M24SR04-Y M24SR04-G Dynamic NFC/RFID tag IC with 4-Kbit EEPROM, NFC Forum Type 4 Tag and IC interface Datasheet - production data * 7 bytes unique identifier (UID) * 128 bits passwords protection Package SO8 (MN) TSSOP8 (DW) UFDFPN8 (MC) * 8-lead small-outline package (SO8) ECOPACK2(R) * TSSOP8 ECOPACK2(R) * UFDFPN8 ECOPACK2(R) Digital pad * GPO: configurable General Purpose Output Wafer * RF disable: activation/deactivation of RF commands Features Temperature range I2C interface * From - 40 C up to 85 C * Two-wire I2C serial interface supports 1 MHz protocol Description * Single supply voltage: - 2.7 V to 5.5 V for grade Y - 2.4 V to 5.5 V for grade G (Limited temperature range -25 to 85 C) M24SR04 belongs to the ST25 family which includes all STMicroelectronics NFC/RFID tag and reader products. The M24SR04 devices is a dynamic NFC/RFID tag IC with a dual interface. It embeds an EEPROM memory. It can be operated from an I2C interface or by a 13.56 MHz RFID reader or an NFC phone. Contactless interface * NFC Forum Type 4 Tag * ISO/IEC 14443 Type A * 106 Kbps data rate The I2C interface uses a two-wire serial interface, consisting of a bidirectional data line and a clock line. It behaves as a slave in the I2C protocol. * Internal tuning capacitance: 25 pF Memory The RF protocol is compatible with ISO/IEC 14443 Type A and NFC Forum Type 4 Tag. * 512-byte (4-kbit) EEPROM * Support of NDEF data structure * Data retention: 200 years * Write cycle endurance: - 1 million Write cycles at 25 C - 600k Write cycles at 85 C * Read up to 246 bytes in a single command * Write up to 246 bytes in a single command September 2017 This is information on a product in full production. DocID024754 Rev 16 1/89 www.st.com Contents M24SR04-Y M24SR04-G Contents 1 Functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.1 2 Functional modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.1.1 I2C mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.1.2 Tag mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.1.3 Dual interface mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Signal descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.1 Serial clock (SCL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.2 Serial data (SDA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.3 Antenna coil (AC0, AC1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.4 Ground (VSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.5 Supply voltage (VCC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.5.1 3 2.5.3 Device reset in IC mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.5.4 Power-down conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.6 RF disable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.7 General purpose output (GPO) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.7.1 Session Open configuration (GPO field = 0xX1 or 0x1X) . . . . . . . . . . . 14 2.7.2 WIP Writing in Progress configuration (GPO field = 0xX2 or 0x2X) . . . 15 2.7.3 I2C answer ready configuration (GPO field = 0xX3) . . . . . . . . . . . . . . . 16 2.7.4 MIP NDEF Message writing in Progress configuration (GPO field = 0x3X) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2.7.5 INT Interrupt configuration (GPO field = 0xX4 or 0x4X) . . . . . . . . . . . . 18 2.7.6 State Control configuration (GPO field = 0xX5 or 0x5X) . . . . . . . . . . . . 19 2.7.7 RF busy configuration (GPO field = 0x6X) . . . . . . . . . . . . . . . . . . . . . . . 20 M24SR04 memory management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.1 3.2 2/89 2.5.2 Operating supply voltage VCC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Power-up conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Memory structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.1.1 File identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.1.2 CC file layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 3.1.3 NDEF file layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 3.1.4 System file layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Read and write access rights to the memory . . . . . . . . . . . . . . . . . . . . . . 25 DocID024754 Rev 16 M24SR04-Y M24SR04-G Contents 3.2.1 State of the Read and Write access rights . . . . . . . . . . . . . . . . . . . . . . . 25 3.2.2 Changing the read access right to NDEF files . . . . . . . . . . . . . . . . . . . . 26 3.2.3 Changing the write access right to NDEF files . . . . . . . . . . . . . . . . . . . 27 3.3 Access right life time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.4 NDEF file passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.5 I2C password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 3.5.1 4 5 IC password and IC protect field of the System file . . . . . . . . . . . . . . . 28 Communication mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 4.1 Master and slave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 4.2 M24SR04 session mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 4.2.1 RF token . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 4.2.2 I2C token . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 IC and RF command sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.1 Structure of the command sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 5.2 I-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 5.2.1 C-APDU: payload format of a command . . . . . . . . . . . . . . . . . . . . . . . . 32 5.2.2 R-APDU: payload format of a response . . . . . . . . . . . . . . . . . . . . . . . . 33 5.3 R-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 5.4 S-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 5.5 CRC of the I2C and RF frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 5.6 NFC Forum Type 4 Tag protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 5.7 5.6.1 Commands set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 5.6.2 Status and error codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 5.6.3 NDEF Tag Application Select command . . . . . . . . . . . . . . . . . . . . . . . . 38 5.6.4 Capability Container Select command . . . . . . . . . . . . . . . . . . . . . . . . . . 38 5.6.5 NDEF Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 5.6.6 System File Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 5.6.7 ReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 5.6.8 UpdateBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 ISO/IEC 7816-4 commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 5.7.1 Verify command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 5.7.2 Change Reference Data command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 5.7.3 Enable Verification Requirement command . . . . . . . . . . . . . . . . . . . . . . 45 5.7.4 Disable Verification Requirement command . . . . . . . . . . . . . . . . . . . . . 46 DocID024754 Rev 16 3/89 5 Contents M24SR04-Y M24SR04-G 5.8 5.9 5.10 6 7 ST Proprietary command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 5.8.1 ExtendedReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 5.8.2 EnablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 5.8.3 DisablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 5.8.4 UpdateFileType command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 5.8.5 SendInterrupt command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 5.8.6 StateControl command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Specific RF command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 5.9.1 Anticollision command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 5.9.2 RATS command and ATS response . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 5.9.3 PPS command & response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Specific IC command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 5.10.1 GetI2Csession command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 5.10.2 KillRFsession command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 RF device operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 6.1 Anticollision and Device Activation command set for the RF interface . . 56 6.2 Open an RFsession . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 6.3 Close an RFsession . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 6.4 Applicative command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 I2C device operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 7.1 I2C communication protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 7.2 Start condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 7.3 Stop condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 7.4 IC token release sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 7.5 IC timeout on clock period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 7.6 Acknowledge bit (ACK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 7.7 Data input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 7.8 IC device address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 7.9 IC frame format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 7.9.1 4/89 Example of IC frame commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 7.10 Open an IC session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 7.11 Close the IC session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 DocID024754 Rev 16 M24SR04-Y M24SR04-G 8 Contents Functional procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 8.1 Selection of an NDEF message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 8.2 Reading of an NDEF message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 8.3 Reading a locked NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 8.4 Locking an NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 8.5 Unlocking an NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 8.6 Reaching the read-only state for an NDEF file . . . . . . . . . . . . . . . . . . . . . 64 8.7 Changing an NDEF password procedure . . . . . . . . . . . . . . . . . . . . . . . . . 64 8.8 Changing a File type Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 8.9 Updating a NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 9 UID: Unique identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 10 Maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 11 I2C DC and AC parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 11.1 I2C timing measurement condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 12 GPO parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 13 Write cycle definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 14 RF electrical parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 15 Package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 15.1 SO8N package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 15.2 TSSOP8 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 15.3 UFDFPN8 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 16 Ordering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 17 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 DocID024754 Rev 16 5/89 5 List of tables M24SR04-Y M24SR04-G List of tables Table 1. Table 2. Table 3. Table 4. Table 5. Table 6. Table 7. Table 8. Table 9. Table 10. Table 11. Table 12. Table 13. Table 14. Table 15. Table 16. Table 17. Table 18. Table 19. Table 20. Table 21. Table 22. Table 23. Table 24. Table 25. Table 26. Table 27. Table 28. Table 29. Table 30. Table 31. Table 32. Table 33. Table 34. Table 35. Table 36. Table 37. Table 38. Table 39. Table 40. Table 41. Table 42. Table 43. Table 44. Table 45. Table 46. Table 47. Table 48. 6/89 Signal names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Functional mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 File identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 CC file layout for 1 NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 NDEF file layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Field list. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Details about I2C watchdog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Details about the GPO field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Details about the RF Session field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Details about the ST reserved field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Details about the RF enable field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Read access right . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Write access right . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 RF and IC command sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 I-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 PCB field of the I-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 C-APDU format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 R-APDU format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 R-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 R-Block detailed format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 S-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 S-Block detailed format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Command set overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Status code of the M24SR04 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Error code of the M24SR04 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 C-APDU of the NDEF Tag Application Select command . . . . . . . . . . . . . . . . . . . . . . . . . . 38 R-APDU of the NDEF Tag Application Select command . . . . . . . . . . . . . . . . . . . . . . . . . . 38 C-APDU of the Capability Container Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 R-APDU of the Capability Container Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 C-APDU of the NDEF Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 R-APDU of the NDEF Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 C-APDU of the System File Select command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 R-APDU of the System File Select command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 C-APDU of the ReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 R-APDU of the ReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 C-APDU of the UpdateBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 R-APDU of the UpdateBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Verify command format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 R-APDU of the Verify command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Change reference data command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 R-APDU of the Change Reference Data command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Enable Verification Requirement command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 R-APDU of the Enable Verification Requirement command. . . . . . . . . . . . . . . . . . . . . . . . 46 Disable Verification Requirement command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 R-APDU of the Disable Verification Requirement command . . . . . . . . . . . . . . . . . . . . . . . 