all | frequencies |
|
|
|
|
exhibits | applications |
---|---|---|---|---|---|---|---|
manual | photos | label |
app s | submitted / available | |||||||
---|---|---|---|---|---|---|---|---|
1 |
|
User Manual | Users Manual | 2.63 MiB | September 27 2022 | |||
1 |
|
Internal photo | Internal Photos | 854.82 KiB | September 27 2022 | |||
1 |
|
External photo | External Photos | 609.59 KiB | September 27 2022 | |||
1 |
|
Label | ID Label/Location Info | 75.55 KiB | September 27 2022 | |||
1 |
|
Antenna specification | Test Report | 85.61 KiB | September 27 2022 | |||
1 |
|
Applicant Declaration Letter | Cover Letter(s) | 162.71 KiB | September 27 2022 | |||
1 |
|
Auth letter | Cover Letter(s) | 68.77 KiB | September 27 2022 | |||
1 | Block diagram | Block Diagram | September 27 2022 | confidential | ||||
1 |
|
Confidentiality FCC | Cover Letter(s) | 86.26 KiB | September 27 2022 | |||
1 | Operational description | Operational Description | September 27 2022 | confidential | ||||
1 |
|
SGS FCC modular request letter | Attestation Statements | 178.26 KiB | September 27 2022 | |||
1 | Schematics | Schematics | September 27 2022 | confidential | ||||
1 |
|
Test report | Test Report | 956.66 KiB | September 27 2022 | |||
1 |
|
Test setup photo | Test Setup Photos | 551.14 KiB | September 27 2022 |
1 | User Manual | Users Manual | 2.63 MiB | September 27 2022 |
UM10936 PN7150 User Manual Rev. 2.0 6 November 2020 348120 COMPANY PUBLIC User manual Document information Info Content Keywords Abstract PN7150, NFC, NFCC, NCI 1.0 This is a user manual for the PN7150 NFC Controller. The aim of this document is to describe the PN7150 interfaces, modes of operation and possible configurations. 1. Introduction UM10936 PN7150 User Manual The PN7150 is a full features NFC controller for contactless communication at 13.56 MHz. The User Manual describes the software interfaces (API), based on the NFC FORUM standard, NCI. Note: this document includes cross-references, which can be used to directly access the section/chapter referenced in the text. These cross-references are indicated by the following sign: . This sign is positioned right before the section/chapter reference. The way to jump to the referenced section/chapter depends on the file format:
In the word format, you have to first press the key Ctrl on the key board and then to click on the section/chapter reference number pointed by the sign. The mouse symbol changes to a small hand when it is positioned on the section/chapter reference number. In .pdf format, you only have to click on the section/chapter reference number pointed by the sign: the mouse symbol automatically changes to a small hand when it is positioned on the section/chapter reference number As this document assumes pre-knowledge on certain technologies please check section 15: References to find the appropriate documentation. For further information please refer to the PN7150 data sheet [PN7150_DS]. In this document the term MIFARE card refers to a contactless card using an IC out of the MIFARE Classic, MIFARE Plus, MIFARE Ultralight or MIFARE DESFire product family UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 3 of 127 UM10936 PN7150 User Manual The PN7150 architecture overview The PN7150 is an NFC Controller, which is briefly described in Fig 1:
The top part describes the Device Host (DH) architecture with Higher Layer Driver
(e.g. Android stack) hosting the different kind of applications (Reader/Writer, Peer to Peer, Card Emulation in the DH-NFCEE), the NCI driver & the transport layer driver. The PN7150 is the NFCC in the Fig 1. It is connected to the DH through a physical interface which is an I2C. The bottom part of the figure contains the RF antenna connected to the PN7150, which can communicate over RF with a Tag (Card) and a Reader/Writer or a Peer device. DH-NFCEE Reader
/ Writer P2P Card Emulat NCI driver Transport layer driver DH IC host interface Transport Layer FW NFCC NCI firmware RF Antenna TAG or Card Reader/Writer or P2P Fig 1. PN7150 system architecture UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 4 of 127 UM10936 PN7150 User Manual For contactless operation, several Modes of operation are possible, based on the overall system described above. 1.1 Reader/Writer Operation in Poll Mode This mode of operation is further detailed in chapter 6. The Reader/Writer application running on the DH is accessing a remote contactless Tag/Card, through the PN7150. DH-NFCEE Reader
/ Writer P2P Card Emulat NCI driver Transport layer driver DH IC host interface Transport Layer FW NFCC NCI firmware RF Antenna TAG or Card Fig 2. Reader/Writer Reader/Writer or P2P UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 5 of 127 UM10936 PN7150 User Manual 1.2 Card Emulation Operation in Listen Mode This mode of operation is further detailed in chapter 7. An external Reader/Writer accesses the DH-NFCEE emulating a contactless card, through the PN7150. DH-NFCEE Reader
/ Writer P2P Card Emulat NCI driver Transport layer driver DH IC host interface Transport Layer FW NFCC NCI firmware RF Antenna TAG or Card Fig 3. Card Emulation Reader/Writer or P2P UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 6 of 127 UM10936 PN7150 User Manual 1.3 Peer to Peer Operation in Listen & Poll Mode This mode of operation is further detailed in chapter 8 The P2P application running on the DH is accessing a remote Peer device, through the PN7150. DH-NFCEE Reader
/ Writer P2P Card Emulat NCI driver Transport layer driver DH IC host interface Transport Layer FW NFCC NCI firmware RF Antenna TAG or Card Fig 4. Peer to peer Reader/Writer or P2P UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 7 of 127 UM10936 PN7150 User Manual 2. NCI Overview The aim of this section is to give an overview of the key points of the [NCI] specification. 2.1 NCI Components Here below are described the NCI component as defined in [NCI] which are located in the NFCC embedded FW. NCI modules y r e v o c s D F R i s e c a f r e t n I F R E E C F N y r e v o c s D i E E C F N s e c a f r e t n I
(...) NCI Core Transport Mapping 1 Transport Mapping 2 Transport Mapping n
(...) Transport 1 Transport 2 Transport n Fig 7. NCI components 2.1.1 NCI Modules NCI modules are built on top of the functionality provided by the NCI Core. Each module provides a well-defined functionality to the DH. NCI modules provide the functionality to configure the NFCC and to discover and communicate with Remote NFC Endpoints (see
[NCI] for definition) or with DH-NFCEEs. Some NCI modules are mandatory parts of an NCI implementation, others are optional. There can also be dependencies between NCI modules in the sense that a module may only be useful if there are other modules implemented as well. For example, all modules that deal with communication with a Remote NFC Endpoint (the RF Interface modules) depend on the RF Discovery to be present. 2.1.2 NCI Core The NCI Core defines the basic functionality of the communication between a Device Host
(DH) and an NFC Controller (NFCC). This enables Control Message (Command, Response and Notification) and Data Message exchange between an NFCC and a DH. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 10 of 127 UM10936 PN7150 User Manual 2.1.3 Transport Mappings Transport Mappings define how the NCI messaging is mapped to an underlying NCI Transport, which is a physical connection (and optional associated protocol) between the DH and the NFCC. Each Transport Mapping is associated with a specific NCI Transport
(see [NCI] for definition). 2.2 NCI Concepts This chapter outlines the basic concepts used in [NCI]. NFC Forum Device DH s e g a s s e M l o r t n o C NCI e c a f r e t n I F R s e g a s s e M a t a D s e g a s s e M l o r t n o C e c a f r e t n I E E C F N s e g a s s e M a t a D s e g a s s e M l o r t n o C NFCC NFCEE Protocol NFCEE l o c o t o r P F R Remote NFC Endpoint Fig 8. NCI concepts 2.2.1 Control Messages A DH uses NCI Control Messages to control and configure an NFCC. Control Messages consist of Commands, Responses and Notifications. Commands are only allowed to be sent in the direction from DH to NFCC, Responses and Notifications are only allowed in the other direction. Control Messages are transmitted in NCI Control Packets, NCI supports segmentation of Control Messages into multiple Packets. The NCI Core defines a basic set of Control Messages, e.g. for setting and retrieving of NFCC configuration parameters. NCI Modules can define additional Control Messages. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 11 of 127 UM10936 PN7150 User Manual DH NFCC Command Response Notification Control Message Exchange Fig 9. Control Message Exchange 2.2.2 Data Messages Data Messages are used to transport data to either a Remote NFC Endpoint (named RF Communication in NCI) or to an NFCEE (named NFCEE Communication). NCI defines Data Packets enabling the segmentation of Data Messages into multiple Packets. Data Messages can only be exchanged in the context of a Logical Connection. As a result, a Logical Connection must be established before any Data Messages can be sent. One Logical Connection, the Static RF Connection, is always established during initialization of NCI. The Static RF Connection is dedicated to be used for RF Communication. Additional Logical Connections can be created for RF and/or NFCEE Communication. Logical Connections provide flow control for Data Messages in the direction from DH to NFCC. DH DH NFCC NFCC Data Data Data Message Exchange Fig 10. Data Message Exchange UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 12 of 127 UM10936 PN7150 User Manual 2.2.3 Interfaces An NCI Module may contain one Interface. An Interface defines how a DH can communicate via NCI with a Remote NFC Endpoint or NFCEE. Each Interface is defined to support specific protocols and can only be used for those protocols (the majority of Interfaces support exactly one protocol). NCI defines two types of Interfaces: RF Interfaces and NFCEE Interfaces. Protocols used to communicate with a Remote NFC Endpoint are called RF Protocols. Protocols used to communicate with an NFCEE are called NFCEE Protocols. An NFCEE Interface has a one-to-one relationship to an NFCEE Protocol, whereas there might be multiple RF Interfaces for one RF Protocol. The later allows NCI to support different splits of the protocol implementation between the NFCC and DH. An NCI implementation on an NFCC should include those RF Interfaces that match the functionality implemented on the NFCC. Interfaces must be activated before they can be used and they must be deactivated when they are no longer used. An Interface can define its own configuration parameters and Control Messages, but most importantly it must define how the payload of a Data Message maps to the payload of the respective RF or NFCEE Protocol and, in case of RF Communication, whether the Static RF Connection is used to exchange those Data Messages between the DH and the NFCC. 2.2.4 RF Communication RF Communication is started by configuring and running the polling loop (RF discovery sequences in loops). The RF discovery sequence involved the NCI module called RF discovery. This module discovers and enumerates Remote NFC Endpoints. For each Remote NFC Endpoint, the RF Discovery module provides the DH with the information about the Remote NFC Endpoint gathered during the RF Discovery sequence. One part of this information is the RF Protocol that is used to communicate with the Remote NFC Endpoint. During RF Discovery module configuration, the DH must configure a mapping that associates an RF Interface for each RF Protocol. If only a single Remote NFC Endpoint is detected during one discovery sequence, the RF Interface for this Endpoint is automatically activated. If there are multiple Remote NFC Endpoints detected during the Poll phase, the DH can select the Endpoint it wants to communicate with. This selection also triggers the activation of the mapped Interface. After an RF Interface has been activated, the DH can communicate with the Remote NFC Endpoint using the activated RF Interface. An activated RF Interface can be deactivated by either the DH or the NFCC (e.g. on behalf of the Remote NFC Endpoint). However, each RF Interface can define which of those methods are allowed. Depending on which part of the protocol stack is executed on the DH there are different deactivation options. For example, if a protocol command to tear down the communication is handled on the DH, the DH will deactivate the RF Interface. If such a command is handled on the NFCC, the NFCC will deactivate the Interface. This specification describes Communication in the form of a state machine. the possible Control Message sequences for RF UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 13 of 127 UM10936 PN7150 User Manual 2.2.5 NFCEE Communication The DH can learn about the NFCEEs connected to the NFCC by using the NFCEE Discovery module. During NFCEE Discovery the NFCC assigns an identifier for each NFCEE. When the DH wants to communicate with an NFCEE, it needs to open a Logical Connection to the NFCEE using the corresponding identifier and specifying the NFCEE Protocol to be used. Opening a Logical Connection to an NFCEE automatically activates the NFCEE Interface associated to the protocol specified. As there is always a one-to-one relationship between an NFCEE Protocol and Interface, there is no mapping step required (different as for the RF Communication). After the Interface has been activated, the DH can communicate with the NFCEE using the activated Interface. Closing the connection to an NFCEE Interface deactivates that NFCEE Interface. NCI also includes functionality to allow the DH to enable or disable the communication between an NFCEE and the NFCC. 2.2.6 Identifiers The NFCC might only be used by the DH but also by the NFCEEs in the device (in such a case the NFCC is a shared resource). NFCEEs differ in the way they are connected to the NFCC and the protocol used on such a link determines how an NFCEE can use the NFCC. For example, some protocols allow the NFCEE to provide its own configuration for RF parameters to the NFCC (similar to the NCI Configuration Parameters for RF Discovery) in other cases the NFCEE might not provide such information. NFCCs can have different implementation in how they deal with multiple configurations from DH and NFCEEs. They might for example switch between those configurations so that only one is active at a time or they might attempt to merge the different configurations. During initialization NCI provides information for the DH whether the configuration it provides is the only one or if the NFCC supports configuration by NFCEEs as well. NCI includes a module, called Listen Mode Routing, with which the DH can define where to route received data when the device has been activated in Listen Mode. The Listen Mode Routing allows the DH to maintain a routing table on the NFCC. Routing can be done based on the technology or protocol of the incoming traffic or based on application identifiers in case [7816-4] APDU commands are used on top of ISO-DEP. In case of PN7150 the only route is the DH-NFCEE, therefore no Listen Mode Routing programming supported. In addition, NCI enables the DH to get informed if communication between an NFCEE and a Remote NFC Endpoint occurs. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 14 of 127 UM10936 PN7150 User Manual 2.3 NCI Packet Format 2.3.1 Common Packet Header All Packets have a common header, consisting of an MT field and a PBF field:
3
(bits) MT 1 P B F Information Octet 0 Octet 1 - N Fig 11. NCI Core Packet Format Message Type (MT) The MT field indicates the contents of the Packet and SHALL be a 3 bit field containing one of the values listed in Table 1, below. The content of the Information field is dependent on the value of the MT field. The receiver of an MT designated as RFU SHALL silently discard the packet. Table 1. MT values MT Description 000b 001b 010b 011b Data Packet Control Packet - Command Message as a payload Control Packet - Response Message as a payload Control Packet Notification Message as a payload 100b-111b RFU Packet Boundary Flag (PBF) The Packet Boundary Flag (PBF) is used for Segmentation and Reassembly and SHALL be a 1 bit field containing one of the values listed in [NCI] specification. Table 2. PBF PBF Value Description 0b 1b The Packet contains a complete Message, or the Packet contains the last segment of a segmented Message The Packet contains a segment of a Message which is not the last segment. The following rules apply to the PBF flag in Packets:
If the Packet contains a complete Message, the PBF SHALL be set to 0b. If the Packet contains the last segment of a segmented Message, the PBF SHALL be set to 0b. If the packet does not contain the last segment of a segmented Message, the PBF SHALL be set to 1b. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 15 of 127 UM10936 PN7150 User Manual 2.3.2 Control Packets The Control Packet structure is detailed below. Packet Header 3 MT 1 P B F 4 GID 1 1 R F U R F U 6 8 OID Payload Length (L) L bytes Payload Octet 0 Octet 1 Octet 2 Octet 3... Octet (2+L) Fig 12. Control Packet Format Each Control Packet SHALL have a 3 octet Packet Header and MAY have additional payload for carrying a Control Message or a segment of Control Message. NOTE In the case of an empty Control Message, only the Packet Header is sent. Message Type (MT) Refer to section 2.3.1 for details of the MT field. Packet Boundary Flag (PBF) Refer to section 2.3.1 for details of the PBF field. Group Identifier (GID) The NCI supports Commands, Responses and Notifications which are categorized according their individual groups. The Group Identifier (GID) indicates the categorization of the message and SHALL be a 4 bit field containing one of the values listed in [NCI]
specification. All GID values not defined in [NCI] specification are RFU. Opcode Identifier (OID) The Opcode Identifier (OID) indicates the identification of the Control Message and SHALL be a 6 bit field which is a unique identification of a set of Command, Response or Notification Messages within the group (GID). OID values are defined along with the definition of the respective Control Messages described in [NCI] specification. Payload Length (L) The Payload Length SHALL indicate the number of octets present in the payload. The Payload Length field SHALL be an 8 bit field containing a value from 0 to 255. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 16 of 127 UM10936 PN7150 User Manual L bytes Payload 2.3.3 Data Packets The Data Packet structure is detailed below. Packet Header 4 8 8 3 MT 1 P B F Conn ID Octet 0 RFU Octet 1 Payload Length (L) Octet 2 Octet 3 ... Octet (2+L) Fig 13. Data Packet Structure Each Data Packet SHALL have a 3 octet Packet Header and MAY have additional Payload for carrying a Data Message or a segment of a Data Message. NOTE: In the case of an empty Data Message, only the Packet Header is sent. Message Type (MT) Refer to section 2.3.1 for details of the MT field. Packet Boundary Flag (PBF) Refer to section 2.3.1 for details of the PBF field. Connection Identifier (Conn ID) The Connection Identifier (Conn ID) SHALL be used to indicate the previously setup Logical Connection to which this data belongs. The Conn ID is a 4 bit field containing a value from 0 to 15. Payload Length (L) The Payload Length field indicates the number of Payload octets present. The Payload Length field is an 8 bit field containing a value from 0 to 255. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 17 of 127 UM10936 PN7150 User Manual 2.3.4 Segmentation and Reassembly The Segmentation and Reassembly functionality SHALL be supported by both the DH and the NFCC. Segmentation and Reassembly of Messages SHALL be performed independently for Control Packets and Data Packets of each Logical Connection. Any NCI Transport Mapping is allowed to define a fixed Maximum Transmission Unit (MTU) size in octets. If such a Mapping is defined and used, then if either DH or NFCC needs to transmit a Message (either Control or Data Message) that would generate a Packet
(including Packet Header) larger than the MTU, the Segmentation and Reassembly (SAR) feature SHALL be used on the Message. The following rules apply to segmenting Control Messages:
For each segment of a Control Message, the header of the Control Packet SHALL contain the same MT, GID and OID values. From DH to NFCC: the Segmentation and Reassembly feature SHALL be used when sending a Command Message from the DH to the NFCC that would generate a Control Packet with a payload larger than the Max Control Packet Payload Size reported by the NFCC at initialization. Each segment of a Command Message except for the last SHALL contain a payload with the length of Max Control Packet Payload Size. From NFCC to DH: when an NFCC sends a Control Message to the DH, regardless of the length, it MAY segment the Control Message into smaller Control Packets if needed for internal optimization purposes. The following rules apply to segmenting Data Messages:
For each segment of a Data Message, the header of the Data Packet SHALL contain the same MT and Conn ID. From DH to NFCC: if a Data Message payload size exceeds the Max Data Packet Payload Size, of the connection then the Segmentation and Reassembly feature SHALL be used on the Data Message. From NFCC to DH: when an NFCC sends a Data Message to the DH, regardless of the payload length it MAY segment the Data Message into smaller Data Packets for any internal reason, for example for transmission buffer optimization. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 18 of 127 UM10936 PN7150 User Manual 3. DH interface 3.1 Introduction The IC interface of the PN7150 is compliant with the IC Bus Specification V3.0, including device ID and Soft Reset. It is slave-only, i.e. the SCL signal is an input driven by the host.
