MFRC50001T/0FE - NXP SEMICONDUCTORS

1. Introduction

This data sheet describes the functionality of the MFRC500 Integrated C ircuit (IC ). It

includes the functional and electrical specifications and from a system an d ha rd wa re

viewpoint gives detailed information on how to design-in the device.

Remark: The MFRC500 supports all variant s of the MIFARE Classic, MIFARE 1K and

MIFARE 4K RF identification protocols. To aid readability throughout this data sheet, the

MIFARE Classic, MIFARE 1K and MIFARE 4K products and protocols have the gen eric

name MIFARE.

2. General description

The MFRC500 is a mem ber of a new family of h ighly integrated re ader ICs for cont actless

communication at 13.56 MHz. This family of reader ICs provide:

•outstanding modulation and demodulation for passive contactless communication

•a wide range of methods and protocols

•pin compatibility with the CLRC632, MFRC530, MFRC531 and SLRC400

All protocol layers of the ISO/IEC 14443 A are supported

The receiver module provides a robust and efficient demodulati on /d ec od in g circ uitr y

implementation for compatible transponder signals (see Section 9.10 on page 30). The

digital module, manages the complete ISO/IEC 14443 A standa rd framing and error

detection (parity and CRC). In addition, it supports the fast Crypto1 security algorithm for

authenticating the MIFARE products (see Section 9.12 on page 35).

The internal transmitter module (Section 9.9 on page 27) can directly drive an antenna

designed for a proximity operating distance up to 100 mm without any additional active

circuitry.

A parallel interface can be directly connected to any 8-bit microprocessor to ensure

reader/terminal design flexibility.

MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Rev. 3.3 — 15 March 2010

048033 Product data sheet

PUBLIC

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 2 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

3. Features and benefits

3.1 General

Highly integrated analog circuitry for demodulating and decoding card response

Buffered output drivers enable anten na connection using the minimum of external

components

Proximity operating distance up to 100 mm

Supports the ISO/IEC 14443 A standard, parts 1 to 4

Supports MIFARE Classic protocol

Crypto1 and secure non-volatile internal key memory

Pin-compatible with the CLRC6 32 , MFRC530, MFRC531 and the SLRC400

Parallel microprocessor interface with internal address latch and IRQ line

Flexible interrupt handling

Automatic detection of parallel microprocessor interface type

64-byte send and receive FIFO buffer

Hard reset with low power function

Software triggered Power-down mode

Programmable timer

Unique serial number

User programmable start-up configuration

Bit-oriented and byte oriented framing

Independent power supp ly pins for analog, digital and transmitter modules

Internal oscillator buffer optimized for low phase jitter enables 13.56 MHz quartz

connection

Clock frequency filtering

3.3 V operation for transmitter in short range and proximity applications

4. Applications

Electronic payment systems

Identification systems

Access control systems

Subscriber services

Banking systems

Digital content systems

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 3 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

5. Quick reference data

6. Ordering information

Table 1. Quick reference data

Symbol Parameter Conditions Min Typ Max Unit

Tamb ambient temperature −40 - +150 °C

Tstg storage temperature −40 - +150 °C

VDDD digital supply voltage −0.5 +5 +6 V

VDDA analog supply voltage −0.5 +5 +6 V

VDD(TVDD) TVDD supply voltage −0.5 +5 +6 V

|Vi|input voltage (absolute

value) on any digi tal pin to DVSS −0.5 - VDDD + 0.5 V

on pin RX to AVSS −0.5 - VDDA + 0.5 V

ILI input leakage current −1.0 - +1.0 mA

IDD(TVDD) TVDD supply current continuous wave - - 150 mA

Table 2. Orderi ng information

Type number Package

Name Description Version

MFRC50001T/0FE SO32 plastic small outline package; 32 lea ds; body width 7.5 mm SOT287-1

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 4 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

7. Block diagram

Fig 1. MFRC500 block diagram

001aaj629

FIFO CONTROL

64-BYTE FIFO

MASTER KEY BUFFER

CRYPTO1 UNIT

CONTROL REGISTER

BANK

NWR NRD NCS ALE A0 A1 A2

10 11 9 21 22 23 24 13 14 15 16 17 18 19 20

AD0 to AD7/D0 to D7

STATE MACHINE

COMMAND REGISTER

PROGRAMMABLE TIMER

INTERRUPT CONTROL

CRC16/CRC8

GENERATION AND CHECK

PARALLEL/SERIAL CONVERTER

BIT COUNTER

PARITY GENERATION AND CHECK

FRAME GENERATION AND CHECK

SERIAL DATA SWITCH

BIT DECODING BIT ENCODING

32 × 16-BYTE

EEPROM

ACCESS

CONTROL

32-BIT PSEUDO

RANDOM GENERATOR

AMPLITUDE

RATING

CLOCK

GENERATION,

FILTERING AND

DISTRIBUTION

OSCILLATOR

LEVEL SHIFTERS

CORRELATION

AND

BIT DECODING

REFERENCE

VOLTAGE

Q-CHANNEL

AMPLIFIER

Q-CHANNEL

DEMODULATOR

I-CHANNEL

AMPLIFIER

ANALOG

TEST

MULTIPLEXER I-CHANNEL

DEMODULATOR

PARALLEL INTERFACE CONTROL

(INCLUDING AUTOMATIC INTERFACE DETECTION AND SYNCHRONISATION)

VOLTAGE

MONITOR

AND

POWER ON

DETECT

DVDD

RSTPD

Q-CLOCK

GENERATION

TRANSMITTER CONTROL

GND

TX1 TX2TVSSRXAUXVMID TVDD

578292730 6

POWER ON

DETECT

OSCIN

AVDD

AVSS

OSCOUT

IRQ

MFIN

MFOUT

DVSS

RESET

CONTROL

POWER DOWN

CONTROL

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 5 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

8. Pinning information

8.1 Pin description

Fig 2. MFRC500 pin configura tion

MFRC500

OSCIN OSCOUT

IRQ RSTPD

MFIN VMID

MFOUT RX

TX1 AVSS

TVDD AUX

TX2 AVDD

TVSS DVDD

NCS A2

NWR/R/NW/nWrite A1

NRD/NDS/nDStrb A0/nWait

DVSS ALE/AS/nAStrb

AD0/D0 D7/AD7

AD1/D1 D6/AD6

AD2/D2 D5/AD5

AD3/D3 D4/AD4

001aal483

Table 3. Pin description

Pin Symbol Type[1] Description

1 OSCIN I oscillator/clock inputs:

crystal oscillator input to the oscillator’s inverting amplifier

externally generated clock input; fclk(ext) = 13.56 MHz

2 IRQ O interrupt request: generates an output signaling an interrupt event

3 MFIN I ISO/IEC 14443 A MIFARE serial data interface input

4[2] MFOUT O serial data ISO/IEC 14443 A output

5 TX1 O transmitter 1 modulated carrier output; 13.56 MHz

6 TVDD P transmitter power supply for the TX1 and TX2 output stages

7 TX2 O transmitter 2 modulated carrier output; 13.56 MHz

8 TVSS G transmitter ground for the TX1 and TX2 output stages

9 NCS I not chip select input is used to select and activate the MFRC500’s microprocessor

interface

10[3] NWR I not write input gen erates the strobe signal for writing data to the MFRC500

registers when applied to pins D0 to D7

R/NW I read not write input is used to switch between read or write cycl es

nWrite I not write input selects the read or write cycle to be performed

11[3] NRD I not read input generates the strobe signal for reading data from the MFRC500

registers when applied to pins D0 to D7

NDS I not data strobe input generates the strobe signal for the read and write cycl es

nDStrb I not data strobe input generates the strobe signa l for the read and write cycles

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 6 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

[1] Pin types: I = Input, O = Output, I/O = Input/Output, P = Power and G = Ground.

[2] The SLRC400 uses pin name SIGOUT for pin MFOUT. The MFRC500 functionality includes test functions for the SLRC400 using pin

MFOUT.

[3] These pins provide different functionality depending on the selected microprocessor interface type (see Section 9.1 on page 7 for

detailed information).

12 DVSS G digital ground

13 to 20[3] D0 to D7 I/O 8-bit bidirectional data bus input/output on pins D0 to D7

AD0 to AD7 I/O 8-bit bidirectional address and data bus input/output on pins AD0 to AD7

21[3] ALE I address latch enable input for pins AD0 to AD5; HIGH latches the internal address

AS I address strobe input for pins AD0 to AD5; HIGH latches the internal address

nAStrb I not address strobe input for pins AD0 to AD5; LOW latches the internal address

22[3] A0 I address line 0 is the address register bi t 0 input

nWait O not wait output:

LOW starts an access cycle

HIGH ends an access cycle

23 A1 I address line 1 is the address register bi t 1 input

24[3] A2 I address line 2 is the address register bi t 2 input

25 DVDD P digital power supply

26 AVDD P analog power supply for pins OSCIN, OSCOUT, RX, VMID and AUX

27 AUX O auxiliary output is used to generate analog test signals. The output signal is

selected using the TestAnaSelect r egister’s TestAnaOutSel[4:0] bits

28 AVSS G ana log ground

29 RX I receiver input is used as the card response input. The carrier is load modulated at

13.56 MHz, drawn from the antenna circuit

30 VMID P internal reference voltag e pin provides the internal reference voltage as a supply

Remark: It must be connected to a 100 nF block capacitor connected between pin

VMID and ground

31 RSTPD I reset and power-down input:

HIGH: the internal current sinks are switched off, the oscillator is inhibited and

the input pads are disconnected

LOW (negative edge): start internal reset phase

32 OSCOUT O crystal oscillator output for the oscillator’s inverting amplifier

Table 3. Pin description …continued

Pin Symbol Type[1] Description

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 7 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9. Functional description

9.1 Digita l interface

9.1.1 Overview of supported microprocessor interfaces

The MFRC500 supports direct interfacing to various 8-bit microprocessors. Alternatively,

the MFRC500 can be connected to a PC’s Enhanced Parallel Port (EPP). Table 4 shows

the parallel interface signals supported by the MFRC500.

9.1.2 Automatic microprocessor interface detection

After a Power-On or Hard reset, the MFRC500 resets the parallel microprocessor

interface mode and detects the microprocessor interface type.

The MFRC500 identifies the microprocessor interface usin g the logic levels on th e control

pins. This is performed usin g a combination of fixed pin connections and the dedicated

Initialization routine (see Section 9.7.4 on page 25).

Table 4. Supported microprocessor and EPP interface signals

Bus control signals Bus Separated address

and data bus Multiplexed address and data bus

Separated read and

write strobes control NRD, NWR, NCS NRD, NWR, NCS, ALE

address A0, A1, A2 AD0, AD1, AD2, AD3, AD4, AD5

data D0 to D7 AD0 to AD7

Common read and write

strobe control R/NW, NDS, NCS R/NW, NDS, NCS, AS

address A0, A1, A2 AD0, AD1, AD2, AD3, AD4, AD5

data D0 to D7 AD0 to AD7

Common read and write

strobe with handshake

(EPP)

control - nWrite, nDStrb, nAStrb, nWait

address - AD0, AD1, AD2, AD3, AD4, AD5

data - AD0 to AD7

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 8 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.1.3 Connection to different microprocessor types

The connection to various microprocessor types is shown in Table 5.

9.1.3.1 Separate read and write strobe

Refer to Section 13.4.1 on page 86 for timing specification.

Table 5. Connection scheme for detecting the parallel interface type

MFRC500

pins Parallel interface type and signals

Separated read/write strobe Common read/write strobe

Dedicated

address bus Multiplexed

address

bus

Dedicated

address bus Multiplexed

address bus with

handshake

ALE HIGH ALE HIGH AS nAStrb

A2 A2 LOW A2 LOW HIGH

A1 A1 HIGH A1 HIGH HIGH

A0 A0 HIGH A0 LOW nWait

NRD NRD NRD NDS NDS nDStrb

NWR NWR NWR R/NW R/NW nWrite

NCS NCS NCS NCS NCS LOW

D7 to D0 D7 to D0 AD7 to AD0 D7 to D0 AD7 to AD0 AD7 to AD0

Fig 3. Connectio n to microprocessor: separate read and write strobes

001aak60

address bus (A3 to An)

NCS

A0 to A2

address bus (A0 to A2)

D0 to D7

ALE

data bus (D0 to D7)

HIGH

NRD

Read strobe (NRD)

NWR

Write strobe (NWR)

DEVICE

ADDRESS

DECODER

non-multiplexed address

NCS

AD0 to AD7

ALE

multiplexed address/data (AD0 to AD7)

address latch enable (ALE)

NRD

Read strobe (NRD)

NWR

Write strobe (NWR)

LOW

HIGH

DEVICE

ADDRESS

DECODER

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 9 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.1.3.2 Common read and write strobe

Refer to Section 13.4.2 on page 87 for timing specification.

9.1.3.3 Common read and write strobe: EPP with handshake

Refer to Section 13.4.3 on page 88 for timing specification.

Remark: In the EPP standard a chip select signal is not defined. To cover this situation,

the status of the NCS pin can be used to inhibit the nDStrb signal. If this inhibitor is not

used, it is mandatory that pin NCS is connected to pin DVSS.

Remark: After each Power-On or Hard reset, the nWait signal on pin A0 is

high-impedance. nWait is defined as the first negative edge applied to the nAStrb pin a fter

the reset phase. The MFRC500 does not support Read Address Cycle.

Fig 4. Connection to microprocessor: common read and write strobes

001aak60

address bus (A3 to An)

NCS

A0 to A2

address bus (A0 to A2)

D0 to D7

ALE

data bus (D0 to D7)

HIGH

NRD

Data strobe (NDS)

NWR

Read/Write (R/NW)

DEVICE

ADDRESS

DECODER

non-multiplexed address

NCS

AD0 to AD7

ALE

multiplexed address/data (AD0 to AD7)

Address strobe (AS)

NRD

Data strobe (NDS)

NWR

Read/Write (R/NW)

LOW

HIGH

LOW

DEVICE

ADDRESS

DECODER

Fig 5. Connection to microprocessor: EPP common read/write strobes and handshake

001aak60

LOW NCS

AD0 to AD7

ALE

multiplexed address/data (AD1 to AD8)

Address strobe (nAStrb)

NRD

Data strobe (nDStrb)

NWR

Read/Write (nWrite)

HIGH

nWait

DEVICE

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 10 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.2 Memory organization of the EEPROM

Table 6. EEPROM memory organization diagram

Block Byte address Access Memory content Refer to

Position Address

0 0 00h to 0Fh R product

information field Section 9.2.1 on page 11

1 1 10h to 1Fh R/W StartUp register

initialization file Section 9.2.2.1 on page 11

2 2 20h to 2Fh R/W

3 3 30h to 3Fh R/W register

initialization file Section 9.2.2.3 “Register

initialization file (read/write)”

on page 13

4 4 40h to 4Fh R/W

5 5 50h to 5Fh R/W

6 6 60h to 6Fh R/W

7 7 70h to 7Fh R/W

8 8 80h to 8Fh W keys for Crypto1 Section 9.2.3 on page 13

9990h to 9FhW

10 A A0h to AFh W

11 B B0h to BFh W

12 C C0h to CFh W

13 D D0h to DFh W

14 E E0h to EFh W

15 F F0h to FFh W

16 10 100h to 10Fh W

17 11 110h to 11Fh W

18 12 120h to 12Fh W

19 13 130h to 13Fh W

20 14 140h to 14Fh W

21 15 150h to 15Fh W

22 16 160h to 16Fh W

23 17 170h to 17Fh W

24 18 180h to 18Fh W

25 19 190h to 19Fh W

26 1A 1A0h to 1AFh W

27 1B 1B0h to 1BFh W

28 1C 1C0h to 1CFh W

29 1D 1D0h to 1DFh W

30 1E 1E0h to 1EFh W

31 1F 1F0h to 1FFh W

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 11 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.2.1 Product information field (read only)

[1] Byte 4 contains the current version number.

9.2.2 Register initialization files (read/write)

the initializing phase (see Section 9.7.3 on page 25) using the StartUp register

initialization file.

In addition, the MFRC500 registers can be initialized using values from the register

initialization file when the LoadCon fig co mm a nd is executed (see Section 11.4.1 on

page 79).

Remark: The following points apply to initialization:

•the Page register (addressed using 10h, 18h, 20h, 28h) is skipped and not initialized.

•PreSetxx registers: do not change.

•all reserved register bits set to logic 0: do not change.

9.2.2.1 StartUp register initial iza ti on fil e (rea d /w r ite )

The EEPROM memory block address 1 an d 2 contents are used to automatica lly set the

in the EEPROM during production are shown in Section 9.2.2.2 “Fac to ry de fa ult StartUp

Table 7. Product information field byte allo ca tion

Byte 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Symbol CRC Internal Product Serial Number - Product Type Identification

Access R R R R R

Table 8. Product information field byte description

Byte Symbol Access Value Description

15 CRC R - the content of the product information field

is secured using a CRC byte which is

checked during start-up

14 to 12 Internal R - three bytes for internal trimming parameters

11 to 8 Product Serial Number R - a unique four byte serial number for the

device

7 to 5 reserved R -

4 to 0 Product Type

Identification R - the MFRC500 is a me mb er of a new family

of highly integrated reader ICs. Each

member of the product family has a unique

product type identification. The value of the

product type identification is shown in

Table 9.

Table 9. Product type identification definition

Definition Product type identification bytes

Byte01234

[1]

Value 30h 88h F8h 00h XXh

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 12 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

The byte assignment is shown in Table 10.

9.2.2.2 Factory default StartUp register initialization file

During the production tests, the StartUp register initialization file is initialized using the

default values shown in Table 11. During each power-up and initialization phase, these

values are writte n to th e MFRC500’s registers.

Table 10. Byte assignment for register initialization at start-up

EEPROM byte address Register address Remark

10h (block 1, byte 0) 10h skipped

11h 11h copied

………

2Fh (block 2, byte 15) 2Fh copied

Table 11. Shipment content of StartUp co nfigu ration file

EEPROM

byte

address

address Value Symbol Description

10h 10h 00h Page free for user

11h 11h 58h TxControl transmitter pins TX1 and TX2 are switched off, bridge driver

configuration, modulator driven from internal digital circuitry

12h 12h 3Fh CwConductance source resistance of TX1 and TX2 is set to minimum

13h 13h 3Fh PreSet13 -

14h 14h 19h PreSet14 -

15h 15h 13h ModWidth pulse width for Miller pulse encoding is set to standard configuration

16h 16h 00h PreSet16 -

17h 17h 00h PreSet17 -

18h 18h 00h Page free for user

19h 19h 73h RxControl1 ISO/IEC 14443 A is set and internal amplifier gain is maximum

1Ah 1Ah 08h DecoderControl bit-collisions always evaluate to HIGH in the data bit stream

1Bh 1Bh ADh BitPhase BitPhase[7:0] is set to standard configuration

1Ch 1Ch FFh RxThreshold MinLevel[3:0] and CollLevel[3:0] are set to maximum

1Dh 1Dh 00h PreSet1D -

1Eh 1Eh 41h RxControl2 use Q-clock for the receiver, automatic receiver off is switched on,

decoder is driven from internal analog circuitry

1Fh 1Fh 00h ClockQControl automatic Q-clock calibration is switched on

20h 20h 00h Page free for user

21h 21h 06h RxWait frame guard time is set to six bit-clocks

22h 22h 03h ChannelRedundancy channel redundancy is set using ISO/IEC 14443 A

23h 23h 63h CRCPresetLSB CRC preset value is set using ISO/IEC 14443 A

24h 24h 63h CRCPresetMSB CRC preset value is set using ISO/IEC 14443 A

25h 25h 00h PreSet25 -

26h 26h 00h MFOUTSelect pin MFOUT is set LOW

27h 27h 00h PreSet27 -

28h 28h 00h Page free for user

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 13 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.2.2.3 Register initial ization file (read/wr ite )

The EEPROM memory content from block add ress 3 to 7 can initialize register

subaddresses 10h to 2Fh when the LoadConfig co mmand is executed (see

Section 11.4.1 on page 79). This command requires the EEPROM starting byte address

as a two byte argument for the initialization procedure.

The byte assignment is shown in Table 12.

The register initialization file is large enough to hold values for two initialization sets and

up to one block (16-byte) of user data.

Remark: The register initialization file can be read/written by user s and these bytes can

be used to store other user data.

After ea ch power-up, the default configuration e nables the MIFARE and ISO/IEC 14 443 A

protocol.

9.2.3 Crypto1 keys (write only)

MIFARE security requires specific cryptographic keys to encrypt data stream

communication on the contactless interface. These keys are called Crypto1 keys.

9.2.3.1 K e y fo rmat

Keys stored in the EEPROM ar e wr itte n in a specific format. Each key byte must be split

into lower four bits k0 to k3 (lower nibb le) and the higher fo ur bits k4 to k7 (higher nibble).

Each nibble is stored twice in on e byte and one of the two nibbles is bi t-wise inverted. This

format is a precondition for successful execution of the LoadKeyE2 (see Section 1 1.6.1 on

page 81) and LoadKey commands (see Section 11.6.2 on page 81).

29h 29h 08h FIFOLevel WaterLevel[5:0] FIFO buffer warning level is set to standard

configuration

2Ah 2Ah 07h TimerClock TPreScaler[4:0] is set to standard configuration, timer unit restart

function is switched off

2Bh 2Bh 06h T imerControl Timer is started at the end of transmission, stopped at the beginning

of reception

2Ch 2Ch 0Ah TimerReload TReloadValue[7:0]: the timer unit preset value is set to standard

configuration

2Dh 2Dh 02h IRQPinConfig pin IRQ is set to high-impedance

2Eh 2Eh 00h PreSet2E -

2Fh 2Fh 00h PreSet2F -

Table 11. Shipment content of StartUp co nfigu ration file …continued

EEPROM

byte

address

address Value Symbol Description

Table 12. Byte assignment for register initialization at startup

EEPROM byte address Register address Remark

EEPROM starting byte address 10h skipped

EEPROM + 1 starting byte address 11h copied

……

EEPROM + 31 starting byte address 2Fh copied

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 14 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Using this format, 12 bytes of EEPROM memory are needed to store a 6-byte key. This is

shown in Figure 6.

Example: The value for the key must be written to the EEPROM.

•If the key was: A0h A1h A2h A3h A4h A5h then

•5Ah F0h 5Ah E1h 5Ah D2h 5Ah C3h 5Ah B4h 5Ah A5h would be written.

Remark: It is possible to load data for other key formats into the EEPROM key sto rage

location. However, it is not possible to validate card authentication with data which will

cause the LoadKeyE2 command (see Section 11.6.1 on page 81) to fail.

9.2.3.2 Storage of keys in the EEPROM

The MFRC500 reserves 384 bytes of memory in the EEPROM for the Crypto1 keys. No

memory segmentation is used to mirror the 12-byte structure of key storage. Thus, every

byte of the dedicated memory area can be the start of a key.

Example: If the key loading cycle start s at the last byte address of an EEPROM block, (for

example, key byte 0 is stored at 12Fh), the next bytes are stored in the next EEPROM

block, for example, key byte 1 is stored at 130h, byte 2 at 131h up to byte 11 at 13Ah.

Based on the 384 bytes of memory and a single key needing 12 bytes, then up to 32

different keys can be stored in the EEPROM.

Remark: It is not possible to load a key exceeding the EEPROM byte location 1FFh.

9.3 FIFO buffer

An 8 ×64 bit FIFO buffer is used in the MFRC500 to act as a parallel-to-parallel converter.

It buffers both the input and output data streams between the microprocessor and the

internal circuitry of the MFRC500. This makes it possible to manage data streams up to

64 bytes long without needing to take timing constraints into account.

9.3.1 Accessing the FIFO buffer

9.3.1.1 Access rule s

The FIFO buffer input and output data bus is connected to the FIFOData register. Writing

to this register stores one byte in the FIFO buffer and increment s the FIFO buffer write

pointer. Reading from this register shows the FIFO bu ffer contents stored at the FIFO

buf fer read pointer and increme nts the FIFO buf fer read pointer . The distance between the

write and read pointer can be obtained by reading the FIFOLength register.

Fig 6. Key storage format

001aak64

0 (LSB)Master key byte

Master key bits

EEPROM byte

address

Example

k7 k6 k5 k4 k7 k6 k5 k4

5Ah

k3 k2 k1 k0 k3 k2 k1 k0

n + 1

F0h

k7 k6 k5 k4 k7 k6 k5 k4

n + 2

5Ah

k3 k2 k1 k0 k3 k2 k1 k0

n + 3

E1h

5 (MSB)

k7 k6 k5 k4 k7 k6 k5 k4

n + 10

5Ah

k3 k2 k1 k0 k3 k2 k1 k0

n + 11

A5h

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 15 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

When the microprocessor starts a command, the MFRC 500 can still access the FIFO

buf fer while the command is running. Only one FIFO buf fer has been implemented which

is used for input and output. Ther efore, the micr oprocessor must ensure that there are no

inadvertent FIFO buffer accesses. Table 13 gives an overview of FIFO buffer access

during command processing.

9.3.2 Controlling the FIFO buffer

In addition to writing to and reading from the FIFO bu ffer, the FIFO buffer pointers can be

reset using the FlushFIFO bit. This changes the FIFOLength[6:0] value to zero, bit

FIFOOvfl is cleared and the stored bytes are no lo nger accessible. This enables the FIFO

buffer to be written with another 64 bytes of data.

9.3.3 FIFO buffer status information

The microprocessor can get the following FIFO buffer status data:

•the number of bytes stored in the FIFO buffer: bits FIFOLength[6:0]

•the FIFO buffer full warning: bit HiAlert

•the FIFO buffer empty warning : bit Lo Ale rt

•the FIFO buffer overflow warning: bit FIFOOvfl.

Remark: Setting the FlushFIFO bit clears the FIFOOvfl bit.

The MFRC500 can generate an interrupt signal when:

•bit LoAlertIRq is set to logic 1 and bit LoAlert = logic 1, pin IRQ is activated.

•bit HiAlertIRq is set to logic 1 and bit HiAlert = logic 1, pin IRQ activated.

The HiAlert flag bit is set to logic 1 only when the WaterLevel[5:0] bits or less can be

stored in the FIFO buffer. The trigger is generated by Equation 1:

Table 13. FIFO buffer acc ess

Active

command FIFO buffer Remark

μp Write μp Read

StartUp - -

Idle - -

Transmit yes -

Receive - yes

Transceive yes yes the microprocessor has to know the state of the

command (transmitting or receiving)

WriteE2 yes -

ReadE2 yes yes the microproce sso r has to prepare the arguments,

afterwards only reading is allowed

LoadKeyE2 yes -

LoadKey yes -

Authent1 yes -

Authent2 - -

LoadConfig yes -

CalcCRC yes -

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 16 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

(1)

The LoAlert flag bit is set to logic 1 when the FIFOLevel register’s WaterLevel[5:0] bits or

less are stored in the FIFO buffer. The trigger is generated by Equation 2:

(2)

9.3.4 FIFO buffer registers and flags

Table 14 shows the related FIFO buffer flags in al phabetic order.

