RM310 NXP Semiconductors, RM310 Datasheet
RM310
Available stocks
Related parts for RM310
RM310 Summary of contents
Page 1
HT RM 310 TM HITAG Mini Reader Module Preliminary Specification Revision 2.3 November 1997 ...
Page 2
... Contents: 1. Introduction.................................................................................................................4 1.1. Features of the Reader Module HT RM310 ....................................................................4 1.2. System Structure ............................................................................................................5 2. Technical Data ............................................................................................................6 2.1. General Data ..................................................................................................................6 2.2. Dimensions of the HT RM310 ........................................................................................6 2.3. Pin Assignment of the Male Connector ...........................................................................7 2.4. How to Design Proximity Antennas ................................................................................8 2.4.1. Basics.................................................................................................................8 2.4.2. Antenna Coil ......................................................................................................9 2.4.3. Measuring Inductance.......................................................................................10 2.4.4. Antenna Tuning ................................................................................................10 2.4.5. Determining the Serial Resistance of the Antenna..............................................11 2.4.6. Checking the Antenna Voltage Û ...
Page 3
... HT RM310 3.3.16. WritePage_HT2..............................................................................................28 3.3.17. ReadPublic A..................................................................................................29 3.3.18. ReadPublic B..................................................................................................29 3.3.19. HF-OFF..........................................................................................................30 3.3.20. Powerdown ....................................................................................................30 3.3.21. GetVersion .....................................................................................................30 3.3.22. WriteSecret_HT .............................................................................................31 4. Appendix A: Timing Interface.................................................................................34 5. Appendix B: Application Example .........................................................................35 6. Appendix C: Reaction Times of the Reader Module ............................................36 7. Appendix D: List of Command Bytes ....................................................................37 8. Appendix E: List of Status Bytes ...........................................................................38 9. Appendix F: List of KEYS in the Crypto Processor..............................................40 HITAG™ ...
Page 4
... Features of the Reader Module HT RM310 The reader module HT RM310 was designed for reading HITAG 1 and HITAG 2 transponders. It allows universal and cost efficient communication with transponders on a very basic system level. Thanks to the small size of the module it can be easily integrated and used in various applications. ...
Page 5
... System Structure The components shown in the diagram above are required in order to create a complete system with the HT RM310 reader module. Antennas of different shapes can be connected to the module. The antennas are tuned using a ca- pacitance and optionally a resistor. For detailed information please see Chapter 2.4. ...
Page 6
... Supply voltage Power consumption: standard mode energy saving mode Temperature range Antenna Interface EEPROM (HT RM310 only) 2.2. Dimensions of the HT RM310 Rev. 2.3 47.3 x 28.3 x 11.4mm (depends on the geometry of the antenna) typ. 290 -25°C to +70 °C in operation -40°C to +85°C when stored ...
Page 7
... HT RM310 2.3. Pin Assignment of the Male Connector The male connector is divided into two lines. For the pin numbers please refer to the diagram "Dimensions of the HT RM310". Pin Number Name 1 /HCDA 2 /RCDA 3 /MCLR 4 VCC 5 GND 6 RxA 7 TxA Only regulated voltage to be used Htrm310 ...
Page 8
... Maximum antenna current ( Î ) Maximum input voltage (Pin RxA, Û The resistance R2 (approx. 600 ... 1000 ) is only needed with cables longer than 50 cm. Rev. 2.3 (Pin TxA) of approximately 2.5Vp the following limits apply to out : 100 mAp ) : Page RM310 Htrm310.doc/HS ...
Page 9
... HT RM310 2.4.2. Antenna Coil The inductance of the coil should be in the range of 350 and 500 µH. The quality factor of the antenna should be approximately Q = 40. If the Q factor is too high, it must be reduced by using an additional resistor. Generally speaking it is better to have a smaller diameter of the wire for the coil rather than using an additional resistor. ...
