Preliminary
This is a product that has fixed target specifications but are Ramtron International Corporation
subject to change pending characterization results. 1850 Ramtron Drive, Colorado Springs, CO 80921
(800) 545-FRAM, (719) 481-7000
http://www.ramtron.com
Rev. 1.4
May 2011 Page 1 of 24
WM71004 / WM71008 / WM71016
4/8/16Kbit Secure F-RAM Memory with
Gen-2 RFID Access
DESCRIPTION
The WM710xx is a RFID transponder IC with
nonvolatile memory employing an advanced
ferroelectric process. A ferroelectric random access
memory, or F-RAM, is nonvolatile and performs
reads and writes like a RAM. It provides reliable data
retention for 20 years while eliminating the
complexities, overhead, and system level reliability
problems caused by EEPROM and other nonvolatile
memories.
Unlike EEPROM‟s, the WM710xx write operations
are zero power – there is no power or speed premium
paid for executing writes into the WM710xx as
compared to read power and speed. Operation of the
memory is fully symmetric: it has an equivalent read
and write range.
The WM710xx‟s RFID interface is compatible with
the EPC Class-1 Generation-2 UHF RFID Protocol
for Communications at 860 MHz – 960 MHz,
Version 1.2.0 Specification for RFID Air Interface.
The WM710xx is a two chip configuration offered in
various forms: standard IC package or wafers. All
specifications discussed herein are applicable to the
combined chipset operation.
Figure 1. System Block Diagram
FEATURES
4/8/16 Kbit Ferroelectric Nonvolatile RAM
Organized as 256/512/1024 x 16 bits
Very High Read/Write Endurance (> 1014)
20-Year Data Retention
Gamma Stability Demonstrated to > 30 kGy
Symmetric Read/Write Operation
Advanced High-Reliability Ferroelectric Process
Interface and Security Features
EPC Class 1 Gen2 (ISO18000-6C) RFID
Compatible Interface (revision 1.2.0)
192-Bit Memory: 96-Bit Electronic Product
Code™ (EPC), 32-Bit Access Password, 32-Bit
KILL Password, 64-Bit TID Memory (Factory
Programmed and Locked)
Inventory, Read, Write and Erase features
Kill Command
Block Permalock Command
Access Command
UHF carrier frequencies from 860 MHz to 960
MHz ISM band, ASK demodulation
Tag-to-reader link frequencies up to 640Kbps
Reader-to-tag asymptotical transmission rates up
to 128Kbps
Supports FM0 and MMS data encoding formats
Custom Features
Stored Address Pointer to Improve Data Write
Speed
Stored Address Pointer Lock
Block Write Command
Variable USER Memory Block Size Support
Ultra Low Power Operation
Memory Read/Write Sensitivity: < -6 dBm (typ.)
Industry Standard Configurations
Industrial Temperature -40 C to +85 C
Bumped Wafers
8-pin UDFN
WM71016
RFID Tag
with F-RAM
RFID
Reader
(Class-1
Gen-2)
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 2 of 24
PIN CONFIGURATION (UDFN PACKAGE)
Top View
(PCB Layout)
8
7
6
5
1
2
3
4
NC ANT-
ANT+
NC
NC
NC
NC
NC
3.0 mm × 3.0 mm body, 0.65 mm pad pitch
PIN DESCRIPTION
Pin Name
Pin Number
Type
Description
ANT+, ANT-
7, 8
Input
RFID Antenna. Connect to external RFID antenna terminals.
NC
1, 2, 3, 4, 5, 6
-
There is no internal connection.
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 3 of 24
FUNCTIONAL DESCRIPTION
The WM710xx is a non-volatile memory device with an industry standard UHF RFID interface that enables
processing data in and out of memory as a generic passive RFID transponder. Unlike other transponder ICs,
the WM710xx transponder IC contains high density symmetric read/write F-RAM memory that enables unique
applications of an RFID solution.
When combined with an appropriate antenna design, WM710xx will power up with energy harvested directly
from the RF field. Following an internally generated reset state, the IC configures itself according to pre-
programmed configuration settings that were stored in F-RAM non-volatile memory at wafer probe, packaged
parts test, or end unit transponder personalization at end-user depot. Configuration settings are read out of
memory and applied prior to enabling data transmission in or out of memory.
As specified in the Gen2 standard, the chip receives and processes commands transmitted by the RFID
interrogator (reader). All required and most optional commands are supported. In addition to these,
WM710xx supports a number of custom commands that take advantage of F-RAM‟s unique ultra low power
and symmetrical characteristics.
Referring to Figure 2, the transponder IC‟s consist of an RFID interface, control and authentication logic, F-
RAM memory, and power management unit. The external antenna is connected directly to the RFID interface
where the RF signal is rectified with high efficiency Schottky diode based rectifier. The rectified voltage is
multiplied up within the Schottky array and then regulated to supply power to on-chip resources.
Also included in the RFID Interface is a modulator/demodulator that detects incoming signals and modulates
the input impedance to enable backscattering of returned signals. The control and authentication logic
processes commands to enable access in and out of F-RAM memory.
Figure 2. Block Diagram
Power
Management
RFID
Interface
Control and
Authentication
Logic
F-RAM Array
(16Kb)
External
MCU
(Optional)
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 4 of 24
MEMORY MAP
WM710xx‟s memory is partitioned according to the logical and physical mapping shown in Table 1 below.
