NFC/HF RFID reader/writer using the TRF7970A

NFC/HF RFID reader/writer using the TRF7970A

Trademarks

BoosterPack, LaunchPad are registered trademarks of Texas Instruments.

Arm, Cortex are registered trademarks of Arm Limited.

All other trademarks are the property of their respective owners.

1 Terms, Definitions, and Symbols

ALL_REQ
NFC-A Polling command, equivalent to ISO14443-3 short frame command WupA (0x52)

ALLB_REQ
NFC-B Polling command, equivalent to ISO14443-3 command WupB

APDU
Application Protocol Data Unit, used in command-response pairs to exchange I (information), R (receive ready) or S (supervisory) blocks.

ATTRIB
PICC Selection Command, Type B

ATQA
Answer To ReQuest A, ISO14443-3 term, equivalent to NFC term SENS_RES

ATQB
Answer To ReQuest B, ISO14443-3 term, equivalent to NFC term SENSB_RES

CC
Capability Container, contains management data and is stored inside a read-only EF. This EF is located inside the NDEF tag application. Default (or basic) file ID for this file (for NFC) is 0xE103. See NFC Type 4 tag Operation Specification and ISO/IEC 7816-4 for more information.

CE
Card Emulation, one of the three modes offered by NFC devices. In this optional mode of NFC operation, an NFC Forum device is considered to be a card emulation platform only when it is emulating a Type 3, Type 4A or Type 4B tag platform. Emulation of any other cards or tags is outside the scope of the NFC Forum Brand Promise.

DEP
Data Exchange Protocol, an abstracted operational layer that is using either ISO or NFC protocols to exchange data. Thus, two terms can be created with this acronym: ISO-DEP and NFC-DEP. In the context of this document, after activation and selection of the emulated card and before deactivation, ISO-DEP is used exclusively to exchange data between reader/writer (PCD) and tag platform (PICC).

EF
Elementary File, a set of data objects, records or units sharing the same file identifier and the same security attributes

File Identifier
Two byte data element used to address a file

fc
Carrier frequency, in the context of NFC/HF RFID, is 13.56 MHz ±7 kHz. This is the fundamental transmit frequency of the reader/writer (also called PCD)

Initiator
Generator of the RF field and source of the beginning of the NFCIP-1 communication

MIME
Multipurpose Internet Mail Extensions

Modulation Index, m
Signal amplitude ratio of , where b is the ratio between the modulated amplitude and the initial signal amplitude. The index m is defined per protocol type for both downlink and uplink and is generally expressed as a percentage (for example, Type A uses m = 100%, and Type B uses m = 8 to 14%).

NDEF
NFC Data Exchange Format

NFC
Near Field Communication

PCB
Protocol Control Byte, used for conveying information required to control data transmission of blocks during the exchange of command-response APDU pairs. Bit coding of this byte and use rules are found in ISO/IEC FDIS 14443-4.

PCD
Proximity Coupling Device (also commonly referred to as reader/writer)

PICC
Proximity Integrated Circuit Card (also commonly referred to as tag, tag platform or transponder)

PUPI
Pseudo Unique PICC Identifier (randomly generated or static number returned by PICC as part of the response to REQB, WupB, ALLB_REQ or SENSB_REQ)

RTD
Record Type Definition

SAK
Select AcKnowledge (from ISO14443-3), in NFC terms this is also called SEL_RES

SDD_RES
Equivalent to ISO14443-3 response to SDD_REQ, and is complete NFCID1 CLn + BCC (if cascade level 1 (single size UID) or indicates NFCID1 is incomplete in the response and further cascade levels must be completed to obtain complete NFCID1+BCC.

SDD_REQ
Equivalent to ISO14443-3 Type A anticollision sequence. Comprised of SEL_CMD, SEL_PAR and n data bits coded based on cascade level specified by SEL_CMD and calculated by value of SEL_PAR

SEL_RES
Equivalent to ISO14443-3 SAK response

SENS_REQ
NFC-A Polling command, equivalent to ISO14443-3 short frame command REQ_A (0x26)

SENS_RES
NFC-A Polling Response, equivalent to ISO14443-3 ATQA

SENSB_REQ
NFC-B Polling command, equivalent to ISO14443-3 command REQ_B

SENSB_RES
NFC-B Polling command response, equivalent to ISO14443-3 ATQB

SENSF_REQ
NFC-F Polling command

SENSF_RES
NFC-F Polling response

Single Device Detection (SDD)
Algorithm used by the reader/writer to detect one out of several targets in its RF field (Type A anticollision, from ISO/IEC 14443-3)

T2T
Type 2Tag

T3T
Type 3Tag

T4T
Type 4Tag

T5T
Type 5Tag

Tag
See Tag Platform

Tag Platform
Responds to reader/writer (PCD) commands by using load modulation scheme (passive operation)

Throughout this document, the terms tag, tag platform, and transponder all have the same meaning.

