NT3H2211W0FTT

NT3H2111_2211 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Rev. 3.5 — 7 May 2019 359935 General description Designed to be the perfect enabler for NFC in home-automation and consumer applications, this feature-packed, second-generation connected NFC tag is the fastest, least expensive way to add tap-and-go connectivity to just about any electronic device. 2 NXP NTAG I C plus is a family of connected NFC tags that combine a passive NFC 2 interface with a contact I C interface. As the second generation of NXP’s industry leading connected-tag technology, these devices maintain full backward compatibility with first2 generation NTAG I C products, while adding new, advanced features for password protection, full memory-access configuration from both interfaces, and an originality signature for protection against cloning. The second-generation technology provides four times higher pass-through performance, 2 along with energy harvesting capabilities, yet NTAG I C plus devices are optimized for use in entry-level NFC applications and offer the lowest BoM of any NFC solution. 2 I C and NFC communications are based on simple, standard command sets, and are augmented by the demo board OM5569/NT322E, which includes online reference source code. All that is required is a simple antenna design (see Ref. 5), with no or only limited extra components, and there are plenty of reference designs online for inspiration. NTAG 2 I C plus development board is certified as NFC Forum Type 2 Tag (Certification ID: 58514). ISO/IEC 14443 1 Product data sheet COMPANY PUBLIC Data I2 C SRAM 1 0 1 0 1 0 MCU EEPROM Energy harvesting Energy Figure 1. Contactless and contact system Event detection Data Energy aaa-030257 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 2 Features and benefits 2.1 Key features • Interoperability – ISO/IEC 14443 Part 2 and 3 compliant 2 – NTAG I C plus development board is certified as NFC Forum Type 2 Tag (Certification ID: 58514) – Unique 7 byte UID – GET_VERSION command for easy identification of chip type and supported features – Input capacitance of 50 pF • Host interface 2 – I C slave – Configurable field detection pin based on open-drain implementation to signal NFC events or synchronize pass-through data transfer • Memory – 2k bytes EEPROM 2 – 64 bytes SRAM buffer for transfer of data between NFC and I C interfaces with memory mirror or pass-through mode 2 – Clear arbitration between NFC and I C memory access • Data transfer – Pass-through mode with 64 byte SRAM buffer – FAST_WRITE and FAST_READ NFC commands for higher data throughput • Security and memory-access management – Full, read-only, or no memory access from NFC interface, based on 32-bit password 2 – Full, read-only, or no memory access from I C interface – NFC silence feature to disable the NFC interface – Originality signature based on Elliptic Curve Cryptography (ECC) for simple, genuine authentication • Power Management – Configurable field-detection output signal for data-transfer synchronization and device wake-up – Energy harvesting from NFC field, so as to power external devices (e.g. connected microcontroller) • Industrial requirements – Temperature range from -40 °C up to 105 °C 2.2 NFC interface • Contactless transmission of data at 106 kbps 2 • NTAG I C plus development board is certified as NFC Forum Type 2 Tag (Certification ID: 58514) (see Ref. 1) • ISO/IEC 14443A compliant (see Ref. 2) • Data transfer of 106 kbit/s • 4 bytes (one page) written including all overhead in 4.8 ms via EEPROM or 0.8 ms via SRAM • 64 bytes (whole SRAM) written including all overhead in 6.1 ms using FAST_WRITE command NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 2 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting • Data integrity of 16-bit CRC, parity, bit coding, bit counting • Operating distance of up to 100 mm (depending on various parameters, such as field strength and antenna geometry) • True anticollision • Unique 7-byte serial number (UID) according to ISO/IEC 14443-3 (see Ref. 2) 2.3 Memory • • • • 2k bytes EEPROM 64 bytes SRAM volatile memory without write endurance limitation Data retention time of minimum 20 years EEPROM write endurance minimum 500.000 cycles 2 2.4 I C interface • • • • 2 I C slave interface supports frequencies up to 400 kHz (see Section 13.1) 2 Fail safe I C operation 2 I C slave supports 7-bit slave address. As the least significant R/W bit is used to indicate data transfer direction, default slave address 55h recalculates to an I²C write address AAh and an I²C read address ABh respectively. • 16 bytes (one block) written in 4 ms (EEPROM) or 0.4 ms (SRAM) 2 2 2 • NTAG I C plus can be used as standard I C EEPROM and I C SRAM 2.5 Security • Manufacturer-programmed 7-byte UID for each device • Capability container with one time programmable bits • Field programmable read-only locking function per page for first 12 pages and per 16 (1k version) or 32 (2k version) pages for the extended memory section • ECC-based originality signature • 32-bit password protection to prevent unauthorized memory operations from NFC perspective may be enabled for parts of, or complete memory 2 • Access to password protected data area may be restricted from I C perspective • Pass-through and mirror mode operation may be password protected • Protected data can be safeguarded against limited number of negative password authentication attempts 2.6 Key benefits • Full interoperability with every NFC-enabled device • Smooth end-user experience with super-fast data exchange (up to 40 kbit/s) via NFC 2 and I C interface • Zero-power operation with non-volatile data storage • Energy harvesting feature delivers up to 15 mW out of NFC field to power (parts of) host system • Data protection to prevent unauthorized data manipulation • Multi-application support, enabled by memory size and segmentation options • Lowest bill of materials and smallest footprint for NFC solution in embedded electronics NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 3 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 3 Applications 2 NXP NTAG I C plus is a family of connected NFC tags that combine a passive NFC 2 interface with a contact I C interface. As the second generation of NXP’s industry-leading connected-tag technology, these devices maintain full backward compatibility with first2 generation NTAG I C products, while adding new, advanced features for password protection, full memory-access configuration from both interfaces, and an originality signature for protection against cloning. The second-generation technology provides four times higher pass-through performance, 2 along with energy harvesting capabilities, yet NTAG I C plus devices are optimized for use in NFC applications like: • • • • • • • • • • NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC IoT nodes (home automation, smart home, etc.) Pairing and configuration of consumer applications NFC accessories (headsets, speakers, etc.) Wearable infotainment Fitness equipment Consumer electronics Healthcare Smart printers Meters Electronic shelf labels All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 4 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 4 Ordering information Table 1. Ordering information Type number Package Name Description Version NT3H2111W0FHK XQFN8 Plastic, extremely thin quad flat package; no leads; 8 terminals; body 1.6 x 1.6 x 0.5 mm; 1k bytes memory, 50 pF input capacitance SOT902-3 NT3H2211W0FHK XQFN8 Plastic, extremely thin quad flat package; no leads; 8 terminals; body 1.6 x 1.6 x 0.5 mm; 2k bytes memory, 50 pF input capacitance SOT902-3 NT3H2111W0FTT TSSOP8 Plastic thin shrink small outline package; 8 leads; body width 3 mm; 1k bytes memory; 50 pF input capacitance SOT505-1 NT3H2211W0FTT TSSOP8 Plastic thin shrink small outline package; 8 leads; body width 3 mm; 2k bytes memory; 50 pF input capacitance SOT505-1 NT3H2111W0FT1 SO8 Plastic small outline package; 8 leads; body width 3.9 mm, 1k bytes memory; 50 pF input capacitance SOT96-1 NT3H2211W0FT1 SO8 Plastic small outline package; 8 leads; body width 3.9 mm, 2k bytes memory; 50 pF input capacitance SOT96-1 NT3H2111W0FUG FFC bumped 8 inch wafer, 150um thickness, on film frame carrier, electronic fail die marking according to SECS-II format), Au bumps, 1k Bytes memory, 50 pF input capacitance NT3H2211W0FUG FFC bumped 8 inch wafer, 150um thickness, on film frame carrier, electronic fail die marking according to SECS-II format), Au bumps, 2k Bytes memory, 50 pF input capacitance REMARK: Wafer specification addendum is available after exchange of a non-disclosure agreement (NDA) NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 5 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 5 Marking Table 2. Marking codes Marking code Type number Line 1 Line 2 Line 3 NT3H2111W0FHK 211 - - NT3H2211W0FHK 221 - - NT3H2111W0FTT 32111 DBSN ASID YWW NT3H2211W0FTT 32211 DBSN ASID YWW NT3H2111W0FT1 NT32111 DBSN ASID nDYWW NT3H2211W0FT1 NT32211 DBSN ASID nDYWW Used abbreviations: DBSN: Diffusion Batch Sequence Number ASID: Assembly Sequence ID n: Assembly Centre Code D: RHF-2006 indicator Y: year WW: week NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 6 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 6 Block diagram VCC LA RF INTERFACE LB GND Vout POWER MANAGEMENT/ ENERGY HARVESTING I2C SLAVE DIGITAL CONTROL UNIT MEMORY ARBITER/STATUS REGISTERS I2C CONTROL EEPROM ANTICOLLISION COMMAND INTERPRETER MEMORY INTERFACE FD SDA SCL SRAM aaa-010358 Figure 2. Block diagram NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 7 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 7 Pinning information 7.1 Pinning 7.1.1 XQFN8 LB LA 1 VSS 2 SCL 3 8 7 VOUT 6 VCC 5 SDA 4 FD Transparent top view aaa-021647 Figure 3. Pin configuration for XQFN8 Detailed package and soldering information may be found in Section 17. 7.1.2 TSSOP8 LA 1 8 LB VSS 2 7 VOUT SCL 3 6 VCC FD 4 5 SDA aaa-021648 Figure 4. Pin configuration for TSSOP8 Detailed package and soldering information may be found in Section 17. 7.1.3 SO8 LA 1 8 LB VSS 2 7 VOUT SCL 3 6 VCC FD 4 5 SDA aaa-021649 Figure 5. Pin configuration for SO8 Detailed package and soldering information may be found in Section 17. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 8 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 7.2 Pin description Table 3. Pin description for XQFN8, TSSOP8 and SO8 NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC Pin Symbol Description 1 LA Antenna connection LA 2 VSS GND 3 SCL Serial clock I C 4 FD Field detection 5 SDA Serial data I C 6 VCC VCC in connection (external power supply) 7 VOUT Voltage out (energy harvesting) 8 LB Antenna connection LB 2 2 All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 9 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 8 Functional description 8.1 Block description 2 NTAG I C plus ICs consist of EEPROM, SRAM, NFC interface, Digital Control Unit 2 (Command interpreter, Anticollision, Arbiter/Status registers, I C control and Memory 2 Interface), Power Management and Energy Harvesting Unit and an I C slave interface. Energy and data are transferred via an antenna consisting of a coil with a few turns, 2 which is directly connected to NTAG I C plus IC. 8.2 NFC interface The passive NFC-interface is based on the ISO/IEC 14443-3 Type A standard. It requires to be supplied by an NFC field (e.g. NFC enabled device) always to be able to receive appropriate commands and send the related responses. As defined in ISO/IEC 14443-3 Type A for both directions of data communication, there is one start bit (start of communication) at the beginning of each frame. Each byte is transmitted with an odd parity bit at the end. The least significant bit of the byte 0 of the selected block is transmitted first. For a multi-byte parameter, the least significant byte is always transmitted first. For example, when reading from the memory using the READ command, byte 0 from the addressed block is transmitted first, followed by bytes 1 to byte 3 out of this block. The same sequence continues for the next block and all subsequent blocks. 8.2.1 Data integrity The following mechanisms are implemented in the contactless communication link 2 between the NFC device and the NTAG I C plus IC to ensure very reliable data transmission: • • • • • 16 bits CRC per block Parity bits for each byte Bit count checking Bit coding to distinguish between "1", "0" and "no information" Channel monitoring (protocol sequence and bit stream analysis) The commands are initiated by the NFC device and controlled by the Digital Control Unit 2 of the NTAG I C plus IC. The command response depends on the state of the IC, and for memory operations, the access conditions valid for the corresponding page. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 10 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 8.2.2 NFC state machine POR HALT IDLE REQA WUPA WUPA READY 1 identification and selection procedure ANTICOLLISION SELECT cascade level 1 HLTA ANTICOLLISION READY 2 HLTA SELECT cascade level 2 READ FAST_READ WRITE FAST_WRITE GET_VERSION READ_SIG ACTIVE memory operations PWD_AUTH AUTHENTICATED READ FAST_READ WRITE PWD_AUTH GET_VERSION READ_SIG aaa-021650 2 Figure 6. NFC state machine of NTAG I C plus The overall NFC state machine is summarized in Figure 6. When an error is detected or an unexpected command is received, in each state the tag returns to IDLE or HALT state as defined in ISO/IEC 14443-3 Type A. 8.2.2.1 IDLE state 2 After a Power-On Reset (POR), the NTAG I C plus switches to the default waiting state, namely the IDLE state. It exits IDLE towards READY 1 state when a REQA or a WUPA command is received from the NFC device. Any other data received while in IDLE state 2 is interpreted as an error, and the NTAG I C plus remains in the IDLE state. 8.2.2.2 READY 1 state In the READY 1 state, the NFC device resolves the first part of the UID (3 bytes) using the ANTICOLLISION or SELECT commands for cascade level 1. READY 1 state is correctly exited after. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 11 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting • receiving SELECT command from cascade level 1 with the matching of complete first 2 part of the UID. In this case, the NFC device switches the NTAG I C plus into READY 2 state where the second part of the UID gets resolved. 2 Remark: The response of the NTAG I C plus to the SELECT command is the Select AcKnowledge (SAK) byte with cascade bit set to 1b indicating that UID is not complete. 8.2.2.3 READY 2 state In the READY 2 state, the NFC device resolves the second part of the UID (4 bytes) using the ANTICOLLISION or SELECT command for cascade level 2. READY2 state is correctly exited after. • receiving SELECT command from cascade level 2 with the matching of complete 2 second part of the UID. In this case, the NFC device switches the NTAG I C plus into ACTIVE state where all application-related commands can be executed. 2 Remark: The response of the NTAG I C plus to the SELECT command in READY 2 state is the Select AcKnowledge (SAK) byte with cascade bit cleared to indicate, that 2 NTAG I C plus is now uniquely selected and only this device will communicate with the NFC device even when other contactless devices are present in the NFC device field. 