PN5180A0ET/C1QL - NXP SEMICONDUCTORS

1. Introduction

This document de scr ibes the fu nct i on ality an d electrical specification of the high-power

NFC IC PN5180.

Additional documents supporting a design-in of the PN5180 are available from NXP, this

information is not part of this document.

2. General description

PN5180, the best full NFC frontend on the market.

As a highly integrated high performance full NFC Forum-compliant fronte nd IC for

contactless communication at 13.56 MHz, this frontend IC utilizes an outstanding

modulation and demod ulation concept completely integrated for different kin ds of

contactless communication methods and protocols.

The PN5180 ensures maximum interoperability for next generation of NFC enabled

mobile phones. The PN5180 is optimized for point of sales terminal applications and

implements a high-power NFC frontend functionality which allows to achieve EMV

compliance on RF level without additional external active components.

The PN5180 frontend IC supports the following RF operating modes:

•Reader/Writer mode supporting ISO/IEC 14443-A up to 848 kBit/s, MIFARE

•Reader/Writer mode supporting ISO/IEC 14443-B up to 848 kBit/s

•Reader/Writer mode supporting JIS X 6319-4 (comparable with FeliCa scheme)

•Supports reading of all NFC tag types (type 1, type 2, type 3, type 4A and type 4B)

•Reader/Writer mode supporting ISO/IEC 15693

•Reader/Writer mode supporting ISO/IEC 18000 -3 Mode 3

•ISO/IEC 18092 (NFC-IP1)

•ISO/IEC 21481 (NFC-IP-2)

•ISO/IEC 14443-type A Card emulation up to 848 kBit/s

One host interface based on SPI is implemented:

•SPI interface with data rates up to 7 Mbit/s with MOSI, MISO, NSS and SCK signals

•Interrupt request line to inform host controller on events

•EEPROM configurable pull-up resistor on SPI MISO line

PN5180

High-performance multi-protocol full NFC Forum-compliant

frontend

Rev. 3.0 — 7 October 2016

240930 Product data sheet

COMPANY PUBLIC

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 2 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

•Busy line to indicate to host availability of data for reading

The PN5180 support s highly innovative and unique features which do not require any host

controller interaction. These unique features include Dynamic Power Control (DPC),

Adaptive Waveform Control (A WC), Adaptive Receiver Control (ARC), and fully automatic

EMD error handling. The inde pendency of real-time host controller interactions makes this

product the best ch oic e for syste m s which oper at e a pr ee m pt ive m ulti- tasking OS like

Linux or Android.

As new power-saving feature the PN5180 allows using a general-purpo se ou tp u t to

control an external LDO or DC/DC during Low-Power Card Detection. One

general-purpose output is used to wake-up an LDO or DC/DC fro m power-saving mode

before the RF field for an LPCD polling cycle is switched on.

The PN5180 supports an external silicon system-power-on switch by using the energy of

the RF field generated by an NFC phone to switch on the system , like it is generated

during the NFC polling loop. This unique and new Zero-Power-Wake-up feature allows

designing systems with a power consumption close to zero during standby.

3. Features and benefits

Transmitter current up to 250 mA

Dynamic Power Control (DPC) for optimized RF performance, even under detuned

antenna conditions

Adaptive W aveform Control ( AWC) au tomatically adjusts the tran smitter modulation for

RF compliancy

Adaptive Receiver Control (ARC) automatically adjusts the receiver parameters for

always reliable communication

Includes NXP ISO/IEC14443-A, Innovatron ISO/IEC14443-B and NXP MIFARE

Crypto 1 intellectual property licensing rights

Full compliancy with all standards relevant to NFC, contactless operation and EMVCo

Active load modulation suppor ts smaller antenna in Card Emulation Mode

Automatic EMD handling performed without host interaction relaxes the timing

requirements on the Host Controller

Low-power card detection (LPCD) minimizes current consumption during polling

Automatic support of system LDO or system DC/DC powe r-down mode during LPCD

Zero-Power-Wake-up

Small, industry-standard packages

NFC Cockpit: PC-based support tool for fast configuration of register settings

Development kit with 32-bit NXP LPC1769 MCU and antenna

NFC Reader Library with source code rea dy for EMVCo L1 and NFC Forum

compliance

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 3 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

4. Applications

Payment

Physical-access

eGov

Industrial

5. Quick reference data

6. Versions

Available firmware versions:

Version 3.4: Allows EMVCO 2.3.1 compliant EMD error handling

Version information:

•EEPROM address 0x12: 0x04

•EEPROM address 0x13: 0x03

Version 3.5: Allows EMVCO 2.5 compliant EMD error handling

Version information:

•EEPROM address 0x12: 0x05

•EEPROM address 0x13: 0x03

Changes of Version 2.5 compared to Version 2.4:

•The EMD_CONTROL register is updated to support EMVCo 2.5.

•Adaptive Waveform Control (AWC ) impl em ent ed

Table 1. Quick reference data

Symbol Parameter Conditions Min Typ Max Unit

VDD(VBAT) supply voltage on pin VBAT - 2.7 3.3 5.5 V

VDD(PVDD) supply voltage on pin PVDD 1.8 V supply 1.65 1.8 1.95 V

3.3 V supply 2.7 3.3 3.6 V

VDD(TVDD) supply voltage on pin TVDD - 2.7 5.0 5.5 V

Ipd power-down current VDD(TVDD) = VDD(PVDD)

=VDD(VDD) 3.0 V; hard

power-down; pin RESET_N

set LOW, Tamb = 25 °C

-10-A

Istb standby current Tamb = 25 °C - 15 - A

IDD(TVDD) supply current on pin TVDD - - 180 250 mA

Tamb ambient temperature in still air with exposed pins

soldered on a 4 layer

JEDEC PCB

30 +25 +85 °C

Tstg storage temperature no supply voltage applied 55 +25 +150 °C

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 4 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Version 3.6: Automatic Receiver Control added

No silicon initialized with this firmware is available. Usage of this firmware requires an

update by the user.

Version information:

•EEPROM address 0x12: 0x06

•EEPROM address 0x13: 0x03

Changes of Version 3.6 compared to Version 2.5:

•Accessible EEPROM top address is change d to 0xFE

•EEPROM functional assignment starting at address 0xD8

•EEPROM updates to support using GPO1 during LPCD card detect and GPIO2

during wake-up from standby

•Adaptive Receiver configuration (ARC) available: EEPROM table updates for receiver

configuration

•Energy of external RF field can be used to operate an external system-power-on

switch

7. Ordering information

Table 2. Ordering information

Type number Package

Name Description Version

PN5180A0HN/C1, 551 HVQFN40 Firmwa r e version 3.4. Plastic thermal enhanced very thin quad

flat package; no leads;

32 terminals + 1 central ground; body 6 x 6 x 1.0 mm; delivered

in one tray, bakable, MSL=3.

SOT618-1

PN5180A0HN/C1, 518 HVQFN40 Firmwa r e version 3.4. Plastic thermal enhanced very thin quad

flat package; no leads;

32 terminals + 1 central ground; body 6 x 6 x 1.0 mm; delivered

on reel MSL = 3.

SOT618-1

PN5180A0ET/C1, 151 TFBGA64 Firmware version 3.4. Plastic thin fine-pitch ball grid array

package; 64 balls, delivered in one tray, MSL = 1. SOT1336-1

PN5180A0ET/C1, 118 TFBGA64 Firmware version 3.4. Plastic thin fine-pitch ball grid array

package; 64 balls, delivered on reel, MSL = 1. SOT1336-1

PN5180A0HN/C2, 551 HVQFN40 Firmwa r e version 3.5. Plastic thermal enhanced very thin quad

flat package; no leads;

32 terminals + 1 central ground; body 6 x 6 x 1.0 mm; delivered

in one tray, bakable, MSL=3.

SOT618-1

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 5 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The PN5180 is not available with pre- installed firmware version 3.6.

8. Marking

PN5180A0HN/C2, 518 HVQFN40 Firmwa r e version 3.5. Plastic thermal enhanced very thin quad

flat package; no leads;

32 terminals + 1 central ground; body 6 x 6 x 1.0 mm; delivered

on reel MSL = 3.

SOT618-1

PN5180A0ET/C2, 151 TFBGA64 Firmware version 3.5. Plastic thin fine-pitch ball grid array

package; 64 balls, delivered in one tray, MSL = 1. SOT1336-1

PN5180A0ET/C2, 118 TFBGA64 Firmware version 3.5. Plastic thin fine-pitch ball grid array

package; 64 balls, delivered on reel, MSL = 1. SOT1336-1

Table 2. Ordering information

Type number Package

Name Description Version

Table 3. Marking codes HVQFN40

Type number Marking code

PN5180 (first Engineering prototypes)

Line A: These de vi ce s are inte nd e d fo r

prototype development only, PN51800 or PN5180A

Line B1: “01... 01” or 6 characters: Diffusion Batch ID and

assembly sequence ID

Line B2: “FW 1.1” or ”Z.1 01”

Line C: Engineering prototypes are marked

“Product life cycle status code Before CQS”: X 8 characters: diffusion and assembly location,

date code, product version (indicated by mask

version), product life cycle status. This line

includes the following elements at 8 positions:

1. Diffusion center code

2. Assembly center code

3. RHF-2006 indicator

4. Year code (Y) 1)

5. Week code (W) 2)

6. Week code (W) 2)

7. Mask layout version

8. (Product life cycle status code Before CQS) X

PN5180 (devices are customer qualification

samples)

Line A: PN5180A

Line B1: 6 characters: Diffusion Batch ID and assembly

sequence ID

Line B2: blank

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 6 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Note that the Firmware of the product PN5180 can be updated. Due to the update

capability, the marking of the package does not allow identifying the installed version of

the actual programmed firmware. The firmware version can be retrieved from address

0x12 in EEPROM.

Line C: Customer qualification samples are

marked as CQS: X or Y 8 characters: diffusion and assembly location,

date code, product version (indicated by mask

version), product life cycle status. This line

includes the following elements at 8 positions:

1. Diffusion center code

2. Assembly center code

3. RHF-2006 indicator

4. Year code (Y) 1)

5. Week code (W) 2)

6. Week code (W) 2)

7. Mask layout version

8. (Product life cycle status code CQS): X or Y

PN5180A0HN This product is released for sale

(volume production).

Line A: PN5180A

Line B: 6 characters: Diffusion Batch ID and assembly

sequence ID

Line C: Release for sale products do not show

any X or Y, instead position 8 is left blank 8 characters: diffusion and assembly location,

date code, product version (indicated by mask

version), product life cycle status. This line

includes the following elements at 8 positions:

1. Diffusion center code

2. Assembly center code

3. RHF-2006 indicator

4. Year code (Y) 1)

5. Week code (W) 2)

6. Week code (W) 2)

7. Mask layout version

8. (Product life cycle status release for sale):

blank

Table 3. Marking codes …continuedHVQFN40

Type number Marking code

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 7 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

8.1 Package marking drawing

The Marking of the TFBGA version can be found in the data sheet addendum which is

available thro ug h th e NXP Doc Store.

9. Block diagram

Fig 1. Marking PN5180 in HVQFN40

Terminal 1 index area

A :7

B1 : 6

aaa-007965

B2 : 6

C : 8

Fig 2. PN5180 Block diagram

aaa-023610

VOLTAGE

REGULATOR

DIGITAL

PROCESSING

ANALOG

PROCESSING

HOST INTERFACE

TRANSMITTER

RXN

AVSSDVSSPVSS

VMID

RXP

TVSS

TX2

TX1

NSS

SCK

MISO

MOSI

VBAT

PVDD

BUSY

IRQ

RESET_N

GPO

AVDD

DVDD

RECEIVER

SYSTEM

CLOCK

DEBUG

INTERFACE

VDD

1.8 V

CLK1 CLK2 AUX1 AUX2

VSS

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 8 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

10. Pinning information

10.1 Pin description

Fig 3. Pin configuration for HVQF N40 (SOT618-1)

aaa-024663

PN5180

TX1

VSS

RESET_N

TVDD

BUSY ANT1

SCK ANT2

PVDD VDHF

MISO VBAT

PVSS VSS

MOSI AVDD

UX2/DWL_REQ VDD

NSS DVDD

n.c.

VBAT

n.c.

RXN

RXP

VMID

TX2

TVSS

n.c.

AUX1

IRQ

GPO1

CLK2

CLK1

n.c.

10 21

922

823

724

625

526

427

328

229

130

terminal 1

index area

Transparent top view

Table 4. Pin description HVQFN40

Symbol Pin Type Description

NSS 1 I SPI NSS

AUX2

/DWL_REQ 2 I/O Analog test bus or Download re quest

MOSI 3 I SPI MOSI

PVSS 4 supply Pad ground

MISO 5 O SPI MISO

PVDD 6 supply Pad supply voltage

SCK 7 I SPI Clock

BUSY 8 O Busy signal

VSS 9 supply Ground

RESET_N 10 I RESET, Low active

n.c. 11 - leave unconnected, do not ground

VBAT 12 supply Supply Connection, all VBAT mandatory to be connected

VBAT 13 supply Supply Connection, all VBAT mandatory to be connected

n.c. 14 - leave unconnected, do not ground

RXN 15 I Receiver Input

RXP 16 I Receiver Input

VMID 17 supply S tabilizing capacitor connection output

TX2 18 O Antenna driver output 2

TVSS 19 supply Antenna driver ground

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 9 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The pinning of the TFBGA version can be found in the data sheet addendum which is

available thro ug h th e NXP Doc Store.

n.c. 20 - leave unconnected, do not ground

TX1 21 O Antenna driver output 1

TVDD 22 supply Antenna driver supply

ANT1 23 I Antenna connection 1 for load modulation in card emulation

mode (only in case of PLM)

ANT2 24 I Antenna connection 2 for load modulation in card emulation

mode (only in case of PLM)

VDHF 25 supply Stabilizing capacitor connection output

VBAT 26 supply Supply Connection, all VBAT mandatory to be connected

VSS 27 supply Ground

AVDD 28 supply Analog VDD supply voltage input (1.8 V), connected to VDD

VDD 29 supply VDD output (1.8 V)

DVDD 30 supply Digital supply voltage input (1.8 V), connected to VDD

n.c. 31 - leave unconnected, do not ground

n.c. 32 - leave unconnected, do not ground

n.c. 33 - leave unconnected, do not ground

n.c. 34 - leave unconnected, do not ground

n.c. 35 - leave unconnected, do not ground

CLK1 36 I Clock input for crystal. This pin is also used as input for an

external generated accurate clock (8 MHz, 12 MHz, 16 MHz,

24 MHz, other clock frequencies not supported)

CLK2 37 O Clock output (amplifier inverted signal output) for crystal

GPO1 38 O (double function pin) GPO1, Digital output 1

IRQ 39 O Interrupt request output, active level configurable

AUX1 40 O Analog/Digital Test signal

Table 4. Pin description HVQFN40 …continued

Symbol Pin Type Description

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 10 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11. Functional description

11.1 Introduction

The PN5180 is a High-Power NFC frontend. It implements the RF functionality like an

antenna driving and receiver circuitry and all the low-level functionality to realize an NFC

Forum-compliant reader. The PN5180 connects to a host microcontroller with a SPI

interface for configuration, NFC data exchange and high-level NFC protocol

implementation.

The PN5180 allows different supply voltages for NFC drivers, internal supply and host

interface providing a maximum of flexibility.

The chip supply voltage and the NFC driver voltage can be chosen independently from

each other.

The PN5180 uses an external 27.12 MHz crystal as clock source for generating the RF

field and its internal digital logic. In addition, an internal PLL allows using an accurate

external clock source of either 8, 12, 16, 24 MHz. This saves the 27.12 MHz crystal in

systems which implement one of the mentioned clock frequencies (e.g. for USB or system

clock).

Two types of memory are implemented in the PN5180: RAM and EEPROM.

Internal registers of the PN5180 state machine store configuration dat a. The internal

registers are reset to initia l values in case of PowerON, and Hardware-reset and standby.

The RF configuration for dedicated RF protocols is defined by EEPROM data which is

copied by a command issued from the host microcontroller - LOAD_RF_CONFIG- into the

registers of the PN5180. The PN5180 is initialized with EEPROM data for the

LOAD_RF_CONFIG command which has been tested to work well for one typical

antenna. For customer-specific antenna sizes and dedicated antenna environment

conditions like metal or ferrite, the pre-defined EEPROM settings can be modified by the

user. This allows users to achieve the maximum RF performance from a given antenna

design. It is mandatory to use the command LOAD_RF_CONFIG for the selection of a

specific RF protocol.

The command LOAD_RF_CONFIG initializes the registers faster compared to individual

11.2 Power-up and Clock

11.2.1 Power Management Unit

11.2.1.1 Supply Connections and Power-up

The Power Management Unit of the PN5180 generates internal supplies required for

operation.

The following pins are used to supply the IC:

•PVDD - supply voltage for the SPI interface and control connections

•VBAT - Supply Voltage input

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 11 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

•TVDD - Transmitter supply

•AVDD - Analog supply input, connected to VDD

•DVDD - Digital supply input, conn ected to VDD

•VDD - 1.8 V output, to be connected to AVDD and DVDD

Decoupling capacitors shall be placed as close as possible to the pins of the package.

Any additional filterin g/damping of the transmitter supply, e.g. by ferrite beads, might have

an impact on the analog RF signal quality and shall be monitored carefully.

Power-up sequence of the PN5180

•First ramp VBAT, PVDD can immediately follow, latest 2 ms after VBAT reaches 1.8 V.

•There is no timing dependency on TVDD, only that TVDD shall rise equal or later to

VBAT.

•VBAT must be equal or higher than PVDD

•TVDD has no other relationship to VBAT or PVDD

After power-up, the PN5180 is indicating the ability to receive command from a host

microcontroller by an IDLE IRQ.

There are configurations in EEPROM, which allow to specify the behavior of the PN5180

after start-up. LPCD (Low-power card detection) and DPC (dynamic power control) are

functionalities which are configurable in EEPROM.

11.2.1.2 Power-down

A hard power-down is enabled with LOW level on pin RESET_N. This low level puts the

internal voltage regulators for the analog and digital core supply as well as the oscillator in

a low-power state. All digital input buf fe rs are separated from the input pads a nd cla mped

Fig 4. Power-up voltages

aaa-020676

1.8 V

max Δ2ms

PVDD

time

VBAT

voltage

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 12 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

internally (except pin RESET_N itself). IRQ, BUSY, AUX1, AUX2 have an internal pull

down resistor which is activated on RESET_N ==0. All other output pins are switched to

high impedance.

To leave the power-down mode, the level at the pin RESET_N has to be set to HIGH. This

high level st arts the internal start- up sequence from Power- Down.

11.2.1.3 Standby

The standby mode is entered immediately after sending the instruction SWITCH_MODE

with standby command. All internal current sinks are set to low-power state.

In opposition to the power-down mode, the digit al input buffers are not sepa rated by the

input pads and keep their functionality. The digital output pins do not change their state.

During standby mode, all registers values, the buffer content and the configuration itself

are not kept, exceptions are the registers with addresses 05h(PADCONFIG_REG),

07h(PADOUT_REG) 25h (TEMP_CONTROL). To leave the standby mode, various

possibilities do exist. The conditions for wake-up are configured in the register

STBY_CFG_REG.

•Wake-up via Timer

•Wa ke-up via RF level detector

•Low Level on RESET_N

•PVDD disappears

Any host communication (data is not validated) triggers the internal start-up sequence.

The reader IC is in ope ration mode when the in ternal star t-up sequence is finalize d, and is

indicating this by an IDLE IRQ.

11.2.1.4 Temperature Sensor

The PN5180 implements a configurable temperature sensor. The temperature sensor is

configurab le by th e TEMP_CONTROL register (25h ).

The Temperature Sensor supports temperature settings for 85 °C, 115 °C, 125 °C and

135 °C.

In case the sensed device temperature is higher than configured, a TEMPSENS_ERROR

IRQ is raised. In case of an TEMPSENS_ERROR, the Firmware is switching off the RF

Field. Additionally host can set the device into standby.

11.2.2 Reset and start-up time

A constant low level of at least 10 s at the RESET_N pin starts the internal reset

procedure.

When the PN5180 has finished the start_up, a IDLE_IRQ is raised and the IC is ready to

receive commands on the host interface.

11.2.3 Clock concept

The PN5180 is supplied by an 27.12 MHz crystal for operation. In addition, the internal

PLL uses an accurate external clock source of either 8, 12, 16, 24 MHz instead of the

crystal.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 13 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The clock applied to the PN5180 provides a time basis for the RF encoder and decoder.

The stability of the clock frequency, is an important factor for correct operation. To obtain

optimum performance, clock jitter must be reduced as much as possible. Optimum

performance is best achieved using the internal oscillator buffer with the recommended

circuitry.

In card emulation mode, the clock is also required.

If an external clock source of 27.12 MHz is used instead o f a crystal, the clock signal must

be applied to pin CLK1. In this case, special care must be taken with the clock duty cycle

and clock jitter (see Table 127).

The crystal is a component which is impacting the overall performance of the system. A

high-quality co mponent is recommended here. The resistor RD1 reduces the st art-up time

of the crystal. A short start-up time is especially desired in case the Low-Power card

detection is used. The values of these resistors depend on the crystal which is used.

11.3 Timer and Interrupt system

11 .3.1 General Purpose Timer

The Timers are used to measure certain intervals between certain configurable events of

the receiver, transmitter and other RF-events. The timer signals its expiration by raising a

flag and the value of the timer may be accessed via the register-set.

Three general-pu rp ose timer s T0, T1, an d T2 ru nnin g with th e PN51 80 clock with seve ra l

start condition s, stop conditions, time resolutions, and maximal timer periods are

implemented.

For automatic timeout handling during MIFARE Authentication Timer2 is blocked during

this operation.

In case EMVCo EMD handling is enabled (EMD_CONTROL register (a ddress 0028h) , bit

EMD_ENABLE) Timer1 is automatically restarted when an EMD event occurs.

Fig 5. Connection of crystal

aaa-020196

CLK1 CLK2

RD1

CL1 CL1

crystal

PN5180

VSS

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 14 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Timers T0 to T2 has a resolution of 20 bits and may be operated at clock frequencies

derived from the 13.56 MHz system clock. Several start events can be configured: start

now , st art on external RF-field on/of f and start on Rx (receive)/Tx (transmit) started/ended.

The timers allow reload of the counter value. At expiration of the timers, a flag is raised

and an IRQ is triggered.

The clock may be divided by a prescaler for frequencies of:

•6.78 MHz

•3.39 MHz

•1.70 MHz

•848 kHz

•424 kHz

•212 kHz

•106 kHz

•53 kHz

11.3.2 Interrupt System

11.3.2.1 IRQ PIN

The IRQ_ENABLE_REG configures, which of the interrupts are routed to the IRQ pin of

the PN5180. All of the interrupts can be enabled and disabled independent from each

other. The IRQ on the pin can either be cleared by writing to the IRQ_SET_CLEAR

enabled IRQ’s are cleared, the IRQ pin remains active.

The polarity of the external IRQ signal is configured by EEPROM in IRQ_PIN_CONFIG

(01Ah).

11.3.2.2 IRQ_STATUS Register

The IRQ_STATUS register contains the status flags. The status flags cannot be disabled.

Status Flag can either be cleared by writing to the IRQ_SET_CLEAR register or when the

IRQ_STATUS register is read (EEPROM configuration)

The PN5180 indicates certain events by setting bits in the register

GENERAL_IRQ_STATUS_REG and additionally, if activated, on the pin IRQ.

LPCD_IRQ, GENERAL_ERROR_IRQ and HV_ERROR_IRQ are non-maskable

interrupts.

11.4 SPI Host Interface

The following description of the SPI host interface is valid for the NFC operation mode.

The Secure Firmware Download mode uses a different physical host interface handling.

Details are described in chapter 12.

11.4.1 Physical Host Interface

The interface of the PN5180 to a host microcontroller is based on a SPI interface,

extended by signal line BUSY. The maximum SPI speed is 7 Mbps and fixe d to CPOL = 0

and CPHA = 0. Only a half-du p lex da ta tran sfer is supported. There is no chaining

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 15 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

allowed, meaning that the whole instruction has to be sent or the whole receive buf fer has

to be read out. The whole transmit b uffer shall be written at once as well. No NSS

assertion is allowed during data transfer.

As the MISO line is per default high-ohmic in case of NSS high, an internal pull-up resistor

can be enabled via EEPROM.

The BUSY signal is used to indicate that the PN5180 is not able to send or receive data

over the SPI interface.

The host interface is designed to support the typica l interface supply volt ages of 1.8 V and

3.3 V of CPUs. A dedicated supply input which defines the host interface supply voltage

independent from other supplies is available (PVDD). Only a voltage of 1.8 V or 3.3 V is

supported, but no voltage in the range of 1.95 V to 2.7 V.

•Master In Slave Out (MISO)

The MISO line is configured as an outpu t in a slave device. It is used to transfer data from

the slave to the master, with the most significant bit sent first. The MISO signal is put into

3-state mode when NSS is high.

•Master Out Slave In (MOSI)

The MOSI line is configur e d as an inpu t in a slav e de vice . It is use d to tran sf er data from

the master to a slave, with the most significant bit sent first.

•Serial Clock (SCK)

The serial clock is used to synchronize data movement both in and out of the device

through its MOSI and MISO lines.

•Not Slave Select (NSS)

The slave select input (NSS) line is used to select a slave device. It shall be set to low

before any dat a transaction starts and must stay low during the transaction.

•Busy

During frame reception, the BUSY line goes ACTIVE and goes to IDLE when PN5180 is

able to receive a new frame or data is available (d epending if SET or GET frame is

issued). If there is a parameter error, the IRQ is set to ACTIVE and a

GENERAL_ERROR_IRQ is set.

Both master and slave devices must operate with the same timing. The master device

always places data on the MOSI line a half cycle before the clock edge SCK, in order for

the slave device to lat ch the da ta.

The BUSY line is used to indicate that the system is BUSY and cannot receive any data

from a host. Recommendation for the BUSY line han dling by the host:

1. Assert NSS to Low

2. Perform Data Exchange

3. Wait until BUSY is high

4. Deassert NSS

5. Wait until BUSY is low

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 16 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

In order to write data to or read data from the PN5180, “dummy reads” shall be performed.

The Figure 8 and Figure 9 are illustrating the usage of this “dummy reads” on the SPI

interface.

11.4.2 Timing Specification SPI

The timing condition for SPI interface is as follows:

Fig 6. Read RX of SPI data using BUSY line

Fig 7. Writing data to the PN5180

Fig 8. Reading data from the PN5180

aaa-011438

Set_Reg

MOSI

MISO

BUSY (idle low)

Get_Reg

FF (data ignored)

Rsp Get_Reg

aaa-018979

SET instruction SET instruction

0xFF...

Host TX

Host RX

BUSY

0xFF...

aaa-018980

GET instruction ignored

0xFF...

Host TX

Host RX

BUSY

Response of GET instruction

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 17 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Remark: To send more bytes in one data stream, the NSS signal must be LOW during th e

send process. To send more than one data stream, the NSS signal must be HIGH

between each data stream. Any data available to be read from the SPI interface is

indicated by the BUSY signal de-asserted.

11.4.3 Logical Host Interface

11.4.3.1 Host Interface Command

A Host Interface Command consist s o f either 1 or 2 SPI frames depending whether the

host wants to write or read dat a from the PN5180. An SPI Frame consists of multiple

bytes.

The protocol used betwe en the host and the PN5180 uses 1 byte indicating the instru ction

code and additional bytes for the payload (instruction-specific data). The actual payload

size depends on the instruction used. The mi nimum length of the p ayload is 1 byte. This

provides a constant offset at which message data begins.

All commands are packed into one SPI Frame. An SPI Frame consists of multiple bytes.

No NSS toggles allowed during sending of an SPI frame.

For all 4 byte command parameter transfers (e.g. register values), the payload

parameters passed follow the little endian approach (Least Significant Byte first).

Fig 9. Connection to host with SPI

aaa-016093

tSCKL

tNSSH tSCKH tSCKL

tsu(D-SCKH) th(SCKH-D)

th(SCKL-Q)

t(SCKL-NSSH)

SCK

MOSI

MISO

MSB

LSB

NSS

Fig 10. Instruction Payload

aaa-023432

lnstruction Payload 1 Payload N

Byte 1 Byte 2 Byte N

- Size of payload depends on Instruction

- Minimum payload is 1 byte

......

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 18 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Direct Instructions are built of a command code (1 Byte) and the instruction parameters

(max. 260 bytes). The actual payload size depends on the instruction used.

Responses to direct instructions contain only a p ayload field (no header). All instructions

are bound to conditions. If at least one of the conditions is not fulfilled, an exception is

raised.

In case of an exception, the IRQ line of PN5180 is asserted an d co rr es po nd in g inte r ru pt

status register con tain information on the exception.

11.4.3.2 Transmission Buffer

Two buffers are implemented in the PN5180. The transmission buffer has a buffer size of

260 bytes, the reception buffer has a size of 508 bytes. Both memories buffer the input

and output data streams between th e host and the internal state machine / contactless

UART of the PN5180. Thus, it is possible to handle data stream s with lengths of up to

260 bytes for transmission and up to 508 bytes for reception without taking timing

constraints into account.

11.4.3.3 Host Interface Command L ist

Fig 11. Instruction Response

aaa-023431

Payload 1 Payload 2 Payload N

Byte 1 Byte 2 Byte N

......

Table 5. 1-Byte Direct Commands an d Direct Command Codes

Command Command

code Description

WRITE_REGISTER 0x00 Write one 32bit register value

WRITE_REGISTER_OR_MASK 0x01 Sets one 32bit register value using a 32 bit OR mask

WRITE_REGISTER_AND_MASK 0x02 Sets one 32bit register value usin g a 32 bi t AN D ma sk

WRITE_REGISTER_MULTIPLE 0x03 Processes an array of register addresses in random order and performs

the defined action on these addresses.

READ_REGISTER 0x04 Reads one 32bit register value

READ_REGISTER_MULTIPLE 0x05 Reads from an array of max.18 register addresses in random order

WRITE_EEPROM 0x06 Processes an array of EEPROM addresses in random order and writes

the value to these addresses

READ_EEPROM 0x07 Processes an array of EEPROM addresses from a start address and

reads the values from these addresses

WRITE_TX_DATA 0x08 This instruction is used to write data into the transmission buffer

SEND_DATA 0x09 This instruction is used to write data into the transmission buffer, the

START_SEND bit is automatically set.

READ_DATA 0x0A This instruction is used to read data from reception buffer, after

successful reception.

SWITCH_MODE 0x0B This instruction is used to switch the mode. It is only possible to switch

from NormalMode to standby, LPCD or Autocoll.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 19 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The following direct instructions are support ed on the Ho st Interface: Detail Description of

the instruction.

WRITE_REGISTER

Description:

This command is used to write a 32-bit value (little endian) to a configuration register.

Condition:

The address of the register must exist. If the condition is not fulfilled, an exception is

raised.

MIFARE_AUTHENTICATE 0x0C This instruction is used to perform a MIFARE Classic Authentication on

an activated card.

EPC_INVENTORY 0x0D This instruction is used to perform an inventory of ISO18000-3M3 tags.

EPC_RESUME_INVENTORY 0x0E This instruction is used to resume the inventory alg orithm in case it is

paused.

EPC_RETRIEVE_INVENTORY_R

ESULT_SIZE 0x0F This instruction is used to retrieve the size of the inventory result.

EPC_RETRIEVE_INVENTORY_R

ESULT 0x10 This instru ction is used to retrieve the result of a preced ing

EPC_INVENTORY or EPC_RESUME_INVENTORY instruction.

LOAD_RF_CONFIG 0x11 This instruction is used to load the RF configuration from EEPROM into

the configuration registers.

UPDATE_RF_CONFIG 0x12 This instruction is used to upda te the RF configuration within EEPROM.

