PCF7936AS/3851/C,1-CT NXP Semiconductors, PCF7936AS/3851/C,1-CT Datasheet
PCF7936AS/3851/C,1-CT
Related parts for PCF7936AS/3851/C,1-CT
PCF7936AS/3851/C,1-CT Summary of contents
Page 1
PCF7936AS Security Transponder (HITAG2) Product Specification CONFIDENTIAL 2010 May 04 ...
Page 2
... NXP Semiconductors Security Transponder (HITAG2) CONTENT 1 FEATURES ............................................................................................................................................................................... 4 2 GENERAL DESCRIPTION........................................................................................................................................................ 4 3 ORDERING INFORMATION ..................................................................................................................................................... 4 4 BLOCK DIAGRAM .................................................................................................................................................................... 5 5 TYPICAL APPLICATION .......................................................................................................................................................... 5 6 QUICK REFERENCE DATA ..................................................................................................................................................... 6 7 FUNCTIONAL DESCRIPTION SECURITY TRANSPONDER .................................................................................................. 7 7.1 Memory Organization, EEPROM ................................................................................................................................... 7 7.1.1 Identifier, IDE ......................................................................................................................................................... 8 7.1.2 Password Basestation, PSW 7.1.3 Secret Key, SK ...................................................................................................................................................... 9 7.1.4 Transponder and Memory Configuration, TMCF ................................................................................................... 9 Secret Key Lock, SKL ...
Page 3
... NXP Semiconductors Security Transponder (HITAG2) 13 REVISION HISTORY .............................................................................................................................................................. 31 14 LEGAL INFORMATION .......................................................................................................................................................... 32 14.1 Data sheet status ......................................................................................................................................................... 32 14.2 Definitions .................................................................................................................................................................... 32 14.3 Disclaimers .................................................................................................................................................................. 32 2010 May 04 3 Product Specification PCF7936AS CONFIDENTIAL ...
Page 4
... NXP Semiconductors Security Transponder (HITAG2) 1 FEATURES • Security Transponder for authentication applications • Data transmission and energy supply via LF link • 32 bit quasi unique device identification (serial number) and product type identification. • Fast mutual authentication, 39ms • 48 bit Secret Key • ...
Page 5
... NXP Semiconductors Security Transponder (HITAG2) 4 BLOCK DIAGRAM The PCF7936AS features a high degree of integration and incorporates the transponder chip, coil and capacitor assembled in a leadless stick package, see Figure 1. Security Transponder Resonance/antenna circuit f = 125 kHz (typ) RES Figure 1. Block Diagram 5 TYPICAL APPLICATION ...
Page 6
... NXP Semiconductors Security Transponder (HITAG2) 6 QUICK REFERENCE DATA PARAMETER Carrier frequency Data rate - read - write Data coding - read - write Data transmission mode Modulation Memory size Identifier (serial number and product type ID) Secret Key (Cipher Mode) Password (Password Mode) Authentication time • ...
Page 7
... NXP Semiconductors Security Transponder (HITAG2) 7 FUNCTIONAL DESCRIPTION SECURITY TRANSPONDER The PCF7936AS does not require any additional power supply. It derives its power supply by inductive coupling to the LF Field, which is generated by the basestation. Reading and writing to the transponder is provided by amplitude modulation of the LF field. The Contactless Interface generates the chip power supply, clock and reset and features the modulator, and demodulator ...
Page 8
... NXP Semiconductors Security Transponder (HITAG2) Password Mode (ENC = 0) bit 31 IDE PSW not used TMCF PSW USER 0 USER 1 USER 2 USER 3 MSB Cipher Mode (ENC = 1) bit 31 IDE SK (low (high TMCF PSW USER 0 USER 1 USER 2 USER 3 MSB Figure 4 ...
Page 9
... NXP Semiconductors Security Transponder (HITAG2) 7.1.3 Secret Key, SK The Secret Key applicable in Cipher mode only (ENC = 1). The Secret Key bit pattern, which typically is initialized and subsequently locked by the customer during device personalization. The Secret Key is located in page 1 and 2, see Figure 4. ...
Page 10
... NXP Semiconductors Security Transponder (HITAG2) Mode Select, MS The device may be configured for to support one out of three Read Only modes, which will cause the device to commence data transmission after the specified time-out period, without interrogation by the basestation, see Table 1. Table 1. Mode Select ...