Table 1: Memory Map
DSPI
Address
Gen-2
Memory Bank
Gen-2
Address
Word
Pointer
(EBV8)
Description
0x000
RESERVED
0x000
0x00
Kill Password[31:16]
0x001
RESERVED
0x001
0x01
Kill Password[15:0]
0x002
RESERVED
0x002
0x02
Access Password[31:16]
0x003
RESERVED
0x003
0x03
Access Password[15:0]
0x004
EPC
0x000
0x00
CRC
0x005
EPC
0x001
0x01
PC
0x006
EPC
0x002
0x02
EPC - Word 0 (MSW)
0x007
EPC
0x003
0x03
EPC - Word 1
0x008
EPC
0x004
0x04
EPC - Word 2
0x009
EPC
0x005
0x05
EPC - Word 3
0x00A
EPC
0x006
0x06
EPC - Word 4
0x00B
EPC
0x007
0x07
EPC - Word 5 (LSW)
0x00C
EPC
0x008
0x08
EPC - read memory
0x00D
EPC
0x009
0x09
EPC - read memory
0x00E
SERVICE
0x00A
0x0A
RESERVED
0x00F
SERVICE
0x00B
0x0B
RESERVED
0x010
TID
0x000
0x00
TID - Word 0: xE201
0x011
TID
0x001
0x01
TID - Word 1: x6216
0x012
TID
0x002
0x02
TID - Word 2: Serial #1
0x013
TID
0x003
0x03
TID - Word 3: Serial #2
0x014
USER
0x000
0x00
RESERVED
0x015
USER
0x001
0x01
RFU
0x016
USER
0x002
0x02
Control/Status Register
0x017
USER
0x003
0x03
Working Stored Address Register
0x018
USER
0x004
0x04
0x019
USER
0x005
0x05
0x01A
USER
0x006
0x06
USER Memory - Start
0x01B
USER
0x007
0x07
0x0FE
USER
0x0EA
0x816A
0x0FF
USER
0x0EB
0x816B
0x100
USER
0x0EC
0x816C
0x101
USER
0x0ED
0x816D
…
…
…
…
0x1FE
USER
0x1EA
0x836A
0x1FF
USER
0x1EB
0x836B
0x200
USER
0x1EC
0x836C
0x201
USER
0x1ED
0x836D
…
…
…
…
0x3BA
USER
0x3A6
0x8726
0x3BB
USER
0x3A7
0x8727
16k Memory: END
(BLK_SIZE = 1 word/block)
0x3BC
USER
0x3A8
0x8728
0x3BD
USER
0x3A9
0x8729
0x3BE
USER
0x3AA
0x872A
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 5 of 24
DSPI
Address
Gen-2
Memory Bank
Gen-2
Address
Word
Pointer
(EBV8)
Description
…
…
…
…
0x3DA
USER
0x3C6
0x8746
0x3DB
USER
0x3C7
0x8747
16k Memory: END
(BLK_SIZE = 2 words/block)
0x3DC
USER
0x3C8
0x8748
0x3DD
USER
0x3C9
0x8749
0x3DE
USER
0x3CA
0x874A
…
…
…
…
0x3EA
USER
0x3D6
0x8756
0x3EB
USER
0x3D7
0x8757
16k Memory: END
(BLK_SIZE = 4 words/block)
0x3EC
USER
0x3D8
0x8758
0x3ED
USER
0x3D9
0x8759
0x3EE
USER
0x3DA
0x875A
…
…
…
…
0x3F3
USER
0x3DF
0x875F
16k Memory: END
(BLK_SIZE = 8 words/block)
0x3F4
USER
0x3E0
0x8760
0x3F5
USER
0x3E1
0x8761
0x3F6
USER
0x3E2
0x8762
0x3F7
USER
0x3E3
0x8763
16k Memory: END
(BLK_SIZE = 16 words/block)
0x3F8
USER
0x3E4
0x8764
0x3F9
USER
0x3E5
0x8765
16k Memory: END
(BLK_SIZE = 32 words/block)
0x3FA
USER
0x3E6
0x8766
0x3FB
USER
0x3E7
0x8767
(BLK_SIZE > 32 words/block)
0x3FC
USER
0x3E8
0x8768
RESERVED
0x3FD
USER
0x3E9
0x8769
RESERVED
0x3FE
USER
0x3EA
0x876A
RESERVED
0x3FF
USER
0x3EB
0x876B
RESERVED
GEN2 WM710XX MEMORY BANKS
The RFID memory banks reside in Ramtron‟s non-volatile F-RAM memory. F-RAM brings many benefits to
the WM710xx. The first benefit is the size of the memory itself – up to 16k-bit, most of which is available in
the USER memory bank. F-RAM‟s impact on the Gen2 protocol is most dramatically seen when writing to
WM710xx memory. Unlike EEPROM memory, no charge pump or memory soak time is required to write to
WM710xx memory, resulting in zero time and zero power penalties. The write cycle is completed
immediately, allowing an interrogator to continue writing additional data to memory with no time penalty
incurred due to the memory itself. A comparison between F-RAM and EEPROM memories is shown in Figure
3. The figure shows the minimum number of Gen2 instructions required to perform a SELECT,
INVENTORY, and ACCESS sequence of commands to write a data word to memory. The same interrogator
command sequence is transmitted to the WM710xx and an EEPROM-based RFID. The effect of the EEPROM
time penalty is shown within the context of the protocol.
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 6 of 24
INTERROGATOR
TAG
MaxArias Write Cycle
QURY
(240u)
SELECT
(385u) ACK
(175u) REQRN
(345u)
EPC
(228u)
WRITE
(495u)
RN
(53u) HANDLE
(78u) WR_OK
(80u)
REQRN
(345u)
RN16
(78u)
EEPROM write delay!