9.4 Interrupt request system

The MFRC500 indicates interrupt even ts by setting the PrimaryS t atus register bit IRq (see

Section 10.5.1.4 “PrimaryStatus register” on page 45) and activating pin IRQ. The signal

on pin IRQ can be used to interrupt the microprocessor using its interrupt handling

capabilities ensuring efficient microprocessor software.

9.4.1 Interrupt sources overview

Table 15 shows the integrated interrupt flags, related source and setting condition. The

interrupt TimerIRq flag bit indicates an interrupt set by the timer unit. Bit TimerIRq is set

when the timer decrements from one down to zero (bit TAutoRestart disabled) or from one

to the TReLoadValue[7:0] with bit TAutoRestart enabled.

Bit TxIRq indicates int erru p ts from different source s and is set as fo llow s:

•the transmitter automatically sets the bit TxIRq interrupt when it is active and its state

changes from sending data to transmitting the end of frame pattern

•the CRC coprocessor sets the bit TxIRq after all data from the FIFO buffer has been

processed ind ica te d by bit CRCRe ad y = lo gic 1

•when EEPROM programming is finished, the bit TxIRq is set and is indicated by bit

E2Ready = logic 1

The RxIRq flag bit indicates an i nterrupt when the end of the received data is detected.

The IdleIRq flag bit is set when a command fin ishes and the content of the Command

HiAlert 64 FIFOLength–()WaterLevel≤=

LoAlert FIFOLength WaterLevel≤=

Table 14. Associated FIFO buffer registers and flags

Flags Register name Bit Register address

FIFOLength[6:0] FIFOLength 6 to 0 04h

FIFOOvfl ErrorFlag 4 0Ah

FlushFIFO Control 0 09h

HiAlert PrimaryStatus 1 03h

HiAlertIEn InterruptEn 1 06h

HiAlertIRq InterruptRq 1 07h

LoAlert PrimaryStatus 0 03h

LoAlertIEn InterruptEn 0 06h

LoAlertIRq InterruptRq 0 07h

WaterLevel[5:0] FIFOLevel 5 to 0 29h

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 17 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

When the FIFO buffer reaches the HIGH-level indicated by the W aterLevel[5:0] value (see

Section 9.3.3 on page 15) and bit HiAlert = log ic 1, th en the HiAlertIRq flag bit is set to

logic 1.

When the FIFO buf fer reache s the LOW- level indicated by the WaterLevel[5:0] value (see

Section 9.3.3 and bit LoAlert = logic 1, then LoAlertIRq flag bit is set to logic 1.

9.4.2 Interrupt request handling

9.4.2.1 Controlling interrupts and getting their status

The MFRC500 informs the microprocessor about the interrupt request source by setting

the relevant bit in th e Int er rup tRq reg iste r. The rele vance of each interrupt requ e st bit as

source for an interrupt can be masked by the InterruptEn register interrupt enable bits.

If an interrupt request flag is set to logic 1 (showing that an interrupt request is pending)

and the corresponding inter rupt enable flag is set, the Primar yS ta tus register IRq flag bit is

set to logic 1. Different interr upt so ur ces ca n activate simultaneously and because of this,

all interrupt req uest bit s are OR’ed , coupled to the IRq flag and th en forwarded to pin IRQ.

9.4.2.2 Accessing the interrupt registers

The interrupt request bits are automatically set by the MFRC500’s internal state

machines. In addition, the microprocessor can also set or clear the interrupt re quest bits

as required.

A special implementation of the InterruptRq and InterruptEn registers enables changing

an individual bit status without influencing any other bits. If an interrupt register is set to

logic 1, bit SetIxx and the specific bit must both be set to logic 1 at the same time. Vice

versa, if a specific interrupt flag is cleared, zero must be written to the SetIxx and the

interrupt register address must be set to logic 1 at the same time.

If a content bit is no t changed during the settin g or cleari ng phase, zero mu st be writte n to

the specific bit location.

Table 15. Interrupt sou rces

Interrupt flag Interrupt source Trigger action

TimerIRq timer unit timer counts from 1 to 0

TxIRq transmitter a data stream, transmitted to the card, ends

CRC coprocessor all data from the FIFO buffer has been processed

EEPROM all data from the FIFO buffer has been

programmed

RxIRq receiver a data stream, received from the card, ends

IdleIRq Command register command execution finishes

HiAlertIRq FIFO buffer FIFO buffer is full

LoAlertIRq FIFO buffer FIFO buffer is empty

Table 16. Interrupt control registers

InterruptEn SetIEn reserved TimerIEn TxIEn RxIEn IdleIEn HiAlertIEn LoAlertIEn

InterruptRq SetIRq reserved TimerIRq TxIRq RxIRq IdleIRq HiAlertIRq LoAlertIRq

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 18 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Example: Writing 3Fh to the InterruptRq register clears all bits. SetIRq is set to logic 0

while all other b its are set to logic 1. Writin g 81h to the In terruptRq register set s LoAlertIRq

to logic 1 and leaves all ot he r bits uncha nged .

9.4.3 Configuration of pin IRQ

The logic level of the IRq flag bit is visible on pin IRQ. The signal on pin IRQ can also be

controlled using the following IRQPinConfig register bits.

•bit IRQInv: the signal on pin IRQ is eq ual to the logic level of bit IRq when this bit is set

to logic 0. When set to logic 1, the signal on pin IRQ is inverted with respect to bit IRq.

•bit IRQPushPull: when set to logic 1, pin IRQ has CMOS output characteristics. When

it is set to logic 0, it is an open-drain output which requires an external resistor to

achieve a HIGH-level at pin IRQ.

Remark: During the reset phase (see Section 9.7.2 on page 25) bit IRQInv is set to

logic 1 and bit IRQPushPull is set to logic 0. This results in a high-impedance on pin IRQ.

9.4.4 Register overview interrupt request system

Table 17 shows the related interrupt request system flags in alphabetically.

Table 17. Associated In terrupt request system registers and flags

Flags Register name Bit Register address

HiAlertIEn InterruptEn 1 06h

HiAlertIRq InterruptRq 1 07h

IdleIEn InterruptEn 2 06h

IdleIRq InterruptRq 2 07h

IRq PrimaryStatus 3 03h

IRQInv IRQPinConfig 1 07h

IRQPushPull IRQPinConfig 0 07h

LoAlertIEn InterruptEn 0 06h

LoAlertIRq InterruptRq 0 07h

RxIEn InterruptEn 3 06h

RxIRq InterruptRq 3 07h

SetIEn InterruptEn 7 06h

SetIRq InterruptRq 7 07h

TimerIEn InterruptEn 5 06h

TimerIRq InterruptRq 5 07h

TxIEn InterruptEn 4 06h

TxIRq InterruptRq 4 07h

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 19 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.5 T imer unit

The timer derives its clock from the 13.56 MHz on-board chip clock. The microprocessor

can use this timer to manage timing-relevant tasks.

The timer unit may be used in one of the following configurations:

•Time ou t co un te r

•WatchDog counter

•Stopwatch

•Programmable one shot

•Periodical trigger

The timer unit can be used to measure the time interval between two events or to indicate

that a specific timed event occurred. The timer is triggered by events but does not

influence any event (e.g. a time-o ut during data rece iving does not automatically influence

the reception process). Several time r related flags can be set a nd these flags can be used

to generate an interrupt.

9.5.1 Timer unit implementation

9.5.1.1 Timer unit block diagram

Figure 7 shows the block diagram of the timer module.

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 20 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

The timer unit is designed, so that event s when combined with enabling flags start or stop

the counter. For example, setting bit TStartTxBe gin = logic 1 enables control of received

data with the timer unit. In ad dition, the first received bit is indicated by the TxBegin event.

This combination starts the counter at the defined TReloadValue[7:0].

The timer stops automatica lly when the counter value is equal to zero or if a defined stop

event happe ns.

9.5.1.2 C on tro lli ng th e ti mer unit

The main p art of the timer unit is a down counter. As long as the down counter value is not

zero, it decrements its value with each timer clock cycle.

If the TAutoRestart flag is enabled, the timer does not decrement down to zero. On

reaching value 1, the timer reloads the next clock function with the TReloadValue[7:0].

The timer is started immediately by loading a va lue from the TimerReload register into the

counter module.

This is activated by one of the following events:

Fig 7. Timer module block diagram

001aak61

TxEnd Event

TAutoRestart

TRunning

TStartTxEnd

TStartNow

START COUNTER/

PARALLEL LOAD

STOP COUNTER

TPreScaler[4:0]

TimerValue[7:0]

Counter = 0 ?

to interrupt logic: TimerIRq

PARALLEL OUT

PARALLEL IN

TReloadValue[7:0]

CLOCK

DIVIDER

COUNTER MODULE

(x ≤ x − 1)

TStopNow

TxBegin Event

TStartTxBegin

TStopRxEnd

RxEnd Event

TStopRxBegin

13.56 MHz

to parallel interface

RxBegin Event

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 21 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

•transmission of the first bit to th e card (TxBegin event) with bit TStart TxBegin = logic 1

•transmission of the last bit to the card (TxEnd event) with bit TStartTxEnd = logic 1

•bit TStartNow is set to logic 1 by the microprocessor

Remark: Every start event reloads the timer from the TimerReload register which

re-triggers the timer unit.

The timer can be configured to stop on on e of the following events:

•receipt of the first valid bit from the card (RxBegin event) with bit

TStopRxBegin = logic 1

•receipt of the last bit from the card (RxEnd event) with bit TStopRxEnd = logic 1

•the counter module has decremented down to zero and bit TAutoRestart = logic 0

•bit TStopNow is set to logic 1 by the microprocessor.

Loading a new value, e.g. zero, into the TimerReload register or changing the timer unit

while it is counting will not immediately influence the counter. In both cases, this is

because this register only affects the counter conten t after a start event.

If the counter is stopped when bit TStopNow is set, no TimerIRq is flagged.

9.5.1.3 Timer unit clock and pe ri od

The timer unit clock is derived from the 13.56 MHz on-board chip clock using the

programmable divider. Clock selection is made using the TimerClock register

TPreScaler[4 :0 ] bi ts based on Equation 3:

(3)

The values for the TPreScaler[4:0] bits are between 0 and 21 which results in a minimum

periodic time (TTimerClock) of between 74 ns and 150 ms.

The time period elapsed since the last start event is calculated using Equation 4:

(4)

This results in a minim um time period (tTimer) of between 74 ns and 40 s.

9.5.1.4 Timer unit stat u s

The SecondaryStatus register’s TRunning bit shows the timer’s status. Configured start

events start the timer at the TReloadValue[7:0] and change the status flag TRunning to

logic 1. Conversely, configured stop events stop the timer and set the TRunning statu s

flag to logic 0. As long as status flag TRunning is set to logic 1, the TimerValue register

changes on the next timer unit clock cycle.

The TimerValue[7:0] bits can be read dir ectly from the TimerValue register.

fTimerClock 1

TTimerClock

--------------------------- 2TPreScaler

13.56

-------------------------- MHz][==

tTimer TReLoadValue TimerValue–

fTimerClock

-----------------------------------------------------------------------------s[]=

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 22 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.5.2 Using the timer unit functions

9.5.2.1 T ime-out and WatchDog counters

After st arting the timer using TReloadValue[7:0], the timer unit decrement s the T imerValue

being received from the card, the timer unit stops without generating an interrupt.

If a stop event does not occur, such as the card not answering within the expected time,

the timer unit decrements down to zero and generates a timer interrupt request. This

signals to the microprocessor the expected event has not occurred within the given time

(tTimer).

9.5.2.2 Stopwatch

The time (tTimer) between a start and stop event is mea sured by the mi croproce ssor using

the timer unit. Setting the TReloadValue register triggers the timer which in turn, st arts to

decrement. If the defined stop event occurs, the timer stops. The time between start and

stop is calculated by the microprocessor using Equation 5 when the time does not

decrement down to zero.

(5)

9.5.2.3 Programmable one shot timer and periodic trigger

Programmable one shot timer: The microprocessor starts the timer unit and wait s for

the timer interrupt. The interrupt occurs after the time specified by tTimer.

Periodic trigger: If the microp rocesso r set s the TAutoRestart bit, it generates an interrupt

request after every tTimer cycle.

Δt TReLoadvalue TimerValue–()tTimer

×=

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 23 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.5.3 Timer unit registers

Table 18 shows the related flags of the timer unit in alphabetical order.

9.6 Power reduction modes

9.6.1 Hard power-down

Hard power-down is enabled when pin RSTPD is HIGH. This turns off all internal current

sinks including the oscillator . All digit al input buffers are separated from the input pa ds and

defined internally (except pin RSTPD itself). The output pins are frozen at a given value.

The status of all pins during a hard power-down is shown in Table 19.

Table 18. Associated time r un it registers and flags

Flags Register name Bit Register address

TAutoRestart TimerClock 5 2Ah

TimerValue[7:0] TimerValue 7 to 0 0Ch

TReloadValue[7:0] TimerReload 7 to 0 2Ch

TPreScaler[4:0] TimerClock 4 to 0 2Ah

TRunning SecondaryStatus 7 05h

TStartNow Control 1 09h

TStartTxBegin TimerControl 0 2Bh

TStartTxEnd TimerControl 1 2Bh

TStopNow Control 2 09h

TStopRxBegin TimerControl 2 2Bh

TStopRxEnd TimerControl 3 2Bh

Table 19. Signal on pins during Har d power-down

Symbol Pin Type Description

OSCIN 1 I not separate d from input, pul led to AVSS

IRQ 2 O high-impedance

MFIN 3 I separated from input

MFOUT 4 O LOW

TX1 5 O HIGH, if bit TX1RFEn = logic 1

LOW, if bit TX1RFEn = logic 0

TX2 7 O HIGH, only if bit TX2RFEn = logic 1 and bit

TX2Inv = logic 0

otherwise LOW

NCS 9 I separated from input

NWR 10 I separated from inp ut

NRD 11 I separated from input

D0 to D7 13 to 20 I/O separated from input

ALE 21 I separated from input

A0 22 I/O separated from input

A1 23 I separated from input

A2 24 I separated from input

AUX 27 O high-impedance

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 24 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.6.2 Soft power-down mode

Soft power-down mode is entered immediately using the Control register bit PowerDown.

All internal current sinks, including the oscillator buffer, are switched off. The digital input

buffers are not separated from the input pads and keep their functionality. In addition, the

digital output pins do not change their state.

After resetting the Control register bit PowerDown, the bit indicating Soft power-down

mode is only clear ed after 51 2 clock cycles. Resetting it does not immediately clea r it. The

PowerDown bit is automatically cleared when the Soft power-down mode is exited.

Remark: When the internal oscillator is used, time (tosc) is required for the oscillator to

become stable. This is because the internal oscillator is supplied by VDDA and any clock

cycles will not be detected by the internal logic until VDDA is stable.

9.6.3 Standby mode

The S t andby mode is immediately entered when the Control register S tandBy bit is set. All

internal current sinks, including the internal digital clock buff er are switched off. However,

the oscillator buffer is not switched off.

The digital input buffers are not separated by the input pads, keeping their functionality

and the digital output pins do not change their state. In addition, the oscillator does not

need time to wake-up.

After r esetting the Control r egister St andBy bit, it t akes four clock cycles on pin OSCIN for

Standby mode to exit. Resetting bit StandBy does not immediately clear it. It is

automatically cleared when the Standby mode is exited.

9.6.4 Automatic receiver power-down

It is a power saving feature to switch off the receiver circuit when it is not needed. Setting

bit RxAutoPD = logic 1, automatically powers down the receiver when it is not in use.

Setting bit RxAutoPD = logic 0, keeps the receiver continuously powered up.

RX 29 I not changed

VMID 30 A pulled to VDDA

RSTPD 31 I not changed

OSCOUT 32 O HIGH

Table 19. Signal on pins during Har d power-down …continued

Symbol Pin Type Description

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 25 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.7 StartUp phase

The events executed during the StartUp phase are shown in Figure 8.

9.7.1 Hard power-down phase

The hard power-down pha se is active during the following cases:

•a Power-On Reset (POR) caused by power-up on pins DVDD or AVDD activated

when VDDD or VDDA is below the relevant analog/digital reset threshold.

•a HIGH-level on pin RSTPD which is active while pin RSTPD is HIGH. The HIGH level

period on pin RSTPD must be at least 100 μs (tPD ≥ 100 μs). Shorter phases will not

necessarily result in the reset phase (treset). The rising or falling edge slew rate on pin

RSTPD is not critical because pin RSTPD is a Schmitt trigger input.

9.7.2 Reset phase

The reset phase automatically follows the Hard power-down. Once the oscillator is

running stably, the reset phase takes 512 clock cycles. During the reset phase, some

description of each register (see Section 10. 5 on page 43).

Remark: When the internal oscillator is used, time (tosc) is required for the oscillator to

become stable. This is because the internal oscillator is supplied by VDDA and any clock

cycles will not be detected by the internal logic until VDDA is stable.

9.7.3 Initialization phase

The initialization phase automatically follows the reset phase and takes 128 clock cycles.

During the initializing phase the content of the EEPROM blocks 1 and 2 is copied into the

Remark: During the production test, the MFRC500 is initialized with default configuration

values. This reduces the microprocessor’s configuration time to a minimum.

9.7.4 Initializing the parallel interface type

A differ ent initialization seque nce is used for each microprocessor. This enables detection

of the correct microprocessor interface type and synchronization of the microprocessor’s

and the MFRC500’s start-up. See Section 9.1.3 on page 8 for detailed information on the

different connections for each microprocessor interface type.

During StartUp phase, the command value is set to 3Fh once the oscillator attains clock

frequency stability at an amplitude of > 90 % of the nominal 13.56 MHz clock frequency. At

the end of the initialization phase, the MFRC500 automatically switches to idle and the

command value changes to 00h.

Fig 8. Th e StartUp procedure

001aak61

StartUp phase

states

tRSTPD treset tinit

Hard power-

down phase Reset phase Initialising

phase ready

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 26 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

To ensure correct detection of the microprocessor interface, the following sequence is

executed:

•the Command register is read until th e 6-bit register value is 00h. On reading the 00h

value, the internal initialization phase is complete and the MFRC500 is ready to be

controlled

•write 80h to the Page register to initialize the microprocessor interface

•read the Command register. If it returns a va lue of 00h, the microprocessor interface

was successfully initialized

•write 00h to the Page registers to activate linear addressing mode.

9.8 Oscillator circuit

The clock applied to the MFRC500 acts as a time basis for the synchronous system

encoder and decoder. The stability of the clock frequency is an important factor for correct

operation. To obtain highest performance , clock jitter must be as small as possible. This is

best achieved by using the internal oscillator buffer with the recommended circuitry.

If an external clock source is used, the clock signal must be applied to pin OSCIN. In this

case, be very careful in optimizing clock duty cycle and clock jitter. Ensure the clock

quality has been verified. It must meet the specifications described in Section 13.4.4 on

page 90.

Remark: We do not recommend using an external clock source.

Fig 9. Quartz clock connection

001aak61

13.56 MHz

15 pF 15 pF

OSCOUT OSCIN

DEVICE

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 27 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.9 Transmitter pins TX1 and TX2

The signal on pins TX1 and TX2 is the 13.56 MHz energy carrier modulated by an

envelope signal. It can be used to drive an antenna directly, using minimal passive

components for matching an d filtering (see Section 15.1 on page 91). To enable this, the

output circuitry is designed with a very low-impedance source resistance. The TxControl

9.9.1 Configuring pins TX1 and TX2

TX1 pin configurations are described in Table 20.

TX2 pin configurations are described in Table 21.

Table 20. Pin TX1 configu rations

TxControl register configuration Envelope TX1 signal

TX1RFEn FORCE100ASK

0 X X LOW (GND)

1 0 0 13.56 MHz carrier frequency modulated

1 0 1 13.56 MHz carrier frequency

110LOW

1 1 1 13.56 MHz energy carrier

Table 21. Pin TX2 configu rations

TxControl register configuration Envelope TX2 signal

TX2RFEn FORCE100ASK TX2CW TX2Inv

0X XXXLOW

1 0 0 0 0 13.56 MHz carrier frequency

modulated

1 0 0 0 1 13.56 MHz carrier frequency

1 0 0 1 0 13.56 MHz carrier frequency

modulated, 180° phase -shift

relative to TX1

1 0 0 1 1 13.56 MHz carrier frequency,

180° phase-shift relative to TX1

1 0 1 0 X 13.56 MHz carrier frequency

1 0 1 1 X 13.56 MHz carrier frequency,

180° phase-shift relative to TX1

11 000LOW

1 1 0 0 1 13.56 MHz carrier frequency

11 010HIGH

1 1 0 1 1 13.56 MHz carrier frequency,

180° phase-shift relative to TX1

1 1 1 0 X 13.56 MHz carrier frequency

1 1 1 1 X 13.56 MHz carrier frequency,

180° phase-shift relative to TX1

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 28 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.9.2 Antenna operating distance versus power consumption

Using different antenna matching circuits (by varying the supply voltage on the antenna

driver supply pin TVDD), it is possible to find the trade-off between maximum effective

operating distance and power consumption. Different antenna matching circuits are

described in the Application note “MIFARE Design of MFRC500 Matching Circuit and

Antennas”.

9.9.3 Antenna driver output source resistance

The output source conductance of pins TX1 and TX2 can be adjusted between 1 Ω and

100 Ω using the CwConductance register Gs Cf gC W[5 :0 ] bits.

The output sour ce conduct ance of pins TX1 and TX2 durin g the modulatio n phase can be

adjusted between 1 Ω and 100 Ω using the ModConduct ance register GsCfgMod[5:0] bit s.

The values are relative to the reference resistance (RS(ref)) which is measured during the

production test and stored in the MFRC500 EEPROM. It can be read from the product

information field (see Section 9.2.1 on page 11). The electrical specification can be found

in Section 13.3.3 on page 86.

9.9.3.1 Source resistance table

Table 22. TX1 and TX2 source resistance of n-channel driver transi s tor again s t GsCfg CW or GsCfg Mod

MANT = Mantissa; EXP= Exponent.

GsCfgCW,

GsCfgMod

(decimal)

EXPGsCfgCW,

EXPGsCfgMod

(decimal)

MANTGsCfgCW,

MANTGsCfgMod

(decimal)

RS(ref)

(Ω)GsCfgCW,

GsCfgMod

(decimal)

EXPGsCfgCW,

EXPGsCfgMod

(decimal)

MANTGsCfgCW,

MANTGsCfgMod

(decimal)

RS(ref)

(Ω)

0 0 0 - 24 1 8 0.0652

16 1 0 - 25 1 9 0.0580

32 2 0 - 37 2 5 0.0541

48 3 0 - 26 1 10 0.0522

1 0 1 1.0000 27 1 11 0.0474

17 1 1 0.5217 51 3 3 0.0467

2 0 2 0.5000 38 2 6 0.0450

3 0 3 0.3333 28 1 12 0.0435

33 2 1 0.2703 29 1 13 0.0401

18 1 2 0.2609 39 2 7 0.0386

4 0 4 0.2500 30 1 14 0.0373

5 0 5 0.2000 52 3 4 0.0350

19 1 3 0.1739 31 1 15 0.0348

6 0 6 0.1667 40 2 8 0.0338

7 0 7 0.1429 41 2 9 0.0300

49 3 1 0.1402 53 3 5 0.0280

34 2 2 0.1351 42 2 10 0.0270

20 1 4 0.1304 43 2 11 0.0246

8 0 8 0.1250 54 3 6 0.0234

9 0 9 0.1111 44 2 12 0.0225

21 1 5 0.1043 45 2 13 0.0208

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 29 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.9.3.2 Calculating the relative source resistance

The reference sour ce resistance RS(ref) can be calculated using Equation 6.

(6)

The reference source resistance (RS(ref)) during the modulation phase can be calculated

using ModConductance register’s GsCfgMod[5:0].

9.9.3.3 Calcula ting the effective source resistance

Wiring resistance (RS(wire)): Wiring and bonding add a constant offset to the driver

resistance that is relevant when pins TX1 and TX2 are switched to low-imp e danc e. The

additional resistance for pin TX1 (RS(wire)TX1) can be set approximately as shown in

Equation 7.

(7)

Effective resistance (RSx): The source resistances of the driver transistors (RsMaxP

byte) read from the Product Information Field (see Section 9.2.1 on page 11) are

measured during the production test with CwConduct ance register’s

GsCfgCW[5:0] = 01h.

To calculate the driver resistance for a specific value set in GsCfgMod[5:0], use

Equation 8.

(8)

10 0 10 0.1000 55 3 7 0.0200

11 0 11 0.0909 46 2 14 0.0193

35 2 3 0.0901 47 2 15 0.0180

22 1 6 0.0870 56 3 8 0.0175

12 0 12 0.0833 57 3 9 0.0156

13 0 13 0.0769 58 3 10 0.0140

23 1 7 0.0745 59 3 11 0.0127

14 0 14 0.0714 60 3 12 0.0117

50 3 2 0.0701 61 3 13 0.0108

36 2 4 0.0676 62 3 14 0.0100

15 0 15 0.0667 63 3 15 0.0093

Table 22. TX1 and TX2 source resistance of n-channel driver transi s tor again s t GsCfg CW or GsCfg Mod …continued

MANT = Mantissa; EXP= Exponent.

GsCfgCW,

GsCfgMod

(decimal)

EXPGsCfgCW,

EXPGsCfgMod

(decimal)

MANTGsCfgCW,

MANTGsCfgMod

(decimal)

RS(ref)

(Ω)GsCfgCW,

GsCfgMod

(decimal)

EXPGsCfgCW,

EXPGsCfgMod

(decimal)

MANTGsCfgCW,

MANTGsCfgMod

(decimal)

RS(ref)

(Ω)

RSref() 1

MANTGsCfgCW 77

------

⎝⎠

⎛⎞

EXPGsCfgCW

•

--------------------------------------------------------------------------------

RSwire()TX1 500 mΩ≈

RSx RSref()maxP RSwire()TX1

–()RSrel()RSwire()TX1

+•=

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 30 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.9.4 Pulse width

The envelope carries the data signal information that is transmitted to the card. It is an

encoded data signal based on the Miller code. In addition, each pa us e of the Miller

encoded signal is again encoded as a pulse of a fixed width. The width of the pulse is

adjusted using the ModWidth register. The pulse width (tw) is calculated using Equation 9

where the freq uen cy c ons tant (fclk) = 13.56 MHz.

(9)

9.10 Receiver circuit

The MFRC500 uses an integrated quadrature demodulation circui t en ablin g it to ext ra ct

the ISO/IEC 14443 A compliant subcarrier from the 13.56 MHz ASK modulated signal

applied to pin RX.

The quadrature demodulator uses two different clocks (Q-clock and I-clock) with a

phase-shift of 90° between them. Both resulting subcarrier signals are amplified, filtered

and forwarded to the correlat ion circuitry. The correlation results are evalua ted , dig itize d

and then passed to the digital circuitry. Various adjustments can be made to obtain

optimum performance for all processing units.

9.10.1 Receiver circuit block diagram

Figure 10 shows the block diagram of the receiver circuit. The receiving process can be

broken down in to several steps. Qu adrature demodulation of the 13.56 MHz carrier signa l

is performed. To achieve the optimum performance, automatic Q-clock calibration is

recommended (see Section 9.10.2.1 on page 31).