Page 10
... The aim is to arrive at a resonance frequency of 125 kHz using C The phase of impedance has the range of +/- 10°. Rev. 2 with an oscilloscope. Then change the frequency until Û and Û R has to be increased too low Page RM310 f has Htrm310.doc/HS R ...
Page 11
... HT RM310 2.4.5. Determining the Serial Resistance of the Antenna Use an oscilloscope to measure Û The serial resistance R can be calculated with the following formula: S 2.4.6. Checking the Antenna Voltage Û Before connecting the antenna to the read/write device (as shown in the graph below), you must carry out a check calculation of the input level of the read/write device according to the formula below in order to prevent damage ...
Page 12
... It can be calculated according to the for- mula given in Chapter 2.4.5. Rev. 2 420 000 described in Chapter 2.4.4. S Page 633 a ln Htrm310.doc/HS HT RM310 ...
Page 13
... The quality factor of the coil is calculated as follows knowing R and the dropping resistor (R s can be calculated very important to calculate the antenna voltage before connecting the antenna to the HT RM310 module to avoid damage. If the calculated value of Û Û =32 Vp, a resistor R must be used to protect the receiver input The resistor has to be placed as shown in Chapter 2 ...
Page 14
... Interface HT RM310 Communication with the host is carried out via an 8 Bit parallel interface with two control lines. 3.1. General Definitions 3.1.1. Hardware The interface needs in total 10 lines (8 data lines and 2 control lines). The data lines are bi- directional, while the control lines are unidirectional. The control lines from host to reader module (host control data /HCDA) and from reader module to host (reader control data /RCDA ) are low active ...
Page 15
... HT RM310 3.1.2. Structure of the Protocol The protocol is structured according to the following format: Byte 1 Function Command/Status Command / Status Contains either the command number of the command to be executed or the status message for the command to be executed. Please refer to the appendix for the structure of the command/status byte. ...
Page 16
... Selects transponder and reads serial number in Crypto Mode Sets transponder in halt mode Reads a page Reads a Bit inverted page Writes a page (with single inversion of the address) Reads Page 4 and 5 of HT2 in Public Mode A Reads Page HT2 in Public Mode B Page RM310 Function Function Function Htrm310.doc/HS ...
Page 17
... HT RM310 3.2.4. General Commands Name of command HF_OFF Power Down GetVersion 3.2.5. Commands for Personalization Name of command WriteSecret_HT Htrm310.doc/HS Rev. 2.3 Deactivates the RF field. The RF field is activated with any command or with each LOW signal generated by /HCDA. Sets the entire module into sleep mode. The sleep mode is deactivated by any command or LOW signal of /HCDA. ...
Page 18
... The “Advanced Protocol Mode“ is not supported by transponder version HT1 ICS30 0 only by version HT1 ICS30 0 Protocol: Host - Reader module Reader module - Host Rev. 2 with serial numbers 0x y yyyyyy Page RM310 0x10 status Snr [0] Snr [3] status error 1 INTERFACE error 3 NOTAG error 1 0x11 status ...
Page 19
... HT RM310 3.3.3. SelectSnr_HT1 This command selects a HITAG 1 transponder with the serial number given in the protocol. With this selection the transponder is prepared for read and write commands in HITAG 1 mode. The command provides the OTP of the selected transponder. Using the “Advanced Protocol Mode“ of HITAG 1 transponders by using the “GetSnr_HT1_Adv“ command the data is followed Bit CRC ...
Page 20
... Bit CRC. Protocol: Host - Reader module Reader module - Host Rev. 2.3 0x14 status status error 1 INTERFACE error 8 ACKNOWLEDGEMENT error 0x15 / 0x16 pagenr status data[0] data[3] status error 1 INTERFACE error 3 NOTAG error 9 CRYPTOBLOCK NOT INIT Page RM310 Htrm310.doc/HS ...
