Highly Integrated ISO14443A Reader IC, MF RC500

The content of the E²PROM memory from block address 3 to 7 may be used to initialise the MF RC500 registers 10hex to 2Fhex by execution of the LoadConfig-Command (see 16.6.1). It requires a two byte argument, that is used as the two byte long E²PROM starting byte address for the initialisation procedure.
The assignment is the following:

E²PROM Byte Address Register Address Remark
Starting Byte address for the E²PROM 10hex Skipped
Starting Byte address for the E²PROM +1 11hex Copied
Starting Byte address for the E²PROM + 31 2Fhex Copied

Table 6-6: Byte Assignment for Register Initialisation at Start Up

The Register Initialisation File is big enough to hold the values for two initialisation sets and leaves one more block (16 bytes) for the user.
Note: The Register Initialisation File is read- and write-able for the user. Therefore, these bytes may also be used to store user specific data for other purposes.

Crypto1 Keys (Write Only)
To store a key in the E²PROM, it has to be written in a specific format. Each key byte has to be split into the lower four bits k0 to k3 (lower nibble) and the higher four bits k4 to k7 (higher nibble). Each nibble is stored twice in one byte and one of the two nibbles is bit-wise inverted. This format is a precondition for successful execution of the LoadKeyE2- (see 16.8.1) and the LoadKey-Command (see 16.8.2).
With this format, 12 bytes of the E²PROM memory are needed to store a 6 byte long key.
This is shown in the following table:

Master Key Byte 0 (LSB) 1  
Master Key Bits k7 k6 k5 k4 k7 k6 k5 k4 k3 k2 k1 k0 k3 k2 k1 k0 k7 k6 k5 k4 k7 k6 k5 k4 k3 k2 k1 k0 k3 k2 k1 k0  
E²PROM Byte Address n n+1 n+2 n+3  
Example 5Ahex F0hex 5Ahex E1hex  
5 (MSB)
k7 k6 k5 k4 k7 k6 k5 k4 k3 k2 k1 k0 k3 k2 k1 k0
n+10 n+11
5Ahex A5hex


 Table 6-7: Key Storage Format
Example: For the actual key A0 A1 A2 A3 A4 A5hex the value 5A F0 5A E1 5A D2 5A C3 5A B4 5A A5hex must be written into the E²PROM.

Note: Although it is possible to load data of any other format into the key storage location of the E²PROM, it is not possible to obtain a valid card authentication with such a key. The LoadKeyE2-Command (see 16.8.1) will fail.
The MF RC500 reserves 384 bytes of memory area in the E²PROM to hold Crypto1 keys. It uses no memory segmentation, that mirrors the 12 byte structure of key storage. Thus, every byte of the dedicated memory area may be the start of a key.
Example If a key loading cycle starts at the last byte address of an E²PROM block, e.g. key byte 0 is stored at 12Fhex, the following bytes are stored in the next E²PROM block , e.g. key byte 1 is stored at 130hex, byte 2 at 131hex, up to byte 11 at 13Ahex.
With 384 bytes of memory and 12 bytes needed for one key, 32 different keys may be stored in the E²PROM.
Note: It is not possible to load a key such that it exceeds the E²PROM byte location 1FFhex.

During production test, the Start Up Register Initialisation File is initialised with the values shown in the table below. With each power up these values are written into the MF RC500 register during the Initialising Phase.

E²PROM Byte Address Reg. Address Value  Description
10 10 00 Page: free for user
11 11 58 TxControl:Transmitter pins TX1 and TX2 switched off, bridge driver configuration, modulator driven from internal digital circuitry
12 12 3F CwConductance:Source resistance of TX1 and TX2 to minimum.
13 13 3F PreSet13
14 14 19 PreSet14
15 15 13 ModWidth: Pulse width for Miller pulse coding is set to standard configuration.
16 16 00 PreSet16
17 17 00 PreSet17
18 18 00 Page:free for user
19 19 73 RxControl1:Amplifier gain is maximum.
1A 1A 08 DecoderControl:A bit-collision always evaluates to HIGH in the data bit stream.
1B 1B AD BitPhase: BitPhaseis set to standard configuration.
1C 1C FF RxThreshold: MinLeveland CollLevel are set to maximum.
1D 1D 00 PreSet1D
1E 1E 41 RxControl2:Use Q-clock for the receiver, ‘Automatic Receiver Off’ is switched on, decoder is driven from internal analog circuitry.
1F  1F 00 ClockQControl:Automatic Q-clock Calibration’ is switched on.
20 20 00 Page:free for user
21 21 06 RxWait: Frame Guard Time is set to six bit clocks.
22 22 03 ChannelRedundancy:Channel Redundancy is set according to ISO14443-A.
23 23 63 CRCPresetLSB:CRC-Preset value is set according to ISO14443-A.
24 24 63 CRCPresetMSB:CRC-Preset value is set according to ISO14443-A.
25 25 00 PreSet25
26 26 00 MFOUTSelect:Pin MFOUT is set to LOW.
27 27 00 PreSet27
28 28 00 Page:free for user
29 29 08 FIFOLevel: WaterLevel FIFO buffer warning level is set to standard configuration.
2A 2A 07 TimerClock: TPreScaleris set to standard configuration, timer unit restart function is switched off.
2B 2B 06 TimerControl:Timer is started at the end of transmission, stopped at the beginning of reception.
2C 2C 0A TimerReload: TReloadValue:the timer unit preset value is set to standard configuration.
2D 2D 02 IRQPinConfig: Pin IRQ is set to high impedance.
2E 2E 00 PreSet2E
2F  2F 00 PreSet2F