The demodulated signal is amplified by an adjustable amplifier. A correlation circuit

calculates the de g re e of sim ilar ity be tw een the expected and the received signal. The

BitPhase register enables correlation inter val position alignment with the received signal’s

bit grid. In the evaluation and digitizer circuitry, the valid bits are detected and the digital

results are sent to the FIFO buffer. Several tuning steps are possible for this circuit.

tw2ModWidth 1+

fclk

-------------------------------------

Fig 10. Receiver circuit block dia g ra m

001aak61

ClkQDelay[4:0]

ClkQCalib

ClkQ180Deg

BitPhase[7:0]

CORRELATION

CIRCUITRY

EVALUATION

AND

DIGITIZER

CIRCUITRY

MinLevel[3:0]

CollLevel[3:0]

RxWait[7:0]

RcvClkSell

s_valid

s_data

s_coll

s_clock

Gain[1:0]

TestAnaOutSel

clock

I TO Q

CONVERSION

I-clock Q-clock

13.56 MHz

DEMODULATOR

VCorrDI

VCorrNI

VCorrDQ

VCorrNQ

VEvalR

VEvalL

VRxFollQ

VRxFollI VRxAmpI

VRxAmpQ

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 31 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

The signal can be observed on its way through the receiver as shown in Figure 10. One

signal at a time can be ro uted to pin AUX using the TestAnaSelect register as descr ibed in

Section 15.2.2 on page 96.

9.10.2 Receiver operation

In general, the defa ult settings programmed in the Sta rtUp initialization fil e are suit able fo r

use with the MFRC500 to MIFARE card data communication. However, in some

environments specific user settings will achieve better performance.

9.10.2.1 Automatic Q-clock calibration

The quadrature demodulation concept of the receiver generates a phase signal (I-clock)

and a 90° phase-shifted quadrature signal (Q-clock). To achieve the optimum

demodulator perfor mance, the Q-clock and the I-clock must be phase-shifted by 90°. Af ter

the reset phase, a calibration procedure is automatically performed.

Automatic calibration can be set-up to execute at the end of each Transceive command if

bit ClkQCalib = logic 0. Setting bit ClkQCalib = logic 1 disables all automatic calibrations

except after the reset sequence. Automatic calibration can also be triggered by the

software when bit ClkQCalib has a logic 0 to logic 1 transition.

Remark: The duration of the automatic Q-clock calibration is 65 oscillator periods or

approximately 4.8 μs.

The ClockQControl register’s ClkQDelay[4:0] value is proportional to the phase-shift

between the Q- clo ck an d th e I-c lock. The ClkQ180Deg status flag bit is set when th e

phase-shift between the Q-clock and the I-clock is greater than 180°.

Remark:

•The StartUp config uration file enables automatic Q-clock calibration af ter a reset

•If bit ClkQCalib = logic 1, automatic calibration is not performed. Leaving this bit set to

logic 1 can be used to permanently disable automatic calibration.

•It is possible to write data to the ClkQDelay[4:0] bits using the microprocessor. The

aim could be to disable automatic calibration and set the delay using the software.

Configuring the delay value using the software requires bit ClkQCalib to have been

previously set to logic 1 and a time interval of at least 4.8 μs has elap sed. Each delay

value must be written with bit ClkQCalib set to logic 1. If bit ClkQCalib is logic 0, the

configured delay value is overwritten by the next automatic calibration interval.

Fig 11. Automatic Q-clock calibration

001aak61

calibration impulse

from reset sequence a rising edge initiates

Q-clock calibration

ClkQCalib bit

calibration impulse

from end of

Transceive command

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 32 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.10.2.2 Amplifier

The demodulated signal must be amplified by the variable amplifier to achieve the best

performance. The gain of the amplifiers can be adjusted using the RxControl1 register

Gain[1:0] bits; see Table 23.

9.10.2.3 Correlation circuitry

The correlation circuitry calculates the degree of matching between the received and an

expected signal. The output is a measure of the amplitude of the expected signal in the

received signal. This is done for both, the Q and I-channels. The correlator provides two

outputs for each of the two input channels, resulting in a total of four output signals.

The correlation circuitry needs the phase information for the incoming card signal for

optimum performance. This information is defined for the microprocessor using the

BitPhase register. This value defines the pha se relationship between the transmitter and

receiver clock in multiples of the BitPhase time (tBitPhase)=1/13.56MHz.

9.10.2.4 Evaluation and digitizer circuitry

The correlation results are evaluated for each bit-half of the Manchester encoded signal.

The evaluation and digitizer circuit decides from the signal strengths of both bit- halves, if

the current bit is valid

•If the bit is valid, its value is identified

•If the bit is not valid, it is checked to identify if it contains a bit-collision

Select the following levels for optimal using RxThreshold register bits:

•MinLevel[3:0]: defines the minimum signal strength of the stronger bit-halve’s signal

which is considered valid.

•CollLevel[3:0]: defines the minimum signal strength relative to the amplitude of the

stronger half-bit that has to be exceeded by the weaker half-bit of the Manchester

encoded signal to generate a bit-collision. If the signal’s strength is below this value,

logic 1 and logic 0 can be determined unequivocally.

After data transmission, the card is not allowed to send its response before a preset time

period which is called the frame guard time in the ISO/IEC 14443 standard. The length of

this time period is set using the RxWait register’s RxWait[7:0] bits. The RxWait register

defines when the r eceiver is switched on after dat a transmission to the card in multiples of

one bit duration.

If bit RcvClkSelI is set to logic 1, the I-clock is used to clock the correlator and evaluation

circuits. If bit RcvClkSelI is set to logic 0, the Q-clock is used.

Table 23. Gain factors for the internal amplifier

See Table 78 “RxControl1 register bit descriptions” on page 55 for additional information.

(simulation results)

00 20

01 24

10 31

11 35

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 33 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Remark: It is recommended to use the Q-clock.

9.11 Serial signal switch

The MFRC500 comprises two main blocks:

•digital circuitry: comprising the state machines, encoder and decoder logic etc.

•analog circuitry: comprising the modulator, antenna drivers, receiver and

amplification circuitry

The interface between these two bl ocks can be configured so that the interface sign als

are routed to pins MFIN an d MFOUT. This make s it possible to connect the analog p art of

one MFRC500 to the digital part of another device.

9.11.1 Serial signal switch block diagram

Figure 12 shows the serial signal switches. Three different switches are implemented in

the serial signal switch enabling the MFRC500 to be used in different configurations.

The serial signal switch can also be used to check the transmitted and received data

during the design-in phase or for test purposes. Section 15.2.1 on page 94 describes the

analog test signals and measurements at the serial signal switch.

Remark: The SLR400 uses pin name SIGOUT for pin MFOUT. The MFRC500

functionality includes the test modes for the SLRC400 using pin MFOUT.

Fig 12. Serial signal switch block diagram

001aak61

MFIN MFOUT

MODULATOR DRIVER

(part of)

analog circuitry

SUBCARRIER

DEMODULATOR

TX1

TX2

CARRIER

DEMODULATOR

MILLER CODER

1 OUT OF 256

NRZ OR

1 OUT OF 4

MANCHESTER

DECODER

SERIAL SIGNAL SWITCH

(part of)

serial data processing

Decoder

Source[1:0]

Modulator

Source[1:0]

SUBCARRIER

DEMODULATOR

serial data out

1 internal

2 Manchester with subcarrier

envelope

MFIN

Manchester

Manchester out

serial data in

envelope

transmit NRZ

Manchester with subcarrier

Manchester

reserved

MFOUTSelect[2:0]

digital test signal

signal to MFOUT

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 34 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Section 9.11.2, Section 9.11.2.1 and Section 9.11.2.2 describe the relevant re gisters and

settings used to configure and control the serial signal switch.

9.11.2 Serial signal switch registers

The RxControl2 registe r DecoderSource[1:0] bits define the input signal for the internal

Manchester decoder and are described in Table 24.

The TxControl register ModulatorSource[1:0] bits define the signal used to modulate the

transmitted 13.56 MHz energy carrier. The modulated signal drives pins TX1 and TX2.

The MFOUTSelect register MFOUTSelect[2:0] bits select the output signal which is to be

routed to pin MFOUT.

Table 24. DecoderSourc e[1:0] valu es

See Table 88 on page 57 for additional information.

Number DecoderSource

[1:0] Input signal to decoder

0 00 constant 0

1 01 output of the analog part. This is the default configuration

2 10 direct connection to pin MFIN; expects an 847.5 kHz subcarrier

signal modulated by a Manchester encoded signal

3 11 direct connection to pin MFIN; expects a Manchester encoded

signal

Table 25. ModulatorSource[1:0] values

See Table 88 on page 57 for additional information.

Number ModulatorSource

[1:0] Input signal to modulator

0 00 constant 0 (energy carrier off on pins TX1 and TX2)

1 01 constant 1 (continuous energy carrier on pins TX1 and TX2)

2 10 modulation signal (envelope) from the internal encoder. This is the

default configuration.

3 11 direct connection to MFIN; expects a Miller pulse coded signal

Table 26. MFOUTSelect[2:0] values

See Table 102 on page 60 for additional information.

Number MFOUTSelect

[2:0] Signal routed to pin MFOUT

0 000 constant LOW

1 001 constant HIGH

2 010 modulation signal (envelope) from the internal encoder

3 011 serial data stream to be transmitted; the same as for

MFOUTSelect[2:0] = 010 but not encoded by the selected pulse

encoder

4 100 output signal of the receiver circuit; card modulation signal

regenerated and dela yed

5 101 output signal of the subcarrier demodulator; Manchester coded card

signal

6110 reserved

7111 reserved

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 35 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Remark: To use the MFOUTSelect[2:0] bits, the TestDigiSelect register SignalToMFOUT

bit must be logic 0.

9.11.2.1 Active antenna concept

The MFRC500 analog and digital circuitry is accessed using pins MFIN and MFOUT.

Table 27 lists the required settings.

[1] The number column refers to the value in the number column of Table 24, Table 25 and Table 26.

Two MFRC500 devices configured as described in Table 27 can be connected to each

other using pins MF OUT an d M FI N .

9.11.2.2 Driving both RF parts

It is possible to connect both pa ss ive and active antennas to a single IC. The passive

antenna pins TX1, TX2 and RX are connected using the appropriate filter and matching

circuit. At the same time an active antenna is connected to pins MFOUT and MFIN. In this

configuration, two RF parts can be driven, one after another, by one microprocessor.

9.12 MIFARE authentication and Crypto1

The security algorithm used in the MIFARE products is called Crypto1. It is based on a

proprietary stream cipher with a 48-bit key length. To access data on MIFARE cards,

knowledge of the key format is needed. The correct key must be available in the

MFRC500 to enable successful card authentication and access to the card’s data stored

in the EEPROM.

After a card is selected as defined in ISO/IEC 14443 A standard, the user can continue

with the MIFARE protocol. It is mandatory that the card authentication is performed.

Crypto1 authentication is a 3-pass authentication which is automatically performed when

the Authent1 and Authent2 commands are executed (see Section 11.6.3 on page 82 and

Section 11.6.4 on page 82).

During the card authentication procedure, the security algorithm is initialized. After a

successful authentication, communication with the MIFARE card is encrypted.

Table 27. Register setting s to enable use of the analog circuitry

Analog circ ui try settings

ModulatorSource 3 Miller pulse encoded MFIN

MFOUTSelect 4 Manchester encoded with subcarrier MFOUT

DecoderSource X - -

Digital circuitry settings

ModulatorSource X - -

MFOUTSelect 2 Miller pulse encoded MFOUT

DecoderSource 2 Manchester encoded with subcarrier MFIN

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 36 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

9.12.1 Crypto1 key handling

On execution of the authentication command, the MFRC500 reads the key from the key

buffer. The key is always read from the key buffer and ensures Crypto1 authentication

commands do not require addr essing of a key. The user must ensure the correct key is

prepared in the key buffer before triggering card authentication.

The key buffer can be loaded from:

•the EEPROM using the LoadKeyE2 command (see Sectio n 11.6.1 on page 81 )

•the microprocessor’s FIFO buffer using the LoadKey command (see Section 11.6.2

on page 81). This is shown in Figure 13.

9.12.2 Authentication procedure

The Crypto1 security algorithm en ables authentication of MIFARE cards. To obtain valid

authentication, the corr ect ke y has to be available in the key bu ffer of the MFRC500. This

can be ensured as follows:

1. Load the internal key buffer by using the LoadKeyE2 (see Section 11.6.1 on pa ge 81)

or the LoadKey (see Section 11.6.2 on page 81) commands.

2. Start the Authent1 command (see Section 11.6.3 on page 82). When finished, check

the error flags to obtain the command execution status.

3. Start the Authent2 command (see Section 11.6.4 on page 82). When finished, check

the error flags and bit Crypto1On to obtain the command execution status.

Fig 13. Crypto1 key hand ling block diagram

001aak62

FIFO BUFFER

from the microcontroller

WriteE2

LoadKey

EEPROM

KEYS

KEY BUFFER

LoadKeyE2

during

Authent1

CRYPTO1

MODULE

serial data stream outserial data stream in

(plain) (encrypted)

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 37 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10. MFRC500 registers

10.1 Register addressing modes

Three methods can be used to operate the MFRC500:

•initiating functions and controlling data by executing commands

•configuring the functional operation using a set of configuration bits

•monitoring the state of the MFRC500 by reading status flags

The commands, configuration bits and flags are accessed using the microprocessor

interface. The MFRC500 can internally address 64 registers using six address lines.

10.1.1 Page registers

The MFRC500 register set is segmented into eight pages contain eight registers each. A

Page register can always be addressed, irrespective of which page is currently selected.

10.1.2 Dedicated address bus

When using the MFRC500 with the dedicated address bus, the microprocessor defines

three address lines using address pins A0, A1 and A2. This enables addressing within a

page. To switch between registers in different pages a paging mechanism needs to be

used.

Table 28 shows how the register address is assembled.

10.1.3 Multiplexed address bus

The microprocessor may define all six address lines at once using the MFRC500 with a

multiplexed address bus. In this case either the paging mechanism or linear addressing

can be used.

Table 29 shows how the register address is assembled.

Table 28. Dedicated add ress bus: assembling the register address

1 PageSelect2 PageSelect1 PageSelect0 A2 A1 A0

Table 29. Multiplexed address bus: assembling the register address

Multiplexed

address bus

type

UsePage

Select Register address

Paging mode 1 PageSelect2 PageSelect1 PageSelect0 AD2 AD1 AD0

Linear

addressing 0 AD5 AD4 AD3 AD2 AD1 AD0

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 38 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.2 Register bit behavior

Bits and flags for different registers be h ave differently, depend ing on th eir func tio ns . In

principle, bits with same behavior are grouped in common registers. Table 30 describes

the function of th e Acce ss co lum n in the re gis te r tables.

Table 30. Behavior and desig na tion of reg ister bits

Abbreviation Behavior Description

R/W read and write These bits can be read and written by the microprocessor.

Since they are on l y use d for con trol, their content is not

influenced by internal state machines.

Example: TimerReload register may be read and written by

the microprocessor. It will also be read by internal state

machines but never changed by them.

D dynamic These bits can be read and written by the microprocessor.

Nevertheless, they may also be written automatically by

internal state machines.

Example: the Command register changes its value

automati cally after the execution of the command.

R read only These registe rs ho ld flags which have a value determined by

internal states only.

Example: the ErrorFlag register cannot be written externally

but shows inte rnal states.

W write only These registers are used for control only. They may be written

by the microprocessor but cannot be read. Reading these

registers returns an undefined value .

Example: The TestAnaSelect register is used to determine the

signal on pin AUX however, it is not possible to read its

content.

0, 1 or x generic value Where applicable, the values 0 and 1 indicate the expected

logic value for a given bit. Where X is used, any logic value can

be entered

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 39 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.3 Register overview

Table 31. MFRC500 register overview

Sub

address

(Hex)

Page 0: Command and status

00h Page selects the page register Table 33 on page 43

01h Command starts and stops command execution Table 35 on page 44

02h FIFOData input and output of 64-byte FIFO buffer Table 37 on page 44

03h PrimaryStatus receiver and transmitter and FIFO buffer status flags Table 39 on page 45

04h FIFOLength number of bytes buffered in the FIFO buffer Table 41 on page 46

05h SecondaryStatus secondary status flags Table 43 on page 46

06h InterruptEn enable and disable interrupt request control bits Table 45 on page 47

07h InterruptRq interrupt request flags Table 47 on page 47

Page 1: Control and status

08h Page selects the page register Table 33 on page 43

09h Control control flags for timer unit, power saving etc Table 49 on page 48

0Ah ErrorFlag show the error status of the last command executed Table 51 on page 49

0Bh CollPos bit position of the first bit-collision detected on the RF in terface Table 53 on page 50

0Ch Ti merValue value of the timer Table 55 on page 50

0Dh CRCResultLSB LSB of the CRC coprocessor re gister Table 57 on page 50

0Eh CRCResultMSB MSB of the CRC coprocessor register Table 59 on page 51

0Fh BitFraming adjustments for bit oriented frames Table 61 on page 51

Page 2: Transmitter and coder control

10h Page selects the page register Table 33 on page 43

11h TxControl controls the operation of the antenna driver pins TX1 and TX2 Table 63 on page 52

12h CwConductance selects the conductance of the antenna driver pins TX1 and TX2 Table 65 on page 53

13h PreSet13 do not change these values Table 67 on page 53

14h PreSet14 do not change these values Table 69 on page 53

15h ModWidth selects the modulation pulse width Table 71 on page 54

16h PreSet16 do not change these values Table 73 on page 54

17h PreSet17 do not change these values Table 75 on page 54

Page 3: Receiver and decoder con t rol

18 Page selects the page register Table 33 on page 43

19 RxControl1 controls receiver behavior Table 77 on page 55

1A DecoderControl controls decoder behavior Table 79 on page 55

1B BitPhase selects the bit-phase between transmitter and receiver clock Table 81 on page 56

1C RxThreshold s elects thresholds for the bit decoder Table 83 on page 56

1D Pre Se t1 D do not change these values Table 85 on page 56

1Eh RxControl2 controls decoder and defines the receiver input source Table 87 on page 57

1Fh ClockQControl clock control for the 90° phase-shifted Q-channel clock Table 89 on page 57

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 40 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Page 4: RF Timing and channel redundancy

20h Page selects the page register Table 33 on page 43

21h RxWait selects the interval after transmission before the receiver starts Table 91 on page 58

22h ChannelRedundancy selects the method and mode used to check data integrity on

the RF channel Table 93 on page 58

23h CRCPresetLSB preset LSB value for the CRC register Table 95 on page 59

24h CRCPresetMSB preset MSB value for the CRC register Table 97 on page 59

25h PreSet25 do not change these values Table 99 on page 59

26h MFOUTSelect selects internal signal applied to pin MFOUT, includes the MSB

of value TimeSlotPeriod; see Table 101 on page 60 Table 101 on page 60

27h PreSet27 do not change these values Table 103 on page 60

Page 5: FIFO, timer and IRQ pi n co nfiguration

28h Page selects the page register Table 33 on page 43

29h FIFOLevel defines the FIFO buffer overflow and underflow warning levels Table 41 on page 46

2Ah TimerClock selects the timer clock divider Table 107 on page 61

2Bh TimerControl selects the timer start and stop conditions Table 109 on page 62

2Ch TimerReload defines the timer preset value Table 111 on page 62

2Dh IRQPinConfig configures pin IRQ output stage Table 113 on page 63

2Eh PreSet2E do not change these values Table 115 on page 63

2Fh P reSet2F do not change these values Table 116 on page 63

Page 6: reserved registers

30h Page selects the page register Table 33 on page 43

31h reserved reserved Table 117 on page 63

32h reserved reserved

33h reserved reserved

34h reserved reserved

35h reserved reserved

36h reserved reserved

37h reserved reserved

Page 7: Test control

38h Page selects the page register Table 33 on page 43

39h reserved reserved Table 118 on page 64

3Ah TestAnaSelect sele cts analog test mode Table 119 on page 64

3Bh reserved reserved Table 121 on page 65

3Ch reserved reserved Table 122 on page 65

3Dh TestDigiSelect s elects digital test mode Table 123 on page 65

3Eh reserved reserved Table 125 on page 66

3Fh reserved reserved

Table 31. MFRC500 register overview …co n tinue d

Sub

address

(Hex)

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 41 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.4 MFRC500 register flags overview

Table 32. MFRC500 register flags overview

Flag(s) Register Bit Address

AccessErr ErrorFlag 5 0Ah

BitPhase[7: 0] BitPhase 7 to 0 1Bh

ClkQ180Deg ClockQControl 7 1Fh

ClkQCalib ClockQControl 6 1Fh

ClkQDelay[4:0] ClockQControl 4 to 0 1Fh

CollErr ErrorFlag 0 0Ah

CollLevel[3:0] RxThreshold 3 to 0 1Ch

CollPos[7:0] CollPos 7 to 0 0Bh

Command[5:0] Command 5 to 0 01h

CRC3309 ChannelRedundancy 5 22h

CRC8 ChannelRedundancy 4 22h

CRCErr ErrorFlag 3 0Ah

CRCPresetLSB[7: 0] CRCPresetLSB 7 to 0 23h

CRCPresetMSB[7:0] CRCPresetMSB 7 to 0 24h

CRCReady SecondaryStatus 5 05h

CRCResultMSB[7:0] CRCResultMSB 7 to 0 0Eh

CRCResultLSB[7:0] CRCResultLSB 7 to 0 0Dh

Crypto1On Control 3 09h

DecoderSource[1:0] RxControl2 1 to 0 1Eh

E2Ready SecondaryStatus 6 05h

Err PrimaryStatus 2 03h

FIFOData[7:0] FIFOData 7 to 0 02h

FIFOLength[6:0] FIFOLength 6 to 0 04h

FIFOOvfl ErrorFlag 4 0Ah

FlushFIFO Control 0 09h

FramingErr ErrorFlag 2 0Ah

Gain[1:0] RxControl1 1 to 0 19h

GsCfgCW[5:0] CwConductance 5 to 0 12h

HiAlert PrimaryStatus 1 03h

HiAlertIEn InterruptEn 1 06h

HiAlertIRq InterruptRq 1 07h

IdleIEn InterruptEn 2 06h

IdleIRq InterruptRq 2 07h

IFDetectBusy Command 7 01h

IRq PrimaryStatus 3 03h

IRQInv IRQPinConfig 1 2Dh

IRQPushPull IRQPinConfig 0 2Dh

KeyErr ErrorFlag 6 0Ah

LoAlert PrimaryStatus 0 03h

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 42 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

LoAlertIEn InterruptEn 0 06h

LoAlertIRq InterruptRq 0 07h

MFOUTSelect[2:0] MFO UTSelec t 2 to 0 26h

MinLevel[3:0] RxThreshold 7 to 4 1Ch

ModemState[2:0] PrimaryStatus 6 to 4 03h

ModulatorSo urc e[1:0] TxC o n tro l 6 to 5 11h

ModWidth[7:0] ModWidth 7 to 0 15h

PageSelect[2:0] Page 2 to 0 00h, 08h, 10h, 18h, 20h, 28h, 30h

and 38h

ParityEn ChannelRedundancy 0 22h

ParityErr ErrorFlag 1 0Ah

ParityOdd ChannelRedundancy 1 22h

PowerDown Control 4 09h

RcvClkSelI RxControl2 7 1Eh

RxAlign[2:0] BitFraming 6 to 4 0Fh

RxAutoPD RxControl2 6 1Eh

RxCRCEn ChannelRedundancy 3 22h

RxIEn InterruptEn 3 06h

RxIRq InterruptRq 3 07h

RxLastBits[2:0] SecondaryStatus 2 to 0 05h

RxMultiple DecoderControl 6 1Ah

RxWait[7:0] RxWait 7 to 0 21h

SetIEn InterruptEn 7 06h

SetIRq InterruptRq 7 07h

SignalToMFOUT TestDigiSelect 7 3Dh

StandBy Control 5 09h

TAutoRestart TimerClock 5 2Ah

TestAnaOutSel[4:0] TestAnaSelect 3 to 0 3Ah

TestDigiSignalSel[6:0] TestDigiSelect 6 to 0 3Dh

TimerIEn InterruptEn 5 06h

TimerIRq InterruptRq 5 07h

TimerValue[7:0] TimerValue 7 to 0 0Ch

TPreScaler[4:0] TimerClock 4 to 0 2Ah

TReloadValue[7:0] TimerReload 7 to 0 2Ch

TRunning SecondaryStatus 7 05h

TStartTxBegin TimerControl 0 2Bh

TStartTxEnd TimerControl 1 2Bh

TStartNow Control 1 09h

TStopRxBegin TimerControl 2 2Bh

TStopRxEnd TimerControl 3 2Bh

TStopNow Control 2 09h

Table 32. MFRC500 register flags overview …continued

Flag(s) Register Bit Address

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 43 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5 Register descriptions

10.5.1 Page 0: Command and status

10.5.1.1 Page register

Selects the page register.

TX1RFEn TxControl 0 11h

TX2Cw TxControl 3 11h

TX2Inv TxControl 3 11h

TX2RFEn TxControl 1 11h

TxCRCEn ChannelRedundancy 2 22h

TxIEn InterruptEn 4 06h

TxIRq InterruptRq 4 07h

TxLastBits[2:0] BitFraming 2 to 0 0Fh

UsePageSelect Page 7 00h, 08h, 10h, 18h, 20h, 28h, 30h

and 38h

WaterLevel[5:0] FIFOLevel 5 to 0 29h

ZeroAfterColl DecoderControl 5 1Ah

Table 32. MFRC500 register flags overview …continued

Flag(s) Register Bit Address

Table 33. Page register (address: 00h, 08h, 10h, 18h, 20h, 28h, 30h, 38h)

reset value: 1000 0000b, 80h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol UsePageSelect 0000 PageSelect[2:0]

Access R/W R/W R/W R/W R/W

Table 34. Page register bit description s

Bit Symbol Value Description

7 UsePageSelect 1 the value of PageSelect[2:0] is used as the register address

A5, A4, and A3. The LSBs of the register address are

defined using the address pins or the internal address latch,

respectively.

0 the complete content of the internal address latch defines

the register address. The address pins are used as

described in Table 5 on page 8.

6 to 3 0000 - reserved

2 to 0 PageSelect[2:0] - when UsePageSelect = logic 1, the value of PageSelect is

used to specify the register page (A5, A4 and A3 of the

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 44 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.1.2 Command register

Starts and stops the command execution.

10.5.1.3 FIFOData register

Input and output of the 64 byte FIFO buffer.

Table 35. Command regi ster (address: 01h) reset value: x000 0000b, x0h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol IFDetectBusy 0 Command[5:0]

Access R R D

Table 36. Command regi ster bit descriptions

Bit Symbol Value Description

7 IFDetectBusy shows the status of interface detectio n logic

0 interface detection finished successfully

1 interface detection ongoing

6 0 - reserved

5 to 0 Command[5:0] - activates a command base d on the Command code.

Reading this register shows which command is being

executed.

Table 37. FIFOData register (address: 02h) reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol FIFOData[7:0]

Access D

Table 38. FIFOData register bit descriptions

Bit Symbol Description

7 to 0 FIFODat a[7:0] data input and output port for the internal 64-byte FIFO buffer . The FIFO

buffer acts as a parallel in to parallel out converter for all data streams.

