HT-CM400 NXP Semiconductors, HT-CM400 Datasheet
HT-CM400
Related parts for HT-CM400
HT-CM400 Summary of contents
Page 1
... HT CM400 HT RM440 Family HT RM800 Family Interface Protocol Reader Product Specification Revision 1.1 Host February 1997 ...
Page 2
... Transfer Timeout Intervals ........................................................................................... 12 3.5 Command Set .............................................................................................................. 13 3.6 Status Byte .................................................................................................................. 15 3.7 Command Description for Operating Mode .................................................................. 16 3.7.1 GetSnr ............................................................................................................. 16 3.7.2 GetSnr_Adv..................................................................................................... 17 3.7.3 SelectSnr.......................................................................................................... 18 3.7.4 SelectLast ........................................................................................................ 19 3.7.5 HaltSelected..................................................................................................... 20 3.7.6 ReadPage......................................................................................................... 21 3.7.7 ReadBlock ....................................................................................................... 22 3.7.8 WritePage ........................................................................................................ 23 3.7.9 WriteBlock ...................................................................................................... 24 3.7.10 TagAuthent.................................................................................................... 25 3.7.11 MutualAuthent............................................................................................... 26 3.7.12 GetSnr_LT..................................................................................................... 27 3.7.13 GetSnrReset_LT ............................................................................................ 28 3.7.14 HaltSelected_LT ............................................................................................ 29 3.7.15 ReadPage_LT ................................................................................................ 30 3.7.16 ReadPageInv_LT ........................................................................................... 31 3.7.17 WritePage_LT................................................................................................ 32 3.7.18 ReadPit_LT.................................................................................................... 33 3.7.19 ReadPublicB_LT............................................................................................ 34 3.7.20 ReadMiro....................................................................................................... 35 3.7.21 ReadPit .......................................................................................................... 36 3.7.22 WritePit ......................................................................................................... 37 3.7.23 WritePitBlock ................................................................................................ 38 3.7.24 PollTags......................................................................................................... 39 3.7.25 PollKbTags .................................................................................................... 41 3.7.26 GetVersion..................................................................................................... 43 3.7.27 Reset.............................................................................................................. 44 Htswp.doc/HS Rev. 1.0 Page 2 (104) 98-02-10 ...
Page 3
... Proximity/Long Range: READ PLAIN............................................................. 77 3.9.3 Proximity/Long Range: WRITE PLAIN........................................................... 77 3.9.4 Proximity/Long Range: READ CRYPTO......................................................... 78 3.9.5 Proximity/Long Range: WRITE CRYPTO ....................................................... 78 3.10 Examples to Access HITAG 2 Transponders .............................................................. 79 3.10.1 Proximity/Long Range: READ ....................................................................... 79 3.10.2 Proximity/Long Range: WRITE ..................................................................... 79 4 Transponders ........................................................................................................... 80 4.1 HITAG 1 Transponders ............................................................................................... 80 4.1.1 Memory Organization ...................................................................................... 80 4.1.2 Anticollision..................................................................................................... 81 4.1.3 Operation-Modes and Configuration ................................................................ 82 Rev. 1.0 Page 3 (104) Introduction Htswp.doc/HS ...
Page 4
... Personalization of HITAG 2 Transponders ................................................................. 100 5.4.1 Definition of Passwords and Keys .................................................................. 100 5.4.2 Changing Passwords and Keys ....................................................................... 101 6 Security Considerations........................................................................................ 102 6.1 Data Reliability........................................................................................................... 102 6.1.1 Data Stream between Read/Write Device and Transponder................................. 102 6.1.2 Checking User Data ....................................................................................... 102 6.2 Data Privacy .............................................................................................................. 103 Author: Dieter Köckinger Htswp.doc/HS Rev. 1.0 Page 4 (104) 98-02-10 ...
Page 5
... This description refers to the interface between a host (e.g. PC) and a contactless 125 kHz read/write device based on the HITAG Communication Controller, as there is e.g. the HT CM400 (HITAG Core Module), HT RM440 family (HITAG Proximity Reader Module) and HT RM800 family (HITAG Long Range Reader Module). For easy and quick development of application specific host software Philips Semiconductors provides a C-Library, Source- and Header-Files ...
Page 6
... Fast Fourier Transformation HF High Frequency LSB Least Significant Byte MSB Most Significant Byte nmb Number OTP One Time Programmable pagenr Page Number RF Radio Frequency ro Read Only r/w Read/Write RWD Read/Write Device snr Serial Number TAG (tag) Transponder wo Write Only Htswp.doc/HS Rev. 1.0 Page 6 (104) 98-02-10 ...
Page 7
... Philips Semiconductors´ customers using or selling these products for use in such applications their own risk and agree to fully indemnify Philips Semiconductors for any damages resulting from such improper use or sale. Rev. 1.0 Page 7 (104) Introduction Htswp.doc/HS ...
Page 8
... There is no Source File for using multiple RWD’s because all necessary code is located in the Header File PROLBMU6.H. For developing software on other platforms by using other compilers we recommend to use our Source Files and Header Files and make your specific adaptations. Htswp.doc/HS Rev. 1.0 Page 8 (104) 98-02-10 ...