TLV
Type Length Value

Transponder
See Tag Platform

UID
Unique IDentifier

VICC
Vicinity Integrated Circuit Card

2 Introduction

The TRF7970A device supports three modes: reader/writer, card emulation, and peer-to-peer. This document describes how to use the TRF7970A in reader/writer mode. This mode allows an NFC enabled system to activate and read existing RFID and NFC tags. In the case of the TRF7970A, it is possible to read Type 2 (T2T), Type 3 (T3T), Type 4A or B (T4T), and ISO15693 (T5T) tag platforms. NFC transceivers supporting reader/writer mode typically poll to check if a tag or NFC peer is present every 500 ms. This time is known as the period time, which includes the time the transceiver is polling (searching for a tag) plus the time the transceiver is listening to be activated (in the case it is emulating a tag or is in peer-to-peer target mode). In Figure 1, for example, the transceiver is first polling for Active A and F technology (active peer-to-peer). Next, it polls for passive A technology (ISO14443A-3), passive B (ISO14443B-3), passive F (ISO18092), and then passive V (ISO15693).

For more information on active peer-to-peer communication and how passive A and F technology can be used to activate peer-to-peer communication, see NFC active and passive peer-to-peer communication using the TRF7970A.

The reader always generates the RF field and the tag load modulates the RF field to send their response. Figure 2 shows the NFC/RFID layers used to read and write tags. Both T2T and T4TAplatforms use technology ISO14443-3 (Type A) at an initial bit rate of 106 kbps for tag activation. T4TB platforms use technology ISO14443-3 (Type B) at an initial bit rate of 106 kbps for tag activation. After the activation process is completed, both T4TA and T4TB platforms use ISO7816-4 and ISODEP layers to read or write the tag content. After the T2T platform is activated it uses T2T commands to read or write the tag content. T3T platforms use technology ISO18092 at an initial bit rate of 212 kbps or 424 kbps for tag activation. When the T3T is activated it uses T3T commands to read or write the tag content. T5T platforms use technology ISO15693 for activation and to read the tag content.

A 16-bit and a 32-bit microcontroller were used to interface with the TRF7970A to demonstrate a reference example of the reader/writer mode. The firmware supports flexible functions that allow the user to enable or disable reading T2T, T3T, T4TA/B, and T5T platforms. Additionally, the firmware provides support for NFC-enabled smart phones that can emulate tag platforms. The firmware can activate and select NFC-enabled smart phones, allowing users to read card data by creating their own custom applications using existing APIs.

Table 1 lists the NFC/RFID technologies that the provided example firmware supports.

NOTE

Type 1 tags are not ISO compliant and require the use of Direct Mode 0 (DM0) to receive raw RF packets. Due to this, the firmware example does not support these tags.

3 Initial RF Collision

NFC enabled systems can support both reader/writer mode and listen mode. To ensure that two NFC reader devices do not send commands at the same time, an initial RF collision detection is required. The transceiver must check the external received signal strength indicator (RSSI) value that measures the strength of the demodulated subcarrier signal before enabling its own RF field. If the RSSI value is greater than 0x00, it will not enable its RF field.

The relation between the 3-bit code and the external RF field strength (A/m) sensed by the antenna must be determined by calculation or by experiments for each antenna design. The antenna Q-factor, coupling factor between the two antennas and connection to the RF input influence the result. Figure 4 through Figure 6 provide the correlation of the free space distance between two unmodified TRF7970ATB modules and the 3-bit external RSSI value in three directions (see Figure 3 for more details on each orientation). One TRF7970A has its RF field at full power (+5 V), and the second TRF7970A is used to take RSSI measurements across different distances.