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 45 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.1.4 PrimaryStatus register

Bits relating to receiver, transmitter and FIFO buffer status flags.

Table 39. PrimaryStatus register (address: 03h) reset value: 0000 0101b, 05h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 0 ModemState[2:0] IRq Err HiAlert LoAlert

Access R R R R R R

Table 40. PrimaryStatus register bit descriptions

Bit Symbol Value Status Description

7 0 - reserved

6 to 4 ModemState[2:0] shows the state of the transmitter and receiver

state machines:

000 Idle neither the transmitter or receiver are operating;

neither of them are started or have input data

001 TxSOF transmit start of frame pattern

010 TxData transmit data from the FIFO buff er (or

redundancy CRC check bits)

011 TxEOF transmit End Of Frame (EOF) pattern

100 GoToRx1 intermediate state 1; receiver starts

GoToRx2 intermediate state 2; receiver finishes

101 PrepareRx waiting until the RxWait register time period

expires

110 AwaitingRx receiver activated; waiting for an input signal on

pin RX

111 Receiving receiving data

3 IRq - shows any interrupt source requesting attention

based on the Interru ptEn register flag settings

2 Err 1 any error flag in the ErrorFlag register is set

1 HiAlert 1 the alert level for the number of bytes in the FIFO

buffer (FIFOLength[6:0]) is:

otherwise value = logic 0

Example:

FIFOLength = 60, WaterLevel = 4 then

HiAlert = logic 1

FIFOLength = 59, WaterLevel = 4 then

HiAlert = logic 0

0 LoAlert 1 the alert level for number of bytes in the FIFO

buffer (FIFOLength[6:0]) is: otherwise

value = logic 0

Example:

FIFOLength = 4, WaterLevel = 4 then

LoAlert = logic 1

FIFOLength = 5, WaterLevel = 4 then

LoAlert = logic 0

HiAlert 64 FIFOLength–()WaterLevel≤=

LoAlert FIFOLength WaterLevel≤=

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 46 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.1.5 FIFOLength register

Number of bytes in the FIFO buffer.

10.5.1.6 SecondaryStatus register

Various secondary status flags.

Table 41. FIFOLength register (address: 04h) reset value: 0000 0000b, 00h bit alloca tion

Bit 7 6 5 4 3 2 1 0

Symbol 0 FIFOLength[6:0]

Access R R

Table 42. FIFOLength bit descrip tions

Bit Symbol Description

7 0 reserved

6 to 0 FIFOLength[6:0] gives the number of bytes stored in the FIFO buffer. Writing

increments the FIFOLength register value while reading decrements

the FIFOLength register value

Table 43. SecondaryStatus register (address: 05h) reset value: 01100 000b, 60h bit

allocation

Bit 7 6 5 4 3 2 1 0

Symbol TRunning E2Ready CRCReady 00 RxLastBits[2:0]

Access R R R R R

Table 44. SecondaryStatus register bit descriptions

Bit Symbol Value Description

7 TRunning 1 the timer unit is running and the counter decrements the

TimerValue register on the next timer clock cycle

0 the timer unit is not running

6 E2Ready 1 EEPROM programming is finished

0 EEPROM programming is ongoing

5 CRCReady 1 CRC calculation is finished

0 CRC calculation is ongoing

4 to 3 00 - reserved

2 to 0 RxLastBits[2:0] - shows the number of valid bits in the last received byte. If zero,

the whole byte is valid

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 47 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.1.7 InterruptEn register

Control bits to enable and disable passing of interrupt requests.

[1] This bit can only be set or cleared using bit SetIEn.

10.5.1.8 InterruptRq register

Interrupt request flags.

Table 45. InterruptEn register (address: 06h) reset value: 0000 0000 b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol SetIEn 0 TimerIEn TxIEn RxIEn IdleIEn HiAlertIEn LoAlertIEn

Access W R/W R/W R/W R/W R/W R/W R/W

Table 46. InterruptEn register bit descriptions

Bit Symbol Value Description

7 SetIEn 1 indicates that the marked bits in the InterruptEn registe r are set

0 clears the marked bits

6 0 - reserved

5 TimerIEn - sends the TimerIRq timer interrupt request to pin IRQ[1]

4 TxIEn - sends the TxIRq transmitter interrupt req uest to pin IRQ [1]

3 RxIEn - sends the RxIRq receiver interrupt requ est to pin IRQ[1]

2 IdleIEn - sends the IdleIRq idle interrupt request to pin IRQ[1]

1 HiAlertIEn - sends the HiAlertIRq high alert interrupt request to pin IRQ[1]

0 LoAlertIEn - sends the LoAlertIRq low alert interrupt request to pin IRQ[1]

Table 47. InterruptRq register (address: 07h) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol SetIRq 0 TimerIRq TxIRq RxIRq IdleIRq HiAlertIRq LoAlertIRq

Access W R/W D D D D D D

Table 48. InterruptRq register bit descriptions

Bit Symbol Value Description

7 SetIRq 1 sets the marked bits in the InterruptRq register

0 clears the marked bits in the InterruptRq register

60 - reserved

5 TimerIRq 1 timer decrements the TimerValue register to zero

0 timer decrements are still greater than zero

4 TxIRq 1 TxIRq is set to logic 1 if one of the following events occurs:

Transceive command; all data transmitted

Authent1 and Authent2 commands; al l data transmi tted

WriteE2 command; all data is programmed

CalcCRC command; all data is processed

0 when not acted on by Transceive, Authent1, Authent2, WriteE2 or

CalcCRC commands

3 RxIRq 1 the receiver terminates

0 reception still ongoing

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 48 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

[1] PrimaryStatus register Bit HiAlertIRq stores this event and it can only be reset using bit SetIRq.

10.5.2 Page 1: Control and status

10.5.2.1 Page register

Selects the page register; see Section 10.5.1.1 “Page register” on page 43.

10.5.2.2 Control register

Various control flags, for timer, power saving, etc.

[1] This bit can only be set to logic 1 by successful execution of the Authent2 command

[2] Reading this bit always returns logic 0

2 IdleIRq 1 command terminates correctly. For example; when the Command

If an unknown command is started the IdleIRq bit is set.

Microprocessor start-up of the Idle command does not set the

IdleIRq bit.

0 IdleIRq = logic 0 in all other instances

1 HiAlertIRq 1 PrimaryStatus register HiAlert bit is set[1]

0 PrimaryStatus regi st er H iAle rt bi t is not set

0 LoAlertIRq 1 PrimaryStatus register LoAlert bit is set[1]

0 PrimaryStatus regi ster LoAlert bit is not set

Table 48. InterruptRq register bit descriptions …continued

Bit Symbol Value Description

Table 49. Contro l register (address: 09h) reset valu e: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00 StandBy PowerDown Crypto1On TStopNow TStartNow FlushFIFO

Access R/W D D D W W W

Table 50. Contro l register bit descriptions

Bit Symbol Value Description

7 to 6 00 - reserved

5 StandBy 1 activates Standby mode. The current consuming blocks are

switched off but the clock keeps runn ing

4 PowerDown 1 activates Power-down mode. The current consuming blocks

are switched off including the clock

3 Crypto1On 1 Crypto 1 unit is switched on and all data communication with

the card is encrypted[1]

0 Crypto1 unit is switched off. All data communication with the

card is unencrypted (plain)

2 TStopNow 1 immediately stops the timer[2]

1 TStartNow 1 immediately starts the timer[2]

0 FlushFIFO 1 immediately clears the internal FIFO buffer’s read and write

pointer, the FIFOLength[6:0] bits are set to logic 0 and the

FIFOOvfl flag[2]

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 49 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.2.3 ErrorFlag register

Error flags show the error status of the last executed command.

Table 51. ErrorFlag register (address: 0Ah) reset value: 0100 0000b, 40h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 0 KeyErr AccessErr FIFOOvfl CRCErr FramingErr ParityErr CollErr

Access R R R R R R R R

Table 52. Erro rFlag register bit descriptions

Bit Symbol Value Description

7 0 - reserved

6 KeyErr 1 set when the LoadKeyE2 or LoadKey command recognize that the

input data is not encoded based on the key format definition

0 set when the LoadKeyE2 or the LoadKey command starts

5 AccessErr 1 set when the access rights to the EEPROM are violated

0 set when an EEPROM related command starts

4 FIFOOvfl 1 set when the microprocessor or MFRC500 internal state machine

(e.g. receiver) tries to write data to the FIFO buffer when it is full

3 CRCErr 1 set when RxCRCEn is set and the CRC fails

0 automatically set during the PrepareRx state in the receiver start

phase

2 FramingErr 1 set when the SOF is incorrect

0 automatically set during the PrepareRx state in the receiver start

phase

1 ParityErr 1 set when the parity check fails

0 automatically set during the PrepareRx state in the receiver start

phase

0 CollErr 1 set when a bit-collision is detected

0 automatically set during the PrepareRx state in the receiver start

phase

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 50 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.2.4 CollPos register

Bit position of the first bit-collision detected on the RF interface.

10.5.2.5 TimerValue register

Value of the timer.

10.5.2.6 CRCResultLSB register

LSB of the CRC coprocessor register.

Table 53. CollPos register (address: 0Bh) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol CollPos[7:0]

Access R

Table 54. CollPos register bit descriptions

Bit Symbol Description

7 to 0 CollPos[7:0] this register shows the bit position of the fi rst detected collision in a

received frame.

Example:

00h indicates a bit collision in the start bit

01h indicates a bit collision in the 1st bit

...

08h indicates a bit collision in the 8th bit

Table 55. TimerValue register (address: 0Ch) reset value: xxxx xxxxb, xxh bit alloca tion

Bit 76543210

Symbol TimerValue[7:0]

Access R

Table 56. TimerValue register bit descriptions

Bit Symbol Description

7 to 0 TimerValue[7:0] this register shows the timer counter value

Table 57. CRCResultLSB register (address: 0Dh) reset value: xxxx xxxxb, xxh bit

allocation

Bit 7 6 5 4 3 2 1 0

Symbol CRCResultLSB[7:0]

Access R

Table 58. CRCResultLSB regi ster bit descriptions

Bit Symbol Description

7 to 0 CRCResultLSB[7:0] gives the CRC register ’s least significant byte value; only valid if

CRCReady = logic 1

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 51 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.2.7 CRCResultMSB register

MSB of the CRC coprocessor register.

10.5.2.8 BitFraming regist er

Adjustment s for bit oriented frames.

Table 59. CRCResultMSB regist er (address: 0Eh) reset value: xxxx xxxxb, xxh bit

allocation

Bit 7 6 5 4 3 2 1 0

Symbol CRCResultMSB[7:0]

Access R

Table 60. CRCResultMSB register bit descriptions

Bit Symbol Description

7 to 0 CRCResultMSB[7:0] gives the CRC register’s most significant byte value; only valid if

CRCReady = logic 1.

The register’s value is undefined for 8-bit CRC calculation.

Table 61. BitFraming register (address: 0Fh) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 0 RxAlign[2:0] 0 TxLastBits[2:0]

Access R/W D R/W D

Table 62. BitFraming register bit descriptions

Bit Symbol Value Description

70 - reserved

6 to 4 RxAlign[2:0] defines the bit position in the FIFO buffer for the first bit received

and stored. Additional received bits are stored in the next

subsequent bit positions. After reception, RxAlign[2:0] is

automatically cleared. For example:

000 the LSB of the received bit is stored in bit position 0 and the

second received bit is stored in bit position 1

001 the LSB of the received bit is stored in bit position 1, the

second received bit is stored in bit position 2

...

111 the LSB of the received bit is stored in bit position 7, the

second received bit is stored in the next byte in bit position 0

30 - reserved

2 to 0 TxLastBits[2:0] - defines the number of bits of the last byte that shall be

transmitted. 000 indicates that all bits of the last byte will be

transmitted. TxLastBits[2:0] is automatically cleared after

transmission.

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 52 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.3 Page 2: Transmitter and control

10.5.3.1 Page register

Selects the page register; see Section 10.5.1.1 “Page register” on page 43.

10.5.3.2 TxControl register

Controls the logical behavior of the antenna pins TX1 and TX2.

Table 63. TxCon t rol register (address: 11h) reset value: 0101 1000b, 58h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 0 ModulatorSource[1:0] 1 TX2Inv TX2Cw TX2RFEn TX1RFEn

Access R/W R/W R/W R/W R/W R/W R/W

Table 64. TxControl register bit descri ptions

Bit Symbol Value Description

7 0 - this value must not be changed

6 to 5 ModulatorSource[1:0] selects the source for the modulator input:

00 modulator input is LOW

01 modulator input is HIGH

10 modulator input is the internal encoder

11 modulator input is pin MFIN

4 1 - this value must not be changed

3 TX2Inv 1 delivers an inverted 13.56 MHz energy carrier output

signal on pin TX2

2 TX2Cw 1 delivers a continu ously unmodulated 13.56 MHz

energy carrier output signal on pin TX2

0 enables modulation of the 13.56 MHz energy carrier

1 TX2RFEn 1 the output signal on pin TX2 is the 13.56 MHz energy

carrier modulated by the transmission data

0 TX2 is driven at a constant output level

0 TX1RFEn 1 the output signal on pin TX1 is the 13.56 MHz energy

carrier modulated by the transmission data

0 TX1 is driven at a constant output level

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 53 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.3.3 CwConductance register

Selects the con ductance of the antenna driver pins TX1 and TX2.

See Section 9.9.3.1 for detailed information about GsCfgCW[5:0].

10.5.3.4 PreSet13 register

These bit settings must not be changed.

10.5.3.5 PreSet14 register

These bit settings must not be changed.

Table 65. CwConductance register (address: 12h) reset value: 0011 1111b, 3Fh bit

allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00 GsCfgCW[5:0]

Access R/W R/W

Table 66. CwConductance register bit descriptions

Bit Symbol Value Description

7 to 6 00 0 these values must not be changed

5 to 0 GsCfgCW[5:0] - defines the conductance register value for the output driver.

This can be used to regulate the output power /current

consumption and operating distance.

Table 67. PreSet13 register (address: 13h) reset value: 0011 1111b, 3Fh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00 11111

Access R/W R/W

Table 68. PreSet13 register bit description s

Bit Symbol Value Description

7 to 6 00 0 these values must not be changed

5 to 0 11111 - these values must not be changed

Table 69. PreSet14 regist er (address: 14h) reset value: 0001 1001b, 19h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 000 11 00 1

Access R/W R/W R/W R/W

Table 70. PreSet14 register bit description s

Bit Symbol Value Description

7 to 5 000 0 these values must not be changed

4 to 3 11 1 these values must not be changed

2 to 1 00 0 these values must not be changed

0 1 1 these values must no t be changed

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 54 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.3.6 ModWidth register

Selects the pulse-modulation width.

10.5.3.7 PreSet16 register

These bit settings must not be changed.

10.5.3.8 PreSet17 register

These bit settings must not be changed.

Table 71. ModWidth register (address: 15h) reset value: 0001 0011b, 13h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol ModWidth[7:0]

Access R/W

Table 72. ModWidth register bit descriptions

Bit Symbol Description

7 to 0 ModWidth[7:0] defines the width of the modulation pulse based on

tmod =2⋅(ModWidth + 1) / fclk

Table 73. PreSet16 regist er (address: 16h) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00000000

Access R/W

Table 74. PreSet16 register bit description s

Bit Symbol Value Description

7 to 0 00000000 0 these values must not be changed

Table 75. PreSet17 regist er (address: 17h) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00000000

Access R/W

Table 76. PreSet17 register bit description s

Bit Symbol Value Description

7 to 0 00000000 0 these values must not be changed

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 55 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.4 Page 3: Receiver and decoder control

10.5.4.1 Page register

Selects the page register; see Section 10.5.1.1 “Page register” on page 43.

10.5.4.2 RxControl1 register

Controls receiver operation.

10.5.4.3 DecoderControl register

Controls decoder operation.

Table 77. RxControl1 reg ister (address: 19h) reset value: 0111 0011b, 73h bit allocatio n

Bit 7 6 5 4 3 2 1 0

Symbol 0 111 00 Gain[1:0]

Access R/W R/W R/W R/W

Table 78. RxControl1 regi ster bit descriptions

Bit Symbol Value Description

7 0 0 these values must not be changed

6 to 4 111 1 these values must not be changed

3 to 2 00 0 these values must not be changed

1 to 0 Gain[1:0] de fines the receiver’s signal voltage gain factor

00 20 dB gain facto r

01 24 dB gain facto r

10 31 dB gain facto r

11 35 dB gain factor

Table 79. DecoderControl register (address: 1Ah) reset value: 0000 1000b, 08h bit

allocation

Bit 7 6 5 4 3 2 1 0

Symbol 0 RxMultiple ZeroAfterColl 0 1 000

Access R/W R/W R/W R/W R/W R/W

Table 80. DecoderContro l register bit descriptions

Bit Symbol Value Description

7 0 - this value must not be changed

6 R xMultiple 0 after receiving one frame, the receiver is deactivated

1 enables reception of more than one frame

5 ZeroAfterColl 1 any bits received after a bit-collision are masked to zero. This

helps to resolve the anti-collision procedure as defined in

ISO/IEC 14443 A

4 0 0 this value must not be chan ged

3 1 1 this value must not be chan ged

2 to 0 000 0 these values must not be changed

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 56 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.4.4 BitPhase register

Selects the bit-phase between transmitter and receiver clock.

10.5.4.5 RxThreshold register

Selects thresholds for the bit decoder.

10.5.4.6 PreSet 1D Re gi st er

These bit settings must not be changed.

Table 81. BitPhase register (address: 1Bh) reset value: 1010 1101b, ADh bit allocation

Bit 76543210

Symbol BitPhase[7:0]

Access R/W

Table 82. BitPhase register bit desc riptions

Bit Symbol Description

7 to 0 BitPhase[7:0] defines the phase relationship between transmitter and receiver clock

Remark: The correct value of this register is essential for proper

operation.

Table 83. RxThreshold register (address: 1Ch) reset value: 1111 1111b, FFh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol MinLevel[3:0] CollLevel[3:0]

Access R/W R/W

Table 84. RxThr eshold register bit descriptions

Bit Symbol Description

7 to 4 MinLevel[3:0] the minimum signal strength the decoder will accept. If the signa l

strength is below this level, it is not evaluated.

3 to 0 CollLevel[3:0] the minimum signal strength the decoder input that must be reached

by the weaker half-bit of the Manchester encoded signal to generate

a bit-collision (relative to the amplitude of the stronger half-bit)

Table 85. PreSet1D register (address: 1Dh) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00000000

Access R/W

Table 86. PreSet1D register bit descriptions

Bit Symbol Value Description

7 to 0 00000000 0 these values mu st not be changed

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 57 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.4.7 RxControl2 register

Controls decoder behavior and defines the input source for the receiver.

[1] I-clock and Q-clock are 90° phase-shifted from each other.

10.5.4.8 ClockQControl register

Controls clock generation for the 90° phase-shifted Q-clock.

Table 87. RxControl2 register (address: 1Eh) reset value: 0100 0001b, 41h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol RcvClkSelI RxAutoPD 0000 DecoderSource[1:0]

Access R/W R/W R/W R/W

Table 88. RxControl2 regi ster bit descriptions

Bit Symbol Value Description

7 RcvClkSelI 1 I-clock is used as the receiver clock[1]

0 Q-clock is used as the receiver clock[1]

6 RxAutoPD 1 receiver circuit is automatically switched on before

receiving and switched off af terwards. This can be used to

reduce current consumption.

0 receiver is always activated

5 to 2 0000 - these values must not be changed

1 to 0 DecoderSource[1:0] selects the source for the decoder input

00 LOW

01 internal demodulator

10 a subcarrier modulated Manchester encoded signal on

pin MFIN

11 a baseband Manchester encoded signal on pin MFIN

Table 89. ClockQControl register (address: 1Fh) reset value: 000x xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol ClkQ180Deg ClkQCalib 0 ClkQDelay[4:0]

Access R R/W R/W D

Table 90. ClockQControl register bit descriptions

Bit Symbol Value Description

7 ClkQ180Deg 1 Q-clock is phase-shifted more than 180° compared to the

I-clock

0 Q-clock is phase-shifted less than 180° compared to the

I-clock

6 ClkQCalib 0 Q-clock is automatically calibrated after the reset phase and

after data reception from the card

1 no calibrati on is performed automatically

5 0 - this value must not be changed

4 to 0 ClkQDelay[4:0] - this register shows the number of delay elements used to

generate a 90° phase-shift of the I-clock to obtain the

Q-clock. It can be writ te n di re ctly by the microprocessor or

by the automatic calibration cycle.

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 58 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.5 Page 4: RF Timing and channel redundancy

10.5.5.1 Page register

Selects the page register; see Section 10.5.1.1 “Page register” on page 43.

10.5.5.2 RxWait register

Selects the time in terval after transmission, before the receiver starts.

10.5.5.3 ChannelRedundancy register

Selects kind and mode of checking the data integrity on the RF channel.

Table 91. RxWait register (address: 21h) reset value: 0000 0101b, 06h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol RxWait[7:0]

Access R/W

Table 92. RxWait register bit descriptions

Bit Symbol Function

7 to 0 RxWait[7:0] after data transmission, the activation of the receiver is delayed

for RxWait bit-clock cycles. During this frame guard time any

signal on pin RX is ignored.

Table 93. Chann elRedundancy register (addre ss: 22h) reset value: 0000 0011b, 03h bit

allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00 CRC3309 CRC8 RxCRCEn TxCRCEn ParityOdd ParityEn

Access R/W R/W R/W R/W R/W R/W R/W R/W

Table 94. ChannelRedundancy bit descr iptions

Bit Symbol Value Function

7 to 6 00 - this value must not be changed

5 CRC3309 1 CRC calculation is performed us ing ISO/IEC 3309 and

ISO/IEC 15693

0 CRC calculation is performed using ISO/IEC 14443 A

4 CRC8 1 an 8-bit CRC is calculated

0 a 16-bit CRC is calculated

3 RxCRCEn 1 the last byte(s) of a received frame are interpreted as CRC bytes. If

the CRC is correct, the CRC bytes are not passed to the FIFO. If

the CRC bytes are incorrect, the CRCErr flag is set.

0 no CRC is expected

2 TxCRCEn 1 a CRC is calculated over the transmitted data and the CRC byte s

are appended to the data stream

0 no CRC is transmitted

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 59 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

[1] With ISO/IEC 14443 A, this bit must be set to logic 1.

10.5.5.4 CRCPresetLSB register

LSB of the preset value for the CRC register.

10.5.5.5 CRCPresetMSB register

MSB of the preset value for the CRC register.

10.5.5.6 PreSet25 register

These values must not be changed.

1 ParityOdd 1 odd parity is generated or expected[1]

0 even parity is generated or expected

0 ParityEn 1 a parity bit is inserted in the transmitted data stream after each byte

and expected in the received data stream after each byte (MIFARE,

ISO/IEC 14443 A)

0 no parity bit is inserted or expected

Table 94. ChannelRedundancy bit descr iptions …continued

Bit Symbol Value Function

Table 95. CRCPresetLSB register (address: 23h) reset value: 0101 0011b, 63h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol CRCPresetLSB[7:0]

Access R/W

Table 96. CRCPresetLSB register bit descriptions

Bit Symbol Description

7 to 0 CRCPresetLSB[7:0] defines the start value for CRC calculation. This value is loaded

into the CRC at the beginning of transmission, reception and

the CalcCRC command (if CRC calculation is enabled).

Table 97. CRCPresetMSB regist er (address: 24h) reset value: 0101 0011b, 63h bit

allocation

Bit 7 6 5 4 3 2 1 0

Symbol CRCPresetMSB[7:0]

Access R/W

Table 98. CRCPresetMSB bit descriptions

Bit Symbol Description

7 to 0 CRCPresetMSB[7:0] defines the starting value for CRC calculation. This value is

loaded into the CRC at the beginning of transmission, reception

and the CalcCRC command (if the CRC calculation is enabled)

Remark: This register is not relevant if CRC8 is set to logic 1.

Table 99. PreSet25 regist er (address: 25h) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00000000

Access R/W

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 60 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.5.7 MFOUTSelect register

Selects the internal signal applied to pin MFOUT.

[1] Only valid for MIFARE and ISO/IEC 14443 A communication at 106 kBd.

10.5.5.8 PreSet27 register

Table 100. PreSet25 register bit descriptions

Bit Symbol Value Description

7 to 0 00000000 0 t hese values must not be changed

Table 101. MFOUTSelect register (address: 26h) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00000 MFOUTSelect[2:0]

Access R/W R/W

Table 102. MFOUTSelect register bit descriptions

Bit Symbol Value Description

7 to 3 00000 0 these values must not be changed

2 to 0 MFOUTSelect[2:0] defines which signal is routed to pin MFOUT:

000 constant LOW

001 constant HIGH

010 modulation signal (envelope) from the internal

encoder, (Miller coded)

011 serial data stream, not Miller encoded

100 output signal of the energy carrier demodulator (card

modulation sign al)[1]

101 output signal of the subcarrier demodulator

(Manchester encoded card signal)[1]

110 reserved

111 reserved

Table 103. PreSet27 (address: 27h) reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol xxxxxxxx

Access W

Table 104. PreSet27 register bit descriptions

Bit Symbol Value Description

7 to 0 xxxxxxxx 0 these values can be logic 1 or logic 0

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 61 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.6 Page 5: FIFO, timer and IRQ pin configuration

10.5.6.1 Page register

Selects the page register; see Section 10.5.1.1 “Page register” on page 43.

10.5.6.2 FIFOLevel re gister

Defines the levels for FIFO underflow and overflow warning.

10.5.6.3 TimerClock register

Selects the divider for the timer clock.

Table 105. FIFOLeve l register (address: 29h) reset value: 0000 1000 b, 08h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00 WaterLevel[5:0]

Access R/W R/W

Table 106. FIFOLeve l register bit descriptions

Bit Symbol Description

7 to 6 00 these values must not be changed

5 to 0 WaterLevel[5:0] defines, the warning level of a FIFO buffer overflow or underflow:

HiAlert is set to logic 1 if the remaining FIFO buffer space is equal to,

or less than, WaterLevel[5:0] bits in the FIFO buffer.

LoAlert is set to logic 1 if equal to, or le ss than, WaterLevel[5:0] bits in

the FIFO buffer.

Table 107. TimerClock register (add ress: 2Ah) reset value: 0000 0111b, 07h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 00 TAutoRestart TPreScaler[4:0]

Access RW RW RW

Table 108. TimerClock register bit description s

Bit Symbol Value Function

7 to 6 00 0 these values must not be changed

5 TAutoRestart 1 the timer automatically restarts its countdown from the

TReloadValue[7:0] instead of counting down to zero

0 the timer decrements to zero and register InterruptIRq

Ti merIRq bit is set to logic 1

4 to 0 TPreScaler[4:0] - defines the timer clock frequency (fTimerClock). The

TPreScaler[4:0] can be adjusted from 0 to 21. The following

formula is used to calculate the TimerClock frequency

(fTimerClock):

fTimerClock = 13.56 MHz / 2TPreScaler [MHz]

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 62 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.6.4 TimerControl register

Selects start and stop conditions for the timer.

