Highly Integrated ISO14443A Reader IC, MF RC500

TRANSCEIVE COMMAND 1EHEX

Command Codehex Action Arguments and Data Returned Data
Transceive 1E Transmits data from FIFO buffer to the card and then activates automatically the receiver Data Stream Data Stream

The Transceive-Command first executes the Transmit-Command (see 16.4.1) and then automatically starts the Receive-Command (see 16.4.2). All data that shall be transmitted is forwarded via the FIFO buffer and all data received is returned via the FIFO buffer. The Transceive-Command can be started only by the μ-Processor.
Note: To adjust the timing relation between transmitting and receiving, the RxWait Register is used to define the time delay from the last bit transmitted until the receiver is activated. Furthermore, the BitPhase Register determines the phase-shift between the transmitter and the receiver clock.

STATES OF THE CARD COMMUNICATION
The actual state of the transmitter and receiver state machine can be fetched from ModemState in the PrimaryStatus Register.
The assignment of ModemState to the internal action is shown in the following table:

ModemState Name of State Description
000 Idle Neither the transmitter nor the receiver is in operation, since none of them is started or the transmitter has not got input data
001 TxSOF Transmitting the ‘Start Of Frame’ Pattern
010 TxData Transmitting data from the FIFO buffer (or redundancy check bits)
011 TxEOF Transmitting the ‘End Of Frame’ Pattern
100 GoToRx1 Intermediate state passed, when receiver starts
GoToRx2 Intermediate state passed, when receiver finishes
101 PrepareRx Waiting until the time period selected in the RxWait Register has expired
110 AwaitingRx Receiver activated; Awaiting an input signal at pin Rx
111 Receiving Receiving data

Table 16-4: Meaning of ModemState

STATE DIAGRAM FOR THE CARD COMMUNICATION

Mifare 4K S70 Card,Mifare 4k Printing Cards,Mifare 4K Proximity Smart Cards,Mifare Classic 4K S70 Offset Printing Cards

Figure 16-4: State Diagram: Card Communication

Commands to Access the E²PROM
WRITEE2 COMMAND 01HEX

Command Codehex Action Arguments and Data Returned Data
Transceive 1E Transmits data from FIFO buffer to the card and then activates automatically the receiver Data Stream Data Stream

The WriteE2-Command interprets the first two bytes in the FIFO buffer as E²PROM starting byte-address. Any further bytes are interpreted as data bytes and are programmed into the E²PROM, starting from the given E²PROM starting byte-address. This command does not return any data. The WriteE2-Command can only be started by the μ-Processor. It will not stop automatically but has to be stopped explicitly by the μ-Processor by issuing the Idle-Command.

Programming Process
One byte up to 16 byte can be programmed into the EEPROM in one programming cycle. The time needed will be in any case about 5.8ms. The state machine copies all data bytes prepared in the FIFO buffer to the E²PROM input buffer. The internal E²PROM input buffer is 16 byte long which is equal the block size of the E²PROM. A programming cycle is started either if the last position of the E²PROM input buffer is written or if the last byte of the FIFO buffer has been fetched. As long as there are unprocessed bytes in the FIFO buffer or the E²PROM programming cycle still is in progress, the flag E2Ready is 0. If all data from the FIFO buffer are programmed into the E²PROM, the flag E2Ready is set to1. Together with the rising edge of E2Ready the interrupt request flag TxIRq indicates a 1. This may be used to generate an interrupt when programming of all data is finished. After the E2Ready bit is set to 1, the WriteE2-Command may be stopped by the μ-Processor by issuing the
Idle-Command.
Note: During the E2PROM programming indicated by E2Ready = 0, the WRITEE2 command cannot be stopped by any other command.

Timing Diagram
The following diagram shows programming of 5 bytes into the E²PROM:

Mifare 4K Card,Mifare 4K Proximity Contactless Cards,Mifare 4K Contactless Smart Cards,Mifare 4K Access Control Cards

Figure 16-5: Timing Diagram for E²PROM programming

Explanation: It is assumed, that the MF RC500 finds and reads Byte 0 before the μ-Processor is able to write Byte 1 (tprog,del = 300 ns). This causes the MF RC500 to start the programming cycle, which needs about tprog = 5.8 ms. In the meantime the μ-Processor stores Byte 1 to Byte 4 to the FIFO buffer. Assuming, that the E²PROM starting byte-address is e.g. 16Chex then Byte 0 is stored exactly there. The MF RC500 copies the following data bytes into the E²PROM input buffer. Copying Byte 3, it detects, that this data byte has to be programmed at the E²PROM byte-address 16Fhex. Since this is the end of the memory block, the MF RC500 automatically starts a programming cycle. In the next turn, Byte 4 will be programmed at the E²PROM byteaddress 170hex. Since this is the last data byte, the flags (E2Ready and TxIRq) that indicate the end of the E²PROM programming activity will be set. Although all data has been programmed into the E2PROM, the MF RC500 stays in the WriteE2-Command. Writing further data to the FIFO would lead to further E²PROM programming, continuing at the E²PROM
byte-address 171hex. The command is stopped using the Idle-Command.