Charge pump & EE soak time
EEPROM-based Write Cycle
4ms
Figure 3. Gen2 Memory Write Cycle Comparison: F-RAM vs. EEPROM Memories
RESERVED: KILL Password:
The kill password provides a mechanism to permanently disable the WM710xx RFID from responding to any
and all Gen2 interrogator commands. The mandatory KILL command can be issued by a RFID interrogator in
either the OPEN or SECURED states. The WM710xx is permanently killed through a four-instruction
sequence of REQRN and KILL commands as detailed in the Gen2 standard. The KILL password is a 32-bit
value stored as 2 16-bit data words in reserved memory. The most significant KILL password is stored in
reserved memory bank address 0x00 with the least significant word stored in reserved memory bank address
0x01. The kill function can be permanently disabled by setting both KILL password words to 0x0000, and
permanently locking the KILL password in the reserved memory bank. Once the kill password has been set, it
should be permanently locked using the LOCK command. The WM710xx is shipped from the factory with the
kill password memory unlocked.
RESERVED: ACCESS Password:
The access password provides a security mechanism to prevent unauthorized RFID interrogators from writing
to WM710xx memory. Non-zero access passwords require the WM710xx be placed in the SECURED state
prior to writing to it. This is accomplished through four consecutive REQRN and ACCESS commands as
described in the Gen2 standard. An access password with a value of zero requires no authentication prior to
writing to WM710xx memory. The ACCESS password is a 32-bit value stored as 2 16-bit data words in
reserved memory. The most significant ACCESS password is stored in reserved memory bank address 0x02
with the least significant word stored in reserved memory bank address 0x03. Once the access password has
been set, it should be permanently locked using the LOCK command. The WM710xx is shipped from the
factory with the access password memory unlocked.
EPC Memory Bank:
The EPC memory bank accommodates 8 words: 1 protocol control (PC) word, a 6-word (96-bit) memory space
for an EPC identifier, and a 1-word CRC. The CRC word is calculated as part of the WM710xx power-on
initialization routine and written into the EPC memory bank address 0x00. The PC and 6-word EPC identifier
are completely programmable. The Protocol Control field is shown in Figure 4.
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 7 of 24
00110 000000000 01
DEFAULT
Numbering System Identifier
NSI Type
Extended Protocol Control
User Memory identifier
EPC Identifier Word Length
LEN NSIXPC NTUMI
15 11 910 8 7 0bit
PROTOCOL CONTROL WORD
Figure 4. EPC Protocol Control Word
The five most significant bits of the PC indicates the size of the EPC identifier in words – for a 96-bit (6-word)
EPC identifier, the PC should be programmed to 0b0011_0xxx_xxxx_xxxx. The LEN parameter of the PC
word may not be greater than 0b00110 – a LEN parameter of 0b00000 has an EPC identifier length of zero
words resulting in only the PC and CRC words when WM710xx is acknowledged. The UMI bit (User
Memory Identifier) is asserted to a logic one by WM710xx and mapped to bit 10 of the PC word. In the event
the host writes a logic zero to the UMI bit, the memory location will be written with a logic zero, however the
backscattered EPC identifier will assert the UMI bit to a logic one which is also used in the calculation of the
CRC. WM710xx does not support extended protocol control and should be written with a logic zero. PC word
bits 8 down to 0 of the PC word are factory-initialized to zero. The WM710xx is shipped from the factory with
the EPC memory bank unlocked.
TID Memory Bank:
The TID memory bank consists of 4 words (64 bits), and is defined as shown in Table 2. The TID memory
bank is permanently locked at the factory and obeys the ISO/IEC 15963 numbering convention.
Table 2: TID memory Bank Fields
Class Identifier MDID[11:4]
MDID[3:0] TMN[11:0]
ID[31:16]
ID[15:0]
0 7 8 15
16 20 31
32 47
48 63
19
Figure 5. TID Memory Bank Fields
Bit Field
Value
(hex)
Description
00h – 07h
E2
ISO/IEC 15963 class-identifier
08h – 13h
016
Mask-Designer Identifier (MDID) – Ramtron International
14h – 1Fh
216
Tag model number
20h – 3Fh
32-bit unique identifier
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 8 of 24
USER Memory Bank:
The USER memory bank comprises two special-function control words, factory-reserved words, and up to 993
available memory locations. Refer to Table 1 for detail on the WM710xx memory structure. The USER
memory bank may be completely locked through the LOCK command. WM710xx also supports the
BLOCKPERMALOCK command providing the ability to lock contiguous words of USER memory, with word
block sizes as small as a single word up to a maximum block size of 128 words. The USER memory bank
ships from the factory completely unlocked.
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 9 of 24
TAG-TO-READER DATA ENCODING
The WM710xx supports both encoding formats defined in the Gen2 standard:
FM0 baseband (FM0)
Miller modulation of a subcarrier (MMS)
Data encoding is performed in the WM710xx as described in the Gen2 standard. A FM0 data symbol is
transmitted with period T which is defined by the tag-to-reader link frequency. The difference between a logic 0
and a logic 1 is defined by an additional mid-bit transition for a logic 0 as shown below in Figure 6. Data
encoding using Miller modulation of a subcarrier (MMS) is further defined by a rate parameter M that defines the
number of link frequency cycles per data bit: 2, 4, or 8, resulting in data encoding defined as MMS2, MMS4, or
MMS8 respectively. MMS data encoding results in a phase inversion of the sub-carrier frequency when one of
the following conditions occurs:
At the mid-bit of a logic 1 data bit, or
At the bit-boundary of two consecutive logic 0s.
