PN5180 High-performance multi-protocol full NFC Forum-compliant frontend Rev. 3.0 -- 7 October 2016 240930 Product data sheet COMPANY PUBLIC 1. Introduction This document describes the functionality and electrical specification of the high-power NFC IC PN5180. Additional documents supporting a design-in of the PN5180 are available from NXP, this information is not part of this document. 2. General description PN5180, the best full NFC frontend on the market. As a highly integrated high performance full NFC Forum-compliant frontend IC for contactless communication at 13.56 MHz, this frontend IC utilizes an outstanding modulation and demodulation concept completely integrated for different kinds of contactless communication methods and protocols. The PN5180 ensures maximum interoperability for next generation of NFC enabled mobile phones. The PN5180 is optimized for point of sales terminal applications and implements a high-power NFC frontend functionality which allows to achieve EMV compliance on RF level without additional external active components. The PN5180 frontend IC supports the following RF operating modes: * * * * * * * * * Reader/Writer mode supporting ISO/IEC 14443-A up to 848 kBit/s, MIFARE Reader/Writer mode supporting ISO/IEC 14443-B up to 848 kBit/s Reader/Writer mode supporting JIS X 6319-4 (comparable with FeliCa scheme) Supports reading of all NFC tag types (type 1, type 2, type 3, type 4A and type 4B) Reader/Writer mode supporting ISO/IEC 15693 Reader/Writer mode supporting ISO/IEC 18000-3 Mode 3 ISO/IEC 18092 (NFC-IP1) ISO/IEC 21481 (NFC-IP-2) ISO/IEC 14443-type A Card emulation up to 848 kBit/s One host interface based on SPI is implemented: * SPI interface with data rates up to 7 Mbit/s with MOSI, MISO, NSS and SCK signals * Interrupt request line to inform host controller on events * EEPROM configurable pull-up resistor on SPI MISO line PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend * Busy line to indicate to host availability of data for reading The PN5180 supports highly innovative and unique features which do not require any host controller interaction. These unique features include Dynamic Power Control (DPC), Adaptive Waveform Control (AWC), Adaptive Receiver Control (ARC), and fully automatic EMD error handling. The independency of real-time host controller interactions makes this product the best choice for systems which operate a preemptive multi-tasking OS like Linux or Android. As new power-saving feature the PN5180 allows using a general-purpose output to control an external LDO or DC/DC during Low-Power Card Detection. One general-purpose output is used to wake-up an LDO or DC/DC from power-saving mode before the RF field for an LPCD polling cycle is switched on. The PN5180 supports an external silicon system-power-on switch by using the energy of the RF field generated by an NFC phone to switch on the system, like it is generated during the NFC polling loop. This unique and new Zero-Power-Wake-up feature allows designing systems with a power consumption close to zero during standby. 3. Features and benefits Transmitter current up to 250 mA Dynamic Power Control (DPC) for optimized RF performance, even under detuned antenna conditions Adaptive Waveform Control (AWC) automatically adjusts the transmitter modulation for RF compliancy Adaptive Receiver Control (ARC) automatically adjusts the receiver parameters for always reliable communication Includes NXP ISO/IEC14443-A, Innovatron ISO/IEC14443-B and NXP MIFARE Crypto 1 intellectual property licensing rights Full compliancy with all standards relevant to NFC, contactless operation and EMVCo Active load modulation supports smaller antenna in Card Emulation Mode Automatic EMD handling performed without host interaction relaxes the timing requirements on the Host Controller Low-power card detection (LPCD) minimizes current consumption during polling Automatic support of system LDO or system DC/DC power-down mode during LPCD Zero-Power-Wake-up Small, industry-standard packages NFC Cockpit: PC-based support tool for fast configuration of register settings Development kit with 32-bit NXP LPC1769 MCU and antenna NFC Reader Library with source code ready for EMVCo L1 and NFC Forum compliance PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 2 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 4. Applications Payment Physical-access eGov Industrial 5. Quick reference data Table 1. Quick reference data Symbol Parameter Conditions Min Typ Max Unit VDD(VBAT) supply voltage on pin VBAT - 2.7 3.3 5.5 V VDD(PVDD) supply voltage on pin PVDD 1.8 V supply 1.65 1.8 1.95 V 3.3 V supply 2.7 3.3 3.6 V VDD(TVDD) supply voltage on pin TVDD - 2.7 5.0 5.5 V Ipd power-down current VDD(TVDD) = VDD(PVDD) =VDD(VDD) 3.0 V; hard power-down; pin RESET_N set LOW, Tamb = 25 C - 10 - A Istb standby current Tamb = 25 C - 15 - A IDD(TVDD) supply current on pin TVDD - - 180 250 mA Tamb ambient temperature in still air with exposed pins soldered on a 4 layer JEDEC PCB 30 +25 +85 C Tstg storage temperature no supply voltage applied 55 +25 +150 C 6. Versions Available firmware versions: Version 3.4: Allows EMVCO 2.3.1 compliant EMD error handling Version information: * EEPROM address 0x12: 0x04 * EEPROM address 0x13: 0x03 Version 3.5: Allows EMVCO 2.5 compliant EMD error handling Version information: * EEPROM address 0x12: 0x05 * EEPROM address 0x13: 0x03 Changes of Version 2.5 compared to Version 2.4: * The EMD_CONTROL register is updated to support EMVCo 2.5. * Adaptive Waveform Control (AWC) implemented PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 3 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Version 3.6: Automatic Receiver Control added No silicon initialized with this firmware is available. Usage of this firmware requires an update by the user. Version information: * EEPROM address 0x12: 0x06 * EEPROM address 0x13: 0x03 Changes of Version 3.6 compared to Version 2.5: * Accessible EEPROM top address is changed to 0xFE * EEPROM functional assignment starting at address 0xD8 * EEPROM updates to support using GPO1 during LPCD card detect and GPIO2 during wake-up from standby * Adaptive Receiver configuration (ARC) available: EEPROM table updates for receiver configuration * Energy of external RF field can be used to operate an external system-power-on switch 7. Ordering information Table 2. Ordering information Type number PN5180A0HN/C1, 551 Package Name Description Version HVQFN40 Firmware version 3.4. Plastic thermal enhanced very thin quad flat package; no leads; SOT618-1 32 terminals + 1 central ground; body 6 x 6 x 1.0 mm; delivered in one tray, bakable, MSL=3. PN5180A0HN/C1, 518 HVQFN40 Firmware version 3.4. Plastic thermal enhanced very thin quad flat package; no leads; SOT618-1 32 terminals + 1 central ground; body 6 x 6 x 1.0 mm; delivered on reel MSL = 3. PN5180A0ET/C1, 151 TFBGA64 Firmware version 3.4. Plastic thin fine-pitch ball grid array package; 64 balls, delivered in one tray, MSL = 1. SOT1336-1 PN5180A0ET/C1, 118 TFBGA64 Firmware version 3.4. Plastic thin fine-pitch ball grid array package; 64 balls, delivered on reel, MSL = 1. SOT1336-1 PN5180A0HN/C2, 551 HVQFN40 Firmware version 3.5. Plastic thermal enhanced very thin quad flat package; no leads; SOT618-1 32 terminals + 1 central ground; body 6 x 6 x 1.0 mm; delivered in one tray, bakable, MSL=3. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 4 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 2. Ordering information Type number PN5180A0HN/C2, 518 Package Name Description Version HVQFN40 Firmware version 3.5. Plastic thermal enhanced very thin quad flat package; no leads; SOT618-1 32 terminals + 1 central ground; body 6 x 6 x 1.0 mm; delivered on reel MSL = 3. PN5180A0ET/C2, 151 TFBGA64 Firmware version 3.5. Plastic thin fine-pitch ball grid array package; 64 balls, delivered in one tray, MSL = 1. SOT1336-1 PN5180A0ET/C2, 118 TFBGA64 Firmware version 3.5. Plastic thin fine-pitch ball grid array package; 64 balls, delivered on reel, MSL = 1. SOT1336-1 The PN5180 is not available with pre-installed firmware version 3.6. 8. Marking Table 3. Marking codes HVQFN40 Type number Marking code PN5180 (first Engineering prototypes) Line A: These devices are intended for prototype development only, PN51800 or PN5180A Line B1: "01... 01" or 6 characters: Diffusion Batch ID and assembly sequence ID Line B2: "FW 1.1" or "Z.1 01" Line C: Engineering prototypes are marked "Product life cycle status code Before CQS": X 8 characters: diffusion and assembly location, date code, product version (indicated by mask version), product life cycle status. This line includes the following elements at 8 positions: 1. Diffusion center code 2. Assembly center code 3. RHF-2006 indicator 4. Year code (Y) 1) 5. Week code (W) 2) 6. Week code (W) 2) 7. Mask layout version 8. (Product life cycle status code Before CQS) X PN5180 (devices are customer qualification samples) PN5180 Product data sheet COMPANY PUBLIC Line A: PN5180A Line B1: 6 characters: Diffusion Batch ID and assembly sequence ID Line B2: blank All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 5 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 3. Marking codes ...continuedHVQFN40 Type number Marking code Line C: Customer qualification samples are marked as CQS: X or Y 8 characters: diffusion and assembly location, date code, product version (indicated by mask version), product life cycle status. This line includes the following elements at 8 positions: 1. Diffusion center code 2. Assembly center code 3. RHF-2006 indicator 4. Year code (Y) 1) 5. Week code (W) 2) 6. Week code (W) 2) 7. Mask layout version 8. (Product life cycle status code CQS): X or Y PN5180A0HN This product is released for sale (volume production). Line A: PN5180A Line B: 6 characters: Diffusion Batch ID and assembly sequence ID Line C: Release for sale products do not show any X or Y, instead position 8 is left blank 8 characters: diffusion and assembly location, date code, product version (indicated by mask version), product life cycle status. This line includes the following elements at 8 positions: 1. Diffusion center code 2. Assembly center code 3. RHF-2006 indicator 4. Year code (Y) 1) 5. Week code (W) 2) 6. Week code (W) 2) 7. Mask layout version 8. (Product life cycle status release for sale): blank Note that the Firmware of the product PN5180 can be updated. Due to the update capability, the marking of the package does not allow identifying the installed version of the actual programmed firmware. The firmware version can be retrieved from address 0x12 in EEPROM. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 6 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 8.1 Package marking drawing Terminal 1 index area A :7 B1 : 6 B2 : 6 C:8 0 5 aaa-007965 Fig 1. Marking PN5180 in HVQFN40 The Marking of the TFBGA version can be found in the data sheet addendum which is available through the NXP DocStore. 9. Block diagram CLK1 CLK2 PVDD SYSTEM CLOCK VBAT VOLTAGE REGULATOR MOSI DIGITAL PROCESSING AUX1 AUX2 DEBUG INTERFACE 1.8 V VDD VSS DVDD SCK NSS BUSY IRQ HOST INTERFACE MISO RESET_N AVDD TX1 TRANSMITTER TX2 TVSS ANALOG PROCESSING RXP GPO RECEIVER VMID RXN PVSS DVSS Fig 2. PN5180 Product data sheet COMPANY PUBLIC AVSS aaa-023610 PN5180 Block diagram All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 7 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 31 n.c. 32 n.c. 33 n.c. 34 n.c. 35 n.c. 36 CLK1 37 CLK2 38 GPO1 terminal 1 index area 39 IRQ 40 AUX1 10. Pinning information NSS 1 30 DVDD AUX2/DWL_REQ 2 29 VDD MOSI 3 28 AVDD PVSS 4 27 VSS MISO 5 PVDD 6 SCK 7 24 ANT2 BUSY 8 23 ANT1 VSS 9 22 TVDD 26 VBAT PN5180 25 VDHF n.c. 20 TVSS 19 TX2 18 VMID 17 RXP 16 RXN 15 n.c. 14 VBAT 13 n.c. 11 21 TX1 VBAT 12 RESET_N 10 aaa-024663 Transparent top view Fig 3. Pin configuration for HVQFN40 (SOT618-1) 10.1 Pin description Table 4. PN5180 Product data sheet COMPANY PUBLIC Pin description HVQFN40 Symbol Pin Type Description NSS 1 I SPI NSS AUX2 /DWL_REQ 2 I/O Analog test bus or Download request MOSI 3 I SPI MOSI PVSS 4 supply Pad ground MISO 5 O SPI MISO PVDD 6 supply Pad supply voltage SCK 7 I SPI Clock BUSY 8 O Busy signal VSS 9 supply Ground RESET_N 10 I RESET, Low active n.c. 11 - leave unconnected, do not ground VBAT 12 supply Supply Connection, all VBAT mandatory to be connected VBAT 13 supply Supply Connection, all VBAT mandatory to be connected n.c. 14 - leave unconnected, do not ground RXN 15 I Receiver Input RXP 16 I Receiver Input VMID 17 supply Stabilizing capacitor connection output TX2 18 O Antenna driver output 2 TVSS 19 supply Antenna driver ground All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 8 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 4. Pin description HVQFN40 ...continued Symbol Pin Type Description n.c. 20 - leave unconnected, do not ground TX1 21 O Antenna driver output 1 TVDD 22 supply Antenna driver supply ANT1 23 I Antenna connection 1 for load modulation in card emulation mode (only in case of PLM) ANT2 24 I Antenna connection 2 for load modulation in card emulation mode (only in case of PLM) VDHF 25 supply Stabilizing capacitor connection output VBAT 26 supply Supply Connection, all VBAT mandatory to be connected VSS 27 supply Ground AVDD 28 supply Analog VDD supply voltage input (1.8 V), connected to VDD VDD 29 supply VDD output (1.8 V) DVDD 30 supply Digital supply voltage input (1.8 V), connected to VDD n.c. 31 - leave unconnected, do not ground n.c. 32 - leave unconnected, do not ground n.c. 33 - leave unconnected, do not ground n.c. 34 - leave unconnected, do not ground n.c. 35 - leave unconnected, do not ground CLK1 36 I Clock input for crystal. This pin is also used as input for an external generated accurate clock (8 MHz, 12 MHz, 16 MHz, 24 MHz, other clock frequencies not supported) CLK2 37 O Clock output (amplifier inverted signal output) for crystal GPO1 38 O (double function pin) GPO1, Digital output 1 IRQ 39 O Interrupt request output, active level configurable AUX1 40 O Analog/Digital Test signal The pinning of the TFBGA version can be found in the data sheet addendum which is available through the NXP DocStore. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 9 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11. Functional description 11.1 Introduction The PN5180 is a High-Power NFC frontend. It implements the RF functionality like an antenna driving and receiver circuitry and all the low-level functionality to realize an NFC Forum-compliant reader. The PN5180 connects to a host microcontroller with a SPI interface for configuration, NFC data exchange and high-level NFC protocol implementation. The PN5180 allows different supply voltages for NFC drivers, internal supply and host interface providing a maximum of flexibility. The chip supply voltage and the NFC driver voltage can be chosen independently from each other. The PN5180 uses an external 27.12 MHz crystal as clock source for generating the RF field and its internal digital logic. In addition, an internal PLL allows using an accurate external clock source of either 8, 12, 16, 24 MHz. This saves the 27.12 MHz crystal in systems which implement one of the mentioned clock frequencies (e.g. for USB or system clock). Two types of memory are implemented in the PN5180: RAM and EEPROM. Internal registers of the PN5180 state machine store configuration data. The internal registers are reset to initial values in case of PowerON, and Hardware-reset and standby. The RF configuration for dedicated RF protocols is defined by EEPROM data which is copied by a command issued from the host microcontroller - LOAD_RF_CONFIG- into the registers of the PN5180. The PN5180 is initialized with EEPROM data for the LOAD_RF_CONFIG command which has been tested to work well for one typical antenna. For customer-specific antenna sizes and dedicated antenna environment conditions like metal or ferrite, the pre-defined EEPROM settings can be modified by the user. This allows users to achieve the maximum RF performance from a given antenna design. It is mandatory to use the command LOAD_RF_CONFIG for the selection of a specific RF protocol. The command LOAD_RF_CONFIG initializes the registers faster compared to individual register writes. 11.2 Power-up and Clock 11.2.1 Power Management Unit 11.2.1.1 Supply Connections and Power-up The Power Management Unit of the PN5180 generates internal supplies required for operation. The following pins are used to supply the IC: * PVDD - supply voltage for the SPI interface and control connections * VBAT - Supply Voltage input PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 10 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend * * * * TVDD - Transmitter supply AVDD - Analog supply input, connected to VDD DVDD - Digital supply input, connected to VDD VDD - 1.8 V output, to be connected to AVDD and DVDD Decoupling capacitors shall be placed as close as possible to the pins of the package. Any additional filtering/damping of the transmitter supply, e.g. by ferrite beads, might have an impact on the analog RF signal quality and shall be monitored carefully. Power-up sequence of the PN5180 * First ramp VBAT, PVDD can immediately follow, latest 2 ms after VBAT reaches 1.8 V. * There is no timing dependency on TVDD, only that TVDD shall rise equal or later to VBAT. * VBAT must be equal or higher than PVDD * TVDD has no other relationship to VBAT or PVDD voltage VBAT PVDD 1.8 V max 2ms time aaa-020676 Fig 4. Power-up voltages After power-up, the PN5180 is indicating the ability to receive command from a host microcontroller by an IDLE IRQ. There are configurations in EEPROM, which allow to specify the behavior of the PN5180 after start-up. LPCD (Low-power card detection) and DPC (dynamic power control) are functionalities which are configurable in EEPROM. 11.2.1.2 Power-down A hard power-down is enabled with LOW level on pin RESET_N. This low level puts the internal voltage regulators for the analog and digital core supply as well as the oscillator in a low-power state. All digital input buffers are separated from the input pads and clamped PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 11 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend internally (except pin RESET_N itself). IRQ, BUSY, AUX1, AUX2 have an internal pull down resistor which is activated on RESET_N ==0. All other output pins are switched to high impedance. To leave the power-down mode, the level at the pin RESET_N has to be set to HIGH. This high level starts the internal start-up sequence from Power-Down. 11.2.1.3 Standby The standby mode is entered immediately after sending the instruction SWITCH_MODE with standby command. All internal current sinks are set to low-power state. In opposition to the power-down mode, the digital input buffers are not separated by the input pads and keep their functionality. The digital output pins do not change their state. During standby mode, all registers values, the buffer content and the configuration itself are not kept, exceptions are the registers with addresses 05h(PADCONFIG_REG), 07h(PADOUT_REG) 25h (TEMP_CONTROL). To leave the standby mode, various possibilities do exist. The conditions for wake-up are configured in the register STBY_CFG_REG. * * * * Wake-up via Timer Wake-up via RF level detector Low Level on RESET_N PVDD disappears Any host communication (data is not validated) triggers the internal start-up sequence. The reader IC is in operation mode when the internal start-up sequence is finalized, and is indicating this by an IDLE IRQ. 11.2.1.4 Temperature Sensor The PN5180 implements a configurable temperature sensor. The temperature sensor is configurable by the TEMP_CONTROL register (25h). The Temperature Sensor supports temperature settings for 85 C, 115 C, 125 C and 135 C. In case the sensed device temperature is higher than configured, a TEMPSENS_ERROR IRQ is raised. In case of an TEMPSENS_ERROR, the Firmware is switching off the RF Field. Additionally host can set the device into standby. 11.2.2 Reset and start-up time A constant low level of at least 10 s at the RESET_N pin starts the internal reset procedure. When the PN5180 has finished the start_up, a IDLE_IRQ is raised and the IC is ready to receive commands on the host interface. 11.2.3 Clock concept The PN5180 is supplied by an 27.12 MHz crystal for operation. In addition, the internal PLL uses an accurate external clock source of either 8, 12, 16, 24 MHz instead of the crystal. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 12 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend The clock applied to the PN5180 provides a time basis for the RF encoder and decoder. The stability of the clock frequency, is an important factor for correct operation. To obtain optimum performance, clock jitter must be reduced as much as possible. Optimum performance is best achieved using the internal oscillator buffer with the recommended circuitry. In card emulation mode, the clock is also required. If an external clock source of 27.12 MHz is used instead of a crystal, the clock signal must be applied to pin CLK1. In this case, special care must be taken with the clock duty cycle and clock jitter (see Table 127). The crystal is a component which is impacting the overall performance of the system. A high-quality component is recommended here. The resistor RD1 reduces the start-up time of the crystal. A short start-up time is especially desired in case the Low-Power card detection is used. The values of these resistors depend on the crystal which is used. PN5180 CLK1 CLK2 RD1 RD1 VSS crystal CL1 CL1 aaa-020196 Fig 5. Connection of crystal 11.3 Timer and Interrupt system 11.3.1 General Purpose Timer The Timers are used to measure certain intervals between certain configurable events of the receiver, transmitter and other RF-events. The timer signals its expiration by raising a flag and the value of the timer may be accessed via the register-set. Three general-purpose timers T0, T1, and T2 running with the PN5180 clock with several start conditions, stop conditions, time resolutions, and maximal timer periods are implemented. For automatic timeout handling during MIFARE Authentication Timer2 is blocked during this operation. In case EMVCo EMD handling is enabled (EMD_CONTROL register (address 0028h), bit EMD_ENABLE) Timer1 is automatically restarted when an EMD event occurs. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 13 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Timers T0 to T2 has a resolution of 20 bits and may be operated at clock frequencies derived from the 13.56 MHz system clock. Several start events can be configured: start now, start on external RF-field on/off and start on Rx (receive)/Tx (transmit) started/ended. The timers allow reload of the counter value. At expiration of the timers, a flag is raised and an IRQ is triggered. The clock may be divided by a prescaler for frequencies of: * * * * * * * * 6.78 MHz 3.39 MHz 1.70 MHz 848 kHz 424 kHz 212 kHz 106 kHz 53 kHz 11.3.2 Interrupt System 11.3.2.1 IRQ PIN The IRQ_ENABLE_REG configures, which of the interrupts are routed to the IRQ pin of the PN5180. All of the interrupts can be enabled and disabled independent from each other. The IRQ on the pin can either be cleared by writing to the IRQ_SET_CLEAR register or by reading the IRQ_STATUS register (EEPROM configuration). If not all enabled IRQ's are cleared, the IRQ pin remains active. The polarity of the external IRQ signal is configured by EEPROM in IRQ_PIN_CONFIG (01Ah). 11.3.2.2 IRQ_STATUS Register The IRQ_STATUS register contains the status flags. The status flags cannot be disabled. Status Flag can either be cleared by writing to the IRQ_SET_CLEAR register or when the IRQ_STATUS register is read (EEPROM configuration) The PN5180 indicates certain events by setting bits in the register GENERAL_IRQ_STATUS_REG and additionally, if activated, on the pin IRQ. LPCD_IRQ, GENERAL_ERROR_IRQ and HV_ERROR_IRQ are non-maskable interrupts. 11.4 SPI Host Interface The following description of the SPI host interface is valid for the NFC operation mode. The Secure Firmware Download mode uses a different physical host interface handling. Details are described in chapter 12. 11.4.1 Physical Host Interface The interface of the PN5180 to a host microcontroller is based on a SPI interface, extended by signal line BUSY. The maximum SPI speed is 7 Mbps and fixed to CPOL = 0 and CPHA = 0. Only a half-duplex data transfer is supported. There is no chaining PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 14 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend allowed, meaning that the whole instruction has to be sent or the whole receive buffer has to be read out. The whole transmit buffer shall be written at once as well. No NSS assertion is allowed during data transfer. As the MISO line is per default high-ohmic in case of NSS high, an internal pull-up resistor can be enabled via EEPROM. The BUSY signal is used to indicate that the PN5180 is not able to send or receive data over the SPI interface. The host interface is designed to support the typical interface supply voltages of 1.8 V and 3.3 V of CPUs. A dedicated supply input which defines the host interface supply voltage independent from other supplies is available (PVDD). Only a voltage of 1.8 V or 3.3 V is supported, but no voltage in the range of 1.95 V to 2.7 V. * Master In Slave Out (MISO) The MISO line is configured as an output in a slave device. It is used to transfer data from the slave to the master, with the most significant bit sent first. The MISO signal is put into 3-state mode when NSS is high. * Master Out Slave In (MOSI) The MOSI line is configured as an input in a slave device. It is used to transfer data from the master to a slave, with the most significant bit sent first. * Serial Clock (SCK) The serial clock is used to synchronize data movement both in and out of the device through its MOSI and MISO lines. * Not Slave Select (NSS) The slave select input (NSS) line is used to select a slave device. It shall be set to low before any data transaction starts and must stay low during the transaction. * Busy During frame reception, the BUSY line goes ACTIVE and goes to IDLE when PN5180 is able to receive a new frame or data is available (depending if SET or GET frame is issued). If there is a parameter error, the IRQ is set to ACTIVE and a GENERAL_ERROR_IRQ is set. Both master and slave devices must operate with the same timing. The master device always places data on the MOSI line a half cycle before the clock edge SCK, in order for the slave device to latch the data. The BUSY line is used to indicate that the system is BUSY and cannot receive any data from a host. Recommendation for the BUSY line handling by the host: 1. Assert NSS to Low 2. Perform Data Exchange 3. Wait until BUSY is high 4. Deassert NSS 5. Wait until BUSY is low PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 15 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend In order to write data to or read data from the PN5180, "dummy reads" shall be performed. The Figure 8 and Figure 9 are illustrating the usage of this "dummy reads" on the SPI interface. MOSI MISO Set_Reg Get_Reg FF (data ignored) FF FF Rsp Get_Reg BUSY (idle low) aaa-011438 Fig 6. Read RX of SPI data using BUSY line Host TX SET instruction SET instruction Host RX 0xFF... 0xFF... BUSY aaa-018979 Fig 7. Writing data to the PN5180 Host TX GET instruction ignored Host RX 0xFF... Response of GET instruction BUSY aaa-018980 Fig 8. Reading data from the PN5180 11.4.2 Timing Specification SPI The timing condition for SPI interface is as follows: PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 16 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend tNSSH tSCKL tSCKH tSCKL SCK th(SCKL-Q) tsu(D-SCKH) th(SCKH-D) MOSI MSB LSB MISO MSB LSB t(SCKL-NSSH) NSS aaa-016093 Fig 9. Connection to host with SPI Remark: To send more bytes in one data stream, the NSS signal must be LOW during the send process. To send more than one data stream, the NSS signal must be HIGH between each data stream. Any data available to be read from the SPI interface is indicated by the BUSY signal de-asserted. 11.4.3 Logical Host Interface 11.4.3.1 Host Interface Command A Host Interface Command consists of either 1 or 2 SPI frames depending whether the host wants to write or read data from the PN5180. An SPI Frame consists of multiple bytes. The protocol used between the host and the PN5180 uses 1 byte indicating the instruction code and additional bytes for the payload (instruction-specific data). The actual payload size depends on the instruction used. The minimum length of the payload is 1 byte. This provides a constant offset at which message data begins. Byte 1 Byte 2 lnstruction Payload 1 Byte N Payload N ...... - Size of payload depends on Instruction - Minimum payload is 1 byte aaa-023432 Fig 10. Instruction Payload All commands are packed into one SPI Frame. An SPI Frame consists of multiple bytes. No NSS toggles allowed during sending of an SPI frame. For all 4 byte command parameter transfers (e.g. register values), the payload parameters passed follow the little endian approach (Least Significant Byte first). PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 17 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Direct Instructions are built of a command code (1 Byte) and the instruction parameters (max. 260 bytes). The actual payload size depends on the instruction used. Responses to direct instructions contain only a payload field (no header). All instructions are bound to conditions. If at least one of the conditions is not fulfilled, an exception is raised. Byte 1 Byte 2 Payload 1 Payload 2 Byte N Payload N ...... aaa-023431 Fig 11. Instruction Response In case of an exception, the IRQ line of PN5180 is asserted and corresponding interrupt status register contain information on the exception. 11.4.3.2 Transmission Buffer Two buffers are implemented in the PN5180. The transmission buffer has a buffer size of 260 bytes, the reception buffer has a size of 508 bytes. Both memories buffer the input and output data streams between the host and the internal state machine / contactless UART of the PN5180. Thus, it is possible to handle data streams with lengths of up to 260 bytes for transmission and up to 508 bytes for reception without taking timing constraints into account. 11.4.3.3 Table 5. Host Interface Command List 1-Byte Direct Commands and Direct Command Codes Command Command Description code WRITE_REGISTER 0x00 Write one 32bit register value WRITE_REGISTER_OR_MASK 0x01 Sets one 32bit register value using a 32 bit OR mask WRITE_REGISTER_AND_MASK 0x02 Sets one 32bit register value using a 32 bit AND mask WRITE_REGISTER_MULTIPLE 0x03 Processes an array of register addresses in random order and performs the defined action on these addresses. READ_REGISTER 0x04 Reads one 32bit register value READ_REGISTER_MULTIPLE 0x05 Reads from an array of max.18 register addresses in random order WRITE_EEPROM 0x06 Processes an array of EEPROM addresses in random order and writes the value to these addresses READ_EEPROM 0x07 Processes an array of EEPROM addresses from a start address and reads the values from these addresses WRITE_TX_DATA 0x08 This instruction is used to write data into the transmission buffer SEND_DATA 0x09 This instruction is used to write data into the transmission buffer, the START_SEND bit is automatically set. READ_DATA 0x0A This instruction is used to read data from reception buffer, after successful reception. SWITCH_MODE 0x0B This instruction is used to switch the mode. It is only possible to switch from NormalMode to standby, LPCD or Autocoll. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 18 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 5. 1-Byte Direct Commands and Direct Command Codes Command Command Description code MIFARE_AUTHENTICATE 0x0C This instruction is used to perform a MIFARE Classic Authentication on an activated card. EPC_INVENTORY 0x0D This instruction is used to perform an inventory of ISO18000-3M3 tags. EPC_RESUME_INVENTORY 0x0E This instruction is used to resume the inventory algorithm in case it is paused. EPC_RETRIEVE_INVENTORY_R 0x0F ESULT_SIZE This instruction is used to retrieve the size of the inventory result. EPC_RETRIEVE_INVENTORY_R 0x10 ESULT This instruction is used to retrieve the result of a preceding EPC_INVENTORY or EPC_RESUME_INVENTORY instruction. LOAD_RF_CONFIG 0x11 This instruction is used to load the RF configuration from EEPROM into the configuration registers. UPDATE_RF_CONFIG 0x12 This instruction is used to update the RF configuration within EEPROM. RETRIEVE_RF_CONFIG_SIZE 0x13 This instruction is used to retrieve the number of registers for a selected RF configuration RETRIEVE_RF_CONFIG 0x14 This instruction is used to read out an RF configuration. The register address-value-pairs are available in the response RF_ON 0x16 This instruction switch on the RF Field RF_OFF 0x17 This instruction switch off the RF Field ENABLE_TESTBUS_DIGITAL 0x18 Enables the Digital test bus ENABLE_TESTBUS_ANALOG 0x19 Enables the Analog test bus The following direct instructions are supported on the Host Interface: Detail Description of the instruction. WRITE_REGISTER Table 6. WRITE_REGISTER Payload Length (byte) Value/Description Command code 1 0x00 Parameter 1 Register address 4 Register content - - Response Description: This command is used to write a 32-bit value (little endian) to a configuration register. Condition: The address of the register must exist. If the condition is not fulfilled, an exception is raised. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 19 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend WRITE_REGISTER_OR_MASK Table 7. WRITE_REGISTER Payload Length (byte) Value/Description Command code 1 0x01 Parameter 1 Register address 4 OR_MASK Response - - Description: This command modifies the content of a register using a logical OR operation. The content of the register is read and a logical OR operation is performed with the provided mask. The modified content is written back to the register. Condition: The address of the register must exist. If the condition is not fulfilled, an exception is raised. WRITE _REGISTER_AND_MASK Table 8. WRITE_REGISTER_AND_MAKSK Payload Length (byte) Value/Description Command code 1 0x02 Parameter 1 Register address 4 AND_MASK Response - - Description: This command modifies the content of a register using a logical AND operation. The content of the register is read and a logical AND operation is performed with the provided mask. The modified content is written back to the register. Condition: The address of the register must exist. If the condition is not fulfilled, an exception is raised. WRITE_REGISTER_MULTIPLE Table 9. PN5180 Product data sheet COMPANY PUBLIC WRITE_REGISTER_MULTIPLE Payload Length (byte) Value/Description Command code 1 0x03 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 20 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 9. WRITE_REGISTER_MULTIPLE Payload Length (byte) Value/Description Parameter 5...210 Array of up to 42 elements {address, action, content} 1 byte Register address 1 byte Action 4 bytes Register content Response - - Description: This instruction allows processing actions on multiple addresses with a single command. Input parameter is an array of register addresses, actions, and values (little endian). The command processes this array, register addresses are allowed to be in random order. For each address, an individual ACTION can be defined. Parameter value is either the REGISTER_DATA, the OR MASK or the AND_MASK. ACTION that can be defined individually for each register address: * 0x01 WRITE_REGISTER * 0x02 WRITE_REGISTER_OR_MASK * 0x03 WRITE_REGISTER_AND_MASK Note: In case of an exception, the operation is not rolled-back, i.e. registers which have been modified until exception occurs remain in modified state. Host has to take proper actions to recover to a defined state. Write Multiple Registers: Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Command: 0x03 Register address WRITE_REGISTER: 0x01 Register content Register content Register content Register content .... LSB MSB aaa-023442 Fig 12. Write_Register_Multiple Modifying Multiple Registers with OR mask: Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Command: 0x03 Register address WRITE_REGISTER: _OR_MASK: 0x02 MASK MASK MASK MASK .... LSB MSB aaa-024843 Fig 13. WRITE_REGISTER_OR_MASK PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 21 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Modifying Multiple Registers with AND mask: Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Command: 0x03 Register address WRITE_REGISTER: _AND_MASK: 0x03 MASK MASK MASK MASK .... LSB MSB aaa-024844 Fig 14. WRITE_REGISTER_AND_MASK Condition: The address of the registers must exist. If the condition is not fulfilled, an exception is raised. READ_REGISTER Table 10. READ_REGISTER Payload Length (byte) Value/Description Command code 1 0x04 Parameter 1 Register address Response 4 Register content Description: This command is used to read the content of a configuration register. The content of the register is returned in the 4 byte response. Condition: The address of the register must exist. If the condition is not fulfilled, an exception is raised. READ_REGISTER_MULTIPLE Table 11. READ_REGISTER_MULTIPLE Payload Length (byte) Value/Description Command code 1 0x05 Parameter 1..18 Array of up to 18 elements {Register address} 1 byte Response 4..72 Register address Array of up to 18 4-byte elements {Register content} 4..72 byte Register content: n*4-Byte (32-bit) register data Description: PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 22 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend This command is used to read up to 18 configuration registers at once. The addresses are allowed to be in random order. The result (data of each register) is provided in the response to the command. Only the register values are included in the response. The order of the register contents within the response corresponds to the order of the register addresses within the command parameter. Condition: The address of the register must exist. The size of `Register Address' array must be in the range from 1 - 18, inclusive. If the condition is not fulfilled, an exception is raised. WRITE_EEPROM Table 12. WRITE_EEPROM Payload length (byte) Value/Description Command code 1 0x06 Parameter 1 Address in EEPROM from which write operation starts {EEPROM Address} 1..255 Array of up to 255 elements {EEPROM content} 1 byte Response - EEPROM content - Description: This command is used to write up to 255 bytes to the EEPROM. The field `EEPROM content' contains the data to be written to EEPROM starting at the address given by byte `EEPROM Address'. The data is written in sequential order. Condition: The EEPROM Address field must be in the range from 0 - 254, inclusive. The number of bytes within `Values' field must be in the range from 1 - 255, inclusive. If the condition is not fulfilled, an exception is raised. READ_EEPROM Table 13. READ_EEPROM Payload Length (byte) Value/Description Command code 1 0x07 Parameter 1 Address in EEPROM from which read operation starts (EEPROM Address) 1 Number of bytes to read from EEPROM 1..255 Array of up to 255 elements {EEPROM content} Response 1 byte EEPROM content Description: PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 23 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend This command is used to read data from EEPROM memory area. The field 'Address" indicates the start address of the read operation. The field Length indicates the number of bytes to read. The response contains the data read from EEPROM (content of the EEPROM); The data is read in sequentially increasing order starting with the given address. Condition: EEPROM Address must be in the range from 0 to 254, inclusive. Read operation must not go beyond EEPROM address 254. If the condition is not fulfilled, an exception is raised. WRITE_DATA Table 14. WRITE_DATA Payload Length (byte) Value/Description Command code 1 0x08 Parameter 1..260 Array of up to 260 bytes {Transmit data} 1 byte Response - Transmit data: Data written into the transmit buffer - Description: This command is used to write data into the RF transmission buffer. The size of this buffer is 260 bytes. After this instruction has been executed, an RF transmission can be started by configuring the corresponding registers. Condition: The number of bytes within the `Tx Data' field must be in the range from 1 to 260, inclusive. The command must not be called during an ongoing RF transmission. If the condition is not fulfilled, an exception is raised. SEND_DATA Table 15. SEND_DATA Payload Length (byte) Value/Description Command code 1 0x09 Parameter 1 Number of valid bits in last Byte 1...260 Array of up to 260 elements {Transmit data} 1 byte Response - Transmit data - Description: This command writes data to the RF transmission buffer and starts the RF transmission. The parameter `Number of valid bits in last Byte' indicates the exact number of bits to be transmitted for the last byte (for non-byte aligned frames). PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 24 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Precondition: Host shall configure the Transceiver by setting the register SYSTEM_CONFIG.COMMAND to 0x3 before using the SEND_DATA command, as the command SEND_DATA is only writing data to the transmission buffer and starts the transmission but does not perform any configuration. Table 16. Coding of `valid bits in last byte' Number/Parameter Functionality 0 All bits of last byte are transmitted 1-7 Number of bits within last byte to be transmitted. Note: When the command terminates, the transmission might still be ongoing, i.e. the command starts the transmission but does not wait for the end of transmission. Condition: The size of `Tx Data' field must be in the range from 0 to 260, inclusive (the 0 byte length allows a symbol only transmission when the TX_DATA_ENABLE is cleared).`Number of valid bits in last Byte' field must be in the range from 0 to 7. The command must not be called during an ongoing RF transmission. Transceiver must be in `WaitTransmit' state with `Transceive' command set. If the condition is not fulfilled, an exception is raised. READ_DATA Table 17. READ_DATA Payload Length (byte) Value/Description Command code 1 0x0A Parameter 1 x00 Response 1...508 Array of up to 508 elements {Receive data} 1 byte Receive data: data which had been received during last successful RF reception Description: This command reads data from the RF reception buffer, after a successful reception. The RX_STATUS register contains the information to verify if the reception had been successful. The data is available within the response of the command. The host controls the number of bytes to be read via the SPI interface. Condition: The RF data had been successfully received. In case the instruction is executed without preceding an RF data reception, no exception is raised but the data read back from the reception buffer is invalid. If the condition is not fulfilled, an exception is raised. SWITCH_MODE Table 18. PN5180 Product data sheet COMPANY PUBLIC SWITCH_MODE Payload Length (byte) Value/Description Command code 1 0x0B All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 25 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 18. SWITCH_MODE Payload Length (byte) Value/Description Parameter 1 Mode 1...n Array of `n' elements {Mode parameter} 1 byte Return value - Mode parameter: Number of total bytes depends on selected mode - Description: This instruction is used to switch the mode. It is only possible to switch from normal mode to Standby, LPCD or Autocoll mode. Switching back to normal mode is not possible using this instruction. The modes Standby, LPCD and Autocoll terminate on specific conditions. Once a configured mode (Standby, LPCD, Autocoll) terminates, normal mode is entered again. To force an exit from Standby, LPCD or Autocoll mode to normal mode, the host controller has to reset the PN5180. Condition: Parameter `mode' has to be in the range from 0 to- 2, inclusive. Dependent on the selected mode, different parameters have to be passed: In case parameter `mode' is set to 0 (Standby): Field `Wake-up Control' must contain a bit mask indicating the enabled wake-up sources and if GPO shall be toggled. Field `Wake-up Counter Value' must contain the value used for the wake-up counter (= time PN5180 remains in standby). The value shall be in the range from 1 - 2690, inclusive. Table 19. Standby configuration Parameter Length (byte) Value/Description Wake-up Control 1 Bit mask controlling the wake-up source to be used and GPO handling. Wake-up Counter Value 2 Used value for wake-up counter in msecs. Maximum supported value is 2690 Table 20. Standby wake-up counter configuration b7 b6 b5 b4 b3 b2 0 0 0 0 0 0 b1 b1 RFU X Wake-up on external RF field, if bit is set to 1b. X Wake-up on wake-up counter expires, if bit is set to 1b. The field has to be present, even if wake-up counter is not defined as wake-up source. In this case, the field `wake-up Counter value' is ignored. No instructions must be sent while being in this mode. Termination is indicated using an interrupt. In case parameter `mode' is set to 1 (LPCD): PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 26 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Field `Wake-up Counter Value' () defines the period between two LPCD attempts (=time PN5180 remains in standby) as has to be in the range from 1 to 2690, inclusive. No instructions must be sent while being in this mode. Termination is indicated using an interrupt. Table 21. LPCD wake-up counter configuration Parameter Length (bytes) Value/Description Wake-up Counter Value 2 Used value for wake-up counter in msecs. Maximum supported value is 2690. In case field `Mode' is set to 2 (Autocoll): Field `RF Technologies' must contain a bit mask indicating the RF Technologies to support during Autocoll, according to Field `Autocoll Mode' must be in the range from 0 to 2, inclusive. No instructions must be sent while being in this mode. Termination is indicated using an interrupt. Table 22. Autocoll wake-up counter configuration Parameter Length (bytes) Value/Description Wake-up Counter Value 2 Used value for wake-up counter in msecs. Maximum supported value is 2690. Parameter Length (bytes) Value/Description RF Technologies 1 Bit mask indicating the RF technology to listen for during Autocoll Autocoll Mode 1 0 Autonomous mode not used, i.e. Autocoll terminates when external RF field is not present. 1 Autonomous mode used. When no RF field is present, Autocoll automatically enters standby mode. Once RF external RF field is detected, PN5180 enters again Autocoll mode. 2 Same as 1 but without entering standby mode. Table 23. Table 24. Autocoll parameter Autocoll bit mask indicating the RF technologies b7 b6 b5 b4 0 0 0 0 b3 b2 b1 b1 RFU X If set, listening for NFC-F active is enabled X If set, listening for NFC-A active is enabled X If set, listening for NFC-F is enabled X PN5180 Product data sheet COMPANY PUBLIC If set, listening for NFC-A s enabled All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 27 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend MIFARE_AUTHENTICATE Table 25. MIFARE_AUTHENTICATE Payload Length (bytes) Value/Description Command code 1 0x0C Parameter 6 Key: Authentication key to be used 1 Key type to be used: 0x60 Key type A 0x61 Key type B Return value 1 Block address: The address of the block for which the authentication has to be performed. 4 UID of the card 1 Authentication Status Description: This command is used to perform a MIFARE Classic Authentication on an activated card. It takes the key, card UID and the key type to authenticate at a given block address. The response contains 1 byte indicating the authentication status. Condition: Field `Key' must be 6 bytes long. Field `Key Type' must contain the value 0x60 or 0x61. Block address may contain any address from 0x0 - 0xff, inclusive. Field `UID' must be 4 bytes long and should contain the 4 byte UID of the card. An ISO14443-3 MIFARE Classic card should be put into state ACTIVE or ACTIVE* prior to execution of this instruction. In case of an error related to the authentication, the return value `Authentication Status' is set accordingly (see Table 25). Attention: Timer2 is not available during the MIFARE Authentication If the condition is not fulfilled, an exception is raised. Table 26. PN5180 Product data sheet COMPANY PUBLIC Authentication status return value Payload Field Length (byte) Value/Description Authentication Status 1 0 Authentication successful. 1 Authentication failed (permission denied). 2 Timeout waiting for card response (card not present). 3..FF RFU All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 28 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend EPC_INVENTORY Table 27. EPC_INVENTORY PARAMETERS Payload Length Value/Description (byte) Command code 1 0x0D Parameter 1 SelectCommandLength: 0, 1 0 No Select command is set prior to "BeginRound" command. 'Valid Bits in last Byte' field and 'Select" Command shall not be present 1...39 Length (n) of the 'Select" command Valid Bits in last Byte 0..39 0 All bits of last byte of 'Select command' field are transmitted 1..7 Number of bits to be transmitted in the last byte of 'Select command' field. Array of up to 39 elements {Select} 1 byte Response Select: If present (dependent on the first parameter Select Command Length), this field contains the `Select' command (according to ISO18000-3) which is sent prior to a BeginRound command. CRC-16c shall not be included. 3 BeginRound: Contains the BeginRound command (according to ISO18000-3). CRC-5 shall not be included. 1 Timeslot behavior 0 0 Response contains max. Number of time slots which may fit in response buffer. 1 Response contains only one timeslot. 2 Response contains only one timeslot. If timeslot contains valid card response, also the card handle is included. - Description: This instruction is used to perform an inventory of ISO18000-3M3 tags. It implements an autonomous execution of several commands according to ISO18000-3M3 in order to guarantee the timings specified by this standard. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 29 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend EPC_INVENTORY received yes send_tx_buffer bit SelectCommand wait t4 time no BeginRound command EPC_RESUME_INVENTORY received Perform Card Check Send NextTimeSlot card detected no Card detected Correct PC/XPC received Store information in the RX buffer Card Check Error no yes GetHandle Only one timeslot no no yes Rx buffer full yes and correct PC/XPC received GetHandleFunction Set Rx_IRQ FINISH State aaa-017294 Fig 15. EPC GEN2 Inventory command PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 30 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend GetHandleFunction START GetHandleFunction EXIT Collision or Recepion Error RX IRQ ReqRN RX IRQ and error or Timer 1 lRQ RX IRQ and no error Handle GetHandleFunction EXIT Store handle, RX_IRQ aaa-017296 Fig 16. Get Handle If present in the payload of the instruction, a `Select' command is executed followed by a `BeginRound' command. If there is a valid response in the first-time slot (no timeout, no collision), the instruction sends an ACK and saves the received PC/XPC/UII. The device performs then an action according to the definitions of the field `Timeslot Processed Behavior': * If this field is set to `0', a NextSlot command is issued to handle the next time slot. This is repeated until the internal buffer is full * If this field is set to 1 the algorithm pauses * If this field is set to 2 a Req_Rn command is issued if, and only if, there has been a valid tag response in this timeslot timeslot 0 timeslot 1 timeslot ... aaa-017297 Fig 17. Timeslot order EPC Gen2 Condition: If the condition is not fulfilled, an exception is raised. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 31 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend EPC_RESUME_INVENTORY Table 28. EPC_RESUME_INVENTORY PARAMETERS Payload Length Value/Description (byte) Command code 1 0x0E Parameter 1 0x00 Response 0 - Description: This instruction is used to resume the inventory algorithm for the ISO18000-3M3 Inventory in case it is paused. This instruction has to be repeatedly called, as long as 'Response Size' field in EPC_RETRIEVE_INVENTORY_RESULT_SIZE is greater than 0. A typical sequence for a complete EPC GEN2 inventory retrieval is: 1. Execute EPC_INVENTORY to start the inventory 2. Execute EPC_RETRIEVE_INVENTORY_RESULT_SIZE 3. If size is 0, inventory has finished. 4. Otherwise, execute EPC_RETRIEVE_INVENTORY_RESULT 5. Execute EPC_RESUME_INVENTORY and proceed with step 2. Condition: Field 'RFU' must be present and can be set to any value. If the condition is not fulfilled, an exception is raised. EPC_RETRIEVE_INVENTORY_RESULT_SIZE Table 29. EPC_RETRIEVE_INVENTORY_RESULT_SIZE PARAMETERS Payload length (byte) Value/Description Command code 1 0x0F Parameter 1 0x00 Response 2 Response size: If Response size == 0: Inventory has finished. If Response size == 1...512: Value indicates the length of the EPC_RETRIEVE_INVENTORY_RESULT response payload Description: This instruction is used to retrieve the size of the inventory result. The size is located in the response to this instruction and reflects the payload size of the response to the next execution of EPC_RETRIEVE_INVENTORY_RESULT. If the size is 0, then no more results are available which means inventory algorithm has finished. Condition: Field Parameter1 must be present. If the condition is not fulfilled, an exception is raised. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 32 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend EPC_RETRIEVE_INVENTORY_RESULT Table 30. EPC_RETRIEVE_INVENTORY_RESULT PARAMETERS Payload Length Value/Description (byte) Command code 1 0x10 Parameter 1 0x00 Response 2 Response size If Response size == 0: Inventory has finished. If Response size == 1...512: Value indicates the length of the EPC_RETRIEVE_INVENTORY_RESULT response payload Description: This instruction is used to retrieve the result of a preceding or EPC_RESUME_INVENTORY instruction. The size of the payload within the response is determined by the `Response Size' field of EPC_RETRIEVE_INVENTORY_RESULT_SIZE response. Depending on the `Timeslot Processed Behavior' defined in that instruction, the result contains one or more time slot responses. Each timeslot response contains a status (field `Timeslot Status') which indicates, that there has been a valid tag reply or a collision or no tag reply: 0 - Tag response available, XPC/PC/UII embedded in the response within 'Tag reply' field 1 - Tag response available and tag handle retrieved. XPC/PC/UII as well as tag handle available in the response within 'Tag reply' field and 'Tag Handle' field, respectively. 2 - No tag replied, empty time slot 3 - Collision, two or more tags replied in the same time slot Condition: Field 'RFU' must be present and can be set to any value. If the condition is not fulfilled, an exception is raised. LOAD_RF_CONFIG Table 31. LOAD_RF_CONFIG PARAMETERS Payload length (byte) Value/Description Command code 1 0x11 Parameter 1 Transmitter configuration byte 1 Receiver configuration byte Response 0 - Description: This instruction is used to load the RF configuration from EEPROM into the configuration registers. The configuration refers to a unique combination of "mode" (target/initiator) and "baud rate". The configurations can be loaded separately for the receiver (Receiver configuration) and transmitter (Transmitter configuration). PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 33 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend The PN5180 is pre-configured by EEPROM with settings for all supported protocols. The default EEPROM settings are considering typical antenna. It is possible for the user to modify the EEPROM content and by this adapt the default settings to individual antennas for optimum performance. The command UPDATE_RF_CONFIG is used for modification of the RF Configuration settings available in the EEPROM. There is no possibility to update the EEPROM data directly, updates have to make use of the UPDATE_RF_CONFIG command. Note that the command LOAD_RF_CONFIG configures parameters which are not accessible by registers, and configures additional parameters depending on the protocol setting (e.g. the waveshaping AWC). It is required to execute the command LOAD_RF_CONFIG for a specific protocol first, before any register settings for this protocol are changed. The parameter 0xFF has to be used if the corresponding configuration shall not be changed. UPDATE_RF_CONFIG LOAD_RF_CONFIG PN5180 EEPROM A106 PN5180 REGISTERS RF_CONTROL_TX_CLK TX_DATA_MOD A212 TX_UNDERSHOOT_ CONFIG TX_OVERSHOOT_CON FIG RF_CONTROL_TX ANT_CONTROL NFC-GTM aaa-023693 (1) UPDATE_RF_CONFIG allows updating the EEPROM content defining all protocol-specific configurations. For each protocol, a user-defined configuration can be defined. (2) LOAD_RF_CONFIG allows loading a protocol-specific configuration from EEPROM to registers as actual RF configuration. Fig 18. LoadRFConfig Condition: Parameter 'Transmitter Configuration' must be in the range from 0x0 - 0x1C, inclusive. If the transmitter parameter is 0xFF, transmitter configuration is not changed. Field 'Receiver Configuration' must be in the range from 0x80 - 0x9C, inclusive. If the receiver parameter is 0xFF, the receiver configuration is not changed. If the condition is not fulfilled, an exception is raised. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 34 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 32. LOAD_RF_CONFIG: Selection of protocol register settings Transmitter: RF configuration byte (hex) Protocol Speed (kbit/s) Receiver: RF configuration byte (hex) Protocol Speed (kbit/s) 00 ISO 14443-A / NFC PI-106 106 80 ISO 14443-A / NFC PI-106 106 01 ISO 14443-A 212 81 ISO 14443-A 212 02 ISO 14443-A 424 82 ISO 14443-A 424 03 ISO 14443-A 848 83 ISO 14443-A 848 04 ISO 14443-B 106 84 ISO 14443-B 106 05 ISO 14443-B 212 85 ISO 14443-B 212 06 ISO 14443-B 424 86 ISO 14443-B 424 07 ISO 14443-B 848 87 ISO 14443-B 848 08 FeliCa / NFC PI 212 212 88 FeliCa / NFC PI 212 212 09 FeliCa / NFC PI 424 424 89 FeliCa / NFC PI 212 424 0A NFC-Active Initiator 106 8A NFC-Active Initiator 106 0B NFC-Active Initiator 212 8B NFC-Active Initiator 212 0C NFC-Active Initiator 424 8C NFC-Active Initiator 424 0D ISO 15693 ASK100 26 8D ISO 15693 26 0E ISO 15693 ASK10 26 8E ISO 15693 53 0F ISO 18003M3 Manch. 424_4 Tari=18.88 8F ISO 18003M3 Manch. 424_4 106 10 ISO 18003M3 Manch. 424_2 Tari=9.44 90 ISO 18003M3 Manch. 424_2 212 11 ISO 18003M3 Manch. 848_4 Tari=18.88 91 ISO 18003M3 Manch. 848_4 212 12 ISO 18003M3 Manch. 848_2 Tari=9.44 92 ISO 18003M3 Manch. 848_2 424 13 ISO 18003M3 Manch. 424_4 106 93 ISO 14443-A PICC 106 14 ISO 14443-A PICC 212 94 ISO 14443-A PICC 212 15 ISO 14443-A PICC 424 95 ISO 14443-A PICC 424 16 ISO 14443-A PICC 848 96 ISO 14443-A PICC 848 17 NFC Passive Target 212 97 NFC Passive Target 212 18 NFC Passive Target 424 98 NFC Passive Target 424 19 NFC Active Target 106 106 99 ISO 14443-A 106 1A NFC Active Target 212 212 9A ISO 14443-A 212 1B NFC Active Target 424 424 9B ISO 14443-A 424 1C GTM ALL 9C GTM ALL UPDATE_RF_CONFIG: Table 33. PN5180 Product data sheet COMPANY PUBLIC UPDATE_RF_CONFIG PARAMETERS Payload length (byte) Command code 1 Value/Description 0x13 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 35 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 33. UPDATE_RF_CONFIG PARAMETERS Payload length (byte) Parameter 1...42 Response Value/Description Array of up to 42 elements {RF configuration byte, Register Address, Register value} - 1 byte RF Configuration byte: RF configuration for which the register has to be changed. 1 byte Register Address: Register Address within the given RF technology. 4 bytes Register value: Value which has to be written into the register. - Description: This instruction is used to update the RF configuration within the EEPROM. The command allows updating dedicated EEPROM addresses, in case the complete set does not require to be updated. The payload parameters passed following the little endian approach (Least Significant Byte first). Condition: The size of the array of `Configuration data' must be in the range from 1 - 42, inclusive. The array data elements must contain a set of `RF Configuration byte', `Register Address' and `Value'. The field `RF Configuration byte' must be in the range from 0x00 - 0x1C or 0x80-0x9C, inclusive. The address within field `Register Address' must exist within the respective RF configuration. The `Register Value' contains a value which will be written into the given register and must be 4 bytes long. If the condition is not fulfilled, an exception is raised. RETRIEVE_RF_CONFIG_SIZE Table 34. RETRIEVE_RF_CONFIG_SIZE PARAMETERS Payload length (byte) Value/Description Command code 1 0x14 Parameter 1 RF configuration ID: RF configuration for which the number of registers has to be retrieved. Response 1 Number of registers for the selected "RF configuration ID" Description: This command is used to retrieve the size (number of 32-bit registers) of a given RF configuration. The size is available in the response to this instruction. Condition: The field 'RF configuration ID' must be in the range from 0x00 - 0x1C or 0x80-0x9C, inclusive. If the condition is not fulfilled, an exception is raised. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 36 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend RETRIEVE_RF_CONFIG Table 35. RETRIEVE_RF_CONFIG PARAMETERS Payload length (byte) Command code 1 0x14 Value/Description Parameter 1 RF configuration ID: RF configuration for which the number of 32-bit registers has to be retrieved. Response 0...39 Array of up to 39 elements {RegisterAddress, RegisterContent} 1 byte RegisterAddress: Address of the register to read 4 bytes RegisterContent: Data of register addressed by this element Description: This command is used to read an RF configuration. The register content available in the response. In order to know how many pairs are to be expected, the command RETRIEVE_RF_CONFIGURATION_SIZE has to be executed first. The payload parameters passed following the little endian approach (Least Significant Byte first). Condition: The field 'RF configuration ID' must be in the range from 0x00-0x1C or 0x80-0x9C, inclusive. If the condition is not fulfilled, an exception is raised. RF_ON Table 36. RF_ON Payload length (byte) Value/Description Command code 1 0x16 Parameter 1 Bit0 == 1: disable collision avoidance according to ISO18092 Bit1 == 1: Use Active Communication mode according to ISO18092 Response - - Description: This command is used to switch on the internal RF field. If enabled the TX_RFON_IRQ is set after the field is switched on. RF_OFF Table 37. RF_OFF Payload length (byte) Value/Description Command code 1 0x17 Parameter 1 dummy byte, any value accepted Response - - Description: PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 37 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend This command is used to switch off the internal RF field. If enabled, the TX_RFOFF_IRQ is set after the field is switched off. ENABLE_TESTBUS_DIGITAL Table 38. ENABLE_TESTBUS_DIGITAL Payload length (byte) Value/Description Command code 1 0x18 Parameter 1 Signal Bank 1*n TB_pos: Pad Location and test bus Bit Position n can have a value between 1 and 4 - - Response Description: This command enables the Digital test bus. There are several signal banks which can be selected. From the selected signal banks, the test signals can be routed to different pads. Attention: Test bus must be enabled before in the EEPROM settings (EEPROM address: 0x17, TESTBUS_ENABLE). TB_pos byte has to be configured in the following way: Table 39. TB_POS BitPos Value Description 0_3 0..7h Signal Selection of the Signal Bank 8h 13 MHz RF clock 9h..Fh RFU 0h IRQ pad 1h AUX1 pad 2h AUX2 pad 3h GPO1 4h..Fh RFU 4:7 ENABLE_TESTBUS_ANALOG Table 40. ENABLE_TESTBUS_ANALOG Payload Length Value/Description (byte) Command code 1 0x19 Parameter 1 DAC output to AUX2 1 DAC output to AUX1 Description: This command enables the Analog test bus. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 38 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Attention: Test bus must be enabled before in the EEPROM settings (EEPROM address: 0x17, TESTBUS_ENABLE). The host interface shall use the following sequence: 11.5 Memories 11.5.1 Overview The PN5180 implements two different memories: EEPROM and RAM. At start-up, all registers are initialized with default values. For the registers defining the RF functionality, the default values are not set to execute any contactless communication. The registers defining the RF functionality are initialized by using the instruction LOAD_RF_CONFIGURATION. Using the instruction LOAD_RF_CONFIGURATION, the initialization of the registers which define the RF behavior of the IC performs an automatic copy of a predefined EEPROM area (read/write EEPROM section1 and section2, register reset) into the registers defining the RF behavior. 11.5.2 EEPROM The EEPROM memory maintains its content during Power-OFF, whereas the RAM (Buffers) does not keep any data stored in this volatile memory. The EEPROM address range is from 0x00 to 0xFF. The EEPROM contains information about Die Identifier, Firmware Version, System configuration and RF settings for fast configuration. Table 41. EEPROM Addresses EEPROM Address (HEX) Field / Value Access Size (bytes) Bits Comments 0x00 Die identifier R 16 - Each DIE has a unique Identifier 0x10 Product Version R 2 15-0 Product Version Indicator 0x12 Firmware Version R 2 15-0 Firmware Version 0x14 EEPROM Version R 2 15-0 EEPROM Version Number (default initialization values) 0x16 IDLE_IRQ_AFTER_BOOT RW 1 7-0 This enables the IDLE IRQ to be set after the boot has finished 0x17 TESTBUS_ENABLE RW 1 7-0 If bit 7 is set, the test bus functionality is enabled. During this phase, it can happen that the BUSY line is asserted after the frame is received. Therefore it is recommended to first set NSS to low, wait until BUSY goes high and then send the data. 0x18 XTAL_BOOT_TIME RW 2 15-0 XTAL boot time in us PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 39 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 41. EEPROM Addresses ...continued EEPROM Address (HEX) Field / Value Access Size (bytes) Bits Comments 0x1A IRQ_PIN_CONFIG RW 7-0 Configures the state (active high/low) and clearing conditions for the IRQ pin 0 Cleared: IRQ active low 1 Set: IRQ active high 1 Cleared: Use IRQ_SET_CLEAR_REG to clear IRQ pin Set: Auto Clear on Read of IRQ_STATUS_REG 0x1B MISO_PULLUP_ENABLE RW 1 7-0 Configures the pullup resistor for the SPI MISO 2-0 000b - no pulldown 001b - no pullup 010b - pulldown 011b - pullup 7-3 0x1C PLL_DEFAULT_SETTING RW 04h - FFh RFU PLL configuration of clock input frequency in case a 13.56 MHz Crystal is not used. The PLL setting need to be written as two 4-byte words to the memory, little endian. This means that the e.g the value for 8 MHz (03A3531002A12210) shall be written as follows to the EPROM (ascending addresses starting at 0x1C): 8 10 53 A3 0310 22 A1 02 8 MHz: 03A35310 - 02A12210 12 MHz: 02A38288 - 02E10190 16 MHz: 02E2A1D8 - 02D11150 24 MHz: 02D35138 - 02E0E158 (default) 0x24 PLL_DEFAULT_SETTING_ R/W ALM 8 - PLL configuration for the Active Load Modulation 0x2c PLL_LOCK_SETTING R/W 4 31-0 Lock Settings for the PLL - do not change 0x30 CLOCK_CONFIG RW 1 7-0 Configures the source of the clock, either 27.12 MHz crystal or external clock e.g. 24 MHz with PLL refactoring 3-0 0000b - PLL 1000b - Crystal 7-4 RFU 0x31 RFU RW 1 7-0 - 0x32 MFC_AUTH_TIMEOUT RW 2 15-0 Timeout value used for each of the Auth1 & Auth2 stages during MFC Authenticate (MIFARE Authenticate). This is an unsigned 16-bit integer value in little endian order. The timebase for the timeout is 1.0 microseconds. Example: The default value of 0x0, 0x5 refers actually to 0x500 (1280 decimal) resulting in a timeout of 1.28 ms for each of the authentication stages. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 40 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 41. EEPROM Addresses ...continued EEPROM Address (HEX) Field / Value Access Size (bytes) Bits Comments 0x34 LPCD_REFERENCE_ VALUE RW 2 15-0 AGC Reference Value 0x36 LPCD_FIELD_ON_TIME RW 1 7-0 1 byte delay * 8 in microseconds settling time for AGC measurement 0x37 LPCD_THRESHOLD RW 1 7-0 1 byte AGC threshold value which is used to compare against the (Current AGC value - Reference AGC) during the Low-Power Card Detection phase 0x38 up to firmware version 3.5: RW LPCD_REFVAL_CONTROL 1 7-0 Configures the LPCD mode and reference value for antenna detuning by card / metal 1-0 LPCD Mode 00b - Use EEPROM value of LPCD_REFERENCE_VALUE for reference value 01b - Use on begin of an LPCD a measurement cycle for generating a reference value. 10b - Use the Register value of CHECK_CARD_RESULT for reference value. This allows the configuration of the reference value without EEPROM programming. 2 GPO1 Control for external TVDD LDO 0b - Disable Control of external TVDD LDO via GPO1 1b - Enable Control of external TVDD LDO via GPO1 from firmware version 3.6 onwards: LPCD_REFVAL_GPO_CO NTROL PN5180 Product data sheet COMPANY PUBLIC RW 1 7-0 This byte in EEPROM is used to control the GPIO assertion during wake-up and LPCD card detect. All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 41 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 41. EEPROM Address (HEX) EEPROM Addresses ...continued Field / Value Access Size (bytes) Bits Comments 1:0 LPCD Mode 00b - Use EEPROM value of LPCD_REFERENCE_VALUE for reference value 01b - Use on begin of an LPCD a measurement cycle for generating a reference value. 10b - Use AGC Reference value and AGC gear from the register AGC_REG_CONFIG. 11b - RFU 2 GPO1 Control for external TVDD LDO 0b - Disable Control of external TVDD LDO via GPO1 1b - Enable Control of external TVDD LDO via GPO1 3 GPO2 Control for external TVDD LDO during wake-up from standby 0b - Disable Control of external TVDD LDO via GPO2 on LPCD Card Detect 1b - Enable Control of external TVDD LDO via GPO2 on LPCD Card Detect 4 GPO1 Control for external TVDD LDO during wake-up from standby 0b - Disable Control of external TVDD LDO via GPO1 on wake-up from standby 1b - Enable Control of external TVDD LDO via GPO1 on wake-up from standby 0x39 LPCD_GPO_TOGGLE_BE FORE_FIELD_ON RW 1 7-0 1 byte value defines the time between setting GPO1 until Field is switched on. The time can be configured in 8 bits in 5us steps 0x3A LPCD_GPO_TOGGLE_AF TER_FIELD_ON RW 1 7-0 1 byte value defines the time between Field Off and clear GPO1. The time can be configured in 8 bits in 5us steps 0x3B NFCLD_SENSITIVITY_VAL RW 1 7-0 NFCLD Sensitivity value to be used during the RF On Field handling Procedure. 0x3C FIELD_ON_CP_SETTLE_T RW IME 1 7-0 Delay in 4us steps (range: 0 - 1020us) to wait during RF on for charge pumps to be settled, to avoid initial Tx driver overcurrent 0x3D RFU RW 2 15-0 RFU 0x3F RF_DEBOUNCE_TIMEOU T RW 1 7-0 RF Debounce Timeout in step size of 10 s 0x40 SENS_RES RW 2 15-0 Response to ReqA / ATQA in order byte 0, byte 1 0x42 NFCID1 RW 3 23-0 If Random UID is disabled (EEPROM address 0x51), the content of these addresses is used to generate a Fixed UID. The order is byte 0, byte 1, byte 2; the first NFCID1 byte is fixed to 08h, the check byte is calculated automatically PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 42 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 41. EEPROM Addresses ...continued EEPROM Address (HEX) Field / Value Access Size (bytes) Bits Comments 0x45 SEL_RES RW 1 7-0 Response to Select 0x46 FELICA_POLLING_RESPO RW NSE 18 - FeliCa Polling response (2 bytes (shall be 01h, FEh) + 6 bytes NFCID2 + 8 bytes Pad + 2 bytes system code) 0x51 RandomUID_enable 1 7-0 Enables the use of a RandomUID in card modes. If enabled (EEPROM configuration, Address 0x51), a random UID is generated after each RF-off. RW 0: Use UID stored in EEPROM 1: Randomly generate the UID 0x58 NFCID3 RW 1 7-0 NFCID3 (1 byte) If the Random UID is enabled (EEPROM address 0x51), this address contains the NFCID3. 0x59 DPC_CONTROL RW 1 7-0 Enables DPC and configures DPC gears 0 DPC_ENABLE cleared: OFF; set: ENABLE 3-1 GEAR_STEP_SIZE: binary definition of gear step size; position of Bit 1 is the LSB of gear step size 7-4 START_GEAR; binary definition of start gear, Position of bit 4 is the LSB of start gear number 0x5A DPC_TIME RW 2 15-0 Sets the value for the periodic regulation. Time base is 1/20 MHz. (Example: Value of 20000 is equal to 1 ms) 0x5C DPC_XI RW 1 7-0 Trim Value of the AGC value 0x5D AGC_CONTROL RW 2 Settings for AGC control loop 9-0 Duration 10 Duration enable 12-11 Step size 13 Step size enable 15-14 RFU 0x5F DPC_THRSH_HIGH RW 30 - Defines the AGC high threshold for each gear. DPC_AGC_GEAR_LUT_SIZE defines the number of gears. DPC_AGC_GEAR_LUT_SIZE can be 1..15. The threshold is defined by 2 bytes (bit0 located in the byte with lower address), 0x7D DPC_THRSH_LOW RW 2 15-0 Defines the AGC low threshold for initial gear. The threshold is defined by 2 bytes (bit 0 located in the byte with lower address) 0x7F DPC_DEBUG RW 1 7-0 Enables the debug signals 0x80 DPC_AGC_SHIFT_VALUE RW 1 7-0 Shift Value for the AGC dynamic low adoption to prevent oscillation 0x81 DPC_AGC_GEAR_LUT_ SIZE RW 1 7-0 Defines the number of gears for the lookup table (LUT, value can be between 1...15) 0x82 DPC_AGC_GEAR_LUT RW 15 - Defines the Gear Setting for each step size starting with Gear0 at lowest address up to 15 gears. Each entry contains a definition for the DPC_CONFIG register content. Bits 8:11 are not taken into account. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 43 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 41. EEPROM Addresses ...continued EEPROM Address (HEX) Field / Value Access Size (bytes) Bits Comments 0x91 DPC_GUARD_FAST_ MODE RW 15-0 Guard time after AGC fast mode has been triggered. This happens in the following scenarios: 2 - End of Receive - End of Transmit - After a gear switch Time base is 1/20 MHz (Example: Value of 2000 is equal to 100 s) 0x93 DPC_GUARD_SOF_ DETECTED RW 2 15-0 Guard time after SoF or SC detection. This is to avoid any DPC regulation between SoF/SC and actual begin of reception. Time base is 1/20MHz (Example: Value of 2000 is equal to 100 s) 0x95 DPC_GUARD_FIELD_ON RW 2 15-0 Guard time after Gear Switch during FieldOn instruction. Time base is 1/20MHz (Example: Value of 2000 is equal to 100 s) 0x97 up to firmware version 3.5: RW PCD_SHAPING_LUT_SIZE 1 7-0 Number of elements for the PCD Shaping 0x98-0xE7 from firmware version 3.6 onwards: 1 7-0 Number of elements for the PCD Shaping and RX settings 4-0 The lower nibble consists of the Number of elements for the PCD Shaping 7-5 The upper nibble consists of the Number of elements for the RxGain. - PCD Shaping configuration lookup table: Each word contains the following configuration information: 3-0 DPC Gear 7-4 TAU_MOD_FALLING (Sign bit + 3-bit value) 11-8 TAU_MOD_RISING (Sign bit + 3-bit value) 15-12 RESIDUAL_CARRIER (Sign bit + 3-bit value) 31-16 Bitmask identifying technology and baud rate: up to firmware version 3.5: PCD_SHAPING_LUT RW RW 64 0000b - A106 0001b - A212 0010b - A424 0011b - A848 0100b - B106 0101b - B212 0110b - B424 0111b - B848 1000b -F212 1001b -F424 1010b - 15693 ASK 100 1011b - 15693 ASK 10 1100b - ISO18000 3M3 PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 44 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 41. EEPROM Address (HEX) EEPROM Addresses ...continued Field / Value Access Size (bytes) from firmware version 3.6 onwards: PCD_SHAPING_LUT entries for AWC R/W Bits Comments 64 Adaptive Waveshaping Control (AWC) and Adaptive Receiver Control (ARC) configuration dynamic 3:0 DPC Gear 7:4 TAU_MOD_FALLING (Sign bit + 3-bit value) 11:8 TAU_MOD_RISING (Sign bit + 3-bit value) 15:12 RESIDUAL_CARRIER (Sign bit + 3-bit value) 31-16 Bitmask identifying technology and baud rate: 0000b - A106 0001b - A212 0010b - A424 0011b - A848 0100b - B106 0101b - B212 0110b - B424 0111b - B848 1000b -F212 1001b -F424 1010b - 15693 ASK 100 1011b - 15693 ASK 10 1100b - ISO18000 3M3 PCD_SHAPING_LUT entries for ARC dynamic 3-0 DPC gear 5-4 RX_GAIN setting (Sign bit + 1-bit value) 7-6 RX_HPCF (Sign bit + 1-bit value) 15-11 RFU 31-16 Bitmask identifying technology and baud rate: 0000b - A106 0001b - A212 0010b - A424 0011b - A848 0100b - B106 0101b - B212 0110b - B424 0111b - B848 1000b -F212 1001b -F424 1010b - 15693 ASK 100 1011b - 15693 ASK 10 1100b - ISO18000 3M3 0xE8 0xFF RFU PN5180 Product data sheet COMPANY PUBLIC R/W - 7-0 RFU All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 45 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11.5.3 RAM The RAM is used as Input/Output buffer, and implements independent buffers for input and output. The buffers are able to improve the performance of a system with limited interface speed. 11.5.4 Register Registers configure the PN5180 for a specific RF protocol and other functionality. Registers can be initialized using the host interface or by copying data from EEPROM to the register as done by the command LOAD_RF_CONFIG. It is mandatory to use the command LOAD_RF_CONFIG for selection of a specific RF protocol. 11.6 Debug Signals 11.6.1 General functionality The debugging of the RF functionality of the PN5180 is supported by a configurable test signal output possibility. Up to 2 analog or up to 4 digital test signals can be routed to configurable output pins of the PN5180. Test signals can be either analog or digital signals. The analog test signals contain the digital data of the signal processing unit of the PN5180, converted to analog signals by a DAC to allow the inspection of these signals in real time. Two set commands exist for configuration of the digital and analog debug signal output, SET_DIGITAL_TESTOUT and SET_ANALOG_TESTOUT. 11.6.2 Digital Debug Configuration The digital debug output is configured by the command SET_DIGITAL_TESTOUT. Two parameters are passed within this command. The first parameter (1 byte) defines the test signal group. Out of this test signal group, one signal can be selected for output on a pin of the PN5180 (4 bits). The signal of the test signal group is selected by the low-nibble of parameter 2. A value of 8 on this position selects the 13.56 MHz clock to be put out on the selected pin. The high nibble of parameter 2 (1 byte) selects the output pin for the selected test signal. The following parameter groups are possible: Table 42. PN5180 Product data sheet COMPANY PUBLIC Debug Signal Group Selection Command parameter (hex) Debug Signal Group 01 Clock signal group 1B Transmitter encoder group 1D Timer group 30 Card mode protocol group 58 Transceive group 70 Receiver data transfer group 73 Receiver error group All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 46 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend The second parameter defines the pin which is used for output of the test signal in the high nibble, and the signal from one of the Debug Signal groups that are put out in the low nibble. 11.6.2.1 Debug signal groups Table 43. Value low nibble (HEX) Debug Function 9..15 RFU 8 13.56 MHz clock is put out 7 CLIF clock reset 6 Signal indicating the PLL is locked 5 Signal indicating an external Field is present 4 20 MHz clock from the high frequency oscillator 3 27.12 MHz clock from the PLL 2 27.12 MHz clock from the RF clock recovery 1 Multiplexed 27.12 MHz clock 0 Multiplexed 13.56 MHz clock Table 44. Product data sheet COMPANY PUBLIC Transmitter Encoder Group Value low nibble (HEX) Debug Function 9..15 RFU 8 13.56 MHz clock is put out 7..2 RFU 1 Output TX envelope 0 Tx-IRQ Table 45. PN5180 Clock Signal Group Timer Group Value low nibble (HEX) Debug Function 9..15 RFU 8 13.56 MHz clock is put out 7 Running flag of timer T0 6 Expiration flag of timer T0 5 Running flag of timer T1 4 Expiration flag of timer T1 3 Running flag of timer T2 2 Expiration flag of timer T2 1..0 RFU All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 47 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 46. Card mode Protocol Group Value low nibble (HEX) 9..15 RFU 8 13.56 MHz Clock is put out 7 Synchronized clock-fail signal 6 Flag indicating that ISO/IEC14443-Type A (Miller) was detected 5 Flag indicating that FeliCa 212 kBd (Manchester) was detected 4 Flag indicating that FeliCa 424 kBd (Manchester) was detected 3 Flag indicating that ISO/IEC14443-Type B (NRZ) was detected 2 Flag indicating that the EOF was detected 1 CM data signal (Miller / Manchester / NRZ) 0 Signal indicating that the current data is valid Table 47. Product data sheet COMPANY PUBLIC Transceive Group Value low nibble (HEX) Debug Function 9..15 RFU 8 13.56 MHz clock is put out 7 Signal indicating that the tx prefetch was completed 6 Signal initiating a tx prefetch at the BufferManager 5 Start of transmission signal to TxEncoder 4 enable reception signal to RxDecoder 3 indicator that the waiting time was already expired 2 Transceive state2 1 Transceive state1 0 Transceive state0 Table 48. PN5180 Debug Function Receiver Data Transfer Group Value low nibble (HEX) Debug Function 9..15 RFU 8 13.56 MHz clock is put out 7 Signal from SigPro indicating a collision 6 Signal from SigPro indicating end of data 5 Signal from SigPro indicating that data is valid 4 Signal from SigPro indicating received data 3 Status signal set by rx_start, ends when RX is completely over 2 Status signal indicating actual reception of data 1 Reset signal for receiver chain (at start of RX) 0 Internal RxDec bitclk All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 48 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 49. Receiver Error Group Value low nibble (HEX) 11.6.2.2 Debug Function 9..15 RFU 8 13.56 MHz clock is put out 7 Combination of data/protocol error and collision 6 Set if RxMultiple is set, and the LEN byte indicates more than 28 bytes 5..3 RFU 2 Set if a collision has been detected 1 Protocol error flag 0 Data integrity error flag (Parity, CRC (Collision)) Digital Debug Output Pin Configuration Table 50. Debug Signal Output Pin Configuration Value high nibble (HEX) Debug Function (PIN) 0 IRQ (39) 1 GPO (38) 2 AUX2 (2) 3 AUX1 (40) all others RFU 11.6.3 Analog Debug Configuration For the output of an analog debug signal, two pins are available, BUSY and AUX2. The function of the output pins is defined by two parameters of the command Table 51. Parameter (hex) Debug Function 0 Analog output of value defined in register DAC_VALUE 1 Receiver Q-channel signal; depending on SIGPRO_IN_SEL either samples signals from ADC, tx_envelope or SigIn 2 Receiver I-channel signal; depending on SIGPRO_IN_SEL either samples signals from ADC, tx_envelope or SigIn 3 Filtered Q-channel signal (rect-filter) 4 Filtered I-channel signal (rect-filter) all others RFU 11.7 AUX2 / DWL_REQ 11.7.1 Firmware update The PN5180 offers the possibility to upgrade the internal Firmware. The pin AUX2/DWL request is a double function pin. During start-up (time from power-up of the IC until IDLE IRQ is raised), the pin is used in input mode. If the polarity on this AUX2/DWL_REQ pin during start-up is high, the PN5180 enters the download mode. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 49 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend If the boot process is finished (indicated by the IDLE IRQ), the pin is switched to output mode and the pin can be used for general debug purpose. Recommended sequence is to set the RESET_N level to 0, set AUX2 pin level to 1 and release RESET_N to 1. Exiting the download mode is performed by setting the AUX2 pin to 0 and perform a reset of the PN5180. 11.7.2 Firmware update command set The PN5180 uses a dedicated host interface command set for download of new firmware. The physical SPI host interface is used for download of a new firmware image. Security features are implemented to avoid intentional or unintentional modifications of the firmware image. The access to the IC is locked based on authentication mechanism to avoid unauthorized firmware downloads. The integrity of the firmware is ensured based on a secure hash algorithm, The Firmware image can be identified based on a version number, which contains major and minor number. For security reasons, the download of a smaller major version number than currently installed on the PN5180 is not possible. 11.8 RF Functionality 11.8.1 Supported RF Protocols 11.8.1.1 ISO/IEC14443 A/MIFARE functionality The physical level of the communication is shown in Figure 19. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 50 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend (1) ISO/IEC 14443 A READER ISO/IEC 14443 A CARD (2) 001aam268 Fig 19. ISO/IEC 14443 A/MIFARE read/write mode communication diagram The physical parameters are described in Table 52. Table 52. Communication overview for ISO/IEC 14443 A/MIFARE reader/writer Communication direction Signal type 106 kbit/s 212 kbit/s 424 kbit/s 848 kbit/s Reader to card (send data from the PN5180 to a card) fc = 13.56 MHz reader side modulation 100 % ASK 100 % ASK 100 % ASK 100 % ASK bit encoding modified Miller encoding modified Miller encoding modified Miller encoding modified Miller encoding bit rate [kbit/s] fc/128 fc/64 fc/32 fc/16 card side modulation subcarrier load modulation subcarrier load modulation subcarrier load modulation subcarrier load modulation subcarrier frequency fc / 16 fc / 16 fc / 16 fc / 16 bit encoding Manchester encoding BPSK BPSK BPSK Card to reader (PN5180 receives data from a card) Transfer speed The PN5180 connection to a host is required to manage the complete ISO/IEC 14443 A/MIFARE protocol. Figure 20 shows the data coding and framing according to ISO/IEC 14443 A/MIFARE. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 51 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend ISO/IEC 14443 A framing at 106 kBd start 8-bit data 8-bit data odd parity start bit is 1 8-bit data odd parity odd parity ISO/IEC 14443 A framing at 212 kBd, 424 kBd and 848 kBd start 8-bit data start bit is 0 even parity 8-bit data odd parity burst of 32 subcarrier clocks 8-bit data odd parity even parity at the end of the frame 001aak585 Fig 20. Data coding and framing according to ISO/IEC 14443 A card response The internal CRC coprocessor calculates the CRC value based on the selected protocol. In card mode for higher baud rates, the parity is automatically inverted as end of communication indicator. The selected protocol needs to be implemented on a host processor. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 52 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11.8.1.2 ISO/IEC14443 B functionality The physical level of the communication is shown in Figure 21. (1) ISO/IEC 14443 B READER ISO/IEC 14443 B CARD (2) 001aal997 (1) Reader to Card NRZ, transfer speed 106 kbit/s to 848 kbit/s (2) Card to reader, Subcarrier Load Modulation Manchester Coded or BPSK, transfer speed 106 kbit/s to 848 kbit/s Fig 21. ISO/IEC 14443B read/write mode communication diagram The physical parameters are described in Table 53. Table 53. Communication overview for ISO/IEC 14443 B reader/writer Communication direction Signal type Reader to card (send data from the PN5180 to a card) fc = 13.56 MHz Card to reader (PN5180 receives data from a card) Transfer speed 106 kbit/s 212 kbit/s 424 kbit/s 848 kbit/s reader side modulation 10 % ASK 10 % ASK 10 % ASK 10 % ASK bit encoding NRZ NRZ NRZ NRZ bit rate [kbit/s] 128 / fc 64 / fc 32 / fc 16 / fc card side modulation subcarrier load modulation subcarrier load modulation subcarrier load modulation subcarrier load modulation subcarrier frequency fc / 16 fc / 16 fc / 16 fc / 16 bit encoding BPSK BPSK BPSK BPSK The PN5180 requires the host to manage the ISO/IEC 14443 B protocol. 11.8.1.3 FeliCa RF functionality The FeliCa mode is the general reader/writer to card communication scheme according to the FeliCa specification. The communication on a physical level is shown in Figure 22. FeliCa READER (PCD) 1. PCD to PICC 8-30 % ASK Manchester Coded, baudrate 212 to 424 kbaud 2. PICC to PCD, > Load modulation Manchester Coded, baudrate 212 to 424 kbaud FeliCa CARD (PICC) 001aam271 Fig 22. FeliCa read/write communication diagram The physical parameters are described in Table 54. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 53 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 54. Communication for FeliCa reader/writer Communication direction Signal type Transfer speed FeliCa FeliCa higher transfer speeds Reader to card (send data from the PN5180 to a card) fc = 13.56 MHz reader side modulation 212 kbit/s 424 kbit/s 8 % to 30 % ASK 8 % to 30 % ASK bit encoding Manchester encoding Manchester encoding bit rate fc/64 fc/32 Card to reader (PN5180 receives data from a card) card side modulation Load modulation, Load modulation, bit encoding Manchester encoding Manchester encoding The PN5180 needs to be connected to a host which implements the FeliCa protocol. Multiple reception cycles (RxMultiple): For FeliCa timeslot handling in PCD mode, PN5180 implements multiple reception cycles. The feature is enabled by setting the control bit RX_MULTIPLE_ENABLE in the register TRANSCEIVE_CONTROL_REG in combination with the transceive state machine. Unlike for normal operation, the receiver is enabled again after a reception is finished. As there is only one receive buffer available, but several responses are expected, the buffer is split into sub buffers of 32 byte length. Hence, the maximum number of responses which can be handled is limited to 8. As the maximum length defined for a FeliCa response is 20 bytes, the buffer size defined does fulfill the requirements for that use-case. The first data frame received is copied onto buffer address 0. The subsequent frames are copied to the buffer address 32 * NumberOfReceivedFrames. The maximum number of data bytes allowed per frame is limited to 28. PayLoad XXX Status Len All bytes in the buffer between the payload and the status byte are uninitialized and therefore invalid. The firmware on the host shall not use these bytes. The last word of the sub buffer (position 28 to 31) contains a status word. The status word contains the number of received bytes (may vary from the FeliCa length in case of an error), the CLError flag indicating any error in the reception (which is a combination of 3 individual error flags DATA_INTEGRITY_ERROR || PROTOCOL_ERROR || COLLISION_DETECTED) the individual error flags and the LenError flag indicating an incorrect length byte (either length byte is greater than 28 or the number of received bytes is shorter than indicated by the length byte). All unused bits (RFU) are masked to 0. Status ClError DataError RFU [15:13] ProtError RFU [23:16] CollError RFU [31:24] LenError 32 byte RFU [7:5] Len [4:0] 4 byte aaa-009166 Fig 23. RxMultiple data format PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 54 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend There are 4 different cases possible for a reception: 1. Correct reception - Data integrity is correct (no CRC error), and additionally the number of bytes received is equal to the length byte. Data is written to the buffer. No error set in status byte. 2. Erroneous reception - Data is incorrect (data integrity error - CRC wrong) but frame length is correct. Data is written to buffer and the bits CLError and DataError in the status byte are set. 3. Erroneous reception - the length byte received indicates a frame length greater than 28. No data is copied to buffer but status byte with LenError bit set is written. 4. Erroneous reception - the length byte is larger than the number of data bytes, which have been received. Data received is written to buffer and the ProtocolError bit in the status byte is set. For each reception, the RX_IRQ in the IRQ_STATUS_REG is set. The host firmware can disable the IRQ and use a timer for timeout after the last timeslot to avoid excessive interaction with the hardware. At the end of the reception, additionally the bit field RX_NUM_FRAMES_RECEIVED in the register RX_STATUS_REG is updated to indicate the number of received frames. After the reception of the eight frames (which is the maximum supported), a state change to next expected state is executed (WaitTransmit for transceive command). It is possible to issue the IDLE command in order to leave the RxMultiple cycle. Consequently the reception is stopped. Upon start of a new reception cycle, the flag RX_NUM_FRAMES_RECEIVED is cleared. The duration between deactivate and reactivate is at minimum 2 RF cycles and can last typically up to 2 s. 11.8.1.4 ISO/IEC15693 functionality The physical parameters are described below. Table 55. Communication for ISO/IEC 15693 reader/writer "reader to card" Communication direction Signal type Transfer speed fc/512 kbit/s Reader to card (send data from the PN5180 to a card) PN5180 Product data sheet COMPANY PUBLIC reader side modulation 10 % to 30 % ASK 90 % to 100 % ASK bit encoding 1/4 bit length 302.08 s All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 55 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 56. Communication for ISO/IEC 15693 reader/writer "card to reader" Communication direction Signal type Transfer speed card side Card to reader (PN5180 receives modulation data from a card) fc = 13.56 MHz 6.62 kbit/s 13.24 kbit/s 26.48 kbit/s not supported not supported single subcarrier load modulation 52.96 kbit/s[1] single subcarrier load modulation ASK ASK bit length (s) [1] 11.8.1.5 - - 37.76 (3.746) 18.88 bit encoding - - Manchester coding Manchester coding subcarrier frequency [MHz] - fc/32 fc/32 - Fast inventory (page) read command only (ICODE proprietary command). ISO/IEC18000-3 Mode 3 functionality The ISO/IEC 18000-3 mode 3 is not described in this document. For a detailed explanation of the protocol, refer to the ISO/IEC 18000-3 standard. The diagram below illustrates the card presence check: Rx IRQ and no collision CardCheck entry CRC16+CRC5 RX IRQ and collision Timer 1 IRQ ACK WAIT T2 RX IRQ and error RX IRQ and no error NACK Timer 1 IRQ Timer 1 IRQ CardCheck EXIT Collison Error CardCheck EXIT No Card detected PC/XPC CardCheck EXIT Card Detected - Store PC/XPC CardCheck EXIT ACK collison CardCheck EXIT ACK timeout aaa-017295 Fig 24. EPC_GEN2 Card presence check PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 56 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Tag response available NO TagHandle Tag response available TagHandle available status 0x00 Tag Reply length Valid bits in last byte 1 byte 1 byte 1 byte status 0x01 Tag Reply length Valid bits in last byte 1 byte 1 byte 1 byte Tag Reply n bytes (defined in Tag Reply Length) Tag Reply Tag handle n bytes (defined in TagReply Length) 2 bytes status 0x02 No Tag replied 1 byte status 0x03 Two or more tags replied 1 byte possible timeslot answers aaa-017298 Fig 25. EPC GEN2 possible timeslot answers 11.8.1.6 NFCIP-1 modes Overview: The NFCIP-1 communication differentiates between an Active and a Passive Communication Mode. * Active Communication mode means both the initiator and the target are using their own RF field to transmit data. * Passive Communication mode means that the target answers to an initiator command in a load modulation scheme. The initiator is active in terms of generating the RF field. * Initiator: Generates RF field at 13.56 MHz and starts the NFCIP-1 communication. * Target: responds to initiator command either in a load modulation scheme in Passive Communication mode or using a self-generated and self-modulated RF field for Active Communication mode. In order, to support the NFCIP-1 standard the PN5180 supports the Active and Passive Communication mode at the transfer speeds 106 kbit/s, 212 kbit/s and 424 kbit/s as defined in the NFCIP-1 standard. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 57 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Active communication mode : Active communication mode means both the initiator and the target are using their own RF field to transmit data. Initial command host NFC INITIATOR powered to generate RF field NFC TARGET 1. initiator starts communication at selected transfer speed host powered for digital processing response host NFC INITIATOR powered for digital processing NFC TARGET 2. target answers at the same transfer speed host powered to generate RF field 001aan216 Fig 26. Active communication mode Table 57. Communication overview for active communication mode Communication direction 106 kbit/s 212 kbit/s Initiator Target According to ISO/IEC 14443 A 100 % ASK, modified Miller Coded According to FeliCa, 8 % to 30 % ASK Manchester Coded Target Initiator 424 kbit/s A dedicated host controller firmware is required to handle the NFCIP-1 protocol. For this purpose NXP offers an NFC Reader library (check the NXP website) which supports Reader/Writer, P2P and CardEmulation modes. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 58 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Passive communication mode: Passive communication mode means that the target answers to an initiator command in a load modulation scheme. The initiator is active (powered) to generate the RF field. 1. initiator starts communication at selected transfer speed host host NFC TARGET NFC INITIATOR 2. targets answers using load modulated data at the same transfer speed powered to generate RF field powered for digital processing 001aan217 Fig 27. Passive communication mode Table 58. Communication overview for passive communication mode Communication direction 106 kbit/s 212 kbit/s 424 kbit/s Initiator Target According to ISO/IEC 14443 A 100 % ASK, Modified Miller Coded According to FeliCa, 8 % to 30 % ASK Manchester Coded Target Initiator According to ISO/IEC 14443 A @106 kbit modified Miller Coded According to FeliCa, > 14 % ASK Manchester Coded A dedicated host controller firmware is required to handle the NFCIP-1 protocol. Note: Transfer Speeds above 424 kbit/s are not defined in the NFCIP-1 standard. NFCIP-1 protocol support: The NFCIP-1 protocol is not described in this document. The PN5180 does not implement any of the high-level protocol functions. These higher-level protocol functions need to be provided by the host. For detailed explanation of the protocol, refer to the NFCIP-1 standard. However the datalink layer is according to the following policy: * Speed shall not be changed while continuous data exchange in a transaction. * Transaction includes initialization, anticollision methods and data exchange (in continuous way, meaning no interruption by another transaction). In order not to disturb current infrastructure based on 13.56 MHz, the following general rules to start an NFCIP-1 communication are defined: 1. Per default, an NFCIP-1 device is in Target mode - meaning its RF field is switched off. 2. The RF level detector is active. 3. Only if it is required by the application the NFCIP-1 device shall switch to Initiator mode. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 59 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 4. An initiator shall only switch on its RF field if no external RF field is detected by the RF Level detector during a time of TIDT. (Details are specified in the ISO/IEC 18092) 5. The initiator performs initialization according to the selected mode. 11.8.1.7 ISO/IEC14443 A Card operation mode PN5180 can be configured to act as an ISO/IEC 14443 A compliant card. In this configuration, the PN5180 can generate an answer in a load modulation scheme according to the ISO/IEC 14443 A interface description. Note: PN5180 does not support a complete card protocol. This card protocol has to be handled by a connected host controller. Nevertheless, the layer3 type A activation is handled by the NFC frontend. The Card Activated IRQ shall be enabled and notifies if a card activation had been successfully performed. The supports ISO/IEC14443 A card mode for data rates 106 kbit/s, 212kbit/s, 424 kbit/s and 848 kbit/s. last bit PCD PN5180 PICC Register TX WAIT PRESCALER TX wait counter TXbit phase TX bitpha se-1 ... 0x00 0x7F 0x09 ... 0x7E 0x00 0x7F ... 0x7E 0x08 0x00 0x07 ... ... 0x7F ... 0x7E 0x00 0x00 register TX WAIT VAL tx_wait time TXbit phase TRANSCEIVE_CONTROL_REG.TX_BITPHASE is loaded in case last PCD bit is 0 TRANSCEIVE_CONTROL_REG.TX_BITPHASE + TX_WAIT_PRESCALER/2 + 1 is loaded in case last PCD bit is 1 aaa-020576 Fig 28. Target Mode case: Timer stop for started reception 11.8.1.8 NFC Configuration The NFC protocol for the 106 kbit/s mode defines an additional Sync-Byte (0xF0 + parity) after the normal start bit had been transmitted. As this Sync-Byte includes a parity bit, it can be handled by a host firmware as a normal data byte. 11.8.1.9 Mode Detector The Mode Detector is a functional block of the PN5180in PICC mode which senses for an RF field generated by another device. The mode detector allows distinguishing between type A and FeliCa target mode. Dependent on the recognized protocol generated by an initiator peer device the host is able to react. The PN5180 is able to emulate type A cards and peer to peer active target modes according to ISO/IEC18092. 11.8.2 RF-field handling The NFC frontend supports generation of a RF-field dependent on external conditions like presence of another NFC device generating an RF field. A flexible mechanism to control the RF field is available. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 60 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend After power-up, the RF-field is off. The instruction RF_ON enables the generation of a RF-field. The NFC frontend can perform an initial RF collision avoidance according to ISO/IEC18092. Before enabling the RF-field, a field detection is automatically enabled for TIDT. In case an external field is detected, the field is not switched on and an RF_ACTIVE_ERROR_IRQ is raised. The cause for the error can be examined in the RF_STATUS_REG. In order to switch off the RF-field generation, the RF_OFF instruction needs to be sent. Active Mode is supported by configuring the RF_ON instruction. 11.8.3 Transmitter TX The transmitter is able to drive an antenna circuit connected to outputs TX1 and TX2 with a 13.56 MHz carrier signal. The signal delivered on pins TX1 and pin TX2 is the 13.56 MHz carrier modulated by an envelope signal for energy and data transmission. It can be used to drive an antenna directly, using a few passive components for matching and filtering. For a differential antenna configuration, either TX1 or TX2 can be configured to put out an inverted clock. 100 % modulation and several levels of amplitude modulation on the carrier can be performed to support 13.56 MHz carrier-based RF-reader/writer protocols as defined by standards ISO/IEC14443 A and B, FeliCa and ISO/IEC 18092. TVDD envelope hs_gate clk_highside M2 TX1 TVDD ls_gate<14:0> clk_lowside M1< PRE-DRIVERS aaa-008643 Fig 29. PN5180 Output driver 11.8.3.1 100 % Modulation There are 5 choices for the output stage behavior during 100 % modulation, and one setting for 10 % modulation. This modulation is controlled by TX_CLK_MODE_RM in RF_CONTROL_TX_CLK: Table 59. PN5180 Product data sheet COMPANY PUBLIC Settings for TX1 and TX2 TX_CLK_MODE_RM (binary) Tx1 and TX2 output Remarks 000 High impedance - 001 0 output pulled to 0 in any case 010 1 output pulled to 1 in any case All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 61 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 59. Settings for TX1 and TX2 ...continued TX_CLK_MODE_RM (binary) Tx1 and TX2 output Remarks 110 RF high side push Open-drain, only high side (push) MOS supplied with clock, clock polarity defined by TX2_INV_RM; low side MOS is off 101 RF low side pull Open-drain, only low side (pull) MOS supplied with clock, clock polarity defined by TX1_INV_RM; high side MOS is off 111 13.56 MHz clock derived from 27.12 MHz quartz divided by 2 push/pull Operation, clock polarity defined by invtx; setting for 10 % modulation With the options "RF high side push" and "RF low side push", potentially faster fall times can be achieved for the antenna voltage amplitude at the beginning of a modulation. This basic behavior during modulation cannot be configured independently for TX1 and TX2. Only the clock polarity can be configured separately with TX1_INV_RM and TX2_INV_RM. 11.8.3.2 10 % Amplitude Modulation For a targeted ASK 10 % amplitude modulation, the bits RF_CONTROL_TX_CLK in register TX_CLK_MODE_RM need to be set to value 0b111. Then the signal envelope does not influence the clock behavior thus resulting in an ASK modulation to a modulation index as defined by RF_CONTROL_TX in the bits TX_RESIDUAL_CARRIER. The residual carrier setting is used to adjust the modulation degree at the TX output. A control loop is implemented to keep the modulation degree as constant as possible. The settings and resulting typical residual carrier and modulation degree is given in table below: Table 60. PN5180 Product data sheet COMPANY PUBLIC Modulation degree configuration TX_RESIDUAL_CARRIER register setting residual carrier nominal (%) modulation degree nominal (%) 00h 100 0 01h 98 1.01 02h 96 2.04 03h 94 3.09 04h 91 4.71 05h 89 5.82 06h 87 6.95 07h 86 7.53 08h 85 8.11 09h 84 8.7 0Ah 83 9.29 0Bh 82 9.89 0Ch 81 10.5 0Dh 80 11.11 0Eh 79 11.73 0Fh 78 12.36 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 62 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 60. 11.8.3.3 Modulation degree configuration ...continued TX_RESIDUAL_CARRIER register setting residual carrier nominal (%) modulation degree nominal (%) 16 77 12.99 17 76 13.64 18 75 14.29 19 74 14.94 20 72 16.28 21 70 17.65 22 68 19.05 23 65 21.21 24 60 25 25 55 29.03 26 45 37.93 27 40 42.86 28 35 48.15 29 30 53.85 30 25 60 31 0 100 TX Wait Tx_wait can be used for 2 different purposes: On the one hand, it can be used to prevent start of transmission before a certain period has expired - even if thePN5180 has already finished data processing and set the START_SEND bit. This behavior is intended for the reader mode to guarantee the PICC to PCD frame delay time (FDT). On the other hand, the tx_wait time can be used to start the transmission at an exactly defined time. For this purpose, data to be sent must be available and the START_SEND flag has to be set by FW before the period expires. In case the START_SEND bit is not set when tx_wait expires and MILLER_SYNC_ENABLE is set the transmission is started on the bit-grid. The guard time tx_wait is started after the end of a reception, no matter if the frame is correct or erroneous. The tx_wait guard time counter is not started in case the reception is restarted because of an EMD-event or in case the RX_MULTIPLE_ENABLE bit is set to 1. In case the register flag TX_WAIT_RFON_ENABLE is set to 1 the guard time counter is started when the devices own RF-Field is switched on. To start a transmission, it is always necessary for the firmware to set the START_SEND bit in the SYSTEM_CONFIG register or sending the instruction SEND_DATA. Having said that it is possible to disable the guard time tx_wait by setting the register TX_WAIT_CONFIG to 00h. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 63 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11.8.3.4 Over- and Undershoot prevention clk13 env_gen_outstream tx_outstream delay overshoot protection delay undershoot protection aaa-009147 Example with overshoot pattern `1100' (binary) with a length of four and undershoot pattern `001' (binary) with a length of three. Fig 30. Overshoot/Undershoot prevention The over- and undershoot protection allows configuring additional signals on the Transmitter output which allows to control the signal shaping of the antenna output. The registers TX_OVERSHOOT_CONFIG_REG and TX_UNDERSHOOT_CONFIG_REG are used to configure the over-and undershoot protection. Additionally, in register RF_CONTROL_TX_CLK (bit TX_CLK_MODE_OVUN_PREV) it is defined which TX clock mode for the period the overshoot/undershoot prevention is active, and RF_CONTROL_TX (bit TX_RESIDUAL_CARRIER_OV_PREV) defines the value for the residual carrier for the period the overshoot prevention pattern is active. 11.8.4 Dynamic Power Control (DPC) The Dynamic Power Control allows adjusting the Transmitter output current dependent on the loading condition of the antenna. A lookup table is used to configure the output voltage and by this control the transmitter current. In addition to the control of the transmitter current, wave shaping settings can be controlled dependent on the selected protocol and the measured antenna load. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 64 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend DPC_AGC_GEAR_LUT PWR LUT ENTRY 1 PWR LUT ENTRY 2 PWR LUT ENTRY 3 PWR LUT ENTRY 4 DPC_THRSH_HIGH AGC VALUE PWR LUT ENTRY 5 GEAR PWR LUT ENTRY X DPC_THRISH_LOW aaa-019796 Fig 31. AGC value defining the RF output power configuration AGC VALUE GEAR PCD_SHAPING_LUT SHAPING LUT ENTRY 1 CONFIGURED PROTOCOL SHAPING LUT ENTRY 2 SHAPING LUT ENTRY 2 SHAPING LUT ENTRY Z aaa-023828 Fig 32. AGC value defining the waveshape configuration The PN5180 allows measuring periodically the RX voltage. The RX voltage is used as indicator for the actual antenna current. The voltage measurement is done with the help of the AGC. The time interval between two measurements can be configured with the OC_TIME byte in the EEPROM. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 65 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend DPC_AGC_GEAR_LUT PWR LUT ENTRY 1 PWR LUT ENTRY 2 PWR LUT ENTRY 3 PWR LUT ENTRY 4 DPC_THRSH_HIGH AGC VALUE PWR LUT ENTRY 5 GEAR PWR LUT ENTRY X DPC_THRISH_LOW aaa-019796 Fig 33. Lookup tables for AGC value-dependent dynamic configuration The AGC value is compared to a maximum and minimum threshold value which is stored in EEPROM. If the AGC value is exceeding one of the thresholds, a new gear configuring another transmitter supply driver voltage will be activated. The number of gears - and by these transmitter supply voltage configurations - can be defined by the application, up to 15 gears are available. TX_CW_TO_MAX_RM VTVDD -150 mV 00 -250 mV 01 -500 mV 10 1 11 1 -1.0 V 0 3.0 V 00 2.75 V 01 2.5 V 10 2.0 V TX driver supply 0 11 TX_CW_AMP_REF2TVDD TX_CW_AMPLITUDE_RM <1:0> aaa-019385 Fig 34. Transmitter supply voltage configuration, VDD(TVDD) > 3.5 V PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 66 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11.8.5 Adaptive Waveform Control (AWC) Depending on the level of detected detuning of the antenna, RF wave shaping related register settings can be automatically updated. The shaping related register settings are stored in a lookup table located in EEPROM, and selected dependent on the actual gear. The gear numbers need to be provided as part of the lookup table entries and need to be provided in ascending order in the EEPROM. Each lookup table entry allows configuring not only a dedicated wave shaping configuration for the corresponding gear, but in additionally it is possible to configure for this gear the wave shaping configuration dependent on the different protocols. Each lookup table item contains a bitmask of technology and baud rate (in order to use an entry for multiple technologies and baudrates), the DPC Gear and a relative value (change compared to actual setting of register RF_CONTROL_TX) for TAU_MODE_FALLING, TAU_MODE_RISING and TX_RESIDUAL_CARRIER. Table 61. Wave shaping lookup table Bit position Function of each DWORD 29:31 RFU 16:28 Bitmask identifying technology and baud rate 0001h A 106 0002h A 212 0004h A 424 0008h A 848 0010h B 106 0020h B 212 0040h B 424 0080h B 848 0100h F 212 0200h F424 0400h ISO/IEC 15693 ASK10 0800h ISO/IEC 15693 ASK100 1000h ISO/IEC 18000m3 12_15 RESIDUAL_CARRIER (Sign bit + 3-bit value) 0: Add value to current residual carrier configuration, 1; subtract value from current residual carrier configuration 8:11 TAU_MOD_RISING (Sign bit + 3-bit value) 0: Add value to current TAU_MOD_RISING configuration, 1; subtract value from current TAU_MOD_RISING configuration 4:7 TAU_MOD_FALLING (Sign bit + 3-bit value) 0: Add value to current TAU_MOD_FALLING configuration, 1; subtract value from current TAU_MOD_FALLING configuration 0:3 DPC Gear If there is a gear switch, a EEPROM lookup is performed if the current gear (at current protocol and baud rate) has an assigned wave shaping configuration. In case of an execution of a LoadProtocol command, this lookup will be performed (example: switching from baud rate A106 to A424) as well. The change from the wave shaping configuration PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 67 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend as configured by LOAD_RF_CONFIG is relative, which means that bits are added or subtracted from the existing configuration. For an increasing gear value, the defined change is cumulative. AGC_CONFIG register AGC_CONFIG register AGC_INPUT_SEL AGC_VREF_SEL AGC_CONFIG register RM_VALUE RF_STATUS register AGC_VALUE AGC_CONFIG register CONTROLLER CM_VALUE AGC config value AGC_CONFIG register to signal processing last AGC value RX input AGC_MODE_SEL internal register UPDATE DIVIDER_VALUE AGC_CONFIG register AGC_ENABLE_CONTROL value fix mode AGC_CONFIG register control mode AGC_CONFIG register AGC_LOAD AGC_TIME_CONSTANT trim value EEPROM: 0x5C DPC_XI aaa-023926 Fig 35. DPC, AGC and AWC configuration 11.8.6 Adaptive Receiver Control (ARC) (Available from Firmware 2.6 onwards) Depending on the level of detected detuning of the antenna, receiver-related register settings can be automatically updated. The registers which allow to be dynamically controlled are RX_GAIN and RX_HPCF. The size of the Lookup table for the ARC is done in the upper nibble of the entry PCD_SHAPING_LUT_SIZE (0x97). In case this entry is zero, the ARC is deactivated. In total 20 entries (20*1 DWORD = 80 bytes) + 1 byte for length (upper nibble for RX Gain, and lower nibble for PCD shaping) can be used for both PCD shaping (AWC) and RX Gain configuration (ARC) in the EEPROM. The ARC lookup table (configuration data) is added at the end of the AWC (waveshaping) lookup table. This provides maximum flexibility and allows do define different lookup table sizes for both AWC and ARC. Care must be taken if the size of the AWC table is changed, this results in invalid ARC data which might have been previously configured since the ARC table offset changes as a result of the changed AWC size. The Adaptive Receiver Control settings override the default RX_GAIN and RX_HPCF register configuration done by LoadProtocol. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 68 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend In case of a gear switch, an EEPROM lookup is performed. If the current gear (at current protocol and baud rate) has an assigned RX_GAIN and RX_HPCF configuration, this value is used to update the current receiver register configuration. 11.8.7 Transceive state machine The transceive command allow transmitting and the following expected receive data with a single command. The transceive state machine is used to trigger the reception and transmission of the RF data dependent on the conditions of the interface. The state machine for the command transceive is started when the SYSTEM_CONFIG command is set to transceive. The transceive command does not terminate automatically. In case of an error, the host can stop the transceive state machine by setting the SYSTEM_CONFIG.command to IDLE. START_SEND can either be triggered by writing to the SYSTEM_CONFIG register start_send or by using the command SET_INSTR_SEND_DATA. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 69 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend IDLE mode Command set to transceive yes Initator yes Tx_skip_send_ enable* no WAIT_RECEIVE (start RX_WAIT timer) no RX_wait timer elapsed WAIT_TRANSMIT (start TX_WAIT timer) WAIT_FOR_DATA (check for reception) Tx-wait timer elapsed Reception started no Reception done RECEIVE (RF reception is started) START_SEND yes TRANSMIT (RF transmission is started) Transmission done Tx_frame_step_ enable no yes no All bytes transmitted yes aaa-020626 Fig 36. Transceive state machine PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 70 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11.8.8 Autocoll The Autocoll state machine performs the time critical activation for Type-A PICC and for NFC-Forum Active and Passive Target activation. The PICC state machine supports three configurations: * Autocoll mode0: Autocoll mode is left when no RF field is present * Autocoll mode1: Autocoll mode is left when one technology is activated by an external reader. During RFoff, the chip enters standby mode automatically * Autocoll mode2: Autocoll mode is left when one technology is activated by an external reader. During RFoff, the chip does not enter standby mode. At start-up, the Autocoll state machine automatically performs a LOAD_RF_CONFIG with the General Target Mode Settings. When a technology is detected during activation, the Autocoll state machine performs an additional LOAD_RF_CONFIG with the corresponding technology. The card configuration for the activation is stored in EEPROM. If RandomUID is enabled (EEPROM configuration, Address 0x51), a random UID is generated after each RF-off. For all active target modes, the own RF field is automatically switched on after the initiator has switched off its own filed. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 71 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend entry IDLE Frame received no SensF received and Passive Target F enabled no ReqA/WupA yes Frame received and no error no yes yes Passive Target A enabled? no Yes and Autocoll_state_a** == HALT Any CL Error ISO14443-3A PICC state machine SC = 0xFFFF or EE-Value yes Active Mode enabled no SensFReq received Send SensF response Yes and Autocoll_state_a** == IDLE any other frame received HALT READY* READY ACTIVE* ACTIVE Passive Target F212/424* IRQ line is asserted Load Protocol PICC-F212 or PICC-F424 done RX_IRQ and CARD_ACTIVATED_IRQ are set Passive Target A106 IRQ line is asserted Load Protocol PICC-A106 done RX_IRQ and CARD_ACTIVATED_IRQ are set Active Target A106/F212/F424* IRQ line is asserted Load Protocol AT106/AT212/ AT424 done RX_IRQ is set *the determined baudrate can be found in the SIGPRO_CONFIG register ** Autocoll_state_a is defined in the register SYSTEM_CONFIG aaa-020625 Fig 37. Autocall state machine 11.8.9 Receiver RX 11.8.9.1 Reader Mode Receiver In Reader Mode, the response of the PICC device is coupled from the PCB antenna to the differential input RXP/RXN. The Reader Mode Receiver extracts this signal by first removing the carrier in passive mixers (direct conversion for I and Q), then filtering and amplifying the baseband signal, and finally converting to digital values with 2 separate ADCs for I and Q channel. Both the I and Q channels have a differential structure which improves the signal quality. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 72 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend The I/Q-Mixer mixes the differential input RF-signal down to the baseband. The mixer has a band with of 2 MHz. The down mixed differential RX input signals are passed to the BBA and band-pass filtered. In order to consider all the various protocols (Type A/B, FeliCa), the high-pass cut-off frequency of BBA can be configured between 45 kHz and 250 kHz in 4 different steps. The low-pass cut-off frequency is above 2 MHz. This band-passed signal is then further amplified with a gain factor which is configurable between 30 dB and 60 dB. The baseband amplifier (BBA)/ADC I- and Q- channel can be enabled separately. This is required for ADC-based CardMode functionality as only the I-channel is used in this case. The gain and high pass corner frequency of the BBA are not independent from each other: Table 62. Gain setting HPCF setting HPCF (kHz) LPCF (MHz) Gain (sB20) Band width (MHz) Gain3 0 39 3.1 60 3.1 1 78 3.2 59 3.1 2 144 3.5 58 3.3 3 260 4.1 56 3.8 0 42 3.1 51 3.1 1 82 3.3 51 3.2 2 150 3.7 49 3.5 3 271 4.3 47 4.0 0 41 3.7 43 3.7 1 82 4.0 42 3.9 2 151 4.5 41 4.3 3 276 5.5 39 5.2 0 42 3.8 35 3.8 1 84 4.1 34 4.0 2 154 4.7 33 4.5 3 281 5.7 31 5.4 Gain2 Gain1 Gain0 BBA RXP DATA I-CLK AGC MIX CLK VMID Q-CLK BBA DATA RXN aaa-008644 Fig 38. PN5180 Receiver Block diagram PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 73 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11.8.9.2 Automatic Gain Control The Automatic Gain Control (AGC) of the receiver is used to control the amplitude of the received 13.56 MHz input sine-wave signal from the antenna (input pins RXP and RXN). It is desirable to achieve an input voltage in the range of 1.5 V to 1.65 V at the pins RXP, RXN. For symmetric antennas, the voltage levels are the same on the pins RXP, RXN. A voltage lower than 1.5 V lead to a reduced sensitivity of the receiver, a voltage level higher than 1.65 V could result in clipping of the received signal in the signal processing unit of the PN5180. Both conditions should be avoided for optimum performance of the IC. An antenna detuning caused by the presence of a card, or mobile phone will typically result in an RX input level which is outside the desired input voltage range. Here the AGC helps to simplify the design by keeping the RX voltage automatically within the range of 1.5 V to 1.65 V even under dynamic changing antenna detuning conditions. Functional description: The peak of the input signal at RXP is regulated to be equal to a reference voltage (internally generated from the supply using a resistive divider). Two external resistors are connected to the RX inputs, the specific value of these resistors in a given design depends on the selected antenna and needs to be determined during development. This external resistor, together with an on-chip variable resistor connected to VMID, forms a resistive voltage divider for the signal processor input voltage. The resolution of the variable resistor is 10 bits. By varying the on-chip resistor, the amplitude of the input signal can be modified. The on-chip resistor value is increased or decreased depending on the output of the sampled comparator, until the peak of the input signal matches the reference voltage. The amplitude of the RX input is therefore automatically controlled by the AGC circuit. The internal amplitude controlling resistor in the AGC has a default value of 10 kOhm typ DC coupled. (i.e. when the resistor control bits in AGC_VALUE_REG <9:0> are all 0, the resistance is 10 k). As the control bits are increased, resistors are switched in parallel to the 10k resistor thus lowering the combined resulting resistance value down to 20 Ohm DC coupled (AGC_VALUE_REG <9:0>, all bits set to 1). 11.8.9.3 RX Wait The guard time rx_wait is started after the end of a transmission. If the register flag RX_WAIT_RFON_ENABLE is set to 1 the guard time is started when the device switches off its own RF-Field and an external RF-Field was detected. The guard time rx_wait can be disabled by setting the register RX_WAIT_VALUE to 00h meaning the receiver is immediately enabled. 11.8.9.4 EMD Error handling EMVCo The PN5180 supports EMD handling according to the EMVCo standard. To support further extension the EMD block is configurable to allow adoption for further standard updates. The PN5180 supports automatically restart of the receiver and CLIF timer1 is restarted in case of an EMD event. The CLIF timer is selectable in the EMD_CONTROL register. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 74 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend An EMD event is generated: * Independent of received number of bytes * Any Residual bits and EMD_CONTROL.emd_transmission_error_above_noise = 0 * When the received number of bytes without CRC is <= EMD_CONTROL.emd_noise_bytes_threshold * Independent of received number of bytes * Any Residual bits and EMD_CONTROL.emd_transmission_error_above_noise = 0 * When the received number of bytes without CRC is <= EMD_CONTROL.emd_noise_bytes_threshold * Missing CRC (1 byte frame) when EMD_CONTROL.emd_missing_crc_is_protocol_error_type_X = 0 11.8.10 Low-Power Card Detection (LPCD) The low-power card detection is an energy saving configuration option for the PN5180. A low frequency oscillator (LFO) is implemented to drive a wake-up counter, waking-up PN5180 from standby mode. This allows implementation of low-power card detection polling loop at application level. The SWITCH_MODE instruction allows entering the LPCD mode with a given standby duration value. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 75 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend FW command LP CD Set wakeup_counter = 0x3FF yes Wakeup_counter > 0x3FF no LoadRF config Tx: A106 Rx: A106 LPCD_GPO_REFVAL _CONTROL[1:0] == 00 LPCD_GPO_REFVAL _CONTROL[1:0] == 10 Reference_value == LPCD_REFERENCE_ VALUE (EEProm@0x34) Reference_value == AGC_REF_CONFIG (register@0x26) LPCD_GPO_REFVAL _CONTROL[1:0] == 01 Function Call RF_CHECKCARD(AGCRefVal=0) AutoCalibration - Measures the actual AGC value&Gear and use this as a reference Enter Standby with Wakeup from Wakeup Counter Standby Mode left SET IDLE_IRQ end state Any other Boot Reason Wakeup counter no Function Call RF_CHECKCARD(AGCRefVal == Reference_value) Switch on RF field and measure AGC | Reference_value-actual_AGC| > LPCD_THRESHOLD yes SET LPCD_IRQ end state aaa-020634 Fig 39. LPCD configuration Before entering the LPCD mode, an LPCD reference value needs to be determined. Three options do exist for generating this reference value. The LPCD works in two phases: PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 76 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend First the standby phase is controlled by the wake-up counter (timing defined in the instruction), which defines the duration of the standby of the PN5180. Second phase is the detection-phase. The RF field is switched on for a defined time (EEPROM configuration) and then the AGC value is compared to a reference value. * If the AGC value exceeds the reference value, a LPCD_IRQ is raised to the host. The register configurations done by the host are not restored after wake-up. command. The host has to configure the NFC frontend for a dedicated protocol operation to allow a polling for a card. * If the AGC value does not exceed the limit of the reference value, no LPC_IRQ is raised and the IC is set to the first phase (standby mode) again. As an additional feature the GPO1 (general-purpose output) pin can be enabled to wake-up an external LDO from power down for the TVDD supply. The GPO1 allows setting to high before the transmitter is switched on. This allows the wake-up of an external LDO from power down. The GPO1 can be set to low after the RF field is switched off to set an external LDO into power-down mode. The time of toggling the GPO in relation to the RF-on and RF-off timings can be configured in EEPROM addresses 0x39 and 0x3A. These two phases are executed in a loop until 1. Card / metal is detected (LPCD_IRQ is raised). 2. Reset occurs, which resets all the system configurations. The LPCD is also stopped in this case. 3. NSS on Host IF 4. RF Level Detected The behavior of the generated field is different dependent on the activation state of the DPC function: * If the DPC feature is not active, the ISO/IEC14443 type A 106 kbit/s settings are used during the sensing time. * If the DPC is active, the RF_ON command is executed. The RF field is switched on as soon as the timer configured by the SWITCH_MODE command elapses. The RF field is switched on for a duration as defined for an activated DPC. The timer for the LPCD_FIELD_ON_TIME starts to count as soon as the RF_ON command terminates. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 77 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 63. Low-Power Card Detection: EEPROM configuration EEPROM Name address Bit value Description 0x34 LPCD_REFERENCE_VALUE - - 2 bytes: bit 9:0 AGC reference value; bit 13:10 AGC gear 0x36 LPCD_FIELD_ON_TIME - - 1 byte: Defines the RF-ON time for the AGC measurement. The minimum RF-ON time depends on the antenna configuration and the connected matching network. It needs to be chosen in such a way that a stable condition for the AGC measurement is given at the end of the time. The byte defines the delay multiplied by 8 in microseconds. 0x37 LPCD_THRESHOLD - - 1 byte: Defines the AGC threshold value. This value is used to compare against the current AGC value during the low-power card detection phase. if the difference between AGC reference value and current AGC value is greater than LPCD_THRESHOLD, the IC wakes up from LPCD. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 78 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 63. Low-Power Card Detection: EEPROM configuration EEPROM Name address Bit value Description 0x38 - - up to firmware version 3.5: LPCD_REFVAL_CONTROL 2 Control of GPO1 in relation to RF-ON 1 Enable Control (e.g. for external TVDD LDO) via GPO1 0 Disable Control (e.g. for external TVDD LDO) via GPO1 1:0 from firmware version 3.6 onwards LPCD_REFVAL_GPO_CONTROL 1:0 2 3 4 LPCD Reference Value Selection and GPO control Source of AGC reference value 11 RFU 10 Use AGC Reference value and AGC gear from the register AGC_REG_CONFIG. 01 Use one AGC measurement to get reference value 00 Use EEPROM value for reference value - This byte in EEPROM is used to control the GPO assertion during wake-up and LPCD card detect. - Defines the source of the LPCD reference value 00 Use EEPROM Value for reference value 01 Use one AGC measurement to get reference value 10 Use AGC Reference value and AGC gear from the register AGC_REG_CONFIG. 11 RFU - Allows enabling a GPO output level change during wake-up from standby, before the RF field is switched on. This allows waking-up an external LDO or DC/DC supplying the transmitter (pin TVDD). 0 Disable Control for external TVDD LDO via GPO1 1 Enable Control for external TVDD LDO via GPO1 - GPO2 Control for external TVDD LDO during wake-up from standby 0 Disable Control of external TVDD LDO via GPO2 on LPCD Card Detect 1 Enable Control of external TVDD LDO via GPO2 on LPCD Card Detect - GPO1 Control for external TVDD LDO during wake-up from standby 0 Disable Control of external TVDD LDO via GPO1 on wake-up from standby 1 Enable Control of external TVDD LDO via GPO1 on wake-up from standby 0x39 LPCD_GPO_TOGGLE_BEFORE_ FIELD_ON - 1 byte: This value defines the time between setting GPO1 until field is switched on. The byte defines the time multiplied by 5 in microseconds. 0x3A LPCD_GPO_TOGGLE_AFTER_ FIELD_ON - 1 byte: This value defines the time between field off and clearing GPO1. The byte defines the time multiplied by 5 in microseconds. PN5180 Product data sheet COMPANY PUBLIC - All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 79 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11.8.10.1 Check Card register The Check Card register at register 0x26 performs one LPCD cycle. This means that only the second phase - the detection phase is executed. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 80 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 11.9 Register overview 11.9.1 Register overview Table 64. PN5180 Product data sheet COMPANY PUBLIC Register address overview Address (HEX) Address (decimal) Name 0h 0 SYSTEM_CONFIG 1h 1 IRQ_ENABLE 2h 2 IRQ_STATUS 3h 3 IRQ_SET_CLEAR 4h 4 TRANSCEIVER_CONFIG 5h 5 PADCONFIG_REG 6h 6 RFU 7h 7 PADOUT_REG 8h 8 TIMER0_STATUS 9h 9 TIMER1_STATUS Ah 10 TIMER2_STATUS Bh 11 TIMER0_RELOAD Ch 12 TIMER1_RELOAD Dh 13 TIMER2_RELOAD Eh 14 TIMER0_CONFIG Fh 15 TIMER1_CONFIG 10h 16 TIMER2_CONFIG 11h 17 RX_WAIT_CONFIG 12h 18 CRC_RX_CONFIG 13h 19 RX_STATUS 14h 20 TX_UNDERSHOOT_CONFIG 15h 21 TX_OVERSHOOT_CONFIG 16h 22 TX_DATA_MOD 17h 23 TX_WAIT_CONFIG 18h 24 TX_CONFIG 19h 25 CRC_TX_CONFIG 1Ah 26 SIGPRO_CONFIG 1Bh 27 SIGPRO_CM_CONFIG 1Ch 28 SIGPRO_RM_CONFIG 1Dh 29 RF_STATUS 1Eh 30 AGC_CONFIG 1Fh 31 AGC_VALUE 20h 32 RF_CONTROL_TX 21h 33 RF_CONTROL_TX_CLK 22h 34 RF_CONTROL_RX 23h 35 LD_CONTROL 24h 36 SYSTEM_STATUS 25h 37 TEMP_CONTROL All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 81 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 64. Register address overview ...continued Address (HEX) Address (decimal) Name 26h 38 CHECK_CARD_RESULT 27h 39 DPC_CONFIG 28h 40 EMD_CONTROL 29h-7Ah 38-127 RFU 11.9.2 Register description Table 65. SYSTEM_CONFIG register (address 0000h) bit description Bit Symbol Access 31:9 RFU R 0*,1 Reserved 9 AUTOCOLL_PICC_STATE R/W 0*,1 Defines the entry state of the PICC TypeA state machine when Autocoll mode is entered 0. 8 SOFT_RESET W 0*,1 performs a reset of the device by writing a "1" into this register. 7 RFU R/W 0*,1 RFU 6 MFC_CRYPTO_ON R/W 0*,1 If set to 1, the mfc-crypto is enabled for end-/de-cryption 5 PRBS_TYPE R/W 0*,1 Defines the PRBS type; If set to 1, PRBS15 is selected, default value 0 selects PRBS9 4 RFU R/W 0*,1 RFU 3 START_SEND R/W 0*,1 If set to 1, this triggers the data transmission according to the transceive state machine 0:2 COMMAND R/W 001* These bits define the command for the transceive state machine: 000 IDLE/StopCom Command; stops all ongoing communication and set the CLIF to IDLE mode 001 RFU 010 RFU 011 Transceive command; initiates a transceive cycle. Note: Depending on the value of the Initiator bit, a transmission is started or the receiver is enabled Note: The transceive command does not finish automatically. It stays in the transceive cycle until stopped via the IDLE/StopCom command 100 KeepCommand command; This command does not change the content of the command register and might be used in case other bits in the register are to be changed 101 LoopBack command; This command is for test purposes only. It starts a transmission and at the same time enables the receiver. 110 PRBS command, performs an endless transmission of PRBS data 111 RFU PN5180 Product data sheet COMPANY PUBLIC Value Description All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 82 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 66. IRQ_ENABLE register (address 0001h) bit description Bit Symbol Access Value Description 17 TEMPSENS_ERROR_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the TempSensor 16 RX_SC_DET_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RX Subcarrier Detection 15 RX_SOF_DET_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RX SOF Detection 14 RFU R/W 0*, 1 - 13 TIMER2_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer2 12 TIMER1_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer1 11 TIMER0_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the Timer0 10 RF_ACTIVE_ERROR_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF active error 9 TX_RFON_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field ON in PCD 8 TX_RFOFF_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field OFF in PCD 7 RFON_DET_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field ON detection 6 RFOFF_DETQ_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the RF Field OFF detection 5 STATE_CHANGE_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the State Change in the transceive state machine 4 CARD_ACTIVATED_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin when PN5180 is activated as a Card 3 MODE_DETECTED_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin when PN5180 is detecting an external modulation scheme 2 IDLE_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for the IDLE mode 1 TX_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for End of RF transmission 0 RX_IRQ_EN R/W 0*, 1 Enable IRQ propagation to the pin for End of RF reception Table 67. IRQ_STATUS register (address 0002h) bit description Bit Symbol Access Value Description 31:20 RFU R/W 0*, 1 - 19 LPCD_IRQ_STAT R/W 0*, 1 Low-Power Card Detection IRQ 18 HV_ERROR_IRQ_STAT R/W 0*, 1 EEPROM Failure during Programming IRQ 17 GENERAL_ERROR_IRQ_STAT R/W 0*, 1 General Error IRQ 16 TEMPSENS_ERROR_IRQ_STA T R/W 0*, 1 Temperature Sensor IRQ 15 RX_SC_DET_IRQ_STAT R/W 0*, 1 RX Subcarrier Detection IRQ 14 RX_SOF_DET_IRQ_STAT R/W 0*, 1 RX SOF Detection IRQ 13 TIMER2_IRQ_STAT R/W 0*, 1 Timer2 IRQ 12 TIMER1_IRQ_STAT R/W 0*, 1 Timer1 IRQ 11 TIMER0_IRQ_STAT R/W 0*, 1 Timer0 IRQ PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 83 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 67. IRQ_STATUS register (address 0002h) bit description ...continued Bit Symbol Access Value Description 10 RF_ACTIVE_ERROR_IRQ_STA T R/W 0*, 1 RF active error IRQ 9 TX_RFON_IRQ_STAT R/W 0*, 1 RF Field ON in PCD IRQ 8 TX_RFOFF_IRQ_STAT R/W 0*, 1 RF Field OFF in PCD IRQ 7 RFON_DET_IRQ_STAT R/W 0*, 1 RF Field ON detection IRQ 6 RFOFF_DET_IRQ_STAT R/W 0*, 1 RF Field OFF detection IRQ 5 STATE_CHANGE_IRQ_STAT R/W 0*, 1 State Change in the transceive state machine IRQ 4 CARD_ACTIVATED_IRQ_STAT R/W 0*, 1 Activated as a Card IRQ 3 MODE_DETECTED_IRQ_STAT R/W 0*, 1 External modulation scheme detection IRQ 2 IDLE_IRQ_STAT R/W 0*, 1 IDLE IRQ 1 TX_IRQ_STAT R/W 0*, 1 End of RF transmission IRQ 0 RX_IRQ_STAT R/W 0*, 1 End of RF reception IRQ Table 68. IRQ_CLEAR register (address 0003h) bit description Bit Symbol Access Value Description 20 LPCD_IRQ_CLR R/W 0*, 1 Clear Low-Power Card Detection IRQ 19 HV_ERROR_IRQ_CLR R/W 0*, 1 Clear EEPROM Failure during Programming IRQ 18 GENERAL_ERROR_IRQ_CLR R/W 0*, 1 Clear General Error IRQ 17 TEMPSENS_ERROR_IRQ_CLR R/W 0*, 1 Clear Temperature Sensor IRQ 16 RX_SC_DET_IRQ_STAT R/W 0*, 1 Clear RX Subcarrier Detection IRQ 15 RX_SOF_DET_IRQ_STAT R/W 0*, 1 Clear RX SOF Detection IRQ 14 RFU R/W 0*, 1 - 13 TIMER2_IRQ_CLR R/W 0*, 1 Clear Timer2 IRQ 12 TIMER1_IRQ_CLR R/W 0*, 1 Clear Timer1 IRQ 11 TIMER0_IRQ_CLR R/W 0*, 1 Clear Timer0 IRQ 10 RF_ACTIVE_ERROR_IRQ_CLR R/W 0*, 1 Clear RF active error IRQ 9 TX_RFON_IRQ_CLR R/W 0*, 1 Clear RF Field ON in PCD IRQ 8 TX_RFOFF_IRQ_CLR R/W 0*, 1 Clear RF Field OFF in PCD IRQ 7 RFON_DET_IRQ_CLR R/W 0*, 1 Clear RF Field ON detection IRQ 6 RFOFF_DET_IRQ_CLR R/W 0*, 1 Clear RF Field OFF detection IRQ 5 STATE_CHANGE_IRQ_CLR R/W 0*, 1 Clear State Change in the transceive state machine IRQ 4 CARD_ACTIVATED_IRQ_CLR R/W 0*, 1 Clear Activated as a Card IRQ 3 MODE_DETECTED_IRQ_CLR R/W 0*, 1 Clear External modulation scheme detection IRQ 2 IDLE_IRQ_CLR R/W 0*, 1 Clear IDLE IRQ 1 TX_IRQ_CLR R/W 0*, 1 Clear End of RF transmission IRQ 0 RX_IRQ_CLR R/W 0*, 1 Clear End of RF reception IRQ PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 84 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 69. TRANSCEIVE_CONTROL register (address 0004h) bit description Bit Symbol Access Value Description 4-9 STATE_TRIGGER_SELECT R/W 000000* Register to select the state to trigger the STATE_CHANGE_IRQ flag. Each bit of the bit field enables one state - several states are possible. Note: If all bits are 0 no IRQ is triggered. xxxxx1 IDLE state enabled to trigger IRQ xxxx1x WaitTransmit state enabled to trigger IRQ xxx1xx Transmitting state enabled to trigger IRQ xx1xxx WaitReceive state enabled to trigger IRQ x1xxxx WaitForData state enabled to trigger IRQ 1xxxxx Receiving state enabled to trigger IRQ 3 TX_SKIP_SEND_ENABLE R/W 0*, 1 If set, not transmission is started after tx_wait is expired and START_SEND was set Note: The bit is cleared by HW when the WaitReceive state is entered. 2 TX_FRAMESTEP_ENABLE R/W 0*, 1 If set, at every start of transmission; each byte of data is sent in a separate frame. SOF and EOF are appended to the data byte according to the framing settings. After one byte is transmitted; the TxEncoder waits for a new start trigger to continue with the next byte. 1 RX_MULTIPLE_ENABLE R/W 0*, 1 If set, the receiver is reactivated after the end of a reception. A status byte is written to the RAM containing all relevant status information of the frame. Note: Data in RAM is word aligned therefore empty bytes of a data Word in RAM are padded with 0x00 bytes. SW has to calculate the correct address for the following frame. 0 INITIATOR R/W 0*, 1 If set, the CLIF is configured for initiator mode. Depending on this setting, the behavior of the transceive command is different Table 70. PINCONFIG register (address 0005h) bit description Bit Symbol Access Value Description 7 EN_SLEW_RATE_CONTROL R/W 0*, 1 Enables slew rate control of digital pads 6 GPO7_DIR R/W 0*, 1 Enables the output driver of GPO7. The GPO is only available for the package TFBGA64 5 GPO6_DIR R/W 0*, 1 Enables the output driver of GPO6. The GPO is only available for the package TFBGA64 4 GPO5_DIR R/W 0*, 1 Enables the output driver of GPO5. The GPO is only available for the package TFBGA64 3 GPO4_DIR R/W 0*, 1 Enables the output driver of GPO4. The GPO is only available for the package TFBGA64 2 GPO3_DIR R/W 0*, 1 Enables the output driver of GPO3. The GPO is only available for the package TFBGA64 1 GPO2_DIR R/W 0*, 1 Enables the output driver of GPO2. The GPO is only available for the package TFBGA64 0 GPO1_DIR R/W 0*, 1 Enables the output driver of GPO1. The GPO is only available for the package TFBGA64 and HVQFN40 PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 85 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 71. PIN_OUT register (address 0007h) bit description Bit Symbol Access Value Description 6 GPO7_OUT R/W 0*, 1 Output value of GPO7. The GPO is only available for the package TFBGA64 5 GPO6_OUT R/W 0*, 1 Output value of GPO6. The GPO is only available for the package TFBGA64 4 GPO5_OUT R/W 0*, 1 Output value of GPO5. The GPO is only available for the package TFBGA64 3 GPO4_OUT R/W 0*, 1 Output value of GPO4. The GPO is only available for the package TFBGA64 2 GPO3_OUT R/W 0*, 1 Output value of GPO3. The GPO is only available for the package TFBGA64 1 GPO2_OUT R/W 0*, 1 Output value of GPO2. The GPO is only available for the package TFBGA64 0 GPO1_OUT R/W 0*, 1 Output value of GPO1. The GPO is only available for the package TFBGA64 and HVQFN40 Table 72. TIMER0_STATUS register (address 0008h) bit description Bit Symbol Access Value Description 20 T0_RUNNING R 0*, 1 Indicates that timer T0 is running (busy) 19:0 T0_VALUE R 00000h* - Value of 20bit counter in timer T0 FFFFFh Table 73. TIMER1_STATUS register (address 0009h) bit description Bit Symbol Access Value Description 20 T1_RUNNING R 0*, 1 Indicates that timer T1 is running (busy) 19:0 T1_VALUE R 00000h* - Value of 20bit counter in timer T1 FFFFFh Table 74. TIMER2_STATUS register (address 000Ah) bit description Bit Symbol Access Value Description 20 T2_RUNNING R 0*, 1 Indicates that timer T2 is running (busy) 19:0 T2_VALUE R 00000h* - Value of 20bit counter in timer T2 FFFFFh Table 75. TIMER0_RELOAD register (address 000Bh) bit description Bit Symbol 20:32 - 19:0 T0_RELOAD_VALUE Table 76. TIMER1_RELOAD register (address 000Ch) bit description Bit Symbol 20:32 - 19:0 T1_RELOAD_VALUE PN5180 Product data sheet COMPANY PUBLIC Access Value Description RFU R/W Access 00000h* - Reload value of the timer T0. FFFFFh Value Description RFU R/W 00000h* - Reload value of the timer T1. FFFFFh All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 86 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 77. TIMER2_RELOAD register (address 000Dh) bit description Bit Symbol 20:32 - 19:0 T2_RELOAD_VALUE Table 78. TIMER0_CONFIG register (address 000Eh) bit description Bit Symbol Access Value Description 20 T0_STOP_ON_RX_STARTED R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped when a data reception begins and the first 4 bits had been received. The additional delay of the timer is protocol-dependent and listed in the appendix. 19 T0_STOP_ON_TX_STARTED R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped when a data transmission begins. 18 T0_STOP_ON_RF_ON_EXT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped when the external RF field is detected. 17 T0_STOP_ON_RF_OFF_EXT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped when the external RF field vanishes. 16 T0_STOP_ON_RF_ON_INT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped when the internal RF field is turned on. 15 T0_STOP_ON_RF_OFF_INT R/W 0* T0_STOP_EVENT: If set; the timer T0 is stopped when the internal RF field is turned off. 14 T0_START_ON_RX_STARTED R/W 0* T0_START_EVENT: If set; the timer T0 is started when a data reception begins (first bit is received). 13 T0_START_ON_RX_ENDED R/W 0* T0_START_EVENT: If set; the timer T0 is started when a data reception ends. 12 T0_START_ON_TX_STARTED R/W 0* T0_START_EVENT: If set; the timer T0 is started when a data transmission begins. 11 T0_START_ON_TX_ENDED R/W 0* T0_START_EVENT: If set; the timer T0 is started when a data transmission ends. 10 T0_START_ON_RF_ON_EXT R/W 0* T0_START_EVENT: If set; the timer T0 is started when the external RF field is detected. 9 T0_START_ON_RF_OFF_EXT R/W 0* T0_START_EVENT: If set; the timer T0 is started when the external RF field is not detected any more. 8 T0_START_ON_RF_ON_INT R/W 0* T0_START_EVENT: If set; the timer T0 is started when an internal RF field is turned on. 7 T0_START_ON_RF_OFF_INT R/W 0* T0_START_EVENT: If set; the timer T0 is started when an internal RF field is turned off. 6 T0_START_NOW R/W 0* T0_START_EVENT: If set; the timer T0 is started immediately. PN5180 Product data sheet COMPANY PUBLIC Access Value Description RFU R/W 00000h* - Reload value of the timer T2. FFFFFh All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 87 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 78. TIMER0_CONFIG register (address 000Eh) bit description ...continued Bit Symbol Access Value Description 3:5 T0_PRESCALE_SEL R/W 000b* Controls frequency/period of the timer T0 when the prescaler is activated in T0_MODE_SEL: 000b 6.78 MHz counter 001b 3.39 MHz counter 010b 1.70 MHz counter 011b 848 kHz counter 100b 424 kHz counter 101b 212 kHz counter 110b 106 kHz counter 111b 53 kHz counter 2 T0_MODE_SEL R/W 0* Configuration of the timer T0 clock. 0b* Prescaler is disabled: the timer frequency matches CLIF clock frequency (13.56 MHz). 1b Prescaler is enabled: the timer operates on the prescaler signal frequency (chosen by T0_PRESCALE_SEL). 1 T0_RELOAD_ENABLE R/W 0* If set to 0; the timer T0 stops on expiration. 0* After expiration the timer T0 stops counting; i.e.; remain zero; reset value. 1 After expiration the timer T0 reloads its preset value and continues counting down. 0 T0_ENABLE R/W 0* Enables the timer T0 Table 79. TIMER1_CONFIG register (address 000Fh) bit description Bit Symbol Access Value Description 20 T1_STOP_ON_RX_STARTED R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped when a data reception begins and the first 4 bits had been received. The additional delay of the timer is protocol-dependent and listed in the appendix. 19 T1_STOP_ON_TX_STARTED R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped when a data transmission begins. 18 T1_STOP_ON_RF_ON_EXT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped when the external RF field is detected. 17 T1_STOP_ON_RF_OFF_EXT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped when the external RF field vanishes. 16 T1_STOP_ON_RF_ON_INT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped when the internal RF field is turned on. 15 T1_STOP_ON_RF_OFF_INT R/W 0* T1_STOP_EVENT: If set; the timer T1 is stopped when the internal RF field is turned off. 14 T1_START_ON_RX_STARTED R/W 0* T1_START_EVENT: If set; the timer T1 is started when a data reception begins (first bit is received). 13 T1_START_ON_RX_ENDED R/W 0* T1_START_EVENT: If set; the timer T1 is started when a data reception ends. 12 T1_START_ON_TX_STARTED R/W 0* T1_START_EVENT: If set; the timer T1 is started when a data transmission begins. 11 T1_START_ON_TX_ENDED R/W 0* T1_START_EVENT: If set; the timer T1 is started when a data transmission ends. 10 T1_START_ON_RF_ON_EXT R/W 0* T1_START_EVENT: If set; the timer T1 is started when the external RF field is detected. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 88 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 79. TIMER1_CONFIG register (address 000Fh) bit description ...continued Bit Symbol Access Value Description 9 T1_START_ON_RF_OFF_EXT R/W 0* T1_START_EVENT: If set; the timer T1 is started when the external RF field is not detected any more. 8 T1_START_ON_RF_ON_INT R/W 0* T1_START_EVENT: If set; the timer T1 is started when an internal RF field is turned on. 7 T1_START_ON_RF_OFF_INT R/W 0* T1_START_EVENT: If set; the timer T1 is started when an internal RF field is turned off. 6 T1_START_NOW R/W 0* T1_START_EVENT: If set; the timer T1 is started immediately. 3:5 T1_PRESCALE_SEL R/W 000b* Controls frequency/period of the timer T1 when the prescaler is activated in T1_MODE_SEL: 000b 6.78 MHz counter 001b 3.39 MHz counter 010b 1.70 MHz counter 011b 848 kHz counter 100b 424 kHz counter 101b 212 kHz counter 110b 106 kHz counter 111b 53 kHz counter 2 T1_MODE_SEL R/W 0* Configuration of the timer T1 clock. 0b* Prescaler is disabled: the timer frequency matches CLIF clock frequency (13.56 MHz). 1b Prescaler is enabled: the timer operates on the prescaler signal frequency (chosen by T1_PRESCALE_SEL). 1 T1_RELOAD_ENABLE R/W 0* If set to 0; the timer T1 stops on expiration. 0* After expiration the timer T1 stops counting; i.e.; remain zero; reset value. 1 After expiration the timer T1 reloads its preset value and continues counting down. 0 T1_ENABLE R/W 0* Enables the timer T1 Table 80. TIMER2_CONFIG register (address 0010h) bit description Bit Symbol Access Value Description 20 T2_STOP_ON_RX_STARTED R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped when a data reception begins and the first 4 bits had been received. The additional delay of the timer is protocol-dependent and listed in the appendix. 19 T2_STOP_ON_TX_STARTED R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped when a data transmission begins. 18 T2_STOP_ON_RF_ON_EXT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped when the external RF field is detected. 17 T2_STOP_ON_RF_OFF_EXT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped when the external RF field vanishes. 16 T2_STOP_ON_RF_ON_INT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped when the internal RF field is turned on. 15 T2_STOP_ON_RF_OFF_INT R/W 0* T2_STOP_EVENT: If set; the timer T2 is stopped when the internal RF field is turned off. 14 T2_START_ON_RX_STARTED R/W 0* T2_START_EVENT: If set; the timer T2 is started when a data reception begins (first bit is received). PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 89 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 80. TIMER2_CONFIG register (address 0010h) bit description ...continued Bit Symbol Access Value Description 13 T2_START_ON_RX_ENDED R/W 0* T2_START_EVENT: If set; the timer T2 is started when a data reception ends. 12 T2_START_ON_TX_STARTED R/W 0* T2_START_EVENT: If set; the timer T2 is started when a data transmission begins. 11 T2_START_ON_TX_ENDED R/W 0* T2_START_EVENT: If set; the timer T2 is started when a data transmission ends. 10 T2_START_ON_RF_ON_EXT R/W 0* T2_START_EVENT: If set; the timer T2T2 is started when the external RF field is detected. 9 T2_START_ON_RF_OFF_EXT R/W 0* T2_START_EVENT: If set; the timer T2 is started when the external RF field is not detected any more. 8 T2_START_ON_RF_ON_INT R/W 0* T2_START_EVENT: If set; the timer T2 is started when an internal RF field is turned on. 7 T2_START_ON_RF_OFF_INT R/W 0* T2_START_EVENT: If set; the timer T2 is started when an internal RF field is turned off. 6 T2_START_NOW R/W 0* T2_START_EVENT: If set; the timer T2 is started immediately. 3:5 T2_PRESCALE_SEL R/W 000b* Controls frequency/period of the timer T2 when the prescaler is activated in T2_MODE_SEL: 000b 6.78 MHz counter 001b 3.39 MHz counter 010b 1.70 MHz counter 011b 848 kHz counter 100b 424 kHz counter 101b 212 kHz counter 110b 106 kHz counter 111b 53 kHz counter 2 T2_MODE_SEL R/W 0* Configuration of the timer T2 clock. 0b* Prescaler is disabled: the timer frequency matches CLIF clock frequency (13.56 MHz). 1b Prescaler is enabled: the timer operates on the prescaler signal frequency (chosen by T2_PRESCALE_SEL). 1 T2_RELOAD_ENABLE R/W 0* If set to 0; the timer T2 stops on expiration. 0* After expiration the timer T2 stops counting; i.e.; remain zero; reset value. 1 After expiration the timer T2 reloads its preset value and continues counting down. 0 T2_ENABLE R/W 0* Enables the timer T2 PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 90 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 81. RX_WAIT_CONFIG (address 0011h) bit description Bit Symbol Access Value Description 8:27 RX_WAIT_VALUE R/W 0* Defines the rx_wait timer reload value. Note: If set to 00000h, the rx_wait guard time is disabled 0:7 RX_WAIT_PRESCALER R/W 0* Defines the prescaler reload value for the rx_wait timer. For correct DPC operation, it is required to set the prescaler to 0x7F For type A communication, the prescaler has to be set to 0x7F as well. Table 82. CRC_RX_CONFIG (address 0012h) bit description Bit Symbol Access Value 31:16 RX_CRC_PRESET_VALUE R/W 0*-FFFFh Arbitrary preset value for the Rx-Encoder CRC calculation. 15:12 RFU R 0 Reserved 11 RX_PARITY_TYPE R/W 0* Defines which type of the parity-bit is used Note: This bit is set by the mod-detector if automatic mode detection is enabled and ISO14443A communication is detected. 0 Even parity calculation is used 1 Odd parity calculation is used 10 RX_PARITY_ENABLE R/W 0* If set to 1; a parity-bit for each byte is expected; will be extracted from data stream and checked for correctness. In case the parity-bit is incorrect; the RX_DATA_INTEGRITY_ERROR flag is set. Nevertheless the reception is continued. Note: This bit is set by the mod-detector if automatic mode detection is enabled and ISO14443A communication is detected. 9 VALUES_AFTER_COLLISION R/W 0* This bit defined the value of bits received after a collision occurred. 0* All received bits after a collision will be cleared. 1 All received bits after a collision keep their value. 8:6 RX_BIT_ALIGN R/W 0* RxAlign defines the bit position within the byte for the first bit received. Further received bits are stored at the following bit positions. PN5180 Product data sheet COMPANY PUBLIC Description All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 91 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 82. CRC_RX_CONFIG (address 0012h) bit description ...continued Bit Symbol Access Value Description 5:3 RX_CRC_PRESET_SEL R/W 000b* Preset values of the CRC register for the Rx-Decoder. For a CRC calculation using 5bits, only the LSByte is used. 000b* 0000h, reset value. This configuration is set by the Mode detector for FeliCa. 001b 6363h, this configuration is set by the Mode detector for ISO14443 type A. 010b A671h 011b FFFFh, this configuration is set by the Mode detector for ISO14443 type B. 100b 0012h 2 1 RX_CRC_TYPE RX_CRC_INV R/W R/W R/W 101b E012h 110b RFU 111b Use arbitrary preset value RX_CRC_PRESET_VALUE 0* Controls the type of CRC calculation for the Rx-Decoder 0 16-bit CRC calculation, reset value 1 5-bit CRC calculation 0* Controls the comparison of the CRC checksum for the Rx-Decoder 0* Not inverted CRC value. This bit is cleared by the Mode detector for ISO14443 type A and FeliCa. 1 Inverted CRC value: F0B8h, this bit is set by the Mode detector for ISO14443 type B. 0* If set; the Rx-Decoder checks the CRC for correctness. Note: This bit is set by the Mode Detector when ISO14443 type B or FeliCa (212 kbit/s or 424 kbit/s) is detected. 0 RX_CRC_ENABLE Table 83. RX_STATUS_REG register (address 0013h) bit description Bit Symbol Access Value Description 26:31 RFU R 0 Reserved 19:25 RX_COLL_POS R 0* These bits show the bit position of the first detected collision in a received frame (only data bits are interpreted). Note: These bits shall only be interpreted in passive communication mode at 106 kbit/s or ISO/IEC14443 A /MIFARE reader / writer mode if bit CollPosValid is set to 1. Note: If RX_ALIGN is set to a value different to 0, this value is included in the RX_COLL_POS. 18 RX_COLLISION_DETECTED PN5180 Product data sheet COMPANY PUBLIC R 0* This flag is set to 1, when a collision has occurred. The position of the first collision is shown in the register RX_COLLPOS All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 92 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 83. RX_STATUS_REG register (address 0013h) bit description ...continued Bit Symbol Access Value Description 17 RX_PROTOCOL_ERROR R 0* This flag is set to 1, when a protocol error has occurred. A protocol error can be a wrong stop bit, a missing or wrong ISO/IEC14443 B EOF or SOF or a wrong number of received data bytes. Note: When a protocol error is detected, data reception is stopped. Note: The flag is automatically cleared at start of next reception. 