47 C-APDU of the ExtendedReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 R-APDU of the ExtendedReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 EnablePermanentState command format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 DocID024754 Rev 16 M24SR04-Y M24SR04-G Table 49. Table 50. Table 51. Table 52. Table 53. Table 54. Table 55. Table 56. Table 57. Table 58. Table 59. Table 60. Table 61. Table 62. Table 63. Table 64. Table 65. Table 66. Table 67. Table 68. Table 69. Table 70. Table 71. Table 72. Table 73. Table 74. Table 75. Table 76. Table 77. Table 78. Table 79. Table 80. Table 81. Table 82. Table 83. Table 84. Table 85. Table 86. Table 87. Table 88. Table 89. List of tables R-APDU table of the EnablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . 48 DisablePermanentState command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 R-APDU of the DisablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 UpdateFileType command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 R-APDU of the UpdateFileType command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 SendInterrupt command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 R-APDU of the SendInterrupt command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 StateControl command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 R-APDU of the StateControl command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Commands issues by the RF host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 RATS command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Conversion from FDSI to FSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 ATS response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 PPS command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Ascending and descending data rate coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 PPS response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Specific IC commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 GetI2Csession command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 KillRFsession command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 I2C device address format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 I2C frame format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 I2C host to M24SR04 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 M24SR04 to I2C host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 UID format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 I2C operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 AC test measurement conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Input parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 I2C DC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 I2C AC characteristics (400 kHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 I2C AC characteristics (1 MHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Device select code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 GPO timings measurement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 Write cycle definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Default operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 RF characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 SO8N - 8-lead plastic small outline, 150 mils body width, package data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 TSSOP8 - 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch, package mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 UFDFPN8 - 8- lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Ordering information scheme for packaged devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 DocID024754 Rev 16 7/89 7 List of figures M24SR04-Y M24SR04-G List of figures Figure 1. Figure 2. Figure 3. Figure 4. Figure 5. Figure 6. Figure 7. Figure 8. Figure 9. Figure 10. Figure 11. Figure 12. Figure 13. Figure 14. Figure 15. Figure 16. Figure 17. Figure 18. Figure 19. Figure 20. Figure 21. Figure 22. Figure 23. 8/89 M24SR04 block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 8-pin package connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 GPO configured as Session Open (GPO field = 0xX1 or 0x1X) . . . . . . . . . . . . . . . . . . . . . 14 GPO configured as WIP (GPO field = 0xX2 or 0x2X). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 GPO configured as I2C answer ready (GPO field = 0xX3) . . . . . . . . . . . . . . . . . . . . . . . . . 16 GPO configured as MIP (GPO field = 0x3X). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 GPO configured as INT (GPO field = 0xX4 or 0x4X) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 GPO configured as State Control (GPO field = 0xX5 or 0x5X). . . . . . . . . . . . . . . . . . . . . . 19 GPO configured as RF busy (GPO field = 0x6X) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Changing the read access right to an NDEF file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Changing the write access right to an NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Command and response exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 IC token release sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 NDEF tag Application Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 AC test measurement I/O waveform. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 I2C AC waveforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Maximum Rbus value with fC = 400 kHz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Maximum Rbus value with fC = 1 MHz. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 I2C bus protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 SO8N - 8-lead plastic small outline, 150 mils body width, package outline . . . . . . . . . . . . 79 SO8N - 8-lead plastic small outline, 150 mils bosy width, package recommended footprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 TSSOP8 - 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch, package outline. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 UFDFPN8 - 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 DocID024754 Rev 16 M24SR04-Y M24SR04-G 1 Functional description Functional description The M24SR04 device is a dynamic NFC/RFID tag that can be accessed either from the I2C or the RF interface. The RF and I2C host can read or write to the same memory, that is why only one host can communicate at a time with the M24SR04. The management of the interface selection is controlled by the M24SR04 device itself. The RF interface is based on the ISO/IEC 14443 Type A standard. The M24SR04 is compatible with the NFC Forum Type 4 Tag specifications and supports all corresponding commands. The I2C interface uses a two-wire serial interface consisting of a bidirectional data line and a clock line. The devices carry a built-in 4-bit device type identifier code in accordance with the IC bus definition. The device behaves as a slave in the I2C protocol. Figure 1 displays the block diagram of the M24SR04 device. Figure 1. M24SR04 block diagram 6XSSO\YROWDJH IRU,&LQWHUIDFH 5)LQWHUIDFH EDVHGRQ ,62,(& 7\SH$ VWDQGDUG 9&& $& $QDORJ)URQWHQG EDVHGRQ ,62,(& 7\SH$VWDQGDUG $& ,QWHUQDOWXQLQJ FDSDFLWDQFH 5) GLVDEOH 1)&)RUXP 7\SH7DJ SURWRFRO 6&/ 6'$ h/ hZ 'LJLWDOXQLW *32 ,&LQWHUIDFH 99 3RZHU PDQDJHPHQW XQLW 1)&B,& LQWHUIDFH *1' 069 DocID024754 Rev 16 9/89 20 Functional description M24SR04-Y M24SR04-G Table 1. Signal names Signal name Function Direction SDA Serial data I/O SCL Serial clock Input AC0, AC1 Antenna coils - VCC Supply voltage - VSS Ground GPO - Interrupt output RF disable (1) Open drain output Disable the RF communication (2) Input 1. An external pull-up > 4.7 k is required. 2. An external pull-down is required when the voltage on Vcc is above its POR level. Figure 2. 8-pin package connections 5)GLVDEOH 9&& $& *32 $& 6&/ 966 6'$ 069 1. See Package mechanical data section for package dimensions, and how to identify pin 1. 1.1 Functional modes The M24SR04 has two functional modes available. The difference between the modes lies in the power supply source (see Table 2). Table 2. Functional mode Mode 1.1.1 Supply source Comments I2C mode Vcc The I2C interface is available Tag mode RF field only The 2C interface is disconnected Dual interface mode RF field or Vcc Both I2C and RF interfaces are available I2C mode M24SR04 is powered by VCC. The I2C interface is connected to the M24SR04. The I2C host can communicate with the M24SR04 device. 1.1.2 Tag mode The M24SR04 is supplied by the RF field and can communicate with an RF host (RFID reader or an NFC phone). The User memory can only be accessed by the RF commands. 10/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 1.1.3 Functional description Dual interface mode Both interfaces, RF and I2C, are connected to the M24SR04 and both RF or I2C host can communicate with the M24SR04 device. The power supply and the access management are carried out by the M24SR04 itself. For further details, please refer to the token mechanism chapter. DocID024754 Rev 16 11/89 20 Signal descriptions M24SR04-Y M24SR04-G 2 Signal descriptions 2.1 Serial clock (SCL) This input signal is used to strobe all data in and out of the device. In applications where this signal is used by slave devices to synchronize the bus to a slower clock, the bus master must have an open drain output, and a pull-up resistor must be connected from Serial clock (SCL) to VCC. (Figure 17 indicates how the value of the pull-up resistor can be calculated). In most applications, though, this method of synchronization is not employed, and so the pull-up resistor is not necessary, provided that the bus master has a push-pull (rather than open drain) output. 2.2 Serial data (SDA) This bidirectional signal is used to transfer data in or out of the device. It is an open drain output that may be wire-OR'ed with other open drain or open collector signals on the bus. A pull-up resistor must be connected from Serial data (SDA) to VCC. (Figure 17 indicates how the value of the pull-up resistor can be calculated). 2.3 Antenna coil (AC0, AC1) These inputs are used to connect the device to an external coil exclusively. It is advised not to connect any other DC or AC path to AC0 or AC1. When correctly tuned, the coil is used to access the device using NFC Forum Type 4 commands. 2.4 Ground (VSS) VSS, when connected, is the reference for the VCC supply voltage for all pads, even AC0 and AC1. 2.5 Supply voltage (VCC) This pin can be connected to an external DC supply voltage. Note: An internal voltage regulator allows the external voltage applied on VCC to supply the M24SR04. 2.5.1 Operating supply voltage VCC Prior to selecting the M24SR04 and issuing instructions to it, a valid and stable VCC voltage within the specified [VCC(min), VCC(max)] range must be applied. To maintain a stable DC supply voltage, it is recommended to decouple the VCC line with suitable capacitors (usually of the order of 10 nF and 100 pF) close to the VCC/VSS package pins. This voltage must remain stable and valid until the end of the transmission of the instruction and, for a writing instruction (UpdateBinary, ChangeReferenceData, 12/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G Signal descriptions EnableVerificationRequirement, DisableVerificationRequirement, EnablePermanentState, DisablePermanentState, until the completion of the internal IC write cycle (tW). 2.5.2 Power-up conditions When the power supply is turned on, VCC rises from VSS to VCC. The VCC rise time must not vary faster than 1V/s. 2.5.3 Device reset in IC mode In order to prevent inadvertent write operations during power-up, a power-on reset (POR) circuit is included. At power-up (continuous rise of VCC), the M24SR04 does not respond to any IC instruction until VCC has reached the power-on reset threshold voltage (this threshold is lower than the minimum VCC operating voltage defined). When VCC passes over the POR threshold, the device is reset and enters the Standby power mode. However, the device must not be accessed until VCC has reached a valid and stable VCC voltage within the specified [VCC(min), VCC(max)] range. In a similar way, during power-down (continuous decrease in VCC), as soon as VCC drops below the power-on reset threshold voltage, the M24SR04 stops responding to any instruction sent to it. 2.5.4 Power-down conditions During power-down (continuous decay of VCC), the M24SR04 must be in Standby power mode (mode reached after decoding a Stop condition, assuming that there is no internal operation in progress). 2.6 RF disable This input signal is used to disable the RF communication. When the voltage on the VCC pin is below the POR level or not connected, an internal pull-down resistor is connected on this pad. Thus, the RF disable pad is maintained to the low level and the RF analog front end is activated. When the voltage on the VCC pin is higher than the POR level, the IC host shall set this pin to enable or disable the RF communication. In Dual interface mode, RF disable must not be left floating. 2.7 General purpose output (GPO) The GPO pad is an open drain pad and a external pull-up resistor shall be connected to it. This pad is a configurable output signal. On delivery, GPO is configured as Session opened. Its behavior is consistent with the I2C or RF session activated and with the mode chosen by the user. The GPO pad is enable when an RF or an I2C session is open. When neither an RF nor an I2C session is open, the GPO is high impedance. DocID024754 Rev 16 13/89 20 Signal descriptions M24SR04-Y M24SR04-G The user can select one of these configurations(1): 2.7.1 * SessionOpen: an RF or I2C session is ongoing. * MIP (NDEF Message updating In Progress): the RF host is writing an NDEF length different from 0x0000. This mode can be used to detect when the RF host changes the NDEF message as defined by the NFC Forum. * WIP (Writing In Progress): the M24SR04 is executing a writing operation. * INT (interrupt): the I2C or RF host can force the M24SR04 to send a negative pulse on the GPO pin. * I2C ready response: an I2C response is ready to be read by the IC host. * State mode: the I2C or RF host can control the state of the GPO pad during the RF session. * RF busy: an RF host is communicating with the M24SR04. Session Open configuration (GPO field = 0xX1 or 0x1X) When the GPO is configured as "Session Open", it goes to the Low state when an RF or I2C session is ongoing (see Figure 3). An RF session is taken when M24SR04 receives a valid Select Application. The session is released after M24SR04 has received a valid Deselect command, if M24SR04 has received a Kill RF session command in I2C or when the RF field became OFF. An I2C session is taken when M24SR04 receives a valid Get session command or a valid Kill RF session command. The session is released after M24SR04 has received I2C token release sequence or after a Power Off. GPO is driven low after a delay (1) or (3) when the session is open. GPO is released after a delay (2) or (4) when the session is released. Z&^Z 'WK^ZK <ZZ 'Z ^Z ZZ E& Figure 3. GPO configured as Session Open (GPO field = 0xX1 or 0x1X) Z& ^Z /^Z D^s 1. CmdEOFtoGPlow (RF command End of frame to GPORF Session pad low) 2. CmdEOFtoGPHZ (RF command End of frame to GPORF Session pad HZ) 3. CmdSTPtoGPlow (I2C command stop to GPO low) 4. AnswerlbLBtoGPHZ (I2C answer last bit of last byte to GPO HZ) 1. See Table 81 for more details. 