RETRIEVE_RF_CONFIG_SIZE 0x13 This instruction is used to retrieve the number of registers for a selected

RF configuration

RETRIEVE_RF_CONFIG 0x14 This instruction is used to read out an RF configuration. The register

address-value-pairs are available in the response

RF_ON 0x16 This instruction switch on the RF Field

RF_OFF 0x17 This instruction switch off the RF Field

ENABLE_TESTBUS_DIGITAL 0x18 Enables the Digital test bus

ENABLE_TESTBUS_ANALOG 0x19 Enables the Analog test bus

Table 5. 1-Byte Direct Commands an d Direct Command Codes

Command Command

code Description

Table 6. WRITE_REGISTER

Payload Length

(byte) Value/Description

Command code 1 0x00

Parameter 1 Register address

4 Register content

Response - -

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 20 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

WRITE_REGISTER_OR_MASK

Description:

This command modifies the content of a register using a logical OR operation. The

content of the register is read and a logical OR operation is performed with the provided

mask. The modified content is written back to the register.

Condition:

The address of the register must exist. If the condition is not fulfilled, an exception is

raised.

WRITE _REGISTER_AND_MASK

Description:

This command modifies the content of a register using a logical AND operation. The

content of the register is read and a logical AND oper ation is performe d with the prov ided

mask. The modified content is written back to the register.

Condition:

The address of the register must exist. If the condition is not fulfilled, an exception is

raised.

WRITE_REGISTER_MULTIPLE

Table 7. WRITE_REGISTER

Payload Length

(byte) Value/Description

Command code 1 0x01

Parameter 1 Register address

4 OR_MASK

Response - -

Table 8. WRITE_REGISTER_AND_MAKSK

Payload Length

(byte) Value/Description

Command code 1 0x02

Parameter 1 Register address

4AND_MASK

Response - -

Table 9. WRITE_REGISTER_MULTIPLE

Payload Length

(byte) Value/Description

Command code 1 0x03

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 21 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Description:

This instruction allows processing actions on multiple addresses with a single command.

Input parameter is an array of register addresses, actions, and values (little endian). The

command processes this array, register addresses are allowed to be in random order. For

each address, an individual ACTION can be defined.

Parameter value is either the REGISTER_DATA, the OR MASK or the AND_MASK.

ACTION that can be def ine d ind ivi dually for each register address:

•0x01 WRITE_REGISTER

•0x02 WRITE_REGISTER_OR_MASK

•0x03 WRITE_REGISTER_AND_MASK

Note: In case of an exception, the operation is not rolled-back, i.e. registers which have

been modified until exception occurs remain in modified state. Host has to take proper

actions to recover to a defin ed state.

Parameter 5...210 Array of up to 42 elements {address, action, content}

1 byte Register address

1 byte Action

4 bytes Register content

Response - -

Table 9. WRITE_REGISTER_MULTIPLE

Payload Length

(byte) Value/Description

Fig 12. Write_Register_Multiple

aaa-023442

Command:

0x03

Byte 1

Write Multiple Registers:

address

Byte 2

WRITE_REGISTER:

0x01

Byte 3

content

Byte 4

LSB MSB

....

content

Byte 5

content

Byte 6

content

Byte 7

Fig 13. WRITE_REGISTER_OR_MASK

aaa-024843

Command:

0x03

Byte 1

Modifying Multiple Registers with OR mask:

address

Byte 2

WRITE_REGISTER:

_OR_MASK:

0x02

Byte 3

MASK

Byte 4

LSB MSB

....

MASK

Byte 5

MASK

Byte 6

MASK

Byte 7

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 22 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Condition:

The address of the registers must exist. If the condition is not fulfilled, an exception is

raised.

READ_REGISTER

Description:

This command is used to read the content of a configuration register. The content of the

Condition:

The address of the register must exist. If the condition is not fulfilled, an exception is

raised.

READ_REGISTER_MULTIPLE

Description:

Fig 14. WRITE_REGISTER_AND_MASK

aaa-024844

Command:

0x03

Byte 1

Modifying Multiple Registers with AND mask:

address

Byte 2

WRITE_REGISTER:

_AND_MASK:

0x03

Byte 3

MASK

Byte 4

LSB MSB

....

MASK

Byte 5

MASK

Byte 6

MASK

Byte 7

Table 10. READ_REGISTER

Payload Length

(byte) Value/Description

Command code 1 0x04

Parameter 1 Register address

Response 4 Register content

Table 11. READ_REGISTER_MULTIPLE

Payload Length

(byte) Value/Description

Command code 1 0x05

Parameter 1..18 Array of up to 18 elements {Register address}

1 byte Register address

Response 4..72 Array of up to 18 4-byte elements {Register content}

4..72

byte Register content: n*4-Byte (32-bit) register data

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 23 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

This command is used to read up to 18 configuration registers at once. The addresses are

allowed to be in random order. The result (data of each register) is provided in the

response to the command. Only the register values are included in the response. The

order of the register contents within the response corresponds to the order of the register

addresses within the command parameter.

Condition:

The address of the register must exist. The size of ‘Register Address’ array must be in the

range from 1 – 18, inclusive. If the condition is not fulfilled, an exception is raised.

WRITE_EEPROM

Description:

This command is used to write up to 255 bytes to the EEPROM. The field ‘EEPROM

content’ contains the data to be written to EEPROM starting at the address given by byte

‘EEPROM Address’. The data is written in sequential order.

Condition:

The EEPROM Address field must be in the ra nge from 0 – 254, inclusive. The number of

bytes within ‘Values’ field must be in the range from 1 – 255, inclusive. If the condition is

not fulfilled, an exception is raised.

READ_EEPROM

Description:

Table 12. WRITE_EEPROM

Payload length

(byte) Value/Description

Command code 1 0x06

Parameter 1 Address in EEPROM from which write operation starts {EEPROM

Address}

1..255 Array of up to 255 elements {EEPROM content}

1 byte EEPROM content

Response - -

Table 13. READ_EEPROM

Payload Length

(byte) Value/Description

Command code 1 0x07

Parameter 1 Address in EEPROM from which read operation s tarts (EEPROM

Address)

1 Number of bytes to read from EEPROM

Response 1..255 Array of up to 255 elements {EEPROM content}

1 byte EEPROM content

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 24 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

This command is used to read data from EEPROM memory area. The field 'Address”

indicates the sta rt address of the read operation. The field Leng th indicates the number of

bytes to read. The response contains the data read from EEPROM (content of the

EEPROM); The data is read in sequentially increasing order starting with the given

address.

Condition:

EEPROM Address must be in the range from 0 to 254, inclusive. Read operation must not

go beyond EEPROM address 254. If the condition is not fulfilled, an exception is raised.

WRITE_DATA

Description:

This command is used to write dat a into the RF transmission buff er. The size of this buf fer

is 260 bytes. After this instruction has been executed, an RF transmission can be started

by configuring the corresponding regi sters.

Condition:

The number of bytes within the ‘Tx Data’ field must be in the range from 1 to 260,

inclusive. The command must not be called during an ongoing RF transmission. If the

condition is not fulfilled, an exception is raised.

SEND_DATA

Description:

This command writes data to the RF transmission buffer and starts the RF transmission.

The para meter ‘Number of valid bits in last Byte’ indicates the exact number of bits to be

transmitted for the last byte (for non-byte aligned frames).

Table 14. WRITE_DATA

Payload Length

(byte) Value/Description

Command code 1 0x08

Parameter 1..260 Array of up to 260 bytes {Transmit data}

1 byte Transmit data: Data written into the transmit buffer

Response - -

Table 15. SEND_DATA

Payload Length

(byte) Value/Description

Command code 1 0x09

Parameter 1 Number of valid bits in last Byte

1...260 Array of up to 260 elements {Transmit data}

1 byte Transmit data

Response - -

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 25 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Precondition: Host shall configure the Transceiver by setting the register

SYSTEM_CONFIG.COMMAND to 0x3 before using the SEND_DATA command, as the

command SEND_DATA is only writing data to the transmission buffer and starts the

transmission but does not perform any configuration.

Note: When the command terminates, the transmission might still be ongoing, i.e. the

command starts the tr ansmission but does not wait for the end of transmission.

Condition:

The size of ‘Tx Data’ field must be in the range from 0 to 260, inclusive (the 0 byte length

allows a symbol only transmission when the TX_DATA_ENABLE is cleared).‘Number of

valid bits in last Byte’ field must be in the range from 0 to 7. The command must not be

called during an ongoing RF transmission. Transceiver must be in ‘WaitTransmit’ state

with ‘Transceive’ command set. If the condition is not fulfilled, an exception is raised.

READ_DATA

Description:

This command reads data from the RF reception buffer, after a successful reception. The

RX_STATUS register contains the information to verify if the reception had been

successful. The data is available within the response of the command. The host controls

the number of byte s to be read via the SPI interface.

Condition:

The RF data had been successfully received. In case the instruction is executed without

preceding an RF data reception, no exception is raised but the data read back from the

reception buffer is invalid. If the condition is not fulfilled, an exception is raised.

SWITCH_MODE

Table 16. Coding of ‘val id bi ts in last byte’

Number/Parameter Functionality

0All bits of last byte are transmitted

1-7 Number of bits within last byte to be transmitted.

Table 17. READ_DATA

Payload Length

(byte) Value/Description

Command code 1 0x0A

Parameter 1 x00

Response 1...508 Array of up to 508 elements {Receive data}

1 byte Receive data: data which had been received during last

successful RF reception

Table 18. SWITCH_MODE

Payload Length

(byte) Value/Description

Command code 1 0x0B

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 26 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Description:

This instruction is used to switch the mode. It is only possible to switch from normal mode

to Standby, LPCD or Autocoll mode. Switching back to normal mo de is not possib le u sing

this instruction. The modes Standby, LPCD and Autocoll terminate on specific conditions.

Once a configured mode (Standby, LPCD, Autocoll) terminates, normal mode is entered

again.

To force an exit from Standby, LPCD or Autocoll mode to no rmal mode, the host con troller

has to reset the PN5180.

Condition:

Parameter ‘mode’ has to be in the range from 0 to– 2, inclusive. Dependent on the

selected mode, different parameters have to be passed:

In case parameter ‘mode’ is set to 0 (Standby):

Field ‘Wake-up Control’ must contain a bit mask indicating the enabled wake-up so urces

and if GPO shall be toggled. Field ‘Wake-up Counter Value’ must contain the value used

for the wake-up counter (= time PN5180 remains in standby). The value shall be in the

range from 1 – 2690, inclusive.

The field has to be present, even if wake-up counter is not defined as wake-up source. In

this case, the field ‘wake-up Counter value’ is ignored. No instructio ns must be sent while

being in this mode. Termination is indicated using an interrupt.

In case parameter ‘mode’ is set to 1 (LPCD):

Parameter 1 Mode

1...n Array of ‘n’ elements {Mode parameter}

1 byte Mode parameter: Number of total bytes depends on

selected mode

Return value - -

Table 19. Standby configuration

Parameter Length (byte) Value/Description

Wake-up Control 1 Bit mask controlling the wake-up source to be

used and GPO handling.

Wake-up Counter Value 2 Used value for wake-up counter in msec s.

Maximum supported value is 2690

Table 20. Standby wake-up counter configu ration

b7 b6 b5 b4 b3 b2 b1 b1

000000 RFU

X Wake-up on external RF field, if bit is set to

1b.

X Wake-up on wake-up counter expires, if bit is

set to 1b.

Table 18. SWITCH_MODE

Payload Length

(byte) Value/Description

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 27 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Field ‘Wake-up Counter Va lue’ () defines the period between two LPCD attempts (=time

PN5180 remains in standby) as has to be in the ra nge from 1 to 2690, inclusive. No

instructions must be sent while being in this mode. Termination is indicated using an

interrupt.

In case field ‘Mode’ is set to 2 (Autocoll):

Field ‘RF Technologies’ must cont ain a bit mask ind icating the RF Technologies to support

during Autocoll, according to Field ‘Autocoll Mode’ must be in the range from 0 to 2,

inclusive. No instructions must be sent while being in this mode. Termination is indicated

using an interrupt.

Table 21. LPCD w ake-up counter configura tion

Parameter Length (bytes) Value/Description

Wake-up Counter Value 2 Used value for wake-up counter in msecs.

Maximum supported value is 2690.

Table 22. Autocoll wake-up counte r configuration

Parameter Length (bytes) Value/Description

Wake-up Counter Value 2 Used value for wake-up counter in msecs.

Maximum supported value is 2690.

Table 23. Autocoll parameter

Parameter Length (bytes) Value/Description

RF Technologies 1 Bit mask indicating the RF technology to listen

for during Autocoll

Autocoll Mode 1 0 Autonomous mode not used, i.e. Au tocoll

terminates when external RF field is not

present.

1 Autonomous mode used. When no RF field

is present, Autocoll automatically enters

standby mode. Once RF external RF field

is detected, PN5180 enters again Autocoll

mode.

2 Same as 1 but without entering standby

mode.

Table 24. Autocoll bit mask indicating the RF technologies

b7 b6 b5 b4 b3 b2 b1 b1

0000 RFU

X If set, listening for NFC-F active is enabled

X If set, listening for NFC-A active is enabled

X If set, listening for NFC-F is enabled

X If set, listening for NFC-A s enabled

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 28 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

MIFARE_AUTHENTICATE

Description:

This command is used to per form a MIFARE Classic Authentication on an activate d card.

It takes the key, card UID and the key type to authenticate at a given block address. The

response contains 1 byte indicating the authentication status.

Condition:

Field ‘Key’ must be 6 bytes long. Field ‘Key Type’ must contain the value 0x60 or 0x61.

Block address may contain any address from 0x0 – 0xff, inclusive. Field ‘UID’ must be 4

bytes long and should cont ain the 4 byte UID of the card. An ISO14443-3 MIF ARE Classic

card should be put int o state ACTIVE or ACTIV E * pr ior to execu tio n of this inst ru ctio n .

In case of an error related to the authentication, the return value ‘Authe ntica tion Status’ is

set accordingly (see Table 25).

Attention:

Timer2 is not available during the MIFARE Authentication

If the condition is not fulfilled, an exception is raised.

Table 25. MIFARE_AUTHENTICATE

Payload Length

(bytes) Value/Description

Command code 1 0x0C

Parameter 6 Key: Authentication key to be used

1 Key type to be used:

0x60 Key type A

0x61 Key type B

1 Block address: T he address of the block for which the

authentication has to be perfo r med.

4 UID of the card

Return value 1 Authen t ica ti o n Status

Table 26. Authentication status return value

Payload Fiel d Length

(byte) Value/Description

Authentication

Status 1 0 Authentication successful.

1 Authentication failed (permissio n den ied).

2 Timeout waiting for card response (card not present).

3..FF RFU

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 29 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

EPC_INVENTORY

Description:

This instruction is used to per form an inventory of ISO18000-3M3 tags. It implements an

autonomous execution of se veral commands according to ISO18000-3M3 in order to

guarantee the timings specified by this standard.

Table 27. EPC_INVENTORY PARAMETERS

Payload Length

(byte) Value/Description

Command code 1 0x0D

Parameter 1 SelectCommandLength:

0 No Select command is set prior to “BeginRo und”

command. 'Valid Bits in last Byte' field and 'Select”

Command shall not be present

1...39 Length (n) of the 'Select” command

0, 1 Valid Bits in last Byte

0 All bits of last byte of 'Select command' field are

transmitted

1..7 Number of bits to be transmitted in the last byte of 'Select

command' field.

0..39 Array of up to 39 elements {Select}

1 byte Select: If present (dependent on the first paramete r Select

Command Length), this field contains the ‘Select’

command (according to ISO18000-3) which is sent prior to

a BeginRound command. CRC-16c shall not be included.

3 BeginRound: Contains the BeginRound command (accordi ng to

ISO18000-3). CRC-5 shall not be included.

1 Timeslot behavior

0 Response contains max. Number of time slots which may

fit in response buffer.

1 Response contains only one timeslot.

2 Response contains only one timeslot. If timeslot contains

valid card response, also the card handle is included.

Response 0 -

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 30 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Fig 15. EPC GEN2 Inventory command

card detected no Card detected

yes

yes and correct

PC/XPC received

aaa-017294

EPC_INVENTORY

received

Send

NextTimeSlot

EPC_RESUME_INVENTORY

received

BeginRound

command

Perform Card

Check

Card Check

Error

Correct PC/XPC received

Store information in the

RX buffer

GetHandleFunction

SelectCommand

wait t4 time

send_tx_buffer

bit

Only one

timeslot

Rx buffer full

GetHandle

Set Rx_IRQ

FINISH State

yes no

no yes

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 31 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

If present in the payload of the instruction, a ‘Select' command is ex ec ute d follo wed by a

‘BeginRound’ command. If there is a valid response in the first-time slot (no timeout, no

collision), the instruction sends an ACK and saves the received PC/XPC/UII. The device

performs then an action according to the definitions of the field ‘Timeslot Processed

Behavior’:

•If this field is set to ‘0’, a NextSlot command is issued to ha ndle the next time slot. This

is repeated until the internal buffer is full

•If this field is set to 1 the algorithm pauses

•If this field is set to 2 a Req_Rn command is issued if, and only if, there has been a

valid tag response in this timeslot

Condition:

If the condition is not fulfilled, an exception is raised.

Fig 16. Get Handle

Fig 17. Timeslot order EPC Gen2

RX IRQ and no error

RX IRQ and error or Timer 1 lRQ

aaa-017296

ReqRN

GetHandleFunction

START

GetHandleFunction EXIT

Collision or Recepion

Error

RX IRQ

Handle

GetHandleFunction EXIT

Store handle, RX_IRQ

aaa-017297

timeslot 0 timeslot 1 timeslot ...

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 32 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

EPC_RESUME_INVENTORY

Description:

This instruction is u sed to resume the inventory algorithm for the ISO18000-3M3 Inventory

in case it is paused. This instruction has to be repeatedly called, as long as 'Response

Size' field in EPC_RETRIEVE_INVENTORY_RESULT_SIZE is greater than 0.

A typical sequence for a complete EPC GEN2 inventory retrieval is:

1. Execute EPC_INVENTORY to start the inventory

2. Execute EPC_RETRIEVE_INVENTORY_RESULT_SIZE

3. If size is 0, inventory has finished.

4. Otherwise, execute EPC_RETRIEVE_INVENTORY_RESULT

5. Execute EPC_RESUME_INVENTORY and proceed with step 2.

Condition:

Field 'RFU' must be present and can be set to any value. If the condition is not fulfilled, an

exception is raised.

EPC_RETRIEVE_INVENTORY_RESULT_SIZE

Description:

This instruction is used to retrieve the size of the inventory result. The size is located in

the response to this instruction and reflects the payload size of the response to the next

execution of EPC_RETRIEVE_INVENTORY_RESULT. If the size is 0, then no more

results are available which means inventory algorithm has finished.

Condition:

Field Parameter1 must be present. If the condition is not fulfilled, an exception is raised.

Table 28. EPC_RESUME_INVENTORY PARAMETERS

Payload Length

(byte) Value/Description

Command code 1 0x0E

Parameter 1 0x00

Response 0 -

Table 29. EPC_RETRIEVE_INVENTORY_RESULT_SIZE PA RAMETERS

Payload length

(byte) Value/Description

Command code 1 0x0F

Parameter 1 0x00

Response 2 Response size:

If Response size == 0: Inventory has finished.

If Response size == 1...512: Value indicates the length of the

EPC_RETRIEVE_INVENTORY_RESULT response payload

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 33 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

EPC_RETRIEVE_INVENTORY_RESULT

Description:

This instruction is used to retrieve the result of a preceding or

EPC_RESUME_INVENTORY instruction. The size of the payload within the response is

determined by the ‘Response Size’ field of

EPC_RETRIEVE_INVENTORY_RESULT_SIZE response. Depending on the ‘Timeslot

Processed Behavior’ defined in that instruction, the result contains one or more time slot

responses. Each timeslot response contains a status (field ‘Timeslot Status’) which

indicates, that there has been a valid tag reply or a collision or no tag reply:

0 - Tag response available, XPC/PC/UII embedded in the response within 'Tag reply'

field

1 - Tag response available and tag handle retrieved. XPC/PC/UII as well as tag handle

available in the resp onse within 'Tag reply' field and 'Tag Handle' field, respectively.

2 - No tag replied, empty time slot

3 - Collision, two or more tags replied in the same time slot

Condition:

Field 'RFU' must be present and can be set to any value. If the condition is not fulfilled, an

exception is raised.

LOAD_RF_CONFIG

Description:

This instruction is used to load the RF configuration from EEPROM into the configuration

registers. The configuration r efer s to a uniq u e combination of “m ode” (target/initiator) and

“baud rate”. The configurations can be loaded separately for the receiver (Receiver

configuration) and transmitter (Transmitter configuration).

Table 30. EPC_RETRIEVE_INVENTORY_RESULT PARAMETERS

Payload Length

(byte) Value/Description

Command code 1 0x10

Parameter 1 0x00

Response 2 Response size

If Response size == 0: Inventory has finished.

If Response size == 1...512: Value indicates the length of the

EPC_RETRIEVE_INVENTORY_RESULT response payload

Table 31. LOAD_RF_CONFIG PARAMETERS

Payload length

(byte) Value/Description

Command code 1 0x11

Parameter 1 Transmitter configuration byte

1 Receiver configuration byte

Response 0 -

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 34 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The PN5180 is pre-configured by EEPROM with settings for all supported protocols. The

default EEPROM settings are considering typical antenna. It is possible for the user to

modify the EEPROM content and by this adapt the default settings to individual antennas

for optimum pe rf or ma n ce . Th e com m a nd UPDATE_RF_CONFIG is used for modification

of the RF Configuration settings available in the EEPROM. There is no possibility to

update the EEPROM data directly, updates have to make use of the

UPDATE_RF_CONFIG command.

Note that the command LOAD_RF_CONFIG configures parameters which are not

accessible by registers, a nd configures additional parameters depending on the

protocol setting (e.g. the waveshaping AWC). It is required to execute the c ommand

LOAD_RF_CONFIG for a specific protocol firs t, before any re gister sett ings for th is

protocol are changed.

The para meter 0xFF has to be used if the corresponding co nfiguration shall not be

changed.

Condition:

Parameter 'Transmitter Configuration' must be in the range from 0x0 - 0x1C, inclusive. If

the transmitter parameter is 0xFF, transmitter configuration is not changed.

Field 'Receiver Configuration' must be in the range fro m 0x80 - 0x9C, inclusive. If the

receiver parameter is 0xFF, th e re ce ive r con fig uration is not changed. If the condition is

not fulfilled, an exception is raised.

(1) UPDATE_RF_CONFIG allows updating the EEPROM content defining all protocol-specific

configurations. For each p rotocol, a user-defined configuration can be defined.

(2) LOAD_RF_CONFIG allows loading a protocol-specific configuration from EEPROM to registers as

actual RF configuration.

Fig 18. LoadRFConfig

aaa-023693

PN5180 EEPROM

UPDATE_RF_CONFIG

A106

A212

NFC-GTM

PN5180 REGISTERS

LOAD_RF_CONFIG

RF_CONTROL_TX_CLK

TX_DATA_MOD

TX_UNDERSHOOT_

CONFIG

TX_OVERSHOOT_CON

FIG

RF_CONTROL_TX

ANT_CONTROL

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 35 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

UPDATE_RF_CONFIG:

Table 32. L OAD_RF_CONFIG: Selection of protocol regi ster settings

Transmitter: RF

configuration

byte (hex)

Protocol Speed

(kbit/s) Receiver: RF

configuration

byte (hex)

Protocol S peed

(kbit/s)

00 ISO 14443-A / NFC PI-106 106 80 I SO 14443-A / NFC PI-106 106

01 ISO 14443-A 212 81 ISO 14443-A 212

02 ISO 14443-A 424 82 ISO 14443-A 424

03 ISO 14443-A 848 83 ISO 14443-A 848

04 ISO 14443-B 106 84 ISO 14443-B 106

05 ISO 14443-B 212 85 ISO 14443-B 212

06 ISO 14443-B 424 86 ISO 14443-B 424

07 ISO 14443-B 848 87 ISO 14443-B 848

08 FeliCa / NFC PI 212 212 88 FeliCa / NFC PI 212 212

09 FeliCa / NFC PI 424 424 89 FeliCa / NFC PI 212 424

0A NFC-Active Initiator 106 8A NFC-Active Initiator 106

0B NFC-Active Initiator 212 8B NFC-Active Initiator 212

0C NFC-Active Initiator 424 8C NFC-Active Initiator 424

0D ISO 15693 ASK100 26 8D ISO 15693 26

0E ISO 15693 ASK10 26 8E ISO 15693 53

0F ISO 18003M3 Manch. 424_4 Tari=18.88 8F ISO 18003M3 Manch. 424_4 106

10 ISO 18003M3 Manch. 424_2 Tari=9.44 90 ISO 18003M3 Manch. 424_2 212

11 ISO 18003M3 Manch. 848_4 Tari=18.88 91 ISO 1800 3M3 Manch. 848_4 212

12 ISO 18003M3 Manch. 848_2 Tari=9.44 92 ISO 18003M3 Manch. 848_2 424

13 ISO 18003M3 Manch. 424_4 106 93 ISO 14443-A PICC 106

14 ISO 14443-A PICC 212 94 ISO 14443-A PICC 212

15 ISO 14443-A PICC 424 95 ISO 14443-A PICC 424

16 ISO 14443-A PICC 848 96 ISO 14443-A PICC 848

17 NFC Passive Target 212 97 NFC Passive Target 212

18 NFC Passive Target 424 98 NFC Passive Target 424

19 NFC Active Target 106 106 99 ISO 14443-A 106

1A NFC Active Target 212 212 9A ISO 14443-A 212

1B NFC Active Target 424 424 9B ISO 14443-A 424

1C GTM ALL 9C GTM ALL

Table 33. UPDATE_RF_CONFIG PARAMETER S

Payload length (byte) Value/Description

Command

code 1 0x13

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 36 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Description:

This instruction is used to update the RF configuration within the EEPROM. The

command allows updating dedicated EEPROM addresses, in case the comple te set does

not require to be updated.

The payload parameters passed following the little endian approach (Least Significant

Byte first).

Condition:

The size of the array of ‘Configuration data’ must be in the range from 1 – 42, inclusive.

The array dat a el ements must contain a set of ‘RF Configuration byte’, ‘Register Address’

and ‘Value ’. Th e field ‘RF Co nfiguration byte ’ must be in the ra ng e fro m 0x0 0 – 0x1C or

0x80-0x9C, inclusive. The address within field ‘Register Address’ must exist within the

respective RF configuration. The ‘Register Value’ contains a value which will be written

into the given register and must be 4 bytes long. If the condition is not fulfilled, an

exception is raised.

RETRIEVE_RF_CONFIG_SIZE

Description:

This command is used to retrieve the size (number of 32-bit registe rs) of a given RF

configuration. The size is available in the response to this instruction.

Condition:

The field 'RF configuration ID' must be in the range from 0x00 - 0x1C or 0x80-0x9C,

inclusive. If the condition is not fulfilled, an exception is raised.

Parameter 1...42 Array of up to 42 elements {RF configuration byte, Register Address,

1 byte RF Configuration byte: RF configuration fo r which the

1 byte Register Address: Register Address within the given RF

technology.

4 bytes Register value: Value which has to be written into the

Response - -

Table 34. RETRIEVE_RF_CONFIG_SIZE PARAMETERS

Payload length

(byte) Value/Description

Command code 1 0x14

Parameter 1 RF configuration ID: RF configura tion for which the number of

registers has to be retrieved.

Response 1 Number of registers for the selected “RF configuration ID”

Table 33. UPDATE_RF_CONFIG PARAMETER S

Payload length (byte) Value/Description

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 37 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

RETRIEVE_RF_CONFIG

Description:

This command is used to read an RF configuration. The register content available in the

response. In order to know how many pairs are to be expected, the command

RETRIEVE_RF_CONFIGURATION_SIZE has to be executed first.

The payload parameters passed following the little endian approach (Least Significant

Byte first).

Condition:

The field 'RF configuration ID' must be in the range from 0x00-0x1C or 0x80-0x9C,

inclusive. If the condition is not fulfilled, an exception is raised.

RF_ON

Description:

This command is used to switch on the internal RF field. If en abled th e TX_R FON_IRQ is

set after the field is switched on.

RF_OFF

Description:

Table 35. RETRIEVE_RF_CONFIG PARAMETERS

Payload length (byte) Value/Description

Command

code 10x14

Parameter 1 RF configuration ID : RF configuration for which the number of 32-bit

registers has to be retrieved.

Response 0...39 Array of up to 39 elements {RegisterAddress, RegisterContent}

1 byte RegisterAddress: Address of the register to read

4 bytes RegisterContent: Data of register addressed by this element

Table 36. RF_ON

Payload length

(byte) Value/Description

Command code 1 0x16

Parameter 1 Bit0 == 1: disable collision avoidance according to ISO18092

Bit1 == 1: Use Active Communication mode according to ISO18092

Response - -

Table 37. RF_OFF

Payload length

(byte) Value/Description

Command code 1 0x17

Parameter 1 dummy byte, any value accepted

Response - -

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 38 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

This command is used to switch off the internal RF field. If enabled, the TX_RFOFF_IRQ

is set after the field is switched off.

ENABLE_TESTBUS_DIGITAL

Description:

This command enables the Digital test bus. There are several signal banks which can be

selected. From the selected sign al banks, the test signals ca n be rou ted to different pads.

Attention: Test bus must be enabled before in the EEPROM settings (EEPROM address:

0x17, TESTBUS_ENABLE).

TB_pos byte has to be configured in the following way:

ENABLE_TESTBUS_ANALOG

Description:

This command enables the Analog test bus.

Table 38. ENABLE_TESTBUS_DIGITAL

Payload length

(byte) Value/Description

Command code 1 0x18

Parameter 1 Signal Bank

1*n TB_pos:

Pad Location and test bus Bit Position

n can have a value between 1 and 4

Response - -

Table 39. TB_POS

BitPos Value Description

0_3 0..7h Signal Selection of the Signal Bank

8h 13 MHz RF clock

9h..Fh RFU

4:7 0h IRQ pad

1h AUX1 pad

2h AUX2 pad

3h GPO1

4h..Fh RFU

Table 40. ENABLE_TESTBUS_ANALOG

Payload Length

(byte) Value/Description

Command code 1 0x19

Parameter 1 DAC output to AUX2

1 DAC output to AUX1

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 39 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Attention: Test bus must be enabled before in the EEPROM settings (EEPROM address:

0x17, TESTBUS_ENABLE).

The host interface shall use the following sequence:

11.5 Memories

11.5.1 Overview

The PN5180 implements two different memories: EEPROM and RAM.

At start-up, all registers are initialized with default values. For the registers defining the RF

functionality, the default value s ar e no t set to execute any contactless communication.

The registers defining the RF functionality are initialized by using the instruction

LOAD_RF_CONFIGURATION.

Using the instruction LOAD_RF_CONFIGURATION, the initialization of the registers

which define the RF behavior of the IC performs an automatic copy of a predefined

EEPROM area (read/write EEPROM section1 and section2, register reset) into the

registers defining the RF behavior.

11.5.2 EEPROM

The EEPROM memory maintains its content during Power-OFF, whereas the RAM

(Buffers) does not keep any data stored in this volatile memory.

The EEPROM address range is from 0x00 to 0xFF.

The EEPROM contains information about Die Identifier, Firmware Version, System

configuration and RF setting s for fast configuration.

Table 41. EEPROM Addresses

EEPROM

Address

(HEX)

Field / Value Access Size

(bytes) Bits Comments

0x00 Die identif i er R 16 - Each DIE has a un i q ue Ide n ti fi e r

0x10 Product Version R 2 15-0 Product Version Indicator

0x12 Firmware Version R 2 15-0 Firmware Version

0x14 EEPROM Version R 2 15-0 EEPROM Version Number (default initialization

values)

0x16 IDLE_IRQ_AFTER_BOOT RW 1 7-0 This enables the IDLE IRQ to be set after the boot

has finished

0x17 TESTBUS_ENABLE RW 1 7-0 If bit 7 is set, the test bus functionality is enabled.

