFU
0
(1)
11: RFU
3
2
0: Return an error, if no RF field
>>>0x02021208
0x0300 Check if RF Field is ON or OFF
>>> 0x0303010FFF - Wait for RF Field appearance for
(16*256)/13.56 µs
Flags, Presc and Timer parameters are optional. They must
be specidfied if the application has to wait for RF field appearance
or disappearance.
The time to wait is (Presc+1)*(Timer+1)/13.56 µs.