Page 21
... HT RM310 3.3.7. ReadBlock_HT1_P / ReadBlock_HT1_C Reads a block ( pages) of the selected transponder. The command “ReadBlock_HT1_P“ reads plain areas of the HITAG 1 transponders only. Reading encrypted areas of the HITAG 1 transponder with this command leads to a status “NOTAG error“ and the transponder is reset. To read encrypted areas of the transponders use the command “ReadBlock_HT1_C“. ...
Page 22
... Upon completion of the write command, a “Read after Write“ procedure should be carried out in order to check whether the write access was successful. Protocol: Host - Reader module Reader module - Host Rev. 2.3 0x19 /0x1A pagenr data[0] data[3] status status error 1 INTERFACE error 3 NOTAG error 4 TIMEOUT error 9 CRYPTOBLOCK NOT INIT Page RM310 Htrm310.doc/HS ...
Page 23
... HT RM310 3.3.9. WriteBlock_HT1_P / Write Block_HT1_C Writes a block ( pages) of the selected transponder. Writing to encrypted areas of the HITAG 1 transponder with this command leads to a status “NOTAG error“ and the transponder is reset. To write to encrypted areas of the transponders use the command “WriteBlock_HT1_C“. Access to the secret area is only possible in Crypto Mode after a mutual authentication. ...
Page 24
... Using the Byte “loginfo“ you can choose between Log information (Keys and Logdata Protocol: Host - Reader module Reader module - Host Rev. 2.3 0x1D loginfo loginfo: status status error 1 INTERFACE error 7 AUTHENT error Page RM310 0x00 loginfo A 0x02 loginfo B Htrm310.doc/HS ...
Page 25
... HT RM310 3.3.11. GetSnr_HT2_P This command selects a HITAG 2 transponder in Password Mode. With this selection the transponder is prepared for read and write commands in HITAG 2 Password Mode. For the selection in Password Mode, a password is transmitted to the reader module which must correspond to Page 1 on the transponder (Password RWD). After the command has been exe- cuted, the reader module returns the serial number and the content of Page 3 (configbyte with 24 Bit Password TAG) ...
Page 26
... If the transponder is set in one of the public modes, it can only be selected within 2.56 ms after reset (entering the RF field or activating the RF field). Protocol: Host - Reader module Reader module - Host Rev. 2.3 0x0B status Snr [0] Snr [3] configbyte Password TAG [0] Password TAG [2] status error 1 INTERFACE error 3 NOTAG error 7 AUTHENT error Page RM310 Htrm310.doc/HS ...
Page 27
... HT RM310 3.3.13. HaltSelected_HT2 Sets the selected transponder in halt mode, i.e. the transponder is muted until it has left the RF field or until the RF field is deactivated. By using this command different transponders can be han- dled simultaneously in the operating field of the antenna. Protocol: Host - Reader module Reader module - Host 3 ...
Page 28
... Please note: The address is transmitted both non-inverted and inverted to the transponder. Protocol: Host - Reader module Reader module - Host Rev. 2.3 0x0E pagenr status data [0] data [3] status error 1 INTERFACE error 3 NOTAG error 0x0F pagenr data [0] data [3] status status error 1 INTERFACE error 3 NOTAG error 4 TIMEOUT error Page RM310 Htrm310.doc/HS ...
Page 29
... HT RM310 3.3.17. ReadPublic A Reads a transponder in Public A Mode. The coding of the data area must contain a header and the parity structure of the µEM H400x. Only the 40 Bit (5 byte) information of the µEM H400x data (1 byte customer ID; 4 byte user ID) is transmitted. Protocol: Host - Reader module Reader module - Host 3 ...
Page 30
... Reads the software version of the reader module. Protocol: Host - Reader module Reader module - Host Rev. 2.3 0x01 status status error 1 INTERFACE error 0x02 status status error 1 INTERFACE error 0x03 status Version - overview Version - in detail reserved reserved status error 1 INTERFACE error Page RM310 Htrm310.doc/HS ...