During this phase, it can happen that the BUSY line

is asserted after the frame is received. Therefore it

is recommended to first set NSS to low, wait until

BUSY goes high and then send the data.

0x18 XTAL_BOOT_TIME RW 2 15-0 XTAL boot time in us

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 40 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

0x1A IRQ_PIN_CONFIG RW 1 7-0 Configures the state (active high/low) and clearing

conditions for the IRQ pin

0 Cleared: IRQ active low

Set: IRQ active high

1 Cleared: Use IRQ_SET_CLEAR_REG to clear IRQ

Set: Auto Clear on Read of IRQ_STATUS_REG

0x1B MISO_PULLUP_ENABLE RW 1 7-0 Configures the pullup resistor for the SPI MISO

2-0 000b - no pulldown

001b - no pullup

010b - pulldown

011b - pullup

7-3 04h - FFh RFU

0x1C PLL_DEFAULT_SETTING RW 8 PLL configuration of clock input frequency in case

a 13.56 MHz Crystal is not used. The PLL setting

need to be written as two 4-byte words to the

memory, little endian. This means that the e.g the

value for 8 MHz (03A3531002A12210) shall be

written as follows to the EPROM (ascending

addresses starting at 0x1C):

1053A3031022A102

8 MHz: 03A35310 - 02A12210

12 MHz: 02A38288 - 02E10190

16 MHz: 02E2A1D8 - 02D11150

24 MHz: 02D35138 - 02E0E158 (default)

0x24 PLL_DEFAULT_SETTING_

ALM R/W 8 - PLL configuration for the Active Load Modulation

0x2c PLL _LOCK_SETTING R/W 4 31-0 Lock Settings for the PLL - do not change

0x30 CLOCK_CONFIG RW 1 7-0 Configures the source of the clock, either

27.12 MHz crystal or external clock e.g. 24 MHz

with PLL refactoring

3-0 0000b - PLL

1000b - Crystal

7-4 RFU

0x31 RFU RW 1 7-0 -

0x32 MFC_AUTH_TIMEOUT RW 2 15-0 Timeout value used for each of the Auth1 & Auth2

stages during MFC Authenticate (MIFARE

Authenticate). This is an unsigned 16-bit integer

value in little endian order. Th e timebase fo r the

timeout is 1.0 microseconds. Example: The default

value of 0x0, 0x5 refers actually to 0x500 (1280

decimal) resulting in a timeout of 1.28 ms for each

of the authentication stages.

Table 41. EEPROM Addresses …continued

EEPROM

Address

(HEX)

Field / Value Access Size

(bytes) Bits Comments

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 41 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

0x34 LPCD_REFERENCE_

VALUE RW 2 15-0 AGC Reference Value

0x36 LPCD_FIELD_ON_ TIME RW 1 7-0 1 byte delay * 8 in microseconds settling time for

AGC measurement

0x37 LPCD_THRESHOLD RW 1 7-0 1 byte AGC threshold value which is used to

compare against the (Current AGC value –

Reference AGC) during the Low-Power Card

Detection phase

0x38 up to firmware version 3.5:

LPCD_REFVAL_CONTROL RW 1 7-0 Configures the LPCD mode and reference value for

antenna detuning by card / metal

1-0 LPCD Mode

00b - Use EEPROM value of

LPCD_REFERENCE_VALUE for reference value

01b - Use on begin of an LPCD a measurement

cycle for generating a refe rence value.

10b - Use the Register value of

CHECK_CARD_RESULT for reference value. This

allows the configurati on of the referenc e value

without EEPROM programming.

2 GPO1 Control for external TVDD LDO

0b - Disable Control of external TVDD LDO via

GPO1

1b - Enable Control of external TVDD LDO via

GPO1

from firmware version 3.6

onwards:

LPCD_REFVAL_GPO_CO

NTROL

RW 1 7-0 This byte in EEPROM is used to control the GPIO

assertion during wake-up and LPCD card detect.

Table 41. EEPROM Addresses …continued

EEPROM

Address

(HEX)

Field / Value Access Size

(bytes) Bits Comments

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 42 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

1:0 LPCD Mode

00b - Use EEPROM value of

LPCD_REFERENCE_VALUE for reference value

01b - Use on begin of an LPCD a measurement

cycle for generating a refe rence value.

10b - Use AGC Reference value and AGC gear

from the register AGC_REG_CONFIG.

11b - RFU

2 GPO1 Control for external TVDD LDO

0b - Disable Control of external TVDD LDO via

GPO1

1b - Enable Control of external TVDD LDO via

GPO1

3 GPO2 Control for external TVDD LDO during

wake-up from standby

0b - Disable Control of external TVDD LDO via

GPO2 on LPCD Card Detect

1b - Enable Control of external TVDD LDO via

GPO2 on LPCD Card Detect

4 GPO1 Control for external TVDD LDO during

wake-up from standby

0b - Disable Control of external TVDD LDO via

GPO1 on wake-up from standby

1b - Enable Control of external TVDD LDO via

GPO1 on wake-up from standby

0x39 LPCD_GPO_TOGGLE_BE

FORE_FIELD_ON RW 1 7-0 1 byte value defines the time between setting

GPO1 until Field is switched on. The time can be

configured in 8 bits in 5us steps

0x3A LPCD_GPO_TOGGLE_AF

TER_FIELD_ON R W 1 7-0 1 byte value defines the time between Field Off and

clear GPO1. The time can be configured in 8 bits in

5us steps

0x3B NFCLD_SENSITIVITY_VAL RW 1 7-0 NFCLD Sensitivity value to be used during the RF

On Field handling Procedure.

0x3C FIELD_ON_CP_SETTLE_T

IME RW 1 7-0 Delay in 4us steps (range: 0 - 1020us) to wait

during RF on for charge pumps to be settled, to

avoid initial Tx driver overcurrent

0x3D RFU RW 2 15-0 RFU

0x3F RF_DEBOUNCE_TIMEOU

TRW 1 7-0 RF Debounce Timeout in step size of 10 s

0x40 SENS_RES RW 2 15-0 Response to ReqA / ATQA in order byte 0, byte 1

0x42 NFCID1 RW 3 23-0 If Random UID is disabled (EEPROM address

0x51), the content of these addresses is used to

generate a Fixed UID. The order is byte 0, byte 1,

byte 2; the first NFCID1 byte is fixed to 08h, the

check byte is calculated automa ti ca l ly

Table 41. EEPROM Addresses …continued

EEPROM

Address

(HEX)

Field / Value Access Size

(bytes) Bits Comments

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 43 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

0x45 SEL_RES RW 1 7-0 Response to Select

0x46 FELICA_POLLING_RESPO

NSE RW 18 - FeliCa Polling response (2 bytes (shall be 01h,

FEh) + 6 bytes NFCI D 2 + 8 byt es Pad + 2 bytes

system code)

0x51 RandomUID_enable RW 1 7-0 Enables the use of a RandomUID in card modes. If

enabled (EEPROM configuration, Address 0x51), a

random UID is generated after each RF-off.

0: Use UID stored in EEPROM

1: Randomly generate the UID

0x58 NFCID3 RW 1 7-0 NFCID3 (1 byte) If the Random UID is enabled

(EEPROM address 0x51), this address contains

the NFCID3.

0x59 DPC_CONTROL RW 1 7-0 Enables DPC and configures DPC gears

0 DPC_ENABLE cleared: OFF; set: ENABLE

3-1 GEAR_STEP_SIZE: binary definition of gear step

size; position of Bit 1 is the LSB of gear step size

7-4 START_GEAR; binary definition of start gear,

Position of bit 4 is the LSB of start gear number

0x5A DPC_TIME RW 2 15-0 Sets the value for the periodic regulation. Time

base is 1/20 MHz. (Example: Value of 20000 is

equal to 1 ms)

0x5C DPC_XI RW 1 7-0 Trim Value of the AGC value

0x5D AGC_CONTROL RW 2 Settings for AGC control loop

9-0 Duration

10 Duration enable

12-11 Step size

13 Step size enable

15-14 RFU

0x5F DPC_THRSH_HIGH RW 30 - Defines the AGC high threshold for each gear.

DPC_AGC_GEAR_LUT_SIZE defines the number

of gears. DPC_AGC_GEAR_LUT_SIZE can be

1..15. The threshold is defined by 2 bytes (bit0

located in the byte with lower address),

0x7D DPC_THRSH_LOW RW 2 15-0 Defines the AGC low threshold for initial gear. The

threshold is defined by 2 bytes (bit 0 located in the

byte with lower address)

0x7F DPC_DEBUG RW 1 7-0 Enables the debug signals

0x80 DPC_AGC_SHIFT_VALUE RW 1 7-0 Shift Value for the AGC dynamic low adoption to

prevent oscillation

0x81 DPC_AGC_GEAR_LUT_

SIZE RW 1 7-0 Defines the number of gears for the lookup table

(LUT, value can be between 1...15)

0x82 DPC_AGC_GEAR_LUT R W 15 - Defines the Gear Setting for each step size starting

with Gear0 at lowest address up to 15 gears. Each

entry contains a definition for the DPC_CONFIG

account.

Table 41. EEPROM Addresses …continued

EEPROM

Address

(HEX)

Field / Value Access Size

(bytes) Bits Comments

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 44 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

0x91 DPC_GUARD_FAST_

MODE RW 2 15-0 Guard ti me after AGC fast mode has been

triggered. This happens in the following scenarios:

- End of Receive

- End of Transmit

- After a gear switch

Time base is 1/20 MHz (Example: Value of 2000 is

equal to 100 s)

0x93 DPC_GUARD_SOF_

DETECTED RW 2 15-0 Guard time after SoF or SC detection. This is to

avoid any DPC regulation between SoF/SC and

actual begin of reception. Time base is 1/20MHz

(Example: Value of 2000 is equal to 100 s)

0x95 DPC_GUARD_FIELD_ON RW 2 15-0 Guard time after Gear Switch during FieldOn

instruction. T ime base is 1/20MHz (Example: Value

of 2000 is equal to 100 s)

0x97 up to firmware version 3.5:

PCD_SHAPING_LUT_SIZE RW 1 7-0 Number of elements for the PCD Shaping

0x98-0xE7 from firmware version 3.6

onwards: RW 1 7-0 Number of elem en ts for the PCD Shaping and RX

settings

4-0 The lower nibble consists of the Number of

elements for the PCD Shaping

7-5 The upper nibble consists of the Number of

elements for the RxGain.

up to firmware version 3.5:

PCD_SHAPING_LUT RW 64 - P CD Shaping configuration lookup table: Each

word contains the following configuration

information:

3-0 DPC Gear

7-4 TAU_MOD_FALLING (Sign bit + 3-bit value)

11-8 TAU_MOD_RISING (Sign bit + 3-bit value)

15-12 RESIDUAL_CARRIER (Sign bit + 3-bit value)

31-16 Bitmask identifying technology and baud rate:

0000b - A106

0001b - A212

0010b - A424

0011b - A848

0100b - B106

0101b - B212

0110b - B424

0111b - B848

1000b -F212

1001b -F424

1010b - 15693 ASK 100

1011b - 15693 ASK 10

1100b - ISO18000 3M3

Table 41. EEPROM Addresses …continued

EEPROM

Address

(HEX)

Field / Value Access Size

(bytes) Bits Comments

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 45 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

from firmware version 3.6

onwards:

PCD_SHAPING_LUT -

entries for AWC

R/W 64 Adaptive Waveshaping Control (AWC) and

Adaptive Receiver Control (ARC) configuration

dynamic 3:0 DPC Gear

7:4 TAU_MOD_FALLING (Sign bit + 3-bit value)

11:8 TAU_MOD_RISING (Sign bit + 3-bit value)

15:12 RESIDUAL_CARRIER (Sign bit + 3-bit value)

31-16 Bitmask identifying technology and baud rate:

0000b - A106

0001b - A212

0010b - A424

0011b - A848

0100b - B106

0101b - B212

0110b - B424

0111b - B848

1000b -F212

1001b -F424

1010b - 15693 ASK 100

1011b - 15693 ASK 10

1100b - ISO18000 3M3

PCD_SHAPING_LUT -

entries for ARC dynamic 3-0 DPC gear

5-4 RX_GAIN setting (Sign bit + 1-bit valu e )

7-6 RX_HPCF (Sign bit + 1-bit value)

15-11 RFU

31-16 Bitmask identifying technology and baud rate:

0000b - A106

0001b - A212

0010b - A424

0011b - A848

0100b - B106

0101b - B212

0110b - B424

0111b - B848

1000b -F212

1001b -F424

1010b - 15693 ASK 100

1011b - 15693 ASK 10

1100b - ISO18000 3M3

0xE8 -

0xFF RFU R/W - 7-0 RFU

Table 41. EEPROM Addresses …continued

EEPROM

Address

(HEX)

Field / Value Access Size

(bytes) Bits Comments

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 46 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.5.3 RAM

The RAM is used as Input/Output buffer, and implements independent buffers for input

and output. The buffers are able to improve the performance of a system with limited

interface speed.

11.5.4 Register

Registers configure the PN5180 for a specific RF protocol and other functionality.

Registers can be initialized using the host interface or by copying data from EEPROM to

the register as done by the command LOAD_RF_CONFIG.

It is mandatory to use th e com m a nd LOAD _R F_ CO NF IG for selec tio n of a sp ec ific RF

protocol.

11.6 Debug Signals

11.6.1 General functionality

The debugging of the RF functionality of the PN5180 is supported by a configurable test

signal output possibility. Up to 2 analog or up to 4 digital test signals can be routed to

configurable output pins of the PN5180. Test signals can be either analog or digital

signals. The analog test signals contain the digital data of the signal processing unit of the

PN5180, converted to analog signals by a DAC to allow the inspection of these signals in

real time.

Two set commands exist for configuration of the digital and analog debug signal output,

SET_DIGITAL_TESTOUT and SET_ANALOG_TESTOUT.

11.6.2 Digital Debug Configuration

The digital debug output is configured by the command SET_DIGITAL_TESTOUT. Two

parameters are passed within this command.

The first p arameter (1 byte) defines the test sig nal group. Out of this test signal group, one

signal can be selected for output on a pin of the PN5180 (4 bits).

The signal of the test signal group is selected by the low-nibb le of parameter 2. A value of

8 on this position selects the 13.56 MHz clock to be put out on the selected pin.

The high nibble of parameter 2 (1 byte) selects the output pin for the selected test signal.

The following parameter groups are possible:

Table 42. Debug Signal Group Selection

Command parameter

(hex) Debug Signal Group

01 Clock signal group

1B Transmitter encoder group

1D Timer group

30 Card mode protocol group

58 Transceive group

70 Receiver data transfer group

73 Receiver error group

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 47 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The second parameter defines the pin wh ich is used for output of the test signal in the

high nibble, and th e signal from one of the Deb ug Signal group s that are put out in the lo w

nibble.

11.6.2.1 Debug signal groups

Table 43. Clock Signal Group

Value low nibble

(HEX) Debug Function

9..15 RFU

8 13.56 MHz clock is put out

7 CLIF clock reset

6 Signal indicating the PLL is locked

5 Signal indicating an external Fiel d is pre s ent

4 20 MHz clock from the high frequency oscillator

3 27.12 MHz clock from th e PL L

2 27.12 MHz clock from the RF clock recovery

1 Multiplexed 27.12 MHz clock

0 Multiplexed 13.56 MHz clock

Table 44. Transmitter Encoder Group

Value low nibble

(HEX) Debug Function

9..15 RFU

8 13.56 MHz clock is put out

7..2 RFU

1 Output TX envelope

0 Tx-IRQ

Table 45. Timer Group

Value low nibble

(HEX) Debug Function

9..15 RFU

8 13.56 MHz clock is put out

7 Running flag of timer T0

6 Expiration flag of timer T0

5 Running flag of timer T1

4 Expiration flag of timer T1

3 Running flag of timer T2

2 Expiration flag of timer T2

1..0 RFU

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 48 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 46. Card mode Protocol Group

Value low nibble

(HEX) Debug Function

9..15 RFU

8 13.56 MHz Clock is put out

7 Synchronized clock-fail signal

6 Flag indicating that ISO/IEC14443-Type A (Miller) was detected

5 Flag indicating that FeliCa 212 kBd (Manchester) was detected

4 Flag indicating that FeliCa 424 kBd (Manchester) was detected

3 Flag indicating that ISO/IEC14443-Type B (NRZ) was de tected

2 Flag indicating that the EOF was detected

1 CM data signal (Miller / Manchester / NRZ)

0 Signal indicating that the current data is valid

Table 47. Trans ceive Group

Value low nibble

(HEX) Debug Function

9..15 RFU

8 13.56 MHz clock is put out

7 Signal indicating that the tx prefe tch was completed

6 Signal initiating a tx prefetch at the BufferManager

5 Start of transmissi on signal to TxEncoder

4 enable reception signal to RxDecoder

3 indicator that the waiting time was already expired

2 Transceive state2

1 Transceive state1

0 Transceive state0

Table 48. Receiver Data Transfer Group

Value low nibble

(HEX) Debug Function

9..15 RFU

8 13.56 MHz clock is put out

7 Signal from SigPro indicating a collision

6 Signal from SigPro indicating end of data

5 Signal from SigPro indicating that data is valid

4 Signal from SigPro indicating received data

3 Status signal set by rx_start, ends when RX is completely over

2 Status signal indicating actual reception of data

1 Reset signal for receiver chain (at start of RX)

0 Internal RxDec bitclk

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 49 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.6.2.2 Digit al Debug Output Pin Configuration

11.6.3 Analog Debug Configuration

For the output of an analog debug signal, two pins are available, BUSY and AUX2.

The function of the output pins is defined by two parameters of the command

11.7 AUX2 / DWL_REQ

11 .7.1 Firmware update

The PN5180 offers the possibility to upgrade the internal Firmware.

The pin AUX2/DWL request is a double function pin. During start-up (time from power-up

of the IC until IDLE IRQ is raised), the pin is used in input mode. If the polarity on this

AUX2/DWL_REQ pin during start-up is high, the PN5180 enters the download mode.

Table 49. Receiver Error Group

Value low nibble

(HEX) Debug Function

9..15 RFU

8 13.56 MHz clock is put out

7 Combination of data/protocol error and collision

6 Set if RxMultiple is set, and the LEN byte indicates more than 28 bytes

5..3 RFU

2 Set if a collision has been detected

1 Protocol error flag

0 Data integrity error flag (Parity, CRC (Collision))

Table 50. Debug Signal Output Pin Configuration

Value high nibble

(HEX) Debug Functio n (PIN)

0IRQ (39)

1 GPO (38)

2AUX2 (2)

3 AUX1 (40)

all others RFU

Table 51.

Parameter (hex) Debug Function

0 Analog output of value defined in register DAC_VALUE

1 Receiver Q-channel signal; depending on SIGPRO_IN_SEL either

samples signals from ADC, tx_envelope or SigIn

2 Receiver I-channel signal; depending on SIGPRO_IN_SEL either

samples signals from ADC, tx_envelope or SigIn

3 Filtered Q-channel signal (rect-filter)

4 Filtered I-channel signal (rect-filter)

all others RFU

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 50 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

If the boot process is finished (indicated by the IDLE IRQ), the pin is switched to output

mode and the pin can be used for general debug purpose.

Recommended sequence is to set the RESET_N level to 0, set AUX2 pin level to 1 and

release RESET_N to 1.

Exiting the download mode is perfor med by setting the AUX2 pin to 0 and perform a reset

of the PN5180.

11.7.2 Firmware update command set

The PN5180 uses a dedicated host interfac e command set for downl oad of new firmware .

The physical SPI host interface is use d for download of a ne w firm ware image. Security

features are implemented to avoid intentional or unintentional modifications of the

firmware image. The access to the IC is locked based on authentication mechanism to

avoid unauthorized firmware downloads. The integrity of the firmware is en sured based on

a secure hash algorithm,

The Firmware image can be identified based on a version number, wh ich co ntains major

and minor number.

For security reasons, the download of a smaller major version number than currently

installed on the PN5180 is not possible.

11.8 RF Functionality

11.8.1 Supported RF Protocols

11.8.1.1 ISO/IEC14443 A/MIFARE functionality

The physical level of the communication is shown in Figure 19.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 51 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The physical p arameters are described in Table 52.

The PN5180 connection to a host is required to manage the complete ISO/IEC 14443

A/MIFARE protocol. Figure 20 shows the data coding and framing according to

ISO/IEC 14443 A/MIFARE.

Fig 19. ISO/IEC 14443 A/MIFARE read/write mode communication diagram

(1)

(2)

001aam268

ISO/IEC 14443 A CARD

ISO/IEC 14443 A

READER

Table 52 . Communication overview for ISO/IEC 14443 A/MIFARE read er/writer

Communication

direction Signal type Transfer speed

106 kbit/s 212 kbit/s 424 kbit/s 848 kbit/s

Reader to card (send

data from the PN5180

to a card)

fc = 13.56 MHz

reader side

modulation 100 % ASK 100 % ASK 10 0 % ASK 100 % ASK

bit encoding modified Miller

encoding modified Miller

encoding

bit rate [kbit/s] fc/128 fc/64 fc/32 fc/16

Card to reader

(PN5180 receives data

from a card)

card side

modulation subcarrier load

modulation

subcarrier

frequency fc/16 f

c/16 f

c /16 f

c/16

bit encoding Manchester

encoding BPSK BPSK BPSK

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 52 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The internal CRC coprocessor calculates the CRC value based on the selected protocol.

In card mode for higher baud rates, the parity is automatically inverted as end of

communication indicator. The selected protocol needs to be implemented on a host

processor.

Fig 20. Data coding and framing according to ISO/IEC 14443 A card response

001aak585

ISO/IEC 14443 A framing at 106 kBd

8-bit data 8-bit data 8-bit data

odd

parity

odd

parity

start

odd

parity

start bit is 1

ISO/IEC 14443 A framing at 212 kBd, 424 kBd and 848 kBd

8-bit data 8-bit data 8-bit data

odd

parity

odd

parity

start even

parity

start bit is 0

burst of 32

subcarrier clocks even parity at the

end of the frame

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 53 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.8.1.2 ISO/IEC14443 B functionality

The physical level of the communication is shown in Figure 21.

The physical p arameters are described in Table 53.

The PN5180 requires the host to manage the ISO/IEC 14443 B protocol.

11.8.1.3 FeliCa RF function ality

The FeliCa mode is the general reader/writer to card communication scheme according to

the FeliCa specification. The communication on a physical level is shown in Figure 22.

The physical p arameters are described in Table 54.

(1) Reader to Card NRZ, transfer speed 106 kbit/s to 848 kbit/s

(2) Card to reader , Subcarrier Load Modulation Manchester Coded or BPSK, transfer speed 106 kbit/s

to 848 kbit/s

Fig 21. ISO/IEC 14443B read/write mode communication diagram

(1)

(2)

001aal997

ISO/IEC 14443 B CARD

ISO/IEC 14443 B

READER

Table 53 . Communication overview fo r ISO/IEC 14443 B reader/writer

Communication

direction Signal type Transfer speed

106 kbit/s 212 kbit/s 424 kbit/s 848 kbit/s

Reader to card (send

data from the PN5180

to a card)

fc = 13.56 MHz

reader side

modulation 10 % ASK 10 % ASK 10 % ASK 10 % ASK

bit encodin g NRZ NRZ NRZ NRZ

bit rate [kbit/s] 128 / fc64 / fc32 / fc16 / fc

Card to reader

(PN5180 receives data

from a card)

card side

modulation subcarrier load

modulation

subcarrier

frequency fc/16 f

c/16 f

c /16 f

c/16

bit encoding BPSK BPSK BPSK BPSK

Fig 22. FeliCa read/write communication diagram

001aam271

FeliCa READER

(PCD)

FeliCa CARD

(PICC)

1. PCD to PICC 8-30 % ASK

Manchester Coded,

baudrate 212 to 424 kbaud

2. PICC to PCD, > Load modulation

Manchester Coded,

baudrate 212 to 424 kbaud

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 54 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The PN5180 needs to be connected to a host which implements the FeliCa protocol.

Multiple reception cycles (RxMultiple): For FeliCa timeslot handling in PCD mode,

PN5180 implements multiple reception cycles. The feature is enabled by setting the

control bit RX_MULTIPLE_ENABLE in the re gis ter TR ANSCEIVE_CONTROL_REG in

combination with the transceive state machine.

Unlike for normal operation, the receiver is enabled again after a reception is finished. As

there is only one receive buffer available, but several responses are expected, the buffer

is split into sub buffers of 32 byte length. Hence, the maximum number of responses

which can be handled is limited to 8. As the maximum length defined for a FeliCa

response is 20 bytes, the buffer size defined does fulfill the requirements for that

use-case. The first data frame received is copied onto buffer address 0. The subsequent

frames are copied to the buffer address 32 * NumberOfReceivedFrames. The maximum

number of data bytes allowed per frame is limited to 28.

All bytes in the buffer between the payload and the status byte are uninitialized and

therefore invalid. The firmware on the host shall not use these bytes. The last wo rd of the

sub buf fer (position 28 to 31) conta ins a status word. T he status word co ntains the numbe r

of received bytes (may vary from the FeliCa length in case of an error), the CLError flag

indicating any error in the reception (which is a combination of 3 individual error flags

DATA_INTEGRITY_ERROR || PROTOCOL_ERROR || COLLISION_DETECTED) the

individual error flags and the LenError flag indicating an incorrect length byte (either

length byte is greater than 2 8 or the number of re ceived bytes is shorter tha n indicated by

the length byte ). All unu se d bits (RFU) ar e ma sk ed to 0.

Table 54. Communication for FeliCa reader/writer

Communication

direction Signal type Transfer speed FeliCa FeliCa higher transfer

speeds

212 kbit/s 424 kbit/s

Reader to card (send

data from the PN5180 to

a card)

fc = 13.56 MHz

reader side

modulation 8 % to 30 % ASK 8 % to 30 % ASK

bit encoding Manchester encoding Manchester encoding

bit rate fc/64 fc/32

Card to reader (PN5180

receives data from a

card)

card side

modulation Load modulation, Load modulation,

bit encoding Manchester encoding Manchester encoding

Fig 23. RxMultiple data format

aaa-009166

Len

Status

LenError

CollError

ProtError

DataError

ClError

PayLoad Status

32 byte

XXX

RFU [31:24] RFU [23:16] Len [4:0]

RFU

[15:13]

RFU

[7:5]

4 byte

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 55 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

There are 4 different cases possible for a reception:

1. Correct reception - Dat a integrity is correct (no CRC error), and additiona lly the number

of bytes received is equal to the length byte. Data is written to the buffer. No error set in

status byte.

2. Erroneous reception - Data is incorrect (data integrity error - CRC wrong) but frame

length is correct. Data is written to buffer and the bits CLError and DataError in the status

byte are set.

3. Erroneous rece ption - the length byte received indicates a frame len gth greater than 28.

No data is copied to buffer but status byte with LenError bit set is written.

4. Erroneous reception - the length byte is larger than the number of data bytes, which

have been received. Data received is written to buffer and the ProtocolError bit in the

status byte is set.

For each reception, the RX_IRQ in the IRQ_STATUS_REG is set. The host firmware can

disable the IRQ and use a timer for timeout after the last timeslot to avoid excessive

interaction with the hard ware. At the end of the reception, additionally the bit field

RX_NUM_FRAMES_RECEIVED in the register RX_STATUS_REG is updated to indicate

the number of receive d fr am e s .

After the reception of the eight frames (which is the maximum supported), a state change

to next expected state is executed (WaitTransmit for transceive command). It is possible

to issue the IDLE command in order to leave the RxMultiple cycle. Consequently the

reception is stopped. Upon start of a new reception cycle, the flag

RX_NUM_FRAMES_RECEIVED is cleared.

The duration between deactivate and reactivate is at minimum 2 RF cycles and can last

typically up to 2 s.

11.8.1.4 ISO/IEC15693 functionalit y

The physical parameters are described below.

Table 55. Communication for ISO/IEC 156 93 reader/writer “reader to card”

Communicatio n direction Signal type Transfer speed

fc/512 kbit/s

Reader to card (send data from

the PN5180 to a card) reader side modulation 10 % to 30 % ASK 90 % to 100 %

ASK

bit encoding 1/4

bit length 302.08 s

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 56 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

[1] Fast inventory (page) read command only (ICODE proprietary command).

11.8.1.5 ISO/IEC18000-3 Mode 3 functionality

The ISO/IEC 18000-3 mode 3 is not described in this document. For a detailed

explanation of the protocol, refer to the ISO/IEC 18000-3 standard.

The diagram below illustrates the card presence check:

Table 56. Communication for ISO/IEC 156 93 reader/writer “card to reader”

Communication

direction Signal type Transfer speed

6.62 kbit/s 13.24 kbit/s 26.48 kbit/s 52.96

kbit/s[1]

Card to reader

(PN5180 receives

data from a card)

fc = 13.56 MHz

card side

modulation not supported not supported single

subcarrier

load

modulation

ASK

single

subcarrier

load

modulation

ASK

bit length

(s) - - 37.76 (3.746) 18.88

bit encoding - - Manchester

coding Manchester

coding

subcarrier

frequency

[MHz]

--f

c/32 fc/32

Fig 24. EPC_GEN2 Card presence check

RX IRQ and no error

RX IRQ and error

RX IRQ

and collision

Timer 1 IRQ

Timer 1 IRQ Timer 1 IRQ

aaa-017295

ACK

CardCheck entry

WAIT T2

CRC16+CRC5

Rx IRQ and

no collision

NACK

PC/XPC

CardCheck EXIT

Card Detected - Store

PC/XPC

CardCheck EXIT

ACK collison

CardCheck EXIT

ACK timeout

CardCheck EXIT

Collison Error

CardCheck EXIT

No Card detected

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 57 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.8.1.6 NFCIP-1 modes

Overview: The NFCIP-1 communication differentiates between an Active and a Passive

Communicatio n Mode.

•Active Communication mode means both the initiator and the target are using their

own RF field to transmit data.

•Passive Communication mode means that the t arget answers to an initiator command

in a load modulation scheme. The initiator is active in terms of generatin g the RF field.

•Initiator: Generates RF field at 13.56 MHz and starts the NFCIP-1 communication.

•Target: responds to initiator command either in a load modulation scheme in Passive

Communication mode or using a self-generated and self-modulated RF field for Active

Communication mode.

In order, to support the NFCIP-1 standard the PN5180 supports the Active and Passive

Communication mode at the transfer speeds 106 kbit/s, 212 kbit/s and 424 kbit/s as

defined in the NFCIP-1 standard.

Fig 25. EPC GEN2 possible timeslot answers

aaa-017298

status

0x00

Tag Reply

length

Valid bits in

last byte

status

0x01

Tag Reply

length

Valid bits in

last byte

1 byte 1 byte 1 byte n bytes (defined in

Tag Reply Length)

1 byte

status

0x02

status

0x03

Tag response

available

NO TagHandle

Tag response

available

TagHandle

available

No Tag replied

Two or more tags

replied

1 byte

1 byte 1 byte 2 bytesn bytes (defined in

TagReply Length)

Tag Reply Tag handle

possible timeslot answers

Tag Reply

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 58 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Active communication mode : Active communication mode means both the initiator and

the target are using their own RF field to transmit data.

A dedicated host controller firmware is required to handle the NFCIP-1 protocol. For this

purpose NXP offers an NFC Reader library (check the NXP website) which supports

Reader/Writer, P2P and CardEmulation modes.

Fig 26. Active communication mode

Table 57. Communication overview for active communication mode

Communication

direction 106 kbit/s 212 kbit/s 424 kbit/s

Initiator Target According to ISO/IEC 14443 A

100 % ASK, modified

Miller Coded

According to FeliCa, 8 % to 30 % ASK

Manchester Coded

Target Initiator

host NFC INITIATOR

powered to

generate RF field

1. initiator starts communication at

selected transfer speed

Initial command

response

2. target answers at

the same transfer speed

host NFC INITIATOR

powered for digital

processing

host

NFC TARGET

powered for

digital processing

powered to

generate RF field

001aan216

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 59 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Passive communication mode: Passive communication mode means that the target

answers to an initiator command in a load modulation scheme. The initiator is active

(powered) to generate the RF field.