Page 11
... NXP Semiconductors Security Transponder (HITAG2) READ ONLY READ_PAGE_INV Figure 7. Transponder State Diagram 7.2 Transponder State Diagram Device operation is controlled by commands issued from the basestation, see Figure 7. After a LF Field Power-On Reset condition the circuitry is reset and the transponder is initialized, which causes the device to enter the WAIT state ...
Page 12
... NXP Semiconductors Security Transponder (HITAG2) 7.2.2 AUTHORIZED State The AUTHORIZED state is entered only after successful device authentication, see START_AUTH command. In AUTHORIZED state the Transponder Memory, TM, can be accessed by means of subsequent read and write commands, see Table 3. Communication with the device employs plain (Password Mode) respectively ciphered (Cipher Mode) transmission of commands and data ...
Page 13
... NXP Semiconductors Security Transponder (HITAG2) 7.3 Command Set Device operation is controlled by commands issued from the basestation. Table 4 gives a comprehensive summary of the applicable commands in alphabetic order. Command Table 4. Command Set Summary NAME HALT Forces the device to enter the HALT state READ_PAGE Reads 32 bit from the designated memory page, if not restricted by the ...
Page 14
... NXP Semiconductors Security Transponder (HITAG2) 7.3.1 Command Description The general form of a control sequence consists of the command sequence send to the transponder and an Equalizer pattern (EQ) and Response received from the transponder. The general control sequence timing is shown in Figure 8. When switching from SEND to RECEIVE and vice versa, ...
Page 15
... NXP Semiconductors Security Transponder (HITAG2) HALT The command HALT may be issued in AUTHORIZED state and forces the device to enter the HALT state. For data integrity reasons the 5 bit command and its complement have to be send, before the device will accept it, see Figure 10. If accepted, the command Response consist of the command itself and its complement ...
Page 16
... NXP Semiconductors Security Transponder (HITAG2) READ_PAGE_INV The command READ_PAGE_INV returns the complement of the content of the designated page. The page designated for reading is specified by the command bits pg2 to pg0. For data integrity reasons the 5 bit command and its complement have to be send, before the device will accept it, see Figure 12 ...
Page 17
... NXP Semiconductors Security Transponder (HITAG2) START_AUTH (Password Mode) If configured for Password mode, START_AUTH triggers the mutual device authentication sequence. If completed successfully, the device enters AUTHORIZED state and subsequently supports plain read and write access of the Transponder Memory, TM. Device authentication employs the ...
Page 18
... NXP Semiconductors Security Transponder (HITAG2) START_AUTH (Cipher Mode) If configured for Cipher mode, START_AUTH triggers the mutual device authentication sequence. If completed successfully, the device enters AUTHORIZED state and subsequently supports ciphered read and write access of the Transponder Memory, TM. Device authentication employs the Identifier, a Random Number, a ciphered Signature and a ciphered device Response, see Figure 13 ...
Page 19
... NXP Semiconductors Security Transponder (HITAG2) WRITE_PAGE The command WRITE_PAGE writes the data supplied with this command into the designated page. The page designated for writing is specified by the command bits pg2 to pg0. For data integrity reasons the 5 bit command and its complement have to be send, before the device will accept it, see Figure 15 ...
Page 20
... NXP Semiconductors Security Transponder (HITAG2) 7.4 Calculation Unit The PCF7936AS incorporates a Calculation Unit for use during mutual device authentication, command operation and EEPROM data exchange, if the device is configured for Cipher mode. The security algorithm involves a quasi unique 32 bit Identifier bit Secret Key and a 32 bit Random Number ...
Page 21
... NXP Semiconductors Security Transponder (HITAG2) 7.5 Read Only Modes If the device is configured for one of three Read Only modes, it will cyclically transmit data while operating in READ ONLY state. The corresponding Read Only mode is selected by the configuration bit MS1 and MS0, located in the EEPROM, see section 7.1.4. ...
Page 22
... NXP Semiconductors Security Transponder (HITAG2) 7.6 Transponder Data Transmission Format Reading from and writing to the device is accomplished by modulating the LF field in amplitude. Since the LF field also provides the device power supply, the modulation characteristics have to be verified carefully, in order to avoid a device reset due to a power low condition. ...