8.2.2.4 ACTIVE state All unprotected memory operations are operated in the ACTIVE and AUTHENTICATED states. The ACTIVE state is exited with the PWD_AUTH command or with the HLTA command. 2 Upon reception of a correct password within PWD_AUTH command, the NTAG I C plus transits to AUTHENTICATED state after responding with PACK. 2 With the HLTA command, the NTAG I C plus transits to the HALT state. Any other invalid command in ACTIVE state is interpreted as an error. Depending on its 2 previous state, the NTAG I C plus returns to either to the IDLE or HALT state. 8.2.2.5 AUTHENTICATED state Protected memory operations are only operated in the AUTHENTICATED state, however access to the unprotected memory is possible, too. The AUTHENTICATED state is exited with the HLTA command and upon reception, the 2 NTAG I C plus transits to the HALT state. Any other invalid command in AUTHENTICATED state is interpreted as an error. 2 Depending on its previous state, the NTAG I C plus returns to either to the IDLE or HALT state. 8.2.2.6 HALT state 2 HALT and IDLE states constitute the two waiting states implemented in the NTAG I C 2 plus. An already processed NTAG I C plus in ACTIVE or AUTHENTICATED state can be set into the HALT state using the HLTA command. In the anticollision phase, this state helps the NFC device distinguish between processed tags and tags yet to be selected. 2 The NTAG I C plus can only exit HALT state upon execution of the WUPA command. Any other data received when the device is in this state is interpreted as an error, and 2 NTAG I C plus state remains unchanged. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 12 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 8.3 Memory organization The memory map is detailed in Table 4 (1k memory) and Table 5 (2k memory) from 2 the NFC interface and in Table 6 (1k memory) and Table 7 (2k memory) from the I C interface. The SRAM memory is only available and accessible when powered via VCC. Please refer to Section 11 for examples of memory map from the NFC interface with SRAM mapping. The structure of manufacturing data, static and dynamic lock bytes, capability container and user memory pages are compatible with other NTAG products. Any memory access which starts at a valid address and extends into an invalid access region will return 00h value for the invalid region. Bits and bytes mareked as reserved for future use (RFU) SHALL NOT be changed, as it may lead to unintended tag behaviour. 8.3.1 Memory map from NFC perspective Memory access from the NFC perspective is organized in pages of 4 bytes each. If password protection is not used, complete user memory is unprotected. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 13 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 2 Table 4. NTAG I C plus 1k memory organization from the NFC perspective Sector Page address Byte number within a page address Dec. Hex. 0 0 00h 1 01h Serial number (UID) 2 02h Internal 3 03h 4 04h ... ... AUTH0 AUTH0 ... ... 225 E1h 226 E2h 0 1 2 Access cond. 3 Serial number (UID) READ READ Internal Static lock bytes READ/R&W Capability Container (CC) READ&WRITE Unprotected user memory READ&WRITE 1 Protected user memory Dynamic lock bytes READ 1 READ&WRITE 1 READ&WRITE 1 READ&WRITE 1 READ&WRITE 1 READ&WRITE E3h RFU RFU RFU AUTH0 READ 228 E4h ACCESS RFU RFU RFU READ E5h 230 E6h 231 E7h 232 E8h 233 E9h 234 EAh 235 EBh 236 ECh 237 EDh 238 EEh 239 EFh 240 F0h ... ... 255 FFh 1 ... 2 3 PWD 2 PACK PT_I2C 2 READ RFU RFU RFU RFU RFU READ&WRITE R&W/READ 00h 227 229 Access cond. AUTH. state ACTIVE state READ READ Configuration registers see 8.3.12 Invalid access - returns NAK n.a. Session registers see 8.3.12 Invalid access - returns NAK n.a. Invalid access - returns NAK n.a. ... Invalid access - returns NAK n.a. ... ... Invalid access - returns NAK n.a. 0 00h ... ... Invalid access - returns NAK n.a. 248 F8h 249 F9h Mirrored session registers see 8.3.12 NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 14 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Sector address 1 2 Page address Dec. Hex. ... ... 255 FFh Byte number within a page 0 1 2 Access cond. 3 Invalid access - returns NAK Access cond. AUTH. state ACTIVE state n.a. 2 If NFC_PROT bit is set to 1b, NTAG I C plus returns NAK 2 On reading PWD or PACK, NTAG I C plus always returns 00h for all bytes NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 15 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 2 Table 5. NTAG I C plus 2k memory organization from the NFC perspective Sector Page address Byte number within a page address Dec. Hex. 0 0 00h 1 01h Serial number (UID) 2 02h Internal 3 03h 4 04h ... ... AUTH0 AUTH0 ... ... 225 E1h 226 E2h 1 2 3 Serial number (UID) READ READ Internal Static lock bytes READ/R&W Capability Container (CC) READ&WRITE Unprotected user memory READ&WRITE 1 Protected user memory READ Dynamic lock bytes 1 READ&WRITE 1 READ&WRITE 1 READ&WRITE 1 READ&WRITE 1 READ&WRITE RFU RFU RFU AUTH0 READ 228 E4h ACCESS RFU RFU RFU READ E5h 230 E6h E7h 232 E8h 233 E9h 234 EAh 235 EBh 236 ECh 237 EDh 238 EEh ... ... 255 FFh 0 00h ... ... 255 FFh 2 ... ... 3 0 00h ... ... 248 F8h 249 F9h NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC PWD 2 PACK PT_I2C 2 READ RFU RFU RFU RFU RFU READ&WRITE R&W/READ 00h E3h 229 Access cond. AUTH. state ACTIVE state 227 231 1 0 Access cond. READ READ Configuration registers see 8.3.12 Invalid access - returns NAK n.a. Session registers see 8.3.12 Invalid access - returns NAK n.a. 3,4 (Un-)protected user memory see protected user memory in Sector 0 Invalid access - returns NAK n.a. Invalid access - returns NAK n.a. Mirrored session registers see 8.3.12 All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 16 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Sector address 1 2 3 4 Page address Dec. Hex. ... ... 255 FFh Byte number within a page 0 1 2 Access cond. 3 Invalid access - returns NAK Access cond. AUTH. state ACTIVE state n.a. 2 If NFC_PROT bit is set to 1b, NTAG I C plus returns NAK 2 On reading PWD or PACK, NTAG I C plus always returns 00h for all bytes 2 If 2K_PROT bit is set to 1b, complete Sector 1 of NTAG I C plus is password protected 2 If NFC_DIS_SEC1 bit is set to 1b, complete Sector 1 of NTAG I C plus is not accessible from NFC perspective NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 17 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 2 8.3.2 Memory map from I C interface 2 2 The memory access of NTAG I C plus from the I C interface is organized in blocks of 16 bytes each. I²C slave address is stored in most significant 7 bits of byte 0 in block 0. However, when 2 reading block 0, NTAG I C plus always returns 04h for byte 0. WARNING: When configuring Static lock bytes and Capability container, Address byte gets updated, too. Address byte consists of slave address (coded in most significant 7 bits) and least significant bit set to 0b. REMARK: For convenience reasons it is recommended to configure Address byte (block 0, byte 0) to 04h. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 18 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 2 2 Table 6. NTAG I C plus 1k memory organization from the I C perspective Byte number within a block Access conditions I C block 2 0 1 2 3 address 4 5 6 7 8 9 10 11 13 14 15 Dec. Hex. 12 0 00h Addr. 1 2 I C_PROT 00b 01b 1xb Serial number (UID) Serial number (UID) Internal Internal READ&WRITE Static lock bytes Capability Container (CC) 1 01h ... ... Unprotected user memory READ&WRITE AUTH0 AUTH0 ... ... 55 37h 56 38h Protected user memory READ&WRITE READ NAK Protected user memory READ&WRITE READ NAK Dynamic lock bytes 57 39h RFU RFU ACCESS RFU PWD 2 58 3Ah RFU AUTH0 RFU RFU RFU RFU RFU RFU 2 PACK PT_I2C 00h RFU Configuration see 8.3.12 registers 59 3Bh ... ... 247 F7h 248 F8h ... ... 251 FBh ... 254 READ&WRITE 00h 00h 00h 00h 00h 00h 00h 00h READ Invalid access - returns NAK n.a. SRAM memory (64 bytes) READ&WRITE ... Invalid access - returns NAK n.a. FEh Session see 8.3.12 registers 00h NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC 00h 00h 00h All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 READ © NXP B.V. 2019. All rights reserved. 19 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Byte number within a block I C block 2 0 1 2 3 address 4 5 6 7 8 9 10 11 12 13 14 15 00h 00h 00h 00h Dec. 255 1 2 Access conditions Hex. FFh 2 I C_PROT 00b 01b Invalid access - returns NAK 1xb n.a. 2 The byte 0 of block 0 is always read as 04h (UID0). Writing to block 0 updates the I C address. 2 On reading PWD and PACK, NTAG I C plus always returns 00h for all bytes NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 20 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 2 2 Table 7. NTAG I C plus 2k memory organization from the I C perspective Byte number within a block Access conditions I C block 2 0 1 2 3 address 4 5 6 7 8 9 10 11 13 14 15 Dec. Hex. 12 0 00h Addr. 1 2 I C_PROT 00b 01b 1xb Serial number (UID) Serial number (UID) Internal Internal READ&WRITE Static lock bytes Capability Container (CC) 1 01h ... ... Unprotected user memory AUTH0 AUTH0 ... ... 56 38h READ&WRITE Protected user memory READ&WRITE Protected user memory READ&WRITE READ NAK READ NAK Protected user memory Dynamic lock bytes 57 39h RFU RFU ACCESS RFU PWD 2 PACK PT_I2C 58 3Ah RFU 00h RFU AUTH0 RFU RFU RFU RFU RFU RFU READ&WRITE 2 Configuration see 8.3.12 registers ... ... 64 40h ... ... 127 7Fh ... ... 248 F8h ... ... 251 FBh ... ... NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC 00h 00h 00h 00h 00h 00h 00h 00h READ Invalid access - returns NAK (Un-)protected user memory n.a. READ&WRITE READ NAK Invalid access - returns NAK n.a. SRAM memory (64 bytes) READ&WRITE Invalid access - returns NAK n.a. All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 21 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Byte number within a block Access conditions I C block 2 0 1 2 3 address 4 5 6 7 8 9 10 11 12 13 14 15 Dec. Hex. 254 FEh 2 I C_PROT 00b 01b Session see 8.3.12 registers 255 1 2 00h 00h 00h 00h 00h 00h 00h 00h READ Invalid access - returns NAK FFh 1xb n.a. 2 The byte 0 of block 0 is always read as 04h (UID0). Writing to block 0 updates the I C address. 2 On reading PWD and PACK, NTAG I C plus always returns 00h for all bytes 8.3.3 EEPROM The EEPROM is a non-volatile memory that stores the 7 byte UID, the memory lock conditions, IC configuration information and the user memory. 2 Sector 0 memory map looks totally the same for NTAG I C plus 1k and 2k version, the only difference is the dynamic lock bit granularity. 2 NXP introduced with NTAG I C plus the possibility to split the memory in an open and a password protected area see Section 8.3.11. 8.3.4 SRAM For frequently changing data, a volatile memory of 64 bytes with unlimited endurance is built in. The 64 bytes are mapped in a similar way as done in the EEPROM, i.e., 64 bytes are seen as 16 pages of 4 bytes from NFC perspective. The SRAM is only available when the tag is powered via the VCC pin. The SRAM is located at the end of the memory space and it is always directly accessible 2 by the I C host (addresses F8h to FBh). An NFC device cannot access the SRAM memory in normal mode (i.e., outside the pass-through mode). The SRAM is only accessible by the NFC device if the SRAM is mirrored onto the EEPROM memory space. With SRAM mirror enabled (SRAM_MIRROR_ON_OFF = 1b - see Section 11.2), the SRAM can be mirrored in the User Memory from start page 01h to 74h for access from the NFC side. The Memory mirror must be enabled once both interfaces are ON as this feature is disabled after each POR. The register SRAM_MIRROR_BLOCK (see Table 14) indicates the address of the first page of the SRAM buffer. In the case where the SRAM mirror is enabled and the READ command is addressing blocks where the SRAM mirror is located, the SRAM byte values will be returned instead of the EEPROM byte values. Similarly, if the tag is not VCC powered, the SRAM mirror is disabled and reading out the bytes related to the SRAM mirror position would return the values from the EEPROM. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 22 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting In the pass-through mode (PTHRU_ON_OFF = 1b - see Section 8.3.12), the SRAM is mirrored to the fixed address F0h - FFh for NFC access (see Section 11) in the first 2 memory sector (Sector 0) of NTAG I C plus. 8.3.5 Serial number (UID) The unique 7-byte serial number (UID) is programmed into the first 7 bytes of memory covering page addresses 00h and 01h - see Figure 7. These bytes are programmed and write protected during production. UID0 is fixed to the value 04h - the manufacturer ID for NXP Semiconductors in accordance with ISO/IEC 14443-3. MSB 0 LSB 0 0 0 0 1 0 0 manufacturer ID for NXP Semiconductors (04h) page 0 page 1 byte UID0 UID1 UID2 UID3 page 2 UID4 UID5 UID6 SAK 0 7 bytes UID 1 2 3 ATQA0 ATQA1 lock bytes aaa-012802 Figure 7. Serial number (UID) 8.3.6 Static Lock Bytes According to NFC Forum Type 2 Tag specification, the bits of byte 2 and byte 3 of page 2 02h (via NFC) or byte 10 and 11 address 00h (via I C) represent the field programmable, read-only locking mechanism (see Figure 8). Each page from 03h (CC) to 0Fh can be individually locked by setting the corresponding locking bit to logic 1b to prevent further write access. After locking, the corresponding page becomes read-only memory. This read only locking is address-based. This means, when SRAM is mirrored to these blocks, also SRAM blocks are read only from NFC prespective. 2 In addition, NTAG I C plus uses the three least significant bits of lock byte 0 as the block-locking bits. Bit 2 controls pages 0Ah to 0Fh (via NFC), bit 1 controls pages 04h to 09h (via NFC) and bit 0 controls page 03h (CC). Once the block-locking bits are set, the locking configuration for the corresponding memory area is frozen, e.g. cannot be changed to read-only anymore. MSB L 7 L 6 L 5 L 4 L CC BL 15-10 LSB MSB BL CC L 15 BL 9-4 LSB L 14 L 13 L 12 L 11 L 10 L 9 L 8 page 2 0 1 2 3 lock byte 0 lock byte 1 Lx locks page x to read-only BLx blocks further locking for the memory area x aaa-006983 Figure 8. Static lock bytes 0 and 1 NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 23 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting For example, if BL15-10 is set to logic 1b, then bits L15 to L10 (lock byte 1, bit[7:2]) can no longer be changed. The static locking and block-locking bits are set by the bytes 2 and 3 of the WRITE command to page 02h. The contents of the lock bytes are bit-wise OR’ed and the result then becomes the new content of the lock bytes. This process is irreversible from NFC perspective. If a bit is set to logic 1b, it cannot be changed 2 back to logic 0b. From I C perspective, the bits can be reset to 0b by writing bytes 10 2 and 11 of block 00h. As I C address is coded in byte 0 of block 0, it may be changed unintentionally. The contents of bytes 0 and 1 of page 02h (via NFC) are unaffected by the corresponding data bytes of the WRITE command. The default value of the static lock bytes is 0000h. 8.3.7 Dynamic Lock Bytes 2 To lock the pages of NTAG I C plus starting at page address 16 and onwards, the dynamic lock bytes are used. The dynamic lock bytes are located in Sector 0 at page 2 E2h. The three lock bytes cover the memory area of 840 data bytes (NTAG I C plus 1k) 2 2 or 1864 data bytes (NTAG I C plus 2k). The granularity is 16 pages for NTAG I C plus 1k 2 (see Figure 9) and 32 pages for NTAG I C plus 2k (see Figure 10) compared to a single page for the first 48 bytes (see Figure 8). 