A dedicated host controller firmware is required to handle the NFCIP-1 protocol.

Note: Transfer Speeds above 424 kbit/s are not defined in the NFCIP-1 standard.

NFCIP-1 protocol support: The NFCIP-1 protocol is not d escribed in this document. The

PN5180 does not implement any of the high-level protocol functions. These higher-level

protocol functions need to be provided by the host. For detailed explanation of the

protocol, refer to the NFCIP-1 standard. However the datalink layer is according to the

following policy:

•Speed shall not be changed while continuous data exchange in a transaction.

•Transaction includes initialization, anticollision methods and data exchange (in

continuous way, meaning no interruption by another transaction).

In order not to disturb current infrastructure based on 13.56 MHz, the following general

rules to start an NFCIP-1 communication are defined:

1. Per default, an NFCIP-1 device is in Target mode - meaning its RF field is switched

off.

2. The RF level detector is active.

3. Only if it is required by the application the NFCIP-1 device shall switch to Initiator

mode.

Fig 27. Passive communication mode

Table 58. Communication overview for passive communication mode

Communication

direction 106 kbit/s 212 kbit/s 424 kbit/s

Initiator Target According to

ISO/IEC 14443 A

100 % ASK, Modified

Miller Coded

According to FeliCa, 8 % to 30 % ASK

Manchester Coded

Target Initiator According to

ISO/IEC 14443 A

@106 kbit modified Miller

Coded

According to FeliCa, > 14 % ASK

Manchester Coded

host NFC INITIATOR

powered to

generate RF field

1. initiator starts communication

at selected transfer speed

2. targets answers using

load modulated data

at the same transfer speed

host

NFC TARGET

powered for

digital processing

001aan217

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 60 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

4. An initiator shall only switch on its RF field if no external RF field is dete cted by the RF

Level detecto r durin g a tim e of TIDT. (Details are specified in the ISO/IEC 18092)

5. The initiator performs initialization accordin g to th e se lect ed mo de .

11.8.1.7 ISO/IEC14443 A Card o peration mode

PN5180 can be configured to act as an ISO/IEC 14443 A compliant card.

In this configuration, the PN5180 can generate an answer in a load modulation scheme

according to the ISO/IEC 14443 A interface description.

Note: PN5180 does not support a complete card protocol. This card protocol has to be

handled by a connected host controller. Nevertheless, the layer3 type A activation is

handled by the NFC frontend. The Card Activated IRQ shall be enabled and notifies if a

card activation had been succe ssfully performed.

The supports ISO/IEC14443 A card mode for data rates 106 kbit/s, 212kbit/s, 424 kbit/s

and 848 kbit/s.

11.8.1.8 NFC Configuration

The NFC protocol for the 106 kbit/s mod e defi nes a n addition al Sync-Byte (0xF0 + parity)

after the normal start bit had been transmitted. As this Sync-Byte includes a parity bit, it

can be handled by a host firmware as a normal data byte.

11.8.1.9 Mode Detector

The Mode Detector is a functional block of the PN5180in PICC mod e which senses for an

RF field generated by another device. The mode detector allows distinguishing between

type A and FeliCa target mode. Dependent on the recognized protocol generated by an

initiator peer device the host is able to react. The PN5180 is ab le to e mul ate type A card s

and peer to peer active target modes according to ISO/IEC18092.

11.8.2 RF-field handling

The NFC fronte nd support s generation of a RF -field dependent on exte rnal conditions like

presence of another NFC device generating an RF field. A flexible mechanism to cont ro l

the RF field is available.

Fig 28. Target Mode case: Timer stop for started reception

aaa-020576

0x00

...

... 0x7E0x7F0x00

0x07

...

0x7E0x7F

0x00

0x08

tx_wait time

...

0x7E0x7F0x00

0x09

...

TXbit TX bitpha

se-1

phase

TXbit TRANSCEIVE_CONTROL_REG.TX_BITPHASE is loaded in case last PCD bit is 0

TRANSCEIVE_CONTROL_REG.TX_BITPHASE + TX_WAIT_PRESCALER/2 + 1 is loaded in case last PCD bit is 1

phase

last bit

TX wait counter

PN5180 PICC

PCD

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 61 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

After power-up, the RF-field is off.

The instruction RF_ON enables the generation of a RF-field. The NFC frontend can

perform an initial RF collision avoidance according to ISO/IEC18092. Before enabling the

RF-field, a field detection is automatically enabled for TIDT. In case an external field is

detected, the field is not switched on and an RF_ACTIVE_ERROR_IRQ is raised. The

cause for the error can be examined in the RF_STATUS_REG.

In order to switch off the RF-field generation, the RF_OFF instruction needs to be sent.

Active Mode is supported by configuring the RF_ON instruction.

11.8.3 Transmitter TX

The transmitter is able to dr ive an ante nna circuit conne cted to outpu ts TX1 and TX2 with

a 13.56 MHz carrier signal. The signal delivered on pins TX1 and pin TX2 is the

13.56 MHz carrier modulated by an envelope signal fo r energy and data tra nsmission. It

can be used to drive an antenna directly, using a few passive components for matching

and filtering. For a dif fere ntial antenna co nfiguration, either TX1 or TX2 can be co nfigured

to put out an inverted clock. 100 % modulation and several levels of amplitude modulation

on the carrier can be performed to suppo rt 13.56 MHz carrier-based RF-reader/writer

protocols as defined by standards ISO/IEC14443 A and B, FeliCa and ISO/IEC 18092.

11.8.3.1 100 % Modulation

There are 5 choices for the output st age behavior during 100 % modulation, and one

setting for 10 % modulation. This modulat ion is controlled by TX_CLK_MODE_RM in

RF_CONTROL_TX_CLK:

Fig 29. PN5180 Output driver

aaa-008643

PRE-DRIVERS

TVDD

TX1

M1<

envelope

clk_highside

clk_lowside

hs_gate

ls_gate<14:0>

Table 59. Settings for TX1 and TX2

TX_CLK_MODE_RM

(binary) Tx1 and TX2 outp ut Remarks

000 High impedance -

001 0 output pulled to 0 in any case

010 1 output pulled to 1 in any case

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 62 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

With the options “RF high side push” and “RF low side push”, potentially faster fall times

can be achieved for the antenna voltage amplitude at the begin ning of a mod ulation. This

basic behavior during modulation cannot be configured independently for TX1 and TX2.

Only the clock polarity can be configured separately with TX1_INV_RM and

TX2_INV_RM.

11.8.3.2 10 % Amplitude Modulation

For a targeted ASK 10 % amplitude modulation, the bits RF_CONTROL_TX_CLK in

does not influence the clock behavior thus resulting in an ASK modulation to a modulation

index as defined by RF_CONTROL_TX in the bits TX_RESIDUAL_CARRIER. The

residual carrier setting is used to adjust the modulatio n degree a t the TX ou tput. A contro l

loop is implemented to keep the modulation degree as constant as possible.

The settings and resulting typical residual carrier and modulation degree is given in table

below:

110 RF high side push Open -drain, only high side (push) MOS

supplied with clock, clock polarity defined by

TX2_INV_RM; low side MOS is off

101 RF low side pull Open-drain, only low side (pull) MOS

supplied with clock, clock polarity defined by

TX1_INV_RM; high side MOS is off

111 13.56 MHz clock derived

from 27.12 MHz quartz

divided by 2

push/pull Operation, clock polarity defined

by invtx; setting for 10 % modulation

Table 59. Settings for TX1 and TX2 …continued

TX_CLK_MODE_RM

(binary) Tx1 and TX2 outp ut Remarks

Table 60. Modulation degree configur ation

TX_RESIDUAL_CARRIER

(%) modulati on degree nomi nal (%)

00h 100 0

01h 98 1.01

02h 96 2.04

03h 94 3.09

04h 91 4.71

05h 89 5.82

06h 87 6.95

07h 86 7.53

08h 85 8.11

09h 84 8.7

0Ah 83 9.29

0Bh 82 9.89

0Ch 81 10.5

0Dh 80 11.11

0Eh 79 11.73

0Fh 78 12.36

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 63 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.8.3.3 TX Wait

Tx_wait can be used for 2 different purposes:

On the one hand, it can be used to prevent start of transmission before a certain period

has expired - even if thePN5180 has already finished data processing and set the

START_SEND bit. This behavior is intended for the reader mode to guarantee the PICC

to PCD frame delay time (FDT).

On the other hand, the tx_wait time can be used to start the transmission at an exactly

defined time. For this purpose, data to be sent must be available and the START_SEND

flag has to be se t by FW before the per iod expires. In case the START_SEND bit is not set

when tx_wait expires and MILLER_SYNC_ENABLE is set the transmission is started on

the bit-grid.

The guard time tx_wait is started after the end of a reception, no matter if the frame is

correct or erroneous. The tx_wait guard time counter is not started in case the reception is

restarte d because of an EMD-event or in case the RX_MULTIPLE_ENABLE bit is set to 1.

In case the register flag TX_WAIT_RFON_ENABLE is set to 1 the guard time counter is

started when the devices own RF-Field is switched on.

To start a transmission, it is always necessary for the firmware to set the START_SEND

bit in the SYSTEM_CONFIG register or sending the instruction SEND_DAT A. Having said

that it is possible to disable the guard time tx_wait by setting the register

TX_WAIT_CONFIG to 00h.

16 77 12.99

17 76 13.64

18 75 14.29

19 74 14.94

20 72 16.28

21 70 17.65

22 68 19.05

23 65 21.21

24 60 25

25 55 29.03

26 45 37.93

27 40 42.86

28 35 48.15

29 30 53.85

30 25 60

31 0 100

Table 60. Modulation degree configur ation …continued

TX_RESIDUAL_CARRIER

(%) modulati on degree nomi nal (%)

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 64 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.8.3.4 Over- and Undershoot prevention

The over- and undershoot protection allows configurîng additional signa ls on the

Transmitter output which allows to control the signal shaping of the antenna output.

The registers TX_OVERSHOOT_CONFIG_REG and

TX_UNDERSHOOT_CONFIG_REG are used to configure the over-and undershoot

protection. Additionally, in register RF_CONTROL_TX_CLK (bit

TX_CLK_MODE_OVUN_PREV) it is defined which TX clock mode for the period the

overshoot/undershoot prevention is active, and RF_CONTROL_TX (bit

TX_RESIDUAL_CARRIER_OV_PREV) defines the value for the residual carrier for the

period the overshoot prevention pattern is active.

11.8.4 Dynamic Power Control (DPC)

The Dynamic Power Control a llows adjusting the Transmitter output current dep endent on

the loading condition of the antenna.

A lookup table is used to configure the output voltage and by this control the transmitter

current. In addition to the control of the transmitter current, wave shaping settings can be

controlled dependent on the selected protocol and the measured antenna load.

Example with overshoot pattern ‘1100’ ( b inary) with a length of four and undershoot pattern ‘001’

(binary) with a length of three.

Fig 30. Overshoot/Undershoot prevention

aaa-009147

clk13

env_gen_outstream

tx_outstream

delay overshoot

protection

delay undershoot

protection

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 65 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The PN5180 allows measuring periodically the RX voltage. The RX voltage is used as

indicator for the actual antenn a current. The volt age measurement is done with the he lp of

the AGC. The time interval between two measurements can be configured with the

OC_TIME byte in the EEPROM.

Fig 31. AGC value definin g the RF outp ut po we r c onfiguration

Fig 32. AGC value defining the waveshape configuration

PWR LUT

ENTRY 1

DPC_AGC_GEAR_LUT

PWR LUT

ENTRY 2

PWR LUT

ENTRY 3

PWR LUT

ENTRY 4

PWR LUT

ENTRY 5

PWR LUT

ENTRY X

GEARAGC VALUE

DPC_THRSH_HIGH

DPC_THRISH_LOW

aaa-019796

PCD_SHAPING_LUT

CONFIGURED

PROTOCOL

SHAPING LUT

ENTRY 1

SHAPING LUT

ENTRY 2

SHAPING LUT

ENTRY 2

SHAPING LUT

ENTRY Z

GEARAGC VALUE

aaa-023828

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 66 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The AGC value is compared to a maximum and minimum threshold value which is stored

in EEPROM.

If the AGC value is exceeding one of the thresholds, a new gear configuring another

transmitter supply driver voltage will be activated. The number of gears - and by these

transmitter supply voltage configurations - can be defined by the application, up to

15 gears are available.

Fig 33. Lookup tables for AGC value-depend ent dynamic configuration

Fig 34. Transmitter supply voltage configuration, VDD(TVDD) > 3.5 V

PWR LUT

ENTRY 1

DPC_AGC_GEAR_LUT

PWR LUT

ENTRY 2

PWR LUT

ENTRY 3

PWR LUT

ENTRY 4

PWR LUT

ENTRY 5

PWR LUT

ENTRY X

GEARAGC VALUE

DPC_THRSH_HIGH

DPC_THRISH_LOW

aaa-019796

aaa-019385

TX_CW_TO_MAX_RM

-150 mV

VTVDD

-250 mV

-500 mV

-1.0 V

TX_CW_AMP_REF2TVDD

TX driver supply

TX_CW_AMPLITUDE_RM <1:0>

3.0 V

2.75 V

2.5 V

2.0 V

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 67 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.8.5 Adaptive Waveform Control (AWC)

Depending on the level of detected detuning of the antenna, RF wave shaping related

stored in a lookup t able located in EEPROM, and selected dependent on the actual gear.

The gear numbers need to be provided as part of the lookup table entries and need to be

provided in ascending order in the EEPROM. Each lookup table en try allows configuring

not only a dedicated wave shaping configur ation for the corresponding gear, but in

additionally it is possible to configure for this gear the wave shaping configuration

dependent on the different protocols.

Each lookup ta ble item cont ains a bitmask of techn ology and baud rate (in order to use an

entry for multiple technologies and baudrates), the DPC Gear and a relative value

(change compared to actual setting of register RF_CONTROL_TX) for

TAU_MODE_FALLING, TAU_MODE_RISING and TX_RESIDUAL_CARRIER.

If there is a gear switch, a EEPROM lookup is performed if the current gear (at current

protocol and baud rate) has an assigned wave shaping configuration. In case of an

execution of a LoadProtocol command, this lookup will be performed (example: switching

from baud rate A106 to A424) as well. The change from the wave shaping configuration

Table 61. Wave shaping lookup table

Bit

position Function of each DWORD

29:31 RFU

16:28 Bitmask identifying techno logy and baud rate

0001h A 106

0002h A 212

0004h A 424

0008h A 848

0010h B 106

0020h B 212

0040h B 424

0080h B 848

0100h F 212

0200h F424

0400h ISO/IEC 15693 ASK10

0800h ISO/IEC 15693 ASK100

1000h ISO/IEC 18000m3

12_15 RESIDUAL_CARRIER (Sign bit + 3-bit value) 0: Add value to curre nt residual

carrier configuration, 1; subtract value from current residual carrier configuration

8:11 TAU_MOD_RISING (Sign bit + 3-bit value) 0: Add value to current

TAU_MOD_RISING configuration, 1; subtract value from current

TAU_MOD_RISING configuration

4:7 TAU_MOD_FALLING (Sign bit + 3-bit value) 0: Add value to current

TAU_MOD_FALLING configuration, 1; subtract value from current

TAU_MOD_FALLING configuration

0:3 DPC Gear

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 68 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

as configured by LOAD_RF_CONFIG is relative, which means that bits are added or

subtracted from the existing configuratio n. For an increasing gear value, the defined

change is cumulative.

11.8.6 Adaptive Receiver Control (ARC)

(Ava ilable from Firmware 2.6 onwards) Depen ding on the level of dete cted detuning of the

antenna, receiver-related register settings can be automa tica lly up da te d . Th e re gis te rs

which allow to be dynamically controlled are RX_GAIN and RX_HPCF.

The size of the Lookup table for the ARC is done in the upper nibble of the entry

PCD_SHAPING_LUT_SIZE (0x97). In case this entry is zero, the ARC is deactivated. In

total 20 entries (20*1 DWORD = 80 bytes) + 1 byte for length (upper nibble for RX Gain,

and lower nibble for PCD shaping) can be used for both PCD shaping (AWC) and RX

Gain configuration (ARC) in the EEPROM.

The ARC lookup t able (configuration dat a) is added a t the end of the AWC (waveshaping)

lookup table. This provides maximum flexibility and allows do define different lookup t able

sizes for both AWC and ARC. Care must be taken if the size of the AWC table is changed,

this results in invalid ARC data which might have been previously configured since the

ARC table offset changes as a result of the changed AWC size.

The Adaptive Receiver Con tro l s et ting s ov er rid e the de fa ult RX_G AIN an d RX_ HPCF

Fig 35. DPC, AGC and AWC configuration

aaa-023926

RM_VALUE

AGC_CONFIG register

AGC_VALUE CONTROLLER

RF_STATUS register

DIVIDER_VALUE

internal register

to signal processing RX input

value

trim

value

DPC_XI

EEPROM: 0x5C

last AGC valueAGC config value

control modefix mode

CM_VALUE

AGC_CONFIG register

AGC_MODE_SEL

AGC_CONFIG register

AGC_INPUT_SEL

UPDATE

AGC_CONFIG register

AGC_VREF_SEL

AGC_CONFIG register

AGC_ENABLE_CONTROL

AGC_CONFIG register

AGC_LOAD

AGC_CONFIG register

AGC_TIME_CONSTANT

AGC_CONFIG register

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 69 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

In case of a gear switch, an EEPROM lookup is performed. If the current gear (at current

protocol and baud rate) has an assigned RX_GAIN and RX_HPCF configuration, this

value is used to update the current receiver register configuration.

11.8.7 Transceive state machine

The transceive command allow transmitting and the following expected receive dat a with

a single command.

The transceive state machin e is use d to trigger the reception and transmission of the RF

data dependent on the conditions of the interface.

The state machine for the command transceive is started when the SYSTEM_CONFIG

command is set to transceive. The transceive command does not terminate automatically.

In case of an error, the host can stop the transceive state machine b y setting the

SYSTEM_CONFIG.command to IDLE.

START_SEND can either be triggered by writing to the SYSTEM_CONFIG register

start_send or by using the command SET_INSTR_SEND_DATA.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 70 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Fig 36. Tra nsceive state machine

aaa-020626

Initator

Tx_skip_send_

enable*

Tx_frame_step_

enable

All bytes

transmitted

WAIT_RECEIVE

(start RX_WAIT

timer)

WAIT_FOR_DATA

(check for

reception)

WAIT_TRANSMIT

(start TX_WAIT

timer)

START_SEND

TRANSMIT

(RF transmission

is started)

Tx-wait timer elapsed

yes

no yes

Transmission done

IDLE mode

Command set to transceive

yes

RX_wait timer elapsed

RECEIVE

(RF reception

is started)

Reception started Reception

done

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 71 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.8.8 Autocoll

The Autocoll state machine performs the time critical activation for Type-A PICC and for

NFC-Forum Active and Passive Target activation.

The PICC state machine supports three configurations:

•Autocoll mode0: Autocoll mode is left when no RF field is present

•Autocoll mode1: Autocoll mode is lef t when one technology is activated by an external

reader. During RFoff, the chip enters standby mode automatically

•Autocoll mode2: Autocoll mode is lef t when one technology is activated by an external

reader. During RFoff, the chip does not enter standby mode.

At start-up, the Autocoll st ate machine auto matically performs a L OAD_RF_ CONF IG wi th

the General Target Mode Settings. When a technology is detected during activation, the

Autocoll state machine performs an additional LOAD_RF_CONFIG with the

correspond in g te chn o l og y.

The card configuration for the activation is stored in EEPROM. If RandomUID is enabled

(EEPROM configuration, Address 0x51), a random UID is generated after each RF-off.

For all active ta rget modes, the own RF field is automatically switched on af ter the initiator

has switched off its own filed.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 72 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11 .8.9 Receiver RX

11.8.9.1 Reader Mode Receiver

In Reader Mode, the response of the PICC device is coup led from the PCB antenna to the

differential input RXP/RXN. The Reader Mode Receiver extracts this signal by first

removing the carrier in passive mixers (direct conversion for I and Q), then filtering and

amplifying the baseband signal, and finally converting to digital values with 2 separate

ADCs for I and Q channel. Both the I and Q channels have a differential structure which

improves the signal quality.

Fig 37. Autoc all state machine

aaa-020625

ReqA/WupA no

Passive Target A

enabled?

IDLE

READYREADY*

Send SensF

response

Frame received

entry

HALT

Yes and

Autocoll_state_a** == HALT

Yes and

Autocoll_state_a** == IDLE

ISO14443-3A PICC

state machine

ACTIVE

Passive Target A106

IRQ line is asserted

Load Protocol PICC-A106 done

RX_IRQ and

CARD_ACTIVATED_IRQ are set

Passive Target F212/424*

IRQ line is asserted

Load Protocol PICC-F212

or PICC-F424 done

RX_IRQ and

CARD_ACTIVATED_IRQ are set

*the determined baudrate can be found in the SIGPRO_CONFIG register

** Autocoll_state_a is defined in the register SYSTEM_CONFIG

Active Target A106/F212/F424*

IRQ line is asserted

Load Protocol AT106/AT212/

AT424 done

RX_IRQ is set

ACTIVE*

yes

SensF received

and Passive

Target F enabled

SC = 0xFFFF or

EE-Value

yes

yes SensFReq

received

any other frame

received

Any CL

Error

Frame received

and no error

Active Mode

enabled

yes

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 73 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The I/Q-Mixer mixes the dif feren tial input RF-s ignal down to the baseband. Th e mixer has

a band with of 2 MHz.

The down mixed diff erential RX input signals are passed to the BBA and band-pass

filtered. In order to consider all the various protocols (Type A/B, FeliCa), the high-pass

cut-off frequency of BBA can be configured between 45 kHz and 250 kHz in 4 different

steps. The low-pass cut-off frequency is above 2 MHz.

This band-passed signal is then further amplified with a gain factor which is configura ble

between 30 dB and 60 dB. The baseband amplifier (BBA)/ADC I- and Q- channel can be

enabled separately. This is required for ADC-based CardMode functionality as only the

I-channel is used in this case.

The gain and high pass corner frequency of the BBA are not independent from each

other:

Table 62.

Gain setting HPCF setting HPCF (kHz) LPCF (MHz) Gain (sB20) Band width

(MHz)

Gain3 0 39 3.1 60 3.1

1 78 3.2 59 3.1

21443.5583.3

32604.1563.8

Gain2 0 42 3.1 51 3.1

1 82 3.3 51 3.2

21503.7493.5

32714.3474.0

Gain1 0 41 3.7 43 3.7

1 82 4.0 42 3.9

21514.5414.3

32765.5395.2

Gain0 0 42 3.8 35 3.8

1 84 4.1 34 4.0

21544.7334.5

32815.7315.4

Fig 38. PN5180 Receiver Block diagram

aaa-008644

RXP

VMID

AGC

BBA

MIX

CLK

I-CLK

Q-CLK

RXN

DATA

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 74 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.8.9.2 Automatic Gain Control

The Automatic Gain Control (AGC) of the receiver is used to control the amplitude of the

received 13.56 MHz input sine-wave signal from the antenna (inp ut pins RXP an d RXN) .

It is desirable to achieve an input voltage in the range of 1.5 V to 1.65 V at the pins RXP,

RXN. For symmetric antennas, the voltage levels are the same on the pins RXP, RXN. A

voltage lowe r than 1.5 V lead to a reduced sensitivity of the receiver, a voltage level high er

than 1.65 V could result in clipping of the received signal in the signal processing unit of

the PN5180. Both conditions should be avoided for optimum performance of the IC. An

antenna detuning caused by the presence of a card, or mobile phone will typically result in

an RX input level which is outside the desire d input volt ag e range. Her e the AGC help s to

simplify the desig n by keeping the RX voltage automatically within the range of 1.5 V to

1.65 V even under dynamic changing antenna detuning conditions.

Functional description:

The peak of the input signal at RXP is regulated to be equal to a reference voltage

(internally generated from the supply using a resistive divider). Two external resistors are

connected to the RX inputs, the specific value of these resistors in a given design

depends on the selected antenna and needs to be determined during development. This

external resistor, together with an on-chip variable resistor conn ected to VMID, forms a

resistive voltage divider for the signal processor input voltage. The resolution of the

variable resistor is 10 bits.

By varying the on-c hip res i sto r, th e am p lit ud e of the inpu t sign a l can be mo dif i ed. Th e

on-chip resistor value is increased or decreased depending on the output of the sampled

comparator, until the peak of the input signal matches the reference voltage. The

amplitude of the RX input is therefore automatically co ntrolled by the AGC circuit.

The internal amplitude controlling resistor in the AGC has a default value of 10 kOhm typ

DC coupled. (i.e. when the resistor control bits in AGC_VAL UE_ REG <9:0> ar e all 0, th e

resistance is 10 k). As the control bits are increased, resistors are switched in parallel to

the 10k resistor thus lowering the combined resulting resistance value down to 20 Ohm

DC coupled (AGC_VALUE_REG <9:0>, all bits set to 1).

11.8.9.3 RX Wait

The guard time rx_wait is started after the end of a transmission. If the register flag

RX_WAIT_RFON_ENABLE is set to 1 the guard time is started when the device

switches off its own RF-Field and an external RF-Field was detected.

The guard time rx_wait can be disabled by setting the register RX_WAIT_VALUE to 00h

meaning the receiver is immediate ly enabled.

11.8.9.4 EMD Error handling

EMVCo

The PN5180 supports EMD handling according to the EMVCo standard. To support

further exten sio n the EMD block is configurable to allo w ad op tio n for furth e r standar d

updates.

The PN5180 supports automatically restart of the receiver and CLIF timer1 is restarted in

case of an EMD event. The CLIF timer is selectable in the EMD_CONTROL register.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 75 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

An EMD event is generated:

•Independent of received number of bytes

•Any Residual bits and EMD_CONTROL.emd_transmission_error_above_noise = 0

•When the received number of bytes without CRC is <=

EMD_CONTROL.emd_noise_bytes_threshold

•Independent of received number of bytes

•Any Residual bits and EMD_CONTROL.emd_transmission_error_above_noise = 0

•When the received number of bytes without CRC is <=

EMD_CONTROL.emd_noise_bytes_threshold

•Missing CRC (1 byte frame) when

EMD_CONTROL.emd_missing_crc_is_protocol_e rror_type_X = 0

11.8.10 Low-Power Card Detection (LPCD)

The low-power card detection is an energy saving configuration option for the PN5180.

A low frequency oscillator (LFO) is implemented to drive a wake-up counter, waking-up

PN5180 from standby mode. This allows implementation of low-power car d detection

polling loop at application level.

The SWITCH_MODE instruction allows entering the LPCD mode with a given standby

duration value.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 76 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Before entering the LPCD mode, an LPCD reference value needs to be determined.

Three options do exist for generating this reference value.

The LPCD works in two phases:

Fig 39. LPCD configu ration

aaa-020634

Wakeup_counter >

0x3FF

Set

wakeup_counter =

0x3FF

LoadRF config

Tx: A106

Rx: A106

yes

Boot ReasonAny other

Standby Mode left

| Reference_value-actual_AGC| >

LPCD_THRESHOLD

FW command

LP CD

yes

LPCD_GPO_REFVAL

_CONTROL[1:0] == 10

LPCD_GPO_REFVAL

_CONTROL[1:0] == 00

LPCD_GPO_REFVAL

_CONTROL[1:0] == 01

Reference_value ==

LPCD_REFERENCE_

VALUE

(EEProm@0x34)

Reference_value ==

AGC_REF_CONFIG

(register@0x26)

Enter Standby with

Wakeup from

Wakeup Counter

Wakeup counter

Function Call

RF_CHECKCARD(AGCRefVal=0)

AutoCalibration - Measures the

actual AGC value&Gear

and use this as a reference

Function Call

RF_CHECKCARD(AGCRefVal ==

Reference_value) Switch on RF field

and measure AGC

SET IDLE_IRQ

end state

SET LPCD_IRQ

end state

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 77 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

First the standby phase is controlled by the wake-up counter (timing defined in the

instruction), which defines the duration of the standby of the PN5180.

Second phase is the detection-phase. The RF field is switched on for a defined time

(EEPROM configuration) and then the AGC value is compared to a reference value.

•If the AGC value exceeds the reference value, a LPCD_IRQ is raised to the host. The

The host has to configure the NFC fron tend for a dedicated protocol operation to allow

a polling for a card.

•If the AGC value does not exceed the limit of the reference value, no LP C_IRQ is

raised and the IC is set to the first phase (standby mode) again.

As an additional feature the GPO1 (general-purpose output) pin can be enabled to

wake-up an external LDO from power down for the TVDD supply. The GPO1 allows

setting to high before the transmitter is switched on. This allows the wake-up of an

external LDO from power down . The GPO1 can be set to low after th e RF field is switched

off to set an exte rnal LDO into power-down mode. The time of toggling the GPO in relation

to the RF-on and RF-off timings can be configured in EEPROM addresses 0x39 and

0x3A.

These two phases are executed in a loop until

1. Card / metal is detected (LPCD_IRQ is raised).

2. Reset occurs, which resets all the system configurations. The LPCD is also stoppe d in

this case.

3. NSS on Host IF

4. RF Level Detected

The behavior of the generated field is differen t dependent on the activation state of the

DPC function:

•If the DPC feature is not active, the ISO/IEC14443 type A 106 kbit/s settings ar e used

during the sensing time.

•If the DPC is active, the RF_ON command is executed. The RF field is switched on a s

soon as the timer configured by the SWITCH_M ODE command elap ses. The RF field

is switched on for a duration as defined for an activated DPC. The timer for the

LPCD_FIELD_ON_TIME star ts to count as soon a s the RF_ON command terminates.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 78 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 63. Low-Power Card Detection: EEPR OM con figuration

EEPROM

address Name Bit value Description

0x34 LPCD_REFERENCE_VALUE - - 2 bytes: bit 9:0 AGC reference value; bit 13:10 AGC gear

0x36 LPCD_FIELD_ON_TIME - - 1 byte: Defines the RF-ON time for the AGC measurement.

The minimum RF-ON time depends on the antenna

configuration and the connected matching network. It needs

to be chosen in such a way that a stable condition for the

AGC measurement is given at the end of the time. The byte

defines the delay multiplied by 8 in microseconds.

0x37 LPCD_THRESHOLD - - 1 byte: Defines the AGC threshold value. This value is used

to compare against the current AGC value during the

low-power card detection phase. if the difference between

AGC reference value and current AGC value is greater than

LPCD_THRESHOLD, the IC wake s up from LPCD.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 79 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

0x38 up to firmware version 3.5:

LPCD_REFVAL_CONTROL - - LPCD Reference Value Selection and GPO control

2 Control of GPO1 in relation to RF-ON

1 Enable Control (e.g. for external TVDD LDO) via GPO1

0 Disable Control (e.g. for external TVDD LDO) via GPO1

1:0 Source of AGC reference value

11 RFU

10 Use AGC Reference value and AGC gear from the register

AGC_REG_CONFIG.

01 Use one AGC measurement to get reference value

00 Use EEPROM value for reference value

from firmware version 3.6 onwards

LPCD_REFVAL_GPO_CONTROL - - This byte in EEPROM is used to control the GPO assertion

during wake-up and LPCD card detect.

1:0 - Defines the source of the LPCD reference value

00 Use EEPROM Value for reference value

01 Use one AGC measurement to get reference value

10 Use AGC Reference value and AGC gear from the register

AGC_REG_CONFIG.

11 RFU

2 - Allows enabling a GPO output level change during wake-up

from standby, before the RF field is switched on. This allows

waking-up an external LDO or DC/DC supplying the

transmitter (pin TVDD).