The following set of four figures depicts the data bit values “00”, “01”, “10” and “11” for FM0 and MMS data
encoding formats. The same link frequency is shown for all cases, however the MMS parameter M lengthens the
baseband bit period by 2, 4, or 8 as shown in Figure 7, Figure 8, and Figure 9.
0 T 2T
11
10
01
00
Figure 6. FM0 Data Encoding
0 2T 4T
11
10
01
00
Figure 7. MMS2 Data Encoding
11
10
01
00
0 4T 8T
Figure 8. MMS4 Data Encoding
11
10
01
00
0 8T 16T
Figure 9. MMS8 Data Encoding
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 10 of 24
CONTROL/STATUS REGISTER
Accessing the unique features of WM710xx is accomplished through the Control/Status register in F-RAM
non-volatile memory. The register is located at physical address 0x016 or USER memory address 0x002.
The Control/Status word register is organized as shown in Table 3: below. Care should be exercised when
writing the Control/Status register word if it is to remain unlocked.
LCK PLCK RFU BW
EN BLKSIZ WRP WRP
EN ALCK AINC
Figure 10. Control/Status Register
Table 3: Control/Status Word Register
Bit
Mnemonic
Function
Initial
Value
15
LOCK
Memory locking of this register.
LOCK
PERMALOCK
DESCRIPTION
0
0
Register unlocked
0
1
Register permanently unlocked
1
0
Register writeable only from the
SECURED state
1
1
Register permanently locked
0
14
PERMALOCK
0
13
RFU
Reserved for future use
0
12
RFU
Reserved for future use
0
11
RFU
Reserved for future use
0
10
RFU
Reserved for future use
0
9
RFU
Reserved for future use
0
8
RFU
Reserved for future use
0
7
BLKWREN
Enables use of the custom command BLOCKWRITE.
1
6
BLKSIZ[2]
USER memory block size.
BLKSIZ[2:0]
# words
BLKSIZ[2:0]
# words
000
1
100
16
001
2
101
32
010
4
110
64
011
8
111
128
1
5
BLKSIZ[1]
1
4
BLKSIZ[0]
0
3
WRPSTAT
Indicates if the Working Stored Address has wrapped.
Logic State
Description
0
Wrapping has not occurred
1
Wrapping has occurred at least once
0
2
WRPEN
Enables wrapping of the Working Stored Address when it reaches the
top of logical memory.
Logic State
Description
0
DISABLE memory wrapping
1
ENABLE memory wrapping.
0
1
AUTOLOCK
Enable Automatic Locking of all user memory between the start of USER
memory and the Working Stored Address register.
Logic State
Description
0
Auto-lock DISABLED
1
Auto-lock ENABLED
0
0
AUTOINCR
Enable the Working Stored Address word to Auto-Increment when
performing an unaddressed write cycle.
Logic State
Description
0
DISABLE auto-increment of stored address register
1
ENABLE auto-increment of stored address register
0
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 11 of 24
Upon power up, WM710xx‟s control logic reads the Control/Status word out of memory and configures itself
accordingly. User applications may change the Control Word as needed providing the register has not been
permanently locked. The Control/Status word may be read by the application at any time.
Register Locking: The LOCK and PERMALOCK control bits are implemented in a similar manner as locking
bits used for Gen2 memory bank locking with the exception that the lock control bits are incorporated into the
register they are locking. As such, attention needs to be placed on how the contents of the Control/Status word
are written when the register is not completely unlocked.
Table 4: Control/Status Word Locking
LOCK
PERMA-
LOCK
Description
0
0
Register unlocked. All control bits, including the LOCK and PERMALOCK bits can
be written to from the OPEN or SECURED states.
0
1
Register permanently unlocked. All control bits can be written from the OPEN or
SECURED states. The LOCK and PERMALOCK bits must be set to logic values 0
and 1 respectively when writing the Control/Status word.
1
0
Register locked. All control bits can be written to only from the SECURED state.
The register cannot be written to in the OPEN state. The LOCK and PERMALOCK
bits must be set to logic values 1 and 0 respectively when writing the Control/Status
word.
1
1
Register permanently locked. The register cannot be written in any circumstance.
Block Write Enable: The BLKWREN control bit enables usage of the WM710xx custom command
BLOCKWRITE. The BLKWREN parameter is internally updated during power-on WM710xx initialization.
In the event the host application toggles the state of BLKWREN, a WM710xx power cycle is required to reflect
the change.
Block Size: The 3 BLKSIZ[2:0] control bits adjust the USER memory block sizes as shown in Table 5:. This
provides the RFID application the ultimate flexibility in determining a balance between the USER memory
requirements and the granularity of the number of USER memory words per block. For the WM71016, the
larger the granularity of the block size, the greater amount of available USER memory; block size has no effect
on WM71004 or WM71008 memory. The effect of the block size on available USER memory is shown in
Table 1. The total number of USER memory words available as a function of the block size is shown in Table 5
below. It is of utmost importance that the 3-bit block size is not modified once set, which would result in
corruption of block permalock status bits.
Table 5: Available USER Memory
Memory
BLKSIZ
Words/Block
Free USER Memory
(words)
4k
xxx
x
230
8k
xxx
x
486
16k
000
1
931
16k
001
2
963
16k
010
4
979
16k
011
8
987
16k
100
16
991
16k
101
32
993
16k
110
64
993
16k
110
128
993
Wrap Status: The WRPSTAT status bit is asserted to a logic one when the following conditions are true:
(a) WRPEN=1, AUTOINCR=1 and AUTOLOCK=0,
(b) The contents of the Working Stored Address register address the last USER memory location, and
(c) An unaddressed WRITE command is received.