2 NTAG I C plus needs a Lock Control TLV as specified in NFC Forum Type 2 Tag specification to ensure NFC Forum Type 2 Tag compliancy. When NFC Forum Type 2 Tag transition to READ ONLY state is intended, all bits marked as RFUI and dynamic lock bits related to the protected area shall be set to 0b when writing to the dynamic lock bytes. The default value of the dynamic lock bytes is 000000h. The value of Byte 3 is always 00h when read. Like for the static lock bytes, this process of modifying the dynamic lock bits is irreversible from NFC perspective and applies also for potentially mirrored SRAM. If a bit 2 is set to logic 1b, it cannot be changed back to logic 0b. From I C interface, these bits can be set to 0b again. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 24 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting LOCK PAGE 80-95 LOCK PAGE 64-79 LOCK PAGE 48-63 LOCK PAGE 32-47 LOCK PAGE 16-31 RFUI RFUI LOCK PAGE 224-225 LOCK PAGE 208-223 LOCK PAGE 192-207 LOCK PAGE 176-191 LOCK PAGE 160-175 LOCK PAGE 144-159 LSB LOCK PAGE 96-111 MSB LOCK PAGE 112-127 LSB LOCK PAGE 128-143 MSB bit 7 6 5 4 3 2 1 0 bit 7 6 5 4 3 2 1 0 0 page 226 (E2h) 1 2 3 BL 208-225 BL 176-207 BL 144-175 BL 112-143 BL 80-111 BL 48-79 BL 16-47 LSB RFUI MSB bit 7 6 5 4 3 2 1 0 aaa-008092 2 Figure 9. NTAG I C plus 1k Dynamic lock bytes 0, 1 and 2 LOCK PAGE 144-175 LOCK PAGE 112-143 LOCK PAGE 80-111 LOCK PAGE 48-79 LOCK PAGE 16-47 LOCK PAGE 496-511 LOCK PAGE 464-495 LOCK PAGE 432-463 LOCK PAGE 400-431 LOCK PAGE 368-399 LOCK PAGE 336-367 LOCK PAGE 304-335 LOCK PAGE 272-303 LSB LOCK PAGE 176-207 MSB LOCK PAGE 208-225 LSB LOCK PAGE 256-271 MSB bit 7 6 5 4 3 2 1 0 bit 7 6 5 4 3 2 1 0 page 226 (E2h) Sector 0 0 1 2 3 BL 400-463 BL 336-399 BL 272-335 BL 208-271 BL 144-207 BL 80-143 BL 16-79 Block Locking (BL) bits LSB BL 464-511 MSB bit 7 6 5 4 3 2 1 0 aaa-021651 2 Figure 10. NTAG I C plus 2k Dynamic lock bytes 0, 1 and 2 NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 25 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 8.3.8 Capability Container (CC) According to NFC Forum Type 2 Tag specification the CC is located on page 03h (see Ref. 1). To keep full flexibility to split the memory into an open and protected area, the default value of the CC is initialized with 00000000h during the IC production. NDEF messages can only be written with NFC Forum devices, after setting these CC bytes according to application-specific needs and NFC Forum specification by a 2 WRITE command from the I C or NFC interface. According to NFC Forum specification, a bit once set to 1b, an NFC Forum Device cannot set bits of the CC back to 0b. 2 However, similar to the lock bits, setting these bits back to 0b is again possible from I C perspective. 2 WARNING: As I C address (byte 0) and static lock bytes (byte 10 and byte 11) are 2 2 coded in block 00h from I C side, the I C address may be changed or the tag may be locked unintentionally, when changing CC. REMARK: When reading out byte 0, NTAG I²C plus always returns 04h (UID0). Therefore, for convenience reasons it is recommended to configure I²C address byte to 04h. NXP recommends setting the size parameter of the CC only to values that the T2T_Area ends at lock bit granularity boundaries when using only part of the memory for storing NDEF messages. Consequently T2T_Area size should be 112 + 64*N or 888 bytes with N less or equal to 13 for the 1k version, or 176 + 128*N or 2032 bytes with N less or equal to 14 for the 2k version. In Figure 11 it is shown how the CC is changed when going from READ/WRITE to READ ONLY state according to NFC Forum. page 3 byte 0 1 2 3 byte E1h 10h 6Dh 00h CC bytes Example possibel content after initialization 11100001 00010000 01101101 CC bytes 00000000 write command to page 3 over RF 00000000 00000000 00000000 00001111 result in page 3 (read-only state over RF) 11100001 00010000 01101101 00001111 aaa-021725 2 Figure 11. Possible configuration of CC bytes of NTAG I C 1k version 8.3.9 User Memory pages Pages 04h to E1h of Sector 0 via the NFC interface - Block 01h to 37h, plus the first 8 2 2 bytes of block 38h via the I C interface is the user memory area for NTAG I C plus 1k and 2k version. In addition, complete Sector 1 (page 00h to FFh) via the NFC interface - block 40h to 7Fh 2 2 via the I C interface is used as user memory area for NTAG I C plus 2k version. 8.3.10 Memory content at delivery As described above the CC in page 03h is set to all 00h to keep the full flexibility. To allow NFC Forum NDEF message reading and writing page 03h (CC) and the following 2 data page (NDEF TLV) of NTAG I C plus need to be initialized by the user according to NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 26 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting the NFC Forum Type 2 Tag specification (see Ref. 1). Table 8 shows an example of NFC Forum-compliant content using the whole memory of sector 0 for NDEF messages. Remark: The default content of the data pages from page 04h onwards is not defined at delivery. 2 Table 8. Minimum memory content to be in initialized state for NTAG I C plus Page Address Byte number within page 0 1 2 3 03h E1h 10h 6Dh 00h 04h 03h 00h FEh 00h 8.3.11 Password and Access Configuration 2 NTAG I C plus can be configured to have password protected memory areas. If this feature is used, NXP recommends changing and diversify the PWD and PACK for every single chip. The password and access configuration area of pages E3h to E7h (Sector 0 - see Table 2 9) via the NFC interface or blocks 38h and 39h via the I C interface are used to configure 2 the password and access conditions of the NTAG I C plus. Those bit values are stored in the EEPROM. Their values can be read and written by both interfaces when applicable and when not locked by the register lock bits (see REG_LOCK in Table 13). AUTH0 defines the starting page address of the protected area in Sector 0. NXP recommends setting AUTH0 in a way always respecting the lock bit granularity. Setting AUTH0 greater EBh, disables password protection. The NFC_PROT bit is used to either only require a PWD_AUTH for writing data to the protected area or even protect reading data from the protected area. If password authentication is used, even the SRAM access can be protected by setting SRAM_PROT bit to 1b. 2 I2C_PROT enables the possibility to limit access to the protected area from I C perspective to read only or no access at all. AUTLIM value can be used to limit negative PWD_AUTH attempts. 2 For the 2k version of NTAG I C plus NFC_DIS_SEC1 bit can be used to disable the access to Sector 1 from NFC perspective with the 2K_PROT bit password protection for Sector 1 can be enabled. Once password protection is enabled, writing to Password and Access Configuration bytes is only possible after a successful password authentication. On reading the PWD or 2 2 PACK, from NFC or I C perspective, NTAG I C plus always returns all 00h bytes. A detailed description of the mechanism and how to program all the parameters is given in Section 8.7. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 27 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Table 9. Password and Access Configuration Register 2 NFC page address I C block address Byte number from NFC perspective (Sector 0) Dec Hex 224 E0h 225 E1h 226 E2h 227 E3h 228 E4h 229 E5h 230 E6h 231 E7h Dec 56 Hex 0 1 38h 2 User Memory Dynamic lock bytes 57 39h 3 00h RFU RFU RFU AUTH0 ACCESS RFU RFU RFU RFU RFU RFU RFU PWD PACK PT_I2C RFU Table 10.  Password and Access Configuration bytes Bit Field Access Access Default 2 via NFC via I C Description values Authentication Pointer (AUTH0) 7-0 AUTH0 R&W R&W FFh Page address of Sector 0 from which onwards the password authentication is required to access the user memory from NFC perspective, dependent on NFC_PROT bit. If AUTH0 is set to a page address greater than EBh, the password protection is effectively disabled. Password protected area starts from page AUTH0 and ends at page EBh. Password protection is excluded for Dynamic Lock Bits, session registers and mirrored SRAM pages. 2 REMARK: From I C interface, you have access to all configuration pages until REG_LOCK_I2C bit is set to 1b. Access Conditions (ACCESS) 7 NFC_PROT R&W R&W 0b Memory protection bit: 0b: write access to protected area is protected by the password 1b: read and write access to protected area is protected by the password 6 RFU R&W R&W 0b RFU - SHALL be 0b 5 NFC_DIS_SEC1 R&W R&W 0b NFC access protection to Sector 1 0b: Sector 1 is accessible in 2k version 1b: Sector 1 in inaccessible and returns NAK0 4-3 RFU NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC R&W R&W 00b RFU - SHALL be 00b All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 28 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Bit 2-0 Field Access Access Default 2 AUTHLIM via NFC via I C values R&W 000b R&W Description Limitation of negative password authentication attempts. After reaching the limit, protected area is not accessible any longer. 000b: limiting of negative password authentication attempts disabled. 001b-111b: maximum number of negative password AUTHLIM authentication attempts is 2 Password (PWD) 31-0 PWD R&W R&W FFFFFFFFh 32-bit password used for memory access protection. Reading PWD always returns 00000000h Password Acknowledge (PACK) 15-0 PACK R&W R&W 0000h 16-bit password acknowledge used during the password authentication process. Reading PACK always returns 0000h Protection bits (PT_I2C) 7-4 RFU R&W R&W 0000b RFU - SHALL be 0000b 3 2K_PROT R&W R&W 0b Password protection for Sector 1 for 2k version 0b: password authentication for Sector 1 disabled 1b: password authentication needed to access Sector 1 2 SRAM_PROT R&W R&W 0b Password protection for pass-through and mirror mode 0b: password authentication for pass-through mode disabled 1b: password authentication needed to access SRAM in passthrough mode 1-0 I2C_PROT R&W R&W 00b 2 Access to protected area from I C perspective 2 00b: Entire user memory accessible from I C 01b: read and write access to unprotected user area, read only access to protected area 1Xb: read and write access to unprotected area, no access to protected area. 2 REMARK: Independent from these bits I C always has R&W access to: • Session registers • SRAM • Configuration pages including PWD Configuration area, but dependent on REG_LOCK_I2C bit 2 8.3.12 NTAG I C configuration and session registers 2 NTAG I C plus behavior can be configured and read in two separate locations depending if the configurations shall be effective within the communication session (use session registers) or by default after Power-On Reset (POR) (use configuration registers). The configuration registers of pages E8h to E9h (Sector 0 - see Table 11) via the NFC 2 interface or block 3Ah via the I C interface are used to configure the default behavior 2 of the NTAG I C plus. Those bit values are stored in the EEPROM and represent the NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 29 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting default settings to be effective after POR. Their values can be read and written by both interfaces when applicable and when not locked by the register lock bits (see REG_LOCK in Table 13). 2 Table 11. Configuration register NTAG I C plus 2 NFC address I C Address (Sector 0) Byte number from NFC perspective Dec Hex Dec Hex 0 1 2 3 232 E8h 58 3Ah NC_REG LAST_NDEF_BLOCK SRAM_MIRROR_BLOCK WDT_LS 233 E9h WDT_MS I2C_CLOCK_STR REG_LOCK RFU The session register on pages ECh to EDh (Sector 0) via the NFC interface or block 2 FEh via I C, see Table 12, are used to configure or monitor the values of the current communication session. Those bits are read only via the NFC interface but may be read 2 and written via the I C interface. For backward compatibility reasons the session registers are mirrored to Sector 3 (page F8h and F9h via the NFC interface). 2 Table 12. Session registers NTAG I C plus 2 NFC address (Sector 0) I C Address Byte number Dec Hex Dec Hex 0 236 ECh 254 FEh NC_REG 237 EDh 1 WDT_MS 2 LAST_NDEF_BLOCK SRAM_MIRROR _BLOCK I2C_CLOCK_STR NS_REG 3 WDT_LS RFU Both, the session and the configuration registers have the same configuration options and parameters except the REG_LOCK bits, which are only available in the configuration register and the NS_REG bits which are only available in the session register. After POR, the content of the configuration register is loaded into the session register. The values of both registers can be changed during a communication session. If the desired effect should be visible immediately, but only for the current communication session, the session registers must be used. After POR, the session registers values will again contain the configuration register values as before. To change the default behavior, changes to the configuration register are needed, but the related effect will only be visible after the next POR. To make the effect immediately and after next POR visible, changes to configuration and session registers are needed. All registers and configuration default values, access conditions and descriptions are defined in Table 13 and Table 14. 2 Reading and writing the session registers via I C can only be done via the READ and WRITE registers operation - see Section 9.8. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 30 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Table 13.  