Page 9
... C-Library (e.g. function proloc_GetSnr() for command GetSnr) for Ordinary Protocol. All Header Files contain short examples to illustrate the usage of each command. Rev. 1.0 *ComStr="COM1" for COM1 // *ComStr= "COM2" for COM2 // mode=0x00: Operating Mode // mode=0x01: KeyInit Mode Page 9 (104) Provided Host Software Modules Htswp.doc/HS ...
Page 10
... BCC calculation in KeyInit Mode of the reader: The BCC is computed by adding all block data bytes including Block Length. The least significant eight bits are used as BCC. Htswp.doc/HS Rev. 1.0 Example for command GetSnr: Byte 1: Block Length 0000 0010 Byte 2: Command Byte ...
Page 11
... If a reader’s node address is different from zero, the reader enters net-mode. In this mode the reader expects all commands from the host to be sent in Extended Protocol including the right Node Address (except SetModuleAdr). If the host transmits a string that does not meet these ...
Page 12
... Character Delay 150 ms Block Delay: Block Delay is only necessary if an error has occurred in the serial communication. To allow for re-synchronization in that case of malfunction there must be a minimum interval - defined as Block Delay - until sending the next block. Block Delay 160 ms Htswp.doc/HS Rev. 1.0 Page 12 (104) 98-02-10 ...
Page 13
... HaltSelected_LT 0x82 ReadPage_LT 0x83 ReadPageInv_LT 0x84 WritePage_LT 0x85 ReadPit_LT 0x90 PollKbTags 0x91 SetModuleAdr 0x9E ReadPublicB_LT 0xA1 SetProxTrmTime 0xA2 GetSnr_Adv 0xA4 SetBCDOffset 0xA6 StopCommand Rev. 1.0 READER TRANSPONDERS HITAG 1 HITAG 2 P/L P/L L P/L L P/L P/L P/L P/L P/L P/L P/L P/L P/L P/L P/L P/L P/L P/L P/L L P/L P/L P/L P/L P/L P/L L P/L P/L P/L P/L P/L P P/L P/L P/L P/L P/L P/L P/L L P/L Page 13 (104) Communication Reader-Host MIRO PIT P Htswp.doc/HS ...
Page 14
... The KeyInit Mode is a mode of all HITAG Readers for using a set of personalization commands. COMMAND COMMAND NAME BYTE 'C' 0x43 ReadControl 'R' 0x52 Reset (Switch to Operating Mode) 'V' 0x56 ReadSecret_LT 'W' 0x57 WriteSecret_LT 'X' 0x58 ReadEEPROM 'Y' 0x59 WriteEEPROM 'c' 0x63 WriteControl 's' 0x73 WriteSerNum 'v' 0x76 WritePitSecurity 'w' 0x77 WritePitPassword 0x90 ReadControl_LT 0x91 WriteControl_LT Htswp.doc/HS Rev. 1.0 READER P/L P/L P/L P/L P/L P/L P/L P P/L P/L Page 14 (104) 98-02-10 ...
Page 15
... New PIT-Data were received by the host before the host-program read the old PIT- Data (error generated by C-Library during command ReadPit). Wrong CRC from a HITAG 1 transponder in Advanced Protocol Mode. Long Range Reader: Broken or badly detuned antenna (error only after command ReadLRStatus). Page 15 (104) Communication Reader-Host Htswp.doc/HS ...
Page 16
... Proximity Reader: more is always 0. Long Range Reader: more equal to one indicates that there is at least one additional transponder in the reading area of the read/write device. Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG Htswp.doc/HS Rev. 1.0 0 ------ 31 24 ------ SNR-MSB more Page 16 (104) 98-02-10 ...
Page 17
... This command provides the serial number of a HITAG 1 transponder and sets the transponder into Advanced Protocol Mode (command is not available for HITAG 1 transponders based on ASIC HT1 ICS30 01x ; only available for HITAG 1 transponders based on ASIC HT1 ICS30 02x). For further information on the Advanced Protocol Mode see chapter „Transponders“. ...
Page 18
... SNR-LSB READ/WRITE DEVICE - HOST 7 n+2 Status OTP-LSB ------ OTP: Configuration Page of HITAG error occurred (error code in Status data were read from a transponder (Status = 0). Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG Htswp.doc/HS Rev. 1.0 ------ 31 24 ------ SNR-MSB BCC 0 ------ 31 24 OTP-MSB BCC Page 18 (104) 98-02-10 ...
Page 19
... Configuration Page is not returned. C-Function: void proloc_SelectLast (void); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'S' 0x51 READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG Rev. 1.0 Page 19 (104) Communication Reader-Host Htswp.doc/HS ...
Page 20
... You can reset a transponder previously turned off by HaltSelected using the command HFReset or putting it out of RF field. C-Function: void proloc_HaltSelected (void); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'H' 0x4A READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -8 ... ACKNOWLEDGEMENT ERROR Htswp.doc/HS Rev. 1.0 Page 20 (104) 98-02-10 ...