0 Disable Control for external TVDD LDO via GPO1

1 Enable Control for external TVDD LDO via GPO1

3 - GPO2 Control for external TVDD LDO during wake-up from

standby

0 Disable Control of external TVDD LDO via GPO2 on LPCD

Card Detect

1 Enable Control of external TVDD LDO via GPO2 on LPCD

Card Detect

4 - GPO1 Control for external TVDD LDO during wake-up from

standby

0 Disable Control of external TVDD LDO via GPO1 on

wake-up from standby

1 Enable Control of external TVDD LDO via GPO1 on

wake-up from standby

0x39 LPCD_GPO_TOGGLE_BEFORE_

FIELD_ON - - 1 byte: This value defines the time between setting GPO1

until field is switched on. The byte defines the time

multiplied by 5 in microseconds.

0x3A LPCD_GPO_TOGGLE_AFTER_

FIELD_ON - - 1 byte: This value defines the time between field off and

clearing GPO1. The byte defines the time multiplied by 5 in

microseconds.

Table 63. Low-Power Card Detection: EEPR OM con figuration

EEPROM

address Name Bit value Description

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 80 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.8.10.1 Check Card register

The Check Card register at register 0x26 performs one LPCD cycle. This means that only

the second phase - the detection phase is executed.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 81 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.9 Register overview

11.9.1 Register overview

Table 64. Register ad dress overview

Address (HEX) Address (decimal) Name

0h 0 SYSTEM_CONFIG

1h 1 IRQ_ENABLE

2h 2 IRQ_STATUS

3h 3 IRQ_SET_CLEAR

4h 4 TRANSCEIVER_CONFIG

5h 5 PADCONFIG_REG

6h 6 RFU

7h 7 PADOUT_REG

8h 8 TIMER0_STATUS

9h 9 TIMER1_STATUS

Ah 10 TIMER2_STATUS

Bh 11 TIMER0_RELOAD

Ch 12 TIMER1_RELOAD

Dh 13 TIMER2_RELOAD

Eh 14 TIMER0_CONFIG

Fh 15 TIMER1_CONFIG

10h 16 TIMER2_CONFIG

11h 17 RX_WAIT_CONFIG

12h 18 CRC_RX_CONFIG

13h 19 RX_STATUS

14h 20 TX_UNDERSHOOT_CONFIG

15h 21 TX_OVERSHOOT_CONFIG

16h 22 TX_DATA_MOD

17h 23 TX_WAIT_CONFIG

18h 24 TX_CONFIG

19h 25 CRC_TX_CONFIG

1Ah 26 SIGPRO_CONFIG

1Bh 27 SIGPRO_CM_CONFIG

1Ch 28 SIGPRO_RM_CONFIG

1Dh 29 RF_STATUS

1Eh 30 AGC_CONFIG

1Fh 31 AGC_VALUE

20h 32 RF_CONTROL_TX

21h 33 RF_CONTROL_TX_CLK

22h 34 RF_CONTROL_RX

23h 35 LD_CONTROL

24h 36 SYSTEM_STATUS

25h 37 TEMP_CONTROL

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 82 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

11.9.2 Register description

26h 38 CHECK_CARD_RESULT

27h 39 DPC_CONFIG

28h 40 EMD_CONTROL

29h-7Ah 38-127 RFU

Table 64. Register ad dress overview …continued

Address (HEX) Address (decimal) Name

Table 65. SYSTEM_CONFIG register (address 0000h) bit description

Bit Symbol Access Value Description

31:9 RFU R 0*,1 Reserved

9 AUTOCOLL_PICC_STATE R/W 0*,1 Defines the entry state of the PICC T ypeA state

machine when Autocoll mode is entered 0.

8 SOFT_RESET W 0*,1 performs a reset of the device by writing a “1” into this

7RFU R/W0*,1RFU

6 MFC_CRYPTO_ON R/W 0*,1 If set to 1, the mfc-crypto is enabled for

end-/de-cryption

5 PRBS_TYPE R/W 0*,1 Defines the PRBS type; If set to 1, PRBS15 is

selected, default value 0 selects PRBS9

4RFU R/W0*,1RFU

3 START_SEND R/W 0*,1 If set to 1, this triggers the data transmission

according to the transceive state machine

0:2 COMMAND R/W 00 1* These bits define the command for the transceive

state ma chi n e :

000 IDLE/StopCom Command; stops all ongoing

communication and set the CLIF to IDLE mode

001 RFU

010 RFU

011 Transceive command; initiates a transceive cycle.

Note: Depending on the value of the Initiator bit, a

transmission is started or the receiver is enabled

Note: The transceive command does not finish

automatically. It stays in the transceive cycle until

stopped via the IDLE/StopCom command

100 KeepCommand command; This command does not

change the content of the command register and

might be used in case other bits in the register are to

be changed

101 LoopBack command; This command is for test

purposes only. It starts a transmission and at the

same time enables the receiver.

110 PRBS command, performs an endless transmission

of PRBS data

111 RFU

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 83 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 66. IRQ_ENABLE register (address 0001h) bit description

Bit Symbol Access Value Description

17 TEMPSENS _ERROR_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the

TempSensor

16 RX_SC_DET _IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RX

Subcarrier Detection

15 RX_SOF_DET_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RX SOF

Detection

14 RFU R/W 0*, 1 -

13 TIMER2 _IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer2

12 TIMER1 _IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer1

11 TIMER0_IRQ_ EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer0

10 RF_ACTIVE_ERROR_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF active

error

9 TX_RFON_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field ON

in PCD

8 TX_RFOFF_IR Q_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field

OFF in PCD

7 RFON_DET_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field ON

detection

6 RFOFF_DETQ_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field

OFF detection

5 STATE_CHANGE_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the State

Change in the transceive state machine

4 CARD_ACTIVATED_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin when PN5180 is

activated as a Card

3 MODE_DETECTED_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin when PN5180 is

detecting an external modulation scheme

2 IDLE_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the IDLE mode

1 TX_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for End of RF

transmission

0 RX_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for End of RF

reception

Table 67 . IRQ_STAT US reg ister (address 0002h) bit description

Bit Symbol Access Value Description

31:20 RFU R/W 0*, 1 -

19 LPCD_IRQ_STAT R/W 0*, 1 Low-Power Card Detection IRQ

18 HV_ERROR_IRQ_STAT R/W 0*, 1 EEPROM Failure during Programming IRQ

17 GENERAL_ERROR _IRQ_STAT R/W 0*, 1 General Error IRQ

16 TEMPSENS_ERROR_IRQ_STA

TR/W 0*, 1 Temperature Sensor IRQ

15 RX_SC_DET_IRQ_STAT R/W 0*, 1 RX Subcarrier Detection IRQ

14 RX_SOF_DET_IRQ_STAT R/W 0*, 1 RX SOF Detection IRQ

13 TIMER2_IRQ_STAT R/W 0*, 1 Timer2 IRQ

12 TIMER1_IRQ_STAT R/W 0*, 1 Timer1 IRQ

11 TIMER0_IRQ_STAT R/W 0*, 1 Timer0 IRQ

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 84 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

10 RF_ACTIVE_ERROR_IRQ_STA

TR/W 0*, 1 RF active error IRQ

9 TX_RFON_IRQ_STAT R/W 0*, 1 RF Field ON in PCD IRQ

8 TX_RFOFF_IRQ_STAT R/W 0*, 1 RF Field OFF in PCD IRQ

7 RFON_DET_IRQ_STAT R/W 0*, 1 RF Field ON detection IRQ

6 RFOFF_DET_IRQ_STAT R/W 0*, 1 RF Field OFF detection IRQ

5 STATE_CHANGE_ IRQ_STAT R/W 0*, 1 State Change in the transceive state machine IRQ

4 CARD_ACTIVATED_IRQ_STAT R/W 0*, 1 Activated as a Card IRQ

3 MODE_DETECTED_IRQ_STAT R/W 0*, 1 Exter nal modulation scheme detection IRQ

2 IDLE_IRQ_STAT R/W 0*, 1 IDLE IRQ

1 TX_IRQ_STAT R/W 0*, 1 End of RF transmission IRQ

0 RX_IRQ_STAT R/W 0*, 1 End of RF recepti on IRQ

Table 67 . IRQ_STAT US reg iste r (address 0002h) bit description …continued

Bit Symbol Access Value Description

Table 68. IRQ_CLEAR register (address 0003h) bit description

Bit Symbol Access Value Description

20 LPCD_IRQ_CLR R/W 0*, 1 Clear Low-Power Card Detection IRQ

19 HV_ERROR_IRQ_CLR R/W 0*, 1 Clear EEPROM Failure during Programming IRQ

18 GENERAL_ERROR _IRQ_CLR R/W 0*, 1 Clear General Error IRQ

17 TEMPSEN S _ERROR_IRQ_CLR R/W 0*, 1 Clear Temperature Sensor IRQ

16 RX_SC _DET_IRQ_STAT R/W 0*, 1 Clear RX Subcarrier Detection IRQ

15 RX_SOF_DET_IRQ_STAT R/W 0*, 1 Clear RX SOF Detection IRQ

14 RFU R/W 0*, 1 -

13 TIMER2_IRQ_CLR R/W 0*, 1 Clear Timer2 IRQ

12 TIMER1_IRQ_CLR R/W 0*, 1 Clear Timer1 IRQ

11 TIMER0_IRQ_CLR R/W 0*, 1 Clear Timer0 IRQ

10 RF_ACTIVE_ERROR_IRQ_CLR R/W 0*, 1 Clear RF active error IRQ

9 TX_RFON_IRQ_CLR R/W 0*, 1 Clear RF Field ON in PCD IRQ

8 TX_RFOFF_IRQ_CLR R/W 0*, 1 Clear RF Field OFF in PCD IRQ

7 RFON_DET_IRQ_CLR R/W 0*, 1 Clear RF Field ON detection IRQ

6 RFOFF_DET_IRQ_CLR R/W 0*, 1 Clear RF Field OFF detecti on IRQ

5 STATE_CHANGE_IRQ_CLR R/W 0*, 1 Clear State Change in the transceive state machine

IRQ

4 CARD_ACTIVATED _IRQ_CLR R/W 0*, 1 Clear Activated as a Card IRQ

3 MODE_DETECTED_IRQ_CLR R/W 0*, 1 Clear External modulation scheme detection IRQ

2 IDLE_IRQ_CLR R/W 0*, 1 Clear IDLE IRQ

1 TX_IRQ_CLR R/W 0*, 1 Clear End of RF transmission IRQ

0 RX_IRQ_CLR R/W 0*, 1 Clear End of RF reception IRQ

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 85 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 69 . TRANSCEIVE_CONTROL register (address 0004h) bit description

Bit Symbol Access Value Description

4-9 STATE_TRIGGER_SELECT R/W 000000* Reg ister to select the state to trigger the

STATE_CHANGE_IRQ flag. Each bit of the bit field

enables one state - several states are possible. Note:

If all bits are 0 no IRQ is triggered.

xxxxx1 IDLE state enabled to trigger IRQ

xxxx1x WaitTransmit state enabled to trigger IRQ

xxx1xx Transmitting state enabled to trigger IRQ

xx1xxx WaitReceive state enabled to trigger IRQ

x1xxxx WaitForData state enabled to trigger IRQ

1xxxxx Rece iving state enabled to trigger IRQ

3 TX_SKIP_SEND_ENABLE R/W 0*, 1 If set, not transmission is started after tx_wait is

expired and START_SEND was set Note: The bit is

cleared by HW when the WaitReceive state is

entered.

2 TX_FRAMESTEP_ENABLE R/W 0*, 1 If set, at every start of transmission; each byte of data

is sent in a separate frame. SOF and EOF are

appended to the data byte according to the framing

settings. After one byte is transmitted; the TxEncoder

waits for a new start trigger to continue with the next

byte.

1 RX_MULTIPLE_ ENABLE R/W 0*, 1 If set, the receiver is reactivated after the end of a

reception. A status byte is written to the RAM

containing all relevant status information of the frame.

Note: Data in RAM is word aligned therefore empty

bytes of a data Word in RAM are padded with 0x00

bytes. SW has to calculate the correct address for the

following frame.

0 INITIATOR R/W 0*, 1 If set, the CLIF is configured for initiator mode.

Depending on this setting, the behavior of the

transceive co mma nd is di fferent

Table 70 . PINCONFIG register (address 0005h) bit description

Bit Symbol Access Value Description

7 EN_SLEW_RATE_CONTROL R/W 0*, 1 Enables sl ew rate control of di gi tal pads

6 GPO7_DIR R/W 0*, 1 Enables the output driver of GPO7. The GPO is only

available for the package TFBGA64

5 GPO6_DIR R/W 0*, 1 Enables the output driver of GPO6. The GPO is only

available for the package TFBGA64

4 GPO5_DIR R/W 0*, 1 Enables the output driver of GPO5. The GPO is only

available for the package TFBGA64

3 GPO4_DIR R/W 0*, 1 Enables the output driver of GPO4. The GPO is only

available for the package TFBGA64

2 GPO3_DIR R/W 0*, 1 Enables the output driver of GPO3. The GPO is only

available for the package TFBGA64

1 GPO2_DIR R/W 0*, 1 Enables the output driver of GPO2. The GPO is only

available for the package TFBGA64

0 GPO1_DIR R/W 0*, 1 Enables the output driver of GPO1. The GPO is only

available for the package TFBGA64 and HVQFN40

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 86 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 71 . PIN_OUT register (address 00 07h) bit description

Bit Symbol Access Value Description

6 GPO7_OUT R/W 0*, 1 Output value of GPO7. The GPO is only available for

the package TFBGA64

5 GPO6_OUT R/W 0*, 1 Output value of GPO6. The GPO is only available for

the package TFBGA64

4 GPO5_OUT R/W 0*, 1 Output value of GPO5. The GPO is only available for

the package TFBGA64

3 GPO4_OUT R/W 0*, 1 Output value of GPO4. The GPO is only available for

the package TFBGA64

2 GPO3_OUT R/W 0*, 1 Output value of GPO3. The GPO is only available for

the package TFBGA64

1 GPO2_OUT R/W 0*, 1 Output value of GPO2. The GPO is only available for

the package TFBGA64

0 GPO1_OUT R/W 0*, 1 Output value of GPO1. The GPO is only available for

the package TFBGA64 and HVQFN40

Table 72 . TIMER0_STATUS registe r (address 0008h) bit description

Bit Symbol Access Value Description

20 T0_RUNNING R 0*, 1 Indicates that timer T0 is running (busy)

19:0 T0_VALUE R 00000h* -

FFFFFh Value of 20bit counter in timer T0

Table 73 . TIMER1_STATUS registe r (address 0009h) bit description

Bit Symbol Access Value Description

20 T1_RUNNING R 0*, 1 Indicates that timer T1 is running (busy)

19:0 T1_VALUE R 00000h* -

FFFFFh Value of 20bit counter in timer T1

Table 74 . TIMER2_STATUS registe r (address 000Ah) bit description

Bit Symbol Access Value Description

20 T2_RUNNING R 0*, 1 Indicates that timer T2 is running (busy)

19:0 T2_VALUE R 00000h* -

FFFFFh Value of 20bit counter in timer T2

Table 75 . TIMER0_RELOAD register (ad dress 000Bh) bit description

Bit Symbol Access Value Description

20:32 - RFU

19:0 T0_RELOAD_VALUE R/W 00000h* -

FFFFFh Reload value of the timer T0.

Table 76 . TIMER1_RELOAD register (ad dress 000Ch) bit description

Bit Symbol Access Value Description

20:32 - RFU

19:0 T1_RELOAD_VALUE R/W 00000h* -

FFFFFh Reload value of the timer T1.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 87 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 77 . TIMER2_RELOAD register (ad dress 000Dh) bit description

Bit Symbol Access Value Description

20:32 - RFU

19:0 T2_RELOAD_VALUE R/W 00000h* -

FFFFFh Reload value of the timer T2.

Table 78 . TIMER0_CONFIG register (addr ess 000Eh) bit description

Bit Symbol Access Value Description

20 T0_STOP_ON_RX_STARTED R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped

when a data reception begins and the first 4 bits had

been received. The additiona l delay of the timer is

protocol-dependent and listed in the appendix.

19 T0_STOP_ON_TX_STARTED R/W 0* T0_STOP_EVENT: If set; the time r T0 is stopped

when a data transmission begins.

18 T0_STOP_ON_RF_ON_EXT R/W 0* T0 _STOP_EVENT: If set; the timer T0 is stopped

when the external RF field is detected.

17 T0_STOP_ON_RF_OFF_EXT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped

when the external RF field vanishes.

16 T0_STOP_ON_RF_ON_INT R/W 0* T0_STOP_EVENT: If set; the timer T0 i s stopped

when the internal RF field is tu rned on.

15 T0_STOP_ON_RF_OFF_INT R/W 0* T0_STOP_EVENT: If set; the timer T 0 is stopped

when the internal RF field is turned off.

14 T0_START_ON_RX_STARTED R/W 0* T0_START_EVENT: If set; the timer T0 is started

when a data reception begins (first bit is received).

13 T0_START_ON_RX_ENDED R/W 0* T0_START_EVENT: If set; the timer T0 is started

when a data reception ends.

12 T0_START_ON_TX_STARTED R/W 0* T0_START_EVENT: If set; the timer T0 is started

when a data transmission begins.

11 T0_START_ON_TX_ENDED R/W 0* T0_START_EVENT: If set; the timer T0 is started

when a data transmission end s.

10 T0_START_ON_RF_ON_EXT R/W 0* T0_START_EVENT: If set; the timer T0 is started

when the external RF field is detected.

9 T0_START_ON_RF_OFF_EXT R/W 0* T0_START_EVENT: If set; the timer T0 is started

when the extern al RF field is not detected any more.

8 T0_START_ON_RF_ON_INT R/W 0* T0_START_EVENT: If set; the time r T0 is started

when an internal RF field is turned on.

7 T0_START_ON_RF_OFF_INT R/W 0* T0_START_EVENT: If set; the timer T0 is started

when an internal RF field is turned off.

6 T0_START_NOW R/W 0* T0_START_EVENT: If set; the timer T0 is started

immediately.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 88 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

3:5 T0_PRESCALE_SEL R/W 000b* Controls frequency/period of the timer T0 when the

prescaler is activated in T0_MODE_SEL :

000b 6.78 MHz counter

001b 3.39 MHz counter

010b 1.70 MHz counter

011b 848 kHz counter

100b 424 kHz counter

101b 212 kHz counter

110b 106 kHz counter

111b 53 kHz counter

2 T0_MODE_SEL R/W 0* Configuration of the timer T0 clock. 0b* Prescaler is

disabled: the timer frequency matches CLIF clock

frequency (13.56 MHz). 1b Prescaler is enabled: the

timer operates on the prescaler signal frequency

(chosen by T0_PRESCALE_SEL).

1 T0_RELOAD_ENABLE R/W 0* If set to 0; the timer T0 stops on exp iration. 0* After

expiration the timer T0 stops counting; i.e.; remain

zero; reset value. 1 After expiration the timer T0

reloads its preset value and continues counting down.

0 T0_ENABLE R/W 0* Enables the time r T0

Table 78 . TIMER0_CONFIG register (addr ess 000Eh) bit description …continued

Bit Symbol Access Value Description

Table 79 . TIMER1_CONFIG re gister (address 000Fh) bit description

Bit Symbol Access Value Description

20 T1_STOP_ON_RX_STARTED R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped

when a data reception begins and the first 4 bits had

been received. The additiona l delay of the timer is

protocol-dependent and listed in the appendix.

19 T1_STOP_ON_TX_STARTED R/W 0* T1_STOP_EVENT: If set; the time r T1 is stopped

when a data transmission begins.

18 T1_STOP_ON_RF_ON_EXT R/W 0* T1 _STOP_EVENT: If set; the timer T1 is stopped

when the external RF field is detected.

17 T1_STOP_ON_RF_OFF_EXT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped

when the external RF field vanishes.

16 T1_STOP_ON_RF_ON_INT R/W 0* T1_STOP_EVENT: If set; the timer T1 i s stopped

when the internal RF field is tu rned on.

15 T1_STOP_ON_RF_OFF_INT R/W 0* T1_STOP_EVENT: If set; the timer T 1 is stopped

when the internal RF field is turned off.

14 T1_START_ON_RX_STARTED R/W 0* T1_START_EVENT: If set; the timer T1 is started

when a data reception begins (first bit is received).

13 T1_START_ON_RX_ENDED R/W 0* T1_START_EVENT: If set; the timer T1 is started

when a data reception ends.

12 T1_START_ON_TX_STARTED R/W 0* T1_START_EVENT: If set; the timer T1 is started

when a data transmission begins.

11 T1_START_ON_TX_ENDED R/W 0* T1_START_EVENT: If set; the timer T1 is started

when a data transmission end s.

10 T1_START_ON_RF_ON_EXT R/W 0* T1_START_EVENT: If set; the timer T1 is started

when the external RF field is detected.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 89 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

9 T1_START_ON_RF_OFF_EXT R/W 0* T1_START_EVENT: If set; the timer T1 is started

when the extern al RF field is not detected any more.

8 T1_START_ON_RF_ON_INT R/W 0* T1_START_EVENT: If set; the time r T1 is started

when an internal RF field is turned on.

7 T1_START_ON_RF_OFF_INT R/W 0* T1_START_EVENT: If set; the timer T1 is started

when an internal RF field is turned off.

6 T1_START_NOW R/W 0* T1_START_EVENT: If set; the timer T1 is started

immediately.

3:5 T1_PRESCALE_SEL R/W 000b* Controls frequency/period of the timer T1 when the

prescaler is activated in T1_MODE_SEL :

000b 6.78 MHz counter

001b 3.39 MHz counter

010b 1.70 MHz counter

011b 848 kHz counter

100b 424 kHz counter

101b 212 kHz counter

110b 106 kHz counter

111b 53 kHz counter

2 T1_MODE_SEL R/W 0* Configuration of the timer T1 clock. 0b* Prescaler is

disabled: the timer frequency matches CLIF clock

frequency (13.56 MHz). 1b Prescaler is enabled: the

timer operates on the prescaler signal frequency

(chosen by T1_PRESCALE_SEL).

1 T1_RELOAD_ENABLE R/W 0* If set to 0; the timer T1 stops on exp iration. 0* After

expiration the timer T1 stops counting; i.e.; remain

zero; reset value. 1 After expiration the timer T1

reloads its preset value and continues counting down.

0 T1_ENABLE R/W 0* Enables the time r T1

Table 79 . TIMER1_CONFIG re gister (address 000Fh) bit description …continued

Bit Symbol Access Value Description

Table 80 . TIMER2_CONFIG re gister (address 0010h) bit descriptio n

Bit Symbol Access Value Description

20 T2_STOP_ON_RX_STARTED R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped

when a data reception begins and the first 4 bits had

been received. The additiona l delay of the timer is

protocol-dependent and listed in the appendix.

19 T2_STOP_ON_TX_STARTED R/W 0* T2_STOP_EVENT: If set; the time r T2 is stopped

when a data transmission begins.

18 T2_STOP_ON_RF_ON_EXT R/W 0* T2 _STOP_EVENT: If set; the timer T2 is stopped

when the external RF field is detected.

17 T2_STOP_ON_RF_OFF_EXT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped

when the external RF field vanishes.

16 T2_STOP_ON_RF_ON_INT R/W 0* T2_STOP_EVENT: If set; the timer T2 i s stopped

when the internal RF field is tu rned on.

15 T2_STOP_ON_RF_OFF_INT R/W 0* T2_STOP_EVENT: If set; the timer T 2 is stopped

when the internal RF field is turned off.

14 T2_START_ON_RX_STARTED R/W 0* T2_START_EVENT: If set; the timer T2 is started

when a data reception begins (first bit is received).

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 90 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

13 T2_START_ON_RX_ENDED R/W 0* T2_START_EVENT: If set; the timer T2 is started

when a data reception ends.

12 T2_START_ON_TX_STARTED R/W 0* T2_START_EVENT: If set; the timer T2 is started

when a data transmission begins.

11 T2_START_ON_TX_ENDED R/W 0* T2_START_EVENT: If set; the timer T2 is started

when a data transmission end s.

10 T2_ START_ON_RF_ON_EXT R/W 0* T2_START_EVENT: If set; the timer T2T2 is started

when the external RF field is detected.

9 T2_START_ON_RF_OFF_EXT R/W 0* T2_START_EVENT: If set; the timer T2 is started

when the extern al RF field is not detected any more.

8 T2_START_ON_RF_ON_INT R/W 0* T2_START_EVENT: If set; the time r T2 is started

when an internal RF field is turned on.

7 T2_START_ON_RF_OFF_INT R/W 0* T2_START_EVENT: If set; the timer T2 is started

when an internal RF field is turned off.

6 T2_START_NOW R/W 0* T2_START_EVENT: If set; the timer T2 is started

immediately.

3:5 T2_PRESCALE_SEL R/W 000b* Controls frequency/period of the timer T2 when the

prescaler is activated in T2_MODE_SEL :

000b 6.78 MHz counter

001b 3.39 MHz counter

010b 1.70 MHz counter

011b 848 kHz counter

100b 424 kHz counter

101b 212 kHz counter

110b 106 kHz counter

111b 53 kHz counter

2 T2_MODE_SEL R/W 0* Configuration of the timer T2 clock. 0b* Prescaler is

disabled: the timer frequency matches CLIF clock

frequency (13.56 MHz). 1b Prescaler is enabled: the

timer operates on the prescaler signal frequency

(chosen by T2_PRESCALE_SEL).

1 T2_RELOAD_ENABLE R/W 0* If set to 0; the timer T2 stops on exp iration. 0* After

expiration the timer T2 stops counting; i.e.; remain

zero; reset value. 1 After expiration the timer T2

reloads its preset value and continues counting down.

0 T2_ENABLE R/W 0* Enables the time r T2

Table 80 . TIMER2_CONFIG re gister (address 0010h) bit descriptio n …continued

Bit Symbol Access Value Description

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 91 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 81. RX_WAIT_CONFIG (address 0011h) bit description

Bit Symbol Access Value Description

8:27 RX_WAIT_VALUE R/W 0* Defines the rx_wait timer reload value. Note: If set to

00000h, the rx_wait guard time is disabled

0:7 RX_WAIT_PRESCALER R/W 0* Defines the prescaler reload value for the rx_wait

timer.

For correct DPC operati on, it is requ ired to set the

prescaler to 0x7F

For type A communication, the prescaler has to be set

to 0x7F as well.

Table 82 . CRC_RX_CONFIG (address 0012h) bit description

Bit Symbol Access Value Description

31:16 RX_CRC_PRESET_VALUE R/W 0*-FFFFh Arbitrary preset value for the Rx-Encoder CRC

calculation.

15:12 RFU R 0 Reserved

11 RX_PARITY_TYPE R/W 0* Defines which type of the parity-bit is used Note: This

bit is set by the mod-detector if automatic mode

detection is enabled and ISO14443A communication

is detected. 0 Even parity calculation is used 1 Odd

parity calculation is used

10 RX_P ARITY_ENABLE R/W 0* If set to 1; a parity-bit for each byte is expected; will be

extracted from data stream and checked for

correctness. In case the parity-bit is incorrect; the

RX_DATA_INTEGRITY_ERROR flag is set.

Nevertheless the reception is continued. Note: This bit

is set by the mod-detector if automatic mode detection

is enabled and ISO14443A communication is

detected.

9 VALUES_AFTER_COLLISION R/W 0* This bit defined the value of bits received after a

collision occurred. 0* All received bits after a collision

will be cleared. 1 All received bits after a collision

keep their value.

8:6 RX_BIT_ALIGN R/W 0* RxAlign define s the bit position within the byte for the

first bit received. Further received bits are stored at

the following bit positions.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 92 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

5:3 RX_CRC_PRESET_SEL R/W 000b* Preset values of the CRC register for the Rx-Decoder .

For a CRC calculation using 5bits, only the LSByte is

used.

000b* 0000h, reset value. This configuration is set by the

Mode detector for FeliCa.

001b 6363h, this configuration is set by the Mode detector

for ISO14443 type A.

010b A671h

011b FFFFh, this configuration is set by the Mode detector

for ISO14443 type B.

100b 0012h

101b E012h

110b RFU

111b Use arbitrary preset value

RX_CRC_PRESET_VALUE

2 RX_CRC_TYPE R/W 0* Controls the type of CRC calculation for the

Rx-Decoder

0 16-bit CRC calculation, reset value

1 5-bit CRC calculation

1 RX_CRC_INV R/W 0* Controls the comparison of the CRC checksum for the

Rx-Decoder

0* Not inverted CRC value. This bit is cleared by the

Mode detector for ISO14443 type A and FeliCa.

1 Inverted CRC value: F0B8h, this bit is set by the Mode

detector for ISO14443 type B.

0 RX_CRC_ENABLE R/W 0* If set; the Rx-Decoder checks the CRC for

correctness. Note: This bit is set by the Mode

Detector when ISO14443 type B or FeliCa (212 kbit/s

or 424 kbit/s) is detected.

Table 82 . CRC_RX_CONFIG (address 0012h) bit description …continued

Bit Symbol Access Value Description

Table 83. RX_STATUS_REG register (address 0013h) bit description

Bit Symbol Access Value Description

26:31 RFU R 0 Reserved

19:25 RX_COLL_POS R 0* These bits show the bit position of the first detected

collision in a received frame (only data bits are

interpreted).

Note: These bits shall only be interpreted in passive

communication mode at 106 kbit/s or ISO/IEC14443

A /MIFARE reader / writer mode if bit CollPosValid is

set to 1.

Note: If RX_ALIGN is set to a value differe nt to 0, th i s

value is included in the RX_COLL_POS.

18 RX_COLLISION_DET ECTED R 0* This flag is set to 1, when a collision has occurred.

The position of the first collision is shown in th e

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 93 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

17 RX_PROTOCOL_ERROR R 0* This flag is set to 1, when a protocol error has

occurred. A protocol error can be a wrong stop bit, a

missing or wrong ISO/IEC14443 B EOF or SOF or a

wrong number of received data bytes.

Note: When a protocol error is detected, data

reception is stopped.

Note: The flag is automatically cleared at start of next

reception.

16 RX_DATA_INTEGRITY_ERROR R 0* This flag is set to 1, if a data integrity error has been

detected. Possible caused can be a wrong parity or a

wrong CRC.

Note: On a data integrity error, the reception is

continued

Note: The flag is automatically cleared at start of next

reception.

Note: If a reversed parity bit is a stop criteria, the flag

is not set to 1 if there is a wrong parity.

13:15 RX_NUM_LAST_BITS R 0* Defines the number of valid bits of the last data byte

received in bit-oriented communications. If zero the

whole byte is valid.

9:12 RX_NUM_FRAMES_RECEIVED R 0* Indicates the number of frames received. The value is

updated when the RxIRQ is raised.

Note: This bit field is only valid when the RxMultiple is

active (bit RX_MULTIPLE_ENABLE set)

8:0 RX_NUM_BYTES_RECEIVED R 0* Indicates the number of bytes received. The value is

valid when the RxIRQ is raised until the receiver is

enabled again.

Table 83. RX_STATUS_REG register (address 0013h) bit description …continued

Bit Symbol Access Value Description

Table 84 . TX_UNDERSHOOT_CONFIG register (address 0014h) bit description

Bit Symbol Access Value Description

16:31 TX_UNDERSHOOT_PATTERN Undershoot pattern which is transmitted after each

falling edge.

5:15 RESERVED -

1:4 TX_UNDERSHOOT_PATTERN_

LEN Defines length of the undershoot prevention pattern

(value +1). The pattern is applied starting from the

LSB of the defined pattern; all other bits are ignored.

0 TX_UNDERSHOOT_PROT_ENA

BLE If set to 1; the undershoot protection is enabled

Table 85 . TX_OVERSHOOT_CONFIG register (address 0015h) bit description

Bit Symbol Access Value Description

31:16 TX_OVERSHOOT_PATTERN R/W 0* -

FFFFh Overshoot pattern which is transmitted after each

rising edge.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 94 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

15:5 RFU R 0 Reserved

4:1 TX_OVERSHOOT_PATTERN

_LEN R/W 0*-Fh Defines length of the overshoot prevention pattern

(value +1). The pattern is applied starting from the

MSB of the defined pattern, all other bits are ignored.