Configuration bytes Bit Field Access Access 2 via NFC via I C Default values Description Configuration register: NC_REG 7 NFCS_I2C_RST_ON_OFF R&W R&W 0b Enables the NFC silence feature and enables soft 2 reset through I C repeated start - see Section 9.3 6 PTHRU_ON_OFF R&W 0b 1b: pass-through mode using SRAM enabled and SRAM mapped to end of Sector 0. R&W 0b: pass-through mode disabled 5-4 FD_OFF R&W R&W 00b defines the event upon which the signal output on the FD pin is released 00b: if the field is switched off 01b: if the field is switched off or the tag is set to the HALT state 10b: if the field is switched off or the last page of the NDEF message has been read (defined in LAST_ NDEF_BLOCK) 11b: (if FD_ON = 11b) if the field is switched off or if 2 last data is read by I C (in pass-through mode NFC 2 2 ---> I C) or last data is written by I C (in pass-through 2 mode I C---> NFC) 11b: (if FD_ON = 00b or 01b or 10b) if the field is switched off See Section 8.4 for more details 3-2 FD_ON R&W R&W 00b defines the event upon which the signal output on the FD pin is pulled low 00b: if the field is switched on 01b: by first valid start of communication (SoC) 10b: by selection of the tag 2 11b: (in pass-through mode NFC-->I C) if the data is 2 ready to be read from the I C interface 2 11b: (in pass-through mode I C--> NFC) if the data is read by the NFC interface See Section 8.4 for more details 1 SRAM_MIRROR_ON_OFF R&W R&W 0b 1b: SRAM mirror enabled and mirrored SRAM starts at page SRAM_MIRROR_BLOCK 0b: SRAM mirror disabled 0 TRANSFER_DIR R&W R&W 1b defines the data flow direction when pass-through mode is enabled 2 0b: from I C to NFC interface 2 1b: from NFC to I C interface In case the pass-through mode is NOT enabled, this bit should be set to 1b, otherwise there is no WRITE access from the NFC perspective Configuration register: LAST_NDEF_BLOCK NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 31 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Bit Field Access Access 2 via NFC via I C Default values Description 7-0 LAST_NDEF_BLOCK R&W 00h I C block address of I C block, which contains last byte(s) of stored NDEF message. An NFC read 2 of the last page of this I C block sets the register NDEF_DATA_READ to 1b and triggers field detection pin if FD_OFF is set to 10b. R&W 2 2 Valid range starts from 01h (NFC page 04h) 2 up to 37h (NFC page DCh) for NTAG I C plus 1k or up to 7Fh (NFC page FCh on Sector 1) for NTAG 2 I C plus 2k. Configuration register: SRAM_MIRROR_BLOCK 7-0 SRAM_MIRROR_BLOCK R&W R&W F8h 2 I C block address of SRAM when mirrored into the User memory. Valid range starts from 01h (NFC page 04h) 2 up to 34h (NFC page D0h) for NTAG I C plus 1k or up to 7Ch (NFC page F0h on memory Sector 1) for 2 NTAG I C plus 2k Configuration register: WDT_LS 7-0 WDT_LS R&W R&W 48h Least Significant byte of watchdog time control register Configuration register: WDT_MS 7-0 WDT_MS R&W R&W 08h Most Significant byte of watchdog time control register. When writing WDT_MS byte, the content of WDT_MS and WDT_LS gets active for the watchdog timer. Configuration register: I2C_CLOCK_STR 7-1 RFU R&W R&W 0000000b RFU - all 7 bits SHALL be 0b 0 I2C_CLOCK_STR R&W R&W 1b 2 Enables (1b) or disable (0b) the I C clock stretching Configuration register: REG_LOCK 7-2 RFU 1 REG_LOCK_I2C 1 R&W R&W 000000b RFU - all 6 bits SHALL be 0b R&W R&W 0b I C Configuration Lock Bit 2 2 0b: Configuration bytes may be changed via I C 2 1b: Configuration bytes cannot be changed via I C Once set to 1b, cannot be reset to 0b anymore. 0 REG_LOCK_NFC 1 R&W R&W 0b NFC Configuration Lock Bit 0b: Configuration bytes may be changed via NFC 1b… Configuration bytes cannot be changed via NFC Once set to 1b, cannot be reset to 0b anymore. 1 Setting both bits REG_LOCK_I2C and REG_LOCK_NFC to 1b, permanently locks write access to register default values (as no write is allowed anymore). As long as one bit is still 0b, the corresponding interface can still access and change the register lock bytes. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 32 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Table 14.  Session register bytes Bit Field Access via NFC Access 2 via I C Default values Description Session register: NC_REG 7 NFCS_I2C_RST_ON_OFF READ R&W - see configuration bytes description 6 PTHRU_ON_OFF READ R&W - see configuration bytes description, the bit is cleared automatically, when one of the interfaces is OFF 5-4 FD_OFF READ R&W - see configuration bytes description 3-2 FD_ON READ R&W 1 SRAM_MIRROR_ON_ OFF READ R&W - see configuration bytes description, the bit is cleared automatically, when there is no Vcc power. 0 TRANSFER_DIR READ R&W see configuration bytes description Session register: LAST_NDEF_BLOCK 7-0 LAST_NDEF_BLOCK READ R&W - see configuration bytes description Session register: SRAM_MIRROR_BLOCK 7-0 SRAM_MIRROR_BLOCK READ R&W - see configuration bytes description Session register: WDT_LS 7-0 WDT_LS READ R&W - see configuration bytes description Session register: WDT_MS 7-0 WDT_MS READ R&W - see configuration bytes description Session register: I2C_CLOCK_STR 7-2 RFU READ READ - RFU, all 6 bits locked to 0b 1 NEG_AUTH_REACHED READ READ 0b Status bit to show the number of negative PWD_ AUTH attempts reached 0b: PWD_AUTH still possible 1b: PWD_AUTH locked 0 I2C_CLOCK_STR READ READ - See configuration bytes description Session register: NS_REG 7 NDEF_DATA_READ READ READ 0b 1b: all data bytes read from the address specified in LAST_NDEF_BLOCK. Bit is reset to 0b when read 6 I2C_LOCKED READ R&W 0b 1b: Memory access is locked to the I C interface 5 RF_LOCKED READ READ 0b 1b: Memory access is locked to the NFC interface 4 SRAM_I2C_READY READ READ 0b 1b: data is ready in SRAM buffer to be read by I2C 3 SRAM_RF_READY READ READ 0b 1b: data is ready in SRAM buffer to be read by NFC 2 EEPROM_WR_ERR READ R&W 0b 1b: HV voltage error during EEPROM write or erase cycle 2 Needs to be written back via I C to 0b to be cleared NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC 2 All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 33 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Bit Field Access via NFC Access 2 via I C Default values Description 1 EEPROM_WR_BUSY READ READ 0b 1b: EEPROM write cycle in progress - access to EEPROM disabled 0b: EEPROM access possible 0 RF_FIELD_PRESENT READ READ 0b 1b: NFC field is detected 8.4 Configurable Field Detection Pin The field detection pin based on open-drain implementation provides the capability to trigger an external device (e.g. μController) or switch on the connected circuitry by an external power management unit depending on activities on the NFC interface. As the field detection pin functionality is operated via NFC field power, VCC supply for the tag itself is not required. NOTE: In some cases VOUT pin might be used as field detection trigger. The conditions for pulling the field detection signal to low, FD_ON can be: • The presence of the NFC field • The detection of a valid command (Start of Communication) • The selection of the IC REMARK: When FD_ON is configured to trigger on NFC field presence (00b), FD will be pulled low again, when host is reading the NDEF_DATA_READ bit of NS_REG session 2 register from I C perspective. The conditions for releasing the field detection signal defined with FD_OFF can be: • The absence of the NFC field • The detection of the HALT state • The NFC interface has read the last part of the NDEF message defined with LAST_NDEF_BLOCK All the various combinations of configurations are described in Table 13 and illustrated in Figure 13, Figure 14 and Figure 15 for all various combinations of the filed detection signal configuration. The timing diagrams are not in scale and all given timing values are typical values. The field detection pin can be used also as a handshake mechanism in the pass-through mode to signal to the external μController if • New data is written to SRAM on the NFC interface • Data written to SRAM from the μController is read via the NFC interface. See Section 11 for more information on this handshake mechanism. In Figure 12 an example how to connect the FD pin is given. All given values are typical values and may vary from application to application. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 34 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting APPLICATION supply (1.2 V ~ 3.6 V) LA Rpu >2 kΩ VSS GND SCL FD event detect signal 1 8 2 7 3 6 4 5 LB VOUT VCC SDA aaa-021652 Figure 12. FD pin example circuit ON RF field OFF HIGH FD pin NS_REG RF_FIELD_PRESENT 0 NC_REG LOW FD_ON = 00b FD_OFF = 00b 01h 1 0 RF field switches OFF Tag set to HALT Tag selected First valid start of communication Event RF field switches ON t aaa-021653 Figure 13. Illustration of the field detection feature when configured for simple field detection NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 35 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting ON RF field OFF HIGH FD pin NS_REG RF_FIELD_PRESENT 0 NC_REG LOW FD_ON = 01b FD_OFF = 01b 15h 1 0 RF field switches OFF Start of HALT command Tag selected First valid start of communication Event RF field switches ON t aaa-021654 Figure 14. Illustration of the field detection feature when configured for first valid start of communication detection NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 36 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting ON RF field OFF HIGH FD pin NS_REG RF_FIELD_PRESENT 0 NC_REG LOW FD_ON = 10b FD_OFF = 10b 29h 1 0 RF field switches OFF Start of READ of last page of NDEF msg. Event Start of SEL CL2 command RF field switches ON First valid start of communication t aaa-021655 Figure 15. Illustration of the field detection feature when configured for selection of the tag detection 8.5 Watchdog timer 2 In order to allow the I C interface to perform all necessary commands (READ, 2 WRITE, ..), the memory access remains locked to the I C interface until the register I2C_LOCKED is cleared by the host - see Table 14. 2 However, to avoid that the memory stays 'locked' to the I C for a long period of time, it 2 is possible to program a watchdog timer to unlock the I C host from the tag, so that the NFC device can access the tag after a period of time of inactivity. The host itself will not be notified of this event directly, but the NS_REG register is updated accordingly (the register bit I2C_LOCKED will be cleared - see Table 14). The default value is set to 20 ms (848h), but the watch dog timer can be freely set from 0001h (9.43 μs) up to FFFFh (617.995 ms). The timer starts ticking when the 2 2 communication between the NTAG I C and the I C interface starts. In case the 2 communication with the I C is still going on after the watchdog timer expires, the communication will continue until the communication has completed. Then the status register I2C_LOCKED will be immediately cleared. 2 In the case where the communication with the I C interface has completed before the end of the timer and the status register I2C_LOCKED was not cleared by the host, it will be cleared at the end of the watchdog timer. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 37 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting The watchdog timer is only effective if the VCC pin is powered and will be reset and 2 stopped if the NTAG I C is not VCC powered or if the register status I2C_LOCKED is set to 0 and RF_LOCKED is set to 1b. 8.6 Energy harvesting 2 The NTAG I C plus provides the capability to supply external low-power devices with energy harvested from the NFC field of an NFC device as illustrated in Figure 16. All given values are typical values. For more details, refer to Ref. 7. The voltage and current from the energy harvesting depend on various parameters, such as the strength of the NFC field, the tag antenna size, or the distance from the NFC 2 device. NTAG I C plus provides typically 5 mA at 2 V on the VOUT pin with an NFC Phone. 2 Operating NTAG I C in energy harvesting mode requires a number of precautions: • A complete total connected capacitor in the range of typically 150 nF up to 220 nF maximum shall be connected between VOUT and GND close to the terminals to ensure that the voltage does not drop below VCC min during modulation or during any application operation. • Start up load current on VOUT should be limited until sufficient voltage is built on VOUT. 2 2 • If NTAG I C also powers the I C bus, then VCC must be connected to VOUT, and pullup resistors on the SCL and SDA pins must be sized to control SCL and SDA sink 2 2 current when those lines are pulled low by NTAG I C or the I C host 2 • If NTAG I C also powers the Field Detect bus, then the pull-up resistor on the Field Detect line must be sized to control the sink current into the Field Detect pin when 2 NTAG I C pulls it low 2 • The NFC reader device communicating with NTAG I C shall apply polling cycles including an NFC Field Off condition of at least 5.1 ms as defined in NFC Forum Activity specification (see Ref. 4, chapter 6). REMARK: increasing the output current on Vout decreases the NFC communication range. supply (2.2 V ~ 3 V) APPLICATION Cload 150 nF ~ 220 nF Rpu >5 kΩ Rpu >5 kΩ Rpu >5 kΩ GND SCL FD 4 SCL VSS LA 3 2 1 5 6 SDA VCC 7 8 VOUT LB event detect signal SDA aaa-021656 Figure 16. Energy harvesting example circuit NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 38 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 8.7 Password authentication The memory write or read/write access to a configurable part of the memory can be constrained to a positive password authentication. The 32-bit secret password (PWD) and the 16-bit password acknowledge (PACK) response shall be typically programmed into the configuration pages at the tag personalization stage. The AUTHLIM parameter specified in Section 8.3.11 can be used to limit the negative authentication attempts. 2 In the initial state of NTAG I C plus, password protection is disabled by an AUTH0 value of FFh. PWD and PACK are freely writable in this state. Access to the configuration pages and any part of the user memory can be restricted by setting AUTH0 to a page address within the available memory space. This page address is the first one protected. For a comprehensive description of all protection mechanism refer to Ref. 9. 2 Remark: The password protection method provided in NTAG I C plus has to be intended as an easy and convenient way to prevent unauthorized memory accesses. If a higher level of protection is required, cryptographic methods can be implemented at application layer to increase overall system security. 8.7.1 Programming of PWD and PACK The 32-bit PWD and the 16-bit PACK need to be programmed into the configuration pages, see Section 8.3.11. The password as well as the password acknowledge are written LSByte first. This byte order is the same as the byte order used during the PWD_AUTH command and its response. The PWD and PACK bytes can never be read out of the memory. Instead of transmitting 2 the real value on any valid read command from both - NFC and I C - interface, only 00h bytes are replied. If the password authentication is disabled, PWD and PACK can be written at any time. If the password authentication is enabled, PWD and PACK can be written after a successful PWD_AUTH command only. Remark: To improve the overall system security, it is advisable to diversify the password and the password acknowledge using a die individual parameter of the IC, which can be 2 the 7-byte UID available on NTAG I C plus. 8.7.2 Limiting negative verification attempts To prevent brute-force attacks on the password, the maximum allowed number of negative password authentication attempts can be set using AUTHLIM. This mechanism is disabled by setting AUTHLIM to a value of 000b, which is also the initial state of NTAG 2 I C plus. If AUTHLIM is not equal to 000b, each negative authentication verification is internally AUTHLIM counted. As soon as this internal counter reaches the number 2 , any further negative password authentication leads to a permanent locking of the protected part of the memory for the specified access modes. Independently, whether the provided password is correct or not, each subsequent PWD_AUTH fails. Any successful password verification, before reaching the limit of negative password verification attempts, resets the internal counter to zero. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 39 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 8.7.3 Protection of configuration segments The configuration pages can be protected by the password authentication as well. The protection level is defined with the NFC_PROT bit. The protection is enabled by setting the AUTH0 byte (see Table 10) to a value that is within the addressable memory space. 