Page 21
... READ/WRITE DEVICE - HOST n+2 Status data[ error occurred (error code in Status data were read from a transponder (Status = 0). Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG -9 ... CRYPTOBLOCK NOT INIT Rev. 1.0 pagenr BCC ....... data[3] BCC Page 21 (104) Communication Reader-Host Htswp.doc/HS ...
Page 22
... READ/WRITE DEVICE - HOST n+2 Status data[ error occurred (error code in Status 12, 16 depending on the page address if data were read from a transponder (Status = 0). Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG -9 ... CRYPTOBLOCK NOT INIT Htswp.doc/HS Rev. 1.0 pagenr BCC ....... data[n-1] BCC Page 22 (104) 98-02-10 ...
Page 23
... HOST - READ/WRITE DEVICE 0x08 'p' crypto pagenr crypto: 0x00 ... Plain Mode 0x01 ... Crypto Mode pagenr: page number READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG -4 ... TIMEOUT -9 ... CRYPTOBLOCK NOT INIT Rev. 1.0 data[0] ....... data[3] BCC Page 23 (104) Communication Reader-Host Htswp.doc/HS ...
Page 24
... HOST - READ/WRITE DEVICE n+4 'b' crypto pagenr data[0] crypto: 0x00 ... Plain Mode 0x01 ... Crypto Mode pagenr: page number (for start address) READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG -4 ... TIMEOUT -9 ... CRYPTOBLOCK NOT INIT Htswp.doc/HS Rev. 1.0 ....... data[n-1] BCC Page 24 (104) 98-02-10 ...
Page 25
... C-Function: void proloc_TagAuthent (BYTE_T keyinfo); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x03 'a' keyinfo BCC keyinfo: 0x00 ... Key/Logdata Set A 0x01 ... Key/Logdata Set B READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -7 ... AUTHENTICATION ERROR Rev. 1.0 Page 25 (104) Communication Reader-Host Htswp.doc/HS ...
Page 26
... C-Function: void proloc_MutualAuthent (BYTE_T keyinfo); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x03 'A' keyinfo BCC keyinfo: 0x00 ... Key/Logdata Set A 0x01 ... Key/Logdata Set B READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -7 ... AUTHENTICATION ERROR Htswp.doc/HS Rev. 1.0 Page 26 (104) 98-02-10 ...
Page 27
... Configuration Byte of HITAG error occurred (error code in Status data were read from a transponder (Status = 0). Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG -5 ... INCORRECT PASSWORD RWD -6 ... INCORRECT PASSWORD TAG -7 ... AUTHENTICATION ERROR Rev. 1.0 BCC 0 ------ 31 24 ------ SNR-MSB Page 27 (104) Communication Reader-Host config BCC Htswp.doc/HS ...
Page 28
... Status data were read from a transponder (Status = 0). Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG -5 ... INCORRECT PASSWORD RWD -6 ... INCORRECT PASSWORD TAG -7 ... AUTHENTICATION ERROR Htswp.doc/HS Rev. 1.0 BYTE_T *config); ‘M’ BCC 0 ------ 31 24 ------ SNR-MSB Page 28 (104) 98-02-10 config BCC ...
Page 29
... You can reset a transponder previously turned off by HaltSelected_LT using the command HFReset or putting it out of RF field. C-Function: void proloc_HaltSelected_LT (void); Header-File: PROLBLT6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 0x81 0x83 READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -8 ... ACKNOWLEDGEMENT ERROR Rev. 1.0 Page 29 (104) Communication Reader-Host Htswp.doc/HS ...
Page 30
... HOST - READ/WRITE DEVICE 0x03 0x82 pagenr pagenr: page number READ/WRITE DEVICE - HOST n+2 Status data[ error occurred (error code in Status data were read from a transponder (Status = 0). Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG Htswp.doc/HS Rev. 1.0 BCC ....... data[3] BCC Page 30 (104) 98-02-10 ...
Page 31
... HOST - READ/WRITE DEVICE 0x03 0x83 pagenr pagenr: page number READ/WRITE DEVICE - HOST n+2 Status data[ error occurred (error code in Status data were read from a transponder (Status = 0). Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG Rev. 1.0 BCC ....... data[3] BCC Page 31 (104) Communication Reader-Host Htswp.doc/HS ...
Page 32
... If no transponder is selected, a NOTAG message will be generated. ATTENTION: To check if WritePage_LT was successful it is important that the immediately following command is a ReadPage_LT. If ReadPage_LT does not return „no error“ and the right data, you have to repeat WritePage_LT. C-Function: void proloc_WritePage_LT (BYTE_T pagenr, char *data); ...
Page 33
... Reset, since Reset can cause undesirable side effects (resetting output pins). C-Function: void proloc_ ReadPit_LT (char *data); Header-File: PROLBLT6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 0x85 BCC READ/WRITE DEVICE - HOST 0x12 Status data[0] Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1.0 ....... data[15] BCC Page 33 (104) Communication Reader-Host Htswp.doc/HS ...