Error Flags for the WriteE2 Command
Programming is inhibited for the E²PROM blocks 0 (E²PROM’s byte-address 00hex to 0Fhex). Programming to these addresses sets the flag AccessErr. No programming cycle is started. Addresses above 1FFhex are taken modulo 200hex

READE2 COMMAND 03HEX

Command Codehex Action Arguments Returned Data
ReadE2 03 Reads data from E²PROM and puts it to the FIFO buffer Start Address LSB Start Address MSB Number of Data Bytes Data Bytes

The ReadE2-Command interprets the first two bytes found in the FIFO buffer as E²PROM starting byte-address. The next byte specifies the number of data bytes that shall be returned. When all three argument-bytes are available in the FIFO buffer, the specified number of data bytes is copied from the E²PROM into the FIFO buffer, starting from the given E²PROM starting byte-address. The ReadE2-Command can be triggered only by the μ-Processor. It stops automatically when all data has
been delivered.
Error Flags for the ReadE2 Command
Reading is inhibited for the E²PROM blocks 8hex up to 1Fhex ( key memory area). Reading from these addresses sets the flag AccessErr to 1. Addresses above 1FFhex are taken modulo 200hex (for the E²PROM memory organisation refer to chapter 6).

Diverse Commands
LOADCONFIG COMMAND 07HEX

Command Codehex Action Arguments and Data Returned Data
LoadConfig 07 Reads data from E²PROM and initialises the registers Start Address LSB Start Address MSB -

The LoadConfig-Command interprets the first two bytes found in the FIFO buffer as E²PROM starting byte-address. When the two argument-bytes are available in the FIFO buffer, 32 bytes from the E²PROM are copied into the MF RC500 control and configuration registers, starting at the given E²PROM starting byte-address. The LoadConfig-Command can only be started by the μ-Processor. It stops automatically when all relevant registers have been copied.

Register Assignment
The 32 bytes of E²PROM content, beginning with the E²PROM starting byte-address, is written to the MF RC500 register 10hex up to register 2Fhex (for the E²PROM memory organisation see also 6). Note: The procedure for the register assignment is the same as it is for the Start Up Initialisation (see 11.3). The difference is, that the E²PROM starting byte-address for the Start Up Initialisation is fixed to 10hex (Block 1, Byte 0). With the LoadConfig-Command it can be chosen.
Relevant Error Flags for the LoadConfig-Command
Valid E²PROM starting byte-addresses are in the range from 10hex up to 60hex. Copying from block 8hex up to 1Fhex (keys) is inhibited. Reading from these addresses sets the flag AccessErr to 1. Addresses above 1FFhex are taken modulo 200hex

CALCCRC COMMAND 12HEX

Command Codehex Action Arguments and Data Returned Data
CalcCRC 12 Activates the CRC-Coprocessor Data Byte-Stream -

 

The CalcCRC-Command takes all data from the FIFO buffer as input bytes for the CRC-Coprocessor. All data stored in the FIFO buffer before the command is started will be processed. This command does not return any data via the FIFO buffer, but the content of the CRC-register can be read back via the CRCResultLSB-register and the CRCResultMSB-register. The CalcCRC-Command can only be started by the μ-Processor. It does not stop automatically but has to be stopped explicitly by the μ-Processor with the Idle-Command. If the FIFO buffer is empty, the CalcCRC-Command waits for further input from the FIFO buffer.

CRC-Coprocessor Settings
For the CRC-Coprocessor the following parameters may be configured:

Parameter Value Bit Register
CRC Register Length 8 Bit or 16 Bit CRC CRC8 ChannelRedundancy
CRC Algorithm Algorithm according ISO14443-A or according ISO/IEC3309 CRC3309 ChannelRedundancy
CRC Preset Value Any CRCPresetLSB, CRCPresetMSB CRCPresetLSB, CRCPresetMSB

Table 16-5: CRC-Coprocessor Parameters
The CRC polynomial for the 8-bit CRC is fixed to x8 + x4 + x3 + x2 +1.
The CRC polynomial for the 16-bit CRC is fixed to x16 + x12 + x5 +1.

Status Flags of the CRC-Coprocessor
The status flag CRCReady indicates, that the CRC-Coprocessor has finished processing of all data bytes found in the FIFO buffer. With the CRCReady flag setting to 1, an interrupt is requested with TxIRq being set. This supports interrupt driven usage of the CRC-Coprocessor. When CRCReady and TxIRq are set to 1, respectively, the content of the CRCResultLSB- and
CRCResultMSB-register and the flag CRCErr is valid. The CRCResultLSB- and CRCResultMSB-register hold the content of the CRC register, the CRCErr flag indicates CRC validity for the processed data.

Error Handling during Command Execution
If any error is detected during command execution, this is shown by setting the status flag Err in the PrimaryStatus Register. For information about the cause of the error, the μ-Processor may evaluate the status flags in the ErrorFlag Register.

Error Flag of the ErrorFlag Register Related to Command
KeyErr LoadKeyE2, LoadKey
AccessError WriteE2, ReadE2, LoadConfig
FIFOOvl No specific commands
CRCErr Receive, Transceive, CalcCRC
FramingErr Receive, Transceive
ParityErr Receive, Transceive
CollErr Receive, Transceive

Table 16-6: Error Flags Overview