8.8 Originality signature 2 NTAG I C plus features a cryptographically supported originality check. With this feature, it is possible to verify that the tag is using an IC manufactured by NXP Semiconductors. This check can be performed on personalized tags as well. 2 NTAG I C plus digital signature is based on standard Elliptic Curve Cryptography (ECC), according to the ECDSA algorithm. The use of a standard algorithm and curve ensures easy software integration of the originality check procedure in an application running on an NFC device without specific hardware requirements. 2 Each NTAG I C plus UID is signed with an NXP private key and the resulting 32-byte 2 signature is stored in a hidden part of the NTAG I C plus memory during IC production. This signature can be retrieved using the READ_SIG command and can be verified in the NFC device by using the corresponding ECC public key provided by NXP. In case the NXP public key is stored in the NFC device, the complete signature verification procedure can be performed offline. To verify the signature (for example with the use of the public domain crypto library OpenSSL) the tool domain parameters shall be set to secp128r1, defined within the standards for elliptic curve cryptography SEC (Ref. 10). Details on how to check the signature value are provided in corresponding application note (Ref. 6). It is foreseen to offer not only offline, as well as online way to verify 2 originality of NTAG I C plus. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 40 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 9 2 I C commands 2 For details about I C interface refer to Ref. 3. SCL SDA Start Condition SCL 1 SDA MSB SDA Input 2 SDA Change Stop Condition 3 7 8 9 ACK Start Condition SCL 1 SDA MSB 2 3 7 8 9 ACK Stop Condition 001aao231 2 Figure 17. I C bus protocol 2 2 The NTAG I C plus supports the I C protocol. This protocol is summarized in Figure 17. Any device that sends data onto the bus is defined as a transmitter, and any device that reads the data from the bus is defined as a receiver. The device that controls the data transfer is known as the "bus master", and the other as the "slave" device. A data transfer can only be initiated by the bus master, which will also provide the serial clock for 2 synchronization. The NTAG I C plus is always a slave in all communications. 9.1 Start condition Start is identified by a falling edge of Serial Data (SDA), while Serial Clock (SCL) is stable in the high state. A Start condition must precede any data transfer command. The 2 NTAG I C plus continuously monitors SDA (except during a Write cycle) and SCL for a Start condition, and will not respond unless one is given. 9.2 Stop condition Stop is identified by a rising edge of SDA while SCL is stable and driven high. A Stop 2 condition terminates communication between the NTAG I C plus and the bus master. A Stop condition at the end of a Write command triggers the internal Write cycle. WARNING: Host shall respect EEPROM programming time (~4 ms) after this Stop condition in any case. If host sends next command too early, the memory may be corrupted as ongoing EEPROM write cycle might get terminated. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 41 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 2 9.3 I C soft reset and NFC silence feature 2 With the bit NFCS_I2C_RST_ON_OFF (see Table 13) NTAG I C plus enables two 2 features: a soft reset of the I C subsystem, and NFC silence, in which the NFC demodulator is disabled. 2 2 2 The I C soft reset feature interprets an I C repeated start (no I C stop in between) as a 2 command to execute a soft reset of the I C subsystem. This is useful when heavy bus 2 interference can cause the I C interface to get stuck. A drawback of this feature is that every start symbol then has to be terminated with a Stop, slowing down communication. 2 If a Stop is forgotten, the I C interface is cleared and previous communication, if any, is lost. Consequently when this feature is used, stop conditions after MEMA for READ/ WRITE (see Figure 18) and after REGA for READ/WRITE registers (see Figure 19) shall be send. The NFC silence feature disables the demodulator. When feature is set, no NFC commands are received, and no replies are issued to commands that were not fully received when NFC Silence was set. This feature allows the tag to "disappear" even if it 2 still is in the reader field. NTAG I C plus will remain in the ISO state it was in when NFC silence was enabled, until NFC silence is removed. 2 The combination of these two features in a single bit means that I C soft reset is only active during NFC silence. 9.4 Acknowledge bit (ACK) The acknowledge bit is used to indicate a successful byte transfer. The bus transmitter, whether it is the bus master or slave device, releases Serial Data (SDA) after sending eight bits of data. During the ninth clock pulse period, the receiver pulls Serial Data (SDA) low to acknowledge the receipt of the ninth data bits. 9.5 Data input 2 During data input, the NTAG I C plus samples SDA on the rising edge of SCL. For correct device operation, SDA must be stable during the rising edge of SCL, and the SDA signal must change only when SCL is driven low. 9.6 Addressing 2 To start communication between a bus master and the NTAG I C plus slave device, the bus master must initiate a Start condition (see Section 9.1). Following this initiation, the bus master sends the 7-bit device address, called Slave Address (SA) in following figures. The 8th bit is the Read/Write bit (R/W). This bit is set to 1b for Read and 0b for Write operations. Default device address of 55h results in AAh default I²C write address and ABh default I²C read address. As from I²C perspective I²C address can be configured via byte 0 of block 0. Reading this block gives 04h, as it is returning UID0 (see Section 8.3.2). Therefore it is recommended to us 04h as I²C write address (02h device address). NOTE: Byte 0 of block 0 is used to configure the device address. The 7-bit device address needs to be programmed in the 7 most significant bits of this byte. Least NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 42 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting significant bit needs to be set to 0b when programming the device address. E.g. to keep default device address of 55h, byte 0 of block 0 needs to be set to AAh. 2 If a match occurs on the device address, the NTAG I C plus gives an acknowledgment 2 on SDA during the 9th bit time. If the NTAG I C plus address does not match, it deselects itself from the bus and clears the register I2C_LOCKED (see Table 12). 2 2 Table 15. Default NTAG I C address from I C R/W Device / Slave Address (SA) [1] Value [1] b7 b6 b5 b4 b3 b2 b1 b0 1 0 1 0 1 0 1 1/0 2 Initial values can be changed from I C perspective 2 2 2 The I C address of the NTAG I C plus (byte 0 - block 0h) can only be modified by the I C interface. Both interfaces cannot read the device address and a READ command from 2 the NFC or I C interface to this byte will return 04h (UID 0 - manufacturer ID for NXP Semiconductors - see Figure 7). 9.7 READ and WRITE Operation NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 43 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Write: Host Start 7 bits SA and `0' Tag MEMA A D0 A D1 A D15 A Stop A Read: Host Start 7 bits SA and `0' Tag MEMA A Stop Start 7 bits SA and `1' A A A D0 A D1 A Stop D15 aaa-012811 2 Figure 18. I C READ and WRITE operation NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 44 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting The READ and WRITE operation always handle 16 bytes to be read or written (one block - see Table 6) For the READ operation (see Figure 18), following a Start condition, the bus master/host 2 sends the NTAG I C slave address code (SA - 7 bits) with the Read/Write bit (R/W) set to 2 0b. The NTAG I C plus acknowledges this (A), and waits for one address byte (MEMA), which should correspond to the address of the block of memory (SRAM or EEPROM) 2 that is intended to be read. The NTAG I C plus responds to a valid address byte with an acknowledge (A). A Stop condition can be then issued. Then the host again issues a 2 start condition followed by the NTAG I C plus slave address with the Read/Write bit set to 1b. When I2C_CLOCK_STR is set to 0b, a pause of at least 50 μs shall be kept before 2 this start condition. The NTAG I C plus acknowledges this (A) and sends the first byte 2 of data read (D0).The bus master/host acknowledges it (A) and the NTAG I C plus will subsequently transmit the following 15 bytes of memory read with an acknowledge from the host after every byte. After the last byte of memory data has been transmitted by the 2 NTAG I C plus, the bus master/host will acknowledge it and issue a Stop condition. WARNING: READ sequence shall be atomic. Complete sequence of above figure needs to be executed, otherwise that tag may go to undefined state and stretches the clock infinitely. For the WRITE operation (see Figure 18), following a Start condition, the bus master/ 2 host sends the NTAG I C plus slave address code (SA - 7 bits) with the Read/Write bit 2 (R/W) set to 0b. The NTAG I C plus acknowledges this (A), and waits for one address byte (MEMA), which should correspond to the address of the block of memory (SRAM or 2 EEPROM) that is intended to be written. The NTAG I C plus responds to a valid address byte with an acknowledge (A) and, in the case of a WRITE operation, the bus master/ host starts transmitting every 16 bytes (D0...D15) that shall be written at the specified 2 address with an acknowledge of the NTAG I C plus after each byte (A). After the last 2 byte acknowledge from the NTAG I C plus, the bus master/host issues a Stop condition. WARNING: Host shall respect EEPROM programming time (~4 ms) after this Stop condition in any case. If host sends next command too early, the memory may be corrupted as ongoing EEPROM write cycle will get terminated. The memory address accessible via the READ and WRITE operations can only correspond to the EEPROM or SRAM (respectively 00h to 3Ah or F8h to FBh for NTAG 2 2 I C plus 1k and 00h to 7Ah or F8h to FBh for NTAG I C plus 2k). NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 45 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 9.8 WRITE and READ register operation 2 In order to modify or read the session register bytes (see Table 14), NTAG I C plus requires the WRITE and READ register operation (see Figure 19). Write: Host Start 7 bits SA and `0' Tag MEMA A REGA A MASK A REGDAT A Stop A Read: Host Start 7 bits SA and `0' Tag MEMA A REGA A Stop Start A 7 bits SA and `1' A A Stop REGDAT aaa-012812 Figure 19. WRITE and READ register operation For the READ register operation, following a Start condition the bus master/host sends 2 the NTAG I C plus slave address code (SA - 7 bits) with the Read/Write bit (R/W) set to 2 0b. The NTAG I C plus acknowledges this (A), and waits for one address byte (MEMA) which corresponds to the address of the block of memory with the session register bytes 2 (FEh). The NTAG I C plus responds to the address byte with an acknowledge (A). Then the bus master/host issues a register address (REGA), which corresponds to the address of the targeted byte inside the block FEh (00h, 01h...to 07h) and then waits for the Stop condition. 2 Then the bus master/host again issues a start condition followed by the NTAG I C plus 2 slave address with the Read/Write bit set to 1b. The NTAG I C plus acknowledges this (A), and sends the selected byte of session register data (REGDAT) within the block FEh. The bus master/host will acknowledge it and issue a Stop condition. WARNING: READ sequence shall be atomic. Complete sequence of above figure needs to be executed, otherwise that tag may go to undefined state and stretches the clock infinitely. For the WRITE register operation, following a Start condition, the bus master/host sends 2 the NTAG I C plus slave address code (SA - 7 bits) with the Read/Write bit (R/W) set to 2 0b. The NTAG I C plus acknowledges this (A), and waits for one address byte (MEMA), which corresponds to the address of the block of memory within the session register 2 bytes (FEh). After the NTAG I C plus acknowledge (A), the bus master/host issues a register address (REGA), which corresponds to the address of the targeted byte inside 2 the block FEh (00h, 01h...to 07h). After acknowledgement (A) by NTAG I C plus, the bus master/host issues a MASK byte that defines exactly which bits shall be modified by a 2 1b bit value at the corresponding bit position. Following the NTAG I C plus acknowledge (A), the new register data (one byte - REGDAT) to be written is transmitted by the bus 2 master/host. The NTAG I C plus acknowledges it (A), and the bus master/host issues a stop condition. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 46 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 10 NFC Command 2 NTAG activation follows the ISO/IEC 14443-3 Type A specification. After NTAG I C plus has been selected, it can either be deactivated using the ISO/IEC 14443 HALT command, or NTAG commands (e.g. READ_SIG, PWD_AUTH, SECTOR_SELECT, READ or WRITE) can be performed. For more details about the card activation refer to Ref. 2. 2 10.1 NTAG I C plus command overview 2 All available commands for NTAG I C plus are shown in Table 16. Table 16. Command overview [1] Command ISO/IEC 14443 NFC FORUM Command code (hexadecimal) Request REQA SENS_REQ 26h (7 bit) Wake-up WUPA ALL_REQ 52h (7 bit) Anticollision CL1 Anticollision CL1 SDD_REQ CL1 93h 20h Select CL1 Select CL1 SEL_REQ CL1 93h 70h Anticollision CL2 Anticollision CL2 SDD_REQ CL2 95h 20h Select CL2 Select CL2 SEL_REQ CL2 95h 70h Halt HLTA SLP_REQ 50h 00h GET_VERSION - - 60h READ - READ 30h FAST_READ - - 3Ah WRITE - WRITE A2h FAST_WRITE - - A6h SECTOR_SELECT - SECTOR_SELECT C2h PWD_AUTH - - 1Bh READ_SIG - - 3Ch [1] Unless otherwise specified, all commands use the coding and framing as described in Ref. 1. 10.2 Timing The command and response timing shown in this document are not to scale and values are rounded to 1 μs. All given command and response times refer to the data frames, including start of communication and end of communication. They do not include the encoding (like the Miller pulses). An NFC device data frame contains the start of communication (1 "start bit") and the end of communication (one logic 0 + 1-bit length of unmodulated carrier). An NFC tag data frame contains the start of communication (1 "start bit") and the end of communication (1-bit length of no subcarrier). The minimum and maximum command response time is specified according to Ref. 1. The minimum frame delay time from NFC tag to NFC device is 86.43 μs. The maximum command response time is specified as a timeout value. Depending on the command, NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 47 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting the TACK value specified for command responses defines the NFC device to NFC tag frame delay time. It does it for either the 4-bit ACK value specified or for a data frame. All timing can be measured according to the ISO/IEC 14443-3 frame specification as shown for the Frame Delay Time in Figure 20. For more details, refer to Ref. 2. last data bit transmitted by the NFC device first modulation of the NFC TAG FDT = (n* 128 + 84)/fc 128/fc logic „1“ 256/fc end of communication (E) 128/fc start of communication (S) FDT = (n* 128 + 20)/fc 128/fc logic „0“ 256/fc end of communication (E) 128/fc start of communication (S) aaa-006986 Figure 20. Frame Delay Time (from NFC device to NFC tag), TACK and TNAK Remark: Due to the coding of commands, the measured timings usually exclude (a part of) the end of communication. Consider this factor when comparing the specified with the measured times. 