16 RX_DATA_INTEGRITY_ERROR R 0* This flag is set to 1, if a data integrity error has been detected. Possible caused can be a wrong parity or a wrong CRC. Note: On a data integrity error, the reception is continued Note: The flag is automatically cleared at start of next reception. Note: If a reversed parity bit is a stop criteria, the flag is not set to 1 if there is a wrong parity. 13:15 RX_NUM_LAST_BITS R 0* Defines the number of valid bits of the last data byte received in bit-oriented communications. If zero the whole byte is valid. 9:12 RX_NUM_FRAMES_RECEIVED R 0* Indicates the number of frames received. The value is updated when the RxIRQ is raised. Note: This bit field is only valid when the RxMultiple is active (bit RX_MULTIPLE_ENABLE set) 8:0 RX_NUM_BYTES_RECEIVED R 0* Table 84. TX_UNDERSHOOT_CONFIG register (address 0014h) bit description Bit Symbol 16:31 TX_UNDERSHOOT_PATTERN Undershoot pattern which is transmitted after each falling edge. 5:15 RESERVED - 1:4 TX_UNDERSHOOT_PATTERN_ LEN Defines length of the undershoot prevention pattern (value +1). The pattern is applied starting from the LSB of the defined pattern; all other bits are ignored. 0 TX_UNDERSHOOT_PROT_ENA BLE If set to 1; the undershoot protection is enabled Access Value Indicates the number of bytes received. The value is valid when the RxIRQ is raised until the receiver is enabled again. Description Table 85. TX_OVERSHOOT_CONFIG register (address 0015h) bit description Bit Symbol Access Value Description 31:16 TX_OVERSHOOT_PATTERN R/W 0* FFFFh Overshoot pattern which is transmitted after each rising edge. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 93 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 85. TX_OVERSHOOT_CONFIG register (address 0015h) bit description ...continued Bit Symbol Access Value Description 15:5 RFU R 0 Reserved 4:1 TX_OVERSHOOT_PATTERN _LEN R/W 0*-Fh Defines length of the overshoot prevention pattern (value +1). The pattern is applied starting from the MSB of the defined pattern, all other bits are ignored. 0 TX_OVERSHOOT_PROT _ENABLE R/W 0*, 1 If set to 1, the overshoot protection is enabled. Table 86. TX_DATA_MOD register (address 0016h) bit description Bit Symbol Access Value Description 8:15 TX_DATA_MOD_WIDTH R/W 0*-FFh Specifies the length of a pulse for sending data with miller pulse modulation enabled. The length is given by the number of carrier clocks + 1. 0:7 TX_BITPHASE R/W 0* - FFh Defines the number of 13.56 MHz cycles used for adjustment of TX_WAIT to meet the FDT. This is done by using this value as first counter initialization value instead of TX_WAIT_PRESCALER. These bits of TX_BITPHASE, together with TX_WAIT_VALUE and TX_WAIT_PRESCALER are defining the number of carrier frequency clocks which are added to the waiting period before transmitting data in all communication modes. TX_BITPHASE is used to adjust the TX bit synchronization during passive NFCIP-1 communication mode at 106 kbit and in ISO/IEC 14443A and 14443A/MIFARE card mode. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 94 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 87. TX_WAIT_CONFIG register (address 0017h) bit description Bit Symbol Access Value Description 27:8 TX_WAIT_VALUE D 0* FFFFFh Defines the tx_wait timer value. The values TX_WAIT_VALUE and TX_WAIT_PRESCALER are the initial counter values of two independent counters. The counter linked to TX_WAIT_PRESCALER is decremented at every 13.56 MHz clock. As soon as the counter TX_WAIT_PRESCALER overflows (transition from 00h to FFh), the counter linked to TX_WAIT is decremented. At the same time, the counter linked to TX_WAIT_PRESCALER is reloaded with the TX_WAIT_PRESCALER value. The first initial TX_WAIT_PRESCALER counter value is always using the data defined in TX_BITPHASE (in case of PICC operation). All other subsequent counter reload values are taken from TX_WAIT_PRESCALER. Note: If set to 00000h the tx_wait guard time is disabled Note: This bit is set by HW a protocol is detected in automatic mode detector. 7:0 TX_WAIT_PRESCALER D 0* - FFh Defines the prescaler reload value for the tx_wait timer. Note: This bit is set by HW a protocol is detected in automatic mode detector. For correct DPC operation, it is required to set the prescaler to 0x7F For type A communication, the prescaler has to be set to 0x7F as well. Table 88. TX_CONFIG register (address 0018h) bit description Bit Symbol Access Value Description 14:31 RFU R 0 Reserved 13 TX_PARITY_LAST_INV_ENABL E R/W 0 If set to 1; the parity bit of last sent data byte is inverted 12 TX_PARITY_TYPE R/W 0 Defines the type of the parity bit 0 Even Parity is calculated 1 Odd parity is calculated 11 TX_PARITY_ENABLE R/W 0 If set to 1; a parity bit is calculated and appended to each byte transmitted. If the Transmission Of Data Is Enabled and TX_NUM_BYTES_2_SEND is zero; then a NO_DATA_ERROR occurs. 10 TX_DATA_ENABLE R/W 0 If set to 1; transmission of data is enabled otherwise only symbols are transmitted. 8:9 TX_STOP_SYMBOL R/W 0 Defines which pattern symbol is sent as frame stop-symbol 00b No symbol is sent 01b Symbol1 is sent 10b Symbol2 is sent 11b Symbol3 is sent PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 95 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 88. TX_CONFIG register (address 0018h) bit description ...continued Bit Symbol Access Value Description 6:7 TX_START_SYMBOL R/W 0 Defines which symbol pattern is sent as frame start-symbol 00b No symbol pattern is sent 01b Symbol0 is sent 10b Symbol1 is sent 11b Symbol2 is sent. 3:5 TX_LAST_BITS R/W 0 Defines how many bits of the last data byte to be sent. If set to 000b all bits of the last data byte are sent. Note: Bits are skipped at the end of the byte 0:2 TX_FIRST_BITS R/W 0 Defines how many bits of the first data byte to be sent. If set to 000b all bits of the last data byte are sent. Note: Bits are skipped at the beginning of the byte Table 89. CRC_TX_CONFIG_REG (address 0019h) bit description Bit Symbol Access Value 31:16 TX_CRC_PRESET_VALUE R/W 0*-FFFFh Arbitrary preset value for the Tx-Encoder CRC calculation. 15:7 RFU R 0 Reserved 6 TX_CRC_BYTE2_ENABLE R/W 0 If set; the CRC is calculated from the second byte onwards (intended for HID). This option is used in the Tx-Encoder. 5:3 TX_CRC_PRESET_SEL R/W 000-101b Preset values of the CRC register for the Tx-Encoder. For a CRC calculation using 5 bits, only the LSByte is used. 2 1 0 TX_CRC_TYPE TX_CRC_INV TX_CRC_ENABLE PN5180 Product data sheet COMPANY PUBLIC R/W R/W R/W Description 000b* 0000h, reset value 001b 6363h 010b A671h 011b FFFFh 100b 0012h 101b E012h 110b RFU 111b Use arbitrary preset value TX_CRC_PRESET_VALUE 0, 1 Controls the type of CRC calculation for the Tx-Encoder 0* 16-bit CRC calculation, reset value 1 5-bit CRC calculation 0, 1 Controls the sending of an inverted CRC value by the Tx-Encoder 0* Not inverted CRC checksum, reset value 1 Inverted CRC checksum 0*, 1 If set to one, the Tx-Encoder computes and transmits a CRC. All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 96 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 90. SIGPRO_CONFIG register (address 001Ah) bit description Bit Symbol Access Value Description 3:31 RFU R 0 Reserved 2:0 BAUDRATE D 000*-111 Defines the baud rate of the receiving signal. The MSB is only relevant for reader mode. Note: These bits are set by the mode-detector if automatic mode detector is enabled and the communication mode is detected. 000* Reserved 001 Reserved 010 Reserved 011 Reserved 100 106 kBd This configuration is set by the Mode detector for ISO/IEC14443 type A and B. 101 212 kBd This configuration is set by the Mode detector for FeliCa 212 kBd. 110 424 kBd This configuration is set by the Mode detector for FeliCa 424 kBd. 111 848 kBd Table 91. SIGPRO_CM_CONFIG_REG register (address 001Bh) bit description Bit Symbol Access Value Description 31 RFU R 0 Reserved 29:30 RX_FRAMING Defines the framing in card mode. These bits are set by the Mode detector if automatic mode detection is enabled and the communication mode is detected. 00b: ISO14443-A / MIFARE 01b: ISO18092 (NFC - with Sync-byte 0xF0) 10b: FeliCa 11 ISO14443B 26:28 EDGE_DETECT_TAP_SEL Selects the number of taps of the edge-detector filter. 000b: Edge detector filter with 4 taps 001b: Edge detector filter with 6 taps 010b: Edge detector filter with 8 taps 011b: Edge detector filter with 8 taps 100b: Edge detector filter with 16 taps 101b: Edge detector filter with 18 taps 110b: Edge detector filter with 24 taps 111b: Edge detector filter with 32 taps 13:25 EDGE_DETECT_TH Threshold for the edge decision block of the ADCBCM. 0:12 BIT_DETECT_TH Threshold for the "bit" decision block of the ADCBCM. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 97 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 92. SIGPRO_RM_CONFIG_REG register (address 001Ch) bit description Bit Symbol Access Value Description 24:31 RFU R 0 Reserved 21:23 BPSK_IQ_MODE R/W 000*-111 Defines signal processing of I- and Q-channel 000* Both channels (I and Q) are used for signal processing 001 Use only I channel 010 Use only Q channel 011 RFU 100 Use the strongest channel 101 Use the first channel 110-111 RFU 20 BPSK_FILT6 R/W 0*-1 Reserved for test 19 RESYNC_EQ_ON R/W 0-1* Resynchronization during the SOF for an equal correlation value is done (default = activated). 18 CORR_RESET_ON R/W 0 The correlator is reset at a reset (default = activated). 17 VALID_FILT_OFF R/W 0*-1 Disables a special filter in BPSK mode. If set to 0, the correlation of 0110 is filtered with the correlation of 1110 and 0111. Otherwise the demodulation is done using the correlation with 0110 16 DATA_BEFORE_MIN R/W 0 Data is received even before the first minimum at the SOF (default: = deactivated). 15:12 MIN_LEVEL R/W 0*-Fh Defines the minimum level (threshold value) for the subcarrier detector unit. Note: The MinLevel should be higher than the noise level in the system Note: Used for BPSK and Manchester with Subcarrier communication types as MinLevel! 11:8 MIN_LEVEL_P R/W 0*-Fh Defines the minimum level (threshold value) for the phase-shift detector unit. Used for BPSK communication 7 USE_SMALL_EVAL R 0 Defines the length of the evaluation period for the correlator for Manchester subcarrier communication types. 6:5 COLL_LEVEL R/W 00*-11 Defines how strong a signal must be interpreted as a collision for Manchester subcarrier communication types. 4 PRE_FILTER R/W 3 RECT_FILTER R/W PN5180 Product data sheet COMPANY PUBLIC 00* >12.5 % 01 >25 % 10 >50 % 11 No Collision If set to 1 four samples are combined to one data. (average) 0 If set to one; the ADC-values are changed to a more rectangular waveshape. All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 98 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 92. SIGPRO_RM_CONFIG_REG register (address 001Ch) bit description ...continued Bit Symbol Access Value Description 2 SYNC_HIGH R/W 0*-1 Defines if the bit grid is fixed at maximum (1) or at a minimum(0) value of the correlation. 1 FSK R 0 If set to 1; the demodulation scheme is FSK. 0 BPSK R/W 0* If set to 1, the demodulation scheme is BPSK. Table 93. RF_STATUS register (address 001Dh) bit description Bit Symbol Access Value Description 27:31 RFU R 0 - 26:24 TRANSCEIVE_STATE R 0* Holds the command bits 0* IDLE state 1 WaitTransmit state 2 Transmitting state 3 WaitReceive state 4 WaitForData state 5 Receiving state 6 LoopBack state 7 reserved 23:20 DPC_CURRENT_GEAR R 0* Current Gear of the DPC 19 DPLL_ENABLE R 0* This bit indicates that the DPLL Controller has enabled the DPLL (RF on, RF frequency ok, PLL locked) 18 CRC_OK R 0 This bit indicates the status of the actual CRC calculation. If 1 the CRC is correct; meaning the CRC register has the value 0 or the residue value if inverted CRC is used. Note: This flag should only be evaluated at the end of a communication. 17 TX_RF_STATUS R 0 If set to 1 this bit indicates that the drivers are turned on; meaning an RF-Field is created by the device itself. 16 RF_DET_STATUS R 0 If set to 1 this bit indicates that an external RF-Field is detected by the RF-level detectors (after digital filtering) 13:15 RF_ACTIVE_ERROR_CAUSE R 0-5 This status flag indicates the cause of an NFC-Active error. Note: These bits are only valid when the RF_ACTIVE_ERROR_IRQ is raised and is cleared as soon as the bit TX_RF_ENABLE is set to 1. 0* No Error; reset value 1 External field was detected on within TIDT timing 2 External field was detected on within TADT timing 3 No external field was detected within TADT timings 4 Peer did switch off RF-Field but no Rx event was raised (no data received) 5-7 Reserved 12 RX_ENABLE This bit indicates if the RxDecoder is enabled. If 1 the RxDecoder was enabled by the Transceive Unit and is now ready for data reception 11 TX_ACTIVE This bit indicates activity of the TxEncoder. If 1 a transmission is ongoing, otherwise the TxEncoder is in idle state. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 99 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 93. RF_STATUS register (address 001Dh) bit description ...continued Bit Symbol 10 RX_ACTIVE 9:0 AGC_VALUE Access Value Description This bit indicates activity of the RxDecoder. If 1 a data reception is ongoing; otherwise the RxDecoder is in idle state. R 0*-3FFh Current value of the AGC 0h* Most sensitive: largest Rx-resistor, i.e., none of the switchable resistors are added in parallel 3FFh Most robust: smallest Rx-resistor, i.e., all switchable resistors are added in parallel Table 94. AGC_CONFIG register (address 001Eh) bit description Bit Symbol Access Value Description 16:31 RFU R 0* Reserved 14:15 AGC_VREF_SEL R/W 0* Select the set value for the AGC control:_ 00b: 1.15 V 01b: 1.40 V 10b: 1.50 V 11b: RFU 4:13 AGC_TIME_CONSTANT R/W 0* Time constant for the AGC update. An AGC period is given by (AGC_TIME_CONSTANT+1) * 13.56 MHz. The minimum allowed value for the AGC_TIME_CONSTANT is 4. 3 AGC_INPUT_SEL R/W 0* Selects the AGC value to be loaded into the AGC and the data source for fix-mode operation: 0b: AGC_VALUE_REG.AGC_CM_VALUE 1b: AGC_VALUE_REG.AGC.RM_VALUE 2 AGC_LOAD W 0* If set; the RX divider setting is loaded from AGC_VALUE_REG. AGC_INPUT_SEL defines the source of the data. This bit is automatically cleared. 1 AGC_MODE_SEL R/W 0* Selects the fix AGC value: 0b: Rx-divider is set according to AGC_VALUE_REG dependent on bit AGC_INPUT_SEL 1b: The last RX divider setting before AGC control operation had been deactivated is used (AGC_ENABLE_CONTROL=0, last RX divider setting is frozen). This bit is not causing any loading of new Rx-divider data. Set the bit AGC_LOAD for updating the RX divider with a new value. 0 AGC_ENABLE_CONTROL R/W 0* 0b: Fix mode operation. The RX divider is fixed to one value. The value is defined by AGC_MODE_SEL 1b: AGC control operation enabled PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 100 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 95. AGC_VALUE_REG register (address 001Fh) bit description Bit Symbol Access Value Description 20:31 RFU R 0 Reserved 10:19 AGC_RM_VALUE R/W 0 Static AGC value used for reader mode 0:9 AGC_CM_VALUE R/W 0 Static AGC value used for card mode Table 96. RF_CONTROL_TX register (address 0020h) bit description Bit Symbol Access Value Description 27:31 RFU R 0 Reserved 26 TX_ALM_TYPE_SELECT R/W 0* 0 ... Both drivers used for ALM 1 ... Single driver used for ALM 24:25 TX_CW_AMPLITUDE_ALM_CM R/W 0* set amplitude of unmodulated carrier at card mode 19:23 TX_RESIDUAL_CARRIER_OV_ PREV R/W 0* Defines the value for the residual carrier for the period the overshoot prevention pattern is active. 18 TX_CW_TO_MAX_ALM_CM R/W 0* TX HI output is the maximum voltage obtainable from charge pump (CM setting); if set to 1 -> TX_CW_AMPLITUDE_CM is overruled. 13:17 TX_RESIDUAL_CARRIER R/W 0* set residual carrier (0=100 %, 1F = 0 %) 12 TX_BYPASS_SC_SHAPING R/W 0* Bypasses switched capacitor TX shaping of the Transmitter Signal and disables the shaping control for the rising edge. So this bit must be 0, if the TAU_MOD_RISING settings shall apply. The rising edge provides the fastest rise time, if TX_SET_BYPASS_SC_SHAPING = 1 (TAU_MOD_RISING does not matter). 8:11 TX_SLEW_SHUNTREG R/W 0* Set slew rate for shunt regulator. Set slew rate for Tx Shaping shunt regulator (0= slowest slew rate, 0xF = fastest slew rate) for both the falling and rising edge. 4:7 TX_TAU_MOD_FALLING R/W 0* Transmitter TAU setting for falling edge of modulation shape. In AnalogControl module, the output signal is switched with the tx_envelope. Only valid is TX_SINGLE_CP_MODE is set 0:3 TX_TAU_MOD_RISING R/W 0* Transmitter TAU setting for rising edge of modulation shape. In Analog Control module, the output signal is switched with the tx_envelope. Only valid is TX_SINGLE_CP_MODE is set Table 97. RF_CONTROL_TX_CLK register (address 0021h) bit description Bit Symbol Access Value Description 19:31 RFU R 0* Reserved 18 TX_ALM_ENABLE R/W 0* If set to 1 ALM is used for transmission in card mode 14:17 RFU R 11:13 CLOCK_CONFIG_DLL_ALM R/W 0* Configures the phase difference in integer multiples of 45 steps between the recovered and the transmitted RF clock 8:10 TX_CLK_MODE_OVUN_PREV R/W 0* Defines the TX clockmode for the period the overshoot/undershoot prevention is active PN5180 Product data sheet COMPANY PUBLIC RFU All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 101 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 97. RF_CONTROL_TX_CLK register (address 0021h) bit description ...continued Bit Symbol Access Value Description 7 TX2_INV_RM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0 -> clk_13m56 is used 6 TX2_INV_CM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0 -> clk_13m56 is used 5 TX1_INV_RM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0 -> clk_13m56 is used 4 TX1_INV_CM R/W 0* If 1 -> TX output is inverted (clk_13m56_n is used); 0 -> clk_13m56 is used 3:1 TX_CLK_MODE_RM R/W 0* TX clockmode 0 CLOCK_ENABLE_DPLL R/W 0* Enables the DPLL Table 98. RF_CONTROL_RX register (address 0022h) bit description Bit Symbol Access Value Description 8:31 RFU R 0* Reserved 6:7 CM_MILLER_SENS R/W Configuration bits for reference level of Miller demodulator 4:5 RX_ MIXER_CONTROL R/W Mixer Control Enable 00, 11 ... power down both mixer 01... reader mode mixer 10... card mode mixer, 2:3 RX_HPCF R/W High Pass Corner Frequency: 00->45 kHz, 01-> 85 kHz, 10->150 kHz, 11->250 kHz 1:0 RX_GAIN R/W 0h*-3h Gain Adjustment BBA: 00->33 dB, 01->40 dB, 10-> 50 dB, 11->57 dB Table 99. RF_LEVEL_DETECTOR_CONTROL register (address 0023h) bit description Bit Symbol Access Value Description 15:31 RFU R 0* Reserved 14 CM_PD_NFC_DET R/W 0* Power Down NFC level detector 12:13 RFDET_SOURCE_SEL R/W 0* Selects the source for RF-Field detection; 0* -> NFC-Level detector indication signal is used; 1 -> RF-Level detector indication signal is used 2; -> NFCand RF-Level detector indication signal is used 3; -> Override - RF-Field detected is emulated 8:11 CM_RFL_NFC R/W 0* Programming of detection level 4:7 RFLD_REF_LO R/W 0* Higher Reference Value for RF Level Detector 0:3 RFLD_REF_HI R/W 0* Lower Reference Value for RF Level Detector Table 100. SYSTEM_STATUS register (address 0024h) bit description Bit Symbol Access Value Description 9:31 RFU R 0 Reserved 8 PARAMETER_ERROR R 0* Parameter Error on Host Communication 7 SYNTAX_ERROR R 0* Syntax Error on Host Communication 6 SEMANTIC_ERROR R 0* Semantic Error on Host Communication 5 STBY_PREVENT_RFLD R 0* Entry of STBY mode prevented due to existing RFLD PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 102 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 100. SYSTEM_STATUS register (address 0024h) bit description ...continued Bit Symbol Access Value Description 4 BOOT_TEMP R 0* Boot Reason Temp Sensor 3 BOOT_SOFT_RESET R 0* Boot Reason due to SOFT RESET 2 BOOT_WUC R 0* Boot Reason wake-up Counter 1 BOOT_RFLD R 0* Boot Reason RF Level Detector 0 BOOT_POR R 0* Boot Reason Power on Reset / RESET_N Table 101. TEMP_CONTROL register (address 0025h) bit description Bit Symbol Access Value Description 4:31 RFU R 0 Reserved 3 TEMP_ENABLE_HYST R/W 0* Enable hystereses of Temperature Sensor 2 TEMP_ENABLE R/W 0* Enable Temp Sensor 0:1 TEMP_DELTA R/W 0* selects temperature value Table 102. CHECK_CARD_RESULT register (address 0026h) bit description Bit Symbol Access Value Description 14:31 RFU R 0 RFU 10:13 AGC_GEAR R/W 0 0:9 AGC_VALUE R/W 0 Reading from this register starts a check card routine which is an LPCD with only one measurement point without entry to standby mode. The value contains the actual gear when DPC is used and the AGC value. Writing to this register is used as a reference value for the LPCD when LPCD mode 2 is used. Table 103. DPC_CONFIG register (address 0027h) bit description Bit Symbol Access RFU R 0 16:19 TX_GSN_CW_CM R/W 0 GSN value for continuous wave in Card Mode 12:15 TX_GSN_MOD_CM R/W 0 GSN value for modulation in Card Mode 8:11 TX_GSN_MOD_RM R/W 0 GSN value for modulation in Reader Mode 4:7 TX_GSN_CW_RM R/W 0 GSN value for continuous wave in Reader Mode 3 TX_CW_TO_MAX_RM R/W 0 Maximum output voltage on TX driver 1:2 TX_CW_AMPLITUDE_RM R/W 0 set amplitude of unmodulated carrier at reader mode 0 TX_CW_AMP_REF2TVDD RW 0 If set to 1 the reference of the unmodulated carrier is defined relative to TVDD 20:31 PN5180 Product data sheet COMPANY PUBLIC Value Description All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 103 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 104. EMD_CONTROL register (address 0028h) bit description Bit Symbol Access Value Description Recommended value for EMVCo 2.3.1 0x185 (use Timer1) Recommended value for EMVCo 2.5 0x187 10:31 RFU 8:9 7 0 Reserved EMD_TRANSMISSION_TIMER_ R/W USED 0 Timer used for RF communication. 00 Timer0, 01 Timer1, 10 Timer 2, 11 RFU up to firmware version 2.4 EMD_MISSING_CRC_IS_PROT OCOL_ERROR_TYPE_B R/W 0 Missing CRC treated as protocol error in case of Type B based communication. Only applicable for EMVCo 2.3.1. from firmware 2.5 onwards R/W 0 RFU up to firmware version 2.4 EMD_MISSING_CRC_IS_PROT OCOL_ERROR_TYPE_A R/W 0 Missing CRC treated as protocol error in case of Type A based communication. Only applicable for EMVCo 2.3.1. from firmware 2.5 onwards R/W 0 RFU 2:5 EMD_NOISE_BYTES_THRESH OLD R/W 0 Defines the threshold under which transmission errors are treated as noise. Note: CRC bytes are NOT included/counted! 1 EMD_TRANSMISSION_ERROR _ABOVE_NOISE_THRESHOLD _IS_NO_EMD R/W 0 Transmission errors with received byte length >= EMD_NOISE_BYTES_THRESHOLD is never treated as EMD (EMVCo 2.5 standard). All transmission with number of received bytes < 4 bytes are treated as EMD noise, (ignored). 0 EMD_ENABLE R/W 0 Enable EMD handling 6 R For transmission errors >= 4 bytes the host is notified. Table 105. ANT_CONTROL register (address 0029h) bit description Bit Symbol Access Value Description 8:31 RFU R 0 Reserved 7 ANT_INVERT_ON_TXACTIVE R/W 0 If set to 1, the ANT short interface in card mode is inverted when tx_active is asserted (i.e. while transmission). Note: this bit is only valid in card mode. Note: if it ANT_ALM_AUTO_SWITCH_ENABLE is set this setting is ignored 6 ANT_ALM_AUTO_SWITCH_EN ABLE R/W 0 If set to 1, the ANT setting for ALM is switched automatically by HW. By default for ALM the ANT_short and ANT_mod uses the same settings as for PLM. 5 ANT_ALM_FW_RESET R/W 0 If set to 1 the ANT setting for ALM is reset to its initial receive configuration PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 104 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 105. ANT_CONTROL register (address 0029h) bit description ...continued Bit Symbol Access Value Description 4 ANT_SHORT_SELECT_RM R/W 0 Selects the control of the ANT modulation interface in reader mode 2:3 ANT_SHORT_SELECT R/W 0 Selects the control of the ANT short interface in cardmode for PLM; in reader mode and ALM the analog control signals are switched by digital logic. 00b Constant 0 (ANT open) 01b Constant 1 (ANT short) 10b TxEnvelope used (idle = 1, modulation = 0) 11b Inverted TxEnvelope used (idle = 0, modulation = 1) 0:1 ANT_MOD_SELECT R/W 0 Selects the control of the ANT modulation interface in cardmode for PLM; in reader mode and ALM the analog control signals are switched by digital logic. 00b Constant 0 (No modulation on ANT mod) 01b Constant 1 (modulation on ANT mod) 10b TxEnvelope used (idle = 1, modulation = 0) 11b Inverted TxEnvelope used (idle = 0, modulation = 1) 12. Secure Firmware Update 12.1 General functionality The PN5180 supports a secure update of the implemented firmware. The secure firmware download mode is using a dedicated command set and framing which is different from the standard host interface commands used for NFC operation of the device. In Secure Firmware update mode, the PN5180 requires a dedicated physical handling of the SPI interface lines and the BUSY line. The secure firmware download mode is entered by setting the DWL_REQ pin to high during startup of the device. This pin can be used for any other functionality after startup, the level of this pin has no impact on the download functionality after startup during standard NFC operation. The firmware binary file which is used to update the PN5180 is protected with a signature. This prevents a download of any other software which is not signed by NXP. An anti-tearing function is implemented in order to detect supply voltage removal or memory fault. During the secure firmware download, the normal mode NFC operation is not available and only the command set defined for the secure firmware download is valid. In case of any failure or exception during the download, the PN5180 remains in the secure firmware download mode until a full firmware update sequence has been performed successfully. Updating the firmware of the PN5180 programs the memories for user EEPROM and RF configuration with default values. Any previous user configuration will be overwritten. The user has to take care to restore the data of these memories after a secure firmware update. The PN5180 can be used for firmware update as follows: PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 105 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 1. Set DWL_REQ pin to high 2. Reset 3. The PN1580 boots in download mode 4. Download new firmware version 5. Execute the check integrity command to verify the successful update (The CheckIntegrity command cannot be called while a download session is open) 6. Reset the PN5180 7. The device starts in NFC operation mode 12.2 Physical Host Interface during Secure Firmware Download In Secure Firmware update mode, the PN5180 is using a different physical host interface signaling than in NFC operation mode. The BUSY line is used in a different way than for NFC operation mode, and the data is packed in frames protected by a CRC16 checksum. nss 0x7f mosi header opcode payload crc16 miso BUSY aaa-024800 Fig 40. Example SPI WRITE in Secure Firmware Download mode nss mosi miso 0xff 0xff header stat payload crc16 BUSY aaa-024799 Fig 41. Example SPI READ in Secure Firmware Download mode A complete frame transmitted in Secure Firmware Update mode consists of For the WRITE: 1. 1 byte direction (0x7F) 2. 2 byte header (chunk bit + length of (Payload + command)) 3. 1 byte command 4. (LENGTH-1) byte payload (the LENGTH in the header includes the 1byte command, therefore the length of the payload needs to be reduced by 1) 5. 2 byte CRC16 (is not included in the header length number) PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 106 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend NSS SCK MOSI Transfer Direction HDLL Header Det. = 0XXXXXXXb Byte 0 HDLL Header HDLL OpCode Byte 1 HDLL Payld Byte 0 HDLL Payld Byte n HDLL CRC2 HDLL CRC1 0xFF 0xFF 0xFF 0xFF MISO 0xFF 0xFF 0xFF 0xFF BUSY aaa-024811 Fig 42. Secure Firmware Download: SPI Write For the READ: 1. 1 byte direction (0xFF) 2. 2 byte header (chunk bit + length of (Payload + status)) 3. 1 byte status 4. (LENGTH-1) byte payload (the LENGTH in the header includes the 1byte status, therefore the length of the payload needs to be reduced by 1) 5. 2 byte CRC16 (is not included in the header length number) NSS SCK MOSI dummy Transfer Direction Det. = 0xFF dummy dummy dummy dummy dummy dummy HDLL Payld Byte 0 HDLL Payld Byte n HDLL CRC2 HDLL CRC1 MISO 0xFF HDLL Header Byte 0 HDLL Header HDLL OpCode Byte 1 BUSY All data has been read, IRQ is reset PN5180 requests a transfer aaa-024814 Fig 43. Secure Firmware Download: SPI Read 12.3 Download Protection Data of the PN5180 like firmware version numbers, are protected against any tearing attempt. The PN5180 uses a chained hash approach having the first command hash protected with an RSA signature. The chained hash sequence binds each frame with the next one comparable to an S/KEY mechanism. Hence authenticity of the downloaded code can be PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 107 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend ensured due to secrecy of the RSA private key. Any firmware which is not issued and signed by NXP, is rejected by the security system of the PN5180 and cannot be loaded into the memory of the device. The security system of the PN5180 assures that no firmware data can be overwritten without verifying the authenticity and integrity of the new data beforehand. During the secure firmware download, a new firmware version number is sent. The firmware version number is composed of a major and a minor number: 1. Major number: 8 bit (MSB) 2. Minor number: 8 bit (LSB) The PN5180 checks if the new major version number is equal or higher than the current one. In case the current major version number is larger than the already installed version number of the firmware, the secure firmware update is rejected. Downgrading major firmware versions is therefore not possible. An integrity check command is available which can be executed by the host immediately after a firmware update to check if the update had been successful. The major and minor firmware version numbers can be read out at any time using the host interface and commands in NFC mode to identify exactly which firmware is installed on a dedicated hardware. It is not required to enter the secure firmware download mode to retrieve this firmware version information. An already started firmware download may be interrupted for any of the following reasons: * Reset (hard or soft) * Failure of the Signature verification of the first secure write command * Hash chain is broken during the download between two consecutive secure write commands * Protocol error in framing * Address mismatch * critical memory failure The PN5180 provides comprehensive mechanisms to recover from all these conditions. 