The WRPSTAT can be cleared by the RFID interrogator by writing a logic zero to the WRPSTAT bit.
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 12 of 24
Wrap Enable: Asserting the WRPEN control bit to a logic one enables the USER memory wrapping feature.
The wrap enable feature allows the stored address pointer to wrap back to the factory-set initial stored address
value of 0x006. In this manner, the WM710xx memory acts as a circular buffer. Clearing the WRPEN control
bit disables wrapping resulting in a write-once memory. In this case, when the Working Stored Address
reaches the end of user memory, no additional unaddressed write cycles will be possible. The WRPEN and
AUTOLOCK control bits are mutually exclusive – only one of the two control bits may be asserted at any
given time.
Auto Lock Enable: Asserting the AUTOLOCK control bit to a logic one enables memory locking of the USER
memory span between the start of USER memory and the Working Stored Address. The AUTOLOCK and
WRPEN control bits are mutually exclusive – only one of the two control bits may be asserted at any given
time. The automatic locking feature can only be used when AUTOINCR is asserted to a logic one.
Auto Increment: Asserting AUTOINCR control bit to a logic one enables the Working Stored Address
increment function. Upon receiving an unaddressed write cycle, the WM710xx increments the pointer stored
in the Working Stored Address register to point to the next free memory location then writes the cover-coded
data word to the respective memory location. This functionality removes any requirement for a RFID
interrogator to determine where free USER memory is located and manipulating the memory pointer itself.
WORKING STORED ADDRESS
To better utilize the F-RAM‟s fast write capability, memory has been architected using an optional Working
Stored Address register. The stored address function enables automation of the storage of large blocks of user
data, such as pedigree or tracking information. This feature enables a RFID interrogator the ability to use a
standard Gen2 WRITE command using a designated address of 0x3FFF (0xFF7F EBV-formatted) as a redirect
pointer to use the contents of the Working Stored Address register – this is referred to as an unaddressed write
(UNADDR_WRITE). The Working Stored Address is a USER memory address pointer addressing the last
unaddressed memory write cycle as shown in Figure 12 below. The Working Stored Address is a read/write
register located in USER memory, address 0x003. It may be manually updated by simply writing to USER
memory address 0x003 or automatically increment when the AUTOINCR control bit in the Control/Status
register is asserted to a logic one and an unaddressed write command is received.
LCK INIT
EN
RFU ADDR[9:0]PLCK
Figure 11. Working Stored Address Register
Table 6: Working Stored Address – Bit Definitions
Bit
Mnemonic
Function
Initial
Value
15
LOCK
Memory locking of this register.
LOCK
PERMALOCK
DESCRIPTION
0
0
Register unlocked
0
1
Register permanently unlocked
1
0
Register writeable only from the
SECURED state
1
1
Register permanently locked
0
14
PERMALOCK
0
13:11
RFU
Reserved for future use
0
10
INITEN
When asserted to a logic ‘1’, sets the contents of the Initial Stored
Address register with the value defined in the 10-bit address field in bits
9 through 0 written to this register using a Gen2 write instruction.
0
9:0
ADDR
Working stored address pointer
006
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 13 of 24
Working Stored
Address Pointer
Gen-2 Memory
Bank
Gen-2 Address
Description
RESERVED
0x000 - 0X003
RESERVED - passwords
MEMORY UNAVAILABLE
EPC
0x000 - 0x009
EPC
SERVICE
0x00A
RESERVED
SERVICE
0x00B
RESERVED
TID
0x000 - 0x003
TID
USER
0x000
RESERVED
USER
0x001
RFU
USER
0x002
Control/Status Register
USER
0x003
Working Stored Address Register: 0x0006
USER
0x004
USER
0x005
USER
0x006
USER Memory - START
AVAILABLE
MEMORY
USER
0x007
USER
0x008
USER
…
…
USER
USER Memory - END
Figure 12. USER Memory Bank: Working Stored Address Register
The syntax for an unaddressed write command is shown in Error! Reference source not found.. All protocol
equirements governing implementation of a WRITE command also apply to the UNADDR_WRITE command.
WRITE
(0xC3) Membank
(0b11) WordPtr
(0xF7FF) 16-bit Data (cover-coded)
(0xNNNN)Handle
(0xHHHH)CRC-16
(0xCCCC)
Figure 13. Unaddressed Write Syntax
Upon reception of a valid UNADDR_WRITE command, the WM710xx examines the state of the AUTOINCR
control bit:
AUTOINCR=0: The 16-bit data word cover-coded in the unaddressed write instruction is written to the
memory address stored in the Working Stored Address register. The contents of the Working Stored
Address register remain unaltered. To avoid the memory being over-written, the Working Stored Address
register must be manually updated.
AUTOINCR=1: The Working Stored Address register is incremented by one, followed by the 16-bit data
word being written to memory. The contents of the Working Stored Address register will reflect the
memory address just written to. A single unaddressed write cycle is shown in Figure 14 with the
AUTOINCR control bit set to a logic one. The Working Stored Address has an initial value of 0x0006 as
shown in Figure 12. An unaddressed write cycle (with AUTOINCR=1) increments the address pointer to
0x0007 followed by a write cycle to the WM710xx memory resulting in data word DATA0 being written
to USER memory address 0x007. Figure 15 depicts an additional seven discrete unaddressed write cycles
(REQRN command for cover-coding not shown). Prior to unaddressed write commands, the Working
Stored Address has a memory address of addrn. An unaddressed write command with data payload
DATAn is written to addrn+1; the following unaddressed write command with data payload DATAn+1 is
written to addrn+2, and so on. Upon completion of the final unaddressed write command, the memory
pointer contents of the Working Stored Address will be addrn+8, reflecting the memory address of the last
unaddressed write cycle. In this manner, the RFID interrogator does not have to read the memory
contents to discern the next available memory location. This substantially reduces the time required
in the RF field yielding greater throughput of a population of tags.