10.3 NTAG ACK and NAK 2 NTAG I C plus uses a 4-bit ACK / NAK as shown in Table 17. Table 17. ACK and NAK values Code (4 bit) ACK/NAK Ah Acknowledge (ACK) 0h NAK for invalid argument (i.e. invalid page address or wrong password) 1h NAK for parity or CRC error 3h NAK for Arbiter locked to I C 4h Number of negative PWD_AUTH commands limit reached 7h NAK for EEPROM write error 2 10.4 ATQA and SAK responses 2 NTAG I C plus replies to a REQA or WUPA command with the ATQA value shown in Table 18. It replies to a Select CL2 command with the SAK value shown in Table 19. The 2-byte ATQA value is transmitted with the least significant byte first (44h). NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 48 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 2 Table 18. ATQA response of the NTAG I C plus Bit number Sales type Hex value 2 NTAG I C plus 00 44h 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 2 Table 19. SAK response of the NTAG I C plus Bit number Sales type 2 NTAG I C plus Hex value 7 6 5 4 3 2 1 0 00h 0 0 0 0 0 0 0 0 Remark: The ATQA coding in bits 7 and 6 indicates the UID size according to ISO/IEC 14443. Remark: The bit numbering in ISO/IEC 14443 specification starts with bit 1 as least significant bit. 10.5 GET_VERSION The GET_VERSION command is used to retrieve information about the NTAG family, the product version, storage size and other product data required to identify the specific 2 NTAG I C plus. This command is also available on other NTAG products to have a common way of identifying products across platforms and evolution steps. The GET_VERSION command has no arguments and returns the version information 2 for the specific NTAG I C plus type. The command structure is shown in Figure 21 and Table 20. Table 21 shows the required timing. NFC device Cmd CRC Data NTAG ,,ACK'' TACK 283 µs CRC 868 µs NAK NTAG ,,NAK'' TNAK 57 µs TTimeOut Time out aaa-006987 Figure 21. GET_VERSION command Table 20. GET_VERSION command NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC Name Code Description Length Cmd 60h Get product version 1 byte CRC - CRC according to Ref. 1 2 bytes All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 49 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Name Code Description Length Data - Product version information 8 bytes NAK see Table 17 see Section 10.3 4 bit Table 21. GET_VERSION timing These times exclude the end of communication of the NFC device. TACK/NAK min [1] GET_VERSION [1] n=9 TACK/NAK max TTimeOut TTimeOut 5 ms Refer to Section 10.2 "Timing". 2 Table 22. GET_VERSION response for NTAG I C plus 2 2 Byte no. Description NTAG I C plus 1k NTAG I C plus 2k Interpretation 0 fixed Header 00h 00h 1 vendor ID 04h 04h NXP Semiconductors 2 product type 04h 04h NTAG 3 product subtype 05h 05h 50 pF I C, Field detection 4 major product version 02h 02h 2 5 minor product version 02h 02h V2 6 storage size 13h 15h see following information 7 protocol type 03h 03h ISO/IEC 14443-3 compliant 2 The most significant 7 bits of the storage size byte are interpreted as an unsigned integer n value n. As a result, it codes the total available user memory size as 2 . If the least n significant bit is 0b, the user memory size is exactly 2 . If the least significant bit is 1b, the n n+1 user memory size is between 2 and 2 . 10.6 READ_SIG The READ_SIG command returns an IC specific, 32-byte ECC signature, to verify NXP Semiconductors as the silicon vendor. The signature is programmed at chip production and cannot be changed afterwards. The command structure is shown in Figure 24 and Table 27. Table 28 shows the required timing. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 50 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting NFC device Cmd Addr CRC Data NTAG ,,ACK'' TACK 368 µs CRC 2907 µs NAK NTAG ,,NAK'' TNAK 57 µs TTimeOut Time out aaa-021657 Figure 22. READ_SIG command Table 23. READ_SIG command Name Code Description Length Cmd 3Ch read ECC signature 1 byte Addr 00h RFU, is set to 00h 1 byte CRC - CRC according to Ref. 1 2 bytes Signature - ECC Signature 32 bytes NAK see Table 17 see Section 10.3 4 bit Table 24. READ_SIG timing These times exclude the end of communication of the NFC device. TACK/NAK min [1] READ_SIG [1] n=9 TACK/NAK max TTimeOut TTimeOut 5 ms Refer to Section 10.2 "Timing". Details on how to check the signature value are provided in the corresponding Application note. It is foreseen to offer an online and offline way to verify originality of 2 NTAG I C plus. 10.7 PWD_AUTH A protected memory area can be accessed only after a successful password verification using the PWD_AUTH command. The AUTH0 configuration byte defines the start of the protected area. It specifies the first page that the password mechanism protects. The level of protection can be configured using the NFC_PROT bit either for write protection or read/write protection. The PWD_AUTH command takes the password as parameter and, if successful, returns the password authentication acknowledge, PACK. By setting the AUTHLIM configuration bits to a value larger than 000b, the number of unsuccessful password verifications can be limited. Each unsuccessful authentication is then counted. AUTHLIM After reaching the limit (2 ) of unsuccessful attempts, the memory write access or the memory access at all (specified in NFC_PROT) to the protected area, is no longer possible. The PWD_AUTH command is shown in Figure 23 and Table 25. Table 26 shows the required timing. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 51 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting NFC device Cmd Pwd CRC NTAG ,,ACK'' PACK TACK 623 µs NTAG ,,NAK'' CRC 368 µs NAK TNAK 57 µs TTimeOut Time out aaa-021658 Figure 23. PWD_AUTH command Table 25. PWD_AUTH command Name Code Description Length Cmd 1Bh password authentication 1 byte Pwd - password 4 bytes CRC - CRC according to Ref. 2 2 bytes PACK - password authentication acknowledge 2 bytes NAK see Table 17 see Section 10.3 4-bit Table 26. PWD_AUTH timing These times exclude the end of communication of the NFC device. TACK/NAK min [1] PWD_AUTH [1] n=9 TACK/NAK max TTimeOut TTimeOut 5 ms Refer to Section 10.2 "Timing". Remark: It is strongly recommended to change - and diversify for each tag - the password and PACK from its delivery state at tag issuing. 10.8 READ The READ command requires a start page address, and returns the 16 bytes of four 2 NTAG I C plus pages. For example, if address (Addr) is 03h then pages 03h, 04h, 05h, 06h are returned. Special conditions apply if the READ command address is near the end of the accessible memory area. For details on those cases and the command structure, refer to Figure 24 and Table 27. Table 28 shows the required timing. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 52 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting NFC device Cmd Addr CRC Data NTAG ,,ACK'' CRC TACK 368 µs 1548 µs NAK NTAG ,,NAK'' TNAK 57 µs TTimeOut Time out aaa-006988 Figure 24. READ command Table 27. READ command Name Code Description Length Cmd 30h read four pages 1 byte Addr - start page address 1 byte CRC - CRC according to Ref. 1 2 bytes Data - Data content of the addressed pages 16 bytes NAK see Table 17 see Section 10.3 4 bit Table 28. READ timing These times exclude the end of communication of the NFC device. TACK/NAK min [1] READ [1] n=9 TACK/NAK max TTimeOut TTimeOut 5 ms Refer to Section 10.2 "Timing". 2 In the initial state of NTAG I C plus, all memory pages are allowed as Addr parameter to the READ command: 2 • Page address from 00h to E9h and pages ECh and EDh for NTAG I C plus 1k and 2k 2 • Page address from 00h to FFh (Sector 1) for NTAG I C plus 2k only • SRAM buffer address when pass-through mode is enabled Addressing a start memory page beyond the limits above results in a NAK response from 2 NTAG I C plus. In case a READ command addressing start with a valid memory area but extends over an invalid memory area, the content of the invalid memory area will be reported as 00h. 10.9 FAST_READ The FAST_READ command requires a start page address and an end page address and returns all n*4 bytes of the addressed pages. For example, if the start address is 03h and the end address is 07h, then pages 03h, 04h, 05h, 06h and 07h are returned. For details on those cases and the command structure, refer to Figure 25 and Table 29. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 53 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Table 30 shows the required timing. NFC device Cmd StartAddr EndAddr CRC Data NTAG ,,ACK'' TACK 453 µs CRC depending on nr of read pages NAK NTAG ,,NAK'' TNAK 57 µs TTimeOut Time out aaa-006989 Figure 25. FAST_READ command Table 29. FAST_READ command Name Code Description Length Cmd 3Ah read multiple pages 1 byte StartAddr - start page address 1 byte EndAddr - end page address 1 byte CRC - CRC according to Ref. 1 2 bytes Data - data content of the addressed pages n*4 bytes NAK see Table 17 see Section 10.3 4 bit Table 30. FAST_READ timing These times exclude the end of communication of the NFC device. TACK/NAK min [1] FAST_READ [1] n=9 TACK/NAK max TTimeOut TTimeOut 5 ms Refer to Section 10.2 "Timing". 2 In the initial state of NTAG I C plus, all memory pages are allowed as StartAddr parameter to the FAST_READ command: 2 • Page address from 00h to E9h and pages ECh and EDh for NTAG I C plus 1k and 2k 2 • Page address from 00h to FFh (Sector 1) for NTAG I C plus 2k only • SRAM buffer address when pass-through mode is enabled 2 If the start addressed memory page (StartAddr) is outside of accessible area, NTAG I C plus replies a NAK. In case the FAST_READ command starts with a valid memory area but extends over an invalid memory area, the content of the invalid memory area will be reported as 00h. The EndAddr parameter must be equal to or higher than the StartAddr. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 54 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Remark: The FAST_READ command is able to read out the entire memory of one sector with one command. Nevertheless, the receive buffer of the NFC device must be able to handle the requested amount of data as no chaining is possible. 10.10 WRITE The WRITE command requires a page address, and writes 4 bytes of data into the 2 addressed NTAG I C plus page. The WRITE command is shown in Figure 26 and Table 31. Table 32 shows the required timing. NFC device Cmd Addr Data CRC ACK NTAG ,,ACK'' TACK 708 µs NTAG ,,NAK'' 57 µs NAK TNAK 57 µs TTimeOut Time out aaa-006990 Figure 26. WRITE command Table 31. WRITE command Name Code Description Length Cmd A2h write one page 1 byte Addr - page address 1 byte Data - data 4 bytes CRC - CRC according to Ref. 1 2 bytes NAK see Table 17 see Section 10.3 4 bit Table 32. WRITE timing These times exclude the end of communication of the NFC device. TACK/NAK min [1] WRITE [1] n=9 TACK/NAK max TTimeOut TTimeOut 5 ms Refer to Section 10.2 "Timing". 2 In the initial state of NTAG I C plus, the following memory pages are valid Addr parameters to the WRITE command: 2 • Page address from 02h to E9h (Sector 0) for NTAG I C plus 1k and 2k 2 • Page address from 00h to FFh (Sector 1) for NTAG I C plus 2k • SRAM buffer addresses when pass-through mode is enabled NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 55 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Addressing a memory page beyond the limits above results in a NAK response from 2 NTAG I C plus. Pages that are locked against writing cannot be reprogrammed using any write command. The locking mechanisms include static and dynamic lock bits, as well as the locking of the configuration pages. 10.11 FAST_WRITE The FAST_WRITE allows to write data in ACTIVE state to the complete SRAM (64 bytes) in pass-through mode, and requires the start block address (F0h), end address (FFh) and 2 writes 64 bytes of data into the NTAG I C plus SRAM. The FAST_WRITE command is shown in Figure 26 and Table 31. WARNING: Data is written directly to SRAM. If received CRC at the end of transmission is wrong and response was a NAK, received (corrupted) data is still in SRAM. Hence it is recommended to implement a protocol on top to ensure data integrity (e.g. include own CRC at the end of the payload) when using SRAM. Table 32 shows the required timing. NFC device Cmd Start End Data CRC ACK NTAG ,,ACK'' 5881 µs TACK NTAG ,,NAK'' 57 µs NAK TNAK 57 µs TTimeOut Time out aaa-021659 Figure 27. FAST_WRITE command Table 33. FAST_WRITE command NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC Name Code Description Length Cmd A6h write complete SRAM 1 byte START_ADDR F0h start SRAM in pass-through mode 1 byte END_ADDR FFh end SRAM in pass-through mode 1 byte Data - data 64 bytes - CRC CRC according to Ref. 1 2 bytes ACK see Table 17 see Section 10.3 4 bit NAK see Table 17 see Section 10.3 4 bit All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 56 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Table 34. FAST_WRITE timing These times exclude the end of communication of the NFC device. TACK/NAK min [1] FAST_WRITE [1] n=9 TACK/NAK max TTimeOut TTimeOut 5 ms Refer to Section 10.2 "Timing". 