Page 31
... HT RM310 3.3.22. WriteSecret_HT Using this command the reader module receives the data needed for the secret access to the HITAG transponders. The data is stored "write only" in the internal EEPROM of the Crypto Processor. In order to change the data, the value of the current data has to be transmitted first to the reader module. The individual data areas of the secret access data are changed one after another and the module returnes “ ...
Page 32
... Logdata 0B [3] status status error 1 INTERFACE error 80 Wrong Crypto 84 Wrong old Logdata 0B 0x00 old Logdata 1A [0] old Logdata 1A [3] new Logdata 1A [0] new Logdata 1A [3] status status error 1 INTERFACE error 80 Wrong Crypto 85 Wrong old Logdata 1A Page RM310 Htrm310.doc/HS ...
Page 33
... HT RM310 Host - Reader module Reader module - Host Host - Reader module Reader module - Host Host - Reader module Reader module - Host Htrm310.doc/HS Rev. 2.3 0x00 old Logdata 1B [0] old Logdata 1B [3] new Logdata 1B [0] new Logdata 1B [3] status status error 1 INTERFACE error 80 Wrong Crypto ...
Page 34
... Appendix A: Timing Interface Host HT RM310-Module (Receive Mode): HDCA RCDA t RLR HT RM310-Module Host (Transmit Mode): RCDA HCDA t Time Description t wait for RCDA Low in Receive Mode RLR t wait for RCDA High in Receive Mode RHR t wait for RCDA Low in Transmit Mode RLT t wait for RCDA High in Transmit Mode ...
Page 35
... HT RM310 5. Appendix B: Application Example The figure below shows an example of a standard application with the HT RM310 Mini Reader Module connected to a host. To avoid destruction of the internal EEPROM data in case of powerfailure a power supervisory circuit to monitor the supply voltage is required. Htrm310.doc/HS Rev. 2.3 Page ...
Page 36
... Page RM310 max. unit ...
Page 37
... HT RM310 7. Appendix D: List of Command Bytes Hex Value Command 0x00 WriteSecret_HT 0x01 HF_OFF 0x02 Power down 0x03 GetVersion 0x07 ReadPublic A 0x08 ReadPublic B 0x0A GetSnr_HT2_P 0x0B GetSnr_HT2_C 0x0C HaltSelected_HT2 0x0D ReadPage_HT2 0x0E ReadPageInv_HT2 0x0F WritePage_HT2 0x10 GetSnr_HT1 0x11 GetSnr_HT1_A 0x12 SelectSnr_HT1 0x13 SelectLastSnr_HT1 ...
Page 38
... Wrong crypto 0x81 Wrong old Key A 0x82 Wrong old Key B 0x83 Wrong old Logdata 0A 0x84 Wrong old Logdata 0B 0x85 Wrong old Logdata 1A 0x86 Wrong old Logdata 1B 0x87 Wrong old Key 16 0x88 Wrong old Key 32 Rev. 2.3 Page RM310 Htrm310.doc/HS ...
Page 39
... HT RM310 Meaning of the status bytes: no error: INTERFACE error: NOTAG error: TIMEOUT error: PASSWORD RWD error: AUTHENT error: ACKNOWLEDGEMENT error: CRYPTOBLOCK NOT INIT Wrong Crypto: Wrong old Key A: Wrong old Key B: Wrong old Logdata 0A: Wrong old Logdata 0B: Wrong old Logdata 1A: Wrong old Logdata 1B: ...
Page 40
... HT1 Key B 00 HT1 Logdata 0A 00 HT1 Logdata 0B 00 HT1 Logdata 1A 00 HT1 Logdata 1B 00 HT2 Key 16 20 HT2 Key 32 4D Rev. 2.3 Hex Value Page RM310 Htrm310.doc/HS ...
Page 41
Philips Semiconductors - a worldwide company Argentina: see South America Australia: 34 Waterloo Road, NORTHRYDE, NSW 2113, Tel. +612 9805 4455, Fax. +612 9805 4466 Austria: Computerstraße 6, A-1101 WIEN, P.O.Box 213, Tel. +431 60 101, Fax. +431 30 101 ...