The initial RF collision can be accomplished by performing the following steps:

1. Write a 0x02 or 0x03 (3-V or 5-V operation) to the Chip Status Control register (0x00), disabling the transmitter and enabling the receiver.
2. Send a Test External RF direct command (0x19).
3. Delay 50 µs to allow the transceiver to measure the field strength and latch the value into the RSSI register.
4. Read the RSSI Levels and Oscillator Status register (0x0F).
5. If the active channel RSSI value (bits 2-0) is greater than 0, remain in target mode for a predetermined n milliseconds.
6. If the active channel RSSI value (bits 2-0) is equal to 0, go into initiator or target mode for active or passive communication.

4 TRF7970A Register Settings

After powering up the TRF7970A, sending SOFT_INIT (0x03) and IDLE (0x00) direct commands enables the passive target mode at 106 kbps. Table 2 lists the default value of registers 0x00 to 0x16 and 0x18h to 0x1C after the commands are issued. Furthermore, it shows the registers that must be modified from their default values for reader/writer mode.

The ISO Control (0x01) register is modified whenever the reader/writer technology or bit rate changes. The Chip Status Control (0x00) register is modified after initialization, and whenever the RF field is enabled or disabled. The Special Function (0x10) register requires modification for writing to Type 2 tags. The Modulator and SYS_CLK Control (0x09), RX Special Settings (0x0A), and Regulator and I/O Control (0x0B) registers need to be modified only once, after initialization. The NFC Target Detection Level register must be modified after initialization based on the TRF7970A silicon errata.

5 Reader/Writer Mode

The TRF7970A supports reader/writer mode for NFC-A (Type 2/4A), NFC-B (Type 4B), NFC-F (Type 3), and NFC-V (Type 5) tag platforms. Only one technology can be activated at a time, requiring the reader/writer mode to poll through each technology individually to detect NFC tags. The way this is handled in the example firmware is illustrated by the flow diagram presented in Figure 7.

After the initial RF collision is completed and the RF field is turned on, there is a guard time before polling for the first technology. The guard time is a specified period of time where the RF field is on, but is unmodulated. The guard time allows for a tag platform to have enough time to be ready to reply to commands that are issued. The guard time requirements vary with each technology, and therefore the ISO specifications for an individual technology should be referenced to find out more information about the guard time for that technology.

For the TRF7970A, there must be a 0x20 or 0x21 written to the Chip Status Control (0x00) register, and the appropriate technology setup for the ISO Control (0x01) register. The example firmware provided implements longer guard times than the minimum required by the specifications for NFC-A and NFC-B. This is done to improve the performance of systems that rely on an RF field to power up additional devices.

The flow diagram for example firmware in Figure 7 does not explicitly show the guard times, but they occur before sending the initial polling command for each technology. For example, the guard time before sending an ALL_REQ or SENS_REQ is set to be 5 ms in the firmware, so if the firmware confirms that NFC-A is enabled, the firmware then turns on the RF field and waits for 5 ms before issuing the ALL_REQ or SENS_REQ command.

The firmware has been structured based on the NFC Forum Activity 1.0 specification, and does not include any anticollision processes for detecting and selecting multiple tags of the same technology. This is equivalent to having the device connection limit set to zero.

It is possible to implement such processes with the TRF7970A by modifying the provided example firmware to support anticollision processes for the different technologies. The firmware has been designed to promote flexibility for modifications as well as custom applications, and the existing APIs can be leveraged to add anticollision functionality for each technology.

5.1 Technology Activation Using the TRF7970A

The TRF7970A defaults as a passive target and therefore requires the ISO Control register (0x01) to be modified to enable the correct NFC technologies for reader/writer mode. Therefore, the following sections describe how to set up the TRF7970A and what the frame format is for each supported technology.

5.1.1 ISO14443-3 Type A (Type 2 and Type 4A Tags)

The frame format for ISO14443A packets at 106 kbps during anticollision(shown in Figure 8) is based on NFC-A technology specifications in NFCForum-TS-DigitalProtocol-1.0 and the ISO 14443-3 Specifications. The Type A frame format does not include CRC bytes when sending anticollision commands, but does include the CRC bytes when sending tag selection and data exchange command.

When the initial RF collision is completed and no RF field has been detected (as shown in Figure 7) the following registers must be modified before and after the anticollision is completed (see Figure 9). For more information, see Section 3.