10.12 SECTOR SELECT The SECTOR SELECT command consists of two commands packet: the first one is the SECTOR SELECT command (C2h), FFh and CRC. Upon an ACK answer from the Tag, the second command packet needs to be issued with the related sector address to be accessed and 3 bytes RFU. To successfully access to the requested memory sector, the tag shall issue a passive ACK, which is sending NO REPLY for more than 1 ms after the CRC of the second command set. The SECTOR SELECT command is shown in Figure 28 and Table 35. Table 36 shows the required timing. NFC device Cmd FFh SECTOR SELECT packet 1 CRC ACK NTAG I2C ,,ACK'' TACK 368 µs 57 µs NAK NTAG I2C ,,NAK'' TNAK Time out 57 µs TTimeOut SECTOR SELECT packet 2 NFC device SecNo NTAG I2C ,,ACK'' 00h 00h 00h CRC (no reply) >1ms 537 µs NTAG I2C ,,NAK'' Passive ACK (any reply) NAK 2 V - - 0.4 V IOL= 2 mA; VCC < 2 V - - 0.2*VCC V VCC=1.8 V I C; idle bus VCC=3.3 V I C; idle bus IDD supply current 2 I C pin characteristics VOL LOW-level output voltage VIH HIGH-level input voltage 0.7*VCC - - V VIL LOW-level input voltage - - 0.3*VCC V Ci input capacitance SCL and SDA pin - 2.4 - pF IL leakage current 0 V and VCC,max - - 10 μA thigh SCL high time fast mode 400 kHz 950 - - ns IOL= 4 mA; VCC > 2 V - - 0.4 V IOL= 3 mA; VCC < 2 V - - 0.2*VCC V - 1.5 10 μA FD pin characteristics VOL IL LOW-level output voltage leakage current EEPROM characteristics NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 69 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Symbol Parameter Conditions Min Typ Max Unit tret retention time Tamb 20 50 - year Nendu(W) write endurance Tamb 200000 - - cycle Nendu(W) write endurance -40°C to 95°C 500000 1000000 - cycle [1] [2] Dependent on PCB design and operating conditions Minimum value depends on available field strength and load current conditions. For details refer to [7] 2 AN11578 NTAG I C Energy Harvesting NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 70 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 14 Package outline XQFN8: plastic, extremely thin quad flat package; no leads; 8 terminals; body 1.6 x 1.6 x 0.5 mm SOT902-3 X D B A terminal 1 index area A E A1 detail X e e v w L 4 3 C C A B C y1 C y b 5 e1 2 6 e1 7 1 terminal 1 index area 8 metal area not for soldering 0 1 Dimensions Unit mm max nom min 2 mm scale A 0.5 A1 b D E 0.05 0.25 1.65 1.65 0.20 1.60 1.60 0.00 0.15 1.55 1.55 e e1 L v w 0.6 0.5 0.45 0.40 0.35 0.1 y y1 0.05 0.05 0.05 Note 1. Plastic or metal protrusions of 0.075 mm maximum per side are not included. References Outline version IEC JEDEC JEITA SOT902-3 --- MO-255 --- sot902-3_po European projection Issue date 11-08-16 11-08-18 Figure 31. Package outline SOT902-3 (XQFN8) NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 71 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting TSSOP8: plastic thin shrink small outline package; 8 leads; body width 3 mm D E SOT505-1 A X c y HE v M A Z 5 8 A2 pin 1 index (A3) A1 A θ Lp L 1 4 e detail X w M bp 0 2.5 5 mm scale DIMENSIONS (mm are the original dimensions) UNIT A max. A1 A2 A3 bp c D(1) E(2) e HE L Lp v w y Z(1) θ mm 1.1 0.15 0.05 0.95 0.80 0.25 0.45 0.25 0.28 0.15 3.1 2.9 3.1 2.9 0.65 5.1 4.7 0.94 0.7 0.4 0.1 0.1 0.1 0.70 0.35 6° 0° Notes 1. Plastic or metal protrusions of 0.15 mm maximum per side are not included. 2. Plastic or metal protrusions of 0.25 mm maximum per side are not included. OUTLINE VERSION REFERENCES IEC JEDEC JEITA EUROPEAN PROJECTION ISSUE DATE 99-04-09 03-02-18 SOT505-1 Figure 32. Package outline SOT505-1 (TSSOP8) NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 72 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting SO8: plastic small outline package; 8 leads; body width 3.9 mm SOT96-1 D E A X c y HE v M A Z 5 8 A2 Q A (A 3) A1 pin 1 index θ Lp 1 L 4 e detail X w M bp 0 2.5 5 mm scale DIMENSIONS (inch dimensions are derived from the original mm dimensions) UNIT A max. A1 A2 A3 bp c D (1) E (2) e HE L Lp Q v w y Z (1) mm 1.75 0.25 0.10 1.45 1.25 0.25 0.49 0.36 0.25 0.19 5.0 4.8 4.0 3.8 1.27 6.2 5.8 1.05 1.0 0.4 0.7 0.6 0.25 0.25 0.1 0.7 0.3 0.01 0.019 0.0100 0.20 0.014 0.0075 0.19 0.16 0.15 inches 0.010 0.057 0.069 0.004 0.049 0.05 0.244 0.039 0.028 0.041 0.228 0.016 0.024 0.01 0.01 0.028 0.004 0.012 θ o 8 o 0 Notes 1. Plastic or metal protrusions of 0.15 mm (0.006 inch) maximum per side are not included. 2. Plastic or metal protrusions of 0.25 mm (0.01 inch) maximum per side are not included. REFERENCES OUTLINE VERSION IEC JEDEC SOT96-1 076E03 MS-012 JEITA EUROPEAN PROJECTION ISSUE DATE 99-12-27 03-02-18 Figure 33. Package outline SOT96-1 (SO8) NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 73 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 15 Handling information CAUTION This device is sensitive to ElectroStatic Discharge (ESD). Observe precautions for handling electrostatic sensitive devices. Such precautions are described in the ANSI/ESD S20.20, IEC/ST 61340-5, JESD625-A or equivalent standards. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 74 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 16 Abbreviations Table 43. Abbreviations NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC Acronym Description ASID Assembly Sequence ID DBSN Diffusion Batch Sequence number POR Power-On Reset All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 75 / 82 NXP Semiconductors 2 2 NT3H2111_2211 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 17 References 1. NFC Forum - Type 2 Tag Specification 1.0 Technical Specification 2. ISO/IEC 14443 - Identification cards - Contactless integrated circuit cards - Proximity cards International Standard 2 3. I C-bus specification and user manual NXP standard UM10204 http://www.nxp.com/documents/user_manual/UM10204.pdf 4. NFC Forum - Activity 2.0 Technical Specification 5. AN11276 NTAG Antenna Design Guide NXP Application Note http://www.nxp.com/documents/application_note/AN11276.pdf 6. AN11350 NTAG21x Originality Signature Validation NXP Application Note http://www.nxp.com/restricted_documents/53420/AN11350.pdf 2 7. AN11578 NTAG I C Energy Harvesting NXP Application Note http://www.nxp.com/documents/application_note/AN11578.pdf 2 8. AN11579 How to use the NTAG I C (plus) for bidirectional communication NXP Application Note http://www.nxp.com/documents/application_note/AN11579.pdf 2 9. AN11786 NTAG I C plus Memory Configuration Options NXP Application Note http://www.nxp.com/documents/application_note/AN11786.pdf 10.XQFN8 - SOT902-3 Package information https://www.nxp.com/docs/en/package-information/SOT902-3.pdf 11.TSSOP8 - SOT505-1 Package information https://www.nxp.com/docs/en/package-information/SOT505-1.pdf 12.SO8 - SOT505-1 Package information https://www.nxp.com/docs/en/package-information/SOT96-1.pdf 13.Certicom Research SEC 2: Recommended Elliptic Curve Domain Parameters V2.0 NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 76 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 18 Revision history Table 44. Revision history Document ID Release date Data sheet status Change notice Supersedes NT3H2111_2211 v. 3.5 20190507 Product data sheet - NT3H2111_2211 v. 3.4 Modifications: • • • • • • • • • Information about I²C fail safe operation added Link to detailed package specification on nxp.com added Information added that tag does not need to be supplied via VCC for ED functionality added Information added that reading NS_REG causes FD pin to be pulled low when configured for NFC field presence detection Information that VOUT maybe used as field detect pin, when energy harvesting is not used Typical idle current and FD pin leakage current added in characteristics (see Section 13) RFU bits and bytes handling requirements added Static and dynamic lock bits concequence to mirrored SRAM added Editorial updates NT3H2111_2211 v. 3.4 20190108 Product data sheet Modifications: • Package dimensions for XQFN8 in ordering information correcet according to package outline • CDM ESD limit added in limiting values table (see Section 12) • Editorial updates NT3H2111_2211 v. 3.3 20180808 Modifications: • • • • • NT3H2111_2211 v. 3.2 20171130 Modifications: • Error in editorial update of V3.1 in Table 13, TRANSFER_DIR corrected NT3H2111_2211 v. 3.1 20171009 Product data sheet - - Product data sheet Product data sheet - NT3H2111_2211 v. 3.1 v. 3.0 2 • Added info, that NTAG I C plus now is NFC Forum certified • Endurance updated in Table 42 • Editorial updates NT3H2111_2211 v. 3.0 20160203 Product data sheet COMPANY PUBLIC NT3H2111_2211 v. 3.2 Info added, that ED pin is based on open-drain implementation 2 Warnings and recommendations related to I C address added Warning, that I²C read operations must be atomic added Tj and thermal resistance added Editorial updates Modifications: NT3H2111/NT3H2211 NT3H2111_2211 v. 3.3 Product data sheet - All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 - © NXP B.V. 2019. All rights reserved. 77 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting 19 Legal information 19.1 Data sheet status Document status [1][2] Product status [3] Definition Objective [short] data sheet Development This document contains data from the objective specification for product development. Preliminary [short] data sheet Qualification This document contains data from the preliminary specification. Product [short] data sheet Production This document contains the product specification. [1] [2] [3] Please consult the most recently issued document before initiating or completing a design. The term 'short data sheet' is explained in section "Definitions". The product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple devices. The latest product status information is available on the Internet at URL http://www.nxp.com. notice. This document supersedes and replaces all information supplied prior to the publication hereof. 19.2 Definitions Draft — The document is a draft version only. The content is still under internal review and subject to formal approval, which may result in modifications or additions. NXP Semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall have no liability for the consequences of use of such information. Short data sheet — A short data sheet is an extract from a full data sheet with the same product type number(s) and title. A short data sheet is intended for quick reference only and should not be relied upon to contain detailed and full information. For detailed and full information see the relevant full data sheet, which is available on request via the local NXP Semiconductors sales office. In case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail. Product specification — The information and data provided in a Product data sheet shall define the specification of the product as agreed between NXP Semiconductors and its customer, unless NXP Semiconductors and customer have explicitly agreed otherwise in writing. In no event however, shall an agreement be valid in which the NXP Semiconductors product is deemed to offer functions and qualities beyond those described in the Product data sheet. 19.3 Disclaimers Limited warranty and liability — Information in this document is believed to be accurate and reliable. However, NXP Semiconductors does not give any representations or warranties, expressed or implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information. NXP Semiconductors takes no responsibility for the content in this document if provided by an information source outside of NXP Semiconductors. In no event shall NXP Semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation - lost profits, lost savings, business interruption, costs related to the removal or replacement of any products or rework charges) whether or not such damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. Notwithstanding any damages that customer might incur for any reason whatsoever, NXP Semiconductors’ aggregate and cumulative liability towards customer for the products described herein shall be limited in accordance with the Terms and conditions of commercial sale of NXP Semiconductors. Right to make changes — NXP Semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC Suitability for use — NXP Semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or malfunction of an NXP Semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. NXP Semiconductors and its suppliers accept no liability for inclusion and/or use of NXP Semiconductors products in such equipment or applications and therefore such inclusion and/or use is at the customer’s own risk. Applications — Applications that are described herein for any of these products are for illustrative purposes only. NXP Semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification. Customers are responsible for the design and operation of their applications and products using NXP Semiconductors products, and NXP Semiconductors accepts no liability for any assistance with applications or customer product design. It is customer’s sole responsibility to determine whether the NXP Semiconductors product is suitable and fit for the customer’s applications and products planned, as well as for the planned application and use of customer’s third party customer(s). Customers should provide appropriate design and operating safeguards to minimize the risks associated with their applications and products. NXP Semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the customer’s applications or products, or the application or use by customer’s third party customer(s). Customer is responsible for doing all necessary testing for the customer’s applications and products using NXP Semiconductors products in order to avoid a default of the applications and the products or of the application or use by customer’s third party customer(s). NXP does not accept any liability in this respect. Limiting values — Stress above one or more limiting values (as defined in the Absolute Maximum Ratings System of IEC 60134) will cause permanent damage to the device. Limiting values are stress ratings only and (proper) operation of the device at these or any other conditions above those given in the Recommended operating conditions section (if present) or the Characteristics sections of this document is not warranted. Constant or repeated exposure to limiting values will permanently and irreversibly affect the quality and reliability of the device. Terms and conditions of commercial sale — NXP Semiconductors products are sold subject to the general terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms, unless otherwise agreed in a valid written individual agreement. In case an individual agreement is concluded only the terms and conditions of the respective agreement shall apply. NXP Semiconductors hereby expressly objects to applying the customer’s general terms and conditions with regard to the purchase of NXP Semiconductors products by customer. All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 78 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting No offer to sell or license — Nothing in this document may be interpreted or construed as an offer to sell products that is open for acceptance or the grant, conveyance or implication of any license under any copyrights, patents or other industrial or intellectual property rights. Quick reference data — The Quick reference data is an extract of the product data given in the Limiting values and Characteristics sections of this document, and as such is not complete, exhaustive or legally binding. Export control — This document as well as the item(s) described herein may be subject to export control regulations. Export might require a prior authorization from competent authorities. Non-automotive qualified products — Unless this data sheet expressly states that this specific NXP Semiconductors product is automotive qualified, the product is not suitable for automotive use. It is neither qualified nor tested in accordance with automotive testing or application requirements. NXP Semiconductors accepts no liability for inclusion and/or use of nonautomotive qualified products in automotive equipment or applications. In the event that customer uses the product for design-in and use in automotive applications to automotive specifications and standards, customer (a) shall use the product without NXP Semiconductors’ warranty of the product for such automotive applications, use and specifications, and (b) whenever customer uses the product for automotive applications beyond NXP Semiconductors’ specifications such use shall be solely at customer’s own risk, and (c) customer fully indemnifies NXP Semiconductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive applications beyond NXP Semiconductors’ standard warranty and NXP Semiconductors’ product specifications. NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC Translations — A non-English (translated) version of a document is for reference only. The English version shall prevail in case of any discrepancy between the translated and English versions. 