14/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 2.7.2 Signal descriptions WIP Writing in Progress configuration (GPO field = 0xX2 or 0x2X) When the GPO is configured as "WIP", it goes to the Low state during an I2C or RF writing operation. During an RF or I2C session, when M24SR04 updates a file, GPO is driven low after a delay (1) or (3) following the beginning of the correspondent UpdateBinary command execution. GPO will remain low during the writing time (2) or (4), before being released. Figure 4. GPO configured as WIP (GPO field = 0xX2 or 0x2X) Z&Z/ Z h Z Z ZZ Z Z 'WKt/W Z D^s 1. CmdSTPtoGPlow (I2C Command Stop to GPO low) 2. Writing time duration 3. CmdEOFtoGPlow (RF Command End of frame to GPO low) 4. Writing time duration DocID024754 Rev 16 15/89 20 Signal descriptions 2.7.3 M24SR04-Y M24SR04-G I2C answer ready configuration (GPO field = 0xX3) When the GPO is configured as I2C answer ready, it goes to the Low state when the M24SR04 has finished to treat the I2C command and is ready to send the I2C response. During an I2C session, after receiving a valid I2C command, GPO pin is driven low after a delay when M24SR04 is ready to deliver a response on the I2C bus. GPO is released when M24SR04 receives a new command. Figure 5. GPO configured as I2C answer ready (GPO field = 0xX3) / K ^Z / Z D^Z Z / Z D^Z Z / Z D^Z Z 'WK/ D^s 16/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 2.7.4 Signal descriptions MIP NDEF Message writing in Progress configuration (GPO field = 0x3X) When the GPO is configured as MIP, its state goes to the low state when the RF host writes the NDEF length to another value than 0x0000. During an RF session, when M24SR04 changes an NDEF file and updates the NDEF length with a value different from 0x0000, GPO is driven low after a delay (1) following the beginning of the correspondent UpdateBinary command execution. GPO will remain low during the writing time (2), before being released. Figure 6. GPO configured as MIP (GPO field = 0x3X) Z& hE& D^Z Z Z Z 'WKD/W D^s 1. CmdEOFtoGPlow (RF command End of frame to GPO low) 2. Writing time duration DocID024754 Rev 16 17/89 20 Signal descriptions 2.7.5 M24SR04-Y M24SR04-G INT Interrupt configuration (GPO field = 0xX4 or 0x4X) The I2C or RF host can send a negative pulse on the GPO pad. The GPO pad goes to the low state at the end of the command and goes to the high state at the end of the M24SR04 response. During an RF or I2C session, when M24SR04 receives a valid Interrupt command, M24SR04 GPO pin is driven low after (1) or (3) for a duration of (4) in RF, or after responding in I2C (2). Then GPO pin is released. Figure 7. GPO configured as INT (GPO field = 0xX4 or 0x4X) Z&Z/ Z D^Z Z ^ / Z ZZ 'WK/Ed D^s 1. CmdSTPtoGPlow (I2C command Stop to GPO low) 2. After NewCmdlbFB (new I2C command last bit of first byte) or after AnswerlbFB (I2C answer last bit of first byte) 3. CmdEOFtoGPlow (RF command End of frame to GPO low) 4. GPO pulse duration 18/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 2.7.6 Signal descriptions State Control configuration (GPO field = 0xX5 or 0x5X) When the GPO is configured as State Control, the I2C or RF host can control the state of the GPO by sending a dedicated command. During an RF or I2C session, the M24SR04 can control the GPO pin. After receiving a valid Set GPO command, GPO pin is driven low after a delay (1) or (3). GPO will be released after a valid Reset command or after a Power off or upon closing the RF session. Figure 8. GPO configured as State Control (GPO field = 0xX5 or 0x5X) 5)RU,& FKDQQHO *32DV 6WDWH&RQWURO RU 5HVHW*32 FRPPDQG RU $Q\RWKHU FRPPDQG 6HW*32 FRPPDQG 069 1. CmdSTPtoGPlow (I2C Set GPO command Stop to GPO low) 2. CmdSTPtoGPHZ (I2C Reset GPO command Stop to GPO HZ) 3. CmdEOFtoGPlow (RF Set GPO command End of frame to GPO low) 4. CmdEOFtoGPHZ (RF Reset GPO command End of frame to GPO HZ) DocID024754 Rev 16 19/89 20 Signal descriptions 2.7.7 M24SR04-Y M24SR04-G RF busy configuration (GPO field = 0x6X) When the GPO is configured as RF busy, the GPO goes to the low state when the M24SR04 is processing an RF command or when an RFsession is ongoing. When an RF field is present, GPO is driven low after a delay (1) when M24SR04 detects the first command. If the RF session is ongoing and M24SR04 receives a not-supported command, GPO remains low. It will be released only at the end of the RF session, after (2). Figure 9. GPO configured as RF busy (GPO field = 0x6X) Z& Z&Z ZZ ^Z ^Z Z& Z ^^ 'WKZ& D^s 1. CmdSOFtoGPlow (RF command Start of frame to GPO low) 2. CmdEOFtoGPHZ (RF command End of frame to GPO HZ) 20/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G M24SR04 memory management 3 M24SR04 memory management 3.1 Memory structure The M24SR04 supports the NDEF Tag Application as defined in the NFC Forum Type 4 Tag. The M24SR04 is composed of three files: * One Capability Container file * One NDEF file * One System file: this is an ST-proprietary file The System file contains some information on the configuration of the M24SR04 device. The CC file gives some information about the M24SR04 itself and the NDEF file. The NDEF file contains the User data. 3.1.1 File identifier The file identifier is the value used in the Select command to select a file. Table 3. File identifier File identifier 3.1.2 Meaning 0xE101 System file 0xE103 CC file 0x0001 NDEF file CC file layout The CC file gives some information about the M24SR04 and the NDEF file. This file is a read-only file for the RF or IC host and cannot be modified by issuing a write command. The T field, Read Access and Write Access fields can be changed by the RF or IC host by issuing a specific process (refer to Section 8: Functional procedures). DocID024754 Rev 16 21/89 28 M24SR04 memory management M24SR04-Y M24SR04-G Table 4. CC file layout for 1 NDEF file File offset 0x0000 Meaning Number of bytes of CC file (1) Value Comments 0x000F 15 bytes 0x20 or 0x10 V 2.0 or V 1.0 0x0002 Mapping version 0x0003 Maximum number of bytes that can be read 0x00F6 246 bytes 0x0005 Maximum number of bytes that can be written 0x00F6 246 bytes (2) T field 0x0007 0x04 0x0008 0x06 L field 0x0009 0x0001 FileID 0x0200 Maximum NDEF file size 0x000D 0x00 (2) Read access 0x000E (2) Write access 0x000B NDEF file control TLV 0x00 1. According to the reader. 2. Delivery state. 3.1.3 NDEF file layout The NDEF file contains the NDEF message which contains the User data. The RF host or the IC host can read and write data inside the file. The first two bytes named NDEF Message Length define the size of the NDEF message. The NDEF Message Length shall be managed by the application and the M24SR04 device does not check if its value is relevant vs the data written by the RF or IC host. The M24SR04 device uses the NDEF Message Length, e. g. the standard read can be processed only inside the NDEF message; otherwise, the M24SR04 device returns an error code. For more details about the read command, refer to Section 5.6.7: ReadBinary command. 22/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G M24SR04 memory management Table 5. NDEF file layout File offset 0x0000 Byte 1 NDEF message length 0x0004 3.1.4 Byte 0 Byte 2 Byte 3 User data User data User data User data User data User data ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... 0x01FC ... ... ... User data System file layout The system file specifies the configuration of the M24SR04. Table 6 lists the different fields. Table 6. Field list File offset Field name Number of bytes Read access Write access Delivery state (1) 0x0000 Length system file 2 IC or RF - 0x0012 0x0002 IC protect 1 IC or RF IC (2) 0x01 0x0003 IC watchdog 1 IC or RF IC (2) 0x00 IC or RF IC (2) 0x11 IC (2) 0x00 (2) 0x xxxx xxx1(3) 0x0004 0x0005 GPO 1 ST reserved 1 IC or RF 0x0006 RF enable 1 IC or RF IC 0x0007 NDEF File number (RFU) 1 IC or RF none 0x00 0x0008 UID 7 IC or RF none 0x0286 xx xx xx xx xx 0x000F Memory Size 2 IC or RF none 0x01FF 0x0011 Product Code 1 IC or RF none 0x86 or 0x8E 1. The delivery state for all passwords = 0x00000000000000000000000000000000. 2. The access is granted when the field IC protect is set to the state Unprotected or when the right IC password was correctly received (see Section 3.5: I2C password). 3. Refer Table 11. Table 7. Details about I2C watchdog File offset 0x0003 b7- b0 The "I2C Watchdog" ensures the I2C host will not keep the session open, while there is no more activity on the I2C bus (between the stop bit of the previous transaction and the start bit of the next one) - 0x00 (default value): the Watchdog is off - Other values: If programmed to a non null value N, the Watchdog is enabled and counts N*30 ms (30 ms is approximate) before releasing the I2C session. DocID024754 Rev 16 23/89 28 M24SR04 memory management M24SR04-Y M24SR04-G Table 8. Details about the GPO field File offset b7 b6-b4 b3 b2-b0 0x0004 RFU When an RF session is open: 0b000: High impedance 0b001: Session opened 0b010: WIP 0b011: MIP 0b100: Interrupt 0b101: State Control 0b110: RF Busy 0b111: RFU RFU When an IC session is open: 0b000: High impedance 0b001: Session opened 0b010: WIP 0b011: IC Answer Ready 0b100: Interrupt 0b101: State Control 0b110: RFU 0b111: RFU Table 9. Details about the RF Session field File offset b7 0x0004 RFU When an RF session is open: 0b001: Session opened RFU 24/89 DocID024754 Rev 16 b6-b4 b3-b0 M24SR04-Y M24SR04-G M24SR04 memory management Table 10 gives some details about the ST reserved field. Table 10. Details about the ST reserved field File offset b7-b0 0x0005 0x00 Table 11 gives some details about the RF enable field. Table 11. Details about the RF enable field File offset b7 b6-b4 b3 b2-b1 b0 0x0006 0: the RF field is off (1) 1: the RF field is on (1) RFU 0: the RF disable pad is at low state (1) 1: the RF disable pad is at high state (1) RFU 0: the M24SR04 does not decode the command received from the RF interface 1: the M24SR04 decodes the command received from the RF interface 1. this field is written by the M24SR04. 3.2 Read and write access rights to the memory An NDEF file can be locked for read or write accesses. It is also protected by a 128-bit password that the host shall present before accessing the NDEF file. There are two 128-bit passwords, one for the read access and the other one for the write access. An NDEF file can be permanently locked for read or write accesses. Thus, the host cannot access the NDEF file. The read password shall be sent to the M24SR04 device before reading a read-locked NDEF file. The write password shall be present on the M24SR04 device before writing a write-locked NDEF file. The write password shall be sent to change the read or write access. The read or write access right is defined for the NDEF file. 3.2.1 State of the Read and Write access rights Two bytes in the CC file are used to define the Read and Write access rights to the NDEF file. For more details, refer to Section 3.1.2: CC file layout. DocID024754 Rev 16 25/89 28 M24SR04 memory management M24SR04-Y M24SR04-G Table 12. Read access right Value Meaning 0x00 Read access without any security 0x80 Locked (1) 0xFE Read not authorized 1. The read password shall be sent before reading in the NDEF file. Table 13. Write access right Value Meaning 0x00 Write access without any security 0x80 Locked (1) 0xFF Write not authorized 1. The write password shall be sent before writing in the NDEF file. The state 0xFF and 0xFE cannot be changed by using the Read or Write passwords. 3.2.2 Changing the read access right to NDEF files The state diagram on Figure 10 shows how to change the access right to read an NDEF file. Figure 10. Changing the read access right to an NDEF file [ 3HUPDQHQWO\ORFNWKH1'()ILOH /RFNWKH1'()ILOH 8QORFNWKH1'()ILOH 3HUPDQHQWO\ORFNWKH1'()ILOH [ [)( 3HUPDQHQWO\XQORFNWKH1'()ILOH 06Y9 1. See the procedure to lock the read access (Section 8.4: Locking an NDEF file). 2. See the procedure to unlock the read access (Section 8.5: Unlocking an NDEF file). 3. See the procedure to permanently lock the read access (Section 8.6: Reaching the read-only state for an NDEF file). 4. Proprietary state, not defined by NFC Forum Type 4 Tag. For NFC Forum compatible tags, the only possible value of the read access rights are 0x00 (no restrictions on reads). 26/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 3.2.3 M24SR04 memory management Changing the write access right to NDEF files The state diagram on Figure 11 shows how to change the write access right to an NDEF file. Figure 11. Changing the write access right to an NDEF file [ /RFNWKH1'()ILOH 3HUPDQHQWO\ORFNWKH1'()ILOH 8QORFNWKH1'()ILOH 3HUPDQHQWO\ORFNWKH1'()ILOH [ [)) 3HUPDQHQWO\XQORFNWKH1'()ILOH 06Y9 1. See the procedure to lock the write access. 2. See the procedure to unlock the write access. 3. See the procedure to permanently lock the write access (Section 8.6: Reaching the read-only state for an NDEF file). 4. Proprietary state, not defined by NFC Forum Type 4 Tag. For NFC Forum compatible tags, it is mandatory that the write access rights are set to either 0x00 (no restrictions on writes) or 0xFF (permanently locked). 0x80 might not be fully decoded with some smart phones. 3.3 Access right life time The access right life time is validated while the NDEF file is selected or until the end of the RF or IC session. Once the read or write access right is granted, the host can send one or more ReadBinary or UpdateBinary commands. At the end of a session or when the host selects another file, the read and write access rights are initialized. 3.4 NDEF file passwords The NDEF file passwords protect the read or write access from an RF or IC interface from/to an NDEF file. Two NDEF file passwords are available for each NDEF file: * Read password * Write password The length of a password is 128 bits (16 bytes). DocID024754 Rev 16 27/89 28 M24SR04 memory management 3.5 M24SR04-Y M24SR04-G I2C password The IC password can be sent only by the IC host. It activates the SuperUser rights. The IC host with the SuperUser rights can: * Access the NDEF file regardless of the right access and without sending the NDEF file passwords. * Change the access rights regardless of the current state. The length of the IC password is 128 bits (16 bytes). 3.5.1 IC password and IC protect field of the System file The IC protect field in the system file can be set to: * 0x00: the IC host has the SuperUser right access without sending the IC password * 0x01: the IC host has the SuperUser right access after sending the IC password For more details about the system file layout, refer to Section 3.1.4: System file layout. 28/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 4 Communication mechanism Communication mechanism This chapter describes the principle of communication between an RF or an I2C host and the M24SR04 device. 4.1 Master and slave The M24SR04 acts as a slave device on either the I2C-bus or the RF channel and therefore waits for a command from the I2C master or the RF host before sending its response. The RF host shall generate the RF field and the RF commands. The I2C host shall supply the M24SR04 through the VCC pin and shall generate the I2C clock on the SCL pad. 4.2 M24SR04 session mechanism The M24SR04 is a dynamic NFC/RFID tag which can be accessed either from the RF or I2C interface. The M24SR04 implements a token system. This token has two possible values, RF or I2C. When the token exists and is assigned to one interface (RF or I2C), the M24SR04 cannot communicate with the other host. 4.2.1 RF token The token is given to the RF interface once the anticollision is done. The release condition can be either an RF field cut-off, or the reception of the command deselect, or when the IC host sends the KillRFsession. 