10.5.6.5 TimerReload register

Defines the preset value for the timer.

Table 109. TimerControl register (address: 2Bh) reset value: 00 00 0110b, 06h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 0000 TStopRxEnd TStopRxBegin TStartTxEnd TStartTxBegin

Access R/W R/W R/W R/W R/W

Table 110. TimerControl register bit descriptions

Bit Symbol Value Description

7 to 4 0000 0 these values must not be changed

3 TStopRxEnd 1 the timer automatically stops when data reception ends

0 the timer is not influenced by this condition

2 TStopRxBegin 1 the timer automatically stops when the first valid bit is received

0 the timer is not influenced by this condition

1 TStartTxEnd 1 the timer automatically starts when data transmission ends. If

the timer is already running, the timer restarts by loading

TReloadValue[7:0] into the timer .

0 the timer is not influenced by this condition

0 TStartTxBegin 1 the timer automatically starts when th e first bit is transmitted. If

the timer is already running, the timer restarts by loading

TReloadValue[7:0] into the timer .

0 the timer is not influenced by this condition

Table 111. TimerReload register (address: 2Ch) reset value: 0000 1010b, 0Ah bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol TReloadValue[7:0]

Access R/W

Table 112. TimerReload register bit descriptions

Bit Symbol Description

7 to 0 TReloadValue[7:0] on a start event, the timer loads the TReloadValue[7:0] value.

Changing this register only affects the timer on the next start event. If

TReloadValue[7:0] is set to logic 0 the timer cannot start.

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 63 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.6.6 IRQPinConfig register

Configures the output stage for pin IRQ.

10.5.6.7 PreSet2E register

10.5.6.8 PreSet2F register

10.5.7 Page 6: reserved

10.5.7.1 Page register

Selects the page register; see Section 10.5.1.1 “Page register” on page 43.

10.5.7.2 Reserved registers 31h, 32h, 33h, 34h, 35h, 36h and 37h

Remark: These registers are reserved for future use.

Table 113. IRQPinConfig register (address: 2Dh) reset value: 0000 0010b, 02h bi t allocation

Bit 7 6 5 4 3 2 1 0

Symbol 000000 IRQInv IRQPushPull

Access R/W R/W R/W

Table 114. IRQPinConfig register bit descriptions

Bit Symbol Value Description

7 to 2 000000 0 these values must not be changed

1 IRQInv 1 inverts the signal on pin IRQ with respect to bit IRq

0 the signal on pin IRQ is not inverted and is the same as bit IRq

0 IRQPushPull 1 pin IRQ functions as a standard CMOS output pad

0 pin IRQ functions as an open-drain output pad

Table 115. PreSet2E register (address: 2Eh) reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol xxxxxxxx

Access W

Table 116. PreSet2F register (address: 2Fh) reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol xxxxxxxx

Access W

Table 117. Reserved registers (address: 31h, 32h, 33 h, 34h, 35h , 36h, 37h)

reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol xxxxxxxx

Access W

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 64 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.8 Page 7: Test control

10.5.8.1 Page register

Selects the page register; see Section 10.5.1.1 “Page register” on page 43.

10.5.8.2 Reserved register 39h

Remark: This register is reserved for future use.

10.5.8.3 TestAnaSelect register

Selects analog test signals.

Table 118. Reserved register (address: 39h) reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol xxxxxxxx

Access W

Table 119. TestAnaSelect register (address: 3Ah) reset value: 0000 0000b, 00h bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol 0000 TestAnaOutSel[4:0]

Access W W

Table 120. TestAnaSelect bit descriptions

Bit Symbol Value Description

7 to 4 0000 0 these values mu st not be changed

3 to 0 Te s tAnaOutSel[4:0] selects the internal analog signal to be routed to the AUX

pin. See Section 15.2.2 on page 96 for detailed

information. The settings are as follows:

0VMID

1 Vbandgap

2 VRxFollI

3 VRxFollQ

4VRxAmpI

5VRxAmpQ

6 VCorrNI

7 VCorrNQ

8 VCorrDI

9 VCorrDQ

A VEvalL

B VEvalR

CVTemp

D reserved

E reserved

F reserved

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 65 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.8.4 Reserved register 3Bh

Remark: This register is reserved for future use.

10.5.8.5 Reserved register 3Ch

Remark: This register is reserved for future use.

10.5.8.6 TestDigiSelect register

Selects digital test mode.

Table 121. Reserved register (address: 3Bh) reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol xxxxxxxx

Access W

Table 122. Reserved register (address: 3Ch) reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol xxxxxxxx

Access W

Table 123. TestDigiSelect register (address: 3Dh) reset valu e: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol SignalToMFOUT TestDigiSignalSel[6:0]

Access W W

Table 124. TestDigiSelect register bit descriptions

Bit Symbol Value Description

7 SignalToMFOUT 1 overrules the MFOUTSelect[2:0] setting and routes the

digital test signal defined with the TestDigiSignalSel[6:0]

bits to pin MFOUT

0 MFOUTSelect[2:0] defines the signal on pin MFOUT

6 to 0 TestDigiSignalSel[6:0] - selects the digital test signal to be routed to pin MFOUT.

Refer to Section 15.2.3 on page 97 for detailed

information. The follo wing lists the signal names for the

TestDigiSignalSel[6:0] addresses:

F4h s_data

E4h s_valid

D4h s_coll

C4h s_clock

B5h rd_sync

A5h wr_sync

96h int_clock

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 66 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10.5.8.7 Res erved registers 3Eh, 3Fh

Remark: This register is reserved for future use.

11. MFRC500 command set

MFRC500 operation is determined by an internal state machine capable of performing a

command set. The commands can be started by writing the command code to the

Command register. Arguments and/or data necessary to process a command are mainly

exchanged using the FIFO buffer.

•Each command needing a data stream (or data byte stream) as an input immediately

processes the data in the FIFO buffer

•Each command that requires arguments only starts processing when it has received

the correct number of arguments from the FIFO buffer

•The FIFO buf fer is not automatically cleared at the start of a command. It is, therefore,

possible to write co mmand arguments and/or the data bytes into the FIFO buffer

before starting a comm a nd .

•Each command (except the StartUp command) can be interrupted by the

microprocessor writing a new command code to the Command register e.g. the Idle

command.

11.1 MFRC500 command overview

Table 125. Reserved register (address: 3Eh, 3Fh) reset value: xxxx xxxxb, xxh bit allocation

Bit 7 6 5 4 3 2 1 0

Symbol xxxxxxxx

Access W

Table 126. MFRC 500 commands overview

Command Value Action FIFO communication

Arguments and data

sent Data received

StartUp 3Fh runs the reset and initialization phase. See

Section 11.1.2 on page 68.

Remark: This command can only be activated by

Power-On or Hard resets.

Idle 00h no action; cancels execution of the current command.

See Section 11.1.3 on page 68 --

Transmit 1Ah transmits data from the FIFO buffer to the card. See

Section 11.2.1 on page 69 data stream -

Receive 16h activates receiver circuitry. Before the receiver starts,

the state machine waits until the time defined in the

RxWait register has elapsed. See Section 11.2.2 on

page 72.

Remark: This command may be used for test

purposes only, since there is no timing relationship to

the Transmit command.

- data stream

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 67 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

[1] This command is the combination of the Transmit and Receive commands.

Transceive[1] 1Eh transmits data from FIFO buffer to the card and

automatically activates the receiver after

transmission. The receiver waits until the time defined

in the RxWait register has elapsed before starting.

See Section 11.2.3 on page 75.

data stream data stream

WriteE2 01h reads data from the FIFO buffer and writes it to the

EEPROM. See Section 11.3.1 on page 77.start address LSB -

start address MSB

data byt e strea m

ReadE2 03h reads data from the EEPROM and sends it to the

FIFO buffer. See Section 11.3.2 on page 79.

Remark: Keys cannot be read back

start address LSB data bytes

start address MSB

number of data bytes

LoadKeyE2 0Bh copies a key from the EEPROM into the key buffer

See Section 11.6.1 on page 81.start address LSB -

start address MSB

LoadKey 19h reads a key from the FIFO buffer and loads it into the

key buffer. See Sectio n 11.6.2 on p a ge 81.

Remark: The key has to be prepared in a specific

format (refer to Sectio n 9.2.3.1 “Key format” on page

13)

byte 0 LSB -

byte 1

…

byte 10

byte 11 MSB

Authent1 0Ch performs the first part of card authentication using the

Crypto1 algorithm. See Section 11.6.3 on page 82 .card Authent1 command -

card block address

card serial number LSB

card serial number byte 1

card serial number byte 2

card serial number MSB

Authent2 14h performs the second part of card authentication using

the Crypto1 algorithm. See Section 11.6.4 on

page 82.

LoadConfig 07h reads data from EEPROM and initializes the

MFRC500 registers. See Section 11.4.1 on page 79.start address LSB -

start address MSB

CalcCRC 12h activates the CRC coprocessor

Remark: The result of the CRC calculation is read

from the CRCResultLSB and CRCResultMSB

registers. See Section 11.4.2 on page 80.

data byt e strea m -

Table 126. MFRC 500 commands overview …continued

Command Value Action FIFO communication

Arguments and data

sent Data received

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 68 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.1.1 Basic states

11.1.2 StartUp command 3Fh

Remark: This command can only be activated by a Power-On or Hard reset.

The StartUp command ru ns th e reset and initialization phases. It does no t ne ed or retur n,

any data. It cannot be activated by the microprocessor but is automatically started after

one of the following events:

•Power-On Reset (POR) caused by power-up on pin DVDD or on pin AVDD

•Negative edge on pin RSTPD

The reset phase comprises an asynchronous reset and configuration of certain register

bits. The initialization phase configures several registers with values stored in th e

EEPROM.

When the StartUp command finishes, the Idle command is automatically executed.

Remark:

•The microprocessor must not write to the MFRC500 while it is still executing the

StartUp command. To avoid this, the microprocessor polls for the Idle command to

determine when the initialization phase has finished; see Section 9.7.4 on page 25.

•When the StartUp command is active, it is only possible to read from the Page 0

•The StartUp comm and cannot be interrupted by the microprocessor.

11.1.3 Idle command 00h

The Idle command switches the MFRC500 to its inactiv e state where it waits for the next

command. It does not need or return, any data.

The device automatically enters the idle state when a command finishes. When this

happens, the MFRC500 sends an inte rrupt request by setting bit IdleIRq. When triggered

by the microprocessor, the Idle command can be used to stop execution of all other

commands (except the Star tUp command ) but this does not g enerate an interrupt requ est

(IdleIRq).

Remark: Stopping command execution with the Idle command does not cle ar the FIFO

buffer.

Table 127. StartUp command 3Fh

Command Value Action Arguments

and data Returned

data

StartUp 3Fh runs the reset and initialization phase - -

Table 128. Idle command 00h

Command Value Action Arguments

and data Returned

data

Idle 00h no action; cancels current command

execution --

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 69 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.2 Commands for card communication

The MFRC500 is a fully ISO/IEC 14443 A compliant reader IC. This enables the

command set to be more flexible and generalized when compared to dedicated MIFARE

reader ICs. Section 11.2.1 to Section 11.2.5 descri be the command set for ISO/IEC 14443

A card communication an d related communication protocols.

11.2.1 Transmit command 1Ah

The Transmit command reads dat a from th e FIFO bu ffer and sends it to the transmitter. It

does not return any data. The Transmit command can only be started by the

microprocessor.

11.2.1.1 Using the Transmit command

To tran sm it da ta, one of the followin g se qu e nce s ca n be used:

1. All data to be transmitted to the card is written to the FIFO buffer while the Idle

command is active. Then the command code for the Transmit command is written to

the Command register.

Remark: This is possible for transmission of a data stream up to 64 bytes.

2. The command code for the Transmit command is stored in the Command register.

Since there is not any dat a available in the FIFO buffer, the command is only enabled

but transmission is not activated. Data transmission starts when the first data byte is

written to the FIFO buffer. To generate a continuous data stream on the RF interface,

the microprocessor must write the subsequent data bytes into the FIFO buffer in time.

Remark: This allows transmission of any dat a stream length but it requires dat a to be

written to the FIFO buffer in time.

3. Part of the data transmitted to the card is written to the FIFO buffer while the Idle

command is active. Then the command code for the Transmit command is written to

the Command register. While the Transmit command is active, the microprocessor

can send further data to the FIFO buffer. This is then appended by the transmitter to

the transmitted data stream.

Remark: This allows transmission of any dat a stream length but it requires dat a to be

written to the FIFO buffer in time.

When the transmitter requests the next data byte to ensure the data stream on the RF

interface is continuous and th e FIFO buffer is empty, the T ransmit command automatically

exits. This causes the internal state machine to change its state from transmit to idle.

When the data transmission to the card is finished, the TxIRq flag is set by the MFRC500

to indi cate to the microprocessor transmission is complete.

Remark: If the microprocessor overwrites the transmit code in the Command register

with another command, transmission stops immediately on the next clock cycle. This can

produce output signals that are not in accordance with ISO/IEC 14443 A.

Table 129. Transmit command 1Ah

Command Value Action Arguments

and data Returned

data

Transmit 1Ah transmits data from FIFO buffer to card data stream -

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 70 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.2.1.2 RF cha nnel redundancy and fr aming

Each ISO/IEC 14443 A frame transmitted consists of a Start Of Frame (SOF) pattern,

followed by the data stream and is closed by an End Of Frame (EOF) pattern. These

different phases of the transmission sequence can be monitored using the PrimaryStatus

Depending on the setting of the ChannelRedundan cy register bit TxCRCEn, the CRC is

calculated and appended to the data stream. The CRC is calculated according to the

settings in the ChannelRedundancy re gister . Pari ty generation is handled according to the

ChannelRedundancy register ParityEn and ParityOdd bits settings.

11.2.1.3 Transmission of bit oriented frames

The transmitter can be configured to send an incomplete last byte. To achieve this the

BitFraming register’s TxLastBits[2:0] bits must be set at above zero (for example, 1). This

is shown in Figure 14.

Figure 14 shows the data stream when bit ParityEn is set in the ChannelRedundancy

byte is not followed by a parity check bit. After transmission, the TxLastBits[2:0] bits are

automatically cleared.

Remark: If the TxLastBits[2:0] bits are not equal to zero, CRC generation must be

disabled. This is done by clearing the ChannelRedund ancy register TxCRCEn bit.

11.2.1.4 Transmission of frames with more than 64 bytes

To generate frames of more than 64 bytes, the microprocessor must write data to the

FIFO buffer while the Transmit comma nd is active . The state mac hine ch ecks the FIFO

buffer status when it starts transmitting the last bit of the data stream; the check time is

shown in Figure 15 with arrows.

Fig 14. Transmitting bit oriented frames

001aak6

TxLastBits = 0

TxLastBits = 7

TxLastBits = 1

07 P 0 7 PSOF

SOF

EOF

0 7 P 0 6

0 7 P 0

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 71 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

As long as the internal signal accept further data is logic 1, data can be written to the FIFO

buffe r. The MFRC500 a ppends this data to the data stream transmitted using the RF

interface.

If the internal accept further data signal is logic 0, the transmission terminates. All data

written to the FIFO buffer after the accept further data signal was set to logic 0 is not

transmitted, however, it remains in the FIFO buffer.

Remark: If parity genera tion is enabled (ParityEn = logic 1), the parity bit is the last bit

transmitted. This delays the accept further data signal by a duration of one bit.

If the TxLastBits[2:0] bit s are not zero, the last byte is not transmitted completely. Only the

number of bit s set by TxLa stBits[2:0], starting with the least significant bit are transmitted.

This means that the internal state machine has to chec k the FIFO buffer status at an

earlier point in time; see Figure 16.

Since in this example TxLastBits[2:0] = 4, transmission stops after bit 3 is transmitted and

the frame is completed with an EOF, if configured.

Fig 15. Timing for transmitting byte oriented frames

Fig 16. Timing for transmitting bit oriented frames

001aak61

accept further data

check FIFO empty

TxData

FIFO empty

FIFOLength[6:0] 0x01 0x00

TxLastBits[2:0] TxLastBits = 0

7 0 770

001aak62

accept further data

check FIFO empty

TxData

FIFO empty

FIFOLength[6:0] 01h 00h 01h 00h

TxLastBits[2:0] TxLastBits = 4

NWR (FIFO data)

7 0 3 4 7 0 34

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 72 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Figure 16 also shows write access to the FIFOData register just before the FIFO buffer’s

status is checked. This leads to FIFO empty state being held LOW which keeps the

accept further data active. The new byte written to the FIFO buffer is transmitted using the

RF interface.

Accept further data is only changed by the check FIFO empty function. This function

verifies FIFO empty for one bit duration before the last expected bit transmission.

11.2.2 Receive command 16h

The Receive command activates the receiver circuitry. All data received from the RF

interface is written to the FIFO buffer. The Receive command can be started either using

the microprocessor or automatically during execution of the Transceive command.

Remark: This command can only be used for test purposes since there is no timing

relationship to the Transmit command.

11.2.2.1 Using the Receive command

After st arting the Receive command, the intern al state machine decrement s to the RxW a it

from 3 down to 1. When the counte r reaches 0, the receiver st arts monitorin g the incoming

signal at the RF interface.

When the signal strength reaches a level higher than the RxThreshold register

MinLevel[3:0] bits value, it starts decoding. The decoder stops when the signal can longer

be detected on the receiver input pin RX. The decoder sets bit RxIRq indicating receive

termination.

The different phases of the receive sequence are monitored using the PrimaryStatus

Remark: Since the counte r values fr om 3 to 0 are nee ded to initialize the anal og receiver

circuitry, the minimum value for RxWait[7:0] is 3.

Table 130. T ransmission of frames of more than 64 bytes

Frame definition Verification at:

8-bit with parity 8th bit

8-bit without parity 7th bit

x-bit without parity (x − 1)th bit

Table 131. Receive co mmand 16h

Command Value Action Arguments

and data Returned

data

Receive 16h activates receiver circuitry - data stream

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 73 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.2.2.2 RF cha nnel redundancy and fr aming

The decoder expects the SOF pattern at the beginning of each data stream. When the

SOF is detected, it activates the serial-to-p arallel converter and gathers th e incoming data

bits. Every completed byte is forwarded to the FIFO buffer.

If an EOF pattern is detected or the signal strength falls below the RxThreshold register

MinLevel[3 :0] bits sett ing, both the receiver and the decoder stop. Then the Idle command

is entered and an appropr iate response for the microprocessor is generated (inter rupt

request activated, status flags set).

When the ChannelRedundancy register bit RxCRCEn is set, a CRC block is expected.

The CRC block can be one byte or two bytes depending on the ChannelRedundancy

Remark: If the CRC block received is correct, it is not sent to the FIFO buffer. This is

realized by shifting the incoming d ata bytes through an internal buffer of either one or two

bytes (depending on the defined CRC). The CRC block remains in this internal buffer.

Consequently, all data bytes in the FIFO buffer are delayed by one or two bytes. If the

CRC fails, all received bytes are sent to the FIFO buffer including the faulty CRC.

If ParityEn is set in the ChannelRedundancy register, a parity bit is expected after each

byte. If ParityOdd = logic 1, the expected parity is odd, otherwise even p arity is expected.

11.2.2.3 Collision detection

If more than one card is within the RF field during the card selection phase, they both

respond simultaneously. The MFRC500 supports the a lgorithm defined in

ISO/IEC 14443 A to resolve card serial number data collisions by performing the

anti-collision procedure. The basis for this procedure is the ability to detect bit-collisions.

Bit-collision detection is supported by the Manchester coding bit encoding scheme used in

the MFRC500. If in the first and second half-bit of a subcarrier, modulation is detected,

instead of forwarding a 1-bit or 0-bit, a bit-collision is indicated. The MFRC500 uses the

RxThreshold register CollLevel[3:0] bits setting to distinguish between a 1-bit or 0-bit and

a bit-collision. If the amplitude of the half-bit with smaller amplitude is larger than that

defined by the CollLevel[3:0] bits, the MFRC500 flags a bit-collision using the error flag

CollErr. If a bit-collision is detected in a parity bit, the ParityErr flag is set.

On a detected collision, the receiver continues receiving the incoming data stream. In the

case of a bit-collision, the decoder sends logic 1 at the collision position.

Remark: As an exception, if bit ZeroAfterColl is set, all bits received after the first

bit-collision are forced to zero, regardless whether a bit-collision or an unequivocal state

has been detected. This feature makes it easier for the control software to perform the

anti-collision procedure as defined in ISO/IEC 14443 A.

When the first bit collision in a frame is detected, the bit-collision position is stored in the

CollPos register.

Table 132 shows the collision positions.

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 74 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Parity bits are not counted in the CollPos register because bit-collisions in parity bit occur

after bit-collisions in the data bits. If a collision is detected in the SOF, a frame error is

flagged and no data is sent to the FIFO buffer. In this case, the receiver continues to

monitor the incoming signal. It generates the correct notifications to the microprocessor

when the end of the faulty input str eam is detected. This helps the microprocessor to

determine wh en it is next allowed to send data to the card.

11.2.2.4 Receiving bit orie nted frames

The receiver can manage b yte str eams with incomplete bytes which result in bit-oriented

frames. To support this, the following values may be used:

•BitFraming register’s RxAlign[2:0] bits select a bit offset for the first incoming byte. For

example, if RxAlign[2:0] = 3, the first 5 bits received are forwarded to the FIFO buffer.

Further bits are packed into bytes and forwarded. After reception, RxAlign[2:0] is

automatically cleared. If RxAlign[2:0] = logic 0, all incoming bits are packed into one

byte.

•RxLastBits[2:0] returns the nu mber of bits valid in the last received byte. For example,

if RxLastBits[2:0] evaluates to 5 bits at the end of the received command, the 5 least

significant bits are valid . If the last byte is complete, RxLastBit s[2:0] evaluates to zero.

RxLastBits[2:0] is only valid if a frame error is not indicated by the FramingErr flag. If

RxAlign[2:0] is not zero and ParityEn is active, the first parity bit is ignored and not

checked.

The first byte containing a single bit from the card is not sent to the microprocessor but

suppressed when If RxAlign[2:0] is set to 7 (see Section 10.5.2.4 on page 50 ).

Remark: Collisions detected at CollPos register bit positions 6, 14, 22, 30 and 38 cannot

be resolved using RxAlign[2:0]. They must be resolved using the control software.

11.2.2.5 Communication errors

The events which can set error flags are shown in Table 133.

Table 132. Return valu es for bit-collision positions

Collision in bit CollPos register value

(Decimal)

SOF 0

Least Significant Bit (LSB) of the Least Significant Byte (LSByte) 1

……

Most Significant Bit (MSB) of the LSByte 8

LSB of second byte 9

……

MSB of second byte 16

LSB of third byte 17

……

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 75 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.2.3 Transceive comman d 1Eh

The Transceive command first executes the Transmit command (see Section 11.2.1 on

page 69) and then start s the Receive command (see Section 11.2.2 on page 72). All data

transmitted is sent using the FIFO buffer an d all data received is written to the FIFO buf fer .

The Transceive command can only be started by the microprocessor.

Remark: To adjust the timing relationship between transmitting and receiving, use the

RxWait register. This register is used to define the time delay between the last bit

transmitted and activation of the re ceiver . In addition, the BitPhase register determines the

phase-shift between the transmitter and receiver clock.

11.2.4 Card communication states

The status of the transmitter and receiver state machine can be read from bits

ModemState[2:0] in the PrimaryStatus register.

The assignment of ModemState[2:0] to the internal action is shown in Table 135.

Table 133. Communication error table

Cause Flag bit

Received data did not start with the SOF pa ttern FramingErr

CRC block is not equal to the expected value CRCErr

Received data is shorter than the CRC block CRCErr

The parity bit is not equal to the expected value (i.e. a bit-collision, not parity) ParityErr

A bit-collision is detected CollErr

Table 134. Transceive command 1Eh

Command Value Action Arguments

and data Returned

data

T ransceive 1Eh transmits data from FIFO buf fer to the card

and then automatically activates the

receiver

data stream data stream

Table 135. Mean ing of ModemState

ModemState

[2:0] State Description

000 Idle transmitter and/or receiver are not operating

001 TxSOF transmitting the SOF pattern

010 TxData transmitting data or redundancy check (CRC) bits from the FIFO

buffer

011 TxEOF transmitting the EOF pattern

100 GoToRx1 intermediate state passed, when receiver starts

GoToRx2 intermediate state passed, when receiver finishes

101 PrepareRx waiting until the RxWait register time period expires

110 AwaitingRx receiver activated; waiting for an input signal on pin RX

111 Receiving receiving data

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 76 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.2.5 Card communication state diagram

Fig 17. Card communication state diagram

001aak62

end of receive frame

and

RxMultiple = 0

RxMultiple = 1

EOF transmitted and

command = Transceive

FIFO not empty

and command =

Transmit or Transceive

command = Receive

COMMAND =

TRANSMIT,

RECEIVE OR

TRANSCEIVE

SET

COMMAND REGISTER = IDLE

(000)

Awaiting Rx

(110)

RECEIVING

(111)

GoToRx2

(100)

Prepare Rx

(101)

GoToRx1

(100)

TxEOF

(011)

TxData

(010)

TxSOF

(001)

IDLE

(000)

SOF transmitted next bit clock

data transmitted RxWaitC[7:0] = 0

EOF transmitted and

command = Transmit

signal strength > MinLevel[3:0]

frame received

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 77 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.3 EEPROM commands

11.3.1 Wr iteE2 command 01h

The WriteE2 command interprets the first two bytes in the FIFO buffer as the EEPROM

start b yte address. Any further bytes are interpreted as dat a bytes and are programmed

into the EEPROM, starting from the given EEPROM start byte address. This command

does not return any data.

The WriteE2 command can only be started by the microprocessor. It will not stop

automatically but has to be stopped explicitly by the microprocessor by issuing the Idle

command.

11.3.1.1 Prog ramming process

One byte up to 16 bytes can be programmed into the EEPROM during a single

programming cycle. The time needed is approximately 5.8 ms.

The state machine copies all the prepared data bytes to the FIFO buffer and then to the

EEPROM input buffer. The internal EEPROM input buffer is 16 bytes long which is equal

to the block size of the EEPROM. A programming cycle is started if the last position of the

EEPROM input buffer is written or if the last byte of the FIFO buffer has been read.

The E2Ready fl ag remains logic 0 when there are u nprocessed bytes in the FIFO buffer or

the EEPROM programming cycle is still in progress. When all the data from the FIFO

buffer are programmed into the EEPROM, the E2Ready flag is set to logic 1. Together

with the rising edge of E2Read y the TxIRq interrupt request flag shows logic 1. This can

be used to generate an interrupt when pr ogramming of all data is finished.

Once E2Ready = logic 1, the WriteE2 command can be stop ped by the microprocessor by

sending the Idle command.

Remark: During the EEPROM programming indicated by E2Ready = logic 0, the WriteE2

command cannot b e stopped using any other command.

Table 136. WriteE2 command 01h

Command Value Action FIFO

Arguments and

data Returned

data

WriteE2 01h get data from FIFO buffer and write it

to the EEPROM start address LSB -

start address MSB -

data byte stream -

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 78 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.3.1.2 Timing diagram

Figure 18 shows programming five bytes into the EEPROM.