NCI packets can be as long as 258 Bytes. If the DH IC peripheral has a buffer limitation which is below 258 Bytes, then a fragmentation mechanism SHALL be used at the IC transport layer, as defined in 3.6. The PN7150 IC interface supports standard (up to 100kbps), fast-Speed mode (up to 400kbps) and High Speed mode (up to 3.4Mbit/s). IC defines two different modes of addressing (7-bit & 10-bit). The PN7150 only supports the 7-bit addressing mode. The PN7150 IC 7-bit address can be configured from 0x28 to 0x2B. The 2 least significant bits of the slave address are electrically forced by pins I2C_ADR0 and I2C_ADDR1 of the PN7150. So, in binary format, the PN7150 slave 7-bit address is:
0 1 0 1 0 I2C_ADDR1 I2C_ADDR0 Table 3. PN7150 IC slave address Address Value I2C_ADDR1 Pin I2C_ADDR0 Pin 0x28 0x29 0x2A 0x2B 0 0 1 1 0 1 0 1 This can be easily configured through direct connection of pins I2C_ADDR0 and I2C_ADDR1 to either GND or PVDD at PCB level. 3.2 NCI Transport Mapping In the PN7150, there is no additional framing added for IC: an NCI packet (either data or control message, as defined in chapter 2.3) is transmitted over IC as is, i.e. without any additional Byte (no header, no CRC etc). 3.3 Write Sequence from the DH As the IC clock is mastered by the DH, only the DH can initiate an IC exchange. A DH write sequence always starts with the sending of the PN7150 IC Slave Address followed by the write bit (logical 0: 0b). Then the PN7150 IC interface sends an IC ACK back to the DH for each data byte written by the DH. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 19 of 127 UM10936 PN7150 User Manual It may send an IC NACK (negative acknowledge) when none of the buffers used by the NCI core in the PN7150 is free, which may happen in case PN7150 is in standby mode. If one single byte of a complete NCI frame is NACKed by the PN7150, the DH has to re-
send the complete NCI frame and not only this single byte. IC Slave Address
+ R/W bit = 0b NCI Header Byte 0 NCI Header Byte 1 NCI Payload Length NCI Payload Byte 0 NCI Payload Byte n-2 NCI Payload Byte n-1 NCI Payload Byte n p o t S C I t r a t S C I SCL SDA IRQ Fig 14. IC Write sequence
It may happen that PN7150 has an NCI Message ready to be sent to the DH while it is receiving another NCI Message from the DH. In such a condition, the IRQ pin will be raised somewhere during the Write Sequence: this is not an error and has to be accepted by the DH: once the Write Sequence is completed, the DH has to start a Read Sequence (see 3.4). 3.4 Read Sequence from the DH The DH shall never initiate a spontaneous IC read request. The DH shall wait until it is triggered by the PN7150. To trigger the DH, the PN7150 generates a logical transition from Low to High on its IRQ pin (if the IRQ pin is configured to be active High; see configuration chapter 10.1). So after writing any NCI command, the DH shall wait until the PN7150 raises its IRQ pin. The DH can then transmit a Read request to fetch the NCI answer from the PN7150. When the PN7150 needs to send a spontaneous notification to the DH (for instance an RF Interface activation notification), the PN7150 raises the IRQ pin and the DH performs a normal read as described above. A DH Read Sequence always starts by the sending of the PN7150 IC Slave Address followed by the read bit (logical 1). Then the DH IC interface sends an ACK back to the PN7150 for each data Byte received. Fig 15 is an example where the IRQ is raised so the DH can proceed a read. DH knows how often to Apply the clock If the DH sends more clocks, zeros will be sent p o t S C I IC Slave Address
+ R/W bit = 1b NCI Header Byte 0 NCI Header Byte 1 NCI Payload Length NCI Payload Byte 0 NCI Payload Byte n-2 NCI Payload Byte n-1 NCI Payload Byte n t r a t S C I SCL SDA IRQ NFCC requests a transfer If NFCC requests a transfer, but DH sets R/W bit to 0b, IRQ will remain high. All data has been read, IRQ is reset Fig 15. IC Read sequence UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 20 of 127 UM10936 PN7150 User Manual As indicated on Fig 15, in case the PN7150 requests a data transfer by raising the IRQ pin and the DH tries to initiate a write sequence by positioning the write bit to 0b, the PN7150 keeps the IRQ active until the DH starts a read sequence. The DH is not allowed to proceed with a write sequence once the PN7150 has set the IRQ pin to its active value (logical 1 in Fig 15). If PN7150 has another message ready to be sent to the DH before the end of the on-going Read Sequence, the IRQ pin will be first deactivated at the end of the on-going Read Sequence and then re-activated to notify to the DH that a new message has to be read. 3.5 Split mode The PN7150 supports the interruption of a frame transfer, as defined in [IC]. This feature is only available in Read Mode; it is forbidden to use it in Write Mode. This can be useful in a system where the IC bus is shared between several peripherals:
it allows the host to stop an on-going exchange, to switch to another peripheral (with a different slave address) and then to resume the communication with the PN7150. Another typical use-case for the split mode is to have the DH reading first the NCI packet header, to know what the Payload length is. The DH can then allocate a buffer with an appropriate size and read the payload data to fill this buffer. This use-case is represented on Fig 16:
DH can split the IC Read transfer p o t S C I t r a t S C I p o t S C I IC Slave Address
+ R/W bit = 1b NCI Header Byte 0 NCI Header Byte 1 NCI Payload Length IC Slave Address
+ R/W bit = 1b NCI Payload Byte 0 NCI Payload Byte n t r a t S C I SCL SDA IRQ Fig 16. IC Read sequence with split mode 3.6 Optional transport fragmentation PN7150 comes with an optional transport fragmentation on IC, which can be enabled/disabled thanks to bit b4 in IRQ_POLARITY_CFG (see 10.1). This fragmentation can only be used from the DH to the PN7150: there is no fragmentation available from the PN7150 to the DH. This fragmentation is purely implemented at the IC transport layer and does not interfere with NCI segmentation, which remains possible on top. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 21 of 127 UM10936 PN7150 User Manual
The IC fragmentation implemented on PN7150 requires that the DH waits until it has received a Control Message of type Response in response to a Control Message of type Command before it can send any Data Message. The DH also has to wait until it has received a Credit Notification to release the credit consumed by a previous Data Message it has sent, before it can send a new Control Message of type Command. 3.6.1 Description of the IC fragmentation:
If the DH has limited capabilities to transport Frames of Bytes over IC (so below the maximum frame size of an NCI packet which is equal to 258 Bytes), it SHALL send the NCI packet into several fragments, according to the following rules:
The fragment size has to be an integer multiple of 4 Bytes (excluding the Slave Address Byte required by the IC protocol). The minimum fragment size supported by the DH has to be long enough to transport the following sequence of commands, which is necessary to enable the feature by setting bit b4 in the IRQ_POLARITY_CFG parameter (see 10.1):
- CORE_RESET_CMD
- CORE_INIT_CMD
- NCI_PROPRIETARY_ACT_CMD
- CORE_SET_CONFIG_CMD To implement a flow control mechanism, the DH has to follow the following sequence:
1. The DH sends a first fragment of an NCI data packet. 2. The DH waits for WaitTime = 500s 3. The DH writes the [Address & R/Wn] Byte over the IC bus; it has then to check the IC ACK bit generated by PN7150:
a. If the ACK bit is not set, this means that PN7150 is still processing the previous fragment of the NCI packet and it is not yet ready to receive the next fragment. The DH has to wait for an additional WaitTime, moving back to step 2. b. If the ACK bit is set, the DH can move to step 4. 4. The DH transmits the next Fragment 5. If the whole NCI packet has not yet been transmitted, the DH proceeds to step 2 with another fragment. If the whole NCI packet has been transmitted, the sequence is stopped. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 22 of 127 UM10936 PN7150 User Manual The next figure shows this sequence:
DH sends the 1st Fragment DH waits for WaitTime = 500s DH sends IC
[Addr & R/W] Byte Did NFCC acknowledge ?
no yes DH writes the next fragment Is the NCI packet fully transmitted ?
no yes Fig 17. cIC transport fragmentation algorithm, from DH point of view UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 23 of 127 UM10936 PN7150 User Manual 3.6.2 Illustration of the IC fragmentation:
The 2 next figures illustrate a transfer of an NCI message implying IC fragmentation, with a fragment size of 36 Bytes maximum, when:
The NCI message fits over a single NCI packet The NCI message fits over multiple NCI packets (NCI segmentation is used on top of IC fragmentation) Fig 18. IC Fragmentation when 1 NCI message = 1 NCI packet UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 24 of 127 UM10936 PN7150 User Manual Fig 19. IC Fragmentation when 1 NCI message is segmented into NCI packets UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 25 of 127 UM10936 PN7150 User Manual 5. Initialization & Operation configuration 5.1 Reset / Initialization
[NCI] defines a Reset/Initialization sequence, which is based on two different commands:
CORE_RESET_CMD CORE_INIT_CMD These two commands have to be called by the DH in an atomic way: there cannot be any other command in-between and the PN7150 operation cannot start any operation
(Reader/Writer, Card Emulation, P2P, Combined modes etc) if it does not first receive these 2 commands.