4.2.2 I2C token The token is given to the I2C interface when the I2C host has sent the correct device Select. The release condition can be either a power down condition on VCC pin or the reception of a I2C token release sequence from the I2C host, after which M24SR04 goes in Standby power mode. DocID024754 Rev 16 29/89 78 IC and RF command sets 5 M24SR04-Y M24SR04-G IC and RF command sets The command sets of the M24SR04 can be split in different command families. Most commands are common between the RF and the IC interface. Some commands are specific to the RF interface and some others are specific to the IC interface. This section describes the M24SR04 command sets that can be issued by the RF or the IC host. There are three command families: * the NFC Forum Type 4 Tag command set * the ISO/IEC 7816-4 command set * the proprietary command set The NFC Forum Type 4 Tag command set and the ISO/IEC 7816-4 command set use the IBlock format. For more details about the I-Block format, refer to Section 5.2: I-Block format. Two other command formats exist: * the commands using the R-Block format * the commands using the S-Block format For more details about these formats, refer to the corresponding sections: Section 5.3: RBlock format and Section 5.4: S-Block format. This section gives a brief description of the RF and IC host common commands. The format of these command sets is the I-Block format. Table 14 lists the RF and IC command sets. Table 14. RF and IC command sets Family command set NFC Forum Type 4 Tag ISO/IEC 7816-4 30/89 Class byte Instruction code NDEF Tag Application Select 0x00 0xA4 NDEF Tag Application Select CC select 0x00 0xA4 Select the CC file NDEF select 0x00 0xA4 Select the NDEF file System select 0x00 0xA4 Select the system file ReadBinary 0x00 0xB0 Read data from file UpdateBinary 0x00 0xD6 Write or erase data to a NDEF file Verify 0x00 0x20 Checks the right access of a NDEF file or sends a password ChangeReferenceData 0x00 0x24 Change a Read or write password EnableVerificationRequirement 0x00 0x28 Activate the password security DisableVerificationRequirement 0x00 0x26 Disable the password security Command name DocID024754 Rev 16 Brief description M24SR04-Y M24SR04-G IC and RF command sets Table 14. RF and IC command sets (continued) Family command set 5.1 Class byte Instruction code Brief description ST Proprietary EnablePermanentState 0xA2 0x28 Enables the Read Only or Write Only security state ST Proprietary ExtendedReadBinary 0xA2 0xB0 Read data from file Command name Structure of the command sets The exchange of data between the RF or the IC host and the M24SR04 uses three kinds of data formats, called blocks: Note: * I-Block: to exchange the command and the response * R-Block: to exchange positive or negative acknowledgment * S-Block: to use either the Deselect command or the Frame Waiting eXtension (WTX) command or response max WTX value = 0x0B This section describes the structure of the I-Block, R-block and S-Block. This format is used for the application command set. 5.2 I-Block format The I-Block is used to exchange data between the RF or the IC host and the M24SR04. It is composed of three fields. Table 15 details the I-Block format. Table 15. I-Block format SoD Payload EoD Name Length PCB DID 0 CRC 1 byte 1 byte 1 to 251 bytes 2 bytes PCB field DID field (optional) RF or IC host to M24SR04: C-APDU M24SR04 to RF or IC host: R-APDU 2 CRC bytes DocID024754 Rev 16 31/89 78 IC and RF command sets M24SR04-Y M24SR04-G Table 16. PCB field of the I-Block format b7-b6 b5 b4 b3 b2 b1 b0 0b00 0 0 X 0 1 X I-Block RFU Must be set to 0 DID field, if bit is set Must be set to 0 Must be set to 1 Block number When the RF or IC host sends a command to the M24SR04 the format of the payload is the C-APDU. When the M24SR04 sends a command to the RF or IC host, the format of the payload is the R-APDU. 5.2.1 C-APDU: payload format of a command The C-APDU format is used by the RF or the IC host to send a command to the M24SR04. Table 17 describes its format. Table 17. C-APDU format Payload field Name Length CLA INS P1 P2 LC Data Le 1 byte 1 byte 1 byte 1 byte 1 byte Lc byte 1 byte Class byte 0x00: standard command 0xA2: ST command Instruction byte Param Byte 1 Param Byte 2 Number of bytes of the Data field Data bytes Number of bytes to be read in the M24SR04 memory 32/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 5.2.2 IC and RF command sets R-APDU: payload format of a response the M24SR04 uses the I-Block format to reply to a command which used the I-Block format. This format is described in Table 18. Table 18. R-APDU format Payload field Name Length Data (optional) SW1 SW2 Le byte 1 byte 1 byte Data Status byte 1 Status byte 2 5.3 R-Block format The R-Block is used to convey positive or negative acknowledgment between the RF or IC host and the M24SR04. Table 19. R-Block format PCB CRC R(ACK) without the DID field: 0xA2 or 0xA3 R(ACK) with the DID field: 0xAA or 0xAB R(NAK) without the DID field: 0xB2 0xB3 R(NAK) with the DID field: 0xBA 0xBB 2 CRC bytes There are two kinds of R-Blocks: * R(ACK): the acknowledgment block sent by the RF or IC host or by the M24SR04. * R(NAK): the non-acknowledgment block sent by the RF or IC host or by the M24SR04. DocID024754 Rev 16 33/89 78 IC and RF command sets M24SR04-Y M24SR04-G Table 20. R-Block detailed format b7-b6 b5 b4 b3 b2 b1 b0 0b10 1 X X 0 1 X R-Block RFU 1: NAK 0: ACK 0: DID field is not present 1: DID field is present Must be set to 0 Must be set to 1 Block number 5.4 S-Block format The S-Block is used to exchange control information between a reader and a contactless tag. Table 21. S-Block format SoD EoD NFC frame Length PCB DID Payload CRC 1 byte 1 byte 0 to 1 bytes 2 bytes 0xC2: for S(DES) when the DID field is not present 0xCA: for S(DES) when the DID field is present 0xF2: for S(WTX) when the DID field is not present 0xFA: for S(WTX) when the DID field is present DID field (optional) WTX field (1) 2 CRC bytes 1. This field is present when b5-b4 bits are set to 0b11 (S-Block is a WTX). see Table 22: S-Block detailed format. There are two requests using the S-Block format: * S(DES): the deselect command * S(DES) is only applicable to RF * S(WTX): the Waiting Frame eXtension command or response. A Waiting Time eXtension request occurs, in RF or I2C, when the operating time needed by M24SRxx is greater than 9.6 ms. The WTX field indicates the increase time factor to be used in this command execution (FDTtemp = WTX * 9.6 ms). The max WTX value is equal 0x0B. 34/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G IC and RF command sets Table 22. S-Block detailed format b7-b6 b5-b4 b3 b2 b1 b0 0b11 X X 0 1 0 S-Block 0b00: Deselect 0b11: WTX 0: DID field is not present 1: DID field is present RFU RFU Note: After receiving the deselect command, the session is released and M24SR04 enters the Standby power mode. In I2C, the session is released after executing the I2C token release sequence. In response to a RATS command, M24SR04 returns FWI parameter (default frame waiting time used); when M24SR04 needs more time for a command execution, it requests a frame waiting time extension by responding 0xF2 0xWTX (Request waiting time = FWI * WTX). If the reader accepts M24SR04 request, it acknowledges by sending the command 0xF2 0xWTX. The frame waiting time becomes FWI * WTX for the current command only. 5.5 CRC of the I2C and RF frame The two CRC bytes check the data transmission between the RF host or IC host and the M24SR04. For the RF frame, the CRC is computed on all the data bits in the frame, excluding parity bits, SOF and EOF, and the CRC itself. For the IC frames, the CRC is computed on all data bits of the frame excluding Device select and the CRC itself. The CRC is as defined in ISO/IEC 13239. The initial register content shall be 0x6363 and the register content shall not be inverted after calculation. DocID024754 Rev 16 35/89 78 IC and RF command sets M24SR04-Y M24SR04-G 5.6 NFC Forum Type 4 Tag protocol 5.6.1 Commands set With the NFC Forum Type 4 Tag protocol, the commands are common to RF and IC. Table 23. Command set overview Command name 5.6.2 Brief description NDEF Tag Application Select Select the NDEF Tag Application Capability Container Select Select the capability container (CC) file using the Select command NDEF Select Select the NDEF file System File Select Select the system file ReadBinary Read data from a file UpdateBinary Write new data to a file Status and error codes This section lists the status and the error code of the M24SR04. Table 24. Status code of the M24SR04 Value SW1 SW2 Comment 0x90 0x00 Command completed successfully Table 25. Error code of the M24SR04 SW1 SW2 1 byte 1 byte Value 0x62 0x80 File overflow (Le error) Value 0x62 0x82 End of file or record reached before reading Le bytes Value 0x63 0x00 Password is required Value 0x63 0xCX Password is incorrect, X further retries allowed (X can take value 0,1, 2) Value 0x65 0x81 Unsuccessful updating Value 0x67 0x00 Wrong length Value 0x69 0x81 Cmd is incompatible with the file structure Value 0x69 0x82 Security status not satisfied Value 0x69 0x84 Reference data not usable Length 36/89 DocID024754 Rev 16 Comment M24SR04-Y M24SR04-G IC and RF command sets Table 25. Error code of the M24SR04 (continued) SW1 SW2 1 byte 1 byte Value 0x6A 0x80 Incorrect parameters Le or Lc Value 0x6A 0x82 File or application not found Value 0x6A 0x84 File overflow (Lc error) Value 0x6A 0x86 Incorrect P1 or P2 values Value 0x6D 0x00 INS field not supported Value 0x6E 0x00 Class not supported Length DocID024754 Rev 16 Comment 37/89 78 IC and RF command sets 5.6.3 M24SR04-Y M24SR04-G NDEF Tag Application Select command the RF or the IC host shall send this command to activate the NDEF Tag Application. To activate the NDEF Tag Application, the RF host sends the Select command (see Table 26) in addition to the sequence defined in the NFC Forum digital protocol. To activate the NDEF Tag Application, the IC host sends the Select command (see Table 26) in addition to the GetSession or the Kill RF session command. Table 26 defines the C-APDU of the Select command to select the NDEF Tag Application (called NDEF Tag Application Select). Table 26. C-APDU of the NDEF Tag Application Select command Name Value CLA INS P1 P2 Lc Data Le 0x00 0xA4 0x04 0x00 0x07 0xD27600 00850101 0x00 Class byte Select instruction code P1 field P2 field Number of bytes of data Application ID Le field Table 27 defines the R-APDU of the NDEF Tag Application Select command. Table 27. R-APDU of the NDEF Tag Application Select command 5.6.4 Data SW1 SW2 Comment Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed Value - 0x6A 0x82 NDEF Tag Application not found Value - 0x6D 0x00 Class not supported Capability Container Select command The RF or IC host uses the Capability Container Select procedure to select the capability container (CC) file. The CC file is selected when this command returns "command completed" in the R-APDU. Table 28 defines the C-APDU of the Select command to select the CC file (called Capability Container Select). 38/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G IC and RF command sets Table 28. C-APDU of the Capability Container Select command Name Value CLA INS P1 P2 Lc Data Le 0x00 0xA4 0x00 0x0C 0x02 0xE103 - Class byte Select instruction code P1 field P2 field Number of bytes of data CC file ID - Table 29 defines the R-APDU of the CC Select command. Table 29. R-APDU of the Capability Container Select command 5.6.5 Data SW1 SW2 Comment Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed Value - 0x6A 0x82 File or application not found Value - 0x6D 0x00 Class not supported NDEF Select command The RF or IC host uses the NDEF Select command to select the NDEF file. The NDEF file is selected when this command returns "command completed" in the RAPDU. Table 30 defines the C-APDU of the Select command to select the NDEF file (called NDEF Select). In case of a password is required to access the NDEF file, the NDEF Select command will disable any previously granted access rights to this file. The Verify command might be required to access the file. Table 30. C-APDU of the NDEF Select command Name Value CLA INS P1 P2 Lc Data Le 0x00 0xA4 0x00 0x0C 0x02 0x000X - Class byte Select instruction code P1 field P2 field Number of bytes of data 0x0001: first NDEF file - DocID024754 Rev 16 39/89 78 IC and RF command sets M24SR04-Y M24SR04-G Table 31 defines the R-APDU of the NDEF Select command. Table 31. R-APDU of the NDEF Select command Data 5.6.6 SW1 SW2 Comment Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed Value - 0x6A 0x82 File or application not found System File Select command The RF or IC host uses this command to select the system file. The System file is selected when this command returns "command completed" in the RAPDU. Table 32 defines the C-APDU of the command to select the System file (called System Select). Table 32. C-APDU of the System File Select command Name CLA INS P1 P2 Lc Data Le 0x00 0xA4 0x00 0x0C 0x02 0xE101 - Class byte Select instruction code P1 field P2 field Number of bytes of data System file ID - Table 33 defines the R-APDU of the System File Select command. Table 33. R-APDU of the System File Select command 40/89 Data SW1 SW2 Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed Value - 0x6A 0x82 Capability container not found, no data is returned DocID024754 Rev 16 Comment M24SR04-Y M24SR04-G 5.6.7 IC and RF command sets ReadBinary command On receiving the ReadBinary command, the M24SR04 reads the requested memory field and sends back its value in the R-APDU response. Before sending a ReadBinary command, a file shall be selected by using a Select command. The Response of the ReadBinary command is successful when the data to be read is within the selected file (1); in other words, when the sum of P1-P2 and Le fields is equal to or lower than the selected file length. Table 34 defines the ReadBinary command. Table 34. C-APDU of the ReadBinary command Name CLA INS P1 & P2 Lc Data Le 0x00 0xB0 2 bytes - - 1 byte Class byte Read instruction code Offset in the file selected Number of bytes to read between 0x01 Le max(Selected File length, 0xF6) Table 35 defines the R-APDU of the ReadBinary command. Table 35. R-APDU of the ReadBinary command Length Data SW1 SW2 - 1 byte 1 byte Don't care(1) Comment Command completed Value Content read 0x90 Value - 0x67 0x00 Wrong length Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x82 File or application not found Value - 0x6E 0x00 Class not supported 1. For more information, please contact your local ST support. 