12.4 Commands 12.4.1 Frame format All messages transmitted between the host and the PN5180 have always the following frame format: Header - Frame - CRC PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 108 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Header Frame End RFU Chunk Length OpCode Payload CRC16 15-11 bit 10 bit 9-0 bit First byte n bytes 15-0 bit aaa-024736 Fig 44. Framing for Secure Firmware Download Header (2 bytes) * RFU (bit 11..15) * Chunk flag used for fragmentation (bit 10) * length of the frame (bit 0..9 bit) Frame ( (n+1) byte) * Command (1 byte) * Payload of the command: (n-byte) CRC (2 bytes) * The CRC16 is compliant to X.25 (CRC-CCITT, ISO/IEC13239) standard with polynomial x^16 + x^12 + x^5 +1 and preload value 0xFFFF. The payload of one command consists of * Memory block address: 3 bytes Memory block size: 2 bytes * Memory data block: 512 bytes maximum * Hash of the next frame: 32 bytes The first write command used for a secure firmware download includes the version number, and a hash value over the following command and the RSA signature. Every following command includes the actual data block to be updated and the hash value over the following command and data. The last command does not contain any hash value. The Payload including command can be split into chunks which allows the transfer of large payloads. DL command Host side 6 bits 10 bits 1 byte n bytes 2 bytes 000000b Length OpCode Payload CRC16 Encapsulated transport 000001b Length Chunk 1 CRC16 000001b Length Chunk 2 CRC16 000000b Length Chunk 3 CRC16 aaa-024735 Fig 45. Splitting commands by chunks PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 109 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 12.4.2 Command Code Overview The following commands are supported in Secure Firmware Download Mode Table 106. Secure Firmware Download Commands Command Command code (hex) Description RESET F0 This command resets the IC GET_VERSION F1 This command provides the IC version and firmware version SECURE_WRITE C0 Writes chunks of data to the IC GET_DIE_ID F4 The command returns the die Identifier - all other RFU The Firmware Download Mode uses of the data structure Frame Header 5-bit RFU 1 -bit 10-bit L Ch M S Packet Length (L) S unk B B Byte 1 Byte 0 MSB End 8-bit (L-1) Bytes 16-bit Op Code Payload CRC16 Byte 2 Byte 3 ... Byte [1+L] Byte [2+L] Byte [3+L] LSB aaa-024807 Fig 46. Secure Firmware Download data structure 12.4.3 Command Code Response A response message is always a multiple of 4 bytes. The first byte of the response is used to indicate the status of the last executed command. Table 107. Secure Firmware Command Status Return Codes Command Command code (hex) Description OK 00 command processed properly ERROR 01-FF any response different from 0x00 indicates an error 12.4.4 Command Code Description 12.4.4.1 RESET Command code: 0xF0 Frame format exchange: Host -> PN5180 [0x00 0x04 0xF0 0x00 0x00 0x00 0x18 0x5B] Host <- PN5180 [0x00 0x04 STAT 0x00 0x00 0x00 CRC16] The reset prevents the PN5180 from sending the OK return code. Only error codes are sent. STAT is the status return code. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 110 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 12.4.4.2 GET_VERSION Command code: 0xF1 Frame format exchange: Host -> PN5180 [0x00 0x04 0xF1 0x00 0x00 0x00 0x6E 0xEF] Host <- PN5180 [0x00 0x0A STAT MD FM1V FM2V CRC16] The payload of the GetVersion command response is: Table 108. Secure Firmware update: GetVersion command response 12.4.4.3 Field size (Byte) Description STAT 1 Status return code MD 6 Manufacturer Data FM1V 1 Firmware major version FM2V 1 Firmware minor version SECURE_WRITE Command code: 0xC0 The secure write function differs between first, middle and last write frames. To ease the usage of the download, the Firmware binaries provided by NXP are already prepared in such a way that only the CRC16 needs to be added. All other data can be packed in the Frames without further need of e.g. HASH calculations. The provided binaries include the command code as well. The first 3 bytes of each data block to be transferred contain always the 2-byte length information and the one-byte command code 0xC0 Host -> PN5180 [Data CRC16] Host <- PN5180 [0x00 0x04 STAT 0x00 0x00 0x00 CRC16] Table 109. Secure Firmware update: First Secure Write Command response 12.4.4.4 Field size (Byte) Description STAT 1 Status return code GET_DIE_ID Command code: 0xF4 This command returns the die Identifier (Unique chip serial number): Host -> PN5180 [0x00 0x04 0xF4 0x00 0x00 0x00 0xD2 0xAA] Host <- PN5180 [0x00 0x14 STAT 0x00 0x00 0x00 ID0 ID2 ID3 ID4 ID5 ID6 ID7 ID8 ID9 ID10 ID11 ID12 ID13 ID14 ID15 ID16 CRC16] PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 111 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 12.4.5 Error handling If the last firmware download was not completed without error, the PN5180 responds to all commands with an answer 0x2A. No additional parameters are transmitted. In this error case, a new firmware download is required. 13. Limiting values Stress above one or more of the limiting values may cause permanent damage to the device. Table 110. Limiting Values In accordance with the Absolute Maximum Rating System (IEC 60134). Symbol Parameter Conditions Min Max Unit VDD(PVDD) supply voltage on pin PVDD - - 3.6 V VDD(TVDD) supply voltage on pin TVDD - - 5.5 V VESD electrostatic discharge voltage Human Body Model (HBM); 1500 , 100 pF; JESD22-A114-B 1500 V Tstg storage temperature no supply voltage applied 55 +150 C Ptot total power dissipation in still air with exposed pins soldered on a 4 layer JEDEC PCB - 1125 mW Tj junction temperature - - 150 C 14. Recommended operating conditions Exposure of the device to other conditions than specified in the Recommended Operating Conditions section for extended periods may affect device reliability. Electrical parameters (minimum, typical and maximum) of the device are guaranteed only when it is used within the recommended operating conditions. Table 111. Recommended Operating Conditions PN5180 Product data sheet COMPANY PUBLIC Symbol Parameter Conditions Min Typ Max Unit VDD(VBAT) supply voltage on pin VBAT VDD(VBAT) <=VDD(PVDD) 2.7 3.3 5.5 VDD(PVDD) supply voltage on pin PVDD 1.8 V supply 1.65 1.8 1.95 V 3.3 V supply 2.7 3.3 3.6 V VDD(TVDD) supply voltage on pin TVDD - 2.7 5.0 5.5 V IDD(TVDD) supply current on pin TVDD in still air with exposed pins soldered on a 4 layer JEDEC PCB - 180 250 mA Tamb ambient temperature in still air with exposed pins soldered on a 4 layer JEDEC PCB 30 +25 +85 C All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 V (c) NXP Semiconductors N.V. 2016. All rights reserved. 112 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend The system design shall consider that maximum supply voltages are not exceeded during power-on of the system. 15. Thermal characteristics Table 112. Thermal characteristics HVQFN40 package Symbol Parameter Conditions Typ Rth(j-a) thermal resistance from junction to ambient in free air with exposed 40 pad soldered on a 4 layer JEDEC PCB, package HVQFN40 Unit K/W Table 113. Thermal characteristics TFBGA64 package Symbol Parameter Conditions Typ Unit Rth(j-a) thermal resistance from junction to ambient in free air with exposed 66 pad soldered on a 4 layer JEDEC PCB, package HVQFN40 K/W Table 114. Junction Temperature Symbol Parameter Conditions Max Unit Tj junction temperature - 125 C 16. Characteristics Table 115. Current consumption PN5180 Product data sheet COMPANY PUBLIC Symbol Parameter Conditions Min Typ Max Unit IDD(PVDD) supply current on pin PVDD VDD(PVDD) = 3.3 V - 20 - mA IDD(VBAT) supply current on pin VBAT VDD(VBAT) = 3.3 V max current includes current of all GPO's - 20 mA Ipd power-down current VDD(TVDD) = VDD(PVDD) =VDD(VDD) 3.0 V; hard power-down; pin RESET_N set LOW, Tamb = 25 C 10 - A Istb standby current Tamb = 25 C 15 - A All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 - (c) NXP Semiconductors N.V. 2016. All rights reserved. 113 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 116. Reset pin RESET_N Symbol Parameter t(reset) reset time VIH HIGH-level input voltage Conditions VDD(PVDD)<= VDD(VBAT) VIL LOW-level input voltage IIH HIGH-level input current VI = VDD(VBAT) IIL LOW-level input current VI = 0 V Ci input capacitance Min Typ Max Unit 10 - - s 1.1 - VDD(PV V DD) 0 - 0.4 V - - 1 mA -1 - - mA - 5 - pF Max Unit VDD(PV V Table 117. Input Pin AUX2 /DWL_REQ Symbol Parameter Conditions Min Typ VIH HIGH-level input voltage VDD(PVDD)<= VDD(VBAT) 0.65 x PVDD - DD) VIL LOW-level input voltage - 0 - 0.4 V IIH HIGH-level input current VI = VDD(VBAT) - - 1 mA IIL LOW-level input current VI = 0 V 1 - - mA Ci input capacitance - - 5 - pF t(RESET_N-AUX2/ time from RESET_N high to AUX2 /DWL_REQ high DWL_REQ) 0 - 50 s Max Unit VDD(PV V Table 118. GPO pin characteristics Symbol Parameter Conditions Min Typ Vi(p-p) peak-to-peak input voltage - - - DD) IOH HIGH-level output current VDD(PVDD) = 3.3 V - - 3 mA IIL LOW-level input current VDD(PVDD) = 3.3 V - - 3 mA Table 119. CLK1, CLK2 pin characteristics Symbol Parameter Vi(p-p) peak-to-peak input voltage IIH HIGH-level input current IIL LOW-level input current Ci(CLK1) Conditions Min Typ Max Unit - 0.2 - 1.65 V VI= 1.65 V - - 1 A VI = 0 V 1 - - A duty cycle - 35 65 % input capacitance on pin CLK1 VDD = 1.8 V, - 2 - pF - 2 - pF VDC = 0.65 V, VAC = 0.9 V (p-p) Ci(CLK2) input capacitance on pin CLK2 VDD = 1.8 V, VDC = 0.65 V, VAC = 0.9 V (p-p) PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 114 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 120. Output pin characteristics IRQ Symbol Parameter Conditions Min VOH HIGH-level output voltage IOH < 3 mA VDD(PVDD) 0.4 DD) 0 - 0.4 V - - 20 pF IOL < 3 mA Typ Max Unit VDD(PV V VOL LOW-level output voltage CL load capacitance tf fall time CL = 12 pF max 1 - 3 ns tr rise time CL = 12 pF max 1 - 3 ns Rpd pull-down resistance 0.4 - 0.7 M Table 121. Input pins SCLK, MOSI, NSS Symbol Parameter Conditions Min Typ Max Unit VIH HIGH-level input voltage 0.65 x VDD(PVDD) VDD(PVDD) V VIL LOW-level input voltage 0 - 0.35 x V VDD(PVDD) Ci input capacitance - 5 - pF IIH HIGH-level input current VI = PVDD - - 1 mA IIL LOW-level input current VI = 0 V - - 1 mA Table 122. Output pin MISO Symbol Parameter Conditions Min VOH HIGH-level output voltage IOH < 3 mA VDD(PV DD) -0.4 Typ DD) VOL LOW-level output voltage IOL < 3 mA 0 0.4 CL load capacitance - - 20 pF tf fall time CL = 12 pF max 1 - 3 ns tr rise time CL = 12 pF max 1 - 3 ns - Max Unit VDD(PV V V Table 123. Timing conditions SPI PN5180 Product data sheet COMPANY PUBLIC Symbol Parameter Min Typ Max Unit tSCKL SCK LOW time 72 - - ns tSCKH SCK HIGH time 72 - - ns th(SCKH-D) SCK HIGH to data input hold time 25 - - ns tsu(D-SCKH) data input to SCK HIGH set-up time 25 - - ns th(SCKL-Q) SCK LOW to data output hold time - - 25 ns t(SCKL-NSSH) SCK LOW to NSS HIGH time 0 - - ns tNSSH NSS HIGH time 72 - - ns All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 115 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 124. Output pins ANT1 and ANT2 Symbol Parameter Conditions Zi(diff) differential impedance from ANT1 to ANT2 Min Typ Max Unit Low impedance configuration 10 17 Ohm Vi(start)(lim)(ANT1) limiter start input voltage on ANT1 I=10 mA - 3.3 - V Vi(start)(lim)(ANT2) limiter start input voltage on ANT2 I=10 mA - 3.3 - V Min Typ Max Unit - - VDD V Table 125. Input pins RXp and RXn Symbol Parameter Conditions Vi(dyn) dynamic input voltage Ci input capacitance - 12 - pF Zi input impedance from RXN, Reader, Card RXP pins to VMID and P2P modes 0 - 15 k Table 126. Output pins TX1 and TX2 Symbol Parameter Conditions Min Typ Max Unit VOH HIGH-level output VDD(TVDD)=5 V - VDD(TVDD) 150mV VDD(TV V DD) VDD(TVDD)=5 V 0 200 - voltage LOW-level output VOL voltage mV Table 127. Start-up time Symbol Parameter Conditions Min Typ Max Unit tboot start-up time[1] RESET_N = High 2.3 2.5 dependent on configuration of XTAL_BOOT_ TIME in EEPROM ms [1] (PN5180 ready to receive commands on the host interface). The PN5180 indicates the ability to receive commands from a host by raising an IDLE IRQ. Table 128. Crystal requirements for ISO/IEC14443 compliant operation PN5180 Product data sheet COMPANY PUBLIC Symbol Parameter Conditions Min Typ Max Unit fxtal crystal frequency - -100 - +100 ppm ESR equivalent series resistance - 50 100 CL load capacitance - - 10 - pF Pxtal crystal power dissipation - - - 100 W All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 116 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 129. Reference input frequency requirements for 8 MHz, 12 MHz, 16 MHz and 24 MHz PN5180 Product data sheet COMPANY PUBLIC Symbol Parameter Conditions n phase noise Vi(p-p) Typ Max Unit Input noise floor at 50 kHz offset - -140 dBc/Hz peak-to-peak input voltage sinus signal 0.2 - 1.8 V Vi(p-p) peak-to-peak input voltage square signal 0 1.8 1.98 V fi(ref)acc reference input frequency accuracy - -100 - +100 ppm All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 Min (c) NXP Semiconductors N.V. 2016. All rights reserved. 117 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend supply VBAT supply transmitter 17. Application information NSS to host microcontroller IRQ BUSY RESET_N AUX2/DWL_REQ to microcontroller supply PVDD PVSS 26 12 13 TVDD VBAT AVDD VDHF 25 C7 22 23 ANT1 3 16 5 1 21 39 17 8 18 10 2 15 6 24 4 38 40 27 9 VSS to testpad AUX1 C6 36 37 R1 19 TVSS MISO 28 29 CLK2 MOSI 30 C5 7 CLK1 SCLK C4 VDD DVDD C3 RXP TX1 R_RXP C_MOD1 L1 VMID C_RXP C_S1 RA1 C_EMC_1 C_P1 C_EMC_2 C_S2 C_P2 antenna TX2 L2 RXN R_RXN RA2 C_RXN C_MOD2 ANT2 GPO1 optional output 11 n.c. R2 Q127 12 MHz 1 C1 4 C2 aaa-020597 Fig 47. Application diagram with minimum components 17.1 Typical component values The following component values are typical values for a design. Refer to the Application note "PN5180 Antenna Design Guide" how to determine the values listed to be dependent on antenna design. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 118 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 130. PN5180 Product data sheet COMPANY PUBLIC Component Value C1,C2 15 pF C3 1 nF C4 100 nF C5 470 nF C6 100 nF C7 6.8 F, additional blocking capacitors 100 nF might be required dependent on PCB layout and supply characteristics L1,L2 470 nH C_EMC_1, C_EMC_2 220 pF C_RCXP, C_RXN 1 nF R_RXP, R_RXN Dependent on antenna design C_MOD 82 pF C_S1, C_S2, C_P1, C_P2 Dependent on antenna design All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 119 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 18. Packaging information Moisture Sensitivity Level (MSL) evaluation has been performed according to SNW-FQ-225B rev.04/07/07 (JEDEC J-STD-020C). MSL for theHVQFN40 package is level 3 which means 260 C convection reflow temperature. * 1-week out-of-pack floor life at maximum ambient temperature 30C/ 60 % RH (Relative Humidity) to limit possible moisture intrusion. * When used in production, stored under nitrogen conditions for not more than 8 days The straps around the package of stacked trays inside the plano-box have sufficient pre-tension to avoid loosening of the trays. strap 46 mm from corner tray ESD warning preprinted chamfer barcode label (permanent) PIN 1 barcode label (peel-off) chamfer QA seal PIN 1 Hyatt patent preprinted In the traystack (2 trays) only ONE tray type* allowed *one supplier and one revision number. printed plano box 001aaj740 Fig 48. Packaging information 1 tray PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 120 of 149 xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx NXP Semiconductors PN5180 Product data sheet COMPANY PUBLIC strap 46 mm from the corner PQ-label (permanent) bag dry-agent relative humidity indicator preprinted: recycling symbol moisture caution label ESD warning tray manufacturer bag info chamfer PQ-label (permanent) PIN 1 PLCC52 dry-pack ID preprinted chamfer strap PIN 1 QA seal chamfer printed plano box PIN 1 aaa-004952 PN5180 121 of 149 (c) NXP Semiconductors N.V. 2016. All rights reserved. Fig 49. Packaging information 5 tray High-performance multi-protocol full NFC Forum-compliant frontend Rev. 3.0 -- 7 October 2016 240930 All information provided in this document is subject to legal disclaimers. ESD warning preprinted xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx BB BA BA BD BD section BC-BC scale 4:1 BB A B C 0.50 3.00 2.50 1.55 3.32 1.10 (0.30) A B C vacuum cell end lock AJ AJ AR AR side lock AN AK AL AL section BA-BA scale 4:1 AK detail AC scale 20:1 AM section AK-AK scale 5:1 AN section AN-AN scale 4:1 section AJ-AJ scale 2:1 section AL-AL scale 5:1 section AM-AM scale 4:1 section AR-AR scale 2:1 aaa-004949 Fig 50. Packaging information Tray PN5180 122 of 149 (c) NXP Semiconductors N.V. 2016. All rights reserved. section BD-BD scale 4:1 AM 0.35 14.200.08+10/S SQ. 1.20 12.80-5/S SQ. 0.56 (0.64) (14.40+5/S SQ.) (1.45) 16.600.08+7/S SQ. 13.850.08+12/S SQ. High-performance multi-protocol full NFC Forum-compliant frontend Rev. 3.0 -- 7 October 2016 240930 All information provided in this document is subject to legal disclaimers. BC 0.50 NXP Semiconductors PN5180 Product data sheet COMPANY PUBLIC BC xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx NXP Semiconductors PN5180 Product data sheet COMPANY PUBLIC ASSY REEL + LABELS tape (see: HOW TO SECURE) see: ASSY REEL + LABELS O 330x12/16/24/32 (hub 7'') guard band label side embossed ESD logo tape (see: HOW TO SECURE) circular sprocket holes opposite the label side of reel printed plano-box cover tape embossed ESD logo O 330x16/24/32/44 (hub 4'') O 330x44 (hub 6'') carrier tape enlongated PIN1 has to be in quadrant 1 circular PIN1 PIN1 1 SO enlongated PLCC PIN1 PIN1 product orientation in carrier tape 2 3 4 BGA bare die QFP unreeling direction (HV)QFN (HV)SON (H)BCC product orientation ONLY for turned products with 12nc ending 128 PIN1 SO PIN1 QFP HOW TO SECURE LEADER END TO THE GUARD BAND, HOW TO SECURE GUARD BAND PIN1 1 2 PIN1 3 4 PIN1 for SOT765 BGA for SOT505-2 ending 125 bare die ending 125 (HV)QFN (HV)SON (H)BCC tapeslot label side trailer trailer : lenght of trailer shall be 160 mm min. and covered with cover tape leader : lenght of trailer shall be 400 mm min. and covered with cover tape circular sprocket hole side guard band leader QA seal preprinted ESD warning PQ-label (permanent) dry-pack ID preprinted lape double-backed onto itself on both ends guard band aaa-004950 Fig 51. Packaging information Reel PN5180 123 of 149 (c) NXP Semiconductors N.V. 2016. All rights reserved. tape (with pull tabs on both ends) High-performance multi-protocol full NFC Forum-compliant frontend Rev. 3.0 -- 7 October 2016 240930 All information provided in this document is subject to legal disclaimers. O 180x12/16/24 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 19. Package outline HVQFN40: plastic thermal enhanced very thin quad flat package; no leads; 40 terminals; body 6 x 6 x 0.85 mm A B D SOT618-1 terminal 1 index area A A1 E c detail X e1 e C v w 1/2 e b 11 20 C A B C y y1 C L 21 10 e Eh e2 1/2 e 1 30 terminal 1 index area 40 31 X Dh 0 2.5 Dimensions (mm are the original dimensions) Unit mm A(1) A1 b max 1.00 0.05 0.30 nom 0.85 0.02 0.21 min 0.80 0.00 0.18 5 mm scale c D(1) Dh E(1) Eh e e1 e2 L v 0.2 6.1 6.0 5.9 4.25 4.10 3.95 6.1 6.0 5.9 4.25 4.10 3.95 0.5 4.5 4.5 0.5 0.4 0.3 0.1 w y 0.05 0.05 y1 0.1 Note 1. Plastic or metal protrusions of 0.075 mm maximum per side are not included. Outline version References IEC SOT618-1 JEDEC JEITA sot618-1_po European projection Issue date 02-10-22 13-11-05 MO-220 Fig 52. Package outline SOT618-1 PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 124 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend SOT1336-1 TFBGA64: plastic thin fine-pitch ball grid array package; 64 balls A B D ball A1 index area A A2 E A1 detail X e1 C 1/2 e e Ov Ow b C A B C y1 C y H G e F E e2 D C 1/2 e B A 1 ball A1 index area 2 3 4 5 6 7 8 X 0 5 mm scale Dimensions (mm are the original dimensions) Unit mm A A1 A2 b max 1.15 0.35 0.80 0.45 nom 1.00 0.30 0.70 0.40 min 0.90 0.25 0.65 0.35 D E e 5.6 5.5 5.4 5.6 5.5 5.4 e1 e2 v w 0.65 4.55 4.55 0.15 0.08 y y1 0.1 0.1 sot1336-1_po Outline version SOT1336-1 References IEC JEDEC JEITA European projection Issue date 12-06-19 12-08-28 --- Fig 53. Package outline package version (TFBGA64) PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 125 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 20. Soldering of SMD packages This text provides a very brief insight into a complex technology. A more in-depth account of soldering ICs can be found in Application Note AN10365 "Surface mount reflow soldering description". 20.1 Introduction to soldering Soldering is one of the most common methods through which packages are attached to Printed Circuit Boards (PCBs), to form electrical circuits. The soldered joint provides both the mechanical and the electrical connection. There is no single soldering method that is ideal for all IC packages. Wave soldering is often preferred when through-hole and Surface Mount Devices (SMDs) are mixed on one printed wiring board; however, it is not suitable for fine pitch SMDs. Reflow soldering is ideal for the small pitches and high densities that come with increased miniaturization. 20.2 Wave and reflow soldering Wave soldering is a joining technology in which the joints are made by solder coming from a standing wave of liquid solder. The wave soldering process is suitable for the following: * Through-hole components * Leaded or leadless SMDs, which are glued to the surface of the printed circuit board Not all SMDs can be wave soldered. Packages with solder balls, and some leadless packages which have solder lands underneath the body, cannot be wave soldered. Also, leaded SMDs with leads having a pitch smaller than ~0.6 mm cannot be wave soldered, due to an increased probability of bridging. The reflow soldering process involves applying solder paste to a board, followed by component placement and exposure to a temperature profile. Leaded packages, packages with solder balls, and leadless packages are all reflow solderable. Key characteristics in both wave and reflow soldering are: * * * * * * Board specifications, including the board finish, solder masks and vias Package footprints, including solder thieves and orientation The moisture sensitivity level of the packages Package placement Inspection and repair Lead-free soldering versus SnPb soldering 20.3 Wave soldering Key characteristics in wave soldering are: * Process issues, such as application of adhesive and flux, clinching of leads, board transport, the solder wave parameters, and the time during which components are exposed to the wave * Solder bath specifications, including temperature and impurities PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 126 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 20.4 Reflow soldering Key characteristics in reflow soldering are: * Lead-free versus SnPb soldering; note that a lead-free reflow process usually leads to higher minimum peak temperatures (see Figure 54) than a SnPb process, thus reducing the process window * Solder paste printing issues including smearing, release, and adjusting the process window for a mix of large and small components on one board * Reflow temperature profile; this profile includes preheat, reflow (in which the board is heated to the peak temperature) and cooling down. It is imperative that the peak temperature is high enough for the solder to make reliable solder joints (a solder paste characteristic). In addition, the peak temperature must be low enough that the packages and/or boards are not damaged. The peak temperature of the package depends on package thickness and volume and is classified in accordance with Table 131 and 132 Table 131. SnPb eutectic process (from J-STD-020D) Package thickness (mm) Package reflow temperature (C) Volume (mm3) < 350 350 < 2.5 235 220 2.5 220 220 Table 132. Lead-free process (from J-STD-020D) Package thickness (mm) Package reflow temperature (C) Volume (mm3) < 350 350 to 2000 > 2000 < 1.6 260 260 260 1.6 to 2.5 260 250 245 > 2.5 250 245 245 Moisture sensitivity precautions, as indicated on the packing, must be respected at all times. Studies have shown that small packages reach higher temperatures during reflow soldering, see Figure 54. PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 127 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend temperature maximum peak temperature = MSL limit, damage level minimum peak temperature = minimum soldering temperature peak temperature time 001aac844 MSL: Moisture Sensitivity Level Fig 54. Temperature profiles for large and small components For further information on temperature profiles, refer to Application Note AN10365 "Surface mount reflow soldering description". PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 128 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 21. Soldering Footprint information for reflow soldering of HVQFN40 package SOT618-1 Hx Gx D P 0.025 0.025 C (0.105) SPx nSPx Hy SPy tot SPy Gy SLy nSPy By Ay SPx tot SLx Bx Ax Generic footprint pattern Refer to the package outline drawing for actual layout occupied area solder resist solder lands solder paste nSPx nSPy 3 3 Dimensions in mm P Ax Ay Bx By 0.500 7.000 7.000 5.200 5.200 Issue date C D 0.900 0.290 SLx SLy SPx tot SPy tot SPx SPy Gx Gy Hx Hy 4.100 4.100 2.400 2.400 0.600 0.600 6.300 6.300 7.250 7.250 09-06-11 14-08-13 sot618-1_fr Fig 55. Soldering HVQFN40 package PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 129 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22. Appendix 22.1 Timer Delay for start of reception measurement Table 133. Timer delay for STOP_ON_RX_STARTED configuration Setting Protocol Speed (kbit/s) Modulation delay (us) 0x80 ISO 14443-A 106 Manch. SubC 48 0x81 ISO 14443-A 212 BPSK 24 0x82 ISO 14443-A 424 BPSK 12 0x83 ISO 14443-A 848 BPSK 6 0x84 ISO 14443-B 106 BPSK 182 0x85 ISO 14443-B 212 BPSK 91 0x86 ISO 14443-B 424 BPSK 46 0x87 ISO 14443-B 848 BPSK 23 0x88 FeliCa 212 - 95 0x89 FeliCa 424 - 48 0x8A NFC-Active Initiator 106 - - 0x8B NFC-Active Initiator 212 - - 0x8C NFC-Active Initiator 424 - - 0x8D ISO 15693 26 1 out 4 / SC 321 0x8E ISO 15693 53 1 out 4 / SC 161 0x8F ISO 18003M3 Manch. 424_4 106 Manch. 424 / 4 period 121 0x90 ISO 18003M3 Manch. 424_2 212 Manch. 424 / 2 period 75 0x91 ISO 18003M3 Manch. 848_4 212 Manch. 848 / 4 period 47 0x92 ISO 18003M3 Manch. 848_2 424 Manch. 848 / 2 period 11 0x93 ISO 14443-A PICC 106 Miller 48 0x94 ISO 14443-A PICC 212 Miller 24 0x95 ISO 14443-A PICC 424 Miller 12 0x96 ISO 14443-A PICC 848 Miller 6 0x97 NFC Passive Target 212 212 - 95 0x98 NFC Passive Target 424 424 - 48 22.2 Default protocol settings for LOAD_RF_CONFIG, Transmitter 22.2.1 ISO/IEC 14443 A-106 Table 134. ISO/IEC 14443 A-106 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value RF_CONTROL_TX_CLK 0x74 TX_DATA_MOD 0x2350 TX_UNDERSHOOT_CONFIG 0x17 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0xDBCF43 ANT_CONTROL 0x10 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 130 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.2.2 ISO/IEC 14443 A-212 Table 135. ISO/IEC 14443 A-212 Register name Initialization value RF_CONTROL_TX_CLK 0x82 TX_DATA_MOD 0x2350 TX_UNDERSHOOT_CONFIG 0x17 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0xDBCF043 ANT_CONTROL 0x10 22.2.3 ISO/IEC 14443 A-424 Table 136. ISO/IEC 14443 A-424 Register name Initialization value RF_CONTROL_TX_CLK 0x82 TX_DATA_MOD 0x650 TX_UNDERSHOOT_CONFIG 0x5 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0xDBCF43 ANT_CONTROL 0x10 22.2.4 ISO/IEC 14443 A-848 Table 137. ISO/IEC 14443 A-848 Register name Initialization value RF_CONTROL_TX_CLK 0x82 TX_DATA_MOD 0x150 TX_UNDERSHOOT_CONFIG 0x1 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0xF9EF45 ANT_CONTROL 0x10 22.2.5 ISO/IEC 14443 B-106 Table 138. ISO/IEC 14443 B-106 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value RF_CONTROL_TX_CLK 0x8E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x3A4756 ANT_CONTROL 0x10 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 131 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.2.6 ISO/IEC 14443 B-212 Table 139. ISO/IEC 14443 B-212 Register name Initialization value RF_CONTROL_TX_CLK 0x8E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x39C746 ANT_CONTROL 0x10 22.2.7 ISO/IEC 14443 B-424 Table 140. ISO/IEC 14443 B-424 Register name Initialization value RF_CONTROL_TX_CLK 0x78E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x1FE0013 RF_CONTROL_TX 0x71CF54 ANT_CONTROL 0x10 22.2.8 ISO/IEC 14443 B-848 Table 141. ISO/IEC 14443 B-848 Register name Initialization value RF_CONTROL_TX_CLK 0x78E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x7E000D RF_CONTROL_TX 0x69AF32 ANT_CONTROL 0x10 22.2.9 Felica-212 Table 142. Felica-212 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value RF_CONTROL_TX_CLK 0x8E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x39E744 ANT_CONTROL 0x10 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 132 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.2.10 Felica-424 Table 143. Felica-424 Register name Initialization value RF_CONTROL_TX_CLK 0x8E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x39EF33 ANT_CONTROL 0x10 22.2.11 NFC active initiator A-106 Table 144. NFC active initiator A-106 Register name Initialization value RF_CONTROL_TX_CLK 0x8782 TX_DATA_MOD 0x2350 TX_UNDERSHOOT_CONFIG 0x17 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0xDBCF43 ANT_CONTROL 0x10 22.2.12 NFC active initiator A-212 Table 145. NFC active initiator A-212 Register name Initialization value RF_CONTROL_TX_CLK 0x808E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x39E744 ANT_CONTROL 0x10 22.2.13 NFC active initiator A-424 Table 146. NFC active initiator A-424 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value RF_CONTROL_TX_CLK 0x808E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x39EF33 ANT_CONTROL 0x10 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 133 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.2.14 ISO/IEC15693-26 Table 147. ISO/IEC15693-26 Register name Initialization value RF_CONTROL_TX_CLK 0x782 TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0xF000001F TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0xDBC745 ANT_CONTROL 0x10 22.2.15 ISO/IEC15693-53 Table 148. ISO/IEC15693-53 Register name Initialization value RF_CONTROL_TX_CLK 0x8E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0xFF000F TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x3A4F44 ANT_CONTROL 0x10 22.2.16 ISO/IEC18003M3 - TARI=18.88 s Table 149. ISO/IEC18003M3 - TARI=18.88us Register name Initialization value RF_CONTROL_TX_CLK 0x8E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0xFF000F TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x3A2734 ANT_CONTROL 0x10 22.2.17 ISO/IEC18003M3 - TARI=9.44 s Table 150. ISO/IEC18003M3 - TARI=9.44 s PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value RF_CONTROL_TX_CLK 0x8E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0xFF000F TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x3A4734 ANT_CONTROL 0x10 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 134 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.2.18 PICC ISO/IEC14443-A 106 Table 151. PICC ISO/IEC14443-A 106 Register name Initialization value RF_CONTROL_TX_CLK 0x8000 TX_DATA_MOD 0x72 RF_CONTROL_TX 0x0 ANT_CONTROL 0xC 22.2.19 PICC ISO/IEC14443-A 212 Table 152. PICC ISO/IEC14443-A 212 Register name Initialization value RF_CONTROL_TX_CLK 0x8000 TX_DATA_MOD 0x72 RF_CONTROL_TX 0x0 ANT_CONTROL 0xC 22.2.20 PICC ISO/IEC14443-A 424 Table 153. PICC ISO/IEC14443-A 424 Register name Initialization value RF_CONTROL_TX_CLK 0x8000 TX_DATA_MOD 0x72 RF_CONTROL_TX 0x0 ANT_CONTROL 0xC 22.2.21 PICC ISO/IEC14443-A 848 Table 154. PICC ISO/IEC14443-A 848 Register name Initialization value RF_CONTROL_TX_CLK 0x8000 TX_DATA_MOD 0x72 RF_CONTROL_TX 0x0 ANT_CONTROL 0xC 22.2.22 NFC passive target 212 Table 155. NFC passive target 212 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value RF_CONTROL_TX_CLK 0x8000 TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x0 