Page 34
... Since the tag sends its 128-bit data continuously, the user must store its data on the tag in a way which allows for synchronization. C-Function: void proloc_ReadPublicB_LT (BYTE_T *data); Header-File: PROLBLT6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 0x9E BCC READ/WRITE DEVICE - HOST 0x12 Status data[0] Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1.0 ----- data[15] BCC Page 34 (104) 98-02-10 ...
Page 35
... C-Function: void proloc_ReadMiro (char *data); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'M' 0x4F READ/WRITE DEVICE - HOST 0x07 Status data[0] Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1.0 9 bit 50 bit 4 bit 1 bit 64 bit ----- data[4] BCC Page 35 (104) Communication Reader-Host Htswp.doc/HS ...
Page 36
... C-Function: void proloc_ReadPit (BYTE_T blknmb, BYTE_T next, char *data); Header-File: PROLBPH6.H Serial protocol: HOST - READ/WRITE DEVICE 0x03 'T' blknmb BCC blknmb: number of blocks to read READ/WRITE DEVICE - HOST 0x12 Status data[ 0x12 Status data[0] Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1.0 .... data[15] BCC .... data[15] BCC Page 36 (104) 98-02-10 ...
Page 37
... Serial protocol: HOST - READ/WRITE DEVICE bytenmb+4 't' byteaddr bytenmb data[0] byteaddr: start address of write data (0 bytenmb: number of data bytes to write (1 READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1.0 ...... data[bytenmb-1] byteaddr 127) bytenmb 16) Page 37 (104) Communication Reader-Host BCC Htswp.doc/HS ...
Page 38
... C-Function: void proloc_WritePitBlock (BYTE_T blkaddr, BYTE_T bytenmb, char *data); Header-File: PROLBPH6.H Serial protocol: HOST - READ/WRITE DEVICE bytenmb+3 'u' blkaddr blockaddr: start address of write data (0 bytenmb = number of data bytes to write (1 bytenmb READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1.0 data[0] ....... data[bytenmb-1] blockaddr 7) 16) Page 38 (104) 98-02-10 BCC ...
Page 39
... HITAG 2 PublicB HITAG 1 Advanced Protocol Mode Poll Poll Poll HITAG 2 HITAG 2 HITAG 2 Public Crypto Password Mode C Mode Mode 0 ------ 31 ------ SNR-MSB Page 39 (104) Communication Reader-Host Poll Poll Poll PIT Miro / HITAG 1 HITAG 2 Standard Public Protocol Mode A Mode 24 more BCC Htswp.doc/HS ...
Page 40
... Status 0x10 SNR-LSB If polling for HITAG 2 Public Mode C was successful: 0x13 Status 0x20 data[0] If polling for HITAG 2 Public Mode B was successful: 0x13 Status 0x40 data[0] Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1.0 0 ------ 31 24 ------ SNR-MSB more ----- data[4] BCC ----- data[15] BCC 0 ------ 31 ...
Page 41
... IN1 and IN2. The read/write device does not enter the Permanent Reading Mode. Port 0 of the HITAG Communication Controller is used to connect a keyboard-matrix. See document „HT RC100 HITAG connections and key-decoding. ATTENTION: To use the keyboard-decoding function a special hardware with connected Port 0 signals is required (Port 0 signals are not available on pin connectors of Philips Semiconductors’ ...
Page 42
... Keyboard-Buffer (appended to protocol when keyboard-buffer is not empty): Keyb[0] Keyb[1] Keyb[2] Keyb[3] Keyb[0] Bits 4-7 oldest key-code Keyb[0] Bits 0 Keyb[3] Bits 4-7 second newest key-code Keyb[3] Bits 0-3 newest key-code Serial number (appended to the protocol if a transponder of requested type was found ------ 31 SNR-LSB ------ SNR-MSB Htswp.doc/HS Rev. 1.0 24 Page 42 (104) 98-02-10 ...
Page 43
... Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'V' BCC READ/WRITE DEVICE - HOST 0x1D Status data[0] data[0] ... data[7]: Version data[8] ... data[15]: Date data[16] ... data[26]: Serial number (11 characters) Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1.0 ------ data[26] BCC (format: Vx.yy.zz) (format: dd-mm-yy) Page 43 (104) Communication Reader-Host Htswp.doc/HS ...
Page 44
... Reset can cause undesirable side effects (resetting output pins). Use StopCommand instead. C-Function: void proloc_Reset (void); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'R' 0x50 READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1.0 Page 44 (104) 98-02-10 ...
Page 45
... This means that all HITAG transponders are reset and transponders that were in Halt Mode will respond again. C-Function: void proloc_HFReset (void); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'h' 0x6A READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1.0 Page 45 (104) Communication Reader-Host Htswp.doc/HS ...
Page 46
... You should not use the command Reset instead, since Reset can cause undesirable side effects (resetting output pins). C-Function: void proloc_StopCommand (void); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 0xA6 BCC READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1.0 Page 46 (104) 98-02-10 ...
Page 47
... READ/WRITE DEVICE - HOST 0x03 Status input BCC input Proximity Reader (In1,In2): Long Range Reader (In1): Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1 In2 In1 0 ... reset ( ... set (5 V) Page 47 (104) Communication Reader-Host 1 ... set ( ... reset (0 V) Htswp.doc/HS ...