1. For more details about CC file, refer to Section 3.1.2: CC file layout. For more details about NDEF file, refer to Section 3.1.3: NDEF file layout. For more details about System file, refer to Section 3.1.4: System file layout. DocID024754 Rev 16 41/89 78 IC and RF command sets 5.6.8 M24SR04-Y M24SR04-G UpdateBinary command On receiving the UpdateBinary command, the M24SR04 writes the data field into the selected file and sends back a status in the R-APDU response. If needed, M24SRxx will request a timing extension (see Section 5.4). Before sending an UpdateBinary command, a file shall be selected by issuing a Select command. Table 36 defines the UpdateBinary command. Table 36. C-APDU of the UpdateBinary command Name CLA INS P1 & P2 Lc Data Le 0x00 0xD6 2 bytes 1 byte Lc bytes - Class byte Write instruction code Offset in the file selected Number of bytes of data (0x01 Lc 0xF6) Data to write in the M24SR04 memory - Table 37 defines the R-APDU of the UpdateBinary command. Table 37. R-APDU of the UpdateBinary command Note: 42/89 Data SW1 SW2 Comment Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed Value - 0x65 0x81 Unsuccessful updating Value - 0x67 0x00 Wrong length Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x82 File or application not found Value - 0x6E 0x00 Class not supported Chaining is not supported on "UpdateBinay" command. For further return codes and definitions, refer to Status and error codes. DocID024754 Rev 16 M24SR04-Y M24SR04-G 5.7 IC and RF command sets ISO/IEC 7816-4 commands The ISO/IEC 7816-4 command set offers some extended features such as the protection of the NDEF file. This command set is used to manage the right access of the NDEF file. 5.7.1 Verify command The Verify command has two functions: 1. Check if a password is required to access to the NDEF file (the LC field = 0x00). 2. Check that the password embedded in the Verify command allows the access to the memory (the Lc field = 0x10 and the password is present). When the Lc field if equal to 0x00, the verify command returns a success code (0x90 00) provided that the access to the NDEF file does not require a password. When the access to the NDEF file is protected, the response to the Verify command returns an error code (0x63 00). When the Lc field equals 0x10, on receiving the Verify command, the M24SR04 compares the requested password with the data contained in the request and reports whether the operation has been successful in the response. Before sending this command, an NDEF file shall be selected by issuing the NDEF Select command. Thus, this command checks the right access condition of the last NDEF file selected. After a successful command, an access is granted for the whole NDEF file. Table 38 defines the Verify command. Table 38. Verify command format Name CLA INS P1 & P2 Lc Data Le 0x00 0x20 2 bytes 1 byte Lc bytes - Class byte Instruction code Password identification 0x0001: Read NDEF password transmit 0x0002: Write NDEF password transmit 0x0003: IC password transmit (1) Other: RFU 0x00: the password is not present 0x10: the password is present in the data field Password 1. This code can only be issued by the IC host. DocID024754 Rev 16 43/89 78 IC and RF command sets M24SR04-Y M24SR04-G Table 39 defines the R-APDU of the Verify command. Table 39. R-APDU of the Verify command Data SW1 SW2 Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed, the password is correct Value - 0x69 0x85 The conditions of use are not satisfied (e.g. no NDEF file was selected) Value - 0x69 0x81 Cmd incompatible with file structure Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x80 Incorrect parameter in cmd data field Value - 0x63 0x00 A password is required Value - 0x63 0xCX (1) Value - 0x6E 0x00 1. At each session, the RF or 5.7.2 I 2C Comment The password transmitted is incorrect and X encodes the number of further allowed retries. Class not supported host can check a password 3 times. Change Reference Data command The Change Reference Data command replaces the read or write password related to the NDEF files previously selected. It can be performed only if the security status satisfies the security attributes for this command. Before sending this command, the verify command with the correct NDEF write password shall be issued. Thus, this command changes the reference data of the NDEF file. Table 40 defines the Change Reference Data command. Table 40. Change reference data command format Name CLA INS P1 & P2 Lc Data Le 0x00 0x24 2 bytes 1 byte Lc bytes - Class byte Instruction code Password identification 0x0001: Read password transmit 0x0002: Write password transmit 0x0003: IC password transmit (1) Other: RFU 0x10: the password is present in the data field NDEF file or IC Password 1. This code can only be issued by the IC host. 44/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G IC and RF command sets Table 41 defines the R-APDU of the Change Reference Data command. Table 41. R-APDU of the Change Reference Data command 5.7.3 Data SW1 SW2 Comment Length 0 1 byte 1 byte - Value - 0x90 0x00 Command completed, the access right has been changed Value - 0x69 0x81 Cmd is incompatible with the file structure Value - 0x65 0x81 Unsuccessful updating Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x80 CC file or System file selected Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values Value - 0x6E 0x00 Class not supported Enable Verification Requirement command The Enable Verification Requirement command activates the protection by password of the NDEF file. When this command is successful, the read or write access to the NDEF file is protected by a 128-bit password. It can be performed only if the security status satisfies the security attributes for this command. This command can update the right access of the NDEF file by writing into the EEPROM. In this case, the response timing will be around 5 ms. Before sending this command, the verify command with the correct NDEF write password shall be issued. Thus, this command changes the access right of the NDEF file. Table 42 defines the Enable Verification requirement command. Table 42. Enable Verification Requirement command format Name CLA INS P1 & P2 Lc Data Le 0x00 0x28 2 bytes - - - Class byte Instruction code New security attributes 0x0001: Enable the read protection of the NDEF file 0x0002: Enable the write protection of the NDEF file Other: RFU - The last five bits identify the password sent in the Verify command. DocID024754 Rev 16 45/89 78 IC and RF command sets M24SR04-Y M24SR04-G Table 43 defines the R-APDU of the Enable Verification Requirement command. Table 43. R-APDU of the Enable Verification Requirement command 5.7.4 Data SW1 SW2 Comment Length 0 1 byte 1 byte - Value - 0x90 0x00 Command completed, the password is correct Value - 0x69 0x81 Cmd is incompatible with the file structure Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x80 CC file or System file selected Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values Disable Verification Requirement command The Disable Requirement command deactivates the protection by password of the NDEF file. When this command is successful, the read or write access to the NDEF file is granted without security requirements. It can be performed only if the security status satisfies the security attributes for this command. Before sending this command, the verify command with the correct NDEF write password shall be issued. Thus, this command changes the access right of the NDEF file. This command can update the right access of the NDEF file by writing into the EEPROM. In this case, the response timing will be around 6 ms. Table 44 defines the Disable Verification Requirement command. Table 44. Disable Verification Requirement command format Name CLA INS P1 & P2 Lc Data Le 0x00 0x26 2 bytes - - - Class byte Instruction code New security attributes 0x0001: Disable the read protection of the NDEF file 0x0002: Disable the write protection of the NDEF file Other: RFU - Table 45 defines the R-APDU of the Disable Verification Requirement command. 46/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G IC and RF command sets Table 45. R-APDU of the Disable Verification Requirement command 5.8 Data SW1 SW2 Comment Length 0 1 byte 1 byte - Value - 0x90 0x00 Command completed, the password is correct Value - 0x69 0x81 Cmd is incompatible with the file structure Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x80 CC file or System file selected Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values Value - 0x6E 0x00 Class not supported Value - 0x65 0x81 Update failed ST Proprietary command set The RF or IC host can be issued with the command set described in this chapter. 5.8.1 ExtendedReadBinary command On receiving the ExtendedReadBinary command, the M24SR04 reads the requested memory field and sends back its value in the R-APDU response. Before sending an ExtendedReadBinary command, a file shall be selected by issuing an NDEF select command. The response of the ExtendedReadBinary command will be successful even if the data to be read is beyond the NDEF message. The command returns an error code if the data to be read goes beyond the end of the file. Table 46. C-APDU of the ExtendedReadBinary command Name Length CLA INS P1 & P2 Lc Data Le 0xA2 0xB0 2 bytes - - 1 byte ST Class byte Read instruction code Offset in the file selected Number of bytes to read between 0x01 Le 0xF6 Table 47 defines the R-APDU of the read binary command. DocID024754 Rev 16 47/89 78 IC and RF command sets M24SR04-Y M24SR04-G Table 47. R-APDU of the ExtendedReadBinary command Data Length SW1 Le bytes SW2 1 byte comment 1 byte (1) Value Content read 0x90 Don't care Command completed Value - 0x67 0x00 Wrong length Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values Value - 0x6E 0x00 Class not supported 1. For more information, please contact your local ST support. 5.8.2 EnablePermanentState command The command configures the NDEF file to the ReadOnly or to the WriteOnly State. This command can update the right access to the NDEF file by writing into the EEPROM. In this case, the response timing will be around 6 ms. Table 48 defines the EnablePermanentState requirement command. Table 48. EnablePermanentState command format Name Length CLA INS P1 & P2 Lc Data Le 0xA2 0x28 2 bytes - - - Class byte Instruction code New security attributes 0x0001: Enable the read protection of the NDEF file 0x0002: Enable the write protection of the NDEF file Other: RFU - Table 49 defines the R-APDU of the EnablePermanentState command. Table 49. R-APDU table of the EnablePermanentState command 48/89 Data SW1 SW2 Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed Value - 0x65 0x81 Update failed Value - 0x67 0x00 Wrong length DocID024754 Rev 16 comment M24SR04-Y M24SR04-G IC and RF command sets Table 49. R-APDU table of the EnablePermanentState command (continued) 5.8.3 Data SW1 SW2 comment Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x80 CC file or System file selected Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values Value - 0x6E 0x00 Class not supported DisablePermanentState command The command configures the NDEF file to the Lock state. This command can update the right access of the NDEF file by writing into the EEPROM. In this case, the response timing will be around 6 ms. This command is only valid in I2C. The SuperUser rights must have been granted to execute the command. Before sending this command, an NDEF file shall be selected by issuing the NDEF Select command. Table 50 defines the DisablePermanentState requirement command. Table 50. DisablePermanentState command format Name Length CLA INS P1 & P2 Lc Data Le 0xA2 0x26 2 bytes - - - Class byte Instruction code New security attributes 0x0001: Disable the read protection of the NDEF file 0x0002: Disable the write protection of the NDEF file Other: RFU - Table 51 defines the R-APDU of the DisablePermanentState command. Table 51. R-APDU of the DisablePermanentState command Data SW1 SW2 Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed Value - 0x65 0x81 Update failed Value - 0x67 0x00 Wrong length Value - 0x69 0x82 Security status not satisfied DocID024754 Rev 16 comment 49/89 78 IC and RF command sets M24SR04-Y M24SR04-G Table 51. R-APDU of the DisablePermanentState command (continued) 5.8.4 Data SW1 SW2 comment Value - 0x6A 0x80 CC file or System file selected Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values Value - 0x6E 0x00 Class not supported UpdateFileType command This command allows to modify the file type of a selected file to Proprietary file (0x05) or NDEF file (0x04). NFC Forum compatible tags must configure the file as NDEF file (0x04). This command is granted only, when application and file are selected and if the file length and access right have previously been set to 0X00h (message invalid, all access rights granted). This command will update the file type located in the CC file by writing into the EEPROM. In this case, the response timing will be around 6 ms. Table 52 defines the UpdateFileType command. Table 52. UpdateFileType command format Name Value CLA INS P1 P2 Lc Data Le 0xA2 0xD6 0x00 0x00 0x01 0x04 or 0x05 - Class byte Select instruction code P1 field P2 field Number of bytes of data File type - Table 53 describes the R-APDU of the UpdateFileType command. Table 53. R-APDU of the UpdateFileType command 50/89 Data SW1 SW2 Comment Length - 1 byte 1 byte - Value - 0x90 0x00 Command completed Value - 0x69 0x82 Security status not satisfied Value - 0x6A 0x80 CC file or System file selected DocID024754 Rev 16 M24SR04-Y M24SR04-G IC and RF command sets Table 53. R-APDU of the UpdateFileType command (continued) 5.8.5 Data SW1 SW2 Comment Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values SendInterrupt command On receiving the SendInterrupt command, the M24SR04 generates a negative pulse on the GPO pin. It starts at the end of the command and ends at the end of the RF response. Before sending this command, the system file shall be selected by issuing the System Select command. Table 54 defines the SendInterrupt command. Table 54. SendInterrupt command format CLA INS P1&P2 Lc Data Le Length 1 byte 1 byte 2 bytes 1 byte - - Value 0xA2 0xD6 0x001E 0x00 - - Table 55 describes the R-APDU of the SendInterrupt command. Table 55. R-APDU of the SendInterrupt command 5.8.6 Data SW1 SW2 Comment Length - 1 byte 1 byte - Value - 0x90 0x00 The interrupt has been sent Value - 0x6A 0x80 The GPO is not configured as an interrupt mode Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values Value - 0x6E 0x00 Class not supported StateControl command On receiving the StateControl command with reset value: data 0x00, the M24SR04 drives the GPO pin low. On receiving the StateControl command with set value: data 0x01, the M24SR04 releases the GPO pin which returns to HZ. Before sending this command, the system file shall be selected by issuing the System Select command. Table 56 defines the State Control command. DocID024754 Rev 16 51/89 78 IC and RF command sets M24SR04-Y M24SR04-G Table 56. StateControl command format CLA INS P1&P2 Lc Data Le Length 1 byte 1 byte 2 bytes 1 byte - - Reset value 0xA2 0xD6 0x001F 0x01 0x00 - Set value 0xA2 0xD6 0x001F 0x01 0x01 - Table 57. R-APDU of the StateControl command 5.9 Data SW1 SW2 Comment Length - 1 byte 1 byte - Value - 0x90 0x00 The set or reset has been sent Value - 0x6A 0x80 The GPO is not configured in StateControl mode Value - 0x6A 0x82 File or application not found Value - 0x6A 0x86 Incorrect P1 or P2 values Value - 0x6E 0x00 Class not supported Specific RF command set This section describes the command set that can be issued only by the RF host. 5.9.1 Anticollision command set Table 58 lists the commands that can be issued only by the RF host. The format of these commands is described in the NFC Forum Digital Protocol specification. Table 58. Commands issues by the RF host Family command set NFC-A technology Command name Instruction code ALL_REQ 0x52 (1) SENS_REQ 0x26 (1) SDD_REQ 0x93 or 0x95 or 0x97 SEL_REQ 0x93 or 0x95 or 0x97 SLP_REQ 0x50 1. Code on 7 bits. 5.9.2 RATS command and ATS response RATS command and ATS response are used for NFC Forum Type 4A Tag Platform Device Activation (as defined in NFC Forum Digital Protocol specification). Table 59 details the RATS command. This command shall be sent after the anticollision process. 