• ISO Control register (0x01) = 0x88 (ISO14443A at 106 kbps, receive without CRC during anticollision, before Select command)
  or
  ISO Control register (0x01) = 0x08 (ISO14443A at 106 kbps, receive with CRC after anticollision is completed).
• Send packet:
  • Reset FIFO (0x0F) direct command.
  • Transmission without (0x10, anticollision before Select command) or with (0x11, after anticollision is completed) CRC direct command.
  • TX Length Byte 1 (0x1D) and TX Length Byte 2 (0x1E) registers.
  • Write the command to the FIFO.

In the context of Type A, anticollision refers to the mandatory process for the retrieval of the UID, and does not imply support for detecting multiple Type A tags presented at the same time.

The ISO control register must be modified for the anticollision state to receive without CRC for the required commands (see the ISO14443-3 specification for more information). When the anticollision is completed, the ISO Control register must be modified to receive with CRC. Step 2 must be used to send commands to the passive target.

5.1.1.1 Additional Tag Activation Commands for Type 4A Tags

Tags that communicate with NFC-A technology and are ISO14443-4 compliant are considered Type 4A tags and must be sent an additional command, RATS, to finish the activation process and allow the exchange of data. There is also an optional command, PPS Request, that can be sent prior to entering data exchange. Because the example firmware provided sends both of these commands (see Figure 10), this section describes how both of them work.

1. Request Answer To Select (RATS)

The RATS command is used to select a Type 4A tag that has indicated support for ISO14443-4. All Type 4A tags must respond to the RATS command by sending back an Answer to Select (ATS) response. The ATS response can optionally include information about supported bit rates, timing requirements, and optional fields for over the air commands. For further detail on the format of the ATS response, refer to the ISO14443-4 specification.

2. Protocol and Parameter Selection Request (PPS Request)

The PPS Request command is an optional command that can be issued by the reader to increase the communication bit rate with a Type 4A tag. The ATS response contains the information about the supported bit rates: 106 kbps, 212 kbps, 424 kbps, and 848 kbps. With this information, the firmware determines the highest mutually supported bit rate by comparing the ATS response to the enabled reader/writer bit-rate settings, and send that bit rate to the tag in the PPS Request to ensure that the tag will operate at that data rate.

Upon receiving a PPS Response, the firmware will set the ISO Control register (0x01) with the correct settings to transmit data at the previously determined bit rate. At this point both the reader/writer and the Type 4A tag are ready to begin exchanging data.

5.1.2 ISO14443B-3 (Type 4B Tags)

The frame format for ISO14443B packets at 106 kbps (see Figure 11) is based on NFC-B technology specifications in NFCForum-TS-DigitalProtocol-1.0 and the ISO 14443-3 Specifications. The Type B frame format must always include the two CRC bytes.

When the initial RF collision is completed and no RF field has been detected (see Figure 7), the ISO control register must be configured as shown in Step 1 below. Step 2 must be used to send commands to the NFC-B/ISO14443B tag. For more information on the initial RF collision, see Section 3.

1. ISO Control Register (0x01) → 0x0C (ISO 14443B at 106 kbps, receive with CRC)
2. Send packet
   1. Reset FIFO (0x0F) direct command.
   2. Transmission (0x11) with CRC direct command.
   3. TX Length Byte 1 (0x1D) and TX Length Byte 2 (0x1E) registers.
   4. Write the command to the FIFO.

5.1.2.1 Selection for Type 4B Tags

After activation is finished for a Type 4B tag the ATTRIB command must be issued to finish the selection of the tag to exchange data with it. The ATTRIB command sends the tag information on timing requirements, framing specifications for RF communication and for data packets, supported communication bit rates, and the CID value assigned to the tag.

To determine the highest mutually supported bit rate between the tag and the reader/writer the tenth byte of the SENSB_RES is compared with the enabled reader/writer bit-rate setting. One of the bytes in the ATTRIB command is then set to tell the tag to operate at that bit rate. The possible bit rates are: 106 kbps, 212 kbps, 424 kbps, and 848 kbps.