Page 48
... Proximity Reader (Out1,Out2): 0 ... reset (0 V) Long Range Reader (Out1): READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1 (Out4) (Out3) Out2 Out1 0 ... set (5 V) Page 48 (104) 98-02- ... set ( ... reset (0 V) ...
Page 49
... C-Function: void proloc_ConfigPorts (BYTE_T config); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x03 'c' config BCC config P0.7 P0.6 P0.5 P0.4 P0.3 P0.2 P0.1 P0.0 READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1 ... configure as input 1 ... configure as output Page 49 (104) Communication Reader-Host Htswp.doc/HS ...
Page 50
... Bit-positions of output-configured pins are read as ‘0’. C-Function: void proloc_ReadPorts (BYTE_T *input); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'i' BCC READ/WRITE DEVICE - HOST 0x03 Status input BCC input P0.7 P0.6 P0.5 P0.4 P0.3 P0.2 P0.1 P0.0 Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1 ... reset ( ... set (5 V) Page 50 (104) 98-02-10 ...
Page 51
... The result is written to the output-configured port pins. 3 ... The current status of the output-configured port pins is EXOR-combined with the bits in -output-. The result is written to the output-configured port pins. READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1.0 BCC Page 51 (104) Communication Reader-Host Htswp.doc/HS ...
Page 52
... Serial protocol: HOST - READ/WRITE DEVICE bytenmb+4 'e' addr addr: EEPROM user address (0 bytenmb: number of bytes to write (1 READ/WRITE DEVICE - HOST 0x02 status BCC Status: 0 ... no error -1 ... SERIAL ERROR -10 ... EEPROM ERROR Htswp.doc/HS Rev. 1.0 BCC addr 84) 16) data[n-1] BCC bytenmb data[0] ....... data[bytenmb-1] addr 84) bytenmb 16) Page 52 (104) ...
Page 53
... READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1.0 Duration of a ‘0’-bit including t_p Duration of a ‘1’-bit including t_p Duration of a Modulation Gap t_p BCC Page 53 (104) Communication Reader-Host Htswp.doc/HS ...
Page 54
... The new node-address is written into the EEPROM of the read/write device. Initial value stored in the EEPROM of a delivered read/write device: addr = 0x00 SetModuleAdr should be sent in Ordinary Protocol. If the right serial number was sent, the read/write device answers with Ordinary Protocol if its former node-address was zero, otherwise it answers in Extended Protocol. ...
Page 55
... This command sets the read/write device into Proximity or Long Range Mode. In standard applications (e.g. using standard reader hardware from Philips Semiconductors) SetHFMode is not used because the HITAG Communication Controller automatically sets the right mode after power-up. Examples: SetHFMode setting the mode to Long Range sets a Proximity Reader in a powerdown-state with reduced power consumption ...
Page 56
... Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'F' 0x44 READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -8 ... ACKNOWLEDGEMENT ERROR The DSP did not send a correct acknowledge. The error leads to a reset of the read/write device. Htswp.doc/HS Rev. 1.0 Page 56 (104) 98-02-10 ...
Page 57
... Serial protocol: HOST - READ/WRITE DEVICE 0x02 'f' BCC READ/WRITE DEVICE - HOST 0x03 Status bitclockdata bitclockdata: 7 bitclockdelay bitclockdelay Bit 3 Bit 2 bitclockdelay: 0 ... 15 Status: 0 ... no error -1 ... SERIAL ERROR Rev. 1.0 BCC 6 5 bitclockdelay bitclockdelay Bit 1 Bit 0 possible dec Page 57 (104) Communication Reader-Host Htswp.doc/ ...
Page 58
... FFT READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -8 ... ACKNOWLEDGEMENT ERROR The DSP did not send a correct acknowledge. The error leads to a reset of the read/write device. Htswp.doc/HS Rev. 1.0 BCC 6 5 bitclockdelay bitclockdelay Bit 1 Bit 0 possible dec Page 58 (104) 98-02-10 ...
Page 59
... This Long Range Reader command reads the antenna overload bit. In case of broken or badly detuned antenna the overload bit is high. C-Function: void proloc_ReadLRStatus (void); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'r' 0x70 READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -20 ... ANTENNA OVERLOAD Rev. 1.0 BCC Page 59 (104) Communication Reader-Host Htswp.doc/HS ...
Page 60
... By default the read/write device is in Active Mode. C-Function: void proloc_SetPowerDown (BYTE_T mode); Header-File: PROLIB6.H Serial protocol: HOST - READ/WRITE DEVICE 0x03 'D' mode BCC mode: 0x00 ... Standby Mode 0x01 ... Active Mode READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1.0 Page 60 (104) 98-02-10 ...
Page 61
... An answer string includes one page of each data carrier. (n+1) strings are transmitted (n ... number of data carriers). The last string contains the last error- condition. Status: 0 ... no error -1 ... SERIAL ERROR -3 ... NOTAG -7 ... AUTHENTICATION ERROR -8 ... ACKNOWLEDGEMENT ERROR -9 ... CRYPTOBLOCK NOT INIT Rev. 1.0 WORD_T *data_len); pagenr BCC ....... data[3] BCC Page 61 (104) Communication Reader-Host Htswp.doc/HS ...