52/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G IC and RF command sets Table 59. RATS command Name INS Param CRC Byte field 0xE0 1 byte 2 bytes Bit field b7-b4 b3-b0 Instruction code FSDI DID (0 DID 14) 2 CRC bytes The FSDI field codes the FSD that defines the maximum size that an RF or IC host is able to receive. Table 60 gives the conversion from FDSI to FSD. Table 60. Conversion from FDSI to FSD FSDI 0x0 0x1 0x2 0x3 0x4 0x5 0x6 0x7 0x8 0x9h0xE 0xF 16 24 32 40 48 64 96 128 256 RFU 256 FSD The DID field defines the value of the addressed M24SR04. Table 61. ATS response Name TL T0 TA(1) TB(1) TC(1) CRC Byte field 0x05 0x78 1 byte 1 byte 0x02 2 bytes Bit field b8-b5 b4-b1 Length of the ATS response FSCI = 256 bytes The maximum ascending data rate is 106 kbps The maximum descending data rate is 106 kbps FWI field (9.6 ms when TB = 0x50) SFGI field (302 s when TB = 0x50) The DID is supported 2 CRC bytes The FSCI codes the FSC which stands for the maximum frame size that the M24SR04 is able to receive. The M24SR04 is able to receive up to 256 bytes of command. If the RF or IC host sends a command with more than 256 bytes, the M24SR04 will not be able to treat the command and will not reply. The FWI which stands for the Frame Waiting time Integer codes the FWT. This time corresponds to the maximum duration while an RF or IC host shall send before sending the next command. DocID024754 Rev 16 53/89 78 IC and RF command sets M24SR04-Y M24SR04-G The SFGI which stands for the Start-up Frame Guard Time is the minimum time that the reader shall wait after receiving the response of the M24SR04. 5.9.3 PPS command & response PPS (Protocol and Parameter Selection) command and response are defined in ISO/IEC 14443-4, in the Protocol Activation of PICC Type A. The PPS command allows to change the data rates of the ascending (RF host to M24SR04) and descending (M24SR04 to RF host) data rates. Table 62. PPS command - Name INS PPS0 PPS1 CRC Byte field 0xDX 0x11 1 byte 2 bytes Bit field INS b7-b4 b3-b0 0b0000 b3-b2 b1-b0 Instruction code DID PPS1 is present RFU PPS1 Descending data rate Ascending data rate 2 CRC bytes The ascending and descending data rates shall be coded as described in Table 63. Table 63. Ascending and descending data rate coding Value Data rate 0b00 0b01 0b10 0b11 106 kbps RFU RFU RFU When the M24SR04 is able to change both data rates, it returns the following response. The data rate of this response is 106 kbps; then, the M24SR04 changes the ascending and descending data rates. Table 64 gives the details of the PPS response. Table 64. PPS response Name INS - PPS0 Byte field 0xDX - 0x11 Bit field b8-b5 b4-b1 Response code DID field 2 CRC bytes 54/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 5.10 IC and RF command sets Specific IC command set Table 65 lists the commands that can only be issued by the IC host. Table 65. Specific IC commands 5.10.1 Command name Format Class byte Instruction code GetI2Csession - - 0x26 Open an IC session when the RF session is not ongoing KillRFsession - - 0x52 Kill the RF session and open an IC session Brief description GetI2Csession command The GetI2Csession command opens an IC session if an RF session is not ongoing. Table 66 defines the GetI2Csession command. Table 66. GetI2Csession command format INS Length 1 byte Value 0x26 The GetI2Csession command does not create a reply. When an RF session is ongoing, the M24SRxx will not acknowledge the command. When no RF session is ongoing, the M24SRxx will acknowledge the command and open an IC session. 5.10.2 KillRFsession command The KillRF session command closes the RF session and opens an IC session. Table 67 defines the KillRFsession command. Table 67. KillRFsession command format INS Length 1 byte Value 0x52 The KillRFsession command does not create a reply. The RF session is closed when the device acknowledges the command. Caution: A successful completion of the RF command is not certain. DocID024754 Rev 16 55/89 78 RF device operation M24SR04-Y M24SR04-G 6 RF device operation 6.1 Anticollision and Device Activation command set for the RF interface The M24SR04 device supports the command set defined in the NFC-A Technology and the Type 4A Tag Platform chapters of the NFC Digital Protocol V1.0 specification. 6.2 Open an RFsession Once the RF host has terminated the anticollision procedure and retrieve the ATS response, it shall send the SelectApplication command. The M24SR04 will open an RF session. At this point, the RF host can send the applicative command set and the IC cannot communicate with the M24SR04 without closing first the RF session using the I2C KillRFsession command. 6.3 Close an RFsession The RF host can close the RF session by issuing one of these methods: 6.4 * send an S(DES) command * turn off the RF field Applicative command set The applicative command set is composed of the following command sets: 56/89 * the NFC Forum Type 4 Tag command set * the ISO/IEC 7816-4 command set * the proprietary command set DocID024754 Rev 16 M24SR04-Y M24SR04-G 7 I2C device operation I2C device operation The M24SR04 device supports the I2C protocol. The device that controls the data transfer is known as the bus master, and the other one as the slave device. A data transfer can only be initiated by the bus master, which also provides the serial clock for synchronization. The M24SR04 device is a slave in all communications. 7.1 I2C communication protocol The I2C communication is built on a system of command and reply exchange. The I2C host starts the communication by sending a request. Once a valid request is received by the M24SR04 device, it carries out an internal operation and creates its answer. As defined in this document, and except for the GetI2C session and Kill RF session commands, the definition of a valid request is a command with a right CRC value. Figure 12 shows an exchange of a command and a response between the IC host and the M24SR04. Once the IC session is open, the IC host can send a command. The command is composed of: * a Device Select field with the R/W bit set to 0. * the command field. The M24SR04 acknowledges on the reception of each byte. Once the M24SR04 is ready to send the answer, the IC host shall: * send a Device Select field with the R/W bit set to 1. * release the SDA line and send an SCL clock. The IC host shall acknowledge on the reception of each byte. Figure 12. Command and response exchange ,&EXV 5: 6 'HYLFH6HOHFW &RPPDQG 5: 3 6 'HYLFH6HOHFW 5HVSRQVH 3 069 Legend: S is the I2C Start bit sequence P is the I2C Stop bit sequence R/W is the 8th bit of Device Select. Note: A restart during a command and response exchange is not supported by the M24SR04. After a command, the I2C host can execute a Polling sequence to determine when the response is available. Polling sequence: Loop on < START (S) + DeviceSelect with RW=0 + read NACK/ACK + STOP (P) > The response is available as soon as the M24SR04 sends an ACK ( host read will a '0'). DocID024754 Rev 16 57/89 78 I2C device operation 7.2 M24SR04-Y M24SR04-G Start condition A Start condition is identified by a falling edge of serial data (SDA) while the serial clock (SCL) is stable in the high state. A Start condition must precede any data transfer command. The device continuously monitors (except during an instruction processing) the SDA and the SCL for a Start condition, and does not respond unless one is given. 7.3 Stop condition A Stop condition is identified by a rising edge of serial data (SDA) while the serial clock (SCL) is stable and driven high. A Stop condition terminates a command between the device and the bus master. 7.4 IC token release sequence As explained in the M24SR04-Y M24SR04-G session mechanism, the IC communication is reserved to the IC host when the session token has the IC value. The following sequence explains how to release the IC value of the session token. IC communication with the M24SR04 starts with a valid Start condition, followed by a device select code. If the delay between the Start condition and the following rising edge of the Serial Clock (SCL) that samples the most significant of the Device Select exceeds the tSTART_OUT_MAX time (see Table 78), the IC logic block is reset and further incoming data transfer is ignored until the next valid Start condition. Figure 13. IC token release sequence !W67$57B287BPD[ 6&/ 6'$ 065'HYLFH 6HOHFWFRGH 6WDUW FRQGLWLRQ 6WRS FRQGLWLRQ 06Y9 Note: 58/89 If the above delay is below tSTART_OUT_min (see Table 78), I2C session token stays unmodified. If the delay is between tSTART_OUT_min and tSTART_OUT_max, I2C session token might or not be released. This range of delay is not authorized for safe operation. DocID024754 Rev 16 M24SR04-Y M24SR04-G 7.5 I2C device operation IC timeout on clock period During a data transfer on the I2C bus, if the serial clock high pulse or serial clock low pulse exceeds tCL_RESET value that is the maximum value specified in Table 78, the I2C logic block is reset and any further incoming data transfer is ignored until the next valid Start condition. If the serial clock high pulse is under the maximum value of tCHCL and the serial clock low pulse is under the maximum value of tCLCH in Table 78, the I2C logic block is not reset. For proper operation, the serial clock high pulse should not be higher than tCHCL and lesser than tCL_RESET, and the serial clock low pulse should not be higher than tCHCH and lesser tCL_RESET. 7.6 Acknowledge bit (ACK) The acknowledge bit is used to indicate a successful byte transfer. The bus transmitter, whether a bus master or a slave device, releases the serial data (SDA) after sending eight bits of data. During the 9th clock pulse period, the receiver pulls the SDA low to acknowledge the receipt of the eight data bits. 7.7 Data input During data input, the device samples serial data (SDA) on the rising edge of the serial clock (SCL). For a correct device operation, the SDA must be stable during the rising edge of the SCL, and the SDA signal must change only when the SCL is driven low. 7.8 IC device address The device address is the concatenation of the group number coded on 4 bits and the I2C address coded on 3 bits, as shown in Table 68. Table 68. I2C device address format b7-b4 b3 b2 b1 b0 0b1010 1 1 0 0bx Group number E2 bit E1 bit E0 bit 0 = Request 1 = Answer DocID024754 Rev 16 59/89 78 I2C device operation 7.9 M24SR04-Y M24SR04-G IC frame format The I2C frame is composed of three fields: 1. SOD field: contains the device select and the PCB. The PCB field is detailed in Section 5.2. 2. Payload field: contains the command and its parameter, as defined in the I2C command set. 3. EOD field: contains the two CRC bytes computed on the SOD but excluding the device select byte field. Table 69 shows the format of an I2C frame. Table 69. I2C frame format I2C frame SOD 0xAC or 0xAD 1 byte Payload EOD 1 to 251 bytes 2 bytes Device select 0xAC: to send a request to the M24SR04 0xAD: to read a response of the M24SR04 PCB field I2C command or I2C answer 2 CRC bytes 7.9.1 Example of IC frame commands NDEF Tag Application command This example presents the I2C frame of an NDEF Tag Application Select command. The I2C frame is detailed in Table 70. Table 70. I2C host to M24SR04 Field SOD Value 0xAC 0x02 or 0x03 Payload EOD Command field 35 C0 or DF BE Device select PCB field 0x00 A4 04 00 07 D2 76 00 00 85 01 01 00 2 CRC bytes Before sending a new command, the I2C host can send an I2C frame to read the M24SR04 answer to the NDEF tag Application Select command. 60/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G I2C device operation Table 71. M24SR04 to I2C host Field SOD Payload I2C host to M24SR04 Value EOD M24SR04 to I2C host 0xAD 0x02 or 0x03 0x90 00 F1 09 or 2D 53 Device select PCB field I2C command 2 CRC bytes Figure 14 shows the I2C frame of the NDEF tag Application Select command. Figure 14. NDEF tag Application Select command 6WDUWRIWKH WUDQVPLVVLRQ RIWKHUHTXHVW ,&EXV 6 $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. (QGRIWKH WUDQVPLVVLRQ RIWKHUHTXHVW ,&EXV $&. $&. $&. [ [ [& W 6WDUWRIWKH WUDQVPLVVLRQ RIWKHDQVZHU ,&EXV ^ < < < < < EZ< Z Z Z & W /HJHQG $&. $&. [ %\WHVHQWE\WKH,&KRVW 1R$&. $FNQRZOHGJHE\WKH,&KRVW $FNQRZOHGJHE\065[[< 1R$FNQRZOHGJHE\WKH,&KRVW [ %\WHVHQWE\WKH065[[< [ %\WHVHQWE\WKH065[[< 6 6WDUWVHQWE\WKH,&KRVW 6WRSVHQWE\WKH,&KRVW 3 DocID024754 Rev 16 6WRSVHQWE\WKH,&KRVW 3 06Y9 61/89 78 I2C device operation 7.10 M24SR04-Y M24SR04-G Open an IC session To open an IC session, the IC host shall send either the GetSession command or the KillRFsession command. The GetSession Command opens an IC session if an RF session in not currently opened. A KillRFsession command closes the current RF session if it exist and opens an IC session. When an IC session is opened, the RF host cannot communicate with the M24SR04 and cannot close the IC session. 7.11 Close the IC session There are three ways to close an IC session: 62/89 * turn off the Vcc power supply * send the I2C token release sequence * wait for the IC watchdog when it is enabled * wait for the IC timeout on clock period DocID024754 Rev 16 M24SR04-Y M24SR04-G 8 Functional procedures Functional procedures This section describes some procedure to access the memory or manage its protection. 8.1 Selection of an NDEF message The RF or IC host shall use this procedure to detect the NDEF message inside an M24SR04. The NDEF detection procedure is as follows: 8.2 1. Open an RF or an IC session 2. Send the SelectNDEFTagApplication command 3. Select the CC file 4. Read the CC file 5. Select the NDEF file. Reading of an NDEF message The RF or IC host executes the NDEF read procedure to read the NDEF file. 1. Detect successfully the NDEF file using the NDEF detection procedure 2. Check that the read access without any security is granted for the NDEF file from the information provided by the CC file 3. Select the NDEF file 4. Read the NDEF file. Note: Reading the NDEF file should not go beyond the NDEF Length field (NLEN), which indicates the size of the NDEF message stored in the NDEF file. 8.3 Reading a locked NDEF file The RF or IC host executes this procedure to read an NDEF file which has been locked previously. 1. Select the NDEF Tag Application 2. Select the NDEF file 3. Verify the Read password by using the Verify command 4. Read the data in the NDEF file. DocID024754 Rev 16 63/89 78 Functional procedures 8.4 M24SR04-Y M24SR04-G Locking an NDEF file The RF or IC host executes this procedure to protect an NDEF file. 1. 8.5 Select the NDEF Tag Application 2. Check the right access provided by the CC file 3. Select the NDEF file 4. Transmit the NDEF file Write password by using the Verify command 5. Lock the NDEF file by sending the Enable verification command. Unlocking an NDEF file The RF or IC host executes this procedure to unlock an NDEF file which has been locked previously. 