ANT_CONTROL 0xC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 135 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.2.23 NFC passive target 424 Table 156. NFC passive target 424 Register name Initialization value RF_CONTROL_TX_CLK 0x8000 TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x0 ANT_CONTROL 0xC 22.2.24 NFC active target 106 Table 157. NFC active target 106 Register name Initialization value RF_CONTROL_TX_CLK 0x8782 TX_DATA_MOD 0x2350 TX_UNDERSHOOT_CONFIG 0x17 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0xDBCF43 ANT_CONTROL 0x10 22.2.25 NFC active target 212 Table 158. NFC active target 212 Register name Initialization value RF_CONTROL_TX_CLK 0x0808E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x39E744 ANT_CONTROL 0x10 22.2.26 NFC active target 424 Table 159. NFC active target 424 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value RF_CONTROL_TX_CLK 0x808E TX_DATA_MOD 0x0 TX_UNDERSHOOT_CONFIG 0x0 TX_OVERSHOOT_CONFIG 0x0 RF_CONTROL_TX 0x39EF33 ANT_CONTROL 0x10 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 136 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.2.27 NFC general target mode - all data rates Table 160. NFC general target mode - all data rates Register name Initialization value RF_CONTROL_TX_CLK 0x8000 TX_DATA_MOD 0x72 22.3 Default protocol settings for LOAD_RF_CONFIG, Receiver 22.3.1 ISO/IEC 14443 A-106 Table 161. ISO/IEC 14443 A-106 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x804B ANA_RX_POWER_CONTROL_RFU 0x200 SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0x430DC RF_CONTROL_RX 0x1E 22.3.2 ISO/IEC 14443 A-212 Table 162. ISO/IEC 14443 A-212 Register name Initialization value AGC_VALUE 0x0x801F0801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0x430DC RF_CONTROL_RX 0x1E 22.3.3 ISO/IEC 14443 A-424 Table 163. ISO/IEC 14443 A-424 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0x192905 RF_CONTROL_RX 0x16 22.3.4 ISO/IEC 14443 A-848 Table 164. ISO/IEC 14443 A-848 Register name PN5180 Product data sheet COMPANY PUBLIC Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 137 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Table 164. ISO/IEC 14443 A-848 Register name Initialization value SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0xF2505 RF_CONTROL_RX 0x11 22.3.5 ISO/IEC 14443 B-106 Table 165. ISO/IEC 14443 B-106 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0x1F2415 RF_CONTROL_RX 0x16 22.3.6 ISO/IEC 14443 B-212 Table 166. ISO/IEC 14443 B-212 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0x192805 RF_CONTROL_RX 0x16 22.3.7 ISO/IEC 14443 B-424 Table 167. ISO/IEC 14443 B-424 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0x192A05 RF_CONTROL_RX 0x16 22.3.8 ISO/IEC 14443 B-848 Table 168. ISO/IEC 14443 B-848 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0xF2505 RF_CONTROL_RX 0x1A All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 138 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.3.9 Felica 212 Table 169. Felica 212 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0xF2605 RF_CONTROL_RX 0x11 22.3.10 FeliCa 424 Table 170. FeliCa 424 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0x2605 RF_CONTROL_RX 0x15 22.3.11 NFC Active Initiator 106 Table 171. NFC Active Initiator 106 Register name Initialization value AGC_VALUE 0xC0150 AGC_CONFIG 0xA00B RX_RFU 0x1 SIGPRO_CM_CONFIG 0x0 RF_CONTROL_RX 0x23 22.3.12 NFC Active Initiator 212 Table 172. NFC Active Initiator 212 Register name Initialization value AGC_VALUE 0xC0150 AGC_CONFIG 0xA00B SIGPRO_CM_CONFIG 0x50010060 RF_CONTROL_RX 0x23 22.3.13 NFC Active Initiator 424 Table 173. NFC Active Initiator 424 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value AGC_VALUE 0xC0150 AGC_CONFIG 0xA00B SIGPRO_CM_CONFIG 0x50010060 RF_CONTROL_RX 0x23 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 139 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.3.14 ISO/IEC 15693-26 Table 174. ISO/IEC 15693-26 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x804B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0x4010 RF_CONTROL_RX 0x1A 22.3.15 ISO/IEC 15693-53 Table 175. ISO/IEC 15693-53 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x804B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0xC4010 RF_CONTROL_RX 0x1A 22.3.16 ISO 18003M3- Tari 18.88 Table 176. ISO 18003M3- Tari 18.88 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_CM_CONFIG_RFU 0x0 SIGPRO_RM_CONFIG 0x8014 RF_CONTROL_RX 0x1A 22.3.17 ISO 18003M3- Tari 9.44 848_2 Table 177. ISO 18003M3- Tari 9.44 848_2 Register name PN5180 Product data sheet COMPANY PUBLIC Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0xC6014 SIGPRO_CM_CONFIG2_RFU 0x1 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 140 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.3.18 ISO 18003M3- Tari 9.44 -848_4 Table 178. ISO18003M3- Tari 9.44 -848_4 Register name Initialization value AGC_VALUE 0x801F0 AGC_CONFIG 0x860B SIGPRO_CM_CONFIG 0x0 SIGPRO_RM_CONFIG 0xC8094 RF_CONTROL_RX 0x1F 22.3.19 ISO 14443A-PICC 106 Table 179. ISO 14443A-PICC 106 Register name Initialization value AGC_CONFIG 0xA003 RX_RFU 0x1 SIGPRO_CM_CONFIG 0x1000801C RF_CONTROL_RX 0x23 22.3.20 ISO 14443A-PICC 212 Table 180. ISO 14443A-PICC 212 Register name Initialization value AGC_CONFIG 0xA003 SIGPRO_CM_CONFIG 0x1C0600E0 RF_CONTROL_RX 0xE3 22.3.21 ISO 14443A-PICC 424 Table 181. ISO 14443A-PICC 424 Register name Initialization value AGC_CONFIG 0xA003 SIGPRO_CM_CONFIG 0x14040040 RF_CONTROL_RX 0x23 22.3.22 ISO 14443A-PICC 848 Table 182. ISO 14443A-PICC 848 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value AGC_CONFIG 0xA003 SIGPRO_CM_CONFIG 0x8030040 RF_CONTROL_RX 0x2F All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 141 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.3.23 NFC-Passive target -212 Table 183. NFC-Passive target -212 Register name Initialization value AGC_CONFIG 0xA003 SIGPRO_CM_CONFIG 0x50010060 RF_CONTROL_RX 0x23 22.3.24 NFC-Passive target -424 Table 184. NFC-Passive target -424 Register name Initialization value AGC_CONFIG 0xA003 SIGPRO_CM_CONFIG 0x50010060 RF_CONTROL_RX 0x23 22.3.25 NFC-active target - 106 Table 185. NFC-active target - 106 Register name Initialization value AGC_VALUE 0xC0150 AGC_CONFIG 0xA00B SIGPRO_CM_CONFIG 0x0 RF_CONTROL_RX 0x23 22.3.26 NFC-active target - 212 Table 186. NFC-active target - 212 Register name Initialization value AGC_VALUE 0xC0150 AGC_CONFIG 0xA00B SIGPRO_CM_CONFIG 0x50010060 RF_CONTROL_RX 0x23 22.3.27 NFC-active target - 424 Table 187. NFC-active target - 424 PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value AGC_VALUE 0xC0150 AGC_CONFIG 0xA00B SIGPRO_CM_CONFIG 0x50010060 RF_CONTROL_RX 0x23 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 142 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 22.3.28 NFC-General target mode - all data rates Table 188. NFC-General target mode - all data rates PN5180 Product data sheet COMPANY PUBLIC Register name Initialization value AGC_VALUE 0xC0150 AGC_CONFIG 0xA003 SIGPRO_CM_CONFIG 0x10010060 RF_CONTROL_RX 0x23 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 143 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 23. Abbreviations Table 189. Abbreviations Acronym Description ADC Analog-to-Digital Converter AWC Adaptive Waveform Control BPSK Binary Phase Shift Keying BBA Base Band Amplifier CRC Cyclic Redundancy Check DPC Dynamic Power Control EGT Extra Guard Time EMC ElectroMagnetic Compatibility EMD ElectroMagnetic Disturbance EOF End Of Frame ETU Elementary Time Unit HBM Human Body Model LFO Low Frequency Oscillator LPCD Low-Power Card Detection LSB Least Significant Bit MISO Master In Slave Out MOSI Master Out Slave In MSB Most Significant Bit NRZ Not Return to Zero NSS Not Slave Select PCD Proximity Coupling Device PLL Phase-Locked Loop RZ Return To Zero RX Receiver SOF Start Of Frame SPI Serial Peripheral Interface SW Software TX Transmitter UART Universal Asynchronous Receiver Transmitter UID Unique Identification 24. References [1] PN5180 Product data sheet COMPANY PUBLIC ISO/IEC 14443 -- parts 2: 2001 COR 1 2007 (01/11/2007), part 3: 2001 COR 1 2006 (01/09/2006) and part 4: 2nd edition 2008 (15/07/2008) All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 144 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 25. Revision history Table 190. Revision history Document ID Release date Data sheet status Change notice Supersedes PN5180 v. 3.0 20161007 Product data sheet - PN5180 v. 2.2 Modifications: PN5180 v. 2.2 Modifications: PN5180 v. 2.1 Modifications: PN5180 v. 2.0 PN5180 Product data sheet COMPANY PUBLIC * * * Data sheet status changed into Product data sheet Section 6 "Versions" added General update 20151217 * * * Preliminary data sheet PN5180 v. 2.1 Waveform control description added Figure 47 "Application diagram with minimum components": updated 20151126 * - Section 11.4.3.2 "Transmission Buffer": Size of RX buffer corrected to 508 bytes Preliminary data sheet - PN5180 v. 2.0 Preliminary data sheet - - Minor updates 20151124 All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 145 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 26. Legal information 26.1 Data sheet status Document status[1][2] Product status[3] Definition Objective [short] data sheet Development This document contains data from the objective specification for product development. Preliminary [short] data sheet Qualification This document contains data from the preliminary specification. Product [short] data sheet Production This document contains the product specification. [1] Please consult the most recently issued document before initiating or completing a design. [2] The term `short data sheet' is explained in section "Definitions". [3] The product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple devices. The latest product status information is available on the Internet at URL http://www.nxp.com. 26.2 Definitions Draft -- The document is a draft version only. The content is still under internal review and subject to formal approval, which may result in modifications or additions. NXP Semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall have no liability for the consequences of use of such information. Short data sheet -- A short data sheet is an extract from a full data sheet with the same product type number(s) and title. A short data sheet is intended for quick reference only and should not be relied upon to contain detailed and full information. For detailed and full information see the relevant full data sheet, which is available on request via the local NXP Semiconductors sales office. In case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail. Product specification -- The information and data provided in a Product data sheet shall define the specification of the product as agreed between NXP Semiconductors and its customer, unless NXP Semiconductors and customer have explicitly agreed otherwise in writing. In no event however, shall an agreement be valid in which the NXP Semiconductors product is deemed to offer functions and qualities beyond those described in the Product data sheet. 26.3 Disclaimers Limited warranty and liability -- Information in this document is believed to be accurate and reliable. However, NXP Semiconductors does not give any representations or warranties, expressed or implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information. NXP Semiconductors takes no responsibility for the content in this document if provided by an information source outside of NXP Semiconductors. In no event shall NXP Semiconductors be liable for any indirect, incidental, punitive, special or consequential damages (including - without limitation - lost profits, lost savings, business interruption, costs related to the removal or replacement of any products or rework charges) whether or not such damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. Notwithstanding any damages that customer might incur for any reason whatsoever, NXP Semiconductors' aggregate and cumulative liability towards customer for the products described herein shall be limited in accordance with the Terms and conditions of commercial sale of NXP Semiconductors. Right to make changes -- NXP Semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without notice. This document supersedes and replaces all information supplied prior to the publication hereof. PN5180 Product data sheet COMPANY PUBLIC Suitability for use -- NXP Semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or malfunction of an NXP Semiconductors product can reasonably be expected to result in personal injury, death or severe property or environmental damage. NXP Semiconductors and its suppliers accept no liability for inclusion and/or use of NXP Semiconductors products in such equipment or applications and therefore such inclusion and/or use is at the customer's own risk. Applications -- Applications that are described herein for any of these products are for illustrative purposes only. NXP Semiconductors makes no representation or warranty that such applications will be suitable for the specified use without further testing or modification. Customers are responsible for the design and operation of their applications and products using NXP Semiconductors products, and NXP Semiconductors accepts no liability for any assistance with applications or customer product design. It is customer's sole responsibility to determine whether the NXP Semiconductors product is suitable and fit for the customer's applications and products planned, as well as for the planned application and use of customer's third party customer(s). Customers should provide appropriate design and operating safeguards to minimize the risks associated with their applications and products. NXP Semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the customer's applications or products, or the application or use by customer's third party customer(s). Customer is responsible for doing all necessary testing for the customer's applications and products using NXP Semiconductors products in order to avoid a default of the applications and the products or of the application or use by customer's third party customer(s). NXP does not accept any liability in this respect. Limiting values -- Stress above one or more limiting values (as defined in the Absolute Maximum Ratings System of IEC 60134) will cause permanent damage to the device. Limiting values are stress ratings only and (proper) operation of the device at these or any other conditions above those given in the Recommended operating conditions section (if present) or the Characteristics sections of this document is not warranted. Constant or repeated exposure to limiting values will permanently and irreversibly affect the quality and reliability of the device. Terms and conditions of commercial sale -- NXP Semiconductors products are sold subject to the general terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms, unless otherwise agreed in a valid written individual agreement. In case an individual agreement is concluded only the terms and conditions of the respective agreement shall apply. NXP Semiconductors hereby expressly objects to applying the customer's general terms and conditions with regard to the purchase of NXP Semiconductors products by customer. No offer to sell or license -- Nothing in this document may be interpreted or construed as an offer to sell products that is open for acceptance or the grant, conveyance or implication of any license under any copyrights, patents or other industrial or intellectual property rights. All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 146 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend Export control -- This document as well as the item(s) described herein may be subject to export control regulations. Export might require a prior authorization from competent authorities. Quick reference data -- The Quick reference data is an extract of the product data given in the Limiting values and Characteristics sections of this document, and as such is not complete, exhaustive or legally binding. Non-automotive qualified products -- Unless this data sheet expressly states that this specific NXP Semiconductors product is automotive qualified, the product is not suitable for automotive use. It is neither qualified nor tested in accordance with automotive testing or application requirements. NXP Semiconductors accepts no liability for inclusion and/or use of non-automotive qualified products in automotive equipment or applications. 26.4 Licenses Purchase of NXP ICs with NFC technology Purchase of an NXP Semiconductors IC that complies with one of the Near Field Communication (NFC) standards ISO/IEC 18092 and ISO/IEC 21481 does not convey an implied license under any patent right infringed by implementation of any of those standards. Purchase of NXP Semiconductors IC does not include a license to any NXP patent (or other IP right) covering combinations of those products with other products, whether hardware or software. In the event that customer uses the product for design-in and use in automotive applications to automotive specifications and standards, customer (a) shall use the product without NXP Semiconductors' warranty of the product for such automotive applications, use and specifications, and (b) whenever customer uses the product for automotive applications beyond NXP Semiconductors' specifications such use shall be solely at customer's own risk, and (c) customer fully indemnifies NXP Semiconductors for any liability, damages or failed product claims resulting from customer design and use of the product for automotive applications beyond NXP Semiconductors' standard warranty and NXP Semiconductors' product specifications. Purchase of NXP ICs with ISO/IEC 14443 type B functionality Translations -- A non-English (translated) version of a document is for reference only. The English version shall prevail in case of any discrepancy between the translated and English versions. 26.5 Trademarks This NXP Semiconductors IC is ISO/IEC 14443 Type B software enabled and is licensed under Innovatron's Contactless Card patents license for ISO/IEC 14443 B. The license includes the right to use the IC in systems and/or end-user equipment. RATP/Innovatron Technology Notice: All referenced brands, product names, service names and trademarks are the property of their respective owners. MIFARE -- is a trademark of NXP B.V. ICODE and I-CODE -- are trademarks of NXP B.V. 27. Contact information For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: salesaddresses@nxp.com PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 147 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 28. Contents 1 2 3 4 5 6 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 General description . . . . . . . . . . . . . . . . . . . . . . 1 Features and benefits . . . . . . . . . . . . . . . . . . . . 2 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Quick reference data . . . . . . . . . . . . . . . . . . . . . 3 Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Version 3.4: Allows EMVCO 2.3.1 compliant EMD error handling . . . . . . . . . . . . . . . . . . . . . .3 Version 3.5: Allows EMVCO 2.5 compliant EMD error handling . . . . . . . . . . . . . . . . . . . . . .3 Version 3.6: Automatic Receiver Control added . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4 7 Ordering information . . . . . . . . . . . . . . . . . . . . . 4 8 Marking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 8.1 Package marking drawing . . . . . . . . . . . . . . . . 7 9 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 7 10 Pinning information . . . . . . . . . . . . . . . . . . . . . . 8 10.1 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . 8 11 Functional description . . . . . . . . . . . . . . . . . . 10 11.1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . 10 11.2 Power-up and Clock . . . . . . . . . . . . . . . . . . . . 10 11.2.1 Power Management Unit . . . . . . . . . . . . . . . . 10 11.2.1.1 Supply Connections and Power-up . . . . . . . . 10 11.2.1.2 Power-down . . . . . . . . . . . . . . . . . . . . . . . . . . 11 11.2.1.3 Standby . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 11.2.1.4 Temperature Sensor . . . . . . . . . . . . . . . . . . . . 12 11.2.2 Reset and start-up time . . . . . . . . . . . . . . . . . 12 11.2.3 Clock concept . . . . . . . . . . . . . . . . . . . . . . . . . 12 11.3 Timer and Interrupt system. . . . . . . . . . . . . . . 13 11.3.1 General Purpose Timer . . . . . . . . . . . . . . . . . 13 11.3.2 Interrupt System . . . . . . . . . . . . . . . . . . . . . . . 14 11.3.2.1 IRQ PIN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 11.3.2.2 IRQ_STATUS Register . . . . . . . . . . . . . . . . . . 14 11.4 SPI Host Interface . . . . . . . . . . . . . . . . . . . . . 14 11.4.1 Physical Host Interface . . . . . . . . . . . . . . . . . . 14 11.4.2 Timing Specification SPI . . . . . . . . . . . . . . . . 16 11.4.3 Logical Host Interface . . . . . . . . . . . . . . . . . . . 17 11.4.3.1 Host Interface Command . . . . . . . . . . . . . . . . 17 11.4.3.2 Transmission Buffer . . . . . . . . . . . . . . . . . . . . 18 11.4.3.3 Host Interface Command List . . . . . . . . . . . . . 18 11.5 Memories . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 11.5.1 Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 11.5.2 EEPROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 11.5.3 RAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 11.5.4 Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 11.6 Debug Signals . . . . . . . . . . . . . . . . . . . . . . . . 46 11.6.1 General functionality . . . . . . . . . . . . . . . . . . . 46 11.6.2 Digital Debug Configuration . . . . . . . . . . . . . 46 11.6.2.1 Debug signal groups . . . . . . . . . . . . . . . . . . . 47 11.6.2.2 Digital Debug Output Pin Configuration . . . . . 49 11.6.3 Analog Debug Configuration . . . . . . . . . . . . . 49 11.7 AUX2 / DWL_REQ. . . . . . . . . . . . . . . . . . . . . 49 11.7.1 Firmware update . . . . . . . . . . . . . . . . . . . . . . 49 11.7.2 Firmware update command set . . . . . . . . . . . 50 11.8 RF Functionality . . . . . . . . . . . . . . . . . . . . . . . 50 11.8.1 Supported RF Protocols. . . . . . . . . . . . . . . . . 50 11.8.1.1 ISO/IEC14443 A/MIFARE functionality . . . . . 50 11.8.1.2 ISO/IEC14443 B functionality . . . . . . . . . . . . 53 11.8.1.3 FeliCa RF functionality. . . . . . . . . . . . . . . . . . 53 11.8.1.4 ISO/IEC15693 functionality . . . . . . . . . . . . . . 55 11.8.1.5 ISO/IEC18000-3 Mode 3 functionality . . . . . . 56 11.8.1.6 NFCIP-1 modes . . . . . . . . . . . . . . . . . . . . . . . 57 11.8.1.7 ISO/IEC14443 A Card operation mode . . . . . 60 11.8.1.8 NFC Configuration . . . . . . . . . . . . . . . . . . . . 60 11.8.1.9 Mode Detector . . . . . . . . . . . . . . . . . . . . . . . . 60 11.8.2 RF-field handling . . . . . . . . . . . . . . . . . . . . . . 60 11.8.3 Transmitter TX . . . . . . . . . . . . . . . . . . . . . . . . 61 11.8.3.1 100 % Modulation . . . . . . . . . . . . . . . . . . . . . 61 11.8.3.2 10 % Amplitude Modulation . . . . . . . . . . . . . 62 11.8.3.3 TX Wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 11.8.3.4 Over- and Undershoot prevention . . . . . . . . . 64 11.8.4 Dynamic Power Control (DPC) . . . . . . . . . . . 64 11.8.5 Adaptive Waveform Control (AWC) . . . . . . . . 67 11.8.6 Adaptive Receiver Control (ARC) . . . . . . . . . 68 11.8.7 Transceive state machine . . . . . . . . . . . . . . . 69 11.8.8 Autocoll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 11.8.9 Receiver RX. . . . . . . . . . . . . . . . . . . . . . . . . . 72 11.8.9.1 Reader Mode Receiver . . . . . . . . . . . . . . . . . 72 11.8.9.2 Automatic Gain Control . . . . . . . . . . . . . . . . . 74 11.8.9.3 RX Wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 11.8.9.4 EMD Error handling . . . . . . . . . . . . . . . . . . . 74 11.8.10 Low-Power Card Detection (LPCD) . . . . . . . . 75 11.8.10.1 Check Card register . . . . . . . . . . . . . . . . . . . . 80 11.9 Register overview . . . . . . . . . . . . . . . . . . . . . 81 11.9.1 Register overview . . . . . . . . . . . . . . . . . . . . . 81 11.9.2 Register description . . . . . . . . . . . . . . . . . . . . 82 12 Secure Firmware Update . . . . . . . . . . . . . . . 105 12.1 General functionality . . . . . . . . . . . . . . . . . . 105 12.2 Physical Host Interface during Secure Firmware Download . . . . . . . . . . . . . . . . . . . 106 12.3 Download Protection . . . . . . . . . . . . . . . . . . 107 12.4 Commands . . . . . . . . . . . . . . . . . . . . . . . . . 108 12.4.1 Frame format . . . . . . . . . . . . . . . . . . . . . . . . 108 12.4.2 Command Code Overview. . . . . . . . . . . . . . . 110 continued >> PN5180 Product data sheet COMPANY PUBLIC All information provided in this document is subject to legal disclaimers. Rev. 3.0 -- 7 October 2016 240930 (c) NXP Semiconductors N.V. 2016. All rights reserved. 148 of 149 PN5180 NXP Semiconductors High-performance multi-protocol full NFC Forum-compliant frontend 12.4.3 Command Code Response . . . . . . . . . . . . . 12.4.4 Command Code Description . . . . . . . . . . . . 12.4.4.1 RESET . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.4.2 GET_VERSION . . . . . . . . . . . . . . . . . . . . . . 12.4.4.3 SECURE_WRITE . . . . . . . . . . . . . . . . . . . . . 12.4.4.4 GET_DIE_ID. . . . . . . . . . . . . . . . . . . . . . . . . 12.4.5 Error handling . . . . . . . . . . . . . . . . . . . . . . . . 13 Limiting values. . . . . . . . . . . . . . . . . . . . . . . . 14 Recommended operating conditions. . . . . . 15 Thermal characteristics . . . . . . . . . . . . . . . . 16 Characteristics . . . . . . . . . . . . . . . . . . . . . . . . 17 Application information. . . . . . . . . . . . . . . . . 17.1 Typical component values . . . . . . . . . . . . . . 18 Packaging information . . . . . . . . . . . . . . . . . 19 Package outline . . . . . . . . . . . . . . . . . . . . . . . 20 Soldering of SMD packages . . . . . . . . . . . . . 20.1 Introduction to soldering . . . . . . . . . . . . . . . . 20.2 Wave and reflow soldering . . . . . . . . . . . . . . 20.3 Wave soldering . . . . . . . . . . . . . . . . . . . . . . . 20.4 Reflow soldering . . . . . . . . . . . . . . . . . . . . . . 21 Soldering . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22.1 Timer Delay for start of reception measurement . . . . . . . . . . . . . . . . . . . . . . . . 22.2 Default protocol settings for LOAD_RF_CONFIG, Transmitter . . . . . . . . . 22.2.1 ISO/IEC 14443 A-106 . . . . . . . . . . . . . . . . . . 22.2.2 ISO/IEC 14443 A-212 . . . . . . . . . . . . . . . . . . 22.2.3 ISO/IEC 14443 A-424 . . . . . . . . . . . . . . . . . . 22.2.4 ISO/IEC 14443 A-848 . . . . . . . . . . . . . . . . . . 22.2.5 ISO/IEC 14443 B-106 . . . . . . . . . . . . . . . . . . 22.2.6 ISO/IEC 14443 B-212 . . . . . . . . . . . . . . . . . . 22.2.7 ISO/IEC 14443 B-424 . . . . . . . . . . . . . . . . . . 22.2.8 ISO/IEC 14443 B-848 . . . . . . . . . . . . . . . . . . 22.2.9 Felica-212 . . . . . . . . . . . . . . . . . . . . . . . . . . . 22.2.10 Felica-424 . . . . . . . . . . . . . . . . . . . . . . . . . . . 22.2.11 NFC active initiator A-106. . . . . . . . . . . . . . . 22.2.12 NFC active initiator A-212. . . . . . . . . . . . . . . 22.2.13 NFC active initiator A-424. . . . . . . . . . . . . . . 22.2.14 ISO/IEC15693-26 . . . . . . . . . . . . . . . . . . . . . 22.2.15 ISO/IEC15693-53 . . . . . . . . . . . . . . . . . . . . . 22.2.16 ISO/IEC18003M3 - TARI=18.88 ms . . . . . . . 22.2.17 ISO/IEC18003M3 - TARI=9.44 ms . . . . . . . . 22.2.18 PICC ISO/IEC14443-A 106 . . . . . . . . . . . . . 22.2.19 PICC ISO/IEC14443-A 212 . . . . . . . . . . . . . 22.2.20 PICC ISO/IEC14443-A 424 . . . . . . . . . . . . . 22.2.21 PICC ISO/IEC14443-A 848 . . . . . . . . . . . . . 22.2.22 NFC passive target 212 . . . . . . . . . . . . . . . . 22.2.23 NFC passive target 424 . . . . . . . . . . . . . . . . 110 110 110 111 111 111 112 112 112 113 113 118 118 120 124 126 126 126 126 127 129 130 130 130 130 131 131 131 131 132 132 132 132 133 133 133 133 134 134 134 134 135 135 135 135 135 136 22.2.24 22.2.25 22.2.26 22.2.27 22.3 22.3.1 22.3.2 22.3.3 22.3.4 22.3.5 22.3.6 22.3.7 22.3.8 22.3.9 22.3.10 22.3.11 22.3.12 22.3.13 22.3.14 22.3.15 22.3.16 22.3.17 22.3.18 22.3.19 22.3.20 22.3.21 22.3.22 22.3.23 22.3.24 22.3.25 22.3.26 22.3.27 22.3.28 23 24 25 26 26.1 26.2 26.3 26.4 26.5 27 28 NFC active target 106 . . . . . . . . . . . . . . . . . NFC active target 212 . . . . . . . . . . . . . . . . . NFC active target 424 . . . . . . . . . . . . . . . . . NFC general target mode - all data rates. . . Default protocol settings for LOAD_RF_CONFIG, Receiver. . . . . . . . . . . ISO/IEC 14443 A-106 . . . . . . . . . . . . . . . . . ISO/IEC 14443 A-212 . . . . . . . . . . . . . . . . . ISO/IEC 14443 A-424 . . . . . . . . . . . . . . . . . ISO/IEC 14443 A-848 . . . . . . . . . . . . . . . . . ISO/IEC 14443 B-106 . . . . . . . . . . . . . . . . . ISO/IEC 14443 B-212 . . . . . . . . . . . . . . . . . ISO/IEC 14443 B-424 . . . . . . . . . . . . . . . . . ISO/IEC 14443 B-848 . . . . . . . . . . . . . . . . . Felica 212 . . . . . . . . . . . . . . . . . . . . . . . . . . FeliCa 424 . . . . . . . . . . . . . . . . . . . . . . . . . . NFC Active Initiator 106 . . . . . . . . . . . . . . . . NFC Active Initiator 212 . . . . . . . . . . . . . . . . NFC Active Initiator 424 . . . . . . . . . . . . . . . . ISO/IEC 15693-26 . . . . . . . . . . . . . . . . . . . . ISO/IEC 15693-53 . . . . . . . . . . . . . . . . . . . . ISO 18003M3- Tari 18.88. . . . . . . . . . . . . . . ISO 18003M3- Tari 9.44 848_2 . . . . . . . . . . ISO 18003M3- Tari 9.44 -848_4. . . . . . . . . . ISO 14443A-PICC 106. . . . . . . . . . . . . . . . . ISO 14443A-PICC 212. . . . . . . . . . . . . . . . . ISO 14443A-PICC 424. . . . . . . . . . . . . . . . . ISO 14443A-PICC 848. . . . . . . . . . . . . . . . . NFC-Passive target -212 . . . . . . . . . . . . . . . NFC-Passive target -424 . . . . . . . . . . . . . . . NFC-active target - 106 . . . . . . . . . . . . . . . . NFC-active target - 212 . . . . . . . . . . . . . . . . NFC-active target - 424 . . . . . . . . . . . . . . . . NFC-General target mode - all data rates . . Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . References. . . . . . . . . . . . . . . . . . . . . . . . . . . Revision history . . . . . . . . . . . . . . . . . . . . . . Legal information . . . . . . . . . . . . . . . . . . . . . Data sheet status . . . . . . . . . . . . . . . . . . . . . Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . Disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . Licenses. . . . . . . . . . . . . . . . . . . . . . . . . . . . Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . Contact information . . . . . . . . . . . . . . . . . . . Contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 136 136 137 137 137 137 137 137 138 138 138 138 139 139 139 139 139 140 140 140 140 141 141 141 141 141 142 142 142 142 142 143 144 144 145 146 146 146 146 147 147 147 148 Please be aware that important notices concerning this document and the product(s) described herein, have been included in section `Legal information'. (c) NXP Semiconductors N.V. 2016. All rights reserved. For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: salesaddresses@nxp.com Date of release: 7 October 2016 240930