[NCI] defines 2 modes for the Reset command: Keep Configuration & Reset Configuration. Here is the detail of the difference between the 2 reset modes:
Table 20. Comparison of the 2 Reset Modes Features CPU reboot NCI Configuration parameters Proprietary Configuration parameters Interface Mapping Table Discovery activity Reset Configuration Keep Configuration Yes Back to default Kept Lost Lost Yes Kept Kept Kept Lost
PN7150 may delay the CORE_RESET_RSP If the DH sends a CORE_RESET_CMD while PN7150 has already indicated that it has some data available to be read by the DH (IRQ pin activated), the DH has first to read the data available from PN7150 before it can get the CORE_RESET_RSP. The reason is that the NCI output buffer in PN7150 needs to be flushed before PN7150 can apply a Reset and then send the CORE_RESET_RSP. 5.2 Manufacturer Specific Information in [NCI] CORE_INIT_RSP The NCI command CORE_INIT_RSP contains a field Manufacturer Specific Information with 4 bytes. Here are the values of these 4 Bytes:
Table 21. Manufacturer specific information in CORE_INIT_RSP Byte Meaning Condition to increment 0 1 2 3 Hardware Version number ROM Code Version number New ROM Code Firmware Major version Firmware Minor version New silicon New Firmware, adding features New Firmware, solving bugs on existing features. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 40 of 127 UM10936 PN7150 User Manual
PN7150B0HN/C11006 exposes FW version 01.AE, while previous IC versions exposes FW version 01.A0. 5.3 Whole sequence to prepare the PN7150 operation After the Reset/Initialization sequence is passed, the PN7150 requires several other steps before it is ready to start operating as a Reader/Writer, Card Emulator etc The simplest case is when the DH issues a CORE_RESET_CMD with Reset Type = Keep Configuration. On this figure, Green background means mandatory exchange DH NFCC Reset / Init Sequence (atomic, cannot be split) CORE_RESET_CMD
(Reset Type = Keep Configuration) CORE_RESET_RSP CORE_INIT_CMD CORE_INIT_RSP Activate NXP proprietary extensions NCI_PROPRIETARY_ACT_CMD NCI_PROPRIETARY_ACT_RSP Start RF Discovery RF_DISCOVER_CMD RF_DISCOVER_RSP Fig 26. Initialization sequence to prepare the PN7150 operation (Keep Configuration) Now, here is the figure which lists the complete sequence, starting by a Reset Command based on Reset Type = Reset Configuration. Since the entire configuration is lost, the PN7150 needs to be reconfigured and various optional steps are added, which might be needed or not, depending on the use case. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 41 of 127 UM10936 PN7150 User Manual On this figure, Green background means mandatory exchange Blue background means optional exchange, depending on the use case. DH NFCC Reset / Init Sequence (atomic, cannot be split) CORE_RESET_CMD
(Reset Type = Reset Configuration) CORE_RESET_RSP CORE_INIT_CMD CORE_INIT_RSP Activate NXP proprietary extensions NCI_PROPRIETARY_ACT_CMD NCI_PROPRIETARY_ACT_RSP Optional: if system includes some NFCEEs NFCEE_DISCOVER_CMD NFCEE_DISCOVER_RSP NFCEE_DISCOVER_NTF RF_NFCEE_DISCOVERY_REQ_NTF RF_NFCEE_DISCOVERY_REQ_NTF Optional: if Protocol to RF Interface default mapping does not fit RF_DISCOVER_MAP_CMD RF_DISCOVER_MAP_RSP Optional: if default RF parameters need to be modifed CORE_SET_CONFIG_CMD CORE_SET_CONFIG_RSP Optional: Load the Listen Mode Routing Table RF_SET_LISTEN_MODE_ROUTING_CMD RF_SET_LISTEN_MODE_ROUTING_RSP Start RF Discovery RF_DISCOVER_CMD RF_DISCOVER_RSP Fig 27. Initialization sequence to prepare the PN7150 operation (Reset configuration) UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 42 of 127 UM10936 PN7150 User Manual 5.4 Proprietary command to enable proprietary extensions It is visible on the previous flow chart that NXP has introduced a proprietary command sent by the DH to enable the proprietary extensions to [NCI], which are available in the PN7150. So, when the PN7150 receives this command NCI_PROPRIETARY_ACT_CMD, it knows that the DH is aware of the proprietary extensions and may therefore send proprietary notifications (see the list in Table 12). If the PN7150 does not receive this proprietary command, it knows that the DH do not understand proprietary extensions and will therefore not send any proprietary notifications. Here is the description of this command:
Table 22. NCI_PROPRIETARY_ACT_CMD GID OID Numbers of parameter(s) Description 1111b 0x02 0 DH informs the PN7150 that it knows the proprietary extensions. Table 23. NCI_PROPRIETARY_ACT_RSP GID OID Numbers of parameter(s) Description 1111b 0x02 2 PN7150 indicates that it understood the command. Table 24. NCI_PROPRIETARY_ACT_RSP parameters Payload Field(s) Length Value/Description STATUS 1 Octet One of the following Status codes, as defined in [NCI_Table1]
0x00 0x03 STATUS_OK STATUS_FAILED Others Forbidden FW_Build_Number 4 Octets NXP internal firmware build number 5.5 Configuration template In order to help the user of the PN7150 to issue the right configuration sequence for a given mode of operation, the present document will detail a typical configuration sequence, based on the following template:
Table 25. Template for a typical configuration sequence Command Main Parameters RF_DISCOVER_MAP_CMD RF Protocol Mode RF Interface CORE_SET_CONFIG_CMD Depends on technology & mode RF_DISCOVER_CMD RF Technology & Mode Values UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 43 of 127 UM10936 PN7150 User Manual 5.6 PLL input Clock Management The PN7150 is flexible in terms of clock sources. It can be either:
a 27.12MHz quartz or a clean clock signal available on the platform on which PN7150 is connected. A PLL inside PN7150 will convert this input clock signal into an internal 27.12MHz used to generate the RF carrier. The input clock frequency has to be one of the predefined set of input frequencies: 13MHz, 19.2MHz, 24MHz, 26MHz, 38.4MHz and 52MHz. The DH has to configure the parameter CLOCK_SEL_CFG (see chapter 10.1) to configure what is the clock source as used in the current application. Table 26. Clock sources supported Name Description XTAL PLL To be selected when a 27.12MHz quartz is used as a clock source To be selected when an input clock is provided to PN7150, with a frequency equal to either 13MHz, 19.2MHz, 24MHz, 26MHz, 38.4MHz or 52MHz The same parameter (CLOCK_SEL_CFG) is used to configure which clock frequency is used as an input to the PLL when this is the clock source in use. In order to optimize system power consumption, it may be required to switch OFF the PLL input clock when the PN7150 does not have to generate the 13.56MHz RF carrier. A dedicated pin (CLKREQ) is used to inform the DH or a clock generating chip that the PN7150 requires to get the PLL input clock, such that it can generate the 13.56MHz RF carrier. PN7150 assumes that the PLL input clock is on and stable after a programmable time-out, which is configured thanks to the parameter CLOCK_TO_CFG (see chapter 10.1). 5.7 Transmitter voltage Configurations The PN7150 supports 2 different configurations, called CFG1 and CFG2. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 44 of 127 UM10936 PN7150 User Manual 5.7.1 CFG1: Transmitter supply voltage from battery supply In CFG 1 VBAT1 and VBAT2 are connected to the Battery and between 2.3V and 5.5V. Fig 28. CFG1: VBAT1 = VBAT2 = 2.3V to 5.5V This configuration is enabled by appropriate setting of PMU_CFG parameter. In addition TVDDReqTime parameter shall be set to 0x00 (see configuration chapter 10.1). 5.7.2 CFG2: Transmitter supply voltage from external 5V supply In CFG 2 VBAT1 is connected to 5V while VBAT2 is connected to the battery (delivering between 2.3V and 5.5V). The internal TXLDO is used to generate a transmitter supply voltage of 4.7V from the external 5V. Fig 29. CFG2: VBAT1 = 5V, VBAT2 = 2.3V to 5.5V This configuration is enabled by appropriate setting of PMU_CFG parameter (see configuration chapter 10.1). UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 45 of 127 UM10936 PN7150 User Manual 6. Reader/Writer Mode 6.1 T1T, T2T, MIFARE Ultralight, MIFARE Classic and MIFARE Plus tags Note: all the Tags/Cards in this category are based on NFC-A technology, but they do not support the ISO-DEP Protocol. MIFARE Plus cards support the ISO-DEP protocol, but only when they are configured in Security Level3, which is out of scope for this section. 6.1.1 Access through the [NCI] Frame RF Interface
[NCI] allows the data exchange with tags T1T, T2T using the Frame RF Interface. Most of the commands of the MIFARE Classic and MIFARE Plus can also be mapped on the Frame RF Interface, but NXP decided to use a separate RF interface (TAG-CMD, see 6.1.2) because some MIFARE Classic commands are split in 2 steps (e.g. Authenticate command) and have a tight response timeout (about 1ms) which can hardly be monitored by the DH through the NFCC. Here is a summary of the Tags/Card based on technology NFC-A which can be accessed through the Frame RF interface Table 27. Tag/Cards accessible over the [NCI] Frame RF Interface Tag/Card Access through the Frame RF Interface T1T T2T MIFARE Ultralight, Ultralight C MIFARE Classic MIFARE Plus for Security levels 1 & 2 Here are the commands and configuration parameters to prepare the Reader/Writer Mode for T1T & T2T through the Frame RF Interface:
Table 28. Config. seq. for R/W of T1T or T2T through the Frame RF Intf Command Main Parameters Values RF_DISCOVER_MAP_CMD*
RF Protocol (choose between the 2 possible protocols) PROTOCOL_T1T PROTOCOL_T2T Mode RF Interface Poll Frame RF Interface CORE_SET_CONFIG_CMD PA_BAIL_OUT*
RF_DISCOVER_CMD RF Technology & Mode NFC_A_PASSIVE_POLL_MODE
* Note: RF_DISCOVER_MAP_CMD is optional since the mapping to Frame RF Intf. is done by default
* this parameter is not active in PN7150: it can be read/written, but PN7150 will always behave with Bail Out in NFC-A, whatever the value written by the DH to that parameter. UM10936 All information provided in this document is subject to legal disclaimers. All rights reserved. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 46 of 127 UM10936 PN7150 User Manual 6.1.2 [PN7150-NCI] extension: TAG-CMD Interface In addition to the incompatibility of the Frame RF Interface with the MIFARE Classic Authenticate command described in the previous chapter, the intention when introducing the TAG-CMD interface was to add some commands such as ReadN/WriteN which would allow to read/write multiple bytes, and would rely on the NFCC to call several times the basic read/write commands defined in the T1T, T2T or MIFARE Classic protocols. Unfortunately, we had to withdraw this concept and the TAG-CMD as implemented in PN7150 is limited to MIFARE Classic operation in Reader/Writer and T2T operation in Reader/Writer when the Sector Select command is required. The figure bellow represents the location of the TAG-CMD RF Interface:
Fig 30. TAG-CMD RF Interface 6.1.3
[PN7150-NCI] extension: Payload structure of the TAG-CMD RF Interface The TAG-CMD RF Interface is using the same data mapping as the one defined for the
[NCI] Frame RF Interface (see section 8.2.1 in [NCI]). However, for the TAG-CMD RF Interface, the Payload is defined differently. Two different structures are defined:
1. REQ (requests) : these are commands from the DH to the NFCC 2. RSP (responses): these are responses from the NFCC to the DH. The diagram below details how the Payload is modified to insert a header, which carries the REQ ID or the RSP ID and some parameters, if required. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 47 of 127 UM10936 PN7150 User Manual NCI data packet structure REQs Frame structure RSPs Frame structure Msg Type Msg Type Msg Type Byte 0 Byte 1 Byte 2 Conn ID RFU Payload Length PAYLOAD Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Conn ID RFU Payload Length REQ ID Parameter 1
(optional) Parameter 2
(optional) DATA (if any) Byte 0 Byte 1 Byte 2 Byte 3 Byte n Conn ID RFU Payload Length RSP ID DATA (if any) RF Status Fig 31. Data message payload for the TAG-CMD Interface Note: REQs and RSPs dont share exactly the same structure:
REQs: Although illustrated with 2 parameters on the figure above, REQs may have no parameters or only one. Some REQuests might also need parameters bigger than 1 Byte. Parsing The REQ ID is the way to know how many parameters follow and how long they are. RSPs: there are no parameters in ReSPonses. A Byte is added at the end of the payload
(after the DATA field) to inform the DH on the RF status (to report RF errors if they were some). The Status codes used are the following:
Table 29. TAG-CMD RF Status code Value 0x00 0x03 0xB0 0xB1 0xB2 Description STATUS_OK STATUS_FAILED RF_TRANSMISSION_ERROR RF_PROTOCOL_ERROR RF_TIMEOUT_ERROR Others Forbidden 6.1.4 [PN7150-NCI] extension: REQs & RSPs rules A REQ command is always going from DH to RF, through the NFCC. A RSP response is always going from the RF to the DH, through the NFCC The DH SHALL wait until it has received a RSP associated to a REQ before it can send a new REQ. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 48 of 127 UM10936 PN7150 User Manual 6.1.5 [PN7150-NCI] extension: List of REQs & RSPs In this section, the following acronyms are used:
Table 30. Acronyms definition Acronym Description T1T MF NFC FORUM Type 1 Tag (based on Topaz/Jewel) MIFARE family, not ISO-DEP compliant, including T2T, MIFARE Ultralight (std or C), MIFARE Classic and MIFARE Plus for Security Level 1 & 2. MFC MIFARE Classic and MIFARE Plus for Security Level 1 & 2. The added REQuests/ReSPonses pairs are listed in the following table:
REQ/RSP Name ID Param 1 Param 2 Param 3 Data Description Table 31. List of REQuests & ReSPonses XCHG_DATA_REQ 0x10 None None None XCHG_DATA_RSP 0x10 N/A N/A N/A Yes MFC: DH sends Raw data to the NFCC, which encrypts them before sending them to MFC. T1T/T2T: DH sends Raw data to the NFCC, which forwards them in plain to the Tag. Yes MFC: DH gets Raw data once RF data from MFC are decrypted by the NFCC, if successful. T1T/T2T: DH gets Raw plain data once the NFCC receives RF data from the Tag, if successful. MF_SectorSel_REQ 0x32 Sector Address None None No T2T & MFU only: DH Sends the address of the Block to select. MF_SectorSel_RSP 0x32 N/A N/A N/A No T2T & MFU only: DH gets the Sector Select response status MFC_Authenticate_REQ 0x40 Sector Address Key Selector Key
(optional) No DH asks NFCC to perform MFC Authenticate command. MFC_Authenticate_RSP 0x40 N/A N/A No DH gets the MFC Authenticate command status All these REQs & RSPs are detailed in the next sections. 6.1.6 [PN7150-NCI] extension: raw data exchange REQs & RSPs Table 32. XCHG_DATA_REQ REQ_ID REQ Name Number of parameter(s) Presence of data Description 0x10 XCHG_DATA_REQ 0 Yes MFC: DH sends Raw data to the NFCC, which encrypts them before sending them to MFC. T1T/T2T: DH sends Raw data to the NFCC, which forwards them in plain to the Tag. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 49 of 127 UM10936 PN7150 User Manual RSP_ID Table 33. XCHG_DATA_RSP Presence of Data Description RSP Name 0x10 XCHG_DATA_RSP Yes MFC: DH gets Raw data once RF data from MFC are decrypted by the NFCC, if successful. T1T/T2T: DH gets Raw plain data once the NFCC receives RF data from the Tag, if successful. If the response from the MF tag in the field is an ACK or a NACK, the ACK/NACK is also sent back to the DH inside the Data field. Since ACK & NACK are 4-bit commands, they are transported on the 4 LSBs of the data Byte; the 4MSBs of that Byte are forced to the logical 0 value. 6.1.7 [PN7150-NCI] extension: T2T & MFU REQs & RSPs All the REQs & RSPs described in this section can be used whatever the tag between:
T2T MIFARE Ultralight (std or C) Table 34. MF_SectorSel_REQ REQ_ID REQ Name Number of parameter(s) Presence of data Description 0x32 MF_SectorSel_REQ 1 No DH Sends the address of the Sector to select. Table 35. MF_SectorSel_REQ parameter Parameter 1 Sector Address Length
(Byte) 1 Value Description
Defines the address of the sector which has to be selected. The address can be any block address in this sector. Table 36. MF_SectorSel_RSP RSP_ID RSP Name Presence of Data Description 0x32 MF_SectorSel_RSP No DH gets sector select status 6.1.8 [PN7150-NCI] extension: MIFARE Classic REQs & RSPs Table 37. MFC_Authenticate_REQ REQ_ID REQ Name Number of parameter(s) Presence of data Description 0x40 MFC_Authenticate_REQ 3 No DH asks NFCC to perform MFC authenticate. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 50 of 127 UM10936 PN7150 User Manual Table 38. MFC_Authenticate_REQ parameters Parameter 1 Sector Address 2 Key Selector Length
(Byte) 1 1 Value Description Address of the sector to authenticate N/A Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 X X Key A (0) or Key B (1) 0 => use pre-loaded key 1 => use Key in param Nbr 3 X X X X Pre-loaded key number (0 to 15) 0 0 RFU 3 Embedded Key
(optional) 6 N/A This parameter is present in the MFC_Authenticate_CMD only if bit b4 is set to logical '1' in Key Selector parameter. If present, this parameter defines the value of the Key used for the Authentication. Table 39. MFC_Authenticate_RSP RSP_ID RSP Name Presence of Data Description 0x40 MFC_Authenticate_RSP No DH gets the authenticate cmd status Table 40. TAG-CMD RF Status code, in the special case of MFC_Authenticate_CMD Value Description 0x00 STATUS_OK Reason Authentication was successful 0x03 STATUS_FAILED Authentication failed (wrong key, time-out triggered during authentication etc) 0xB0 RF_TRANSMISSION_ERROR Not used 0xB1 RF_PROTOCOL_ERROR 0xB2 RF_TIMEOUT_ERROR Not used Not used Others Forbidden Once a sector is authenticated, PN7150 will automatically encrypt any data sent by the DH to be transferred over RF, thanks to the XCHG_DATA_REQ command. The key used is the one used for the sector currently authenticated. In a symmetrical way, PN7150 will automatically decrypt the data received from RF before it forwards to the DH thanks to the XCHG_DATA_RSP response, again using the key of the sector currently authenticated. Fig 32 illustrates the use of the MFC_Authenticate_REQ & XCHG_DATA_REQ in a typical NFC reader sequence for MIFARE Classic. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 51 of 127 UM10936 PN7150 User Manual DH NCI NFCC RF Endpoint RF_DISCOVER_MAP_CMD
(RF Prot. = MF_CLASSIC,Mode = Poll, RF Intf. = TAG-CMD, ...) RF_DISCOVER_MAP_RSP RF_DISCOVER_CMD(NFC_A_PASSIVE_POLL_MODE, ...) RF_DISCOVER_RSP Map MIFARE Classic prot. to TAG-CMD Intf Start Discovery
(move to RFST_DISCOVERY) RF Field On Activation sequence: driven by the NFCC REQA/ATQA AntiColl CL1 SELECT/SAK NFCC activates the TAG-CMD intf: move to RFST_POLL_ACTIVE RF_INTF_ACTIVATED_NTF
(Prot = MF_CLASSIC, Intf = TAG-CMD.) SAK shows MIFARE Classic with bit b4=1b (see AN10833). Authentication to sector 0: triggered by DH, executed by NFCC NCI_DATA_MSG
(MFC_Authenticate_REQ(Sect. Addr = 0, Key)) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(MFC_Authenticate_RSP)
[MIFARE Authent.]_Plain Token RB Token AB_encrypted_Sect0 Token BA_encrypted_Sect0 NFCC encrypts/decrypts data using the key for sector 0 Commands sent by DH on Authenticated Sector 0 NCI_DATA_MSG(XCHG_DATA_REQ(MF_CMD1)) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(XCHG_DATA_RSP(MF_RSP1)) NCI_DATA_MSG(XCHG_DATA_REQ(MF_CMDn)) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(XCHG_DATA_RSP(MF_RSPn)) NCI_DATA_MSG
(MFC_Authenticate_REQ(Sect. Addr = S, Key)) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(MFC_Authenticate_RSP)
[MF_CMD1]_encrypted_Sect0
[MF_RSP1]_encrypted_Sect0
[MF_CMDn]_encrypted_Sect0
[MF_RSPn]_encrypted_Sect0
[MIFARE Authent. Step1]_ encrypted_Sect0
[MIFARE Authent. Step2]_ encrypted_SectS Authentication to sector S: triggered by DH, executed by NFCC NFCC still encrypts/decrypts data using the key for sector 0 Commands sent by DH on Authenticated Sector S SEND DATA (XCHG_DATA_REQ(MF_CMD1)) NFCC encrypts/decrypts data using the key for sector S CORE_CONN_CREDITS_NTF SEND DATA (XCHG_DATA_RSP(MF_RSP1)) SEND DATA (XCHG_DATA_REQ(HLTA)) CORE_CONN_CREDITS_NTF SEND DATA (XCHG_DATA_RSP()) RF_DEACTIVATE_CMD(Discovery) RF_DEACTIVATE_RSP RF_DEACTIVATE_NTF Fig 32. Reader Sequence for MIFARE Classic
[MF_CMD1]_encrypted_SectS
[MF_RSP1]_encrypted_SectS DH sends a HLTA cmd to close the MFC transaction
[HLTA]_encrypted_SectS
[NACK]_encrypted_SectS DH stops the communication by deactivating the TAG-CMD RF intf RF Field OFF UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 52 of 127 UM10936 PN7150 User Manual 6.1.9 Access through the TAG-CMD RF Interface The TAG-CMD RF interface allows full access to all the Tags based on NFC-A technology and not supporting the ISO-DEP protocol, leaving up to the PN7150 to manage the low level TAG-CMD:
Table 41. Tag/Cards accessible over the TAG-CMD Interface Tag/Card Access through the TAG-CMD Interface T1T T2T MIFARE Ultralight, Ultralight C MIFARE Classic MIFARE Plus for Security levels 1 & 2 Here are the commands and configuration parameters to prepare the Reader/Writer Mode for T1T, T2T, and MIFARE Classic through the TAG-CMD Interface:
Table 42. Config. seq. for R/W of T1T, T2T & MFC through the TAG-CMD Interface Command Main Parameters Values RF_DISCOVER_MAP_CMD PROTOCOL_MIFARE_CLASSIC RF Protocol (choose between the 3 possible protocols) PROTOCOL_T1T PROTOCOL_T2T Mode RF Interface Poll TAG-CMD CORE_SET_CONFIG_CMD PA_BAIL_OUT 1 RF_DISCOVER_CMD RF Technology & Mode NFC_A_PASSIVE_POLL_MODE 1 this parameter is not active in PN7150: it can be read/written, but PN7150 will always behave with Bail Out in NFC-A, whatever the value written by the DH to that parameter. 6.2 T3T tag
[NCI] allows the data exchange with a tag T3T by using the Frame RF Interface, so there is no need to add proprietary extensions here. 6.2.1 Access through the Frame RF Interface Here are the commands and configuration parameters to prepare the Reader/Writer Mode for T3T Tags/Cards through the Frame RF Interface:
Table 43. Config. seq. for R/W of T3T through the Frame RF Interface Command Main Parameters Values RF Protocol PROTOCOL_T3T RF_DISCOVER_MAP_CMD Mode CORE_SET_CONFIG_CMD PF_BIT_RATE RF Interface Poll Frame UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 53 of 127 UM10936 PN7150 User Manual Command Main Parameters Values PF_RC_CODE RF_DISCOVER_CMD RF Technology & Mode NFC_F_PASSIVE_POLL_MODE 6.3 T4T & ISO-DEP Tags/Cards
[NCI] allows the data exchange with a T4T tag or an ISO-DEP tag by using the Frame RF Interface or the ISO-DEP RF Interface, so there is no need to define a proprietary RF interface here. 6.3.1 Access through the Frame RF Interface The Frame RF interface allows full access to all the Tags based on NFC-A & NFC-B technology and supporting the ISO-DEP protocol, assuming that the ISO-DEP protocol is fully handled by the DH:
Table 44. Tag/Cards accessible over the Frame RF Interface Tag/Card T4T MIFARE DESFire MIFARE Plus for Security levels 3 JCOP-based smart cards Access through Frame RF Interface the Here are the commands and configuration parameters to prepare the Reader/Writer Mode for ISO-DEP Tags/Cards through the Frame RF Interface for technology NFC-A:
Table 45. Config. seq. for R/W of NFC-A / ISO-DEP through the Frame RF interface Command Main Parameters Values RF Protocol PROTOCOL_ISO-DEP RF_DISCOVER_MAP_CMD *
Mode CORE_SET_CONFIG_CMD PA_BAIL_OUT 1 RF Interface Poll Frame RF_DISCOVER_CMD RF Technology & Mode NFC_A_PASSIVE_POLL_MODE
* Note: RF_DISCOVER_MAP_CMD is optional since the mapping to Frame RF Intf. is done by default 1 this parameter is not active in PN7150: it can be read/written, but PN7150 will always behave with Bail Out in NFC-A, whatever the value written by the DH to that parameter. Here are the commands and configuration parameters to prepare the Reader/Writer Mode for ISO-DEP Tags/Cards through the Frame RF Interface for technology NFC-B:
Table 46. Config. seq. for R/W of NFC-B / ISO-DEP through the Frame RF interface Command Main Parameters Values RF_DISCOVER_MAP_CMD * RF Protocol PROTOCOL_ISO-DEP UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 54 of 127 UM10936 PN7150 User Manual Command Main Parameters Mode RF Interface PB_AFI Values Poll Frame CORE_SET_CONFIG_CMD PB_BAIL_OUT 1 PB_SENSB_REQ_PARAM 2 RF_DISCOVER_CMD RF Technology & Mode NFC_B_PASSIVE_POLL_MODE
* Note: RF_DISCOVER_MAP_CMD is optional since the mapping to Frame RF Intf. is done by default 1 this parameter is not active in PN7150: it can be read/written, but PN7150 will always behave with Bail Out in NFC-A, whatever the value written by the DH to that parameter. 2 this parameter is not supported in PN7150: STATUS_INVALID_PARAM will be returned to the DH if it attempts to write this parameter. 6.3.2 Access through the ISO-DEP RF Interface The ISO-DEP RF interface allows full access to all the Tags based on NFC-A & NFC-B technology and supporting the ISO-DEP protocol, leaving up to the PN7150 to manage the ISO-DEP protocol:
Table 47. Tag/Cards accessible over the ISO-DEP RF Interface Tag/Card T4T MIFARE DESFire MIFARE Plus for Security levels 3 JCOP-based smart cards Access through the ISO-
DEP RF Interface Here are the commands and configuration parameters to prepare the Reader/Writer Mode for ISO-DEP through the ISO-DEP Interface for technology NFC-A:
Table 48. Config. seq. for R/W of NFC-A / ISO-DEP through the ISO-DEP interface Command Main Parameters Values RF Protocol PROTOCOL_ISO-DEP RF_DISCOVER_MAP_CMD Mode RF Interface PA_BAIL_OUT 1 CORE_SET_CONFIG_CMD PI_BIT_RATE PA_ADV_FEAT 3 Poll ISO-DEP RF_DISCOVER_CMD RF Technology & Mode NFC_A_PASSIVE_POLL_MODE 1 this parameter is not active in PN7150: it can be read/written, but PN7150 will always behave with Bail Out in NFC-A, whatever the value written by the DH to that parameter. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 55 of 127 UM10936 PN7150 User Manual 2 this parameter is not supported in PN7150: STATUS_INVALID_PARAM will be returned to the DH if it attempts to write this parameter. Here are the commands and configuration parameters to prepare the Reader/Writer Mode for ISO-DEP through the ISO-DEP Interface for technology NFC-B:
Table 49. Config. seq. for R/W of NFC-B / ISO-DEP through the ISO-DEP interface Command Main Parameters Values RF Protocol PROTOCOL_ISO-DEP RF_DISCOVER_MAP_CMD Mode RF Interface PB_AFI PB_BAIL_OUT 1 CORE_SET_CONFIG_CMD PB_H_INFO PI_BIT_RATE PB_SENSB_REQ_PARAM 3 Poll ISO-DEP RF_DISCOVER_CMD RF Technology & Mode NFC_B_PASSIVE_POLL_MODE 1 this parameter is not active in PN7150: it can be read/written, but PN7150 will always behave with Bail Out in NFC-A, whatever the value written by the DH to that parameter. 2 this parameter is not supported in PN7150: STATUS_INVALID_PARAM will be returned to the DH if it attempts to write this parameter. 6.3.3 [PN7150-NCI] extension: Presence check Command/Response When a Tag/Card has been activated in Poll Mode, the RF State Machine is then in state RFST_POLL_ACTIVE. It is useful for the DH to know if the card is still in the field or not, especially at the end of the transaction. For that purpose, NXP has added a proprietary command to check the Tag/Card presence. All the rules defined for command/response in [NCI] (section 3.2) apply to the command defined here. Here are two additional rules:
The DH can use this command ONLY if the RF State Machine is in state RFST_POLL_ACTIVE. PN7150 will respond STATUS_SEMANTIC_ERROR in case this command is sent in any other state The DH can use this command ONLY if the active protocol is either ISO-DEP or NFC-DEP Table 50. RF_PRES-CHECK_CMD GID OID Numbers of parameter(s) Description 1111b 0x11 0 The DH asks to know if the ISO-DEP Tag/Card is in the field or not. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 56 of 127 UM10936 PN7150 User Manual Table 51. RF_PRES-CHECK_RSP GID OID Numbers of parameter(s) Description 1111b 0x11 1 The NFCC acknowledges the command received from the DH. Table 52. RF_PRES-CHECK_RSP parameters Payload Field(s) Length Value/Description STATUS 1 Octet One of the following Status codes, as defined in [NCI_Table1]
0x00 0x01 0x06 STATUS_OK STATUS_REJECTED STATUS_SEMANTIC_ERROR Others Forbidden Table 53. RF_PRES-CHECK_NTF GID OID Numbers of parameter(s) Description 1111b 0x11 1 NFCC indicates if the ISO-DEP Tag/Card is still in the field or not. Table 54. RF_PRES-CHECK_NTF parameters Payload Field(s) Length Value/Description Presence 1 Octet 0x00 0x01 Card no more in the field Card still in the field 0x02-0xFF RFU 6.3.4
[PN7150-NCI] extension: S-Block Command/Response In some circumstances the DH may want to send specific S-Block to the remote card. All the rules defined for command/response in [NCI] (section 2.2) apply to the commands defined here. Here are two additional rules:
The DH SHALL not issue these commands if the ISO-DEP RF Interface is not activated. If the DH issues such a command although the ISO-DEP RF Interface is not activated, the NFCC SHALL send the corresponding response with STATUS set to STATUS_SEMANTIC_ERROR. Table 55. RF_T4T_SBLOCK_PARAM_CMD GID OID Numbers of parameter(s) Description 1111b 0x10 1 Command to allow the DH to send S-Block S(PARAMETERS) over RF. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 57 of 127 UM10936 PN7150 User Manual Table 56. RF_T4T_SBLOCK_PARAM_CMD parameters Payload Field(s) Length Value/Description ABI N* Octets S-Block S(PARAMETERS) to send;
* PN7150 supports maximum 10 Bytes for ABI length the payload only has to be provided (i.e. PARAMETERS), NFCC will encapsulate it in an S-Block. Table 57. RF_T4T_SBLOCK_PARAM_RSP GID OID Numbers of parameter(s) Description 1111b 0x10 1 The NFCC acknowledges the command received from the DH. Table 58. RF_T4T_SBLOCK_PARAM_RSP parameters Payload Field(s) Length Value/Description STATUS 1 Octet 0x00 0x01 0x06 STATUS_OK STATUS_REJECTED STATUS_SEMANTIC_ERROR Others Forbidden Table 59. RF_T4T_SBLOCK_PARAM_NTF GID OID Numbers of parameter(s) Description 1111b 0x10 2 The NFCC sends the response S-Blocks S(PARAMETERS) to the DH. Table 60. RF_T4T_SBLOCK_PARAM_NTF parameters Payload Field(s) ABT Length Value/Description N1 Octets Response received on RF to the S-Block sent. STATUS If there is no error on RF, the payload only is provided (i.e. PARAMETERS), NFCC will extract it from the received S-Block. If there is an RF error, this field is empty. 0x00 0x02 0xB0 0xB1 0xB2 STATUS_OK STATUS_RF_FRAME_CORRUPTED RF_TRANSMISSION_ERROR RF_PROTOCOL_ERROR RF_TIMEOUT_ERROR Others Forbidden 1 PN7150 supports maximum 10 Bytes for ABT length UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 58 of 127 UM10936 PN7150 User Manual 6.3.5