Page 23
... NXP Semiconductors Security Transponder (HITAG2) 7.6.2 Write Direction Transmission of data from the basestation to the transponder is accomplished by Amplitude Shift Keying (ASK) of the LF field with a modulation index as specified. According to the data designated for transmission, the basestation coil driver is simply switched ON and OFF (tri- state) typically. Due to the inductive coupling of the ...
Page 24
... NXP Semiconductors Security Transponder (HITAG2) 7.7 LF Field Power On Reset When the transponder enters a LF field a rectifier circuitry becomes operational and the internal transponder supply voltage (V ) develops. As soon as the supply voltage DD exceeds the LF Field Power-On Reset threshold voltage (V ) the device performs a chip reset and starts its THR initialization sequence, see Figure 23 ...
Page 25
... NXP Semiconductors Security Transponder (HITAG2) 8 EEPROM CONTENT AT DELIVERY PCF7936AS The EEPROM content is initialized during device manufacturing, according to Table 5. However the EEPROM content may be modified as desired by the application, except for the page 0 block 0 which holds the Identifier (IDE) and serves the function of a serial number and product type ID ...
Page 26
... NXP Semiconductors Security Transponder (HITAG2) 9 LIMITING VALUES All values are in accordance with Absolute Maximum Rating System (IEC 134) PARAMETER Operating temperature range Storage temperature range Magnetic flux density (resistance against magnetic pulses) Vibration - 10 - 2000Hz - 3.axis - IEC 68-2-6, Test Fc Shock - 3.axis - IEC 68-2-27, Test Ea ...
Page 27
... NXP Semiconductors Security Transponder (HITAG2) 10 DEVICE CHARACTERISTICS 10.1 Electrical Characteristics Tamb = -40 to +85° 125kHz, T SYS SYMBOL PARAMETER Operating Conditions f Resonance frequency RES BW Bandwidth B Magnetic flux density, THR Read direction B Magnetic flux density, Note 1 PRG For EEPROM programming B Magnetic flux density, Note 1 AUT ...
Page 28
... NXP Semiconductors Security Transponder (HITAG2) 10.2 Timing Characteristics Tamb = -40 to +85° 125kHz, T SYS SYMBOL PARAMETER Command Handling t Transponder response delay WAIT,Tr t Basestation response delay WAIT,Bs t EEPROM erase/write time PROG t Idle time IDLE Data Transmission T Bit duration BIT T Write pulse width WRP T Write pulse repetition time, logic 0 ...
Page 29
... NXP Semiconductors Security Transponder (HITAG2) 10.3 Mechanical Characteristics 4.9-5.1 Protruding plastic must not exceed specified dimension by more than 0.2 mm Figure 26. Package outlines SOT 385-1 0.4 Figure 27.Coil position, Layout SOT 385BA4 2010 May 04 11.9-12 12.0 10 Product Specification PCF7936AS 1.1-1.2 0.165 1.9-2.1 Cross Section A-A ( without Scale ) OUTLINE DIMENSIONS ARE NOMINAL VALUES ...
Page 30
... NXP Semiconductors Security Transponder (HITAG2) 11 TEST SETUP Device characteristics are measured according to the test setups given below. Electrical characteristics are measured in a Helmholtz arrangement that generates an almost homogenous magnetic field at the position of the device under test (transponder), see Figure 29. Figure 28. Mechanical Stress ...
Page 31
... NXP Semiconductors Security Transponder (HITAG2) 12 DEVELOPMENT TOOLS Reference OM6705 TED-Kit 13 REVISION HISTORY Revision Page 2000 Apr 04 Revised and updated revision 9, 10 PWP2 renamed PG3L and CSelect renamed DCS 14 Specification of t 2003 May 15 Editorial changes and correction 7 Changes regarding the Transponder Configuration become effective after a device reset or initialization sequence only ...
Page 32
... This document supersedes and replaces all information supplied prior to the publication hereof. Suitability for use NXP Semiconductors products are not designed, authorized or warranted to be suitable for use in medical, military, aircraft, space or life support equipment, nor in applications where failure or malfunction of a NXP Semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. NXP Semiconductors accepts no liability for inclusion and/or use of NXP Semiconductors products in such equipment or applications and therefore such inclusion and/or use is at the customer’ ...