Page 62
... C-Function: void proloc_GetDspVersion (char *data); Header-File: PROLVEG6.H Serial protocol: HOST - READ/WRITE DEVICE 0x02 'v' BCC READ/WRITE DEVICE - HOST 0x12 Status data[0] ....... data[0] ... data[15]: Version bytes with even index: ASCII bytes with odd index: 0 Status: 0 ... no error -1 ... SERIAL ERROR Htswp.doc/HS Rev. 1.0 data[15] BCC Page 62 (104) 98-02-10 ...
Page 63
... PW0 PW1 /<--- Password READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error -1 ... SERIAL ERROR -11 ... EEPROM WRONG OLD DATA The password was incorrect. The read/write device remains in Operating Mode. Rev. 1 PW2 PW3 BCC -->/ Page 63 (104) Communication Reader-Host Htswp.doc/HS ...
Page 64
... Chapter „Personalization“). In this mode the BCC is computed by adding all block data bytes including Block Length. The least significant eight bits are used as BCC. The command KeyInitMode is used to get from Operating Mode to KeyInit Mode. Exit of KeyInit Mode is done by the command Reset failing WriteEEPROM, WriteSecret_LT or WriteControl_LT ...
Page 65
... Status BCC Status: 0 ... no error - 1 ... SERIAL ERROR (in this case the error can also mean, that the read/write device is not in the KeyInit Mode!) -12 ... EEPROM WRITE PROTECTED If any error occurs KeyInit Mode is exited immediately. Rev. 1.0 ..... Snr[10] BCC Page 65 (104) Communication Reader-Host Htswp.doc/HS ...
Page 66
... This command reads personalization data (4 data bytes) from the EEPROM of the read/write device. Access rights are verified automatically by the read/write device before this command is executed Read command is not permitted, Status is set to -13 (EEPROM READ PROTECTED). C-Function: void proloc_ReadEEPROM (BYTE_T num, DWORD_T *data); ...
Page 67
... This command requires the old data to be transmitted as well, which means that data can only be changed if the user knows the old written data. Access rights and conformity between the sent old data and the stored data are verified before command execution. ...
Page 68
... Status data[0] data[1] data[0]: Control_RW ... see Chapter „Personalization“ data[1]: Control_WO ... see Chapter „Personalization“ Status: 0 ... no error - 1 ... SERIAL ERROR (in this case the error can also mean, that the read/write device is not in the KeyInit Mode!) Htswp.doc/HS Rev. 1.0 BCC Page 68 (104) 98-02-10 ...
Page 69
... Control_RW: see Chapter „Personalization“ Control_WO: see Chapter „Personalization“ READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error - 1 ... SERIAL ERROR (in this case the error can also mean, that the read/write device is not in the KeyInit Mode!) Rev. 1.0 Page 69 (104) Communication Reader-Host Htswp.doc/HS ...
Page 70
... This command reads HITAG 2 personalization data (4 data bytes) from the EEPROM of the read/write device. Access rights are verified automatically by the read/write device before this command is executed Read command is not permitted, Status is set to -13 (EEPROM READ PROTECTED). C-Function: void proloc_ReadSecret_LT (BYTE_T num, DWORD_T *data); ...
Page 71
... This command requires the old data to be transmitted as well, which means that data can only be changed if the user knows the old written data. Access rights and conformity between the sent old data and the stored data are verified before command execution. ...
Page 72
... HOST - READ/WRITE DEVICE 0x02 0x90 BCC READ/WRITE DEVICE - HOST 0x03 Status data[0] data[0]: Control_LT ... see Chapter „Personalization“ Status: 0 ... no error - 1 ... SERIAL ERROR (in this case the error can also mean, that the read/write device is not in the KeyInit Mode!) Htswp.doc/HS Rev. 1.0 BCC Page 72 (104) 98-02-10 ...
Page 73
... READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error - 1 ... SERIAL ERROR (in this case the error can also mean, that the read/write device is not in the KeyInit Mode!) -12 ... EEPROM WRITE PROTECTED If any error occurs KeyInit Mode is exited immediately. Rev. 1.0 BCC Page 73 (104) Communication Reader-Host Htswp.doc/HS ...
Page 74
... BCC mode: 0x00 ... Password Mode off 0x01 ... Password Mode on READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error - 1 ... SERIAL ERROR (in this case the error can also mean, that the read/write device is not in the KeyInit Mode!) Htswp.doc/HS Rev. 1.0 Page 74 (104) 98-02-10 ...
Page 75
... Serial protocol: HOST - READ/WRITE DEVICE 0x09 'w' data[0] ....... READ/WRITE DEVICE - HOST 0x02 Status BCC Status: 0 ... no error - 1 ... SERIAL ERROR (in this case the error can also mean, that the read/write device is not in the KeyInit Mode!) Rev. 1.0 data[6] BCC Page 75 (104) Communication Reader-Host Htswp.doc/HS ...