[PN7150-NCI] extension: WTX notification After data was sent to the card/tag, it can request an additional processing time before sending data response. This is done with WTX (Waiting Time Extension) request. If WTX REQ/RESP exchange phase continues a NCI system notification WTX is sent with a period configurable via READER_FWITOX_NTF_CFG. Table 61. PH_NCI_OID_SYSTEM_WTX GID OID Numbers of parameter(s) Description 1111b 0x17 0 Notification indicating that RF communication is in phase of WTX(RTOX) REQ/RESP exchange for longer period of time. 6.3.6
[PN7150-NCI] extension: Higher bit rates in Poll NFC-A & NFC-B
[NCI] does not officially support the use of higher bit rates in technology NFC-A & NFC-
B. PN7150 offers 4 different bit rates for these technologies, which can be used either in Poll Mode (to read/write an external Card/Tag) or in Listen Mode (to emulate a card):
1. 106 kbps (default bit rate, always used during activation) 2. 212 kbps 3. 424 kbps 4. 848 kbps Everything is prepared (see the RF configuration parameter PI_BIT_RATE), except for the ISO-DEP RF Interface activation. As currently defined in [NCI], the ISO-DEP RF interface activation for technology NFC-A is incompatible with bit rates higher than 106kbps, since this requires to handle the PPS commands exchange, which is not addressed in [NCI]. So the PN7150 implements an ISO-DEP RF Interface activation which is different from the one described in [NCI_Chap1] (see chapter 15). Here is a copy of this chapter, where the modification as implemented in the PN7150 is highlighted in red italic:
______________________ Copied from [NCI]
8.3.2.2 Discovery and Interface Activation To enable Poll Mode for ISO-DEP, the DH sends the RF_DISCOVER_CMD to the PN7150 containing configurations with RF Technology and Mode values of NFC_A_PASSIVE_POLL_MODE and/or NFC_B_PASSIVE_POLL_MODE. ___________________________ When the PN7150 is ready to exchange data (that is, after receiving a response to the protocol activation command from the Remote NFC Endpoint), it sends the RF_INTF_ACTIVATED_NTF to the DH to indicate that this Interface has been activated to be used with the specified Remote NFC Endpoint. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 59 of 127 UM10936 PN7150 User Manual Detailed ISO-DEP RF Interface activation handling in the NFCC:
For NFC-A:
Following the anticollision sequence, if the Remote NFC Endpoint supports ISO-DEP Protocol, the NFCC sends the RATS Command to the Remote NFC Endpoint. And after receiving the RATS response, the PN7150 MAY send the PPS command if PI_BIT_RATE was set by the DH to an allowed value higher than 0x00. It SHALL then send the RF_INTF_ACTIVATED_NTF to the DH to indicate a Remote NFC Endpoint based on ISO-DEP has been activated. The RF_INTF_ACTIVATED_NTF will inform the DH on the actual bit rate used on RF. For NFC-A the RF_INTF_ACTIVATED_NTF SHALL include the Activation Parameters defined in Table 74 (see below). Table 74: Activation Parameters for NFC-A/ISO-DEP Poll Mode Length Description Parameter RATS Response Length 1 Octet Length of RATS Response Parameter (n) RATS Response n Octets All Bytes of the RATS Response as defined in
[DIGITAL] starting from and including Byte 2. ______________________ End of Copy from [NCI] __________________________ 6.4 [PN7150-NCI] extension: 15693 & I-Code tags The current version of the NCI standard allows the data exchange with a tag ISO15693 by using the RF Frame interface. No additional interface is needed for this protocol. However, the data mapping is not yet defined in [NCI], therefore, NXP has defined it for [PN7150-
NCI]. 6.4.1 Access through the Frame RF Interface The Frame RF interface allows full access to all the Tags based on NFC-15693 technology. Here is a list of such tags from the NXP portfolio:
Table 62. NFC-15693 compliant Tag/Cards accessible over the Frame RF Interface Tag/Card I-Code SLI I-Code SLI-L I-Code SLI-S Access through Frame RF Interface the Here are the commands and configuration parameters to prepare the Reader/Writer Mode for NFC-15693 Tags/Cards through the Frame RF Interface:
UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 60 of 127 UM10936 PN7150 User Manual Table 63. Config. seq. for R/W of NFC-15693 through the Frame RF Interface Main Parameters Command Values RF Protocol PROTOCOL_15693 RF_DISCOVER_MAP_CMD *
Mode Poll RF Interface Frame RF RF_DISCOVER_CMD RF Technology & Mode NFC_15693_PASSIVE_POLL_MODE
* Note: RF_DISCOVER_MAP_CMD is optional since the mapping to Frame RF Intf. is done by default 6.4.2 [PN7150-NCI] extension: Specific parameters for NFC_15693 Poll Mode Once PN7150 detects and activates a remote NFC Endpoint based on NFC-15693, PN7150 will activate the Frame RF Interface, providing the following activation parameters:
Table 64. Specific parameters for NFC_15693 Poll Mode Length Parameter 1 Octet 1 Octet Description 1st Byte of the Inventory Response 2nd Byte of the Inventory Response FLAGS DSFID UID 8 Octets 3rd Byte to last Byte of the Inventory Response 6.4.3 [PN7150-NCI] extension: Data Mapping between the DH and RF Data from the DH to RF The NCI Data Message corresponds to the Request Format defined in [ISO15693-3]
Section 7.3. After receiving a Data Message from the DH, the PN7150 appends the appropriate EoD, SOF and EOF and then sends the result in an RF Frame in NFC-15693 technology to the Remote NFC Endpoint. The following figure illustrates the mapping between the NCI Data Message Format and the RF frame when sending the RF frame to the Remote NFC Endpoint. This figure shows the case where NCI Segmentation and Reassembly feature is not used. Data Packet Data Packet Header Payload RF Frame Payload
[EoD]
SOF FLAGS CMD PARAM DATA CRC_1 CRC_2 EOF Fig 33. Format for Frame RF Interface (NFC-15693) for Transmission Although the Frame RF interface is defined to be a transparent interface where the NFCC does not parse/modify the Bytes transmitted by the DH, the following exceptions occur:
UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 61 of 127 UM10936 PN7150 User Manual
PN7150 is parsing the bit Option Flag (bit b7 in the request Flags Byte, as defined in ISO15693) to check if this bit is set by the DH or not. If set, this indicates that the tag is from TI, and PN7150 is sending commands over RF using a special mode, as defined for some commands in ISO15693. Data from RF to the DH The NCI Data Message corresponds to the Payload of the Response Format defined in
[ISO15693-3] Section 7.4, followed by a Status field of 1 octet. After receiving an RF frame, the PN7150 checks and removes the EoD, the SOF & EOF and sends the result in a Data Message to the DH. In case of an error the Data Message may consist of only a part of the Payload of the received RF frame but it will always include the trailing Status field. So the PN7150 may send a Data Message consisting of only the Status field if the whole RF frame is corrupted. If the RF frame was received correctly, the PN7150 sets the Status field of Data Message to a value of STATUS_OK. If the PN7150 detected an error when receiving the RF frame, of of the Status it STATUS_RF_FRAME_CORRUPTED. the Data Message value sets field to a The following figure illustrates the mapping of the RF frame received from the Remote NFC Endpoint in technology NFC-15693 to the Data Message format to be sent to the DH. This figure shows the case where NCI Segmentation and Reassembly feature is not used. RF Frame Payload
[EoD]
SOF FLAGS PARAM DATA CRC_1 CRC-2 EOF Data Packet Data Packet Header Payload Status 254 octets at maximum 1 octet Fig 34. Format for Frame RF Interface (NFC-15693) for Reception 6.4.4 PN7150 behavior with multiple VICCs PN7150 supports collision resolution (using the Inventory command), so it can detect multiple VICCs (2 maximum, as defined for CON_DEVICE_LIMIT in 4.2.5). Here is the behavior when two VICCs are detected and then, one of them is removed from the Field before the DH wants to select it:
in state RFST_DISCOVERY;
is PN7150 RF_DISCOVER_NTF RFST_W4_ALL_DISCOVERIES. to the DH it detects 2 VICCs. for VICC1 and It sends an to moves UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 62 of 127 UM10936 PN7150 User Manual PN7150 is in state RFST_W4_ALL_DISCOVERIES, it sends an RF_DISCOVER_NTF to the DH for VICC2 and moves to RFST_W4_HOST_SELECT. PN7150 is in state RFST_W4_ALL_DISCOVERIES and waits for the DH to select one of the 2 VICCs. Once it receives the RF_DISCOVER_SELECT_CMD from the DH, PN7150 immediately activates the Frame RF Interface and does not check if the selected VICC that PN7150 will not send a CORE_GENERIC_ERROR_NTF (Discovery_Target_Activation_Failed) to the DH if the selected VICC to RFST_POLL_ACTIVE. field anymore. The state field. That means is now changed is still is not the the in in PN7150 is in state RFST_POLL_ACTIVE; it waits for the DH to send some data to transfer over RF. Once it gets this data, PN7150 forwards it over RF. If the selected VICC is not in the field anymore, PN7150 will stay mute and will not send any data back to the DH. The DH has to implement a time-out function, to detect that the VICC is not in the field anymore. Once this timeout is triggered, the DH can de-activate the Frame RF RF_DEACTIVATE_CMD. Interface sending the by 6.5 [PN7150-NCI] extension: KOVIO tags Kovio tags are very particular tags which use a sub-set of NFC-A technology. The basic concept is that the tag is powered from RF Field generated by PN7150, and it will spontaneously generate a 16-Byte ID using NFC-A load modulation, although it did not receive any command from PN7150. Once PN7150 has detected a Kovio tag by capturing its ID, PN7150 will send a RF_INTF_ACTIVATED_NTF, transporting the tag ID as RF parameter. Table 65. Kovio specific RF parameters inside the RF_INTF_ACTIVATED_NF Payload Field(s) Length Value/Description Length of RF Technology Specific Parameters 1 Octet 16 RF Technology Specific Parameters 16 Octets Kovio ID It is then up to the DH to decide when to leave the RFST_POLLING_ACTIVE state, and also to decide if it directly comes back to RFST_DISCOVERY, where the same Kovio Tag may be discovered again, or if it comes back to RFST_IDLE first, in order to wait without any RF activity or re-configuring the RF Discovery so that PN7150 does not poll for a Kovio tag again. Kovio tags are accessed through the [NCI] Frame RF Interface. Due to the very particular behavior of the Kovio tags, it is necessary to configure the RF Discovery specifically for these tags, using the NFC-A_KOVIO_POLL_MODE parameter for the RF_DISCOVER_CMD as highlighted in the table below:
UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 63 of 127 UM10936 PN7150 User Manual Table 66. Config. seq. for R/W of Kovio tags through the Frame RF Intf Command Main Parameters Values RF Protocol PROTOCOL_KOVIO RF_DISCOVER_MAP_CMD*
Mode Poll RF Interface Frame RF Interface CORE_SET_CONFIG_CMD PA_BAIL_OUT1 RF_DISCOVER_CMD RF Technology & Mode NFC_A_KOVIO_POLL_MODE
* Note: RF_DISCOVER_MAP_CMD is optional since the mapping to Frame RF Intf. is done by default 1 this parameter is not active in PN7150: it can be read/written, but PN7150 will always behave with Bail Out in NFC-A, whatever the value written by the DH to that parameter. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 64 of 127 7. Card Emulation Mode UM10936 PN7150 User Manual The PN7150 supports Card Emulation hosted by the DH based on either technology NFC-
A, NFC-B or NFC-F. 7.1 ISO-DEP card emulation through NFC-A & NFC-B
[NCI] defines all the mechanisms necessary to implement this feature. Two options are possible:
1. The DH wants to manage by itself the ISO-DEP protocol; it SHALL then map the ISO-DEP protocol on the Frame RF Interface.
Not supported in PN7150 2. The DH leaves the ISO-DEP protocol management to the NFCC: it SHALL then map the ISO-DEP protocol on the ISO-DEP interface. Here are the commands and configuration parameters to prepare the ISO-DEP Card Emulation for technology NFC-A in the DH through the ISO-DEP RF Interface:
Table 67. Config. seq. for CE of ISO-DEP/NFC-A Command Main Parameters Values RF Protocol PROTOCOL_ISO-DEP RF_DISCOVER_MAP_CMD Mode RF Interface LA_BIT_FRAME_SDD LA_PLATFORM_CONFIG LA_SEL_INFO Listen ISO-DEP CORE_SET_CONFIG_CMD LA_NFCID1 LI_FWI LA_HIST_BY LI_BIT_RATE RF_DISCOVER_CMD RF Technology & Mode NFC_A_PASSIVE_LISTEN_MODE Here are the commands and configuration parameters to prepare the ISO-DEP Card Emulation for technology NFC-B in the DH through the Frame RF Interface:
Table 68. Config. seq. for CE of ISO-DEP/NFC-B Command Main Parameters Values RF Protocol PROTOCOL_ISO-DEP RF_DISCOVER_MAP_CMD Mode CORE_SET_CONFIG_CMD RF Interface LB_SENSB_INFO LB_NFCID0 Listen ISO-DEP UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 65 of 127 UM10936 PN7150 User Manual Command Main Parameters Values LB_APPLICATION_DATA LB_SFGI LB_ADC_FO LI_FWI LB_H_INFO_RESP 1 LI_BIT_RATE RF_DISCOVER_CMD RF Technology & Mode NFC_B_PASSIVE_LISTEN_MODE 1 this parameter is not active in PN7150: it can be read/written, but PN7150 will always behave with empty Higher Layer Response field in the ATTRIB response, whatever the value written by the DH to that parameter. 7.2 T3T card emulation through NFC-F 7.2.1 Configuring the T3T card emulation As described in the NFC specification, several Listen F parameters exist to set up T3T with NCI commands. Table 69. Values to configure the T3T on DH ID Length Values and description LF_T3T_MAX 1 byte LF_T3T_IDENTIFIERS_1 - 4 10 bytes 0 16, defines the maximum amount of LF_T3T_IDENTIFIERS supported by the NFCC. PN7150 supports four maximum. Bytes 0 and 1 define the SC to be used by the T3T. Bytes 2 10 define the NFCID2 value to be used. 7.2.2 Access through the Frame RF Interface The Frame RF interface allows emulating a T3T card, assuming that the DH is able to manage the T3T protocol on its own. Here are the commands and configuration parameters to prepare the T3T Card Emulation for technology NFC-F through the Frame RF Interface:
Table 70. Configuration seq. for ISO-DEP/NFC-A Card Emulation in the DH over Frame RF Interface Command Main Parameters Values RF Protocol PROTOCOL_T3T RF_DISCOVER_MAP_CMD *
Mode CORE_SET_CONFIG_CMD RF Interface LF_T3T_MAX LF_T3T_IDENTIFIERS_X Listen Frame See above, used to set SC, NFCID2 RF_DISCOVER_CMD RF Technology & Mode NFC_F_PASSIVE_LISTEN_MODE UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 66 of 127 UM10936 PN7150 User Manual
* Note : RF_DISCOVER_MAP_CMD is optional since the mapping to Frame RF Intf. is done by default UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 67 of 127 UM10936 PN7150 User Manual 8. P2P Initiator & Target Mode 8.1 P2P Passive mode
[NCI] defines all the mechanisms necessary to implement this feature. Two options are possible:
1. The DH wants to manage by itself the NFC-DEP protocol; it SHALL then map the NFC-DEP protocol on the Frame RF Interface.