0 TX_OVERSHOOT_PROT

_ENABLE R/W 0*, 1 If set to 1, the overshoot protection is enabled.

Table 85 . TX_OVERSHOOT_CONFIG register (address 0015h) bit description …continued

Bit Symbol Access Value Description

Table 86. TX_DATA_MOD register (address 0016h) bit description

Bit Symbol Access Value Description

8:15 TX_DATA_MOD_WIDTH R/W 0*-FFh Specifies the le ngth of a pulse for sendin g data with

miller pulse modulation enabled. The length is given

by the number of carrier clocks + 1.

0:7 TX_BITPHASE R/W 0* - FFh Defines the number of 13.56 MHz cycles used for

adjustment of TX_WAIT to meet the FDT. This is done

by using this value as first counter initializatio n value

instead of TX_WAIT_PRESCALER.

These bits of TX_BITPHASE, together with

TX_WAIT_VALUE and TX_WAIT_PRESCALER are

defining the number of carrier frequency clocks which

are added to the waiting period before transmitting

data in all communication modes. TX_BITPHASE is

used to adjust the TX bit synchronization during

passive NFCIP-1 communication mode at 106 kbit

and in ISO/IEC 14443A and 14443A/MIFA RE card

mode.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 95 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 87. TX_WAIT_CONFIG register (address 0017h) bit description

Bit Symbol Access Value Description

27:8 TX_WAIT_VALUE D 0* -

FFFFFh Defines the tx_wait timer value.

The values TX_WAIT_VALUE and

TX_W AIT_PRESCALER ar e the initial counter values

of two independent counters. The counter linked to

TX_WAIT_PRESCALER is decremented at every

13.56 MHz clock.

As soon as the counter TX_WAIT_PRESCALER

overflows (transition from 00h to FFh), the counter

linked to TX_WAIT is decremented. At the same time,

the counter linked to TX_WAIT_PRESCALER is

reloaded with the TX_WAIT_PRESCALER value.

The first initial TX_W AIT_PRESCALER counter value

is always using the data defined in TX_BITPHASE (in

case of PICC operation). All other subsequent counter

reload values are taken from

TX_WAIT_PRESCALER.

Note: If set to 00000h the tx_wait guard time is

disabled

Note: This bit is set by HW a protocol is detected in

automatic mode detector.

7:0 TX_WAIT_PRESCALER D 0* - FFh Defines the prescaler reload value for the tx_wait

timer.

Note: This bit is set by HW a protocol is detected in

automatic mode detector.

For correct DPC operation, it is required to set the

prescaler to 0x7F

For type A communication, the prescaler has to be set

to 0x7F as well.

Table 88. TX_CONFIG register (address 0018h) bit description

Bit Symbol Access Value Description

14:31 RFU R 0 Reserved

13 TX_PARITY_LAST_INV_ENABL

ER/W 0 If set to 1; the parity bit of last sent data byte is

inverted

12 TX_PARITY_TYPE R/W 0 Defin es the type of the parity bit 0 Even Parity is

calculated 1 Odd parity is calculated

11 TX_PARITY_ENABLE R/W 0 If set to 1; a parity bit is calculated and appended to

each byte transmitted. If the Transmission Of Data Is

Enabled and TX_NUM_BYTES_2_SEND is zero;

then a NO_DATA_ERROR occurs.

10 TX_DATA_ENABLE R/W 0 If set to 1; transmission of data is enabled otherwise

only symbols are transmitted.

8:9 TX_STOP_SYMBOL R/W 0 Defines which pattern symbol is sent as frame

stop-symbol 00b No symbol is sent 01b Symbol1 is

sent 10b Symbol2 is sent 11 b Symbol3 is sent

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 96 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

6:7 TX_START_SYMBOL R/W 0 Defines which symbol pattern is sent as frame

start-symbol 00b No symbol pattern is sent 01b

Symbol0 is sent 10b Symbol1 is sent 11b Symbol2 is

sent.

3:5 TX_LAST_BITS R/W 0 Defines how many bits of the last data byte to be sent.

If set to 000b all bits of the last data byte are sent.

Note: Bits are skipped at the end of the byte

0:2 TX_FIRST_BITS R/W 0 Defines how many bits of the first data byte to be sent.

If set to 000b all bits of the last data byte are sent.

Note: Bits are skipped at the beginning of the byte

Table 88. TX_CONFIG register (address 0018h) bit description …continue d

Bit Symbol Access Value Description

Table 89 . CRC_TX_CONFIG_REG (address 0019h) bit description

Bit Symbol Access Value Description

31:16 TX_CRC_PRESET_VALUE R/W 0*-FFFFh Arbitrary preset value for the Tx-Encoder CRC

calculation.

15:7 RFU R 0 Reserved

6 TX_CRC_BYTE2_ENABLE R/W 0 If set; the CRC is calculated from the second byte

onwards (intended for HID). This option is used in the

Tx-Encoder.

5:3 TX_CRC_PRESET_SEL R/W 000-101b Preset values of the CRC register for the Tx-Encoder .

For a CRC calculation using 5 bits, only the LSByte is

used.

000b* 0000h, reset value

001b 6363h

010b A671h

011b FFFFh

100b 0012h

101b E012h

110b RFU

111b Use arbitrary preset value

TX_CRC_PRESET_VALUE

2 TX_CRC_TYPE R/W 0, 1 Controls the type of CRC calculation for the

Tx-Encoder

0* 16-bit CRC calculation, reset value

1 5-bit CRC calculation

1 TX_CRC_INV R/W 0, 1 Controls the sending of an inverted CRC value by the

Tx-Encoder

0* Not inverted CRC checksum, reset value

1 Inverted CRC checksum

0 TX_CRC_ENABLE R/W 0*, 1 If set to one, the Tx-Encoder computes and transmits

a CRC.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 97 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 90 . SIGPRO_CONFIG register (address 001Ah) bit description

Bit Symbol Access Value Description

3:31 RFU R 0 Reserved

2:0 BAUDRATE D 000*-111 Defines the baud rate of the receiving signal. The

MSB is only relevant for reader mode.

Note: These bits are set by the mode-detector if

automatic mode detector is ena bled and the

communication mode is detected.

000* Reserved

001 Reserved

010 Reserved

011 Reserved

100 106 kBd

This configuration is set by the Mode detector for

ISO/IEC14443 type A and B.

101 212 kBd

This configuration is set by the Mode detector for

FeliCa 212 kBd.

110 424 kBd

This configuration is set by the Mode detector for

FeliCa 424 kBd.

111 848 kBd

Table 91 . SIGPRO_CM_CONFIG_REG register (add ress 001Bh) bit description

Bit Symbol Access Value Description

31 RFU R 0 Reserved

29:30 RX_FRAMING Defines the framing in card mode. These bits are set

by the Mode detector if automatic mode detection is

enabled and the communicati on mode is detected.

00b: ISO14443-A / MIFARE

01b: ISO18092 (NFC - with Sync-byte 0xF0)

10b: FeliCa 11 ISO14443B

26:28 EDGE_DETECT_TAP_SEL Selects the number of taps of the edge-detector filter.

000b: Edge detector filter with 4 taps

001b: Edge detector filter with 6 taps

010b: Edge detector filter with 8 taps

011b: Edge detector filter with 8 taps

100b: Edge detector filter with 16 taps

101b: Edge detector filter with 18 taps

110b: Edge detector filter with 24 taps

111b: Edge detector filter with 32 taps

13:25 EDGE_DETECT_ TH Threshold for the edge decision block of the

ADCBCM.

0:12 BIT _DETECT_TH Threshold for the “bit” decision block of the ADCBCM.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 98 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 92 . SIGPRO_RM_CONFIG_REG register (add ress 001Ch) bit description

Bit Symbol Access Value Description

24:31 RFU R 0 Reserved

21:23 BPSK_IQ_MODE R/W 000*-111 Defines signal processing of I- and Q-channel

000* Both channels (I and Q) are used for signa l

processing

001 Use only I channel

010 Use only Q channel

011 RFU

100 Use the strongest channel

101 Use the first channel

110-111 RFU

20 BPSK_FILT6 R/W 0*-1 Reserved for test

19 RESYNC_EQ_ON R/W 0-1* Resynchronization during the SOF for an equal

correlation value is done (default = activated).

18 CORR_RESET_ON R/W 0 The correlator is reset at a reset (default = activated).

17 VALID_FILT_OFF R/W 0*-1 Disables a special filter in BPSK mode. If set to 0, the

correlation of 0110 is filtered with the correlation of

1110 and 0111. Otherwise the demo dulation is done

using the correlation with 0110

16 DATA _BEFORE_MIN R/W 0 Data is received even before the first minimu m at the

SOF (default: = deactivated).

15:12 MIN_LEVEL R/W 0*-Fh Defines the minimum level (threshold value) for the

subcarrier detector unit. Note: The MinLevel should

be higher than the noise level in the system

Note: Used for BPSK and Manchester with Subcarrier

communication types as MinLevel!

11:8 MIN_LEVEL_P R/W 0*-Fh Defines the minimum level (threshold value) for the

phase-shift detector unit. Used for BPSK

communication

7 USE_SMALL_EVAL R 0 Defines the length of the ev aluation period for the

correlator for Manchester subcarrier communication

types.

6:5 COLL_LEVEL R/W 00*-11 Defines how strong a signal must be interpreted as a

collision for Manchester subcarrier communication

types.

00* >12.5 %

01 >25 %

10 >50 %

11 No Collision

4 PRE_FILTER R/W If set to 1 four samples are combined to one data.

(average)

3 RECT_FILTER R/W 0 If set to one; the ADC-values are changed to a more

rectangular waveshape.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 99 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

2 SYNC_HIGH R/W 0*-1 Defines if the bit grid is fixed at maximum (1) or at a

minimum(0) value of the correlation.

1 FSK R 0 If set to 1; the demodulation scheme is FSK.

0 BPSK R/W 0* If set to 1, the demodulation scheme is BPSK.

Table 92 . SIGPRO_RM_CONFIG_REG register (add ress 001Ch) bit description …continued

Bit Symbol Access Value Description

Table 93 . RF_STATUS register (ad dre ss 001Dh) bit description

Bit Symbol Access Value Description

27:31 RFU R 0 -

26:24 TRANSCEIVE_STATE R 0* Holds the command bits 0* IDLE state 1 W aitT ransmit

state 2 Transmitting state 3 WaitReceive state 4

W aitForData state 5 Receiving state 6 LoopBack state

7 reserved

23:20 DPC_CURRENT_GEAR R 0* Current Gear of the DPC

19 DPLL_ENABL E R 0* This bit indicates that the DPLL Controller has

enabled the DPLL (RF on, RF frequency ok, PLL

locked)

18 CRC_OK R 0 Th is bit indicates the status of the actual CRC

calculation. If 1 the CRC is correct; meaning the CRC

CRC is used. Note: This flag should only be evaluated

at the end of a communication.

17 TX_RF_STATUS R 0 If set to 1 this bit indicates that the drivers are turned

on; meaning an RF-Field is created by the device

itself.

16 RF_DET_ST ATUS R 0 If set to 1 this bit indicates that an external RF-Field is

detected by the RF-level dete ctors (after digital

filtering)

13:15 RF_ACTIVE_ERROR_CAUSE R 0 - 5 This status flag indicates the cause of an NFC-Active

error.

Note: These bits are only valid when the

RF_ACTIVE_ERROR_IRQ is raised and is cleared as

soon as the bit TX_RF_ENABLE is set to 1.

0* No Error; reset value

1 External field was detected on within TIDT timing

2 External field was detected on within TADT timing

3 No external field was detected within TADT timings

4 Peer did switch off RF-Field but no Rx event was

raised (no data received)

5 - 7 Reserved

12 RX_ENABLE This bit indicates if the RxDecoder is enabled. If 1 the

RxDecoder was enabled by the T ransceive Unit and is

now ready for data reception

11 TX_ACTIVE This bit indicates activity of the TxEncoder. If 1 a

transmission is ongoing, otherwise the TxEncoder is

in idle state.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 100 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

10 RX_ACTIVE This bit indicates activity of the RxDecoder . If 1 a data

reception is ongoing; otherwise the RxDecoder is in

idle state.

9:0 AGC_VALUE R 0*-3FFh Current value of the AGC

0h* Most sensitive: largest Rx-resistor, i.e., none of the

switchable resistors are added in parallel

3FFh Most robust: smallest Rx-resistor, i.e., all switchable

resistors are added in parallel

Table 93 . RF_STATUS register (ad dre ss 001Dh) bit description …continued

Bit Symbol Access Value Description

Table 94. AGC_CONFIG registe r (address 001Eh) bit description

Bit Symbol Access Value Description

16:31 RFU R 0* Reserved

14:15 AGC_VREF_SEL R/W 0* Select the set value for the AGC control:_

00b: 1.15 V

01b: 1.40 V

10b: 1.50 V

11b: RFU

4:13 AGC_TI ME_CONSTANT R/W 0* Time constant for the AGC update. An AGC period is

given by (AGC_TIME_CONSTANT+1) * 13.56 MHz.

The minimum allowed value for the

AGC_TIME_CONSTANT is 4.

3 AGC_INPUT_SEL R/W 0* Selects the AGC value to be loaded into the AGC and

the data source for fix-mode operation:

0b: AGC_VALUE_REG.AGC_CM_VALUE

1b: AGC_VALUE_REG.AGC.RM_VALUE

2 AGC_LOAD W 0* If set; the RX divider setting is loaded from

AGC_VALUE_REG. AGC_INPUT_SEL defines the

source of the data. This bit is automatically cleared.

1 AGC_MODE_SEL R/W 0* Selects the fix AGC value:

0b: Rx-divider is set according to

AGC_VALUE_REG dependent on bit

AGC_INPUT_SEL

1b: The last RX divider setting before AGC contro l

operation had been deactivated is used

(AGC_ENABLE_CONTROL=0, last RX divider

setting is frozen).

This bit is not causing any loading of new Rx-divider

data. Set the bit AGC_LOAD for updating the RX

divider with a new value.

0 AGC_ENABLE_CONTROL R/W 0* 0b: Fix mode operation. The RX divider is fixed to

one value. The value is defin ed by

AGC_MODE_SEL

1b: AGC control operation enabled

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 101 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 95. AG C_VALUE_REG register (address 001F h) bit description

Bit Symbol Access Value Description

20:31 RFU R 0 Reserved

10:19 AGC_RM_VALUE R/W 0 Static AGC value used for reader mode

0:9 AGC_CM_VAL UE R/W 0 Static AGC value used for card mode

Table 96. RF_CONTROL_TX register (address 0020h) bit description

Bit Symbol Access Value Description

27:31 RFU R 0 Reserved

26 TX_ALM_TYPE_SELECT R/W 0* 0 ... Both drivers used for ALM

1 ... Single driver used for ALM

24:25 TX_CW_AMPLITUDE_ALM_CM R/W 0* set amplitude of unmodulated carrier at card mode

19:23 TX_RESIDUAL_CARRIER_OV_

PREV R/W 0* Defines the value for the residual carrier for the period

the overshoot prevention pattern is active.

18 TX_CW_TO_MAX_ALM_CM R/W 0* TX HI output is the maximum voltage obtainable from

charge pump (CM setting); if set to 1 ->

TX_CW_AMPLITUDE_CM is overruled.

13:17 TX_RESIDUAL_CARRIER R/W 0* set residual carrier (0=100 %, 1F = 0 %)

12 TX_BYPASS_SC_SHAPING R/W 0* Bypasses switched capacitor TX shaping of the

Tr ansmitter Signal and disables the shaping control

for the rising edge.

So this bit must be 0, if the TAU_MOD_RISING

settings shall apply.

The rising edge provides the fa stest rise time, if

TX_SET_BYPASS_SC_SHAPING = 1

(TAU_MOD_RISING does not matter).

8:11 TX_SLEW_SHUNTREG R/W 0* Set slew rate for shunt regulator. Set slew rate for Tx

Shaping shunt regulator (0= slowest slew rate, 0xF =

fastest slew rate) for both the falling and rising edge.

4:7 TX_TAU_MOD_F ALLING R/W 0* Transmitter TAU setting for falling edge of modulation

shape. In AnalogControl modul e, the output signal is

switched with the tx_envelope. Only valid is

TX_SINGLE_CP_MODE is set

0:3 TX_TAU_MOD_RISING R/W 0* Transmitter TAU setting for rising edge of modulation

shape. In Analog Control module, the output signal is

switched with the tx_envelope. Only valid is

TX_SINGLE_CP_MODE is set

Table 97. RF_CONTROL_TX_CLK register (address 0021h) bit description

Bit Symbol Access Value Description

19:31 RFU R 0* Reserved

18 TX_ALM_ENABLE R/W 0* If set to 1 ALM is used for transmission in card mode

14:17 RFU R RFU

1 1:13 CLOCK_CONFIG_DLL_ALM R/W 0* Configures the phase difference in integer multiples of

45° steps between the recovered and the transmitted

RF clock

8:10 TX_CLK_MODE_OVUN_PREV R/W 0* Defines the TX clockmode for the period the

overshoot/undershoot prevention is active

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 102 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

7 TX2_INV_RM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0

-> clk_13m56 is used

6 TX2_INV_CM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0

-> clk_13m56 is used

5 TX1_INV_RM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0

-> clk_13m56 is used

4 TX1_INV_CM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0

-> clk_13m56 is used

3:1 TX_CLK_MODE_RM R/W 0* TX clockmode

0 CLOCK_ENABLE_DPLL R/W 0* Enables th e DPLL

Table 97. RF_CONTROL_TX_CLK register (address 0021h) bit description …continued

Bit Symbol Access Value Description

Table 98 . RF_CONTROL_RX register (ad dress 0022h) bit description

Bit Symbol Access Value Description

8:31 RFU R 0* Reserved

6:7 CM_MILLER_SENS R/W Configuration bits for reference level of Miller

demodulator

4:5 RX_ MIXER_CONTROL R/W Mixer Control Enable

00, 11 … power down both mixer

01… reader mode mixer

10… card mode mixer,

2:3 RX_HPCF R/W High Pass Corner Frequency: 00->45 kHz, 01->

85 kHz, 10->150 kHz, 11->250 kHz

1:0 RX_GAIN R/W 0h*-3h Gain Adjustment BBA: 00->33 dB, 01->40 dB, 10->

50 dB, 11->57 dB

Table 99. RF_LEVEL_DETECTOR_CONTROL register (address 0023h ) bit de scription

Bit Symbol Access Value Description

15:31 RFU R 0* Reserved

14 CM_PD_NFC_DET R/W 0* Power Down NFC level detector

12:13 RFDET_SOURCE_SEL R/W 0* Selects the source for RF-Field detection; 0* ->

NFC-Leve l de te ct or i nd i ca ti on s ig n al is used; 1 ->

RF-Level detector indication signal is used 2; -> NFC-

and RF-Level detector indication signal is used 3; ->

Override - RF-Fi e ld detected is em ul ated

8:11 CM_RFL_NFC R/W 0* Programming of detection level

4:7 RFLD_REF_LO R/W 0* Higher Reference Value for RF Leve l Detecto r

0:3 RFLD_REF_HI R/W 0* Lower Reference Value for RF Level Dete ctor

Table 10 0. SYSTEM_STATUS register (address 0024h) bit description

Bit Symbol Access Value Description

9:31 RFU R 0 Reserved

8 PARAMETER_ERROR R 0* Parameter Error on Host Communication

7 SYNTAX_ERROR R 0* Syntax Error on Host Communication

6 SEMANTIC_ERROR R 0* Semantic Error on Host Communication

5 STBY_PREVENT_RFLD R 0* Entry of STBY mode prevented due to existing RFLD

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 103 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

4 BOOT_TEMP R 0* Boot Reason Temp Sensor

3 BOOT_SOFT_RESET R 0* Boot Reason due to SOFT RESET

2 BOOT_WUC R 0* Boot Reason wake-up Counter

1 BOOT_RFLD R 0* Boot Reason RF Level Detector

0 BOOT_POR R 0* Boot Reason Power on Reset / RESET_N

Table 10 0. SYSTEM_STATUS register (address 0024h) bit description …con tinue d

Bit Symbol Access Value Description

Table 10 1. TEMP_CONTROL register (address 0025h) bit descriptio n

Bit Symbol Access Value Description

4:31 RFU R 0 Reserved

3 TEMP_ENABLE_HYST R/W 0* Enable hystereses of Temperature Sensor

2 TEMP_ENABLE R/W 0* Enable Temp Sensor

0:1 TEMP_DELTA R/W 0* selects temperature value

Table 10 2. CHECK_CARD_RESULT register (address 0026h) bit description

Bit Symbol Access Value Description

14:31 RFU R 0 RFU

10:13 AGC_GEAR R/W 0 Reading from this register starts a check card routine

which is an LPCD with only one measuremen t point

without entry to standby mode. The value contains the

actual gear when DPC is used and the AGC value.

Writing to this register is used as a reference value for

the LPCD when LPCD mode 2 is used.

0:9 AGC_VALUE R/W 0

Table 10 3. DPC_CONFIG register (addre ss 0027h) bit description

Bit Symbol Access Value Description

20:31 RFU R 0

16:19 TX_GSN_CW_CM R/W 0 GSN value for continuous wave in Card Mode

12:15 TX_GSN_MOD_CM R/W 0 GSN value for modulation in Card Mode

8:11 T X _GSN_MOD_RM R/W 0 GSN value for modulation in Reader Mode

4:7 TX_GSN_CW_RM R/W 0 GSN value for continuous wave in Reader Mode

3 TX_CW_TO_MAX_RM R/W 0 Maximum output voltage on TX driver

1:2 TX_CW_AMPLITUDE_RM R/W 0 set amplitude of unmodulated carrier at reader mode

0 TX_CW_AMP_REF2TVDD RW 0 If set to 1 the reference of the unmodulated carrier is

defined relative to TVDD

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 104 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 10 4. EMD_CONTROL register (address 0028 h) bit description

Bit Symbol Access Value Description

Recommended value fo r EMVCo 2.3.1 0x185 (use Timer1)

Recommended value fo r EMVCo 2.5 0x187

10:31 RFU R 0 Reserved

8:9 EMD_TRANSMISSION_TIMER_

USED R/W 0 Timer used for RF communication.

00 Timer0,

01 Timer1,

10 Timer 2,

11 RFU

7 up to firmware version 2.4

EMD_MISSING_CRC_IS_PROT

OCOL_ERROR_TYPE_B

R/W 0 Missing CRC treated as protocol error in case of Type

B based communication. Only applicable for EMVCo

2.3.1.

from firmware 2.5 onwards R/W 0 RFU

6 up to firmware version 2.4

EMD_MISSING_CRC_IS_PROT

OCOL_ERROR_TYPE_A

R/W 0 Missing CRC treated as protocol error in case of Type

A based communication. Only applicable for EMVCo

2.3.1.

from firmware 2.5 onwards R/W 0 RFU

2:5 EMD_NOISE_BYTES_THRESH

OLD R/W 0 Defines the threshold under which transmission errors

are treated as noise. Note: CRC bytes are NOT

included/counted!

1 EMD_TRANSMISSION_ERROR

_ABOVE_NOISE_THRESHOLD

_IS_NO_EMD

R/W 0 Transmission errors with received byte length >=

EMD_NOISE_BYTES_THRESHOLD is never treated

as EMD (EMVCo 2.5 standard). All transmission with

number of received bytes < 4 bytes are treated as

EMD noise, (ignored).

For transmission errors >= 4 bytes the host is notified.

0 EMD_ENABLE R/W 0 Enable EMD handling

Table 10 5. ANT_CONTROL register (address 0029h) bit description

Bit Symbol Access Value Description

8:31 RFU R 0 Reserved

7 ANT_INVERT_ON_TXACTIVE R/W 0 If set to 1, the ANT short interface in card mode is

inverted when tx_active is asserted (i.e. while

transmission). Note: this bit is only valid in card mode.

Note: if it ANT_ALM_AUTO_SWITCH_ENABLE is set

this setting is ignored

6 ANT_ALM_AUTO_SWITCH_EN

ABLE R/W 0 If set to 1, the ANT setting for ALM is switched

automatically by HW. By defaul t for ALM the

ANT_short and ANT_mod uses the same settings as

for PLM.

5 ANT_ALM_FW_RESET R/W 0 If set to 1 the ANT setting for ALM is reset to its initial

receive configuration

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 105 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

12. Secure Firmware Update

12.1 General functionality

The PN5180 support s a secure update of the imp lemented firmware. The secure firmware

download mode is using a dedicated command set and framing which is different from the

standar d host interface commands used for NFC operation of the device.

In Secure Firmware update mode, the PN5180 requires a dedicated physical handling of

the SPI interface lines an d th e BUSY line .

The secure firmware download mode is entered by setting the DWL_REQ pin to high

during startup of the device. This pin can be used for any other functionality after startup,

the level of this pin has no impact on the dow nloa d fun ct ion alit y after startup during

standard NFC operatio n.

The firmware binary file which is used to update the PN5180 is protected with a signature.

This prevents a download of any other software which is not signed by NXP.

An anti-tearing function is implemented in order to de te ct supp ly voltage removal or

memory fault.

During the secure firmware download, the normal mode NFC operation is not available

and only the command set defined for the secure firmware download is valid.

In case of any failure or exception during the download, the PN5180 remains in the secure

firmware download mode until a full firmware update sequence has been performed

successfully.

Up dating the firmware of the PN5180 programs the memories for user EEPROM and

RF configuration with default values. Any previous user configuration will be

overwritten. The user has to take care to restore the data of these memories after a

secure firmware update.

The PN5180 can be used for firmware update as follows:

4 ANT_SHORT_SELECT_RM R/W 0 Selects the control of the ANT modulation interface in

reader mode

2:3 ANT_SHORT_SELECT R/W 0 Selects the control of the ANT short interface in

cardmode for PLM; in reader mode and ALM the

analog control signals are switched by digital logic.

00b Constant 0 (ANT open) 01b Constant 1 (ANT

short) 10b TxEnvelope used (idle = 1, modulation = 0)

11b Inverted TxEnvelope used (idle = 0, modulation =

0:1 ANT_MOD_SELECT R/W 0 Selects the control of the ANT modulation interface in

cardmode for PLM; in reader mode and ALM the

analog control signals are switched by digital logic.

00b Constant 0 (No modulation on ANT mod) 01b

Constant 1 (modulation on ANT mod) 10b

TxEnvelope used (idle = 1, modulatio n = 0) 11b

Inverted TxEnvelope used (idle = 0, modulation = 1)

Table 10 5. ANT_CONTROL register (address 0029h) bit description …continued

Bit Symbol Access Value Description

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 106 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

1. Set DWL_REQ pin to high

2. Reset

3. The PN1580 boots in download mode

4. Download new firmware version

5. Execute the check integrity command to verify the successful update (The

CheckIntegrity command cannot be called while a download session is open)

6. Reset the PN5180

7. The device starts in NFC operation mode

12.2 Physical Host Interface during Secure Firmware Download

In Secure Firmware update mode, the PN5180 is using a different physical host interface

signaling than in NFC operation mo de .

The BUSY line is used in a different way than for NFC operation mode, and the data is

packed in frames protected by a CRC16 checksum.

A complete frame transmitted in Secure Firmware Update mode consists of

For the WRITE:

1. 1 byte directio n (0 x7 F )

2. 2 byte header (chunk bit + length of (Payload + command))

3. 1 byte comman d

4. (LENGTH-1) byte payload (the LENGTH in the header includes the 1byte command,

therefore the length of the payload needs to be reduce d by 1)

5. 2 byte CRC16 (is not included in the header length number)

Fig 40. Example SPI WRITE in Secure Fi rmware Download mod e

nss

mosi 0x7f header opcode payload crc16

miso

BUSY

aaa-024800

Fig 41. Example SPI READ in Secure Firmware Download mode

nss

mosi 0xff 0xff

miso header stat payload crc16

BUSY

aaa-024799

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 107 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

For the READ:

1. 1 byte directio n (0 xF F )

2. 2 byte header (chunk bit + length of (Payload + status))

3. 1 byte status

4. (LENGTH-1) byte payload (the LENGTH in the header includes the 1byte status,

therefore the length of the payload needs to be reduce d by 1)

5. 2 byte CRC16 (is not included in the header length number)

12.3 Download Protection

Data of the PN5180 like firmware version numbers, are protected against any tearing

attempt.

The PN5180 uses a chained hash approach having the first command hash protected

with an RSA signature. The chained hash sequence binds each fr ame with the next one

comparable to an S/KEY mechanism. Hence authenticity of the downloaded code can be

Fig 42. Secure Firmware Download: SPI Write

Transfer Direction

Det. = 0XXXXXXXb

HDLL Header

Byte 0

HDLL Header

Byte 1

HDLL OpCode HDLL Payld

Byte 0

HDLL Payld

Byte n

HDLL

CRC2

HDLL

CRC1

0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF

aaa-024811

NSS

SCK

MOSI

MISO

BUSY

Fig 43. Secure Firmware Download: SPI Read

Transfer Direction

Det. = 0xFF

0xFF

dummy dummy dummy dummy dummy dummy dummy

aaa-024814

NSS

BUSY

PN5180 requests

a transfer

SCK

MOSI

HDLL Header

Byte 0

HDLL Header

Byte 1

HDLL OpCode HDLL Payld

Byte 0

HDLL Payld

Byte n

HDLL

CRC2

HDLL

CRC1

MISO

All data has been

read, IRQ is reset

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 108 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

ensured due to secrecy of the RSA private key. Any firmware which is not issued and

signed by NXP, is rejected by the security system of the PN5180 and cannot be loaded

into the memory of the device.

The security system of the PN5180 assures that no firmware data can be overwritten

without verifying the authenticity and integrity of the new data beforehand.

During the secure firmware download, a new firmware version number is sent. The

firmware version number is composed of a major and a minor number:

1. Major number: 8 bit (MSB)

2. Minor number: 8 bit (LSB)

The PN5180 checks if the new major version number is equal or higher than the current

one. In case the current major version number is larger than the already installed version

number of the firmware, the secure firmware update is rejected. Downgrading major

firmware versio ns is therefore not possible .

An integrity check command is available which can be executed by the host immediately

afte r a firmware update to check if the update had been successful.

The major and mi nor firmware version nu mbers can be read out at any time using the host

interface and commands in NFC mode to identify exactly which firmware is installed on a

dedicated hardware. It is not required to enter the secure firmware download mode to

retrieve this firmware version information.

An already st arted fir mware download may be interrupted for any of the following rea sons:

•Reset (hard or soft)

•Failure of the Signature verification of the first secure write command

•Hash chain is broken during the download between two consecutive secure write

commands

•Protocol error in framing

•Address mismatch

•critical memory failure

The PN5180 provides comprehensive mechanisms to recover from all these conditions.

12.4 Commands

12.4.1 Frame format

All messages transmitted between the host and the PN5180 have always the following

frame format: Header - Frame - CRC

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 109 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Header (2 bytes)

•RFU (bit 11..15)

•Chunk flag used for fragmentation (bit 10)

•length of the frame (bit 0..9 bit)

Frame ( (n+1) byte)

•Command (1 byte)

•Payload of the command: (n-byte)

CRC (2 bytes)

•The CRC16 is compliant to X.25 (CRC-CCITT, ISO/IEC13239) standard with

polynomial x^16 + x^12 + x^5 +1 and preload value 0xFFFF.

The payload of one command consists of

•Memory block address: 3 bytes Mem ory block size: 2 bytes

•Memory data block: 512 bytes maximum

•Hash of the next frame: 32 bytes

The first write command used for a secure firmware download inclu des the version

number, and a hash value over the following command and the RSA signature. Every

following command includes the actual data block to be updated and the hash value over

the following command and data. The last command does not contain any hash value.

The Payload including command can be split in to chunks which allows the transfer of

large payloads.