Page 76
... HaltSelected ( ); while (!RWDEot); proloc GetSnr (&snr, &more); while (!RWDEot); no proloc HFReset ( ); while (!RWDEot case you want to access the same tags for several times. Htswp.doc/HS Rev. 1.0 START GetSnr yes RWDErr interpretation < errors no Select ...
Page 77
... Writes data to a transponder. Use C-Function proloc_WritePage or proloc_WriteBlock. Read (Plain) To substantially increase the data reliability we strictly recommend to read the previously written data (read after write). Use C-Function proloc_ReadPage or proloc_ReadBlock. HaltSelected Mutes the just treated transponder. Rev. 1.0 Page 77 (104) Communication Reader-Host Htswp.doc/HS ...
Page 78
... Carries out the mutual authentication of the transponder and the read/write device. Write (Crypto) Use C-Function proloc_WritePage or proloc_WriteBlock. Read (Crypto) To substantially increase the data reliability we strictly recommend to read the previously written data (read after write). Use C-Function proloc_ReadPage or proloc_ReadBlock. HaltSelected Htswp.doc/HS Rev. 1.0 Page 78 (104) 98-02-10 ...
Page 79
... Reads from the transponder to verify if the write process was successful. Use C-Function proloc_ReadPage_LT. If the response of the read/write device (to this first command after WritePage_LT) includes an error-condition, start from the beginning of the Write-Sequence again! HaltSelected_LT Mutes the just treated transponder. Rev. 1.0 Page 79 (104) Communication Reader-Host Htswp.doc/HS ...
Page 80
... Block 8 public user data Block 15 Areas (or settings) with light dark background may be configured by the OEM client using the Configuration Page (Page 1). Memory locations marked with "secret" can only be accessed after a mutual authentication. An enciphered data communication is used in that area. Memory locations marked with "public" can be accessed without mutual authentication, no encryption is used ...
Page 81
... In Proximity applications only one transponder is handled even if there are several transponders within the communication field of the antenna. In this case either no communication takes place or the "stronger" or closer transponder takes over. By muting a selected transponder (HALT Mode) another transponder that found in the communication field of the antenna can be recognized. Rev. 1.0 Page 81 (104) Transponders Htswp.doc/HS ...
Page 82
... Advanced Protocol Mode: This mode is activated using the command GetSnr_Adv. Advanced Protocol Mode is not available for HITAG 1 transponders based on ASIC HT1 ICS30 01x (only available for HITAG 1 transponders based on ASIC HT1 ICS30 02x). Advanced Protocol Mode uses, above all, an additional Cyclic Redundancy Check (CRC) for read operations ...
Page 83
... Block 6: "1" ... r/w "0" ... ro Block 5: "1" ... r/w "0" ... ro Block 4: "1" ... r/w "0" ... ro Block 3: "1" ... r/w "0" ... ro Block 2: "1" ... r/w "0" ... ro Key A and Key B: Logdata in Block 1: "1" ... r/w Page 83 (104) Transponders "1" ... wo "0" ... 0 "0" ... 0 Htswp.doc/HS ...
Page 84
... Bit= ‘0’: Access type for Blocks SECRET. Bit= ‘1’: Access type for Blocks PUBLIC. This bit can be set or reset until Bit 4 of Configuration Byte 1 is set to ‘0’. Htswp.doc/HS Rev. 1 Access type for Blocks "0" ... SECRET ...
Page 85
... Value for Transport Keys, Transport Logdata: 0x00000000 RECOMMENDATION: Before delivering transponders to end users, the Configuration Page should be set to read only (Configuration Byte 1/Bit 4 = ‘0’). Rev. 1 Page 85 (104) Transponders fixed can be changed can be changed can be changed can be changed can be changed Htswp.doc/HS ...
Page 86
... Password Mode: Page bit Config., 24 bit Password TAG Htswp.doc/HS Rev. 1.0 Content Serial Number 32 bit "KEY LOW" 16 bit " KEY HIGH" read/write page read/write page read/write page read/write page Content Serial Number Password RWD reserved read/write page ...
Page 87
... Operation-Modes and Configuration With the Configuration Byte the operation-mode and the access rights to the memory can be selected. During Power-Up of the transponder the Configuration Byte is read from the transponder’s EEPROM. If you change keys, passwords or configuration, you have to place the transponder directly on the antenna or hold it directly to it (0-distance)! In order to avoid any errors do not move the transponder during this write process and be sure that you are in a safe environment without electrical noise ...
Page 88
... Bit= ‘0’: Pages 1 and 2 are read/write. Bit= ‘1’: Pages 1 and 2 are locked against writing. This process is irreversible ! ATTENTION: Do not set Bit 7 of the Configuration Byte to ‘1’ before having written the final data into Pages 1 and 2 of the transponder. Htswp.doc/HS Rev. 1 Manchester Code ...
Page 89
... Before delivering transponders to end users, Pages should be locked (set Configuration Byte / Bit 6 to ‘1’ for Page 3 and set Configuration Byte / Bit 7 to ‘1’ for Pages 1 and 2). Rev. 1 MIKR ) (= MIKR ) (= ON ) Page 89 (104) Transponders fixed can be changed can be changed can be changed can be changed can be changed Htswp.doc/HS ...