19.4 Licenses Purchase of NXP ICs with NFC technology Purchase of an NXP Semiconductors IC that complies with one of the Near Field Communication (NFC) standards ISO/IEC 18092 and ISO/ IEC 21481 does not convey an implied license under any patent right infringed by implementation of any of those standards. Purchase of NXP Semiconductors IC does not include a license to any NXP patent (or other IP right) covering combinations of those products with other products, whether hardware or software. 19.5 Trademarks Notice: All referenced brands, product names, service names and trademarks are the property of their respective owners. 2 I C-bus — logo is a trademark of NXP B.V. NTAG — is a trademark of NXP B.V. All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 79 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Tables Tab. 1. Tab. 2. Tab. 3. Tab. 4. Tab. 5. Tab. 6. Tab. 7. Tab. 8. Tab. 9. Tab. 10. Tab. 11. Tab. 12. Tab. 13. Tab. 14. Tab. 15. Tab. 16. Tab. 17. Tab. 18. Tab. 19. Tab. 20. Tab. 21. Tab. 22. Tab. 23. Tab. 24. Tab. 25. Ordering information ..........................................5 Marking codes ...................................................6 Pin description for XQFN8, TSSOP8 and SO8 ................................................................... 9 NTAG I2C plus 1k memory organization from the NFC perspective ............................... 14 NTAG I2C plus 2k memory organization from the NFC perspective ............................... 16 NTAG I2C plus 1k memory organization from the I2C perspective .................................19 NTAG I2C plus 2k memory organization from the I2C perspective .................................21 Minimum memory content to be in initialized state for NTAG I2C plus ..................................27 Password and Access Configuration Register ........................................................... 28 Password and Access Configuration bytes ..... 28 Configuration register NTAG I2C plus ............. 30 Session registers NTAG I2C plus ................... 30 Configuration bytes ......................................... 31 Session register bytes .....................................33 Default NTAG I2C address from I2C ...............43 Command overview .........................................47 ACK and NAK values ......................................48 ATQA response of the NTAG I2C plus ............49 SAK response of the NTAG I2C plus .............. 49 GET_VERSION command .............................. 49 GET_VERSION timing .................................... 50 GET_VERSION response for NTAG I2C plus .................................................................. 50 READ_SIG command ..................................... 51 READ_SIG timing ............................................51 PWD_AUTH command ................................... 52 NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC Tab. 26. Tab. 27. Tab. 28. Tab. 29. Tab. 30. Tab. 31. Tab. 32. Tab. 33. Tab. 34. Tab. 35. Tab. 36. Tab. 37. Tab. 38. Tab. 39. Tab. 40. Tab. 41. Tab. 42. Tab. 43. Tab. 44. PWD_AUTH timing ..........................................52 READ command ............................................. 53 READ timing ....................................................53 FAST_READ command .................................. 54 FAST_READ timing .........................................54 WRITE command ............................................ 55 WRITE timing .................................................. 55 FAST_WRITE command .................................56 FAST_WRITE timing ....................................... 57 SECTOR_SELECT command .........................57 SECTOR_SELECT timing ............................... 58 Illustration of the SRAM memory addressing via the NFC interface (with SRAM_ MIRROR_ON_OFF set to 1b and SRAM_ MIRROR_BLOCK set to 01h) for the NTAG I2C plus 1k ......................................................60 Illustration of the SRAM memory addressing via the NFC interface (with SRAM_ MIRROR_ON_OFF set to 1b and SRAM_ MIRROR_BLOCK set to 01h) for the NTAG I2C plus 2k ......................................................61 Illustration of the SRAM memory addressing via the NFC interface in pass-through mode (PTHRU_ON_OFF set to 1b) for the NTAG I2C 1k ..............................................................63 Illustration of the SRAM memory addressing via the NFC interface in pass-through mode (PTHRU_ON_OFF set to 1b) for the NTAG I2C 2k ..............................................................64 Limiting values ................................................ 68 Characteristics .................................................69 Abbreviations ...................................................75 Revision history ...............................................77 All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 80 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Figures Fig. 1. Fig. 2. Fig. 3. Fig. 4. Fig. 5. Fig. 6. Fig. 7. Fig. 8. Fig. 9. Fig. 10. Fig. 11. Fig. 12. Fig. 13. Fig. 14. Fig. 15. Fig. 16. Contactless and contact system ....................... 1 Block diagram ................................................... 7 Pin configuration for XQFN8 ............................. 8 Pin configuration for TSSOP8 ........................... 8 Pin configuration for SO8 ..................................8 NFC state machine of NTAG I2C plus ............ 11 Serial number (UID) ........................................ 23 Static lock bytes 0 and 1 .................................23 NTAG I2C plus 1k Dynamic lock bytes 0, 1 and 2 ............................................................... 25 NTAG I2C plus 2k Dynamic lock bytes 0, 1 and 2 ............................................................... 25 Possible configuration of CC bytes of NTAG I2C 1k version ................................................. 26 FD pin example circuit .................................... 35 Illustration of the field detection feature when configured for simple field detection ................35 Illustration of the field detection feature when configured for first valid start of communication detection .................................36 Illustration of the field detection feature when configured for selection of the tag detection .... 37 Energy harvesting example circuit .................. 38 NT3H2111/NT3H2211 Product data sheet COMPANY PUBLIC Fig. 17. Fig. 18. Fig. 19. Fig. 20. Fig. 21. Fig. 22. Fig. 23. Fig. 24. Fig. 25. Fig. 26. Fig. 27. Fig. 28. Fig. 29. Fig. 30. Fig. 31. Fig. 32. Fig. 33. I2C bus protocol ..............................................41 I2C READ and WRITE operation .................... 44 WRITE and READ register operation .............. 46 Frame Delay Time (from NFC device to NFC tag), TACK and TNAK .....................................48 GET_VERSION command .............................. 49 READ_SIG command ..................................... 51 PWD_AUTH command ................................... 52 READ command ............................................. 53 FAST_READ command .................................. 54 WRITE command ............................................ 55 FAST_WRITE command .................................56 SECTOR_SELECT command .........................57 Illustration of the Field detection feature in combination with the pass-through mode for data transfer from NFC to I2C .........................66 Illustration of the Field detection signal feature in combination with pass-through mode for data transfer from I2C to NFC .......... 67 Package outline SOT902-3 (XQFN8) .............. 71 Package outline SOT505-1 (TSSOP8) ............72 Package outline SOT96-1 (SO8) .....................73 All information provided in this document is subject to legal disclaimers. Rev. 3.5 — 7 May 2019 359935 © NXP B.V. 2019. All rights reserved. 81 / 82 NT3H2111_2211 NXP Semiconductors 2 2 NTAG I C plus: NFC Forum T2T with I C interface, password protection and energy harvesting Contents 1 2 2.1 2.2 2.3 2.4 2.5 2.6 3 4 5 6 7 7.1 7.1.1 7.1.2 7.1.3 7.2 8 8.1 8.2 8.2.1 8.2.2 8.2.2.1 8.2.2.2 8.2.2.3 8.2.2.4 8.2.2.5 8.2.2.6 8.3 8.3.1 8.3.2 8.3.3 8.3.4 8.3.5 8.3.6 8.3.7 8.3.8 8.3.9 8.3.10 8.3.11 8.3.12 8.4 8.5 8.6 8.7 8.7.1 8.7.2 8.7.3 8.8 9 9.1 General description ............................................ 1 Features and benefits .........................................2 Key features ...................................................... 2 NFC interface .................................................... 2 Memory .............................................................. 3 I2C interface ...................................................... 3 Security .............................................................. 3 Key benefits .......................................................3 Applications .........................................................4 Ordering information .......................................... 5 Marking .................................................................6 Block diagram ..................................................... 7 Pinning information ............................................ 8 Pinning ............................................................... 8 XQFN8 ............................................................... 8 TSSOP8 .............................................................8 SO8 ....................................................................8 Pin description ................................................... 9 Functional description ......................................10 Block description ............................................. 10 NFC interface .................................................. 10 Data integrity ................................................... 10 NFC state machine ..........................................11 IDLE state ........................................................11 READY 1 state ................................................ 11 READY 2 state ................................................ 12 ACTIVE state ...................................................12 AUTHENTICATED state .................................. 12 HALT state .......................................................12 Memory organization ....................................... 13 Memory map from NFC perspective ................13 Memory map from I2C interface ...................... 18 EEPROM ......................................................... 22 SRAM ...............................................................22 Serial number (UID) ........................................ 23 Static Lock Bytes .............................................23 Dynamic Lock Bytes ........................................ 24 Capability Container (CC) ................................26 User Memory pages ........................................ 26 Memory content at delivery ............................. 26 Password and Access Configuration ............... 27 NTAG I2C configuration and session registers ........................................................... 29 Configurable Field Detection Pin ..................... 34 Watchdog timer ............................................... 37 Energy harvesting ............................................38 Password authentication ..................................39 Programming of PWD and PACK .................... 39 Limiting negative verification attempts ............. 39 Protection of configuration segments ...............40 Originality signature ......................................... 40 I2C commands .................................................. 41 Start condition ..................................................41 9.2 9.3 9.4 9.5 9.6 9.7 9.8 10 10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 10.9 10.10 10.11 10.12 11 11.1 11.1.1 11.1.2 11.2 11.3 11.3.1 11.3.2 11.3.3 12 13 13.1 14 15 16 17 18 19 Stop condition ..................................................41 I2C soft reset and NFC silence feature ............42 Acknowledge bit (ACK) ....................................42 Data input ........................................................ 42 Addressing ....................................................... 42 READ and WRITE Operation .......................... 43 WRITE and READ register operation .............. 46 NFC Command .................................................. 47 NTAG I2C plus command overview .................47 Timing .............................................................. 47 NTAG ACK and NAK ...................................... 48 ATQA and SAK responses .............................. 48 GET_VERSION ............................................... 49 READ_SIG .......................................................50 PWD_AUTH .....................................................51 READ ............................................................... 52 FAST_READ ....................................................53 WRITE ............................................................. 55 FAST_WRITE .................................................. 56 SECTOR SELECT ...........................................57 Communication and arbitration between NFC and I2C interface ...................................... 59 Pass-through mode not activated .................... 59 I2C interface access ........................................ 59 NFC interface access ...................................... 59 SRAM buffer mapping with Memory Mirror enabled ............................................................ 60 Pass-through mode ......................................... 62 SRAM buffer mapping ..................................... 63 NFC to I2C data transfer ................................. 65 I2C to NFC data transfer ................................. 66 Limiting values .................................................. 68 Characteristics .................................................. 69 Electrical characteristics .................................. 69 Package outline .................................................71 Handling information ........................................ 74 Abbreviations .................................................... 75 References ......................................................... 76 Revision history ................................................ 77 Legal information .............................................. 78 Please be aware that important notices concerning this document and the product(s) described herein, have been included in section 'Legal information'. © NXP B.V. 2019. All rights reserved. For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: salesaddresses@nxp.com Date of release: 7 May 2019 Document identifier: NT3H2111/NT3H2211 Document number: 359935