The Working Stored Address pointer will be factory-initialized to the start of USER memory then
managed by the memory controller or the host application as required.
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 14 of 24
Working Stored
Address Pointer
Gen-2 Memory
Bank
Gen-2 Address
Description
RESERVED
0x000 - 0X003
RESERVED - passwords
MEMORY UNAVAILABLE
EPC
0x000 - 0x009
EPC
SERVICE
0x00A
RESERVED
SERVICE
0x00B
RESERVED
TID
0x000 - 0x003
TID
USER
0x000
RESERVED
USER
0x001
RFU
USER
0x002
Control/Status Register
USER
0x003
Working Stored Address Register: 0x0007
USER
0x004
USER
0x005
USER
0x006
USER Memory - START
AVAILABLE
MEMORY
USER
0x007
UNADDR_WRITE: DATA0
USER
0x008
USER
…
…
USER
USER Memory - END
Figure 14. Single Unaddressed Write Cycle, AUTOINCR=1
Working Stored
Address Pointer
Gen-2 Memory
Bank
Gen-2 Address
Description
RESERVED
0x000 - 0X003
RESERVED - passwords
MEMORY UNAVAILABLE
EPC
0x000 - 0x009
EPC
SERVICE
0x00A
RESERVED
SERVICE
0x00B
RESERVED
TID
0x000 - 0x003
TID
USER
0x000
RESERVED
USER
0x001
RFU
USER
0x002
Control/Status Register
USER
0x003
Working Stored Address Register: 0x000E
USER
0x004
USER
0x005
USER
0x006
USER Memory - START
AVAILABLE MEMORY
USER
0x007
UNADDR_WRITE: DATA0
USER
0x008
UNADDR_WRITE: DATA1
USER
0x009
UNADDR_WRITE: DATA2
USER
0x00A
UNADDR_WRITE: DATA3
USER
0x00B
UNADDR_WRITE: DATA4
USER
0x00C
UNADDR_WRITE: DATA5
USER
0x00D
UNADDR_WRITE: DATA6
USER
0x00E
UNADDR_WRITE: DATA7
USER
0x00F
USER
0x010
USER
0x011
…
…
…
…
…
…
USER Memory - END
Figure 15. Multiple Unaddressed Write Cycles, AUTOINCR=1
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 15 of 24
INITIAL STORED ADDRESS
The Initial Stored Address is a preset address pointer that is loaded into the Working Stored Address when a
memory wrap occurs after an unaddressed write command is executed. A memory wrap only occurs if the
WRPEN control bit is asserted to a logic one and the AUTOLOCK control bit is cleared to a logic zero in the
Control/Status register and the Working Stored Address points to the last free memory location in the USER
memory bank (last memory location depends on the set block size).
The contents of the Initial Stored Address may be altered by setting the INITEN bit to a logic one through a
Gen2 write cycle to the Working Stored Address register – refer to Table 6 above. When the INITEN control
bit is set during a write cycle, the contents of the Working Stored Address register in USER memory 0x003 are
not affected.
Use of an Initial Stored Address register provides flexibility when using the wrap enable feature of WM710xx.
It may be set to the start of USER memory, allowing the entire USER memory bank to be utilized.
Alternatively, it may be set to a higher memory address within the USER memory bank. This mechanism
would provide for a static USER memory bank and a dynamic USER memory bank as shown in Figure 16
below. In the example shown in Figure 16, the Working Stored Address points to address 0x3F8 after having
written user_log_data[n] with an unaddressed write command. The subsequent unaddressed write cycle will
increment (wrap) the Working Stored Address to the value defined by the Initial Stored Address, defined in this
example as 0x000A, and write the value user_log_data[n+1] to USER memory bank 0x00A, over-writing the
previous data contents user_log_data[0]. In the example shown, four memory locations are used for static
memory, or memory that will not be over-written when a wrap condition has occurred.
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 16 of 24
Working Stored
Address Pointer
Gen-2
Memory
Bank
Gen-2
Address
Description
RESERVED
0x000 - 0X003
RESERVED - passwords
MEMORY UNAVAILABLE
EPC
0x000 - 0x009
EPC
SERVICE
0x00A
RESERVED
SERVICE
0x00B
RESERVED
TID
0x000 - 0x003
TID
USER
0x000
RESERVED
USER
0x001
RFU
USER
0x002
Control/Status Register
USER
0x003
Working Stored Address Register: 0x03F8
USER
0x004
USER
0x005
USER
0x006
user_static_data0
STATIC
USER
0x007
user_static_data1
USER
0x008
user_static_data2
USER
0x009
user_static_data3
Initial Stored Address
USER
0x00A
user_log_data[0], user_log_data[n+1]
DYNAMIC
USER
0x00B
user_log_data[1]
USER
0x00C
…
USER
0x00D
…
USER
0x00E
…
USER
0x00F
…
USER
0x010
…
USER
0x011
…
…
…
…
USER
0x3F7
user_log_data[n-1]
USER
0x3F8
user_log_data[n]
Figure 16. Initial Stored Address Example – Block Size = 128 words/block
The Initial Stored Address is factory-initialized with a value of 0x0006 (USER memory bank address 0x006).