Fig 44. Framing for Secure Firmware Download

aaa-024736

RFU Chunk Length OpCode Payload CRC16

15-11

bit

9-0

bit

First byte n bytes 15-0

bit

Header Frame End

Fig 45. Sp li tting commands by ch unks

aaa-024735

000001b Length Chunk 1 CRC16

CRC16

000000b Length OpCode Payload

2 bytes6 bits

DL command

Host side

Encapsulated

transport

10 bits 1 byte n bytes

000001b Length Chunk 2 CRC16 000000b Length Chunk 3 CRC16

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 110 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

12.4.2 Command Code Overview

The following commands are supported in Secure Firmware Download Mode

The Firmware Download Mode uses of the data structure

12.4.3 Command Code Response

A response message is always a multiple of 4 by tes. The first byte of the response is used

to indicate the status of the last executed command.

12.4.4 Command Code Description

12.4.4.1 RESET

Command code: 0xF0

Frame format exchange:

Host -> PN5180 [0x00 0x04 0xF0 0x00 0x00 0x00 0x18 0x5B]

Host <- PN5180 [0x00 0x04 STAT 0x00 0x00 0x00 CRC16]

The reset prevents the PN5180 from sending the OK return code. Only error codes are

sent. STAT is the status return code.

Table 106 . Secure Firmware Download Commands

Command Command

code (hex) Description

RESET F0 This command resets the IC

GET_VERSION F1 This command provides the IC version and firmware

version

SECURE_WRITE C0 Writes chunks of data to the IC

GET_DIE_ID F4 The command returns the die Identifier

-all otherRFU

Fig 46. Secure Firmware Download data structure

aaa-024807

RFU

5-bit

Byte 0

MSB LSB

Byte [2+L] Byte [3+L]Byte 1 Byte 2 Byte 3 ... Byte [1+L]

Packet Length (L)

BOp Code Payload CRC16

unk

10-bit

Header Frame End

-bit

8-bit (L-1) Bytes 16-bit

Table 107. Secure Fir mware Command Status Return Codes

Command Command

code (hex) Description

OK 00 command processed properly

ERROR 01-FF any response different from 0x00 indicates an error

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 111 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

12.4.4.2 GET_VERSION

Command code: 0xF1

Frame format exchange:

Host -> PN5180 [0x00 0x04 0xF1 0x00 0x00 0x00 0x6E 0xEF]

Host <- PN5180 [0x00 0x0A STAT MD FM1V FM2V CRC16]

The payload of the GetVersion command response is:

12.4.4.3 SECURE_WRITE

Command code: 0xC0

The secure write function differs between first, middle and last write frames.

To ease the usage of the download, the Firmware binaries provided by NXP are already

prepared in such a way that only the CRC16 needs to be added. All other data can be

packed in the Frames without further need of e.g. HASH calculations. The provided

binaries include the command code as well. The first 3 bytes of each data block to be

transferred cont ain always the 2- byte length infor mation and the one- byte command code

0xC0

Host -> PN5180 [Data CRC16]

Host <- PN5180 [0x00 0x04 STAT 0x00 0x00 0x00 CRC16]

12.4.4.4 GET_DIE_ID

Command code: 0xF4

This command returns the die Identifier (Unique chip serial number):

Host -> PN5180 [0x00 0x04 0xF4 0x00 0x00 0x00 0xD2 0xAA]

Host <- PN5180 [0x00 0x14 STAT 0x00 0x00 0x00 ID0 ID2 ID3 ID4 ID5 ID6 ID7 ID8 ID9

ID10 ID11 ID12 ID13 ID14 ID15 ID16 CRC16]

Table 108. Secure Firmware update: GetVersio n command response

Field size

(Byte) Description

STAT 1 Status return code

MD 6 Manufacturer Da ta

FM1V 1 Firmware major version

FM2V 1 Firmware minor version

Table 109. Secure Firmware update: First Secure Write Command response

Field size (Byte) Description

STAT 1 Status return code

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 112 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

12.4.5 Error handling

If the last firmware downloa d was not completed without error, the PN5180 respond s to all

commands with an answer 0x2A. No additional parameters are transmitted. In this error

case, a new firmware download is required.

13. Limiting values

Stress above one or more of the limiting values may cause permanent damage to the

device.

14. Recommended operating conditions

Exposure of the device to ot her conditions than sp ecified in the Recommend ed Opera ting

Conditions section for extended periods may affect device reliability.

Electrical paramete rs (minimum, typical and maximum) of the de vice a re guar anteed only

when it is used within the recommended operating conditions.

Table 110. Limiting Values

In accordance with the Absolute Maximum Rating System (IEC 60134).

Symbol Parameter Conditions Min Max Unit

VDD(PVDD) supply voltage on pin

PVDD --3.6V

VDD(TVDD) supply voltage on pin

TVDD --5.5V

VESD electrostatic discharge

voltage Human Body Model

(HBM); 1500 , 100 pF;

JESD22-A114-B

-1500V

Tstg storage temperature no supply voltage

applied 55 +150 °C

Ptot total power dissipation in still air with exposed

pins soldered on a 4

layer JEDEC PCB

-1125mW

Tj junction temperature - - 150 °C

Table 111. Recommended Operating Conditions

Symbol Parameter Conditions Min Typ Max Unit

VDD(VBAT) supply voltage on pin

VBAT VDD(VBAT) <=VDD(PVDD) 2.7 3.3 5.5 V

VDD(PVDD) supply voltage on pin

PVDD 1.8 V supply 1.65 1.8 1.95 V

3.3 V supply 2.7 3.3 3.6 V

VDD(TVDD) supply voltage on pin

TVDD - 2.7 5.0 5.5 V

IDD(TVDD) supply current on pi n

TVDD in still air with exposed

pins soldered on a 4

layer JEDEC PCB

- 180 250 mA

Tamb ambient temperature in still air with exposed

pins soldered on a 4

layer JEDEC PCB

30 +25 +85 °C

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 113 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

The system design shall consider that maximum sup ply voltages are n ot exceeded during

power-on of the system.

15. Thermal characteristics

16. Characteristics

Table 112. Thermal characteristics HVQFN40 package

Symbol Parameter Conditions Typ Unit

Rth(j-a) thermal resistance from junction to

ambient in free air with exposed

pad soldered on a 4

layer JEDEC PCB,

package HVQFN40

40 K/W

Table 113. Thermal characteristics TFBGA64 package

Symbol Parameter Conditions Typ Unit

Rth(j-a) thermal resistance from junction to

ambient in free air with exposed

pad soldered on a 4

layer JEDEC PCB,

package HVQFN40

66 K/W

Table 114. Junction Temperature

Symbol Parameter Conditions Max Unit

Tjjunction temperature - 125 °C

Table 115. Current consumption

Symbol Parameter Conditions Min Typ Max Unit

IDD(PVDD) supply current on pi n PVDD VDD(PVDD) = 3.3

V-20-mA

IDD(VBAT) supply current on pin VBAT VDD(VBAT) = 3.3 V

max current

includes current

of all GPO’s

--20mA

Ipd power-down current VDD(TVDD) =

VDD(PVDD)

=VDD(VDD) 3.0

V; hard

power-down; pin

RESET_N set

LOW,

Tamb = 25 °C

-10-A

Istb standby current Tamb = 25 °C - 15 - A

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 114 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 116. Reset pin RESET_N

Symbol Parameter Conditions Min Typ Max Unit

t(reset) reset time 10 - - s

VIH HIGH-level input voltage VDD(PVDD)<=

VDD(VBAT)

1.1 - VDD(PV

DD)

VIL LOW-level input voltage 0 - 0.4 V

IIH HIGH-level input current VI = VDD(VBAT) --1mA

IIL LOW-level input current VI = 0 V -1--mA

Ciinput capacitance - 5 - pF

Table 117. Input Pin AUX2 /DWL_REQ

Symbol Parameter Conditions Min Typ Max Unit

VIH HIGH-level input voltage VDD(PVDD)<=

VDD(VBAT)

0.65 x

PVDD

-V

DD(PV

DD)

VIL LOW-level input voltage - 0 - 0.4 V

IIH HIGH-level input current VI = VDD(VBAT) --1mA

IIL LOW-level input current VI = 0 V 1--mA

Ciinput capacitance - - 5 - pF

t(RESET_N-AUX2/

DWL_REQ)

time from RESET_N high to

AUX2 /DWL_REQ high -0-50s

Table 118. GPO pin characteristics

Symbol Parameter Conditions Min Typ Max Unit

Vi(p-p) peak-to-peak input voltage - - - VDD(PV

DD)

IOH HIGH-level output current VDD(PVDD) = 3.3 V - - 3 mA

IIL LOW-level input current VDD(PVDD) = 3.3 V - - 3 mA

Table 119. CLK1, CLK2 pin characteristic s

Symbol Parameter Conditions Min Typ Max Unit

Vi(p-p) peak-to-peak input voltage - 0.2 - 1.65 V

IIH HIGH-level input current VI= 1.65 V - - 1 A

IIL LOW-level input current VI = 0 V 1 - - A

duty cycle - 35 65 %

Ci(CLK1) input capacitance on pin CLK1 VDD = 1.8 V,

VDC = 0.65 V,

VAC = 0.9 V (p-p)

-2- pF

Ci(CLK2) input capacitance on pin CLK2 VDD = 1.8 V,

VDC = 0.65 V,

VAC = 0.9 V (p-p)

-2- pF

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 115 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 120. Output pin characteristics IRQ

Symbol Parameter Conditions Min Typ Max Unit

VOH HIGH-level output voltage IOH < 3 mA VDD(PVDD)

0.4 -V

DD(PV

DD)

VOL LOW-level output voltage IOL < 3 mA 0 - 0.4 V

CLload capacit a nc e - - 20 pF

tffall time CL = 12 pF max 1 - 3 ns

trrise time CL = 12 pF max 1 - 3 ns

Rpd pull-down resistance 0.4 - 0.7 M

Table 121. Input pins SCLK, MOSI, NSS

Symbol Parameter Conditions Min Typ Max Unit

VIH HIGH-level input voltage 0.65 x

VDD(PVDD)

-V

DD(PVDD) V

VIL LOW-level input voltage 0 - 0.35 x

VDD(PVDD)

Ciinput capacitance - 5 - pF

IIH HIGH-level input current VI = PVDD --1mA

IIL LOW-level input current VI = 0 V - - 1 mA

Tabl e 122. Output pi n MISO

Symbol Parameter Conditions Min Typ Max Unit

VOH HIGH-level output voltage IOH < 3 mA VDD(PV

DD) -0.4 -V

DD(PV

DD)

VOL LOW-level output voltage IOL < 3 mA 0 - 0.4 V

CLload capacit a nc e - - 20 pF

tffall time CL = 12 pF max 1 - 3 ns

trrise time CL = 12 pF max 1 - 3 ns

Table 123. Timing conditions SPI

Symbol Parameter Min Typ Max Unit

tSCKL SCK LOW time 72 - - ns

tSCKH SCK HIGH time 72 - - ns

th(SCKH-D) SCK HIGH to data input hold time 25 - - ns

tsu(D-SCKH) data input to SCK HIGH set-up time 25 - - ns

th(SCKL-Q) SCK LOW to data output hold time - - 25 ns

t(SCKL-NSSH) SCK LOW to NSS HIGH time 0 - - ns

tNSSH NSS HIGH time 72 - - ns

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 116 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

[1] (PN5180 ready to receive commands on the host interface). The PN5180 indicates the ability to

receive commands from a host by raising an IDLE IRQ.

Table 124. Output pins ANT 1 and ANT2

Symbol Parameter Conditions Min Typ Max Unit

Zì(diff) differential impedance

from ANT1 to ANT2 Low impedance

configuration -1017Ohm

Vi(start)(lim)(ANT1) limiter start input voltage

on ANT1 I=10 mA - 3.3 - V

Vi(start)(lim)(ANT2) limiter start input voltage

on ANT2 I=10 mA - 3.3 - V

Table 125. Input pins RXp and RXn

Symbol Parameter Conditions Min Typ Max Unit

Vi(dyn) dynamic input voltage - - VDD V

Ciinput capacitance - 12 - pF

Ziinput impedance from RXN,

RXP pins to VMID Reader, Card

and P2P modes 0- 15k

Table 126. Output pins TX1 and TX2

Symbol Parameter Conditions Min Typ Max Unit

VOH HIGH-level output

voltage VDD(TVDD)=5

V-V

DD(TVDD)

150mV VDD(TV

DD)

VOL LOW-level output

voltage VDD(TVDD)=5

V0200 - mV

Table 127. Start-up time

Symbol Parameter Conditions Min Typ Max Unit

tboot start-up time[1] RESET_N =

High 2.3 2.5 dependent on

configuration of

XTAL_BOOT_

TIME in EEPROM

Table 128. Crystal requirements for ISO/IEC14443 compliant operation

Symbol Parameter Conditions Min Typ Max Unit

fxtal crystal frequency - -100 - +100 ppm

ESR equivalent series resistance - 50 100 

CLload capacitance - - 10 - pF

Pxtal crystal power dissipation - - - 100 W

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 117 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 129. Reference in put frequency requirements for 8 MHz, 12 MHz, 16 MHz and 24 MHz

Symbol Parameter Conditions Min Typ Max Unit

nphase noi s e Input noise

floor at

50 kHz offset

- - -140 dBc/Hz

Vi(p-p) peak-to-peak input voltage sinus signal 0.2 - 1.8 V

Vi(p-p) peak-to-peak input voltage square

signal 0 1.8 1.98 V

fi(ref)acc reference in put frequency

accuracy - -100 - +100 ppm

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 118 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

17. Application information

17.1 Typical component values

The following component values are typical values for a design. Refer to the Application

note “PN5180 Antenna Design Guide” how to determin e the values listed to be dependent

on antenna design.

Fig 47. Application diagram with minimum components

aaa-020597

29 25 26

SCLK

MOSI

MISO

to host

microcontroller

to microcontroller supply

to testpad

optional output

NSS

IRQ

BUSY

AUX1

RESET_N

AUX2/DWL_REQ

PVDD

PVSS

VSS

CLK1

CLK2

TVSS

36 37 19

ANT1

RXP

TX1

VMID

TX2

RXN

ANT2

38 GPO1

2830

DVDD

VDHF

VBAT

TVDD supply transmitter

supply VBAT

AVDD

VDD

n.c.

C3 C5 C7C6C4

R1 R2

R_RXP

C_S1

C_S2

C_P1

antenna

C_P2

R_RXN

L1 C_RXP

C_MOD1

RA1

RA2

C_MOD2

C_EMC_1

C_EMC_2

C_RXN

Q127

12 MHz

C1 C2

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 119 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Table 130.

Component Value

C1,C2 15 pF

C3 1 nF

C4 100 nF

C5 470 nF

C6 100 nF

C7 6.8 F, additional blo cking capacitors 100 nF migh t be required

dependent on PCB layout and supply characteristics

L1,L2 470 nH

C_EMC_1, C_EMC_2 220 pF

C_RCXP, C_RXN 1 nF

R_RXP, R_RXN Dependent on antenna design

C_MOD 82 pF

C_S1, C_S2, C_P1, C_P2 Dependent on antenna design

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 120 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

18. Packaging information

Moisture Sensitivity Level (MSL) evaluation has been performed according to

SNW-FQ-225B rev.04/07/07 (JEDEC J-STD-020C). MSL for theHVQFN40 package is

level 3 which means 260 °C convection reflow temperature.

•1-week out-of-pack floor life at maximum ambient temperature 30°C/ 60 % RH

(Relative Humidity) to limit possible moisture intrusion.

•When used in produ c tio n, stor ed unde r nitr o ge n co nd itio ns for no t mo re than 8 da ys

Fig 48. Packaging information 1 tray

001aaj740

strap 46 mm from corner

tray

chamfer

PIN 1

chamfer

PIN 1

printed plano box

ESD warning preprinted

barcode label (permanent)

barcode label (peel-off)

QA seal

Hyatt patent preprinted

The straps around the package of

stacked trays inside the plano-box

have sufficient pre-tension to avoid

loosening of the trays.

In the traystack (2 trays)

only ONE tray type* allowed

*one supplier and one revision number.

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 121 of 149

NXP Semiconductors PN5180

High-performance multi-protocol full NFC Forum-compliant frontend

Fig 49. Packaging information 5 tray

aaa-004952

PQ-label (permanent) bag

strap 46 mm from the corner

dry-agent

ESD warning preprinted

PQ-label (permanent)

dry-pack ID preprinted

strap

QA seal

relative humidity indicator

tray

preprinted:

recycling symbol

moisture caution label

ESD warning

manufacturer bag info

chamfer

printed plano box

PIN 1

PLCC52

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 122 of 149

NXP Semiconductors PN5180

High-performance multi-protocol full NFC Forum-compliant frontend

Fig 50. Packag ing information Tray

1.55

3.00

(0.30)

16.60±0.08+7°/S SQ.

1.20

0.56

3.32

(14.40+5°/S SQ.)

(1.45)

1.10

2.50

(0.64)

0.35

aaa-004949

AL AL AM AM

section BC-BC

scale 4:1

vacuum cell

section BD-BD

scale 4:1

section BA-BA

scale 4:1

detail AC

scale 20:1 section AJ-AJ

scale 2:1

section AR-AR

scale 2:1

section AL-AL

scale 5:1

section AK-AK

scale 5:1

section AM-AM

scale 4:1

section AN-AN

scale 4:1

end lock side lock

12.80-5°/S SQ.

14.20±0.08+10°/S SQ.

13.85±0.08+12°/S SQ.

BA C

0.50

BA C

0.50

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 123 of 149

NXP Semiconductors PN5180

High-performance multi-protocol full NFC Forum-compliant frontend

Fig 51. Packag ing information Reel

aaa-004950

tape

guard band

circular sprocket holes

opposite the label side of reel

cover tape

carrier tape

enlongated

circular

enlongated

PIN1 has to be

in quadrant 1

QA seal

preprinted ESD warning

PQ-label

dry-pack ID preprinted

(permanent)

product orientation

in carrier tape

product orientation ONLY for turned

products with 12nc ending 128

HOW TO SECURE LEADER END TO THE GUARD BAND,

HOW TO SECURE GUARD BAND

unreeling direction

(see: HOW TO SECURE)

PIN1

PIN1 PIN1

BGA

bare die BGA

bare die for SOT505-2

ending 125

for SOT765

ending 125

PIN1 PIN1 PIN1

PIN1 PIN1

QFP QFP

PLCCSO SO

(HV)QFN

(HV)SON

(H)BCC

(HV)QFN

(HV)SON

(H)BCC

see: ASSY REEL + LABELS

ASSY REEL + LABELS

label side embossed

ESD logo

embossed

ESD logo

tape

printed plano-box

Ø 330x12/16/24/32 (hub 7’’)

Ø 330x16/24/32/44 (hub 4’’)

Ø 330x44 (hub 6’’)

Ø 180x12/16/24

tapeslot

label side

trailer

leader

leader : lenght of trailer shall be 400 mm min.

and covered with cover tape

circular sprocket hole side

guard band

trailer : lenght of trailer shall be 160 mm min.

and covered with cover tape

tape

(with pull tabs on both ends)

guard band

lape double-backed

onto itself on both ends

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 124 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

19. Package outline

Fig 52. Package outline SOT618-1

References

Outline

version

European

projection Issue date

IEC JEDEC JEITA

SOT618-1 MO-220

sot618-1_po

02-10-22

13-11-05

Unit

max

nom

min

1.00 0.05 0.2 6.1 4.25 6.1

0.4

(1)

Dimensions (mm are the original dimensions)

Note

1. Plastic or metal protrusions of 0.075 mm maximum per side are not included.

HVQFN40: plastic thermal enhanced very thin quad flat package; no leads;

40 terminals; body 6 x 6 x 0.85 mm SOT618-1

0.30

(1)

4.10

Lvw

0.05

0.1

0.85 0.02 6.0 4.10 6.00.21

0.33.950.80 0.00 5.9 3.95 5.90.18

0.5 4.5 0.54.25 4.5 0.1

1/2 e

terminal 1

index area

11 20

40 31

terminal 1

index area

0 2.5 5 mm

scale

detail X

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 125 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Fig 53. Package outline package version (TFBGA64)

References

Outline

version

European

projection Issue date

IEC JEDEC JEITA

SOT1336-1 - - -

sot1336-1_po

12-06-19

12-08-28

Unit

max

nom

min

1.15 0.35 0.45 5.6 5.6

4.55 0.15 0.1

Dimensions (mm are the original dimensions)

TFBGA64: plastic thin fine-pitch ball grid array package; 64 balls

A1A2

0.80

1.00 0.30 0.40 5.5 5.5 0.650.70

bDEee

4.55

0.90 0.25 0.35 5.4 5.40.65

e2vw

0.08

0.1

SOT1336-1

0 5 mm

scale

AA2

detail X

ball A1

index area

ball A1

index area

24613578

eAC B

Ø v

CØ w

1/2 e

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 126 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

20. Soldering of SMD packages

This text provides a very brief insight into a complex technology. A more in-depth account

of soldering ICs can be found in Application Note AN10365 “Surface mount reflow

soldering description”.

20.1 Introduction to soldering

Soldering is one of the most common methods through which packages are attached to

Printed Circuit Boards (PCBs), to form electrical circuits. The soldered joint provides both

the mechanical and the electrical connection. There is no single soldering method that is

ideal for all IC packages. Wave soldering is often preferred when through-hole and

Surface Mount Devices (SMDs) are mixed on on e printed wiring board; however, it is not

suitable for fine pitch SMDs. Reflow soldering is ideal for the small pitches and high

densities that come with increased miniaturization.

20.2 Wave and reflow soldering

W ave soldering is a joining te chnology in which the joints are m ade by solder coming from

a standing wave of liquid solder. The wave soldering process is suitable for the following:

•Through-hole components

•Leaded or leadless SMDs, which are glued to the surface of the printed circuit board

Not all SMDs can be wave soldered. Packages with solder balls, and some leadless

packages which have solde r lands underneath the body, cannot be wave soldered. Also,

leaded SMDs with leads ha ving a pitch smaller than ~0.6 mm cannot be wave solder ed,

due to an increased probability of bridging.

The reflow soldering process involves applying solder paste to a board, followed by

component placement and exposure to a temperature profile. Leaded pa ckages,

packages with solder balls, and leadless packages are all reflow solderable.

Key characteristics in both wave and reflow soldering are:

•Board specifications, including the board finish, solder masks and vias

•Package footprints, including solder thieves and orientation

•The moisture sensitivity level of the packages

•Package placement

•Inspection and repair

•Lead-free soldering ve rsus SnPb soldering

20.3 Wave soldering

Key characteristics in wave soldering are:

•Process issues, such as application of adhesive and flux, clinching of leads, board

transport, the solder wave parameters, and the time during which components are

exposed to the wave

•Solder bath specifications, including temperature and impurities

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 127 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

20.4 Reflow soldering

Key characteristics in reflow soldering are :

•Lead-free ve rsus SnPb soldering; note th at a lead-free reflow process usua lly leads to

higher minimum peak temperatures (see Figure 54) than a SnPb process, thus

reducing the process window

•Solder paste printing issues including smearing, release, and adjusting the process

window for a mix of large and small components on one board

•Reflow temperature profile; this profile includes preheat, reflow (in which the board is

heated to the peak temperature) an d cooling down. It is imperative that the peak

temperature is high enoug h for the solder to make reliable solder joint s (a solder paste

characteristic). In addition, the peak temperature must be low enough that the

packages and/or boards are not damaged. The peak temperature of the package

depends on p ackage thickness and volume and is classified in accordance with

Table 131 and 132

Moisture sensitivity precautions, as indicated on the packin g, must be respected at all

times.

Studies have shown that small package s r each higher temperatures during reflow

soldering, see Figure 54.

Table 131 . SnPb eutectic process (from J-STD-0 20D)

Package thickness (mm) Package reflow temperature (C)

Volume (mm3)

< 350  350

< 2.5 235 220

 2.5 220 220

Table 132. Lead-free pr ocess (from J-STD-020D)

Package thickness (mm) Package reflow temperature (C)

Volume (mm3)

< 350 350 to 2000 > 2000

< 1.6 260 260 260

1.6 to 2.5 260 250 245

> 2.5 250 245 245

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 128 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

For further informa tion on temperature profiles, refer to Application Note AN10365

“Surface mount reflow soldering description”.

MSL: Moisture Sensitivity Level

Fig 54. Temperature profiles for large and small components

001aac844

temperature

time

minimum peak temperature

= minimum soldering temperature

maximum peak temperature

= MSL limit, damage level

peak

temperature

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 129 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

21. Soldering

Fig 55. Soldering HVQFN40 package

SOT618-1Footprint information for reflow soldering of HVQFN40 package

sot618-1_fr

occupied area

solder paste

solder resist

solder lands

Dimensions in mm

Ay Bx D SLx SLy SPy totP

7.000 5.200

5.200 0.900 0.290

4.100 4.100 2.400

SPx tot

2.400

SPx

0.600

SPy

0.600

6.300

7.250

7.2500.500

7.000

nSPx

nSPy

Issue date 09-06-11

14-08-13

SLx

AyBySLy

P 0.025 0.025

(0.105)

SPx tot

SPy tot

nSPx

nSPy

SPx

SPy

Generic footprint pattern

Refer to the package outline drawing for actual layout

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 130 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22. Appendix

22.1 Timer Delay for start of reception measurement

22.2 Default proto col settings for LOAD_RF_CONFIG, Transmitter

22.2.1 ISO/IEC 14443 A-106

Table 133. Timer delay for STOP_ON_RX_STARTED config uration

Setting Protocol Speed (kbit/s) Modulation delay (us)

0x80 ISO 14443-A 106 Manch. SubC 48

0x81 ISO 14443-A 212 BPSK 24

0x82 ISO 14443-A 424 BPSK 12

0x83 ISO 14443-A 848 BPSK 6

0x84 ISO 14443-B 106 BPSK 182

0x85 ISO 14443-B 212 BPSK 91

0x86 ISO 14443-B 424 BPSK 46

0x87 ISO 14443-B 848 BPSK 23

0x88 FeliCa 212 - 95

0x89 FeliCa 424 - 48

0x8A NFC-Active Initiator 106 - -

0x8B NFC-Active Initiator 212 - -

0x8C NFC-Active Initiator 424 - -

0x8D ISO 15693 26 1 out 4 / SC 321

0x8E ISO 15693 53 1 out 4 / SC 161

0x8F ISO 18003M3 Manch. 424_4 106 Manch . 424 / 4 period 121

0x90 ISO 18003 M3 Manch. 424_2 212 Manch. 424 / 2 period 75

0x91 ISO 18003 M3 Manch. 848_4 212 Manch. 848 / 4 period 47

0x92 ISO 18003 M3 Manch. 848_2 424 Manch. 848 / 2 period 11

0x93 ISO 14443-A PICC 106 Miller 48

0x94 ISO 14443-A PICC 212 Miller 24

0x95 ISO 14443-A PICC 424 Miller 12

0x96 ISO 14443-A PICC 848 Miller 6

0x97 N FC Passive Target 212 212 - 95

0x98 N FC Passive Target 424 424 - 48

Table 134 . ISO/IEC 14443 A-106

RF_CONTROL_TX_CLK 0x74

TX_DATA_MOD 0x2350

TX_UNDERSHOOT_CONFIG 0x17

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0xDBCF43

ANT_CONTROL 0x10

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 131 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.2.2 ISO/IEC 14443 A-212

22.2.3 ISO/IEC 14443 A-424

22.2.4 ISO/IEC 14443 A-848

22.2.5 ISO/IEC 14443 B-106

Table 135 . ISO/IEC 14443 A-212

RF_CONTROL_TX_CLK 0x82

TX_DATA_MOD 0x2350

TX_UNDERSHOOT_CONFIG 0x17

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0xDBCF043

ANT_CONTROL 0x10

Table 136 . ISO/IEC 14443 A-424

RF_CONTROL_TX_CLK 0x82

TX_DATA_MOD 0x650

TX_UNDERSHOOT_CONFIG 0x5

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0xDBCF43

ANT_CONTROL 0x10

Table 137 . ISO/IEC 14443 A-848

RF_CONTROL_TX_CLK 0x82

TX_DATA_MOD 0x150

TX_UNDERSHOOT_CONFIG 0x1

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0xF9EF45

ANT_CONTROL 0x10

Table 138 . ISO/IEC 14443 B-106

RF_CONTROL_TX_CLK 0x8E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x3A4756

ANT_CONTROL 0x10

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 132 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.2.6 ISO/IEC 14443 B-212

22.2.7 ISO/IEC 14443 B-424

22.2.8 ISO/IEC 14443 B-848

22.2.9 Felica-212

Table 139 . ISO/IEC 14443 B-212

RF_CONTROL_TX_CLK 0x8E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x39C746

ANT_CONTROL 0x10

Table 140 . ISO/IEC 14443 B-424

RF_CONTROL_TX_CLK 0x78E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x1FE0013

RF_CONTROL_TX 0x71CF54

ANT_CONTROL 0x10

Table 141 . ISO/IEC 14443 B-848

RF_CONTROL_TX_CLK 0x78E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x7E000D

RF_CONTROL_TX 0x69AF32

ANT_CONTROL 0x10

Table 142. Felica-212

RF_CONTROL_TX_CLK 0x8E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x39E744

ANT_CONTROL 0x10

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 133 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.2.10 Felica-424

22.2.11 NFC active initiator A-106

22.2.12 NFC active initiator A-212

22.2.13 NFC active initiator A-424

Table 143. Felica-424

RF_CONTROL_TX_CLK 0x8E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x39EF33

ANT_CONTROL 0x10

Table 144 . NFC active initiator A-106

RF_CONTROL_TX_CLK 0x8782

TX_DATA_MOD 0x2350

TX_UNDERSHOOT_CONFIG 0x17

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0xDBCF43

ANT_CONTROL 0x10

Table 145 . NFC active initiator A-212

RF_CONTROL_TX_CLK 0x808E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x39E744

ANT_CONTROL 0x10

Table 146 . NFC active initiator A-424

RF_CONTROL_TX_CLK 0x808E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x39EF33

ANT_CONTROL 0x10

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 134 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.2.14 ISO/IEC15693-26

22.2.15 ISO/IEC15693-53

22.2.16 ISO/IEC18003M3 - TARI=18.88 s

22.2.17 ISO/IEC18003M3 - TARI=9.44 s

Table 147 . ISO/IEC15693-26

RF_CONTROL_TX_CLK 0x782

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0xF000001F

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0xDBC745

ANT_CONTROL 0x10

Table 148 . ISO/IEC15693-53

RF_CONTROL_TX_CLK 0x8E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0xFF000F

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x3A4F44

ANT_CONTROL 0x10

Table 149. ISO/IEC18003M3 - TARI=18.88us

RF_CONTROL_TX_CLK 0x8E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0xFF000F

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x3A2734

ANT_CONTROL 0x10

Table 150 . ISO/IEC18003M3 - TARI=9.44 s

RF_CONTROL_TX_CLK 0x8E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0xFF000F

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x3A4734

ANT_CONTROL 0x10

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 135 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.2.18 PICC ISO/IEC14443-A 106

22.2.19 PICC ISO/IEC14443-A 212

22.2.20 PICC ISO/IEC14443-A 424

22.2.21 PICC ISO/IEC14443-A 848

22.2.22 NFC passive target 212

Table 151 . PICC ISO/IEC14443-A 106

RF_CONTROL_TX_CLK 0x8000

TX_DATA_MOD 0x72

RF_CONTROL_TX 0x0

ANT_CONTROL 0xC

Table 152 . PICC ISO/IEC14443-A 212

RF_CONTROL_TX_CLK 0x8000

TX_DATA_MOD 0x72

RF_CONTROL_TX 0x0

ANT_CONTROL 0xC

Table 153 . PICC ISO/IEC14443-A 424

RF_CONTROL_TX_CLK 0x8000

TX_DATA_MOD 0x72

RF_CONTROL_TX 0x0

ANT_CONTROL 0xC

Table 154 . PICC ISO/IEC14443-A 848

RF_CONTROL_TX_CLK 0x8000

TX_DATA_MOD 0x72

RF_CONTROL_TX 0x0

ANT_CONTROL 0xC

Table 155. NFC passive target 212

RF_CONTROL_TX_CLK 0x8000

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x0

ANT_CONTROL 0xC

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 136 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.2.23 NFC passive target 424