Page 90
... Blocks 0 and 1 store information for read/write access control. The intention of these blocks is to provide some flexibility for different applications in terms of data security and access to relevant information. ATTENTION: PIT transponders can only be accessed using the proximity read/write device ! Htswp.doc/HS Rev. 1.0 Page 90 (104) 98-02-10 ...
Page 91
... MIRO / EM (H400x) Transponders 4.4.1 Memory Organization In the 64 bit memory the unique 40 bit serial numer of the transponder is stored as well as 24 bit header and parity bits. The data is read-only and cannot be changed. Rev. 1.0 Page 91 (104) Transponders Htswp.doc/HS ...
Page 92
... All the security relevant data in the read/write device can be protected from read or write accesses using special serial commands. Security relevant data for HITAG 1 transponders: Key information A and B Logdata 0A, 0B Logdata 1A, 1B Security relevant data for HITAG 2 transponders: Key information Password TAG Password RWD Htswp.doc/HS Rev. 1.0 Page 92 (104) 98-02-10 ...
Page 93
... Control_WO (only for HITAG 1) and Control_LT (only for HITAG 2). All control bytes are located in EEPROM of the read/write device. On delivery of a read/write device all bits of Control_RW, Control_WO and Control_LT are set to 1, except Bit 7 of CONTROL_RW (serial number). Rev. 1.0 Page 93 (104) Personalization Htswp.doc/HS ...
Page 94
... BIT NAME 7 Serial Number 6 Logdata1B 5 Logdata1A 4 Logdata1A 3 Logdata1A 2 Key A 1 Key B 0 Password Htswp.doc/HS Rev. 1.0 BIT-VALUE = 1 BIT-VALUE = 0 - read allowed read allowed read prohibited read allowed read prohibited read allowed read prohibited read allowed read prohibited read allowed read prohibited read allowed ...
Page 95
... Logdata1A 2 Key A 1 Key B 0 Password Rev. 1.0 BIT-VALUE = 1 BIT-VALUE = 0 - write allowed read/write prohibited write allowed read/write prohibited write allowed read/write prohibited write allowed read/write prohibited write allowed read/write prohibited write allowed read/write prohibited write allowed read/write prohibited Page 95 (104) Personalization - Htswp.doc/HS ...
Page 96
... Password TAG of the reader doesn’t, the read/write device transmits the error- message INCORRECT PASSWORD TAG to the host. We recommend to activate „Check PW TAG“ (set bit 1 to zero) in order to increase the security for GetSnr_LT and PollTags commands. Htswp.doc/HS Rev. 1.0 BIT-VALUE = 1 BIT-VALUE = 0 ...
Page 97
... Key A on the transponder KEY A LOGDATA 0A Set A LOGDATA 1A KEY B LOGDATA 0B Set B LOGDATA 1B Page 97 (104) Personalization the read/write device Htswp.doc/HS ...
Page 98
... Moreover, you need to know the old value if you want to change the key on the read/write device! Only after carrying out correctly steps 1 through to 3 (execute a read-access test with the changed key to check it!) may the second key be changed following the steps described above. Conveniently you change both keys to the same value! Htswp.doc/HS Rev. 1.0 Page 98 (104) 98-02-10 ...
Page 99
... For changing the logdata of a big number of tags we recommend to doing it in the same way as described in the former chapter „Changing Keys“ in the note. When you change a key, this does not mean that you also have to change the corresponding logdata and the other way round. Rev. 1.0 Page 99 (104) Personalization Htswp.doc/HS ...
Page 100
... CONTROL_LT): Password TAG HITAG 2 in Crypto mode: on the read/write device KEY LOW KEY HIGH as an option (depending on bit 1 of CONTROL_LT): Password TAG Htswp.doc/HS Rev. 1.0 on the transponder Password RWD Password TAG on the transponder KEY LOW KEY HIGH ...
Page 101
... Bytes 1..3 are set to the new Password TAG value. Then Byte 0 to Byte 3 are written to the transponder. 2. Change Password TAG on the read/write device to the new value. Again, you need to know the old values before they can be changed on the read/write device. Rev. 1.0 Page 101 (104) Personalization Htswp.doc/HS ...
Page 102
... You can protect sensitive data better than less sensitive data, thus permitting optimised operation times. Detailed instructions how to use and calculate Cyclic Redundancy Check (CRC) are available at Philips Semiconductors in the following Application Note: HT1 (resp. HT2) Transponder Family, Reliability and Integrity of Data Transmission. Htswp.doc/HS Rev. 1.0 0xFF ...
Page 103
... The transponders and the read/write device are provided with identical transport keys and transport logdata by Philips Semiconductors so that you can start operating them right away. In order to offer our OEM clients high flexibility, the configuration of the transponder memory, password, keys and logdata can be changed ...
Page 104
... Security Considerations INTENTIONALLY LEFT BLANK Htswp.doc/HS Rev. 1.0 Page 104 (104) 98-02-10 ...