Not supported in PN7150 2. The DH leaves the NFC-DEP protocol management to the NFCC: it SHALL then map the NFC-DEP protocol on the NFC-DEP interface. The NFC-DEP RF interface allows the DH to emulate an NFC-DEP Target or Initiator in P2P Passive, leaving up to the PN7150 to manage the NFC-DEP protocol. Here are the commands and configuration parameters to prepare the NFC-DEP Target in P2P Passive hosted by the DH, for technologies NFC-A and NFC-F, through the NFC-DEP RF Interface:
Table 71. Config. seq. of NFC-DEP/NFC-A&F Passive Target over NFC-DEP RF Intf Command Main Parameters Values RF Protocol PROTOCOL_NFC-DEP Listen NFC-DEP RF_DISCOVER_MAP_CMD Mode CORE_SET_CONFIG_CMD RF Interface LA_BIT_FRAME_SDD LA_PLATFORM_CONFIG LA_SEL_INFO LA_NFCID1 LF_CON_BITR_F LF_PROTOCOL_TYPE LN_WT LF_ADV_FEAT1 LN_ATR_RES_GEN_BYTES LN_ATR_RES_CONFIG RF_DISCOVER_CMD RF Technology & Mode NFC_A_PASSIVE_LISTEN_MODE RF Technology & Mode NFC_F_PASSIVE_LISTEN_MODE 1 this parameter is not supported in PN7150 Here are the commands and configuration parameters to prepare the NFC-DEP Initiator for technologies NFC-A and NFC-F in the DH through the Frame RF Interface:
UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 68 of 127 UM10936 PN7150 User Manual Table 72. Config. seq. of NFC-DEP/NFC-A&F Passive Initiator over NFC-DEP RF Intf Command Main Parameters Values RF Protocol PROTOCOL_NFC-DEP Poll NFC-DEP RF_DISCOVER_MAP_CMD Mode CORE_SET_CONFIG_CMD RF Interface PA_BAIL_OUT PF_BIT_RATE PF_RC_CODE PN_NFC_DEP_SPEED PN_ATR_REQ_GEN_BYTES PN_ATR_REQ_CONFIG RF_DISCOVER_CMD RF Technology & Mode NFC_A_PASSIVE_POLL_MODE RF Technology & Mode NFC_F_PASSIVE_POLL_MODE 8.2 P2P Active mode All P2P active modes are supported (Initiator for NFC-A & NFC-F and Target for NFC-A &
NFC-F). As for the P2P Passive mode, the PN7150 allow access to P2P Active mode through the NFC-DEP RF Interface, the Frame RF Interface implemented in PN7150 not supporting the NFC-DEP protocol. The NFC-DEP RF interface allows the DH to emulate an NFC-DEP Target or Initiator in P2P Active, leaving up to the NFCC to manage the NFC-DEP protocol. Here are the commands and configuration parameters to prepare the NFC-DEP Target in P2P Active hosted by the DH, for technologies NFC-A and NFC-F, through the NFC-DEP RF Interface:
Table 73. Config. seq. of NFC-DEP/NFC-A&F Active Target over NFC-DEP RF Intf Command Main Parameters Values RF Protocol PROTOCOL_NFC-DEP Listen NFC-DEP RF_DISCOVER_MAP_CMD Mode RF Interface LA_BIT_FRAME_SDD LA_PLATFORM_CONFIG LA_SEL_INFO LA_NFCID1 CORE_SET_CONFIG_CMD LF_CON_BITR_F LF_PROTOCOL_TYPE LN_WT LN_ATR_RES_GEN_BYTES LN_ATR_RES_CONFIG UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 69 of 127 UM10936 PN7150 User Manual Command Main Parameters Values RF_DISCOVER_CMD RF Technology & Mode NFC_A_ACTIVE_LISTEN_MODE RF Technology & Mode NFC_F_ACTIVE_LISTEN_MODE Here are the commands and configuration parameters to prepare the NFC-DEP Initiator for technologies NFC-A and NFC-F in the DH through the Frame RF Interface:
Table 74. Config. seq. of NFC-DEP/NFC-A&F Active Initiator over NFC-DEP RF Intf Main Parameters Command Values RF Protocol PROTOCOL_NFC-DEP RF_DISCOVER_MAP_CMD Mode RF Interface PA_BAIL_OUT PF_BIT_RATE CORE_SET_CONFIG_CMD PN_NFC_DEP_SPEED PN_ATR_REQ_GEN_BYTES PN_ATR_REQ_CONFIG Poll NFC-DEP RF_DISCOVER_CMD RF Technology & Mode NFC_A_ACTIVE_POLL_MODE RF Technology & Mode NFC_F_ACTIVE_POLL_MODE 8.3 Presence check command As already described in 6.3.3, the PN7150 comes with a proprietary function to allow the DH knowing if the Tag/Card is still present or not. The command description in 6.3.3 also applies in Initiator mode (Active or Passive). 8.4 WTX notification As already described in 6.3.5, the PN7150 comes with a proprietary notification WTX which indicates that peers are in phase of exchanging RTOX REQ/RESP (NFC DEP equivalent of WTX in ISO DEP) for the configured period of time. The notification description in 6.3.5 also applies in Initiator mode (Active or Passive). UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 70 of 127 UM10936 PN7150 User Manual 9. RF Discovery Management 9.1 RF Discovery functionalities This contains the overall RF Discovery concepts applied in PN7150. [NCI] defines the general RF state machine allowing the NFC controller to discover either cards or readers or peers. This RF state machine contains a state called RFST_DISCOVERY where the RF Discovery profile is applied. In order to ensure standard compliance, the PN7150 supports 2 different RF discovery profiles:
NFC FORUM profile: implementation of the NFC FORUM polling activity,
- Either limited to the current technologies defined in this standardization body (NFC-A, NFC-B, NFC-F and P2P passive).
- Or extended with the additional technologies supported by PN7150, i.e. P2P Active and ISO15693. PN7150 also offers the possibility to extend this profile by polling for both NFC-F 424 and NFC-F 212. EMVCo profile: mode allowing the PN7150 to be compliant to the EMVCo polling activity. In addition to these RF profiles, the PN7150 offers a way to limit the power consumption by applying a tag detector concept. The tag detector can be seen as a precondition to enable a dedicated profile. It means that if the tag detector is triggered, the default profile is automatically started. Note that [NCI] defines the TOTAL_DURATION of the discovery period independently of the reader phases applied. To simplify the implementation, for the PN7150 it has been decided to apply a timer only during the Listen/pause phase. So depending on the polling phase configuration (1 technology or more), the total duration will vary a bit. This is considered as acceptable and agreed by the NCI task Force in the NFC FORUM. The following drawing shows the [PN7150-NCI] RF state machine. It differs from [NCI] only by the additions in red. Here are these additions:
A loop-back transition on state RFST_POLL_ACTIVE, corresponding to the RF_PRES_CHECK_CMD which can be sent by the DH to know if the Card/PICC is still in the field. See the command description in chapter 6.3.3. A new status code used on the CORE_GENERIC_ERROR_NTF loop-back transition on state RFST_DISCOVERY: this new status code is used when PN7150 is configured to behave as an EMVCo PCD, and it detects collision. See 9.5.1.2 for more details. A new transition from RFST_POLL_ACTIVE to RFST_DISCOVERY: this transition is triggered by PN7150, when it is configured to behave as an EMVCo PCD and it detects that the RF communication with the PICC is broken. See 9.5.1.2 UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 71 of 127 UM10936 PN7150 User Manual RF_DISCOVER_SELECT_CMD/RSP RF_DEACTIVATE_CMD/RSP
(Idle Mode) RF_PRES_CHECK_ CMD/RSP/NTF CORE_INTF_ERROR_NTF
(RF_xxx_ERROR) RF_DEACTIVATE_CMD/RSP/NTF
(Idle Mode) RFST_ POLL_ ACTIVE RF_INTF_ACTIVATED_NTF
(Poll Mode) RF_DEACTIVATE_CMD/RSP/NTF
(Sleep Mode) RF_DEACTIVATE_CMD/RSP/NTF
(Sleep_AF Mode) RFST_W4_ HOST_ SELECT RF_INTF_ACTIVATED_NTF
(Poll Mode) RF_DEACTIVATE_CMD/RSP/NTF
(Discovery) or RF_DEACTIVATE_NTF
(Discovery, Link Loss) CORE_GENERIC_ERROR_NTF
(DISC_TG_ACT_FAILED) RF_DISCOVER_NTF
(Notification Type = 0/1) RFST_IDLE RF_DEACTIVATE_CMD/RSP
(Idle Mode) RF_DISCOVER_CMD/RSP RFST_ DISCOVERY RF_DISCOVER_NTF
(Notification Type = 2) RFST_W4_ ALL_DISCOVERIES RF_DEACTIVATE_CMD/RSP/NTF
(Discovery) RF_DEACTIVATE_NTF
(Discovery, Link_Loss) RF_DEACTIVATE_NTF
(Discovery, NFC-B_Bad_AFI) CORE_GENERIC_ERROR_NTF
(DISC_TG_ACT_FAILED or DISCOVERY_TEAR_DOWN or EMVCo_PCD_COLLISION) RF_INTF_ACTIVATED_NTF
(Listen Mode) RF_DISCOVER_NTF
(Notification Type = 2) RF_DEACTIVATE_CMD/RSP/NTF
(Discovery) RF_DEACTIVATE_NTF
(Discovery, Link_Loss) RF_DEACTIVATE_NTF
(Discovery, Endpoint_Request) RF_DEACTIVATE_CMD/RSP
(Idle Mode) RFST_ LISTEN_SLEEP RF_DEACTIVATE_CMD/RSP/NTF
(Idle Mode) RF_DEACTIVATE_CMD/RSP/NTF
(Sleep Mode) RF_DEACTIVATE_CMD/RSP/NTF
(Sleep_AF Mode) RF_DEACTIVATE_NTF
(Sleep Mode, Endpoint_Request) RF_DEACTIVATE_NTF
(Sleep_AF Mode, Endpoint_Request) RF_NFCEE_ACTION_NTF RFST_ LISTEN_ACTIVE RF_INTF_ACTIVATED_NTF
(Listen Mode) CORE_INTF_ERROR_NTF
(RF_xxx_ERROR) RF_DEACTIVATE_CMD/RSP
(Idle Mode) Fig 35. NXP RF State machine Since the [NCI] RF State Machine is quite complex, it is presented slightly differently in Annex A of the present document: the State Machine is drawn depending on the RF interface to be used. See chapter 13 for further details.
Since PN7150 does not support Listen Mode using the Frame RF Interface, it or does the RF_DEACTIVATE_CMD(Sleep Mode) accept not UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 72 of 127 UM10936 PN7150 User Manual RF_DEACTIVATE_CMD(Discovery) RFST_LISTEN_SLEEP. in RFST_LISTEN_ACTIVE or 9.2 NFC FORUM Profile as defined in [NCI]
The NFC FORUM profile is the implementation of the RF discovery activity as defined in the NFC FORUM (see [ACTIVITY] specification). [NCI] only covers technologies NFC-A, NFC-B & NFC-F. So the basic NFC FORUM profile will poll for these technologies only. Furthermore, for NFC-F, only one bit rate is used during the polling phase. This is configured thanks to the Poll F parameter PF_BIT_RATE as defined in [NCI], section 6.1.4. So the DH configures if NFC-F is polled at 212kbps or at 424kbps, before it activates the discovery by sending the RF_DISCOVER_CMD command. The figure bellow represents the profile defined by the NFC FORUM, assuming that the DH has enabled the 3 technologies currently supported by the NFC FORUM (NFC-A, NFC-
B, NFC-F) in Poll mode & Listen mode. To do so, it has to send the following command:
RF_DISCOVER_CMD(
6,
[NFC_A_PASSIVE_POLL_MODE,1],
[NFC_B_PASSIVE_POLL_MODE,1],
[NFC_F_PASSIVE_POLL_MODE,1],
[NFC_A_PASSIVE_LISTEN_MODE,1],
[NFC_B_PASSIVE_LISTEN_MODE,1],
[NFC_F_PASSIVE_LISTEN_MODE,1] ) Listening phase Polling phase NFC-A NFC-B NFC-F Fig 36. RF Discovery sequence in case of NFC FORUM profile UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 73 of 127 UM10936 PN7150 User Manual 9.3 [PN7150-NCI] extension: additional technologies not yet supported by the NFC FORUM PN7150 supports more technologies than currently supported by the NFC FORUM specifications: P2P Active, ISO15693 VCD and KOVIO Reader. Furthermore, PN7150 offers an additional proprietary value for the configuration parameter PF_BIT_RATE, which allows configuring for both 212 kbps & 424 kbps to be polled in NFC-
F in Passive Mode. Thanks to the RF_DISCOVER_CMD and the PF_BIT_RATE, the DH has full flexibility to extend the default RF Discovery profile as currently defined in the [NCI] specification. Here is an example how the DH can enable all technologies available in PN7150, for both Poll
& Listen Mode:
1. The DH sets PF_BIT_RATE to 0x80, such that the PN7150 polls for 212 & 424 kbps in technology F PASSIVE. CORE_SET_CONFIG_CMD(
NbrParam = 0x01, ID = 0x18, Length = 0x01, 2. The DH enables all technologies & modes available in PN7150:
Val = 0x80 ) RF_DISCOVER_CMD(
11,
[NFC_A_PASSIVE_POLL_MODE,1],
[NFC_B_PASSIVE_POLL_MODE,1],
[NFC_F_PASSIVE_POLL_MODE,1],
[NFC_15693_PASSIVE_POLL_MODE,1],
[NFC_KOVIO_POLL_MODE,1],
[NFC_A_ACTIVE_POLL_MODE*,1],
[NFC_A_PASSIVE_LISTEN_MODE,1],
[NFC_B_PASSIVE_LISTEN_MODE,1],
[NFC_F_PASSIVE_LISTEN_MODE,1],
[NFC_A_ACTIVE_LISTEN_MODE,1],
[NFC_F_ACTIVE_LISTEN_MODE,1]
* NCI_DISCOVERY_TYPE_POLL_F_ACTIVE is not allowed, see 4.2.4.