8.6 1. Select the NDEF Tag Application 2. Select the NDEF file 3. Verify the NDEF file Write password or the IC password by using the Verify command 4. Unlock the NDEF file by sending the Disable verification command. Reaching the read-only state for an NDEF file The RF or IC host executes this procedure to reach the read-only state for an NDEF file. 8.7 1. Select the NDEF Tag Application 2. Select the NDEF file 3. Transmit the NDEF file Write password or the IC password by using the Verify command 4. Send an EnablePermanentState command as the Write access right of the previous Select NDEF file. Changing an NDEF password procedure The RF or IC host could use this procedure to change one NDEF password. it can be a Read or Write password. 1. 64/89 Select the NDEF Tag Application 2. Select the NDEF file 3. Transmit the NDEF file Write password or the IC password by using the Verify command 4. Change the password by sending a ChangeReferenceData command. DocID024754 Rev 16 M24SR04-Y M24SR04-G 8.8 Functional procedures Changing a File type Procedure The RF or IC host executes this procedure to change the File Type of a file for which all access rights were previously granted. 1. 8.9 Select the NDEF Tag Application 2. Select the File to be modified 3. Set the File Length to 0x00 using the UpdateBinary command 4. Send an UpdateFileType command with the New file Type as data. Updating a NDEF file When there's enough space in the file to update it with new content, the following steps should be followed to update the NDEF message: 1. Select the NDEF Tag Application 2. Select the NDEF file 3. Unlock the NDEF file if necessary 4. Write the NDEF length to 0x0000 with the Update Binary command. 5. Write the NDEF message in the NDEF message field using one or more Update Binary commands. 6. Write the NDEF length of the NDEF message using the Update Update command. It is recommended the NDEF length is read back and checked against the desired value to ensure the Update sequence has been correctly performed. DocID024754 Rev 16 65/89 78 UID: Unique identifier 9 M24SR04-Y M24SR04-G UID: Unique identifier The M24SR04 is uniquely identified by a 7 bytes unique identifier (UID). The UID is a readonly code and comprises: * The IC manufacturer code on 1 byte (0x02 for STMicroelectronics). * The Product code on 1 byte. * A device number on 5 bytes. Table 72 describes the UID format. Table 72. UID format 0x02 IC manufacturer code M24SR04 product code Device number 66/89 DocID024754 Rev 16 0x86 5 bytes M24SR04-Y M24SR04-G 10 Maximum ratings Maximum ratings Stressing the device above the ratings listed in Table 73 may cause permanent damage to the device. These are stress ratings only and operation of the device at these or any other conditions above those indicated in the operating sections of this specification is not implied. Exposure to absolute maximum rating conditions for extended periods may affect the device reliability. Table 73. Absolute maximum ratings Symbol TA Parameter Min. Max. Ambient operating temperature for grade 6 - 40 85 Ambient operating temperature for grade 5 - 25 85 - 65 150 C 15 25 C - 9 months Storage temperature TSTG Storage temperature Storage time TLEAD VIO Lead temperature during soldering UFDFPN8, SO8, TSSOP8 Sawn Bumped Wafer (kept in its antistatic bag) C UFDFPN8, SO8, TSSOP8 I2C input or output range and GPO Unit see note (1) C - 0.50 6.5 V RF supply current AC0 - AC1 - 100 mA VMAX_1 (2) RF input voltage amplitude between AC0 and AC1, GND pad left floating VAC0-VAC1 - 10 V VMAX_2 (2) AC voltage between AC0 and GND, or AC1 and GND VAC0-GND or VAC1-GND - 0.5 4.5 V VESD Electrostatic discharge voltage (human body model) (3) AC0-AC1 - 1000 V Electrostatic discharge voltage (human body model) (3) Other pads - 3500 V ICC (2) VESD 1. Compliant with JEDEC Std J-STD-020D (for small body, Sn-Pb or Pb assembly), the ST ECOPACK(R) 7191395 specification, and the European directive on Restrictions on Hazardous Substances (ROHS directive 2011/65/EU, July 2011). 2. Based on characterization, not tested in production. Maximum absorbed power = 100 mW @ 7.5 A/m 3. AEC-Q100-002 (compliant with JEDEC Std JESD22-A114A, C1 = 100 pF, R1 = 1500 , R2 = 500 ) DocID024754 Rev 16 67/89 78 I2C DC and AC parameters 11 M24SR04-Y M24SR04-G I2C DC and AC parameters This section summarizes the operating and measurement conditions, and the DC and AC characteristics of the device in I2C mode. The parameters in the DC and AC characteristic tables that follow are derived from tests performed under the measurement conditions summarized in the relevant tables. Designers should check that the operating conditions in their circuit match the measurement conditions when relying on the quoted parameters. Table 74. I2C operating conditions Symbol VCC TA Parameter Min. Max. Supply voltage range Y 2.7 5.5 Supply voltage range G 2.4 5.5 Ambient operating temperature for grade 6 -40 85 Ambient operating temperature for grade 5 -25 85 Unit V C Table 75. AC test measurement conditions Symbol Parameter CL Load capacitance tr, tf Input rise and fall times Min. Max. Unit 100 - pF 50 ns Vhi-lo Input levels 0.2 VCC to 0.8 VCC V Vref(t) Input and output timing reference levels 0.3 VCC to 0.7 VCC V Figure 15. AC test measurement I/O waveform ,QSXWOHYHOV ,QSXWDQGRXWSXW WLPLQJUHIHUHQFHOHYHOV 9FF 9FF 9FF 6CC 069 Table 76. Input parameters Symbol 68/89 Parameter Min. Max. Unit CIN Input capacitance (SDA) - 8 pF CIN Input capacitance (other pins) - 6 pF tNS Pulse width ignored (Input filter on SCL and SDA) - 80 ns DocID024754 Rev 16 M24SR04-Y M24SR04-G I2C DC and AC parameters Table 77. I2C DC characteristics Symbol Parameter ILI Input leakage current (SCL, SDA) ILO Output leakage current ICC0 ICC1 Standby power mode supply current Supply current (I2C Session open) Test condition Min. Max. Unit VIN = VSS or VCC device in Standby mode - 2 A SDA in Hi-Z, external voltage applied on SDA: VSS or VCC - 2 A VCC = 3.3 V, with RF ON - 30 VCC = 3.3 V, with RF OFF - 5 (1) VCC = 5.5 V, with RF ON - 30 VCC = 5.5 V, with RF OFF - 5 VCC = 3.3 V, with RF ON - 150 VCC = 3.3 V, with RF OFF - 150 VCC = 5.5 V, with RF ON - 150 VCC = 5.5 V, with RF OFF ICC2 Supply current (2) (Read binary) - 150 VCC = 3.3 V (fC = 1 MHz), with RF ON (3) - 250 VCC = 3.3 V (fC = 1 MHz), with RF OFF (3) - 200 (3) - 250 VCC = 5.5 V (fC = 1 MHz),with RF OFF (3) - 200 (3) VCC = 5.5 V (fC = 1 MHz),with RF ON VCC = 3.3 V (fC = 1 MHz),with RF ON ICC3 Supply current (2) (Update binary) - 550 VCC = 3.3 V (fC = 1 MHz),with RF OFF (3) - 500 VCC = 5.5 V (fC = 1 MHz), with RF ON (3) - 550 VCC = 5.5 V (fC = 1 MHz), with RF OFF (3) - 500 A A A A VIL Input low voltage (SDA, SCL) VCC = 2.7 V (grade Y) VCC = 2.4 V (grade G) VCC = 5.5 V -0.45 0.3 VCC V VIH Input high voltage (SDA, SCL) VCC = 2.7 V (grade Y) VCC = 2.4 V (grade G) VCC = 5.5 V 0.7 VCC 6.5 V VIL Input low voltage (RF disable) VCC = 2.7 V (grade Y) VCC = 2.4 V (grade G) VCC = 5.5 V 0.45 V VIH Input high voltage (RF disable) VCC = 2.7 V (grade Y) VCC = 2.4 V (grade G) VCC = 5.5 V 1.4 - V Output low voltage (SDA) IOL = 3 mA, VCC = 5.5 V - 0.4 V Output low voltage (GPO) IOL = 1 mA, VCC = 2.7 V (grade Y) or 2.4 V (grade G) to VCC = 5.5 V - 0.4 V VOL - 1. When an RF session is Opened, Icc corresponds to the standby power mode. 2. Characterized only. 3. Input levels as defined in Figure 15. DocID024754 Rev 16 69/89 78 I2C DC and AC parameters M24SR04-Y M24SR04-G Table 78. I2C AC characteristics (400 kHz) Test conditions specified in Table 74 (preliminary data based on design simulations) Symbol Alt. fC Parameter Min. Max. Unit fSCL Clock frequency 0.05 400 kHz tCHCL (1) tHIGH Clock pulse width high 0.6 20000 s tCLCH (2) tLOW Clock pulse width low 1.3 20000 s 40000 - s Input signal rise time (3) (3) ns (3) ns tCL_reset tXH1XH2 tR Clock reset tXL1XL2 tF Input signal fall time (3) tDL1DL2 tF SDA (out) fall time 20 300 ns tDXCX tSU:DAT Data in set up time 100 - ns tCLDX tHD:DAT Data in hold time 0 - ns tCLQX(4) tDH Data out hold time 100 - ns (5) tAA Clock low to next data valid (access time) - 900 ns tCLQV tCHDX (6) tSU:STA Start condition set up time 600 - ns tDLCL tHD:STA Start condition hold time 600 - ns tCHDH tSU:STO Stop condition set up time 600 - ns tDHDL tBUF Time between Stop condition and next Start condition 1300 - ns tW tWR IC write time in one page - 5 ms IC write time up to 246 bytes - 90 ms - Pulse width ignored (input filter on SCL and SDA) - 80 ns - Delay for IC token release 20 40 ms tNS (7) tSTART_OUT 1. tCHCL timeout. 2. tCLCH timeout. 3. There is no min. or max. value for the input signal rise and fall times. It is however recommended by the IC specification that the input signal rise and fall times be more than 20 ns and less than 300 ns when fC < 400 kHz. 4. To avoid spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or rising edge of SDA. 5. tCLQV is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8VCC in a compatible way with the I2C specification (which specifies tSU:DAT (min) = 100 ns), assuming that the Rbus x Cbus time constant is less than 500 ns (as specified in Figure 17). 6. For a restart condition, or following a write cycle. 7. Characterized only, not tested in production. 70/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G I2C DC and AC parameters Table 79. I2C AC characteristics (1 MHz) Test conditions specified in Table 74 (preliminary data based on design simulations) Symbol Alt. fC Parameter Min. Max. Unit fSCL Clock frequency 0.05 1000 kHz tCHCL (1) tHIGH Clock pulse width high 260 - ns tCLCH (2) tLOW Clock pulse width low 500 - ns tR Input signal rise time (3) (3) ns (3) ns tXH1XH2 tXL1XL2 tF Input signal fall time (3) tDL1DL2 tF SDA (out) fall time 20 120 ns tDXCX tSU:DAT Data in set up time 50 - ns tCLDX tHD:DAT Data in hold time 0 - ns 100 - ns - 450 ns tSU:STA Start condition set up time 250 - ns tDLCL tHD:STA Start condition hold time 250 - ns tCHDH tSU:STO Stop condition set up time 250 - ns 500 - ns IC write time in one page - 5 ms IC write time up to 246 bytes - 150 ms Pulse width ignored (input filter on SCL and SDA) - 80 ns tCLQX tCLQV (4)(5) tCHDX (6) tDH Data out hold time tAA Clock low to next data valid (access time) tDHDL tBUF tW tWR tNS (7) - Time between Stop condition and next Start condition 1. tCHCL timeout. 2. tCLCH timeout. 3. There is no min. or max. value for the input signal rise and fall times. It is however recommended by the IC specification that the input signal rise and fall times be less than 120 ns when fC < 1 MHz. 4. To avoid spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or rising edge of SDA. 5. tCLQV is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8VCC in a compatible way with the I2C specification (which specifies tSU:DAT (min) = 100 ns), assuming that the Rbus x Cbus time constant is less than 500 ns (as specified in Figure 17). 6. For a reStart condition, or following a write cycle. 7. Characterized only, not tested in production. DocID024754 Rev 16 71/89 78 I2C DC and AC parameters M24SR04-Y M24SR04-G Figure 16. I2C AC waveforms W;/;/ W;+;+ W&+&/ W&/&+ 6&/ W'/&/ W;/;/ 6'$,Q W&+'/ W&/'; W;+;+ 6WDUW FRQGLWLRQ 6'$ ,QSXW 6'$ W';&+ &KDQJH W&+'+ W'+'/ 6WDUW 6WRS FRQGLWLRQ FRQGLWLRQ 6&/ 6'$,Q W: W&+'+ 6WRS FRQGLWLRQ W&+'/ :ULWHF\FOH 6WDUW FRQGLWLRQ W&+&/ 6&/ W&/49 6'$2XW W&/4; 'DWDYDOLG W4/4/ 'DWDYDOLG 069 72/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G I2C timing measurement condition Figure 17 represents the Maximum Rbus value versus bus parasitic capacitance (Cbus) for an I2C bus at maximum frequency fC = 400 kHz. Figure 17. Maximum Rbus value with fC = 400 kHz "US LINE PULL UP RESISTOR K K1/2 4HE 2 BUS X #BUS TIME CONSTANT MUST BE BELOW THE NS TIME CONSTANT LINE REPRESENTED ON THE LEFT 2 BU S # BU S (ERE 2BUS #BUS NS 6## 2BUS NS )# BUS MASTER 3#, -XXX 3$! P& "US LINE CAPACITOR P& #BUS AIB Figure 18 represents the Maximum Rbus value versus bus parasitic capacitance (Cbus) for an I2C bus at maximum frequency fC = 1 MHz. Figure 18. Maximum Rbus value with fC = 1 MHz "US LINE PULL UP RESISTOR K 11.1 I2C DC and AC parameters 6## 4HE 2BUS #BUS TIME CONSTANT MUST BE BELOW THE NS TIME CONSTANT LINE REPRESENTED ON THE LEFT 2 BUS # BUS NS 2BUS )# BUS MASTER 3#, -XXX 3$! (ERE 2 BUS #BUS NS #BUS "US LINE CAPACITOR P& -36 DocID024754 Rev 16 73/89 78 I2C DC and AC parameters M24SR04-Y M24SR04-G Figure 19. I2C bus protocol 6&/ 6'$ 6'$ ,QSXW 6WDUW FRQGLWLRQ 6'$ &KDQJH 6WRS FRQGLWLRQ 6&/ 6'$ $&. 06% 6WDUW FRQGLWLRQ 6&/ 6'$ 06% $&. 6WRS FRQGLWLRQ -36 Table 80. Device select code Device type identifier (1) b7 Device select code 1 b6 0 Chip Enable address b5 1 b4 0 1. The most significant bit, b7, is sent first. 74/89 DocID024754 Rev 16 b3 1 b2 1 b1 0 RW b0 RW M24SR04-Y M24SR04-G 12 GPO parameters GPO parameters This section lists the timing of the GPO according to its configuration. Table 81. GPO timings measurement(1) GPO field I/F Condition I2C GPO low when session active I2C GPO return HZ RF RF 0xX1 Session Open 0x1X I2C 0xX2 WIP Message In Progress Kill session CmdSTPtoGPlow *add 100 s for boot after POR 15* s 15* s I2C token release sequence AnswerlbLBtoGPHZ 105 ns GPO low when session active NDEF select CmdEOFtoGPlow 170 s GPO return HZ Deselect CmdEOFtoGPHZ 370 s CmdSTPtoGPlow 45 s Writing time duration (No time extension) 5 ms CmdEOFtoGPlow 75 s Writing time duration (No time extension) 5 ms 55 or 5 s ms Get session Update Binary GPO low when a command is computed ReadBinary or UpdateBinary CmdSTPtoGPlow I2C GPO return HZ on new command All commands After NewCmdlbFB or AnswerlbFB 105 ns RF GPO low when modifying NDEF UpdateBinary (Msg Length #0) CmdEOFtoGPlow 75 s RF GPO low when modifying NDEF UpdateBinary Writing time duration (No time extension) 5 ms I2C GPO low after receiving an Interrupt command SendInterrupt CmdSTPtoGPlow 50 s I2C GPO return HZ All commands After NewCmdlbFB or AnswerlbFB 105 ns RF GPO low after receiving an Interrupt command CmdEOFtoGPlow 75 s SendInterrupt Pulse duration 540 s RF 0x3X 0xX4 0x4X Unit GPO low when programming 0xX3 Interrupt Typ. Update Binary I2C I2C Answer Ready Symbol GPO low when programming RF 0x2X Command RF DocID024754 Rev 16 75/89 78 GPO parameters M24SR04-Y M24SR04-G Table 81. GPO timings measurement(1) (continued) GPO field I/F Condition Command Symbol Typ. Unit I2C GPO low when reset Reset GPO CmdSTPtoGPlow 40 s I2C GPO return HZ when set Set GPO CmdSTPtoGPHZ 40 s RF GPO low when reset Reset GPO CmdEOFtoGPlow 60 s RF GPO return HZ when set Set GPO CmdEOFtoGPHZ 60 s RF GPO low after receiving an RF command Anticollision command or start of RF disturb (command using another RF protocol) CmdSOFtoGPlow 6 s RF GPO return HZ after deselection or RF command in another protocol Deselect or end of RF disturb (command using another RF protocol) CmdEOFtoGPHZ 460 s 0xX5 State Control 0x5X RF Busy 0x6X 1. Characterized only. 76/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 13 Write cycle definition Write cycle definition Table 82. Write cycle definition(1) Symbol Parameter Test Conditions Min Max Ncycle Write cycle endurance(2) TA 25 C, VCC(min) < VCC < VCC(max) - 1,000,000 TA 85 C, VCC(min) < VCC < VCC(max) - 600,000 Units Write cycle 1. A write cycle is calculated per byte, and corresponds to a write to this byte. 2. Write cycle endurance is defined by characterization and qualification. DocID024754 Rev 16 77/89 78 RF electrical parameters 14 M24SR04-Y M24SR04-G RF electrical parameters This section summarizes the operating and measurement conditions, and the DC and AC characteristics of the device in RF mode. The parameters in the DC and AC characteristics tables that follow are derived from tests performed under the Measurement Conditions summarized in the relevant tables. Designers should check that the operating conditions in their circuit match the measurement conditions when relying on the quoted parameters. Table 83. Default operating conditions Symbol TA Parameter Min. Max. Ambient operating temperature for grade 6 -40 85 Ambient operating temperature for grade 5 -25 85 Unit C Table 84. RF characteristics (1) Symbol fC H_ISO H_Extended MICARRIER Parameter Condition Min Typ Max Unit 13.553 13.56 13.567 MHz TA = 0 C to 50 C 1500 - 7500 mA/m TA = -40 C to 85 C 500 - 7500 mA/m MI=(A-B)/(A+B) 90 - 100 % External RF signal frequency Operating field according to ISO Operating field in extended temperature range 100% carrier modulation index t1 Pause A length - 28/fC - 40.5/fC s t2 Pause A low time - 7/fC - t1 s t3 Pause A rise time - 1.5xt4 - 16/fC s t4 Pause A rise time section - 0 - 6/fC s tMIN CD Minimum time from carrier generation to first data From H-field min - - 5 ms - - 6 - ms fC = 13.56 MHz 22.5 25 27.5 pF Chip reset - - 5 ms Wt CTUN tRF_OFF RF write time (including internal Verify) for one page Internal tuning capacitor in SO8 (2) RF OFF time 1. All timing characterizations were performed on a reference antenna with the following characteristics: External size: 75 mm x 48 mm Number of turns: 6 Width of conductor: 0.6 mm Space between two conductors: 0.6 mm Value of the tuning capacitor in SO8: 25 pF (M24SR04) Value of the coil: 5 H Tuning frequency: 14.2 MHz. 2. Characterized only, at room temperature only, measured at VAC0-VAC1 = 2 V peak to peak at 13.56 MHz. 78/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 15 Package information Package information In order to meet environmental requirements, ST offers these devices in different grades of ECOPACK(R) packages, depending on their level of environmental compliance. ECOPACK(R) specifications, grade definitions and product status are available at: www.st.com. ECOPACK(R) is an ST trademark. 