Assuming that the MFRC500 finds and reads byte 0 before the microprocessor is able to

write byte 1 (tprog,del = 300 ns). This causes the MFRC500 to start the programming cycle

(tprog), which takes approxima tely 5.8 ms to complete. In the meantime, the

microprocessor stores byte 1 to byte 4 in the FIFO buffer.

If the EEPROM start byte address is 16Ch then byte 0 is stored at that address. The

MFRC500 copies the subsequent data bytes into the EEPROM input buffer. Whilst

copying byte 3, it detects that this data byte has to be programmed at the EEPROM byte

address 16Fh. As this is the end of the memory block, the MFRC500 automatically starts

a programm ing c ycle .

Next, byte 4 is programmed at the EEPROM byte address 170h. As this is the last data

byte, the E2Ready and TxIRq flags are set indicating the end of the EEPROM

programming activity.

Although all data has been programmed into the EEPROM, the MFRC500 stays in the

WriteE2 command. Writing more data to the FIFO buffer would lead to another EEPROM

programming cycle continuing from EEPROM byte address 171h. The command is

stopped using the Idle command.

11.3.1.3 WriteE2 command error flags

Programming is restricted for EEPROM block 0 (EEPROM byte address 00h to 0Fh). If

you program these addresses, the AccessErr flag is set and a program ming cycle is not

started.

Addresses above 1FFh are taken modulo 200h; see Section 9.2 on page 10 for the

EEPROM memory organization.

Fig 18. EEPROM programming timing diagram

001aak62

NWR

data

WriteE2

command active

EEPROM

programming

E2Ready

TxIRq

write

addr

LSB

addr

MSB byte 0 byte 1

tprog,del

byte 2 byte 3 byte 4

programming byte 0

tprog

programming

byte 1, byte 2 and byte 3

tprog

programming byte 4

tprog

Idle

command

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 79 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.3.2 ReadE2 command 03h

The ReadE2 command interprets the first two bytes stored in the FIFO buffer as the

EEPROM starting byte address. The next byte specifies the number of data bytes

returned.

When all three argument bytes are available in the FIFO buffer, the specified number of

data bytes is copied from the EEPROM into the FIFO buffer, starting from the given

EEPROM starting byte address.

The ReadE2 command can only be triggered by the microprocessor and it automatically

stops when all data has been copied.

11.3.2.1 ReadE2 command error flags

Reading is restricted to EEPROM blocks 8h to 1Fh (key memory area). Reading from

these addresses sets the flag AccessErr = logic 1.

Addresses above 1FFh ar e taken as modulo 200h; see Section 9.2 on page 10 for the

EEPROM memory organization.

11.4 Diverse commands

11.4.1 LoadConfig command 07h

The LoadConfig command interprets the first two bytes found in the FIFO buffer as the

EEPROM starting byte address. When the two argument bytes are available in the FIFO

buffer, 32 bytes from the EEPROM are copied into the Control and other relevant

registers, starting at the EEPROM starting byte addr ess. The LoadConfig command can

only be started by the micro pr oc es s or and it automatically stops when all relevant

registers have been copied.

11.4.1.1 Register assignment

The 32 bytes of EEPROM content are written to the MFRC500 registers 10h to register

2Fh; see Section 9.2 on page 10 for the EEPROM memory organization.

Remark: The procedure fo r the register assignment is the same as it is for the StartUp

initialization (see Section 9.7.3 on page 25). The dif fere nce is, the EEPROM st ar ti ng byte

address for the startup initialization is fixed to 10h (block 1, byte 0). However, it can be

chosen with the Lo ad Co n fig co mm a nd .

Table 137. ReadE2 command 03h

Command Value Action Arguments Returned data

ReadE2 03h reads EEPROM data and

stores it in the FIFO buffer start address LSB data bytes

start address MSB

number of data bytes

Table 138. LoadConfig command 07h

Command Value Action Arguments and

data Returned data

LoadConfig 07h reads data from EEPROM and

initializes the registers start address LSB -

start address MSB -

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 80 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.4.1.2 Relevant LoadConfig command error flags

Valid EEPROM starting byte addresses are between 10h and 60h.

Copying from block 8h to 1Fh (keys) is re str icted. Read ing from these addre sses se t s th e

flag AccessErr = logic 1.

Addresses above 1FFh ar e taken as modulo 200h; see Section 9.2 on page 10 for the

EEPROM memory organization.

11.4.2 CalcCRC command 12h

The CalcCRC command takes all the data from the FIFO buffer as the inpu t bytes for the

CRC coprocessor. All data stored in the FIFO buffer before the command is started is

processed.

This command d oes not return any dat a to the FIFO buffer but the content of the CRC can

be read using the CRCResultLSB and CRCResultMSB registers.

The CalcCRC command can only be started by the microprocessor and it does not

automatically stop. It must be stopped by the microprocesso r sending the Idle command.

If the FIFO buffer is empty, the CalcCRC command waits for further input before

proceeding.

11.4.2.1 CRC coprocessor sett ings

Table 140 shows the parameters that can be configured for the CRC coprocessor.

The CRC polynomial for the 8-bit CRC is fixed to x8 + x4 + x3 + x2 + 1.

The CRC polynomial for the 16-bit CRC is fixed to x16 + x12 + x5 + 1.

11.4.2.2 CRC coprocessor status flags

The CRCReady status flag indicates that the CRC coprocessor has finished processing

all the data bytes in the FIFO buffer. When the CRCReady flag is set to logic 1, an

interrupt is requested which sets the TxIRq flag. This supports interrupt driven use of the

CRC coprocessor.

When CRCReady and TxIRq flags are set to logic 1 the content of the CRCResultLSB

and CRCResultMSB registers and the CRCErr flag are valid. The CRCResultLSB and

CRCResultMSB registers hold the content of the CRC, the CRCErr flag indicates CRC

validity for the processed data .

Table 139. CalcCRC command 12h

Command Value Action Arguments and

data Returned data

CalcCRC 12h activates the CRC copr ocessor data byte stream -

Table 140. CRC coprocessor parameters

Parameter Value Bit Register

CRC register

length 8-bit or 16-bit CRC CRC8 ChannelRedundancy

CRC algorithm ISO/IEC 14443 A or ISO/IEC 3309 CRC3309 ChannelRedundancy

CRC preset value any CRCPresetLSB CRCPresetLSB

CRCPresetMSB CRCPresetMSB

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 81 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.5 Error handling during command execution

If an error is detected during command execution, the PrimaryStatus register Err flag is

set. The microprocessor can evaluate the status flags in the ErrorFlag register to get

information about the cause of the error.

11.6 MIFARE security commands

11.6.1 LoadKeyE2 command 0Bh

The LoadKeyE2 command interprets the first two bytes found in the FIFO buffer as the

EEPROM starting byte address. The EEPROM bytes starting from the given starting byte

address are interpreted as the key when stored in the correct key format as described in

Section 9.2.3.1 “Key format” on page 13. When both argument b ytes ar e available in the

FIFO buffer, the command executes.

The LoadKeyE2 command can only be st arted by the micropr ocessor and it automatica lly

stops after copying the key from the EEPROM to the key buffer.

11.6.1.1 Relevant LoadKeyE2 command error flags

If the key format is incorrect (see Section 9.2.3.1 “Key f ormat” on page 13) an undefined

value is copied into the key buffer and the KeyErr flag is set.

11.6.2 LoadKey command 19h

Table 141. ErrorFlag register error flags overview

Error flag Related commands

KeyErr LoadKeyE2, LoadKey

AccessErr WriteE2, ReadE2, LoadConfig

FIFOOvlf no specific commands

CRCErr Receive, Transceive, CalcCRC

FramingErr Receive, Tr ansceive

ParityErr Receive, Transceive

CollErr Receive, Transceive

Table 142. LoadKeyE2 command 0Bh

Command Value Action Arguments and

data Returned

data

LoadKeyE2 0Bh reads a key from the EEPROM and

puts it into the internal key buffer start address LSB -

start address MSB -

Table 143. LoadKey command 19h

Command Value Action Arguments and

data Returned

data

LoadKey 19h reads a key from the FIFO buffer and puts it

into the key buffer byte 0 (LSB) -

byte 1 -

…-

byte 10 -

byte 11 (MSB) -

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 82 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

The LoadKey command interprets the first twelve bytes it finds in the FIFO buffer as the

key when stored in th e co rrect key for mat as de scribed in Section 9.2.3.1 “ Key fo rmat” o n

page 13. When the twelve argument bytes are available in the FIFO buffer they are

checked and, if valid , ar e co pie d int o th e key buffer.

The LoadKey command can only be started by the microprocessor and it automatically

stops after copying the key from the FIFO buffer to the key buffer.

11.6.2.1 Relevant LoadKey command error flags

All bytes requested are copied from the FIFO buffer to the key buffer. If the key format is

not correct (see Section 9.2.3.1 “Key format” on page 13) an undefined value is copied

into the key buffer and the KeyErr flag is set.

11.6.3 Authent1 command 0Ch

The Authent1 command is a special Transceive command; it sends six ar gument bytes to

the card. The card’s response is not sent to the microprocessor, it is used instead to

authenticate the card to the MFRC500 and vice versa.

The Authent1 command can be triggered only by the microprocessor. The sequence of

states for this command are the same as those for the Transceive command; see

Section 11.2.3 on page 75.

11.6.4 Authent2 command 14h

The Authent2 command is a special Transceive command . It does not need an argument

byte, however all the data needed to be sent to the card is assembled by the MFRC500.

The card response is not sent to the microprocessor but is used to authenticate the card

to the MFRC500 and vice versa.

The Authent2 command can only be started by the microprocessor. The sequence of

states for this command are the same as those for the Transceive command; see

Section 11.2.3 on page 75.

Table 144. Auth ent1 command 0Ch

Command Value Action Arguments and data Returned

data

Authent1 0Ch performs the first part of the Crypto1

card authentication card Authent1 command -

card block address -

card serial number LSB -

card serial number byte1 -

card serial number byte2 -

card serial number MSB -

Table 145. Auth ent2 command 14h

Command Value Action Arguments

and data Returned

data

Authent2 14h performs the second part of the card

authentication using the Crypto1 algorithm --

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 83 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

11.6.4.1 Authent2 command ef fects

If the Authent2 command is successful, the authenticity of card and the MFRC500 are

proved. This automatically sets the Crypto1On control bit. When bit Crypto1On = logic 1,

all further card communication is encrypted using the Crypto1 security algorithm. If the

Authent2 command fails, bit Crypto1On is cleared (Crypto1On = logic 0).

Remark: The Crypto1On flag can only be set by a successfully executed Authent2

command and not by the micr opr ocessor. The microprocessor can clear bit Crypto1On to

continue with unencrypted (plain) card communication.

Remark: The Authent2 command must be executed immediately afte r a successful

Authent1 command; see Section 11.6.3 “Authent1 command 0Ch”. In addition, the keys

stored in the key buffer and those on the card must match.

12. Limiting values

13. Characteristics

13.1 Operating condition range

Table 146. Limiting values

In accordance with the Absolute Maximum Rating System (IEC 60134).

Symbol Parameter Conditions Min Max Unit

Tamb ambient temperature −40 +150 °C

Tstg storage temperature −40 +150 °C

VDDD digital supply voltage −0.5 +6 V

VDDA analog supply voltage −0.5 +6 V

VDD(TVDD) TVDD supply voltage −0.5 +6 V

|Vi|input voltage (absolute value) on any digital pin to DVSS −0.5 VDDD + 0.5 V

on pin RX to AVSS −0.5 VDDA + 0.5 V

Table 147. Operating con ditio n range

Symbol Parameter Conditions Min Typ Max Unit

Tamb ambient temperature - −25 +25 +85 °C

VDDD digital supply voltage DVSS = AVSS = TVSS = 0 V 4.5 5.0 5.5 V

VDDA analog supply voltage DVSS = AVSS = TVSS = 0 V 4.5 5.0 5.5 V

VDD(TVDD) TVDD supply voltage DVSS = AVSS = TVSS = 0 V 3.0 5.0 5.5 V

VESD electrostatic discharge voltage Human Body Model (HBM); 1.5 kΩ,

100 pF - - 1000 V

Machine Mode l (MM); 0.75 μH,

200 pF --100V

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 84 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

13.2 Current consumption

13.3 Pin characteristics

13.3.1 Input pin characteristics

Pins D0 to D7, A0, and A1 have TTL input characteristics and behave as defined in

Table 149.

The digital input pins NCS, NWR, NRD, ALE, A2, and MFIN have Schmitt trigger

characteristics, and behave as defined in Table 150.

Table 148. Current consumption

Symbol Parameter Conditions Min Typ Max Unit

IDDD digital supply current Idle command - 8 11 mA

Standby mode - 3 5 mA

Soft power-down mode - 800 1000 μA

Hard power-down mode - 1 10 μA

IDDA analog supply current Idle command; receiver on - 25 40 m A

Idle command; receiver off - 12 15 mA

Standby mode - 10 13 mA

Soft power-down mode - 1 10 μA

Hard power-down mode - 1 10 μA

IDD(TVDD) TVDD supply current continuous wave - - 150 mA

pins TX1 and TX2 unconnected;

TX1RFEn and TX2RFEn = log ic 1 -5.57 mA

pins TX1 and TX2 unconnected;

TX1RFEn and TX2RFEn = log ic 0 - 65 130 μA

Table 149. Standard input pin characteristics

Symbol Parameter Conditions Min Typ Max Unit

ILI input leakage current −1.0 - +1.0 μA

Vth threshold voltage CMOS: VDDD < 3.6 V 0.35VDDD - 0.65VDDD V

TTL: 4.5 < V DDD 0.8 - 2.0 V

Table 150. Schmitt trigger input pin characteristics

Symbol Parameter Conditions Min Typ Max Unit

ILI input leakage current −1.0 - +1.0 μA

Vth threshold voltage positive-going threshold;

TTL = 4.5 < VDDD

1.4 - 2.0 V

CMOS = VDDD < 3.6 V 0.65VDDD - 0.75VDDD V

negative-going threshold;

TTL = 4.5 < VDDD

0.8 - 1.3 V

CMOS = VDDD < 3.6 V 0.25VDDD -0.4V

DDD V

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 85 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Pin RSTPD has Schmitt trigger CMOS characteristics. In addition, it is internally filtered by

a RC low-pass filter which causes a propagation delay on the reset signal.

The analog input pin RX has the input capacitance and input voltage range shown in

Table 152.

13.3.2 Digital output pin characteristics

Pins D0 to D7, MFOUT and IRQ have CMOS output characteristics and behave as

defined in Table 153.

Remark: Pin IRQ can be con figured as o pen collector which causes the VOH va lues to be

no longer applicable.

Table 151. RSTPD input pin char acteristics

Symbol Parameter Conditions Min Typ Max Unit

ILI input leakage current −1.0 - +1.0 μA

Vth threshold voltage positive-going threshold;

CMOS = VDDD < 3.6 V 0.65VDDD - 0.75VDDD V

negative-going threshold;

CMOS = VDDD < 3.6 V 0.25VDDD -0.4V

DDD V

tPD propagation delay - - 20 μs

Table 152. RX inpu t capacitance and input voltage range

Symbol Parameter Conditions Min Typ Max Unit

Ciinput capacitance - - 15 pF

Vi(dyn) dynamic input voltage VDDA = 5 V; Tamb = 25 °C1.1-4.4V

Table 153. Digital output pin characteristics

Symbol Parameter Conditions Min Typ Max Unit

VOH HIGH-level output

voltage VDDD = 5 V; IOH = −1 mA 2.4 4.9 - V

VDDD = 5 V; IOH = −10 mA 2.4 4.2 - V

VOL LOW- l e vel output

voltage VDDD = 5 V; IOL = 1 mA - 25 400 mV

VDDD = 5 V; IOL = 10 mA - 250 400 mV

IOoutput current source or sink; VDDD =5V - - 10 mA

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 86 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

13.3.3 Antenna driver output pin characteristics

The source conductance of the antenna driver pins TX1 and TX2 for driving the

HIGH-level can be configured using the CwCon ductance register’s GsCfgCW[5:0] bits,

while their source conductance for driving the LOW-level is constant.

The antenna driver default configuration output characteristics are specified in Table 154.

13.4 AC electrical characteristics

13.4.1 Separate read/write strobe bus timing

Table 154. Antenna driver output pin characteristics

Symbol Parameter Conditions Min Typ Max Unit

VOH HIGH-level output

voltage VDD(TVDD) = 5.0 V; IOL = 20 mA - 4.97 - V

VDD(TVDD) = 5.0 V; IOL = 100 mA - 4.85 - V

VOL LOW -l evel output

voltage VDD(TVDD) = 5.0 V; IOL = 20 mA - 30 - mV

VDD(TVDD) = 5.0 V; IOL = 100 mA - 150 - mV

IOoutput current transmitter; continuous wave;

peak-to-peak - - 200 mA

Table 155. Timing specification for separate read/write strobe

Symbol Parameter Conditions Min Typ Max Unit

tLHLL ALE HIGH time 20 - - ns

tAVLL address valid to ALE LOW time 15 - - ns

tLLAX address ho ld after ALE LOW

time 8--ns

tLLRWL ALE LOW to read/write LOW

time ALE LOW to NRD or

NWR LOW 15 - - ns

tSLRWL chip select LOW to read/write

LOW time NCS LOW to NRD or

NWR LOW 0--ns

tRWHSH read/write HIGH to chip select

HIGH time NRD or NWR HIGH to

NCS HIGH 0--ns

tRLDV read LOW to data input valid

time NRD LOW to data valid - - 65 ns

tRHDZ read HIGH to data input high

impedance time NRD HIGH to data

high-impedance - - 20 ns

tWLQV write LOW to data output valid

time NWR LOW to data valid - - 35 ns

tWHDX data output hold after write

HIGH time data hold time after

NWR HIGH 8--ns

tRWLRWH read/write LOW time NRD or NWR 65 - - ns

tAVRWL address val id to read/write

LOW time NRD or NWR LOW

(set-up time) 30 - - ns

tWHAX address hold after write HIGH

time NWR HIGH (hold time) 8 - - ns

tRWHRWL read/write HIGH time 150 - - ns

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 87 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Remark: The signal ALE is not relevant for separate address/data bus and the

multiplexed addresses on the data bus do not care. The multip lexed address and data bus

address lines (A0 to A2) must be connected as described in Section 9.1.3 on page 8.

13.4.2 Common read/write strobe bus timing

Fig 19. Separate read/write strobe timing diagram

001aaj63

tSLRWL tRWHSH

tRWHRWL

tWHDX

tRHDZ

tWLQV

tRLDV

tAVRWL tWHAX

tLLAX

tAVLL

tRWLRWH

tLLRWL

tRWHRWL

tLHLL

A0 to A2

D0 to D7

NWR

NRD

NCS

ALE

A0 to A2

Multiplexed address bus

Separated address bus

Table 156. Common read/write strobe timing specification

Symbol Parameter Conditions Min Typ Max Unit

tLHLL ALE HIGH time 20 - - ns

tAVLL address valid to ALE LOW time 15 - - ns

tLLAX address hold af ter ALE LOW time 8 - - ns

tLLDSL ALE LOW to dat a strobe LOW time NWR or NRD

LOW 15 - - ns

tSLDSL chip select LOW to data strobe

LOW time NCS LOW to

NDS LOW 0--ns

tDSHSH data strobe HIGH to chip select

HIGH time 0--ns

tDSLDV data strobe LOW to data input valid

time - - 65 ns

tDSHDZ data strobe HIGH to data input high

impedance time - - 20 ns

tDSLQV data strobe LOW to data output

valid time NDS/NCS LOW - - 35 ns

tDSHQX data output hold after dat a strobe

HIGH time NDS HIGH (write

cycle hold time) 8--ns

tDSHRWX RW hold after data strobe HIGH

time after NDS HIGH 8 - - ns

tDSLDSH data strobe LOW time NDS/NCS 65 - - ns

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 88 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

13.4.3 EPP bus timing

tAVDSL ad dress valid to data strobe LOW

time 30 - - ns

tRHAX address hold after read HIGH time 8 - - ns

tDSHDSL data strobe HIGH time period between

write sequences 150 - - ns

tWLDSL write LOW to data strobe LOW time R/NW valid to

NDS LOW 8--ns

Fig 20. Common read/write strobe timing diagram

Table 156. Common read/write strobe timing specification …continued

Symbol Parameter Conditions Min Typ Max Unit

001aaj63

tSLDSL tDSHSH

tDSHDSL

tDSHQX

tDSHDZ

tDSLDV

tDSLQV

tAVDSL tRHAX

tLLAX

tAVLL

tDSLDSH

tLLDSL

tDSHDSL

tLHLL

tWLDSL tDSHRWX

A0 to A2

D0 to D7

NRD

R/NW

NCS/NDS

ALE

A0 to A2

Multiplexed address bus

Separated address bus

Table 157. Common read/write strobe timing specification for EPP

Symbol Parameter Conditions Min Typ Max Unit

tASLASH address strobe LOW time nAStrb 20 - - ns

tAVASH address valid to address strobe

HIGH time multiplexed address

bus set-up time 15 - - ns

tASHAV address valid after address strobe

HIGH time multiplexed address

bus hold time 8- - ns

tSLDSL chip select LOW to data strobe

LOW time NCS LOW to nDStrb

LOW 0- - ns

tDSHSH data strobe HIGH to chip select

HIGH time nDStrb HIGH to

NCS HIGH 0- - ns

tDSLDV data strobe LOW to data input valid

time read cycle - - 65 ns

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 89 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Remark: Figure 21 does not distinguish between the address write cycle and a data write

cycle. The timings for the address write and data write cycle are different. In EPP mode,

the address lines (A0 to A2) must be connected as described in Section 9.1.3 on page 8.

tDSHDZ data strobe HIGH to data input high

impedance time read cycle - - 20 ns

tDSLQV data strobe LOW to data output

valid time nDStrb LOW - - 35 ns

tDSHQX data output hold after data strobe

HIGH time NCS HIGH 8 - - ns

tDSHWX write hold after data strobe HIGH

time nWrite 8 - - ns

tDSLDSH data strobe LOW time nDStrb 65 - - ns

tWLDSL write LOW to data strobe LOW time nWrite valid to

nDStrb LOW 8- - ns

tDSL-WAITH data strobe LOW to WAIT HIGH

time nDStrb LOW to

nWrite HIGH - - 75 ns

tDSH-WAITL data strobe HIGH to WAIT LOW

time nDStrb HIGH to

nWrite LOW - - 75 ns

Fig 21. Timing diagram for common read/write strobe; EPP

Table 157. Common read/write strobe timing specification for EPP …continued

Symbol Parameter Conditions Min Typ Max Unit

001aaj64

nWait

tDSL-WAITH

tDSLDV

tDSLQV

tWLDSL

tSLDSL

tDSHSH

tDSLDSH

D0 to D7

A0 toA7

tDSHQX

tDSHDZ

tDSH-WAITL

tDSHWX

D0 to D7

nDStrb

nAStrb

nWrite

NCS

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 90 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

13.4.4 Clock frequency

The clock input is pin OSCIN.

The clock applied to the MFRC500 acts as a time constant for the synchronous system’s

encoder and decoder. The stability of the clock frequency is an important factor for

ensuring proper p erformance. To obtain highest pe rformance, clock jitter must be as small

as possible. This is best achieved using the internal oscillator buffer and the

recommended circuitry; see Section 9.8 on page 26.

14. EEPROM characteristics

The EEPROM size is 32 × 16 ×8 = 4096 bit.

Table 158. Clock frequ ency

Symbol Parameter Conditions Min Typ Max Unit

fclk clock frequency c hecked by the clock

filter -13.56-MHz

δclk clock duty cycle 40 50 60 %

tjit jitter time of clock edges - - 10 ps

Table 159. EEPROM characteristics

Symbol Parameter Conditions Min Typ Max Unit

Nendu(W_ER) write or erase endurance erase/write cycles 100.000 - - Hz

tret retention time Tamb ≤ 55 °C 10 - - year

ter erase time - - 2.9 ms

ta(W) write access time - - 2.9 ms

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 91 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

15. Application information

15.1 Typical application

15.1.1 Circuit diagram

Figure 22 shows a typical application where the antenna is directly matched to the

MFRC500:

15.1.2 Circuit description

The matching circuit consists of an EMC low-pass filter (L0 and C0), m atc hin g circu itry

(C1 and C2), a receiver circuit (R1, R2, C3 and C4) and the antenna itse lf.

Refer to the following application notes for mo re d et ailed information a bout designing an d

tuning an antenna.

•MICORE reader IC family; Directly Matched Antenna Design Ref. 1

•MIFARE (14443 A) 13.56 MHz RFID Proximity Antennas Ref. 2.

15.1.2.1 EMC low-pass filter

The MIFARE system operates at a frequency of 13.56 MHz. This frequency is generated

by a quartz oscillator to clock the MFRC500. It is also the basis for driving the antenna

using the 13.56 MHz energ y ca rrier. This not only causes power emissions at 13.5 6 MHz,

it also emits power at higher harmonics. International EMC r egulations define the

amplitude of the emitted power over a broa d fre que ncy range . To meet these regulations,

appropriate filtering of the output signal is required.

Fig 22. Application example circuit diagram: directly matched antenna

001aak62

DVDD RSTPD AVDD TVDD

DVDD Reset AVDD TVDD

DVSS

control lines

data bus

IRQ

OSCIN OSCOUT

13.56 MHz

AVSS

VMID

TX2

TVSS

TX1

IRQ

15 pF 15 pF

C0 C2a

C2b

L0 C1

100 nF

MICROPROCESSOR

BUS

MICROPROCESSOR

DEVICE

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 92 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

A multilayer board is recommended to implement a low-pass filter as shown in Figure 22.

The low-pass filter consists of the components L0 and C0. The recommended values are

given in Application notes MICORE reader IC family; Directly Matched Antenna Design

Ref. 1 and MIFARE (14443 A) 13.56 MHz RFID Proximity Antennas Ref. 2.

Remark: To achieve best performance, all component s must be at least equal in quality to

those recommended.

Remark: The layout has a major influence on the overall performance of the filter.

15.1.2.2 Antenna matching

Due to the impedance transformation of the low-pass filter, the antenna coil has to be

matched to a given impe dance. T he match ing elem ent s C1 and C2 can be estimated a nd

have to be fine tuned depending on the design of the antenna coil.

The correct impedance matching is important to ensure optimum performance. The

overall quality factor has to be considered to guarantee a proper ISO/IEC 14443 A

communication scheme. Environmen tal influence s have to considered and common EMC

design rules.

Refer to Application notes MICORE reader IC family; Directly Matched Antenna Design

Ref. 1 and MIFARE (14443 A) 13.56 MHz RFID Proximity Antennas Ref. 2 for details.

Remark: Do not exceed the current limit s (IDD(TVDD)), otherwise the chip might be

destroyed.

Remark: The overall 13.56 MHz RFID proximity antenna design in combination with the

MFRC500 IC does not require an y specialist RF knowledge. However, all relevant

parameters have to be considered to guarantee optimum performance and international

EMC compliance.

15.1.2.3 Receiver circuit

The internal receiver of the MFRC500 makes use of both subcarrier load modulation

side-bands. No external filtering is required.