22.2.24 NFC active target 106

22.2.25 NFC active target 212

22.2.26 NFC active target 424

Table 156. NFC passive target 424

RF_CONTROL_TX_CLK 0x8000

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x0

ANT_CONTROL 0xC

Table 157. NFC active target 106

RF_CONTROL_TX_CLK 0x8782

TX_DATA_MOD 0x2350

TX_UNDERSHOOT_CONFIG 0x17

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0xDBCF43

ANT_CONTROL 0x10

Table 158. NFC active target 212

RF_CONTROL_TX_CLK 0x0808E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x39E744

ANT_CONTROL 0x10

Table 159. NFC active target 424

RF_CONTROL_TX_CLK 0x808E

TX_DATA_MOD 0x0

TX_UNDERSHOOT_CONFIG 0x0

TX_OVERSHOOT_CONFIG 0x0

RF_CONTROL_TX 0x39EF33

ANT_CONTROL 0x10

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 137 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.2.27 NFC general target mode - all data rates

22.3 Default protocol settings for LOAD_RF_CONFIG, Receiver

22.3.1 ISO/IEC 14443 A-106

22.3.2 ISO/IEC 14443 A-212

22.3.3 ISO/IEC 14443 A-424

22.3.4 ISO/IEC 14443 A-848

Table 160. NFC general target mode - all data rates

RF_CONTROL_TX_CLK 0x8000

TX_DATA_MOD 0x72

Table 161 . ISO/IEC 14443 A-106

AGC_VALUE 0x801F0

AGC_CONFIG 0x804B

ANA_RX_POWER_CONTROL_RFU 0x200

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0x430DC

RF_CONTROL_RX 0x1E

Table 162 . ISO/IEC 14443 A-212

AGC_VALUE 0x0x801F0801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0x430DC

RF_CONTROL_RX 0x1E

Table 163 . ISO/IEC 14443 A-424

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0x192905

RF_CONTROL_RX 0x16

Table 164 . ISO/IEC 14443 A-848

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 138 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.3.5 ISO/IEC 14443 B-106

22.3.6 ISO/IEC 14443 B-212

22.3.7 ISO/IEC 14443 B-424

22.3.8 ISO/IEC 14443 B-848

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0xF2505

RF_CONTROL_RX 0x11

Table 164 . ISO/IEC 14443 A-848

Table 165 . ISO/IEC 14443 B-106

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0x1F2415

RF_CONTROL_RX 0x16

Table 166 . ISO/IEC 14443 B-212

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0x192805

RF_CONTROL_RX 0x16

Table 167 . ISO/IEC 14443 B-424

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0x192A05

RF_CONTROL_RX 0x16

Table 168 . ISO/IEC 14443 B-848

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0xF2505

RF_CONTROL_RX 0x1A

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 139 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.3.9 Felica 212

22.3.10 FeliCa 424

22.3.11 NFC Active Initiator 106

22.3.12 NFC Active Initiator 212

22.3.13 NFC Active Initiator 424

Table 169 . Felica 212

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0xF2605

RF_CONTROL_RX 0x11

Table 170 . FeliCa 424

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0x2605

RF_CONTROL_RX 0x15

Table 171 . NFC Active Initiator 106

AGC_VALUE 0xC0150

AGC_CONFIG 0xA00B

RX_RFU 0x1

SIGPRO_CM_CONFIG 0x0

RF_CONTROL_RX 0x23

Table 172 . NFC Active Initiator 212

AGC_VALUE 0xC0150

AGC_CONFIG 0xA00B

SIGPRO_CM_CONFIG 0x50010060

RF_CONTROL_RX 0x23

Table 173 . NFC Active Initiator 424

AGC_VALUE 0xC0150

AGC_CONFIG 0xA00B

SIGPRO_CM_CONFIG 0x50010060

RF_CONTROL_RX 0x23

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 140 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.3.14 ISO/IEC 15693-26

22.3.15 ISO/IEC 15693-53

22.3.16 ISO 18003M3- Tari 18.88

22.3.17 ISO 18003M3- Tari 9.44 848_2

Table 174 . ISO/IEC 15693-26

AGC_VALUE 0x801F0

AGC_CONFIG 0x804B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0x4010

RF_CONTROL_RX 0x1A

Table 175 . ISO/IEC 15693-53

AGC_VALUE 0x801F0

AGC_CONFIG 0x804B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0xC4010

RF_CONTROL_RX 0x1A

Table 176 . ISO 18003M3- Tari 18.88

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_CM_CONFIG_RFU 0x0

SIGPRO_RM_CONFIG 0x8014

RF_CONTROL_RX 0x1A

Table 177 . ISO 18003M3- Tari 9.44 848_2

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0xC6014

SIGPRO_CM_CONFIG2_RFU 0x1

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 141 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.3.18 ISO 18003M3- Tari 9.44 -848_4

22.3.19 ISO 14443A-PICC 106

22.3.20 ISO 14443A-PICC 212

22.3.21 ISO 14443A-PICC 424

22.3.22 ISO 14443A-PICC 848

Table 178 . ISO18003M3- Tari 9.44 -848_4

AGC_VALUE 0x801F0

AGC_CONFIG 0x860B

SIGPRO_CM_CONFIG 0x0

SIGPRO_RM_CONFIG 0xC8094

RF_CONTROL_RX 0x1F

Table 179 . ISO 14443A-PICC 106

AGC_CONFIG 0xA003

RX_RFU 0x1

SIGPRO_CM_CONFIG 0x1000801C

RF_CONTROL_RX 0x23

Table 180 . ISO 14443A-PICC 212

AGC_CONFIG 0xA003

SIGPRO_CM_CONFIG 0x1C0600E0

RF_CONTROL_RX 0xE3

Table 181 . ISO 14443A-PICC 424

AGC_CONFIG 0xA003

SIGPRO_CM_CONFIG 0x14040040

RF_CONTROL_RX 0x23

Table 182 . ISO 14443A-PICC 848

AGC_CONFIG 0xA003

SIGPRO_CM_CONFIG 0x8030040

RF_CONTROL_RX 0x2F

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 142 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.3.23 NFC-Passive target -212

22.3.24 NFC-Passive target -424

22.3.25 NFC-active target - 106

22.3.26 NFC-active target - 212

22.3.27 NFC-active target - 424

Table 183 . NFC-Passive target -212

AGC_CONFIG 0xA003

SIGPRO_CM_CONFIG 0x50010060

RF_CONTROL_RX 0x23

Table 184 . NFC-Passive target -424

AGC_CONFIG 0xA003

SIGPRO_CM_CONFIG 0x50010060

RF_CONTROL_RX 0x23

Table 185 . NFC-active target - 106

AGC_VALUE 0xC0150

AGC_CONFIG 0xA00B

SIGPRO_CM_CONFIG 0x0

RF_CONTROL_RX 0x23

Table 186 . NFC-active target - 212

AGC_VALUE 0xC0150

AGC_CONFIG 0xA00B

SIGPRO_CM_CONFIG 0x50010060

RF_CONTROL_RX 0x23

Table 187 . NFC-active target - 424

AGC_VALUE 0xC0150

AGC_CONFIG 0xA00B

SIGPRO_CM_CONFIG 0x50010060

RF_CONTROL_RX 0x23

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 143 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

22.3.28 NFC-General target mode - all data rates

Table 188 . NFC-General target mode - all data rates

AGC_VALUE 0xC0150

AGC_CONFIG 0xA003

SIGPRO_CM_CONFIG 0x10010060

RF_CONTROL_RX 0x23

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 144 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

23. Abbreviations

24. References

[1] ISO/IEC 14443 — parts 2: 2001 COR 1 2007 (01/11/2007), part 3: 2001 COR 1

2006 (01/09/2006) and part 4: 2nd edition 2008 (15/07/2008)

Table 189. Abbreviations

Acronym Description

ADC Analog-to-Digital Converter

AWC Adaptive Waveform Control

BPSK Binary Phase Shift Keying

BBA Base Band Amplifier

CRC Cyclic Redundancy Check

DPC Dynamic Power Control

EGT Extra Guard Time

EMC ElectroMagnetic Compatibility

EMD ElectroMagnetic Disturbance

EOF End Of Frame

ETU Elementary Time Unit

HBM Human Body Model

LFO Low Frequency Oscillator

LPCD Low-Power Card Detection

LSB Least Significant Bit

MISO Master In Slave Out

MOSI Master Out Slave In

MSB Most Significant Bit

NRZ Not Return to Zero

NSS Not Slave Select

PCD Proximity Coupling Device

PLL Phase-Locked Loop

RZ Return To Zero

RX Receiver

SOF Start Of Frame

SPI Serial Peripheral Interface

SW Software

TX Transmitter

UART Universal Asynchronous Receiver Transmitter

UID Unique Identification

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 145 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

25. Revision history

Table 190. Revision his tory

Document ID Release date Data sheet status Change notice Supersedes

PN5180 v. 3.0 20161007 Product data sheet - PN5180 v. 2.2

Modifications: •Data sheet status changed into Product data sheet

•Section 6 “Versions” added

•General update

PN5180 v. 2.2 20151217 Preliminary data sheet - PN5180 v. 2.1

Modifications: •Section 11.4 .3.2 “Transmission Buffer”: Size of RX buffer corrected to 508 bytes

•Waveform contro l description added

•Figure 47 “Application diagram with minimum components”: updated

PN5180 v. 2.1 20151126 Preliminary data sheet - PN5180 v. 2.0

Modifications: •Minor updates

PN5180 v. 2.0 20151124 Preliminary data sheet - -

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 146 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

26. Legal information

26.1 Data sheet status

[1] Please consult the most recently issued document before initiating or completing a design.

[2] The term ‘short data sheet’ is explained in section “Definitions”.

[3] The product status of de vice(s) descr ibed in th is document m ay have cha nged since thi s document w as publish ed and may di ffe r in case of multiple devices. The latest product status

information is available on the Internet at URL http://www.nxp.com.

26.2 Definitions

Draft — The document is a draft version only. The content is still under

internal review and subject to formal approval, which may result in

modifications or additions. NXP Semiconductors does not give any

representations or warranties as to the accuracy or completeness of

information included herein and shall have no liab ility for the consequences of

use of such information.

Short data sheet — A short data sheet is an extract from a full data sheet

with the same product type number(s) and tit le. A short data sh eet is intended

for quick reference only and shou ld not b e relied u pon to cont ain det ailed and

full information. For detailed and full informatio n see the relevant full data

sheet, which is available on request via the local NXP Semicond uctors sales

office. In case of any inconsistency or conflict with the short data sheet, the

full data sheet shall pre va il.

Product specificatio n — The information and data provided in a Product

data sheet shall define the specification of the product as agreed between

NXP Semiconductors and its customer, unless NXP Semiconductors and

customer have explicitly agreed otherwise in writing. In no event however,

shall an agreement be valid in which the NXP Semiconductors product is

deemed to off er functions and qualities beyon d those described in the

Product data sheet.

26.3 Disclaimers

Limited warr a nty and liability — Information in this document is believed to

be accurate and reliable. However, NXP Semiconductors does not give any

representations or warrant ies, expressed or implied, as to the accuracy or

completeness of such information and shall have no liability for the

consequences of use of such information. NXP Se miconductors takes no

responsibility for the content in this document if provided by an information

source outside of NXP Semiconductors.

In no event shall NXP Semiconductors be liable for any indirect , incidental,

punitive, special or consequ ential damages (including - wit hout limitation - lost

profits, lost savings, business interruption, costs related to the removal or

replacement of any products or rework charges) whether or not such

damages are based on tort (including negligence), warranty, breach of

contract or any other legal theory.

Notwithstanding any damages that customer might incur for any reason

whatsoever, NXP Semiconductors’ ag gregate and cumulative l iability toward s

customer for the products described herein shall be limited in accordance

with the Terms and conditions of commercial sale of NXP Semicondu ctors.

Right to make changes — NXP Semiconductors reserves the right to make

changes to information published in this document, including without

limitation specifications and product descriptions, at any time and without

notice. This document supersedes and replaces all informa tion supplied prior

to the publication hereof .

Suitability for use — NXP Semiconductors product s are not designed,

authorized or warranted to be suitable for use in life support, life-critical or

safety-critical systems or equipment, nor in applications where failure or

malfunction of an NXP Semiconductors product can reasonably be expected

to result in perso nal injury, death or severe property or environmental

damage. NXP Semiconductors and its suppliers accept no liability for

inclusion and/or use of NXP Semiconducto rs products in such equipment or

applications and ther efore such inclu sion and/or use is at the cu stomer’s own

risk.

Applications — Applications that are described herein for any of these

products are for illustrative purposes only. NXP Semiconductors makes no

representation or warranty that such applications will be suitable for the

specified use without further testing or modification.

Customers are responsible for the design and ope ration of their applications

and products using NXP Semiconductors product s, and NXP Semiconductors

accepts no liability for any assistance with applications or customer product

design. It is customer’s sole responsibility to determine whether the NXP

Semiconductors product is suit able and fit for t he customer’s applications and

products planned, as well as fo r the planned application and use of

customer’s third party customer(s). Custo mers should provide appropriate

design and operating safeguards to minimize the risks associated with t heir

applications and products.

NXP Semiconductors does not accept any liability related to any default,

damage, costs or problem which is based on any weakness or default in the

customer’s applications or products, or the application or use by customer’s

third party custo mer(s). Customer is responsible for doing all necessary

testing for the customer’s applications and products using NXP

Semiconductors products in order to avoid a default of the applications and

the products or of the application or use by customer’s third party

customer(s). NXP does not accept any liability in this respect.

Limiting values — Stress above one or more limiting values (as defined in

the Absolute Maximum Ratings System of IEC 60134) will cause permanent

damage to the device. Limiting values are stress ratings only and (proper)

operation of the device at these or any other conditions above those given in

the Recommended operating conditions section (if present) or the

Characteristics sections of this document is not warranted. Constant or

repeated exposure to limiting values will permanently and irreversibly affect

the quality and reliability of the device.

Terms and conditions of commercial sale — NXP Semiconductors

products are sold subject to the general terms and conditions of commercial

sale, as published at http://www.nxp.com/profile/terms, unless otherwise

agreed in a valid written individua l agreement. In case an individual

agreement is concluded only the terms and conditions of the respective

agreement shall apply. NXP Semiconductors hereby expressly objects to

applying the customer’s general terms and conditions with regard to the

purchase of NXP Semiconductors products by customer.

No offer to sell or license — Nothing i n this document may be interpreted or

construed as an of fer t o sell product s that is open for accept ance or the gr ant,

conveyance or implication of any license under any copyrights, patents or

other industrial or inte llectual property rights.

Document status[1][2] Product status[3] Definition

Objective [short] data sheet Development This document contains data from the objective specification for product development .

Preliminary [short] dat a sheet Qualification This document contains data from the preliminary specification.

Product [short] data sheet Production This document cont ains the product specification.

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 147 of 149

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

Export control — This document as well as the item(s) described herein

may be subject to export control regulations. Export might require a prior

authorization from competent authorities.

Quick reference data — The Quick reference data is an extract of the

product data given in the Limiting values and Characteristics sections of this

document, and as such is not complete, exhaustive or legally binding.

Non-automotive qualified products — Unless this data sheet expressly

states that this specific NXP Semiconductors product is automotive qualified,

the product is not suitable for automotive use. It i s neither qua lif ied nor test ed

in accordance with automotive testing or application requirements. NXP

Semiconductors accepts no liability for inclusion and/or use of

non-automotive qualified products in automotive equipment or applications.

In the event that customer uses the product for design-in and use in

automotive applications to automot ive specifications and standards, custome r

(a) shall use the product without NXP Semiconductors’ warranty of the

product for such au tomotive applications, use and specifications, and (b)

whenever customer uses the product for automotive applications beyond

NXP Semiconductors’ specifications such use shall be solely at customer’s

own risk, and (c) customer fully indemnifies NXP Semiconductors for any

liability, damages or failed product claims resulting from customer design and

use of the product for automotive appl ications beyond NXP Semiconductors’

standard warrant y and NXP Semiconductors’ product specifications.

Translations — A non-English (translated) version of a document is for

reference only. The English version shall prevail in case of any discrepancy

between the translated and English versions.

26.4 Licenses

26.5 Trademarks

Notice: All referenced b rands, produc t names, service names and trademarks

are the property of their respective ow ners.

MIFARE — is a trademark of NXP B.V.

ICODE and I-CODE — are trademarks of NXP B.V.

27. Contact information

For more information, please visit: http://www.nxp.com

For sales office addresses, please send an email to: salesaddresses@nxp.com

Purchase of NXP ICs with NFC technology

Purchase of an NXP Semiconductors IC that co mplies with one of the Near

Field Communication (NFC) standards ISO/IEC 18092 and ISO/IEC 21481

does not convey an implied license under any patent right infringed by

implementation of any of those standards. Purchase of NXP

Semiconductors IC does not include a license to any NXP patent (or other

IP right) covering combinations of those products with other products,

whether hardware or software.

Purchase of NXP ICs with ISO/IEC 14443 type B functionality

This NXP Semiconductors IC is I SO/IEC 14443 T ype B

software enabled and is licensed under Innovatron’s

Contactless Card p atents license for ISO/IEC 144 43 B.

The license includes the right to use the IC in systems

and/or end-user equipment.

RATP/Innovatron

Technology

Product data sheet

COMPANY PUBLIC Rev. 3.0 — 7 October 2016

240930 148 of 149

continued >>

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

28. Contents

1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2 General description. . . . . . . . . . . . . . . . . . . . . . 1

3 Features and benefits . . . . . . . . . . . . . . . . . . . . 2

4 Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

5 Quick reference data . . . . . . . . . . . . . . . . . . . . . 3

6 Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Version 3.4: Allows EMVCO 2.3.1 compliant

EMD error handling . . . . . . . . . . . . . . . . . . . . . .3

Version 3.5: Allows EMVCO 2.5 compliant

EMD error handling . . . . . . . . . . . . . . . . . . . . . .3

Version 3.6: Automatic Receiver Control

added . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

7 Ordering information. . . . . . . . . . . . . . . . . . . . . 4

8 Marking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

8.1 Package marking drawing . . . . . . . . . . . . . . . . 7

9 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 7

10 Pinning information. . . . . . . . . . . . . . . . . . . . . . 8

10.1 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . 8

11 Functional description . . . . . . . . . . . . . . . . . . 10

11.1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . 10

11.2 Power-up and Clock . . . . . . . . . . . . . . . . . . . . 10

11.2.1 Power Management Unit . . . . . . . . . . . . . . . . 10

11.2 .1.1 Sup ply Connections and Power-up . . . . . . . . 10

11.2.1.2 Power-down . . . . . . . . . . . . . . . . . . . . . . . . . . 11

11.2.1.3 Standby . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

11.2.1.4 Temperature Sensor. . . . . . . . . . . . . . . . . . . . 12

11.2.2 Reset and start-up time . . . . . . . . . . . . . . . . . 12

11.2.3 Clock concept. . . . . . . . . . . . . . . . . . . . . . . . . 12

11.3 Timer and Interrupt system. . . . . . . . . . . . . . . 13

11.3.1 General Purpose Timer . . . . . . . . . . . . . . . . . 13

11.3.2 Interrupt System . . . . . . . . . . . . . . . . . . . . . . . 14

11.3.2.1 IRQ PIN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

11.3.2.2 IRQ_STATUS Register. . . . . . . . . . . . . . . . . . 14

11.4 SPI Host Interface . . . . . . . . . . . . . . . . . . . . . 14

11.4.1 Physical Host Interface. . . . . . . . . . . . . . . . . . 14

11.4.2 Timing Specification SPI . . . . . . . . . . . . . . . . 16

11.4.3 Logical Host Interface. . . . . . . . . . . . . . . . . . . 17

11.4.3.1 Host Interface Command . . . . . . . . . . . . . . . . 17

11.4.3.2 Transmission Buffer . . . . . . . . . . . . . . . . . . . . 18

11.4.3.3 Host Interface Command List. . . . . . . . . . . . . 18

11.5 Memories . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

11.5.1 Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

11.5.2 EEPROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

11.5.3 RAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

11.5.4 Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

11.6 Debug Signals . . . . . . . . . . . . . . . . . . . . . . . . 46

11.6.1 General functionality . . . . . . . . . . . . . . . . . . . 46

11.6.2 Digital Debug Configuration . . . . . . . . . . . . . 46

11.6.2.1 Debug signal groups . . . . . . . . . . . . . . . . . . . 47

11.6.2.2 Digital Debug Output Pin Configuration. . . . . 49

11.6.3 Analog Debug Configuration . . . . . . . . . . . . . 49

11.7 AUX2 / DWL_REQ. . . . . . . . . . . . . . . . . . . . . 49

11.7.1 Firmware update . . . . . . . . . . . . . . . . . . . . . . 49

11.7 .2 Firmware update command set . . . . . . . . . . . 50

11.8 RF Functionality. . . . . . . . . . . . . . . . . . . . . . . 50

11.8 .1 Supported RF Protocols. . . . . . . . . . . . . . . . . 50

11.8.1.1 ISO/IEC14443 A/MIFARE functionality . . . . . 50

11.8.1.2 ISO/IEC14443 B functionality . . . . . . . . . . . . 53

11.8.1.3 FeliCa RF functionality. . . . . . . . . . . . . . . . . . 53

11.8.1.4 ISO/IEC15693 functionality . . . . . . . . . . . . . . 55

11.8 .1.5 ISO/IEC18000-3 Mode 3 functionality . . . . . . 56

11.8.1.6 NFCIP-1 modes. . . . . . . . . . . . . . . . . . . . . . . 57

11.8.1.7 ISO/IEC14443 A Card operation mode . . . . . 60

11.8.1.8 NFC Configuration . . . . . . . . . . . . . . . . . . . . 60

11.8.1.9 Mode Detector . . . . . . . . . . . . . . . . . . . . . . . . 60

11.8 .2 RF-field handling . . . . . . . . . . . . . . . . . . . . . . 60

11.8.3 Transmitter TX . . . . . . . . . . . . . . . . . . . . . . . . 61

11.8.3.1 100 % Modulation . . . . . . . . . . . . . . . . . . . . . 61

11.8 .3.2 1 0 % Amplitude Modu lation . . . . . . . . . . . . . 62

11.8.3.3 TX Wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

11.8.3.4 Over- and Undershoot prevention . . . . . . . . . 64

11.8.4 Dynamic Power Control (DPC) . . . . . . . . . . . 64

11.8.5 Adaptive Waveform Control (AWC) . . . . . . . . 67

11.8.6 Adaptive Receiver Control (ARC) . . . . . . . . . 68

11.8.7 Transceive state machine . . . . . . . . . . . . . . . 69

11.8.8 Autocoll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

11.8.9 Receiver RX. . . . . . . . . . . . . . . . . . . . . . . . . . 72

11.8.9.1 Reader Mode Receiver . . . . . . . . . . . . . . . . . 72

11.8.9.2 Automatic Gain Control . . . . . . . . . . . . . . . . . 74

11.8.9.3 RX Wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

11.8 .9.4 EMD Error handling . . . . . . . . . . . . . . . . . . . 74

11.8.10 Low-Power Card Detection (LPCD). . . . . . . . 75

11.8.10.1 Check Card register. . . . . . . . . . . . . . . . . . . . 80

11.9 Register overview . . . . . . . . . . . . . . . . . . . . . 81

11.9.1 Register overview . . . . . . . . . . . . . . . . . . . . . 81

11.9.2 Register description . . . . . . . . . . . . . . . . . . . . 82

12 Secure Firmware Update . . . . . . . . . . . . . . . 105

12.1 General functionality . . . . . . . . . . . . . . . . . . 105

12.2 Physi cal Host Interface during Secure

Firmware Download. . . . . . . . . . . . . . . . . . . 106

12.3 Download Protection . . . . . . . . . . . . . . . . . . 107

12.4 Commands . . . . . . . . . . . . . . . . . . . . . . . . . 108

12.4.1 Frame format . . . . . . . . . . . . . . . . . . . . . . . . 108

12.4.2 Command Code Overview. . . . . . . . . . . . . . . 110

NXP Semiconductors PN5180

High-performance multi-pr otocol full NFC Forum-compliant frontend

For more information, please visit: http://www.nxp.com

For sales office addresses, please send an email to: salesaddresses@nxp.com

Date of release: 7 October 2016

240930

Please be aware that important notices concerning this document and the product(s)

described herein, have been included in section ‘Legal information’.

12.4.3 Command Code Response . . . . . . . . . . . . . 110

12.4.4 Command Code Description . . . . . . . . . . . . 110

12.4.4.1 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 0

12.4.4.2 GET_VERSION . . . . . . . . . . . . . . . . . . . . . . 111

12.4.4.3 SECURE_WRITE. . . . . . . . . . . . . . . . . . . . . 111

12.4.4.4 GET_DIE_ID. . . . . . . . . . . . . . . . . . . . . . . . . 111

12.4.5 Error handling. . . . . . . . . . . . . . . . . . . . . . . . 112

13 Limiting values. . . . . . . . . . . . . . . . . . . . . . . . 112

14 Recommended operating conditions. . . . . . 112

15 Thermal characteristics . . . . . . . . . . . . . . . . 113

16 Characteristics. . . . . . . . . . . . . . . . . . . . . . . . 113

17 Application information. . . . . . . . . . . . . . . . . 118

17.1 Typical component values . . . . . . . . . . . . . . 118

18 Packaging information . . . . . . . . . . . . . . . . . 120

19 Package outline . . . . . . . . . . . . . . . . . . . . . . . 124

20 Soldering of SMD packages . . . . . . . . . . . . . 126

20.1 Introductio n to soldering . . . . . . . . . . . . . . . . 126

20.2 Wave and reflow soldering . . . . . . . . . . . . . . 126

20.3 Wave soldering. . . . . . . . . . . . . . . . . . . . . . . 126

20.4 Reflow soldering. . . . . . . . . . . . . . . . . . . . . . 127

21 Soldering . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

22 Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

22.1 Timer Delay for start of reception

measurement . . . . . . . . . . . . . . . . . . . . . . . . 130

22.2 Default protocol settings for

LOAD_RF_CONFIG, Transmitter . . . . . . . . . 130

22.2.1 ISO/IEC 14443 A-106. . . . . . . . . . . . . . . . . . 130

22.2.2 ISO/IEC 14443 A-212. . . . . . . . . . . . . . . . . . 131

22.2.3 ISO/IEC 14443 A-424. . . . . . . . . . . . . . . . . . 131

22.2.4 ISO/IEC 14443 A-848. . . . . . . . . . . . . . . . . . 131

22.2.5 ISO/IEC 14443 B-106. . . . . . . . . . . . . . . . . . 131

22.2.6 ISO/IEC 14443 B-212. . . . . . . . . . . . . . . . . . 132

22.2.7 ISO/IEC 14443 B-424. . . . . . . . . . . . . . . . . . 132

22.2.8 ISO/IEC 14443 B-848. . . . . . . . . . . . . . . . . . 132

22.2.9 Felica-212. . . . . . . . . . . . . . . . . . . . . . . . . . . 132

22.2.10 Felica-424. . . . . . . . . . . . . . . . . . . . . . . . . . . 133

22.2.11 NF C active initiator A-106. . . . . . . . . . . . . . . 133

22.2.12 NFC active initiator A-212. . . . . . . . . . . . . . . 133

22.2.13 NFC active initiator A-424. . . . . . . . . . . . . . . 133

22.2.14 ISO/IEC15693-26 . . . . . . . . . . . . . . . . . . . . . 134

22.2.15 ISO/IEC15693-53 . . . . . . . . . . . . . . . . . . . . . 134

22.2.16 ISO/IEC 18003M3 - TARI=18.88 ms . . . . . . . 134

22.2.17 ISO/IEC 18003M3 - TARI=9.44 ms . . . . . . . . 134

22.2.18 PICC ISO/IEC14443-A 106 . . . . . . . . . . . . . 135

22.2.19 PICC ISO/IEC14443-A 212 . . . . . . . . . . . . . 135

22.2.20 PICC ISO/IEC14443-A 424 . . . . . . . . . . . . . 135

22.2.21 PICC ISO/IEC14443-A 848 . . . . . . . . . . . . . 135

22.2.22 NFC passive target 212 . . . . . . . . . . . . . . . . 135

22.2.23 NFC passive target 424 . . . . . . . . . . . . . . . . 136

22.2.24 NFC active target 106 . . . . . . . . . . . . . . . . . 136

22.2.25 NFC active target 212 . . . . . . . . . . . . . . . . . 136

22.2.26 NFC active target 424 . . . . . . . . . . . . . . . . . 136

22.2.27 NFC general target mode - all data rates. . . 137

22.3 Defa ult protocol settings for

LOAD_RF_CONFIG, Receiver. . . . . . . . . . . 137

22.3.1 ISO/IEC 14443 A-106 . . . . . . . . . . . . . . . . . 137

22.3.2 ISO/IEC 14443 A-212 . . . . . . . . . . . . . . . . . 137

22.3.3 ISO/IEC 14443 A-424 . . . . . . . . . . . . . . . . . 137

22.3.4 ISO/IEC 14443 A-848 . . . . . . . . . . . . . . . . . 137

22.3.5 ISO/IEC 14443 B-106 . . . . . . . . . . . . . . . . . 138

22.3.6 ISO/IEC 14443 B-212 . . . . . . . . . . . . . . . . . 138

22.3.7 ISO/IEC 14443 B-424 . . . . . . . . . . . . . . . . . 138

22.3.8 ISO/IEC 14443 B-848 . . . . . . . . . . . . . . . . . 138

22.3.9 Felica 212 . . . . . . . . . . . . . . . . . . . . . . . . . . 139

22.3.10 FeliCa 424 . . . . . . . . . . . . . . . . . . . . . . . . . . 139

22.3.11 NFC Active Initiator 106. . . . . . . . . . . . . . . . 139

22.3.12 NFC Active Initiator 212. . . . . . . . . . . . . . . . 139

22.3.13 NFC Active Initiator 424. . . . . . . . . . . . . . . . 139

22.3.14 ISO/IEC 15693-26 . . . . . . . . . . . . . . . . . . . . 140

22.3.15 ISO/IEC 15693-53 . . . . . . . . . . . . . . . . . . . . 140

22.3.16 ISO 18003M3- Tari 18.88. . . . . . . . . . . . . . . 140

22.3.17 ISO 18003M3- Tari 9.44 848_2 . . . . . . . . . . 140

22.3.18 ISO 18003M3- Tari 9.44 -848_4. . . . . . . . . . 141

22.3.19 ISO 14443A-PICC 106. . . . . . . . . . . . . . . . . 141

22.3.20 ISO 14443A-PICC 212. . . . . . . . . . . . . . . . . 141

22.3.21 ISO 14443A-PICC 424. . . . . . . . . . . . . . . . . 141

22.3.22 ISO 14443A-PICC 848. . . . . . . . . . . . . . . . . 141

22.3.23 NFC-Passive target -212 . . . . . . . . . . . . . . . 142

22.3.24 NFC-Passive target -424 . . . . . . . . . . . . . . . 142

22.3.25 NFC-active target - 106 . . . . . . . . . . . . . . . . 142

22.3.26 NFC-active target - 212 . . . . . . . . . . . . . . . . 142

22.3.27 NFC-active target - 424 . . . . . . . . . . . . . . . . 142

22.3.28 NFC-General target mode - all data rates . . 143

23 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . 144

24 References. . . . . . . . . . . . . . . . . . . . . . . . . . . 144

25 Revision history . . . . . . . . . . . . . . . . . . . . . . 145

26 Legal information . . . . . . . . . . . . . . . . . . . . . 146

26.1 Data sheet status. . . . . . . . . . . . . . . . . . . . . 146

26.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . 146

26.3 Disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . 146

26.4 Licenses. . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

26.5 Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . 147

27 Contact information . . . . . . . . . . . . . . . . . . . 147

28 Contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148