) The resulting RF discovery is drawn below (note that KOVIO does not have a specific Poll Phase, since it is based on a Response only, as described in 6.5):
UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 74 of 127 UM10936 PN7150 User Manual Listening phase NFC-A Active NFC-A NFC-B NFC-F
@424 NFC-F
@212 15693 Polling phase Fig 37. RF Discovery sequence in case of NFC FORUM+ profile Note: the transition from the Poll NFC-A Active phase to the Poll NFC-A (passive) is done through an RF field off/on sequence. For more details concerning the different phases duration, guard time, Bailout, please refer to the configuration section (chapter 10.2) where all these parameters are defined. 9.4 [PN7150-NCI] extension: Low Power Card Detector (LPCD) Mode 9.4.1 Description The Low Power Card Detector is an NXP proprietary extension, which can be used by the DH to reduce the power consumption. The concept is to avoid using the Technology Detection Activity as defined in [ACTIVITY], which implies to generate an RF Field for several tens of milliseconds and to send technology specific request commands to see if there is a Card/Tag in the field to respond. The more technologies the PN7150 is configured to detect, the longer the RF Field is generated and the higher the current consumption. The LPCD is based on another concept, which only relies on the antenna characteristics, not on valid responses from a Card/Tag. Indeed, the antenna impedance is influenced by the Card/tag which may enter into its proximity, due to the magnetic coupling between the UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 75 of 127 UM10936 PN7150 User Manual 2 antennas. The LPCD is therefore monitoring the antenna impedance, to see if there is a significant variation which is interpreted as being caused by a Card/Tag being in proximity. To achieve that, the LPCD periodically generates very short pulses of RF Field, without any modulation, and measures some antenna characteristics during this pulse. The time between these RF pulses is defined by the TOTAL_DURATION parameter, as specified for the RF Discovery in [NCI]. When a Card/Tag enters the field, there is an antenna impedance variation. If this variation is higher than a pre-defined threshold, the NFC FORUM polling loop profile is automatically started (the LPCD is not supported when using EMVCo polling loop profile). The PN7150 is then sending technology specific request commands, expecting a response since the LPCD detected a change on the antenna impedance. Note: the LPCD may also be triggered by a metal object, which can influence the Antenna impedance in a similar way as a Card/Tag. The PN7150 will anyhow detect that this object is not a contactless device since it immediately starts sending contactless commands to check if a Card/Tag can respond. The Low Power Card Detector is configured and enabled/disabled thanks to a specific configuration parameter TAG_DETECTOR_CFG described in 10.2.1. threshold The TAG_DETECTOR_THRESHOLD_CFG described in the same section. is also defined by an additional configuration parameter The figure below describes the RF Discovery when the LPCD is enabled:
Listening phase LPCD RF pulse Polling phase Fig 38. RF Discovery sequence in case of Low Power Card Detector mode UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 76 of 127 UM10936 PN7150 User Manual The figure below compares the RF Discovery with the LPCD disabled to the RF Discovery with the LPCD enabled and highlights the impact on the average current consumption (the assumption being here that TOTAL_DURATION ~ 300ms):
RF Discovery with LPCD disabled, NFC-A & NFC-B only in Poll Mode One complete RF Discovery Loop: Period = TOTAL_DURATION Listen Phase Poll Phase Listen Phase Poll Phase Listen Phase Poll A Poll B Poll A Poll B RF Field Imax Current consumption
~20 A RF Field Imax Current consumption
~20 A Average Current Consumption
~20ms
~300ms RF Discovery with LPCD enabled One complete RF Discovery Loop: Period = TOTAL_DURATION Listen Phase Poll Phase Listen Phase Listen Phase Poll Phase Average Current Consumption
~300ms
~100s t t t t Fig 39. Comparison of the RF Discovery with the LPCD disabled or enabled A specific application note explains how to properly configure and optimize this LPCD in a given application. See [AN 11757]. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 77 of 127 UM10936 PN7150 User Manual 9.4.2 Configuration of the Technology Detection Activity when the LPCD has detected an "object"
As described in the previous chapter, once the PN7150 detects a change in the antenna impedance, it performs a Technology Detection as defined in [ACTIVITY] which tries to activate the object by sending Request Commands from the different technologies configured for the RF Discovery. In order to improve the likelihood to catch such a Card/Tag, the PN7150 comes with a retry mechanism which performs several Technology Detection polling cycles before it switches back to LPCD. During this retry mechanism, a temporary period is used, called TechDet_PERIOD. This is specified in steps of 10ms. The number of the retry cycles can also be configured thanks to the TechDet_NBR_RETRIES parameter. Table 75. Parameters used to configure the overall period of the RF Discovery:
LPCD Status Period between 2 consecutive Technology Detections Period between 2 consecutive LPCD RF pulses Enabled Disabled TechDet_PERIOD TOTAL_DURATION TOTAL_DURATION Not applicable figure The next these 3 parameters TOTAL_DURATION, TechDet_PERIOD and TechDet_NBR_RETRIES influence the Low Power Card Detector and the RF Discovery:
illustrates how Technology Detection LPCD RF pulse LPCD RF pulse LPCD:
an object detected No Response No Detection No Detection Technology Detection LPCD RF pulse LPCD RF pulse No Rsp No Rsp No Rsp No Rsp No Detection TOTAL_DURATION TOTAL_DURATION TOTAL_DURATION TechDet_ PERIOD TechDet_ PERIOD TechDet_ PERIOD TechDet_ PERIOD TOTAL_DURATION TechDet_RETRIES Fig 40. Illustration of the Low Power Card detector and the subsequent Technology Detection cycles See 10.2.1 parameter TechDet_AFTER_LPCD_CFG containing the 2 parameters TechDet_PERIOD and TechDet_NBR_RETRIES. configuration description the the for of UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 78 of 127 UM10936 PN7150 User Manual 9.4.3 Notification when the Trace Mode is enabled The Low Power Card Detector needs to be tuned in each application; it is therefore useful to get some information from PN7150 so that the Low Power Card Detector can be appropriately configured. The Low Power Card Detector can be configured to enable a Trace Mode, where the following Notification will be sent to the DH by PN7150:
Table 76. RF_LPCD_TRACE_NTF GID OID Numbers of parameter(s) Description 1111b 0x13 2 PN7150 sends the actual measurement + the threshold Table 77. RF_LPCD_TRACE_NTF parameters Payload Field(s) Reference Value Length Value/Description 2 Octets Reference Value used by Low Power Card Detector function to compare with the measurement value. Coding is little Endian. Measurement Value 2 Octets Value measured on the AGC. Coding is little Endian. 9.5 [PN7150-NCI] extension: EMVCo Profile in Poll & Listen Modes The EMVCo profiles are introduced in PN7150 for EMVCo compliancy. Indeed there are incompatibilities between the RF Discovery activity as defined in the NFC FORUM and the RF discovery defined in EMVCo standard. 9.5.1 EMVCo profile in Poll Mode 9.5.1.1 Configuring PN7150 to implement the EMVCo polling loop profile To be compliant to the EMVCo certification tests, the RF Discovery has to be configured so that only NFC-A and NFC-B are supported in Poll phase and so that there is no Listen phase. So the DH has to send the following command:
RF_DISCOVER_CMD(
2,
[NCI_DISCOVERY_TYPE_POLL_A_PASSIVE,1],
[NCI_DISCOVERY_TYPE_POLL_B_PASSIVE,1]) In addition, PN7150 needs to be aware of the fact that it has to behave according to the EMVCo RF discovery, not according to the NFC FORUM RF discovery based on
[ACTIVITY]. A specific configuration parameter POLL_PROFILE_SEL_CFG (see 10.2.1) is defined for that purpose, allowing to select the active profile of the RF discovery in Poll Mode. When this parameter is set to 0x01, PN7150 implements a specific discovery algorithm, compliant to the EMVCo standard. The target is to ensure that there is one single card in the field. So PN7150 has to detect any collision inside 1 technology (NFC-A or NFC-B) or to detect if there are multiple cards based on different technologies (i.e. 1 card in NFC-A and 1 card in NFC-B). UM10936 All information provided in this document is subject to legal disclaimers. All rights reserved. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 79 of 127 UM10936 PN7150 User Manual NFC-A NFC-B Polling phase Wait phase (no Listen) Fig 41. RF Discovery sequence in case of EMVCo profile If there is a card detected in the field, then the polling sequence is modified by the PN7150, in order to look for another potential card in the field. This is illustrated by the 2 figures below:
On the 1st one, there is no card in the RF Field, so PN7150 keeps polling by alternating WUPA & WUPB commands. No NFC-A Card
=> no response No NFC-B Card
=> no response No NFC-A Card
=> no response No NFC-B Card
=> no response NFCC = PCD WUPA WUPB WUPA WUPB Fig 42. EMVCo polling without a card in the field On the 2nd one, an NFC-A card is placed in the RF Field. The PN7150 detects it, activates it and puts it in HALT state and then looks for a potential NFC-B card in the field. Since there is no NFC-B card in the field, the PN7150 activates the NFC-A card again, then the PN7150 activates the ISO-DEP interface and the DH can start to exchange data with the NFC-A card to proceed with the payment application. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 80 of 127 UM10936 PN7150 User Manual 1xNFC-A Card in the Field, No NFC-B Card 1 NFC-A Card
=> Response No NFC-B Card
=> no response 1 NFC-A Card
=> Response Payment transaction proceeds NFCC = PCD WUPA WUPB WUPA HLTA Anticoll
+ Select Fig 43. EMVCo polling with NFC-A card in the field
In PN7150 the Low Power Card Detector is automatically disabled when the if EMVCo profile is enabled, since these 2 simultaneously enabled. features are conflicting 9.5.1.2 Notification for RF technology collision When the EMVCo polling loop profile is activated, PN7150 will activate the ISO-DEP RF Interface through RF_INTF_ACTIVATED_NTF only when there is 1 single card in the field, whatever the technology (NFC-A or NFC-B). When PN7150 detects a collision on RF (either in one technology or between technologies), it will report a special Status in the CORE_GENERIC_ERROR_NTF:
STATUS_EMVCo_PCD_COLLISION. The current state will remain RFST_DISCOVERY, as graphically described in Fig 35. The identifier of this proprietary Status is defined in 0.Note that if the cards remain in the RF Field, PN7150 will keep sending the CORE_GENERIC_ERROR_NTF with status STATUS_EMVCo_PCD_COLLISION at each polling loop: this can be used as a presence check mechanism. When the EMVCo profile for Poll Mode is activated and PN7150 has detected a single PICC (i.e. no collision) but it is unable to properly activate this PICC, then PN7150 will send status DISCOVERY_TARGET_ACTIVATION_FAILED as defined in [NCI]. CORE_GENERIC_ERROR_NTF with a 9.5.1.3 Modification of the NCI RF State Machine in case of failure during data exchange or an When the EMVCo profile for Poll Mode is activated, the PN7150 has to comply with tight timings verified during the EMVCo PCD certification. In case the RF link with the PICC is broken, the regular way to behave according to NCI is that the PN7150 will detect a time-
out a protocol CORE_INTERFACE_ERROR_NTF with the appropriate status. It is then up to the DH to stop the RF Discovery with RF_DEACTIVATE_CMD(IDLE) and to restart the RF Discovery with RF_DISCOVER_CMD. Unfortunately, the time required to execute this sequence is highly dependent on the DH latency and it is often not possible to match the timings expected and checked by the EMVCo PCD certification. unrecoverable send error then and To solve this issue, NXP has decided to add a transition from the RFST_POLL_ACTIVE the to RFST_DISCOVERY, triggered sending the by of UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 81 of 127 UM10936 PN7150 User Manual RF_DEACTIVATE_NTF(Discovery, Link Loss). In such a way, when PN7150 has detected a timeout or an unrecoverable protocol error during the RF communication with the PICC, it will autonomously come back to RFST_DISCOVERY, switching off the RF Field, as requested by EMVCo and then restarting the Polling phase in a timely manner, as requested by EVMCo. This new transition is graphically described in Fig 35. 9.5.2 EMVCo profile in Listen Mode To be compliant to the EMVCo certification tests emulating an EMVCo PICC, PN7150 has to behave as a single PICC based on either technology NFC-A or NFC-B. In order to solve this issue, PN7150 comes with a specific configuration parameter:
LISTEN_PROFILE_SEL_CFG, detailed in section 10.2.2. Thanks to this parameter, a specific EMVCo PICC profile can be activated such that PN7150 will hide the non-yet-selected technology to the EMVCo PCD. Once this parameter is activated, the PICC selection sequence is as follows (assuming NFC-A is selected first):
Once NFC-A has been selected by the PCD through the REQA command, PN7150 disables the NFC-B card emulation so that the REQB command sent later on by the EMVCo PCD gets no answer. The payment transaction can then successfully go through based on technology NFC-A. PN7150 waits then for an RF Field off/on sequence before enabling the non-
selected technology (NFC-B) again. NFCC activated in NFC-A first => NFC-B disabled NFCC = PICC NFCC sends ATQA response NFCC keeps Mute NFCC sends ATQA response NFCC activated in NFC-B first
=> NFC-A disabled Payment transaction proceeds RF Field OFF NFCC sends ATQB response WUPA WUPB WUPA HLTA Anticoll
+ Select WUPB RF Field ON Fig 44. EMVCo Listen with first NFC-A activated by the PCD then NFC-B activated, after field off/on sequence 9.6 [PN7150-NCI] extension: Power optimization PN7150 offers a standby mode, which can be activated together with the RF Discovery, such that the overall power consumption is significantly reduced. One dedicated proprietary function is added to enable/disable this standby mode:
CORE_SET_POWER_MODE. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 82 of 127 UM10936 PN7150 User Manual 9.6.1 CORE_SET_POWER_MODE Command/Response
The Standby Mode is enabled by default. Given the very strong impact on the power consumption, disabling the Standby Mode should be restricted to debug sessions. Table 78. CORE_SET_POWER_MODE_CMD GID OID Numbers of parameter(s) Description 1111b 0x00 1 Command to request the PN7150 to enable/disable the Standby Mode Table 79. CORE_SET_POWER_MODE_CMD parameter Payload Field(s) Length Value/Description Mode 1 Octet 0x00 0x01 Standby Mode disabled Standby Mode enabled 0x03-0xFF RFU Table 80. CORE_SET_POWER_MODE_RSP GID OID Numbers of parameter(s) Description 1111b 0x00 1 Response to inform the DH of the status of the CORE_SET_POWER_MODE_CMD. Table 81. CORE_SET_POWER_MODE_RSP parameter Payload Field(s) Length Value/Description Status 1 Octet 0x00 0x06 0x09 STATUS_OK STATUS_SEMANTIC_ERROR STATUS_INVALID_PARAM Others Forbidden 9.6.2 Standby wake-up The PN7150 wakes-up from standby when one of the following event occurs:
- Regular polling-loop starts. When the DH has served the PN7150 with a NCI_RF_DISCOVER_CMD command, the PN7150 enters into the standby mode and automatically leave the low power mode after the period defined by TOTAL_DURATION.
- RF level detector triggered. An external field has been introduced in the NFC volume during the standby period of the polling loop and at least one listen phase has been requested by the NCI_DISCOVER_CMD.
- Host interface activity detected. See 3.3 section. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 83 of 127 10. Configurations UM10936 PN7150 User Manual When the DH needs to update the value of the parameters described hereafter, it shall send a CORE_RESET_CMD/CORE_INIT_CMD sequence after the CORE_SET_CONFIG_CMD, to ensure that the new value is used for the parameters. If numerous parameters are updated thanks to multiple CORE_SET_CONFIG_CMD commands, a single CORE_RESET_CMD/
CORE_INIT_CMD sequence is enough after the last CORE_SET_CONFIG_CMD. Any CORE_SET_CONFIG_CMD to one of the following parameters or to the
[NCI] standard parameters will trigger an EEPROM write cycle. Since the PN7150 EEPROM has a limited number of Erase/Write cycles (300 000), it is highly recommended to only use the CORE_SET_CONFIG_CMD during the NCI initialization sequence.