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 17 of 24
SUPPORTED COMMANDS
The WM710xx supports the following Select, Inventory, and Access commands as described in the
EPCglobal class 1 generation 2 UHF RFID Specification. Please refer to the referenced document for detailed
descriptions of these commands.
Select
Query
QueryAdjust
QueryRep
ACK
NAK
Req_RN
Read
Write
Kill
Lock
Access
BlockWrite *
BlockPermalock
MAXARIAS GEN2 CUSTOM COMMAND: BLOCKWRITE
The WM710xx supports a customized version of the BLOCKWRITE command to support unique features
within the device. The BLOCKWRITE command optional feature is enabled by asserting the BLKWREN
control bit in the Control/Status register to a logic one, after which the WM710xx will require a power cycle to
initialize itself. To support other features within the WM710xx, the BLOCKWRITE command uses the
address stored in the Working Stored Address register. The address pointer passed in the BLOCKWRITE
command is the physical address 0x3FFF (EBV formatted address = 0xF7FF), representing the same address
used for unaddressed write cycles. A single BLOCKWRITE command carries a maximum data payload of
127 words. BLOCKWRITE commands with data payloads greater than 127 words may optionally be written
to unlocked memory, however the WM710xx will not acknowledge the BLOCKWRITE command with a
success message. In this event, the host interrogator may perform one or more READ cycles to verify USER
memory data contents.
Prior to transmitting a BLOCKWRITE command, the interrogator must set the Working Stored Address
register through a standard Gen2 WRITE command. The BLOCKWRITE command is shown in Figure 17
below.
BLKWRITE
(0xC7) Membank
(0b11) WordPtr
(0xF7FF) Data
(xNN × 16-bit data) Handle
(0xHHHH)CRC-16
(0xCCCC)
WordCnt
(0xNN)
Figure 17. Block Write Syntax
BLOCKWRITE commands do not support the auto-increment feature used for UNADDR_WRITE commands.
As such, the Working Stored Address must be manually updated by the host interrogator and will not be altered
by a BLOCKWRITE command. When using the streaming capabilities of the BLOCKWRITE command, care
should be taken to consider the logic state of the AUTOINCR control bit. As with UNADDR_WRITE
commands, the Working Stored Address register is incremented prior to writing data to memory when
AUTOINCR=1 affecting the first USER memory address written to. Figure 18 shows an 8-word
BLOCKWRITE command with AUTOINCR=0; Figure 19 shows a BLOCKWRITE command with
AUTOINCR=1. In the respective figures, when AUTOINCR=0, data is written starting at the address defined
by the Working Stored Address register – 0x006; when AUTOINCR=1, data is written starting at the next free
address defined by the contents of the Working Stored Address incremented by one, or 0x007. It is important
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 18 of 24
to note that in both cases, the value stored in the Working Stored Address register does not change for a
BLOCKWRITE command – in the example shown, it remains at a value of 0x006.
Working Stored
Address Pointer
Gen-2 Memory
Bank
Gen-2 Address
Description
RESERVED
0x000 - 0X003
RESERVED - passwords
MEMORY UNAVAILABLE
EPC
0x000 - 0x009
EPC
SERVICE
0x00A
RESERVED
SERVICE
0x00B
RESERVED
TID
0x000 - 0x003
TID
USER
0x000
RESERVED
USER
0x001
RFU
USER
0x002
Control/Status Register
USER
0x003
Working Stored Address Register: 0x0006
USER
0x004
USER
0x005
USER
0x006
BLKWRITE: DATA0
AVAILABLE MEMORY
USER
0x007
BLKWRITE: DATA1
USER
0x008
BLKWRITE: DATA2
USER
0x009
BLKWRITE: DATA3
USER
0x00A
BLKWRITE: DATA4
USER
0x00B
BLKWRITE: DATA5
USER
0x00C
BLKWRITE: DATA6
USER
0x00D
BLKWRITE: DATA7
USER
0x00E
USER
0x00F
…
…
…
USER Memory - END
Figure 18. BLOCKWRITE Command: AUTOINCR=0
Working Stored
Address Pointer
Gen-2 Memory
Bank
Gen-2 Address
Description
RESERVED
0x000 - 0X003
RESERVED - passwords
MEMORY UNAVAILABLE
EPC
0x000 - 0x009
EPC
SERVICE
0x00A
RESERVED
SERVICE
0x00B
RESERVED
TID
0x000 - 0x003
TID
USER
0x000
RESERVED
USER
0x001
RFU
USER
0x002
Control/Status Register
USER
0x003
Working Stored Address Register: 0x0006
USER
0x004
USER
0x005
USER
0x006
USER Memory - START
AVAILABLE MEMORY
USER
0x007
BLKWRITE: DATA0
USER
0x008
BLKWRITE: DATA1
USER
0x009
BLKWRITE: DATA2
USER
0x00A
BLKWRITE: DATA3
USER
0x00B
BLKWRITE: DATA4
USER
0x00C
BLKWRITE: DATA5
USER
0x00D
BLKWRITE: DATA6
USER
0x00E
BLKWRITE: DATA7
USER
0x00F
…
…
…
USER Memory - END
Figure 19. BLOCKWRITE Command: AUTOINCR=1
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 19 of 24
SPECIFICATIONS
WM710xx‟s RFID Interface conforms to the Specification for RFID Air Interface EPC Class-1 Generation-2 UHF
RFID Protocol for Communications at 860 MHz – 960 MHz, Version 1.2.0.
Options and Exceptions are noted here:
State Persistence Requirements
WM710xx features infinite state retention for S1, S2, S3, and SL State flags. State flag S0 has no persistence
and will always return to state „A‟ upon a power cycle.