Table 6-5: Shipment Content of Start Up Configuration File

An 8×64 bit FIFO buffer is implemented in the MF RC500 acting as a parallel-to-parallel converter. It buffers the input and output data stream between the μ-Processor and the internals of the MF RC500. Thus, it is possible to handle data streams with lengths of up to 64 bytes without taking timing constraints into account.

Accessing the FIFO Buffer
The FIFO-buffer input and output data bus is connected to the FIFOData Register. Writing to this register stores one byte in the FIFO-buffer and increments the internal FIFO-buffer write-pointer. Reading from this register shows the FIFO-buffer content stored at the FIFO-buffer read-pointer and increments the FIFObuffer read-pointer. The distance between the write- and read-pointer can be obtained by reading the FIFOLength Register.
When the μ-Processor starts a command, the MF RC500 may, while the command is in progress, access the FIFO-buffer according to that command. Physically only one FIFO-buffer is implemented, which can be used in input- and output direction. Therefore the μ-Processor has to take care, not to access the FIFO-buffer in an unintended way.
The following table gives an overview on FIFO access during command processing:

Active Command µ-Processor is allowed to Remark
Write to FIFO
StartUp - -  
Idle - -  
Transmit 9 -  
Receive - 9  
Transceive 9 9 µ-Processor has to know the actual state of the command (transmitting or receiving)
WriteE2 9 -  
ReadE2 9 9 The µ-Processor has to prepare the arguments, then only reading is allowed
LoadKeyE2 9 -  
LoadKey 9 -  
Authent1 9 -  
Authent2 - -  
LoadConfig 9 -  
CalcCRC 9 -  

Table 7-1: Allowed Access to the FIFO-Buffer

Controlling the FIFO-Buffer
Besides writing to and reading from the FIFO-buffer, the FIFO-buffer pointers may be reset by setting the bit FlushFIFO. Consequently, FIFOLength becomes zero, FIFOOvfl is cleared, the actually stored bytes are not accessible anymore and the FIFO-buffer can be filled with another 64 bytes again.

Status Information about the FIFO-Buffer
The μ-Processor may obtain the following data about the FIFO-buffers status:
–Number of bytes already stored in the FIFO-buffer: FIFOLength
–Warning, that the FIFO-buffer is quite full: HiAlert
– Warning, that the FIFO-buffer is quite empty: LoAlert
–Indication, that bytes were written to the FIFO-buffer although it was already full: FIFOOvfl FIFOOvfl can be cleared only by setting bit FlushFIFO.
The MF RC500 can generate an interrupt signal
–If LoAlertIRq is set to 1 it will activate Pin IRQ when LoAlert changes to 1.
–If HiAlertIRq is set to 1 it will activate Pin IRQ when HiAlert changes to 1.
The flag HiAlert is set to 1 if only WaterLevel bytes or less can be stored in the FIFO-buffer. It is generated
by the following equation:
HiAlert = (64 − FIFOLength) ≤ WaterLevel
The flag LoAlert is set to 1 if WaterLevel bytes or less are actually stored in the FIFO-buffer. It is generated by the following equation:
LoAlert = FIFOLength ≤ WaterLevel

Register Overview FIFO Buffer
The following table shows the related flags of the FIFO buffer in alphabetic order.

Flags Register  Address Register, bit position
FIFOLength FIFOLength 0×04, bits 6-0
FIFOOvfl ErrorFlag 0x0A, bit 4
FlushFIFO Control 0×09, bit 0
HiAlert PrimaryStatus  0×03, bit 1
HiAlertIEn InterruptIEn 0×06, bit 1
HiAlertIRq InterruptIRq 0×07, bit 1
LoAlert PrimaryStatus  0×03, bit 0
LoAlertIEn InterruptIEn 0×06, bit 0
LoAlertIRq InterruptIRq 0×07, bit 0
WaterLevel FIFOLevel 0×29, bits 5-0

Table 7-2. Registers associated with the FIFO Buffer