The response to the ATTRIB (Answer to ATTRIB) is an acknowledgment that it received the ATTRIB command. Upon receiving the ATTRIB response, the firmware sets the ISO Control Register (0x01) with the correct settings to transmit data at the previously determined bit rate. Now the reader/writer and Type 4B tag can enter data exchange. For further detail on the format of the ATTRIB command, refer to the ISO14443-3 specification.

5.1.3 ISO18092 (Type 3 Tags)

The frame format for ISO18092 packets at 212 kbps and 424 kbps(see Figure 12) is based on NFC-F technology specifications in NFCForum-TS-DigitalProtocol-1.0 and the ISO 18092/JIS X 6319-4 specifications. The Type F frame format must always include the two CRC bytes.

When the initial RF collision is completed and no RF field has been detected (see Figure 7), the ISO control register must be configured as shown in Step 1 below. Step 2 must be used to send commands to the Type 3 tag. For more information on the initial RF collision, see Section 3.

1. ISO Control Register (0x01) → 0x1A (NFC-F at 212 kbps, receive with CRC)
   or
   ISO Control Register (0x01) → 0x1B (NFC-F at 424 kbps, receive with CRC).
2. Send packet
   1. Reset FIFO (0x0F) direct command.
   2. Transmission with CRC direct command (0x11).
   3. TX Length Byte 1 (0x1D) and TX Length Byte 2 (0x1E) registers.
   4. Write the command to the FIFO.

The example firmware selects the first Type 3 tag that replies within an allotted time slot. Refer to the ISO 18092/JIS X 6319-4 or NFCForum-TS-DigitalProtocol-1.0 document for further details on the tag selection process and time slots.

5.1.4 ISO15693 (Type 5 Tags)

The frame format for ISO15693 packets at 26.48 kbps(see Figure 13) is based on the ISO 15693-3 Specifications. The Type 5 frame format must always include the two CRC bytes.

When the initial RF collision is completed and no RF field has been detected (see Figure 7), the ISO control register must be configured as shown in Step 1 below. Step 2 must be used to send commands to the ISO15693 tag. For more information on the initial RF collision, see Section 3.

1. ISO Control Register (0x01) → 0x02 (ISO15693 at 26.48 kbps, one subcarrier, 1 out of 4, receive with CRC).
2. Send packet
   1. Reset FIFO (0x0F) direct command.
   2. Transmission with CRC direct command (0x11).
   3. TX Length Byte 1 (0x1D) and TX Length Byte 2 (0x1E) registers.
   4. Write the command to the FIFO.

The provided example firmware does not contain anticollision for NFC-V/ISO15693 tags, so only one tag can be read or written to at one time.

Upon reading the basic information of tag, the firmware determines the available memory size and if any special request flags must be used (such as extended protocol or option flags) based on the response to Get System Information commands (see Figure 14 for further details).

5.2 Tag Memory Format With NDEF Examples

The NFC Data Exchange Format (NDEF) specification is a data format standard for storing information on NFC tag platforms in messages. The composition of NDEF messages are determined by the various NFC Forum Record Type Definition (RTD) formats. Among the supported RTD formats are Text, Uniform Resource Identifier (URI), Smart Poster, V-Card, and MIME. The examples for the following sections focus on the NFC Forum Text RTD structure.

The method to detect and read/write NDEF contents vary between tag types, but one common factor is the requirement for basic information needed to read the contents of an NDEF formatted message. In most tags, this is called the Capability Container (CC) file. The exception to that is with Type 3 tags, which instead have an 'Attribute Information Block'. The information stored in these bytes is used to determine the mapping specification, data sizes, read and write access, and other parameters. According to the current specifications of each tag type, only after the CC (or Attribute Block) is read can the NDEF contents of a tag be read.

For most tag types, with Type 3 being the exception once again, information about NDEF messages are stored with Tag, Length, Value (TLV) bytes. The Tag field provides information on the format and the Length field indicates the length of the NDEF message. For Type 2 and Type 5 tags, the Value field is where the NDEF message itself is stored. For Type 4 tags, the Value field contains additional information about the NDEF message. Based on each NFC Forum tag specification, the TLV bytes may not be separate and must follow one another sequentially.

The following sections describe the basics of the memory layout, NDEF formatting, and Capability Container (or Attribute Block) for each tag type. For further details, review the NFC Forum specifications for each tag type. References for each specification can be found in Section 12.

5.2.1 Type 2 Tags