15.1 SO8N package information Figure 20. SO8N - 8-lead plastic small outline, 150 mils body width, package outline H X ! ! C CCC B E PP *$8*(3/$1( $ K % % ! , , 62$B9 1. Drawing is not to scale. Table 85. SO8N - 8-lead plastic small outline, 150 mils body width, package data inches (1) millimeters Symbol Min Typ Max Min Typ Max A - - 1.750 - - 0.0689 A1 0.100 - 0.250 0.0039 - 0.0098 A2 1.250 - 0.0492 - - b 0.280 - 0.480 0.0110 - 0.0189 c 0.170 - 0.230 0.0067 - 0.0091 D 4.800 4.900 5.000 0.1890 0.1929 0.1969 E 5.800 6.000 6.200 0.2283 0.2362 0.2441 E1 3.800 3.900 4.000 0.1496 0.1535 0.1575 e - 1.270 - - 0.0500 - h 0.250 - 0.500 0.0098 - 0.0197 k 0 - 8 0 - 8 L 0.400 - 1.270 0.0157 - 0.0500 DocID024754 Rev 16 79/89 84 Package information M24SR04-Y M24SR04-G Table 85. SO8N - 8-lead plastic small outline, 150 mils body width, package data (continued) inches (1) millimeters Symbol Min Typ Max Min Typ Max L1 - 1.040 - - 0.0409 - ccc - - 0.100 - - 0.0039 1. Values in inches are converted from mm and rounded to 4 decimal digits. Figure 21. SO8N - 8-lead plastic small outline, 150 mils bosy width, package recommended footprint [ 2B621B)3B9 80/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G 15.2 Package information TSSOP8 package information Figure 22. TSSOP8 - 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch, package outline W > > 76623$0B9 1. Drawing is not to scale. / Table 86. TSSOP8 - 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch, package mechanical data inches (1) millimeters Symbol Typ Min Max Typ Min Max A - - 1.200 - - 0.0472 A1 0.050 - 0.150 0.0020 - 0.0059 A2 0.800 1.000 1.050 0.0315 0.0394 0.0413 b 0.190 - 0.300 0.0075 - 0.0118 c 0.090 - 0.200 0.0035 - 0.0079 CP - - 0.100 - - 0.0039 D 2.900 3.000 3.100 0.1142 0.1181 0.1220 e - 0.650 - - 0.0256 - E 6.200 6.400 6.600 0.2441 0.2520 0.2598 E1 4.300 4.400 4.500 0.1693 0.1732 0.1772 L 0.450 0.600 0.750 0.0177 0.02636 0.0295 L1 - 1.000 - - 0.0394 - 0 8 0 - 8 1. Values in inches are converted from mm and rounded to 4 decimal digits. DocID024754 Rev 16 81/89 84 Package information 15.3 M24SR04-Y M24SR04-G UFDFPN8 package information Figure 23. UFDFPN8 - 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package outline ' 1 $ % $ FFF 3LQ ,'PDUNLQJ ( $ & HHH & 6HDWLQJSODQH $ 6LGHYLHZ [ DDD & DDD & [ 7RSYLHZ ' H 'DWXP$ E / / / / 3LQ ,'PDUNLQJ ( . / H / H 7HUPLQDOWLS 'HWDLO$ (YHQWHUPLQDO 1'[ H %RWWRPYLHZ 6HH'HWDLO$ =:EB0(B9 1. Max package warpage is 0.05 mm. 2. Exposed copper is not systematic and can appear partially or totally according to the cross section. 3. Drawing is not to scale. 4. The central pad (the area E2 by D2 in the above illustration) must be either connected to VSS or left floating (not connected) in the end application. 82/89 DocID024754 Rev 16 M24SR04-Y M24SR04-G Package information Table 87. UFDFPN8 - 8- lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package mechanical data inches (1) millimeters Symbol Min Typ Max Min Typ Max A 0.450 0.550 0.600 0.0177 0.0217 0.0236 A1 0.000 0.020 0.050 0.0000 0.0008 0.0020 b(2) 0.200 0.250 0.300 0.0079 0.0098 0.0118 D 1.900 2.000 2.100 0.0748 0.0787 0.0827 D2 (rev MC) 1.200 - 1.600 0.0472 - 0.0630 E 2.900 3.000 3.100 0.1142 0.1181 0.1220 E2 (rev MC) 1.200 - 1.600 0.0472 - 0.0630 e - 0.500 - - 0.0197 - K (rev MC) 0.300 - - 0.0118 - - L 0.300 - 0.500 0.0118 - 0.0197 L1 - - 0.150 - - 0.0059 L3 0.300 - - 0.0118 - - aaa - - 0.150 - - 0.0059 bbb - - 0.100 - - 0.0039 ccc - - 0.100 - - 0.0039 ddd - - 0.050 - - 0.0020 - - 0.080 - - 0.0031 eee (3) 1. Values in inches are converted from mm and rounded to 4 decimal digits. 2. Dimension b applies to plated terminal and is measured between 0.15 and 0.30 mm from the terminal tip. 3. Applied for exposed die paddle and terminals. Exclude embedded part of exposed die paddle from measuring. DocID024754 Rev 16 83/89 84 Ordering information 16 M24SR04-Y M24SR04-G Ordering information Table 88. Ordering information scheme for packaged devices Example: M24 SR 04- Y MN 6 T /2 Device type M24 = I2C interface device Device feature SR = Short range Memory size 04 = memory size in Kbits Voltage range Y = 2.7 to 5.5 V G = 2.4 to 5.5 V, only available in grade 5 (-25 to 85 C) Package MN = SO8N DW = TSSOP8 MC = UFDFPN8 SG12I = 120 m 15 m bumped and sawn inkless wafer on 8-inch frame(1) Device grade 5 = industrial: device tested with standard test flow over -25 to 85 C 6 = industrial: device tested with standard test flow over -40 to 85 C (No parameter for SG12I) Option T = Tape and reel packing (No parameter for SG12I) Capacitance /2 = 25 pF 1. SG12I is only available for voltage range "G". Note: 84/89 Parts marked as ES or E are not yet qualified and therefore not approved for use in production. ST is not responsible for any consequences resulting from such use. In no event will ST be liable for the customer using any of these engineering samples in production. ST's Quality department must be contacted prior to any decision to use these engineering samples to run a qualification activity. DocID024754 Rev 16 M24SR04-Y M24SR04-G 17 Revision history Revision history Table 89. Document revision history Date Revision 13-Jun-2013 1 Initial release. 2 Added UFDFPN8 drawing on page 1. Edited Section 2.6: RF disable. Updated ICC0 parameter in Table 77: I2C DC characteristics and added a note. Added Section 15.3: UFDFPN8 package information and UFDFPN8 package. 28-Oct-2013 3 Updated the Capacitance value to 25 pF. Removed all "Battery assisted" and "Wire power management" information (conditioned for a future use). Moved GetI2Csession command before Section 5.10.2: KillRFsession command. Added 2 new sections: Section 7.4: IC token release sequence and Section 7.5: IC timeout on clock period. Removed "DID field" information from Section 7.9: IC frame format and from Table 69 to Table 71 Updated different values in Table 73: Absolute maximum ratings, Table 74: I2C operating conditions, Table 77: I2C DC characteristics, Table 78: I2C AC characteristics (400 kHz), Table 79: I2C AC characteristics (1 MHz), and Table 84: RF characteristics, and removed all "(forecast data)" from the table titles. Moved RF characteristics table before Table 84: RF characteristics, deleted footnote (1) and updated footnote (2). Fully edited. 08-Nov-2013 4 Added a note to Section 7.1: I2C communication protocol below Figure 12: Command and response exchange. 5 Changed the datasheet status from "Preliminary data" to "Production data". Restored the whole content of Table 77: I2C DC characteristics. Updated the capacitor values in Section 2.5.1: Operating supply voltage VCC. Removed bullet (4) from Section 8.6: Reaching the read-only state for an NDEF file. Updated VESD value in Table 73: Absolute maximum ratings, ICC values in Table 77: I2C DC characteristics, and H_Extended value in Table 84: RF characteristics. Added details to "S(WTX)" bullet in Section 5.4: S-Block format. Added sentences to Section 5.6.8: UpdateBinary command and to Section 5.8.3: DisablePermanentState command. Changed `0x001E' value into `0x001F' in Table 56: StateControl command format. Updated values in Table 61: ATS response. Added Note (4) to Figure 10: Changing the read access right to an NDEF file and Figure 11: Changing the write access right to an NDEF file. 29-Aug-2013 18-Dec-2013 Changes DocID024754 Rev 16 85/89 88 Revision history M24SR04-Y M24SR04-G Table 89. Document revision history (continued) Date 26-Feb-2014 11-Jun-2014 20-Nov-2014 20-Aug-2015 86/89 Revision Changes 6 Updated Figure 5: GPO configured as I2C answer ready (GPO field = 0xX3) and Figure 8: GPO configured as State Control (GPO field = 0xX5 or 0x5X). Added I2C text to the Note below Table 22: S-Block detailed format. Edited the third paragraph of Section 5.8.1: ExtendedReadBinary command. Added Section 5.8.4: UpdateFileType command and Section 8.8: Changing a File type Procedure. Updated bullet 3 in Section 7.9: IC frame format, and the Payload row of Table 70: I2C host to M24SR04. Updated bullet 2 in Section 7.11: Close the IC session. Edited VIO row and removed VESD (machine model) row from Table 73: Absolute maximum ratings. Updated ICC rows and added a Note to Table 77: I2C DC characteristics. Updated Figure 20: SO8N - 8-lead plastic small outline, 150 mils body width, package outline. Fixed a typo in Figure 23: UFDFPN8 - 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package outline title: UFDPFN8 changed into UFDFPN8. 7 Added data for automotive grade in Table 6: Field list and Table 72: UID format Added WFDFPN8 package for automotive grade under qualification Added Figure 24: WFDFPN8 (MLP8) 8-lead, 2 x 3 mm, 0.5 mm pitch very thin fine pitch dual flat package outline Added WFDFPN8 package for automotive grade under qualification Added Table 88: WFDFPN8 8-lead thin fine pitch dual flat package no lead mechanical data Added MF = WFDFPN8 inside Table 88: Ordering information scheme for packaged devices Inserted byte <04> between A4 and 00 inside Figure 14: NDEF tag Application Select command 8 Added: - New Root Part Number on cover page - single supply voltage for I2C for grade G and note (1) Updated: - Figure 14 - Figure 73,Figure 74, Figure 77, Figure 78, Figure 83, Figure 88 9 Added - Figure 21: SO8N - 8-lead plastic small outline, 150 mils bosy width, package recommended footprint Updated - Section 15: Package information - Table 73: Absolute maximum ratings - Table 74: I2C operating conditions - Table 78: I2C AC characteristics (400 kHz) - Table 88: Ordering information scheme for packaged devices DocID024754 Rev 16 M24SR04-Y M24SR04-G Revision history Table 89. Document revision history (continued) Date 04-Mar-2016 27-Apr-2016 14-Oct-2016 18-Nov-2016 07-Feb-2017 Revision Changes 10 Updated: - Features - Section 2.7.6: State Control configuration (GPO field = 0xX5 or 0x5X) Added: - Table 7: Details about I2C watchdog - Table 82: Write cycle definition 11 Updated: - Features - Table 73: Absolute maximum ratings - Table 82: Write cycle definition Added: - Section 13: Write cycle definition 12 Updated: - Section 3.2.2: Changing the read access right to NDEF files - Section 3.2.3: Changing the write access right to NDEF files - Section 5.6.5: NDEF Select command - Section 5.8.4: UpdateFileType command - Section 5.8.5: SendInterrupt command - Section 8.2: Reading of an NDEF message - Section 8.5: Unlocking an NDEF file - Section 8.6: Reaching the read-only state for an NDEF file - Section 16: Ordering information Added: - Section 8.9: Updating a NDEF file 13 Updated: - Table 35: R-APDU of the ReadBinary command - Table 47: R-APDU of the ExtendedReadBinary command - Table 88: Ordering information scheme for packaged devices 14 Added: - Note 4. on Figure 23.: UFDFPN8 - 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package outline Updated: - Table 88: Ordering information scheme for packaged devices DocID024754 Rev 16 87/89 88 Revision history M24SR04-Y M24SR04-G Table 89. Document revision history (continued) Date 08-Feb-2017 12-Sep-2017 88/89 Revision Changes 15 Package SB12I replaced with SG12I. Updated: - Table 73: Absolute maximum ratings - Table 88: Ordering information scheme for packaged devices 16 Updated: - Features - Table 6: Field list - Table 20: R-Block detailed format - Table 72: UID format - Table 74: I2C operating conditions - Table 78: I2C AC characteristics (400 kHz) - Table 86: TSSOP8 - 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch, package mechanical data - Table 88: Ordering information scheme for packaged devices - Figure 10: Changing the read access right to an NDEF file - Figure 11: Changing the write access right to an NDEF file - Figure 15: AC test measurement I/O waveform - Figure 16: I2C AC waveforms - Figure 19: I2C bus protocol - Figure 22: TSSOP8 - 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch, package outline - Section 16: Ordering information Deleted: - Section 15.4: WFDFPN8 package information - Figure 24: WFDFPN8 (MLP8) 8-lead, 2 x 3 mm, 0.5 mm pitch very thin fine pitch dual flat package outline - Table 88: WFDFPN8 8-lead thin fine pitch dual flat package no lead mechanical data DocID024754 Rev 16 M24SR04-Y M24SR04-G IMPORTANT NOTICE - PLEASE READ CAREFULLY STMicroelectronics NV and its subsidiaries ("ST") reserve the right to make changes, corrections, enhancements, modifications, and improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on ST products before placing orders. ST products are sold pursuant to ST's terms and conditions of sale in place at the time of order acknowledgement. Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or the design of Purchasers' products. No license, express or implied, to any intellectual property right is granted by ST herein. Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product. ST and the ST logo are trademarks of ST. All other product or service names are the property of their respective owners. Information in this document supersedes and replaces information previously supplied in any prior versions of this document. (c) 2017 STMicroelectronics - All rights reserved DocID024754 Rev 16 89/89 89 Mouser Electronics Authorized Distributor Click to View Pricing, Inventory, Delivery & Lifecycle Information: STMicroelectronics: M24SR04-YMN6T/2 M24SR04-YMC6T/2 M24SR04-YDW6T/2 M24SR04-GMC5T/2