ELECTRICAL SPECIFICATIONS
ABSOLUTE MAXIMUM RATINGS
Symbol
Description
Ratings
VIN
Voltage on ANT+ with respect to ANT-
-1.0V to +4.5V
TSTG
Storage Temperature
-55C to + 125C
TOP
Operating Temperature
-40oC to +85oC
TLEAD
Lead Temperature (Soldering, 10 seconds)
260 C
VESD
Electrostatic Discharge Voltage
- Human Body Model (JEDEC Std JESD22-A114-B)
- Charged Device Model (JEDEC Std JESD22-C101-A)
- Machine Model (JEDEC Std JESD22-A115-A)
500V
1kV
50V
ME
Memory Endurance: Read or Write or Erase
1x1014
RFexp
RF Exposure
+10dBm
(800 ~ 1000 MHz)
Package Moisture Sensitivity Level
MSL-2
Stresses above those listed under Absolute Maximum Ratings may cause permanent damage to the device. This is a stress rating
only, and the functional operation of the device at these or any other conditions above those listed in the operational section of this
specification is not implied. Exposure to absolute maximum ratings conditions for extended periods may affect device reliability.
RF Operating Characteristics (TA = -40 C to + 85 C unless otherwise specified)
Symbol
Parameter
Min
Typ
Max
Units
Notes
SR
Read Sensitivity
-6
dBm
SW
Write Sensitivity
-6
dBm
FR
Max Sustainable Read Rate @ SR
640
Kbits/s
1
FW
Max Sustainable Write Rate @ Sw
160
Kbits/s
1
tST
Power-on time
1.0
1.5
ms
Change in Modulator Reflection
Coefficient
TBD
TBD
ZIN
Input Impedance @ fIN=915MHz
63 – j199
Ohms
2
Note:
1. Actual read & write speeds are constrained by the EPC Class 1 Gen2 data communication standard.
2. ZIN is measured at SR/SW.
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 20 of 24
USER MEMORY BLOCK SIZE DEFINITION
x000
x001
x002
x003
x004
x005
x006
x007
x008
x009
x00A
x00B
x00C
x00D
x00E
x00F
x010
x011
BLK:0
BLK:1
BLK_SIZ=111
BLK:0
BLK_SIZ=110
BLK:0
BLK:1
BLK_SIZ=101
BLK:0
BLK:1
BLK_SIZ=100
BLK:0
BLK:1
BLK:2
...
BLK_SIZ=011
BLK:0
BLK:1
BLK:2
BLK:3
BLK:4
...
BLK_SIZ=010
BLK:0
BLK:1
BLK:2
BLK:3
BLK:4
BLK:5
BLK:6
BLK:7
BLK:8
...
BLK_SIZ=001
BLK:0
BLK:1
BLK:2
BLK:3
BLK:4
BLK:5
BLK:6
BLK:7
BLK:8
BLK:9
BLK:10
BLK:11
BLK:12
BLK:13
BLK:14
BLK:15
BLK:16
BLK:17
BLK_SIZ=000
...
USER
MEMORY
ADDRESS
x013
x012
x014
x017
x018
x01F
x020
x03F
x040
x07F
x080
x0FF
x100
...
...
...
...
...
...
BLK:1
...
...
...
...
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 21 of 24
SPECIFICATION & COMPLIANCE SUMMARY
Refer to EPCTM Radio-Frequency Identity Protocols Class-1 Generation-2 UHF RFID Protocol for
Communications at 860MHz-960MHz Version 1.2.0 for all critical RFID specifications.
Link to specifications page:
http://www.epcglobalus.org/Standards/EPCglobalSpecifications/tabid/335/Default.aspx
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 22 of 24
MECHANICAL DRAWINGS
8-pin UDFN (3.0 mm x 3.0 mm body, 0.65 mm pad pitch)
Note: All dimensions in millimeters. Care must be taken to ensure PCB traces and vias are not
placed within the exposed metal pad area.
UDFN PACKAGE MARKING SCHEME FOR BODY SIZE 3MM X 3MM
Legend:
XXXXXXX= base part number (WM71004, WM71008, WM71016)
LLLLLLLL= lot code
R=revision, P=package (D=DFN), N=split designator (numeric)
RIC=Ramtron Int‟l Corp, YY=year, WW=work week
Example: WM71004, “Green” UDFN-8 package, Lot 0411702,
Rev B., Year 2010, Work Week 12
WM71004
0411702
BD1
RIC1012
XXXXXXXX
LLLLLLLL
RPN
RICYYWW
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 23 of 24
ORDERING INFORMATION
Note: Contact Ramtron for other ordering options, i.e. bumped die.
Product
Description
Delivery & MOQ
WM71004-6-DGTR
8-pin UDFN with 4Kb memory
Tape & Reel – 3000 units
WM71008-6-DGTR
8-pin UDFN with 8Kb memory
Tape & Reel – 3000 units
WM71016-6-DGTR
8-pin UDFN with 16Kb memory
Tape & Reel – 3000 units
WM710xx – Secure F-RAM with Gen-2 RFID
Rev. 1.4
May 2011 Page 24 of 24
REVISION HISTORY
Revision
Date
Summary
0.1
12/12/2008
Initial release.
0.2
3/8/2010
Documentation updates.
1.0
3/12/2010
Changed to Preliminary status.
1.1
8/23/2010
Changed read/write sensitivity specs.
1.2
9/7/2010
Changed input impedance and test frequency.
1.3
4/14/2011
Documentation updates and clarifications.
1.4
5/25/2011
Modified Memory Map table on p. 5 (changed line entries for DSPI address
0x3FA – 0x3FB).