It is recommende d to use the internally gen erated VMID potentia l as the input potential fo r

pin RX. This VMID DC volta ge level has to be coupled to pin RX using resistor (R2). To

provide a stable DC reference voltage, a capacitor (C4) must be connected between

VMID and groun d.

The AC volt age divider of R1 + C3 and R2 ha s to be designe d taking in to account the AC

voltage limits on pin RX. Depending on the antenna coil design and the impedance,

matching the voltage at the antenna coil will differ. Therefore the recommended way to

design the receiver circuit is to use the given values for R1, R2, and C3; refer to

Application note; MIFARE (14443 A) 13.56 MHz RFID Proximity Antennas Ref. 2. The

voltage on pin RX can be altered by varying R1 within the given limits.

Remark: R2 is AC connected to ground using C4.

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 93 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

15.1.2.4 Antenna coil

The precise calculation of the antenna coil’s inductance is not practicable but the

inductance can be estimated using Equation 10. We recommend designing an antenna

that is either circula r or rectangular.

(10)

•l1= length of one turn of the conductor loop

•D1= diameter of the wire or width of the PCB conductor, respectively

•K = antenna shape factor (K = 1.07 for circular antennas and K = 1.47 for square

antennas)

•N1= number of turns

•ln = natural logarithm function

The values of the antenna inductance, resistance, and capacitance at 13.56 MHz depend

on various parameters such as:

•antenna construction (type of PCB)

•thickness of conductor

•distance between the windings

•shielding layer

•metal or ferrite in the near environment

Therefore a measurement of these parameters under rea l life conditions or at least a

rough measurement and a tuning procedure is highly recommended to guarantee

adequate performance. Refer to Application notes MICORE reader IC family; Directly

Matched Antenna Design Ref. 1 and MIFARE (14 443 A) 13.56 MHz RFID Prox imit y

Antennas Ref. 2 for details.

15.2 Test signals

The MFRC500 allows different kinds of signal measuremen ts. These measurements can

be used to check the internally generated and received signals using the serial signal

switch as described in Section 9.11 on page 33.

In addition, the MFRC500 enables users to select between:

•internal analog signals for measurement on pin AUX

•internal digital signals for observation on pin MFOUT (based on register selections)

These measurement s can be help ful during th e design-in phase to optimize the receiver’s

behavior, or for test purposes.

L1nH[]2=I1cm[] I1

------

〈〉ln K–

⎝⎠

⎛⎞

N11.8

⋅⋅

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 94 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

15.2.1 Measurements using the serial signal switch

Using the serial signal switch on pin MFOUT, data is observed that is sent to the card or

received from the card. Table 160 gives an overview of the different signals available.

15.2.1.1 TX control

Figure 23 shows as an example of an ISO/IEC 14443 A communication.

The signal is measured on pin MFOUT using the serial signal switch to control the data

sent to the card. Setting the flag MFOUTSelect[2:0] = 3 sends the data to the card coded

as NRZ. Setting MFOUTSelect[2:0] = 2 shows the data as a Miller coded signal.

The RFOut signal is measured directly on the antenna and gives the RF signal pulse

shape. Refer to Application note Directly matched Antenna - Excel calcula tion (Ref. 3) for

detail information on the RF signal pulse.

Table 160. Signal route d to pin MFOUT

SignalToMFOUT MFOUTSelect Signal routed to pin MFOUT

00LOW

01HIGH

02envelope

0 3 transmit NRZ

0 4 Manchester with subcarrier

0 5 Manchester

0 6 reserved

0 7 reserved

1 X digital test signal

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 95 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

15.2.1.2 RX control

Figure 24 shows an example of ISO/IEC 14443 A communication which represents the

beginning of a card’s answer to a request signal.

The RF signal shows the RF voltage measured directly on the antenna so th at the card’s

load modulation is visible. Setting MFOUTS elect[2:0] = 4 shows the Manchester decoded

signal with subc ar rie r. Set tin g MF O UT Sel ect[2:0] = 5 shows the Manchester decoded

signal.

(1) MFOUTSelect[2:0] = 3; serial data stream; 2 V per division.

(2) MFOUTSelect[2:0] = 2; serial data stream; 2 V per division.

(3) RFOut; 1 V per division.

Fig 23. TX control signals

001aak62

(1)

(2)

(3)

10 μs per division

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 96 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

15.2.2 Analog test signals

The analog test signals can be routed to pin AUX by selecting them using the

TestAnaSelect register TestAnaOutSel[4:0] bits.

(1) RFOut; 1 V per division.

(2) MFOUTSelect[2:0] = 4; Manchester with subcarrier; 2 V per division.

(3) MFOUTSelect[2:0] = 5; Manchester; 2 V per division.

Fig 24. RX cont rol signals

001aak62

10 μs per division

(1)

(2)

(3)

Table 161. Analog test signal selection

Value Signal Name Description

0 VMID voltage at internal node VMID

1 Vbandgap internal reference voltage generated by the bandgap

2 VRxFollI output signal from the demodulato r using the I-clock

3 VRxFollQ output signal from the demodulator using the Q-clock

4 VRxAmpI I-channel subcarrier signal amplified and filtered

5 VRxAmpQ Q-channel subcarrier signal amplified an d filtered

6 VCorrNI output signal of N-channel correlator fed by the I-channel subcarrier

signal

7 VCorrNQ output signal of N-channel correlator fed by the Q-channel subcarrier

signal

8 VCorrDI output signal of D-channel correlator fed by the I-channel subcarrier

signal

9 VCorrDQ output signal of D-channel correlator fed by the Q-channel subcarrier

signal

A VEvalL evaluation signal from the left half-bit

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 97 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

15.2.3 Digital test signals

Digital test signals can be routed to pin MFOUT by setting bit SignalToMFOUT = logic 1. A

digital test signal is selected using the TestDigiSelect register TestDigiSignalSel[6:0] bits.

The signals selected by the TestDigiSignalSel[6:0] bits are shown in Table 162.

If test signals are not used, the TestDigiSelect register address value must be 00h.

Remark: All other values for TestDigiSignalSel[6:0] are for production test purposes only.

15.2.4 Analog and digital test signal Examples

Figure 25 shows a MIFARE card’s answer to a request command using the Q-clock

receiving path. RX reference is given to show the Manchester modulated signal on pin

RX.

The signal is demodulated and amplified in the receiver circuitry. Signal VRXAmpQ is the

amplified side-band signal using the Q-clock for demodulation. The signals VCorrDQ and

VCorrNQ were generated in the correlation circuitry. They are processed further in the

evaluation and dig itize r cir cuit ry.

Signals VEvalR and VEvalL show the evaluation of the signal’s right and left half-bit.

Finally, the digital test signal s_data shows the received data. This is then sent to the

internal digital circuit and s_valid which indicates the received data strea m is valid.

B VEvalR evalua ti o n si gn a l from th e ri gh t ha l f-b i t

C VTe mp temperature voltage derived from band gap

D reserved reserved for future use

E reserved reserved for future use

F reserved reserved for future use

Table 161. Analog test signal selection …continued

Value Signal Name Description

Table 162. Digital test signal selection

TestDigiSignalSel

[6:0] Signal name Description

F4h s_dat a data received from the card

E4h s_valid when logic 1 is returned th e s_data and s_co ll signals are

valid

D4h s_coll when logic 1 is returned a collision has been detected in the

current bit

C4h s_clock internal serial clock:

during transmission, this is the encoder clock

during reception this is the receiver clock

B5h rd_sync internal synchronized read signal which is derived from the

parallel microprocessor interface

A5h wr_sync i nternal synchronized write signal which is derived from the

parallel microprocessor interface

96h int_clock internal 13.56 MHz clock

00h no test signal output as defined by the MFOUTSelect register

MFOUTSelect[2:0] bits routed to pin MFOUT

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 98 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Fig 25. ISO/IEC 14443 A receiving path Q-clock

001aak62

RX reference

VRxAmpQ

VCorrDQ

VCorrNQ

VEvalR

VEvalL

s_data

s_valid

50 μs per division

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 99 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

16. Package outline

Fig 26. Package outline SOT287-1

UNIT A

max. A1A2A3bpcD

(1) E(1) eH

ELL

pQZywv θ

REFERENCES

OUTLINE

VERSION EUROPEAN

PROJECTION ISSUE DATE

IEC JEDEC JEITA

inches

2.65

0.1

0.25

0.01

1.4

0.055

0.3

0.1

2.45

2.25

0.49

0.36

0.27

0.18

20.7

20.3

7.6

7.4 1.27 10.65

10.00

1.2

1.0

0.95

0.55 8

0.25 0.1

0.004

0.25

DIMENSIONS (inch dimensions are derived from the original mm dimensions)

Note

1. Plastic or metal protrusions of 0.15 mm (0.006 inch) maximum per side are not included.

1.1

0.4

SOT287-1 MO-119

(1)

0.012

0.004

0.096

0.089

0.02

0.01 0.05 0.047

0.039

0.419

0.394

0.30

0.29

0.81

0.80

0.011

0.007

0.037

0.022

0.010.01

0.043

0.016

vMA

32 17

detail X

(A )

pin 1 index

0 5 10 mm

scale

O32: plastic small outline package; 32 leads; body width 7.5 mm SOT287

-1

00-08-17

03-02-19

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 100 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

17. Abbreviations

18. References

[1] Application note — MICORE reader IC family; Directly Matched Antenna Design.

[2] Application note — MIFARE (14443 A) 13.56 MHz RFID Proximity Antennas.

[3] Application note — Directly matched Antenna - Excel calculation.

[4] ISO standard — ISO/IEC 14443 Identification cards - Contactless integrated

circuit(s) cards - Proximity cards, part 1-4.

[5] Application note — MIFARE Implementation of Higher Baud rates.

Table 163. Abbreviations and acronyms

Acronym Description

ASK Amplitude-Shift Keying

CMOS Complementary Metal-Oxide Semiconductor

CRC Cyclic Redundancy Check

EOF End Of Frame

EPP Enhanced Parallel Port

ETU Elementary Time Unit

FIFO First In, First Out

HBM Human Body Mo del

LSB Least Significant Bit

MM Machine Model

MSB Most Significant Bit

NRZ None Return to Zero

POR Power-On Reset

PCD Proximity Coupling Device

PICC Proximity Integrated Circui t Card

SOF Start Of Frame

SPI Seri al Peripheral Interface

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 101 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

19. Revision history

Table 164. Revisio n history

Document ID Release d ate Data sheet status Change notice Supersedes

MFRC500_33 20100315 Product data sheet - 048032

Modifications: •The format of this data sheet has been redesigned to comply with the new identity guidelines of

NXP Semiconductors

•Legal texts have been adapted to the new company name where appropriate

•This version supersedes all previous revisions.

•The symbols for electrical characteristics and their parameters have been updated to meet the

NXP Semiconductors’ guidelines

•A number of inconsistencies in pin, register and bit names have been eliminated from the data sheet

•All drawings have been updated

•Section 5 “Quick reference data” on page 3: section added

•Section 15.1.2.4 “Antenna coil” on page 93: added missing formula and updated the last clause

•Section 16 “Package outline” on page 99: updated

•Section 18 “References” on page 100: added section and updated the references in the docume nt

048032 20051201 Product data sheet - 048031

048031 20040501 Product data sheet - 048030

048030 20030301 Preliminary data sheet - 048020

048020 20010131 Objective data sheet - 048010

048010 20040430 Objective data sheet - -

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 102 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

20. Legal information

20.1 Data sheet status

[1] Please consult the most recently issued document before initiating or completing a design.

[2] The term ‘short data sheet’ is explained in section “Definitions”.

[3] The prod uct sta tus of device (s) descri bed in this d ocument may have change d since this d ocument was p ublished and may dif fer in case of multiple devices. The latest product st atus

information is available on the Internet at URL http://www.nxp.com.

20.2 Definitions

Draft — The document is a draft version only. The content is still under

internal review and subject to formal approval, which may result in

modifications or additions. NXP Semiconductors does not give any

representations or warranties as to the accuracy or completeness of

information included herein and shall have no liab ility for the consequences of

use of such information.

Short data sheet — A short data sheet is an extract from a full data sheet

with the same product type number(s) and tit le. A short data sh eet is intended

for quick reference only and shou ld not b e relied u pon to cont ain det ailed and

full information. For detailed and full informatio n see the relevant full data

sheet, which is available on request via the local NXP Semicond uctors sales

office. In case of any inconsistency or conflict with the short data sheet, the

full data sheet shall pre va il.

Product specification — The information and data provided in a Product

data sheet shall define the specification of the product as agreed between

NXP Semiconductors and its customer, unless NXP Semiconductors and

customer have explicitly agreed otherwise in writing. In no event however,

shall an agreement be valid in which the NXP Semiconductors product is

deemed to off er functions and qualities beyond those described in the

Product data sheet.

20.3 Disclaimers

Limited warr a nty and liability — Information in this document is believed to

be accurate and reliable. However, NXP Semiconductors does not give any

representations or warrant ies, expressed or implied, as to the accuracy or

completeness of such information and shall have no liability for the

consequences of use of such information.

In no event shall NXP Semiconductors be liable for any indirect , incidental,

punitive, special or consequ ential damages (including - wit hout limitation - lost

profits, lost savings, business interruption, costs related to the removal or

replacement of any products or rework charges) whether or not such

damages are based on tort (including negligence), warranty, breach of

contract or any other legal theory.

Notwithstanding any damages that customer might incur for any reason

whatsoever, NXP Semiconductors’ ag gregate and cumulative l iability toward s

customer for the products described herein shall be limited in accordance

with the Terms and conditions of commercial sale of NXP Semiconduct ors.

Right to make changes — NXP Semiconductors reserves the right to make

changes to information published in this document, including without

limitation specifications and product descriptions, at any time and without

notice. This document supersedes and replaces all informa tion supplied prior

to the publication hereof .

Suitability for use — NXP Semiconductors products are not designed,

authorized or warranted to be suitable for use in medical, military, aircraft,

space or life support equipment, nor in applications where failure or

malfunction of an NXP Semiconductors pro duct can reasonably be expected

to result in perso nal injury, death or severe propert y or environmental

damage. NXP Semiconductors accepts no liab ility for inclusion and/or use of

NXP Semiconductors products in such equipment or applications and

therefore such inclusion and/or use is at the customer’s own risk.

Applications — Applications that are described herein for any of these

products are for illustrative purposes only. NXP Semiconductors makes no

representation or warranty that such applications will be suitable for the

specified use without further testing or modification.

NXP Semiconductors does not accept any liabili ty related to any default,

damage, costs or problem which is based on a weakness or default in the

customer application /use or t he application/use of customer’s third party

customer(s) (hereinafter both referred to as “Application ”). It is customer’s

sole responsibility to check whether the NXP Semiconductors product is

suitable and fit for the Appl ica tion plann ed. Customer has to do all necessary

testing for the Application in order to avoid a default of the Application and t he

product. NXP Semiconductors does not accept any liability in this respect.

Limiting values — Stress above one or more limiting values (as defined in

the Absolute Maximum Ratings System of IEC 60134) will cause permanent

damage to the device. Limiting values are stress ratings only and (proper)

operation of the device at these or any other conditions above those given in

the Recommended operating conditions section (if present) or the

Characteristics sections of this document is not warranted. Constant or

repeated exposure to limiting values will permanently and irreversibly affect

the quality and reliability of the device.

Terms and conditions of commercial sale — NXP Semiconductors

products are sold subject to the general terms and conditions of commercial

sale, as published at http://www.nxp.com/profile/terms, unless otherwise

agreed in a valid written individua l agreement. In case an individual

agreement is concluded only the ter m s and conditions of the respective

agreement shall apply. NXP Semiconductors hereby expressly object s to

applying the customer’s general terms and conditions with regard to the

purchase of NXP Semiconductors products by customer.

No offer to sell or license — Nothing i n this document may be interpreted or

construed as an of fer t o sell product s that is open for accept ance or the gr ant,

conveyance or implication of any license under any copyrights, patents or

other industrial or inte llectual property right s.

Export control — This document as well as the item(s) described herein

may be subject to export control regulatio ns. Export might require a prior

authorization from national authorities.

Quick reference data — The Quick refer ence data is an extract of the

product data given in the Limiting values and Characteristics sections of this

document, and as such is not complete, exhaustive or legally binding.

Non-automotive qualified products — Unless this data sheet expressly

states that t his specific NXP Semiconductors product is automotive qualified,

the product is not suit ab le for aut omotive u se. It is neit her qua lifi ed n or test ed

in accordance with automotive testing or application requirements. NXP

Semiconductors accepts no liability for inclu sio n and/or use of

non-automotive qualifie d products in automotive equipment or applications.

Document status[1][2] Product status[3] Definition

Objective [short] data sheet Development This document contains data from the objective specification for product development.

Preliminary [short] dat a sheet Qualification This document contains data from the preliminar y specification.

Product [short] data sheet Production This document contains the product specification.

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 103 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

In the event that customer uses the product for design-in and use in

automotive applications to automot ive specifications and standards, custome r

(a) shall use the product without NXP Semiconductors’ warranty of the

product for such au tomotive applications, use and specifica tions, and (b)

whenever customer uses the product for automotive applications beyond

NXP Semiconductors’ specifications such use shall be solely at customer’s

own risk, and (c) customer fully indemnifies NXP Semiconductors for any

liability, damages or failed product claims resulting from customer design and

use of the product for automotive appl ications beyond NXP Semiconductors’

standard warrant y and NXP Semiconductors’ product specifications.

20.4 Trademarks

Notice: All referenced b rands, produc t names, service names and trademarks

are the property of their respective ow ners.

MIFARE — is a trademark of NXP B.V.

21. Contact information

For more information, please visit: http://www.nxp.com

For sales office addresses, please send an email to: salesaddresses@nxp.com

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 104 of 110

continued >>

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

22. Tables

Table 1. Quick reference data . . . . . . . . . . . . . . . . . . . . .3

Table 2. Ordering information . . . . . . . . . . . . . . . . . . . . .3

Table 3. Pin description . . . . . . . . . . . . . . . . . . . . . . . . . .5

Table 4. Supported microprocessor and EPP interface

signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7

Table 5. Connectio n scheme for detecting the parallel

interface type . . . . . . . . . . . . . . . . . . . . . . . . . . .8

Table 6. EEPROM memory organization diagram . . . . .10

Table 7. Product information field byte allocation . . . . .11

Table 8. Product information field byte description . . . .11

Table 9. Product type identificatio n definition . . . . . . . .11

Table 10. Byte assignment for register initialization at

start-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12

Table 11. Shipment content of StartUp

configuration file . . . . . . . . . . . . . . . . . . . . . . .12

Table 12. Byte assignment for register initialization at

startup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

Table 13. FIFO buffer access . . . . . . . . . . . . . . . . . . . . .1 5

Table 14. Associated FIFO buf fer registers and flags . . .16

Table 15. Interrupt sources . . . . . . . . . . . . . . . . . . . . . . .17

Table 16. Interrupt control registers . . . . . . . . . . . . . . . .17

Table 17. Associated Interrupt request system registers

and flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Table 18. Associated timer unit registers and flags . . . . .23

Table 19. Signal on pins during Hard power-down . . . . .23

Table 20. Pin TX1 configurations . . . . . . . . . . . . . . . . . .27

Table 21. Pin TX2 configurations . . . . . . . . . . . . . . . . . .27

Table 22. TX1 and TX2 source resistance of n-channel

driver transistor against

GsCfgCW or GsCfgMod . . . . . . . . . . . . . . . . .28

Table 23. Gain factors for the internal amplifier . . . . . . . .32

Table 24. DecoderSource[1:0] valu es . . . . . . . . . . . . . . .34

Table 25. ModulatorSource[1:0] values . . . . . . . . . . . . . .34

Table 26. MFOUTSelect[2:0] values . . . . . . . . . . . . . . . .34

Table 27. Register settings to enable use of the analog

circuitry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35

Table 28. Dedicated address bus: assembling the

Table 29. Multiplexed address bus: assembling the

Table 30. Behavior and designation of register bits . . . . .38

Table 31. MFRC500 register overview . . . . . . . . . . . . . .39

Table 32. MFRC500 register flags overview . . . . . . . . . .41

Table 33. Page register (address: 00h, 08h, 10h, 18h,

20h, 28h, 30h, 38h) reset value: 1000 0000b,

80h bit allocation . . . . . . . . . . . . . . . . . . . . . . .43

Table 34. Page register bit descriptions . . . . . . . . . . . . .43

Table 35. Command register (address: 01h)

reset value: x000 0000b, x0h bit allocation . . . 44

Table 36. Command register bit descriptions . . . . . . . . . 44

Table 37. FIFOData register (address: 02h)

reset value: xxxx xxxxb, xxh bit allocation . . . 44

Table 38. FIFOData register bit descriptions . . . . . . . . . 44

Table 39. PrimaryStatus register (address: 03h)

reset value: 0000 0101b, 05h bit allocation . . 45

Table 40. PrimaryStatus register bit descriptions . . . . . . 45

Table 41. FIFOLength register (address: 04h)

reset value: 0000 0000b, 00h bit allocation . . 46

Table 42. FIFOLength bit descriptions . . . . . . . . . . . . . . 46

Table 43. SecondaryStatus register (address: 05h)

reset value: 01100 000b, 60h bit allocation . . . 46

Table 44. SecondaryStatus register bit descriptions . . . . 46

Table 45. InterruptEn register (address: 06h)

reset value: 0000 0000b, 00h bit allocation . . 47

Table 46. InterruptEn register bit descriptions . . . . . . . . 47

Table 47. InterruptRq register (address: 07h)

reset value: 0000 0000b, 00h bit allocation . . 47

Table 48. InterruptRq registe r bit descriptions . . . . . . . . 47

Table 49. Control register (address: 09h )

reset value: 0000 0000b, 00h bit allocation . . 48

Table 50. Control register bit descriptions . . . . . . . . . . . 48

Table 51. ErrorFlag register (addre ss: 0Ah)

reset value: 0100 0000b, 40h bit allocation . . 49

Table 52. ErrorFlag register bit descriptions . . . . . . . . . . 49

Table 53. CollPos register (address: 0Bh)

reset value: 0000 0000b, 00h bit allocation . . 50

Table 54. CollPos register bit descriptions . . . . . . . . . . . 50

Table 55. TimerValue register (address: 0Ch)

reset value: xxxx xxxxb, xxh bit allocation . . . 50

Table 56. TimerValue register bit descriptions . . . . . . . . 50

Table 57. CRCResultLSB register (address: 0Dh)

reset value: xxxx xxxxb, xxh bit allocation . . . 50

Table 58. CRCResultLSB register bit descriptions . . . . . 50

Table 59. CRCResultMSB register (address: 0Eh)

reset value: xxxx xxxxb, xxh bit allocation . . . 51

Table 60. CRCResultMSB register bit descriptions . . . . 51

Table 61. BitFraming register (address: 0Fh)

reset value: 0000 0000b, 00h bit allocation . . 51

Table 62. BitFraming register bit descriptions . . . . . . . . . 51

Table 63. TxControl register (address: 11h)

reset value: 0101 1000b, 58h bit allocation . . 52

Table 64. TxControl register bit descri ptions . . . . . . . . . 52

Table 65. CwConductance register (addre ss: 12h)

reset value: 0011 1111b, 3Fh bit allocation . . . 53

Table 66. CwConductance register bit descriptions . . . . 53

Table 67. PreSet13 register (address: 13h)

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 105 of 110

continued >>

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

reset value: 0011 1111b, 3Fh bit allocation . . .53

Table 68. PreSet13 register bit descriptions . . . . . . . . . .53

Table 69. PreSet14 register (address: 14h)

reset value: 0001 1001b, 19h bi t allocation . . .5 3

Table 70. PreSet14 register bit descriptions . . . . . . . . . .53

Table 71. ModWidth register (address: 15h)

reset value: 0001 0011b, 13h bit allocation . . .54

Table 72. ModWidth register bit descriptions . . . . . . . . . .54

Table 73. PreSet16 register (address: 16h)

reset value: 0000 0000b, 00h bi t allocation . . .5 4

Table 74. PreSet16 register bit descriptions . . . . . . . . . .54

Table 75. PreSet17 register (address: 17h)

reset value: 0000 0000b, 00h bi t allocation . . .5 4

Table 76. PreSet17 register bit descriptions . . . . . . . . . .54

Table 77. RxControl1 register (address: 19 h)

reset value: 0111 0011b, 73h bit allocation . . .55

Table 78. RxControl1 register bit descrip tions . . . . . . . . .55

Table 79. DecoderControl register (address: 1Ah)

reset value: 0000 1000b, 08h bi t allocation . . .5 5

Table 80. DecoderControl register bit descriptions . . . . .55

Table 81. BitPhase register (address: 1Bh) reset value:

1010 1101b, ADh bit allocation . . . . . . . . . . . .5 6

Table 82. BitPhase register bit descriptions . . . . . . . . . .56

Table 83. RxThreshold register (address: 1Ch)

reset value: 1111 1111b, FFh bit allocation . . .56

Table 84. RxThreshold register bit descriptions . . . . . . .56

Table 85. PreSet1D register (address: 1Dh)

reset value: 0000 0000b, 00h bi t allocation . . .5 6

Table 86. PreSet1D register bit descriptions . . . . . . . . . .56

Table 87. RxControl2 register (address: 1Eh )

reset value: 0100 0001b, 41h bi t allocation . . .5 7

Table 88. RxControl2 register bit descrip tions . . . . . . . . .57

Table 89. ClockQControl register (address: 1Fh)

reset value: 000x xxxxb, xxh bit allocation . . . .57

Table 90. ClockQControl register bit descriptions . . . . . .57

Table 91. RxWait register (address: 21h) reset value:

0000 0101b, 06h bit allocation . . . . . . . . . . . . .58

Table 92. RxWai t regi ster bit descriptions . . . . . . . . . . . .5 8

Table 93. ChannelRedundancy register (addre ss: 22h)

reset value: 0000 0011b, 03h bit allocation . . .58

Table 94. ChannelRedundancy bit descriptions . . . . . . .58

Table 95. CRCPresetLSB register (address: 23h)

reset value: 0101 0011b, 63h bit allocation . . .59

Table 96. CRCPresetLSB register bit descriptions . . . . .59

Table 97. CRCPresetMSB register (address: 24h)

reset value: 0101 0011b, 63h bit allocation . . .59

Table 98. CRCPresetMSB bit descriptions . . . . . . . . . . .59

Table 99. PreSet25 register (address: 25h)

reset value: 0000 0000b, 00h bi t allocation . . .5 9

Table 100. PreSet25 register bit descriptions . . . . . . . . . .60

Table 101. MFOUTSelect register (address: 26h)

reset value: 0000 0000b, 00h bit allocation . . 60

Table 102. MFOUTSelect register bit descriptions . . . . . 60

Table 103. PreSet27 (address: 27h) reset value:

xxxx xxxxb, xxh bit allocation . . . . . . . . . . . . . 60

Table 104. PreSet27 register bit descriptions . . . . . . . . . 60

Table 105. FIFOLevel register (address: 29h)

reset value: 0000 1000b, 08h bit allocation . . 61

Table 106. FIFOLevel register bit descriptions . . . . . . . . 61

Table 107. TimerClock register (address: 2Ah)

reset value: 0000 0111b, 07h bit allocation . . . 61

Table 108. TimerClock register bit descriptions . . . . . . . . 61

Table 109. TimerControl register (address: 2Bh)

reset value: 0000 0110b, 06h bit allocation . . . 62

Table 110. TimerControl register bit descriptions . . . . . . . 62

Table 111. TimerReload register (address: 2Ch)

reset value: 0000 1010b , 0Ah bit allocation . . 62

Table 112. TimerReload register bit descriptions . . . . . . . 62

Table 113. IRQPinConfig register (address: 2Dh)

reset value: 0000 0010b, 02h bit allocation . . 63

Table 114. IRQPinConfig register bit descriptions . . . . . . 63

Table 115. PreSet2E register (address: 2Eh)

reset value: xxxx xxxxb, xxh bit allocation . . . 63

Table 116. PreSet2F register (address: 2Fh)

reset value: xxxx xxxxb, xxh bit allocation . . . 63

Table 117. Reserved registers (address: 31h, 32h, 33h,

34h, 35h, 36h, 37h) reset value: xxxx xxxxb,

xxh bit allocation . . . . . . . . . . . . . . . . . . . . . . . 63

Table 118. Reserved register (address: 39h)

reset value: xxxx xxxxb, xxh bit allocation . . . 64

Table 119. TestAnaSelect register (addre ss: 3Ah)

reset value: 0000 0000b, 00h bit allocation . . 64

Table 120. TestAnaSelect bit descriptions . . . . . . . . . . . . 64

Table 121. Reserved register (address: 3Bh)

reset value: xxxx xxxxb, xxh bit allocation . . . 65

Table 122. Reserved register (address: 3Ch)

reset value: xxxx xxxxb, xxh bit allocation . . . 65

Table 123. TestDigiSelect register (addre ss: 3Dh)

reset value: xxxx xxxxb, xxh bit allocation . . . 65

Table 124. TestDigiSelect register bit descriptions . . . . . 65

Table 125. Reserved register (address: 3Eh, 3Fh)

reset value: xxxx xxxxb, xxh bit allocation . . . 66

Table 126. MFRC500 commands overview . . . . . . . . . . . 66

Table 127. StartUp command 3Fh . . . . . . . . . . . . . . . . . . 68

Table 128. Idle command 00h . . . . . . . . . . . . . . . . . . . . . 68

Table 129. Transmit command 1Ah . . . . . . . . . . . . . . . . . 69

Table 130. Transmission of frames of more than

64 bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Table 131. Receive command 16h . . . . . . . . . . . . . . . . . 72

Table 132. Return values for bit-co llision positions . . . . . 74

Table 133. Communication error table . . . . . . . . . . . . . . . 75

Table 134. Transceive command 1Eh . . . . . . . . . . . . . . . 75

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 106 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

Table 135. Meaning of ModemState . . . . . . . . . . . . . . . . .75

Table 136. WriteE2 command 01h . . . . . . . . . . . . . . . . . .77

Table 137. ReadE2 command 03h . . . . . . . . . . . . . . . . . .79

Table 138. LoadConfi g command 07h . . . . . . . . . . . . . . .79

Table 139. CalcCRC command 12h . . . . . . . . . . . . . . . . .80

Table 140. CRC coprocessor parameters . . . . . . . . . . . .8 0

Table 141. ErrorFlag register error flags overview . . . . . .81

Table 142. LoadKeyE2 command 0Bh . . . . . . . . . . . . . . .81

Table 143. LoadKey command 19h . . . . . . . . . . . . . . . . .81

Table 144. Authent1 command 0Ch . . . . . . . . . . . . . . . . .8 2

Table 145. Authent2 command 14h . . . . . . . . . . . . . . . . .82

Table 146. Limiting values. . . . . . . . . . . . . . . . . . . . . . . . .83

Table 147. Operating condition range . . . . . . . . . . . . . . . .83

Table 148. Current consumption . . . . . . . . . . . . . . . . . . . .84

Table 149. Standard input pin characteristics . . . . . . . . . .8 4

Table 150. Schmitt trigger input pin characteristics . . . . .84

Table 151. RSTPD input pin characte ristics . . . . . . . . . . .85

Table 152. RX input capacitance and input voltage

range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85

Table 153. Digital output pin characteristics . . . . . . . . . . .85

Table 154. Antenna driver output pin characteristics . . . .86

Table 155. Timing specification for separate read/write

strobe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86

Table 156. Common read/write strobe timing

specification . . . . . . . . . . . . . . . . . . . . . . . . . . .87

Table 157. Common read/write strobe timing

specification for EPP . . . . . . . . . . . . . . . . . . . .88

Table 158. Clock frequency . . . . . . . . . . . . . . . . . . . . . . .90

Table 159. EEPROM characteristics . . . . . . . . . . . . . . . .90

Table 160. Signal routed to pin MFOUT . . . . . . . . . . . . . .94

Table 161. Analog test signal selection . . . . . . . . . . . . . .96

Table 162. Digital test signal selection . . . . . . . . . . . . . . .97

Table 163. Abbreviations an d acronyms . . . . . . . . . . . . .100

Table 164. Revision history . . . . . . . . . . . . . . . . . . . . . . .101

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 107 of 110

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

23. Figures

Fig 1. MFRC500 block diagram. . . . . . . . . . . . . . . . . . . .4

Fig 2. MFRC500 pin configuration. . . . . . . . . . . . . . . . . .5

Fig 3. Connection to microprocessor: separate

read and write strobes. . . . . . . . . . . . . . . . . . . . . .8

Fig 4. Connection to microprocessor: common

read and write strobes. . . . . . . . . . . . . . . . . . . . . .9

Fig 5. Connection to microprocessor: EPP common

read/write strobes and handshake. . . . . . . . . . . . .9

Fig 6. Key storage format . . . . . . . . . . . . . . . . . . . . . . .14

Fig 7. Timer module block diagram . . . . . . . . . . . . . . . .20

Fig 8. The StartUp procedure. . . . . . . . . . . . . . . . . . . . .25

Fig 9. Quartz clock connection . . . . . . . . . . . . . . . . . . .26

Fig 10. Receiver circuit block diagram. . . . . . . . . . . . . . .30

Fig 11. Automatic Q-clock calibration . . . . . . . . . . . . . . .31

Fig 12. Serial signal switch block diagra m. . . . . . . . . . . .33

Fig 13. Crypto1 key handling block diagram . . . . . . . . . .36

Fig 14. Transmitting bit oriented frames . . . . . . . . . . . . .70

Fig 15. Timing for transmitting byte oriented frames . . . .71

Fig 16. Timing for transmitting bit oriented frames. . . . . .71

Fig 17. Card communicati on state diagram. . . . . . . . . . .76

Fig 18. EEPROM programming timing diagram. . . . . . . .78

Fig 19. Separate read/write strobe timing diagram . . . . .87

Fig 20. Common read/write strobe timing diagram . . . . .88

Fig 21. Timing diagram for common read/write strobe;

EPP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89

Fig 22. Application exa mp le circuit diagram: directly

matched antenna. . . . . . . . . . . . . . . . . . . . . . . . .91

Fig 23. TX control signals . . . . . . . . . . . . . . . . . . . . . . . .95

Fig 24. RX control signals . . . . . . . . . . . . . . . . . . . . . . . .96

Fig 25. ISO/IEC 14443 A receiving path Q-clock. . . . . . .98

Fig 26. Package outline SOT287-1 . . . . . . . . . . . . . . . . .9 9

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 108 of 110

continued >>

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

24. Contents

1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2 General description. . . . . . . . . . . . . . . . . . . . . . 1

3 Features and benefits . . . . . . . . . . . . . . . . . . . . 2

3.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

4 Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

5 Quick reference data . . . . . . . . . . . . . . . . . . . . . 3

6 Ordering information. . . . . . . . . . . . . . . . . . . . . 3

7 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 4

8 Pinning information. . . . . . . . . . . . . . . . . . . . . . 5

8.1 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . 5

9 Functional description . . . . . . . . . . . . . . . . . . . 7

9.1 Digital interface. . . . . . . . . . . . . . . . . . . . . . . . . 7

9.1.1 Overview of supported microprocessor

interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

9.1.2 Automatic microprocessor interface

detection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

9.1.3 Connection to different microprocessor

types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

9.1.3.1 Separate read and write strobe . . . . . . . . . . . . 8

9.1.3.2 Common read and write strobe . . . . . . . . . . . . 9

9.1.3.3 Common read and write strobe: EPP with

handshake . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

9.2 Memory organization of the EEPROM . . . . . . 10

9.2.1 Product information field (read only). . . . . . . . 11

9.2.2 Register initialization files (read/write) . . . . . . 11

9.2.2.1 StartUp register initialization file

(read/write) . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

9.2.2.2 Factory default StartUp register

initialization file . . . . . . . . . . . . . . . . . . . . . . . . 12

9.2.2.3 Register initialization file (read/write) . . . . . . . 13

9.2.3 Crypto1 keys (write only) . . . . . . . . . . . . . . . . 13

9.2.3.1 Key format . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

9.2.3.2 Storage of keys in the EEPROM . . . . . . . . . . 14

9.3 FIFO buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

9.3.1 Accessing the FIFO buffer . . . . . . . . . . . . . . . 14

9.3.1.1 Access rules . . . . . . . . . . . . . . . . . . . . . . . . . . 14

9.3.2 Controlling the FIFO buffer. . . . . . . . . . . . . . . 15

9.3.3 FIFO buffer status information . . . . . . . . . . . . 15

9.3.4 FIFO buffer registers and flags. . . . . . . . . . . . 16

9.4 Interrupt request system. . . . . . . . . . . . . . . . . 16

9.4.1 Interrupt sources overview . . . . . . . . . . . . . . . 16

9.4.2 Interrupt request handling. . . . . . . . . . . . . . . . 17

9.4.2.1 Contro lling interrupts and getting their

status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

9.4.2.2 Accessing the interrupt registers . . . . . . . . . . 17

9.4.3 Configuration of pin IRQ. . . . . . . . . . . . . . . . . 18

9.4.4 Register overview interrupt request system. . 18

9.5 Timer unit. . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

9.5.1 Timer unit implementation . . . . . . . . . . . . . . . 19

9.5.1.1 Timer unit block diagram . . . . . . . . . . . . . . . . 19

9.5.1.2 Controlling the timer unit . . . . . . . . . . . . . . . . 20

9.5.1.3 Timer unit clock and period . . . . . . . . . . . . . . 21

9.5.1.4 Timer unit status. . . . . . . . . . . . . . . . . . . . . . . 21

9.5.2 Using the timer unit functions. . . . . . . . . . . . . 22

9.5.2.1 Time-out and WatchDog counters . . . . . . . . . 22

9.5.2.2 Stopwatch . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

9.5.2.3 Programmable one shot timer and

periodic trigger. . . . . . . . . . . . . . . . . . . . . . . . 22

9.5.3 Timer unit registers . . . . . . . . . . . . . . . . . . . . 23

9.6 Power reduction modes. . . . . . . . . . . . . . . . . 23

9.6.1 Hard power-down. . . . . . . . . . . . . . . . . . . . . . 23

9.6.2 Soft power-down mode . . . . . . . . . . . . . . . . . 24

9.6.3 Standby mode . . . . . . . . . . . . . . . . . . . . . . . . 24

9.6.4 Automatic receiver power-down. . . . . . . . . . . 24

9.7 StartUp phase . . . . . . . . . . . . . . . . . . . . . . . . 25

9.7.1 Hard power-down phase . . . . . . . . . . . . . . . . 25

9.7.2 Reset phase. . . . . . . . . . . . . . . . . . . . . . . . . . 25

9.7.3 Initialization phase . . . . . . . . . . . . . . . . . . . . . 25

9.7.4 Initializing the parallel interface type . . . . . . . 25

9.8 Oscillator circuit . . . . . . . . . . . . . . . . . . . . . . . 26

9.9 Tran smitter pins TX1 and TX2. . . . . . . . . . . . 27

9.9.1 Configuring pins TX1 and TX2. . . . . . . . . . . . 27

9.9.2 Antenna operating distance versus power

consumption . . . . . . . . . . . . . . . . . . . . . . . . . . 28

9.9.3 Antenna driver output source resi stance . . . . 28

9.9.3.1 Source resistance ta ble . . . . . . . . . . . . . . . . . 28

9.9.3.2 Ca lculating the relative source resistance . . . 29

9.9.3.3 Ca lculating the effective source resistance . . 29

9.9.4 Pulse width. . . . . . . . . . . . . . . . . . . . . . . . . . . 30

9.10 Receiver circuit . . . . . . . . . . . . . . . . . . . . . . . 30

9.10.1 Receiver circuit block diagram. . . . . . . . . . . . 30

9.10.2 Receiver operation. . . . . . . . . . . . . . . . . . . . . 31

9.10.2.1 Automatic Q-clock calibration . . . . . . . . . . . . 31

9.10.2.2 Amplifier. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

9.10.2.3 C orre l a ti on circuitry . . . . . . . . . . . . . . . . . . . . 32

9.10.2.4 Evaluation and digitizer circuitry . . . . . . . . . . 32

9.11 Serial signal switch . . . . . . . . . . . . . . . . . . . . 33

9.11.1 Serial signal switch block diagram. . . . . . . . . 33

9.11.2 Serial signal switch registers . . . . . . . . . . . . . 34

9.11.2.1 Active antenna concept . . . . . . . . . . . . . . . . . 35

9.11.2.2 Driving both RF parts. . . . . . . . . . . . . . . . . . . 35

9.12 MIFARE authentication and Crypto1 . . . . . . . 35

9.12.1 Crypto1 key handling. . . . . . . . . . . . . . . . . . . 36

9.12.2 Au thentication procedure. . . . . . . . . . . . . . . . 36

Product data sheet

PUBLIC Rev. 3.3 — 15 March 2010

048033 109 of 110

continued >>

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

10 MFRC500 registers . . . . . . . . . . . . . . . . . . . . . 37

10.1 Register addressing modes . . . . . . . . . . . . . . 37

10.1.1 Page registers . . . . . . . . . . . . . . . . . . . . . . . . 37

10.1.2 Dedicated address bus. . . . . . . . . . . . . . . . . . 37

10.1.3 Multiplexed address bus. . . . . . . . . . . . . . . . . 37

10.2 Register bit behavior. . . . . . . . . . . . . . . . . . . . 38

10.3 Register overview. . . . . . . . . . . . . . . . . . . . . . 39

10.4 MFRC500 register flags overview. . . . . . . . . . 41

10.5 Register descriptions . . . . . . . . . . . . . . . . . . . 43

10.5.1 Page 0: Command and status . . . . . . . . . . . . 43

10.5.1.1 Page register . . . . . . . . . . . . . . . . . . . . . . . . . 43

10.5.1.2 Command register . . . . . . . . . . . . . . . . . . . . . 44

10.5.1.3 FIFOData register. . . . . . . . . . . . . . . . . . . . . . 44

10.5.1.4 PrimarySta tus register . . . . . . . . . . . . . . . . . . 45

10.5.1.5 FIFOLength register . . . . . . . . . . . . . . . . . . . . 46

10.5.1.6 SecondaryStatus register . . . . . . . . . . . . . . . . 46

10.5.1.7 InterruptEn register. . . . . . . . . . . . . . . . . . . . . 47

10.5.1.8 Int erruptRq register. . . . . . . . . . . . . . . . . . . . . 47

10.5.2 Page 1: Control and status. . . . . . . . . . . . . . . 48

10.5.2.1 Page register . . . . . . . . . . . . . . . . . . . . . . . . . 48

10.5.2.2 Control register. . . . . . . . . . . . . . . . . . . . . . . . 48

10.5.2.3 ErrorFlag register . . . . . . . . . . . . . . . . . . . . . . 49

10.5.2.4 CollPos register . . . . . . . . . . . . . . . . . . . . . . . 50

10.5.2.5 TimerValue register. . . . . . . . . . . . . . . . . . . . . 5 0

10.5.2.6 CRCResultLSB register . . . . . . . . . . . . . . . . . 50

10.5.2.7 CRCResultMSB register. . . . . . . . . . . . . . . . . 51

10.5.2.8 BitFraming register . . . . . . . . . . . . . . . . . . . . . 51

10.5.3 Page 2: Transmitter and control . . . . . . . . . . . 52

10.5.3.1 Page register . . . . . . . . . . . . . . . . . . . . . . . . . 52

10.5.3.2 TxControl register. . . . . . . . . . . . . . . . . . . . . . 52

10.5.3.3 CwConductance register . . . . . . . . . . . . . . . . 53

10.5.3.4 PreSet13 register . . . . . . . . . . . . . . . . . . . . . . 53

10.5.3.5 PreSet14 register . . . . . . . . . . . . . . . . . . . . . . 53

10.5.3.6 ModWidth register. . . . . . . . . . . . . . . . . . . . . . 54

10.5.3.7 PreSet16 register . . . . . . . . . . . . . . . . . . . . . . 54

10.5.3.8 PreSet17 register . . . . . . . . . . . . . . . . . . . . . . 54

10.5.4 Page 3: Receiver and decoder control . . . . . . 55

10.5.4.1 Page register . . . . . . . . . . . . . . . . . . . . . . . . . 55

10.5.4.2 RxControl1 register. . . . . . . . . . . . . . . . . . . . . 55

10.5.4.3 DecoderControl register . . . . . . . . . . . . . . . . . 55

10.5.4.4 BitPhase register . . . . . . . . . . . . . . . . . . . . . . 56

10.5.4.5 RxThreshold register . . . . . . . . . . . . . . . . . . . 56

10.5.4.6 PreSet1D Register . . . . . . . . . . . . . . . . . . . . . 56

10.5.4.7 RxControl2 register. . . . . . . . . . . . . . . . . . . . . 57

10.5.4.8 ClockQControl register . . . . . . . . . . . . . . . . . . 57

10.5.5 Page 4: RF T iming and channel

redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . 58

10.5.5.1 Page register . . . . . . . . . . . . . . . . . . . . . . . . . 58

10.5.5.2 RxWait register. . . . . . . . . . . . . . . . . . . . . . . . 58

10.5.5.3 ChannelRed undancy register. . . . . . . . . . . . . 58

10.5.5.4 CRCPresetLSB register . . . . . . . . . . . . . . . . . 59

10.5.5.5 CRCPresetMSB register . . . . . . . . . . . . . . . . 59

10.5.5.6 PreSet25 register. . . . . . . . . . . . . . . . . . . . . . 59

10.5.5.7 MFOUTSelect register. . . . . . . . . . . . . . . . . . 60

10.5.5.8 PreSet27 register. . . . . . . . . . . . . . . . . . . . . . 60

10.5.6 Page 5: FIFO, timer and IRQ pin

configuration . . . . . . . . . . . . . . . . . . . . . . . . . 61

10.5.6.1 Page register . . . . . . . . . . . . . . . . . . . . . . . . . 61

10.5.6.2 FIFOLevel register. . . . . . . . . . . . . . . . . . . . . 61

10.5.6.3 TimerClock register . . . . . . . . . . . . . . . . . . . . 61

10.5.6.4 TimerControl register . . . . . . . . . . . . . . . . . . . 62

10.5.6.5 TimerReload register . . . . . . . . . . . . . . . . . . . 62

10.5.6.6 IRQPinConfig register . . . . . . . . . . . . . . . . . . 63

10.5.6.7 PreSet2E register. . . . . . . . . . . . . . . . . . . . . . 63

10.5.6.8 PreSet2F register. . . . . . . . . . . . . . . . . . . . . . 63

10.5.7 Page 6: reserved . . . . . . . . . . . . . . . . . . . . . . 63

10.5.7.1 Page register . . . . . . . . . . . . . . . . . . . . . . . . . 63

10.5.7.2 Reserved registers 31h, 32h, 33h, 34h,

35h, 36h and 37h. . . . . . . . . . . . . . . . . . . . . . 63

10.5.8 Page 7: Test control. . . . . . . . . . . . . . . . . . . . 64

10.5.8.1 Page register . . . . . . . . . . . . . . . . . . . . . . . . . 64

10.5.8.2 Reserved register 39h . . . . . . . . . . . . . . . . . . 64

10.5.8.3 TestAnaSelect register. . . . . . . . . . . . . . . . . . 64

10.5.8.4 Reserved register 3Bh. . . . . . . . . . . . . . . . . . 65

10.5.8.5 Reserved register 3Ch. . . . . . . . . . . . . . . . . . 65

10.5.8.6 TestDigiSelect register. . . . . . . . . . . . . . . . . . 65

10.5.8.7 Reserved registers 3Eh, 3Fh. . . . . . . . . . . . . 66

11 MFRC500 command set . . . . . . . . . . . . . . . . . 66

11.1 MFRC500 command overview. . . . . . . . . . . . 66

11.1.1 Basic states . . . . . . . . . . . . . . . . . . . . . . . . . . 68

11.1.2 StartUp command 3Fh. . . . . . . . . . . . . . . . . . 68

11.1.3 Idle command 00h . . . . . . . . . . . . . . . . . . . . . 68

11.2 Commands for card communication . . . . . . . 69

11.2.1 Transmit command 1Ah. . . . . . . . . . . . . . . . . 69

11.2.1.1 Using the Transmit command . . . . . . . . . . . . 69

11.2.1.2 RF channel redundancy and fra mi ng. . . . . . . 70

11.2.1.3 Tr ansmission of bit oriented frames. . . . . . . . 70

11.2.1.4 Transmission of frames with more than

64 bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

11.2.2 Receive command 16h . . . . . . . . . . . . . . . . . 72

11.2.2.1 Using the Receive command. . . . . . . . . . . . . 72

11.2.2.2 RF channel redundancy and fra mi ng. . . . . . . 73

11.2.2.3 Collision detection . . . . . . . . . . . . . . . . . . . . . 73

11.2.2.4 Receiving bit oriented frames . . . . . . . . . . . . 74

11.2.2.5 Communication errors . . . . . . . . . . . . . . . . . . 74

11.2.3 Transceive command 1Eh . . . . . . . . . . . . . . . 75

11.2.4 Card communication states . . . . . . . . . . . . . . 75

11.2.5 Card communication state diagram . . . . . . . . 76

11.3 EEPROM commands. . . . . . . . . . . . . . . . . . . 77

11.3.1 WriteE2 command 01h . . . . . . . . . . . . . . . . . 77

11.3.1.1 Programming process . . . . . . . . . . . . . . . . . . 77

NXP Semiconductors MFRC500

Highly Integrated ISO/IEC 14443 A Reader IC

For more information, please visit: http://www.nxp.com

For sales office addresses, please send an email to: salesaddresses@nxp.com

Date of release: 15 March 2010

048033

Please be aware that important notices concerning this document and the product(s)

described herein, have been included in section ‘Legal information’.

11.3.1.2 Timing diagram. . . . . . . . . . . . . . . . . . . . . . . . 78

11.3.1.3 WriteE2 command error flags. . . . . . . . . . . . . 78

11.3.2 ReadE2 command 03h. . . . . . . . . . . . . . . . . . 79

11.3.2.1 ReadE2 command error flags. . . . . . . . . . . . . 79

11.4 Diverse commands. . . . . . . . . . . . . . . . . . . . . 79

11.4.1 LoadConfig command 07h . . . . . . . . . . . . . . . 79

11.4.1.1 Register assignment. . . . . . . . . . . . . . . . . . . . 79

11.4.1.2 Relevant LoadConfig command error flags . . 80

11.4.2 CalcCRC command 12h. . . . . . . . . . . . . . . . . 80

11.4.2.1 CRC coprocessor settings . . . . . . . . . . . . . . . 80

11.4.2.2 CRC coprocessor status flags . . . . . . . . . . . . 80

11.5 Error handling during command execution. . . 81

11.6 MIFARE security commands . . . . . . . . . . . . . 81

11.6.1 LoadKeyE2 command 0Bh. . . . . . . . . . . . . . . 81

11.6.1.1 Relevant LoadKeyE2 command error flags . . 81

11.6.2 LoadKey command 19h . . . . . . . . . . . . . . . . . 81

11.6.2.1 Relevant LoadKey command error flags . . . . 82

11.6.3 Authent1 command 0Ch. . . . . . . . . . . . . . . . . 82

11.6.4 Authent2 command 14h . . . . . . . . . . . . . . . . . 82

11.6.4.1 Authent2 command effects. . . . . . . . . . . . . . . 83

12 Limiting values. . . . . . . . . . . . . . . . . . . . . . . . . 83

13 Characteristics. . . . . . . . . . . . . . . . . . . . . . . . . 83

13.1 Operating condition range . . . . . . . . . . . . . . . 83

13.2 Current consumption . . . . . . . . . . . . . . . . . . . 84

13.3 Pin characteristics . . . . . . . . . . . . . . . . . . . . . 84

13.3.1 Input pin characteristics . . . . . . . . . . . . . . . . . 84

13.3.2 Digital output pin characteristics. . . . . . . . . . . 85

13.3.3 Antenna driver output pin characteristics . . . . 86

13.4 AC electrical characteristics . . . . . . . . . . . . . . 86

13.4.1 Separate read/write strobe bus timing . . . . . . 86

13.4.2 Common read/write strobe bus timing . . . . . . 87

13.4.3 EPP bus timing. . . . . . . . . . . . . . . . . . . . . . . . 88

13.4.4 Clock frequency . . . . . . . . . . . . . . . . . . . . . . . 90

14 EEPROM characteristics. . . . . . . . . . . . . . . . . 90

15 Application information. . . . . . . . . . . . . . . . . . 91

15.1 Typical application . . . . . . . . . . . . . . . . . . . . . 91

15.1.1 Circuit diagram . . . . . . . . . . . . . . . . . . . . . . . . 91

15.1.2 Circuit description. . . . . . . . . . . . . . . . . . . . . . 91

15.1.2.1 EMC low-pass filter. . . . . . . . . . . . . . . . . . . . . 91

15.1.2.2 Antenna matching. . . . . . . . . . . . . . . . . . . . . . 92

15.1.2.3 Receiver circuit. . . . . . . . . . . . . . . . . . . . . . . . 92

15.1.2.4 Antenna coil . . . . . . . . . . . . . . . . . . . . . . . . . . 93

15.2 Test signals. . . . . . . . . . . . . . . . . . . . . . . . . . . 93

15.2.1 Measurements using the serial signal

switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

15.2.1.1 TX control. . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

15.2.1.2 RX control. . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

15.2.2 Analog test signals . . . . . . . . . . . . . . . . . . . . . 96

15.2.3 Digital test signals. . . . . . . . . . . . . . . . . . . . . . 97

15.2.4 Analog and digital test signal Examples. . . . . 97

16 Package outline. . . . . . . . . . . . . . . . . . . . . . . . 99

17 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . 100

18 References. . . . . . . . . . . . . . . . . . . . . . . . . . . 100

19 Revision history . . . . . . . . . . . . . . . . . . . . . . 101

20 Legal information . . . . . . . . . . . . . . . . . . . . . 102

20.1 Data sheet status. . . . . . . . . . . . . . . . . . . . . 102

20.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . 102

20.3 Disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . 102

20.4 Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . 103

21 Contact information . . . . . . . . . . . . . . . . . . . 103

22 Tables. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

23 Figures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

24 Contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108