10.1 [PN7150-NCI] extension: System configurations PN7150 offers several parameters used to configure the system aspects. Table 82. Core configuration parameters Name & Rights Description CLOCK_REQUEST_CFG RW in EPROM Indicates how the clock is requested to the DH by the PN7150. Ext. Tag Len. Default Value 0xA0 0x02 1 0x01 0x00 0x01 Clock Request is disabled Hardware-based Clock Request is enabled:
CLKREQ pin set to high when clock requested, otherwise it is set to hi-Z (High Impedance). 0x02-0xFF RFU UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 84 of 127 Name & Rights Description CLOCK_SEL_CFG RW in EPROM Input Clock selection & configuration for the internal 13.56MHz CLOCK Bits [4:3]
Clk Source Description UM10936 PN7150 User Manual Ext. Tag Len. Default Value 0xA0 0x03 1 0x08 01b 10b XTAL PLL 11b 00b RFU RFU A 27.12MHz quartz has to be connected to PN7150 A clean clock signal has to be directly provided on the Clock pad (bits [2:0] have to be configured in addition to specify the clock value, see the table below) When the PLL is used, the bits [2:0] have to be configured according to the following table, depending on the clock provided to PN7150 Bits [2:0]
Clk In 000b 001b 010b 011b 100b 101b 13.0 MHz 19.2 MHz 24 MHz 26.0 MHz 38.4 MHz 52 MHz 110b-111b RFU CLOCK_TO_CFG RW in EPROM Indicates the timeout value to be used for clock request acknowledgment (from 1.53ms to 10 ms in steps of 330s). 0xA0 0x04 1 0x01 So the actual Time Out value (in s) is given by the following formula:TimeOut (s) = 1200 + (CLOCK_TO_CFG)*330 Minimum value is 01. Value 0x00 SHALL NOT be used, otherwise there is no timeout (no wait time). In this case the PLL is started immediately without waiting for the external sys_clock. Maximum value to be used is 0x06, to ensure the NFCC is ready to reply 5ms after an external field on. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 85 of 127 UM10936 PN7150 User Manual Ext. Tag Len. Default Value 0xA0 0x05 1 0x00 Name & Rights Description IRQ_POLARITY_CFG Configuration of the IRQ pin polarity RW in EPROM Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 X IC transport fragmentation
'1' => enabled,
'0'=> disabled X IRQ PIN polarity config. 0 0 0 0 0 0 All these bits SHALL be set to logical 0 (RFU) b1=0 => PN7150 requests to transmit when IRQ pin = 1. b1=1 => PN7150 requests to transmit when IRQ pin = 0. VBAT_MONITOR_EN_ CFG To Enable/Disable the Battery monitor & configure the Threshold 0xA0 0x06 1 0x00 RW in EPROM Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 0xA0 0x07 1 0x03 VEN_CFG RW in EPROM X Vbat Monitor Enable X Vbat Monitor Threshold 0 0 0 0 0 0 RFU b0: 1 to Enable, 0 to disable. b1: 1 to set the threshold to 2.3V and 0 to set it to 2.75V. Note: in NCI_RFST_DISCOVERY state, setting this parameter will be rejected by the NFCC with an INVALID PARAM status 0x09 instead of SEMANTIC ERROR status 0x06. Configures the internal VEN signal, in case the VEN pin driver is NOT supplied from PVDD. In such a case, when PVDD is switched OFF, the VEN pin level in unknown, so the internal VEN signal is defined by one bit in an internal register
(VEN_Value) while the VEN pin has to be pulled-down (to avoid leakages) thanks to a 2nd bit in the same register
(VEN_Pulld) which has then to be set to '1' to activate the Pull Down. These 2 bits can be configured through NCI thanks to VEN_CFG LSbits, according to the following table:
Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 X VEN_Value X VEN_Pulld 0 0 0 0 0 0 RFU Note, in order to force a certain VEN value to be used internally (no matter which state the external VEN pin level is in) the VEN_Pulld value HAS to be set. Only if VEN_Pulld is set and PVDD is switched off the internal VEN state will be forced to what is specified in VEN_Value. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 86 of 127 Name & Rights Description TO_BEFORE_STDBY_ CFG Timeout used to wait after last DH-NFCEE communication before going into standby (from 0 to 65.536s in steps of 1ms). RW in EPROM Applies only when the discovery is stopped and standby mode is activated by SET_PWR_MODE_CMD. Pay attention that the parameter value is defined in little endian (LSB first). UM10936 PN7150 User Manual Ext. Tag Len. 0xA0 0x09 2 Default Value 0x03E8
(1s) PAD_SLEW_RATE_CFG RW in EPROM Parameter used to configure the slew rate of the pads, on a per pad basis:
0xA0 0x0A 1 0x00 Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 X CLK_REQ X IRQ 0 0 0 0 0 0 RFU For each of the pads, '1' => fast slew rate, '0' => slow slew rate. RF_TRANSITION_CFG RW in EPROM TLV parameter to configure the RF transitions: see chapter 10.3 0xA0 0x0D UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 87 of 127 UM10936 PN7150 User Manual Name & Rights Description Ext. Tag Len. PMU_CFG Configuration of the Power Management Unit (PMU) 0xA0 0x0E 3 RW in EPROM Byte 0:
Default Value 0x020900
(CFG1) Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 X VBAT1 connected to 5V 0 - CFG1, 1 - CFG2 0 0 0 0 0 1 0 RFU Byte 1:
Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 X X X X TVDD monitoring threshold:
0 - 3.6V (CFG1, CFG2) 1 - 5V (CFG2) TxLDO Voltage in card mode communication:
000: 3V (CFG1, CFG2) 001: 3.3V (CFG1, CFG2) 010: 3.6V (CFG1, CFG2) 011: 4.5V (CFG2) 100: 4.7V (CFG2) X X X TxLDO Voltage in reader mode communication:
000: 3V (CFG1, CFG2) 001: 3.3V (CFG1, CFG2) 010: 3.6V (CFG1, CFG2) 011: 4.5V (CFG2) 100: 4.7V (CFG2) 0 RFU Byte 2: RFU. Must be 0x00 for CFG1 and 0x01 in CFG2. DH_EEPROM_AREA_2 RW in EPROM 32-Byte EEPROM area dedicated to the DH to store/retrieve non-volatile data. The 32 Bytes have to be read
(CORE_GET_CONFIG_CMD) or written
(CORE_SET_CONFIG_CMD) is a row: it is not possible to access only a subset of these 32 Bytes. 0xA0 0x14 32 DYN_LMA_SETTINGS_ CFG Parameter used to Read/write the Configuration as well as the Lookup table for the dynamic LMA feature 0xA0 0x92 68 RW in EPROM See Table 84 UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 88 of 127 UM10936 PN7150 User Manual Table 83. DYN_LMA_SETTINGS_CFG Description Bytes Description 0 1 RFU 2 3 4
... bLutSize: Size of LUT, DO NOT MODIFY this parameter bNbLutEntries: Number of entries in DynLma look up table
. bits 0:3 = Number of Entries for Type A/B (0 means LMA disabled for this Type)
. bits 4:7 = Number of Entries for Type F (0 means LMA disabled for this Type) The number of entries for Type A/B + Type F shall not exceed the Total number of Entries. The Entries for TypeF follow the ones for Type A/B. This means if number of entries for Type A/B is 8 Entry 8 is the first for TypeF dwLutEntry0:
bits 20:18 = TXLDO output voltage: PMU_TXLDO_CONTROL_REG/TXLDO_SELECT bits 17:16 = CLIF_ANA_TX_AMPLITUDE_REG / TX_CW_AMPLITUDE_ALM_CM bit 15 = CLIF_TX_CONTROL_REG / TX_ALM_TYPE_SELECT bits 14:10 = CLIF_ANA_TX_AMPLITUDE_REG / TX_RESIDUAL_CARRIER bits 09:00 = AGC_VALUE dwLutEntry 64 ... 67 dwLutEntryF Len. Default Value 2 1 N/A 0x10 1 0x00 4 0x037C02 4 4 N/A 0x000032 10.2 [PN7150-NCI] extension: RF Discovery configuration 10.2.1 Poll Mode Several configuration parameters are required for the Poll Mode in RF discovery:
Table 84. Poll Mode configuration Name & Rights Description Ext. Tag Len. Default Value TAG_DETECTOR_CFG Tag detector enabling/disabling as follows:
0xA0 0x40 1 0x00 RW in EPROM Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 X X Detection based on the AGC Activation of the Trace mode 0 0 0 0 0 0 RFU
'1' => Enabled; '0' => Disabled Sets the detection level. 0xA0 0x41 1 0x04 Time in steps of 8us to wait before reading the AGC value. 0xA0 0x42 1 0x0F TAG_DETECTOR_ THRESHOLD_CFG RW in EPROM TAG_DETECTOR_ PERIOD _CFG RW in EPROM UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 89 of 127 UM10936 PN7150 User Manual Ext. Tag Len. Default Value 0xA0 0x43 1 0x50 Name & Rights Description TAG_DETECTOR_ FALLBACK_CNT_CFG Parameter used to configure the "Hybrid" mode ton insert a regular Polling cycle every N pulses generated by the LPCD:
RW in EPROM 0x00 Hybrid mode disabled: LPCD only, no regular Polling cycle unless an "object" is detected by the LPCD. 0x02- 0xFF Hybrid mode enabled, inserting a regular Polling cycle every 'N' pulses of LPDC.
'N' is coded by the value assigned to TAG_DETECTOR_FALLBACK_CNT_CFG in decimal. POLL_PROFILE_SEL_ CFG RW in EPROM Discovery profile selection in Poll Mode as follows:
0xA0 0x44 1 0x00 0x00 NFC FORUM profile All static configurations (Bail-out) will be set to the [NCI] default value (disabled). 0x01 EMVCo profile 0x02- 0xFF RFU GT_NFC-AA_CFG RW in EPROM Guard time (in steps of 0.59s) used between the start of unmodulated RF field & 1st command for Poll NFC-A Active
(min=0001, max=FFFF) 0xA0 0x46 2 GT_NFC-AP_CFG RW in EPROM Guard time (in steps of 0.59s) used between the start of unmodulated RF field & 1st command for Poll NFC-A Passive
(min=0001, max=FFFF) 0xA0 0x47 2 GT_NFC-B_CFG RW in EPROM Guard time (in steps of 0.59s) used between the start of unmodulated RF field & 1st command for Poll NFC-B Passive
(min=0001, max=FFFF) 0xA0 0x48 2 GT_NFC-F_CFG RW in EPROM Guard time (in steps of 0.59s) used between the start of unmodulated RF field & 1st command for Poll NFC-F Passive
(min=0001, max=FFFF) 0xA0 0x49 2 0x21C4
(5.1ms) 0x2219
(5.15ms) 0x2219
(5.15ms) 0x878D
(20.47ms) Note: If previous phase on polling loop is a FeliCa Poll that fail on Timeout, you will see an additional 5 ms delay due to the FeliCa timeout itself GT_15693_CFG RW in EPROM Guard time (in ms) used between the start of unmodulated RF field & 1st command for Poll 15693 Passive (min=0001, max=FFFF) 0xA0 0x4A 2 0x07B8
(1.17ms) PF_SYS_CODE_CFG Discovery configuration parameters for Poll F: system code 0xA0 0x4C 2 0xFFFF RW in EPROM MFC_KEY-0_CFG Key 0, used in MIFARE Classic Authentication command. 0xA0 0x4D 6 WO1 in EPROM MFC_KEY-1_CFG Key 1, used in MIFARE Classic Authentication command. 0xA0 0x4E 6 WO1 in EPROM MFC_KEY-2_CFG Key 2, used in MIFARE Classic Authentication command. 0xA0 0x4F 6 WO1 in EPROM 0xA0A1 A2A3 A4A5 0xD3F7 D3F7 D3F7 0xFFFF FFFF FFFF UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 90 of 127 UM10936 PN7150 User Manual Name & Rights Description Ext. Tag Len. MFC_KEY-3_CFG Key 3, used in MIFARE Classic Authentication command. 0xA0 0x50 6 WO1 in EPROM MFC_KEY-4_CFG Key 4, used in MIFARE Classic Authentication command. 0xA0 0x51 6 WO1 in EPROM MFC_KEY-5_CFG Key 5, used in MIFARE Classic Authentication command. 0xA0 0x52 6 WO1 in EPROM MFC_KEY-6_CFG Key 6, used in MIFARE Classic Authentication command. 0xA0 0x53 6 WO1 in EPROM MFC_KEY-7_CFG Key 7, used in MIFARE Classic Authentication command. 0xA0 0x54 6 WO1 in EPROM MFC_KEY-8_CFG Key 8, used in MIFARE Classic Authentication command. 0xA0 0x55 6 WO1 in EPROM MFC_KEY-9_CFG Key 9, used in MIFARE Classic Authentication command. 0xA0 0x56 6 WO1 in EPROM MFC_KEY-10_CFG Key 10, used in MIFARE Classic Authentication command. 0xA0 0x57 6 WO1 in EPROM MFC_KEY-11_CFG Key 11, used in MIFARE Classic Authentication command. 0xA0 0x58 6 WO1 in EPROM MFC_KEY-12_CFG Key 12, used in MIFARE Classic Authentication command. 0xA0 0x59 6 WO1 in EPROM MFC_KEY-13_CFG Key 13, used in MIFARE Classic Authentication command. 0xA0 0x5A 6 WO1 in EPROM MFC_KEY-14_CFG Key 14, used in MIFARE Classic Authentication command. 0xA0 0x5B 6 WO1 in EPROM MFC_KEY-15_CFG Key 15, used in MIFARE Classic Authentication command. 0xA0 0x5C 6 WO1 in EPROM Default Value 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF 0xFFFF FFFF FFFF FSDI_CFG RW in EPROM Frame Size value for the PN7150 to display in RATS or ATTRIB. 0xA0 0x5D 1 0x08 JEWEL_RID_CFG RW in EPROM Parameter used to configure if the RID is sent on RF to the T1T by PN7150 during the RF activation or not:
0xA0 0x5E 1 0x00 0x01 => The RID is sent on RF to the T1T 0x00 => The RID is NOT sent on RF to the T1T UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 91 of 127 Name & Rights Description UM10936 PN7150 User Manual Ext. Tag Len. Default Value In both cases, the RF_INTF_ACTIVATED_NTF will NOT embed the RID response from the T1T, as defined in [NCI]. FELICA_TSN_CFG RW in EPROM TSN value transported by the PN7150 in the SENSF_REQ command: the DH defines the number of time slots for collision resolution. 0xA0 0x5F 1 0x00
!! This value has to be set to 0x03 for NFC FORUM compliance (DTA/Digital protocol tests) !!
TechDet_AFTER_LPCD_ CFG RW in EPROM Parameter used to configure the RF Discovery taking place right after the Low Power Card Detector has triggered a detection:
0xA0 0x61 1 0x00 Bit Mask Description b7 b6 b5 b4 b3 b2 b1 b0 X X X X X TechDet_PERIOD In steps of 10ms X X X TechDet_NBR_RETRIES See 9.4.2 for more details on the use of this parameter. 1 WO (Write Only) parameters can only be written, using CORE_SET_CONFIG_CMD. PN7150 will always return CORE_GET_CONFIG_RSP(STATUS_INVALID_PARAM) to any attempt to read the value of the WO parameter. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 92 of 127 10.2.2 Listen Mode Table 85. Listen Mode Configuration Name & Rights Description TO_RF_OFF_CFG RW in EPROM Specifies the time out (in ms) applied by PN7150 before it restarts a Polling sequence, after it has detected a Field OFF in Listen Mode UM10936 PN7150 User Manual Ext. Tag Len. Default Value 0xA0 0x80 2 0x012C
(300 ms) LISTEN_PROFILE_SEL_ CFG RW in EPROM Discovery profile selection in Listen Mode, as follows:
0xA0 0x81 1 0x01 0x00 0x01 NFC FORUM profile EMVCo 0x02- 0xFF RFU LISTEN_ISODEP_FSCI_ CFG Parameter to define the FSC parameter (RF Frame Size for the PICC), as defined in [14443-4]:
0xA0 0x83 1 0x08 RW in EPROM 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 FSC = 16 FSC = 24 FSC = 32 FSC = 40 FSC = 48 FSC = 64 FSC = 96 FSC = 128 FSC = 256 0x09- 0xFF RFU 10.3 [PN7150-NCI] extension: Contactless Interface configurations PN7150 offers multiple configuration options for the Contactless Interface, to allow an optimum match between the antenna characteristics and the transmitter and receiver in PN7150. A generic TLV mechanism has been defined to write the Contactless Interface settings. It relies on the [NCI] CORE_SET_CONFIG_CMD and is described hereafter:
Table 86. Mechanism to configure the RF transitions:
Name & Rights Description Ext. Tag Len. Default Value RF_TRANSITION_CFG Parameter to configure one RF transition. 0xA0 0D 3, 4 or 6 N/A RW in EPROM One transition will be coded as:
Transition ID
(TID) CLIF register offset
(RO) Register Value
(RV) 1 Byte 1 Byte 1 Byte 2 Bytes 4 Bytes UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 93 of 127 Name & Rights Description The list of transition IDs and the appropriate values for the Register offset & its value is available in [AN 11755], as referenced in 15 UM10936 PN7150 User Manual Ext. Tag Len. Default Value CORE_SET_CONFIG_CMD command to set RF Transitions triggers internal EEPROM memory page write operation. To prevent memory corruption, any interruption of this command (between CORE_SET_CONFIG_CMD and CORE_SET_CONFIG_RSP) by hardware reset or power off MUST be prevented. Thus, it is recommended to:
- Prevent re-applying RF Transitions parameters when not required (those parameters been stored in non-volatile memory, there are persistent even in case NCI CORE_RESET_CMD with option reset configuration is applied).
- Split the RF Transition settings into several CORE_SET_CONFIG_CMD commands to limit the time for the command treatment inside PN7150
(CORE_SET_CONFIG_CMD with only one RF Transition takes 2.7ms, 5.4ms in the specific case where the RF parameter resides in 2 separate Flash memory blocks)
- Avoid mixing RF Transition parameters with other parameters (not starting with address 0xA00D) in a same CORE_SET_CONFIG_CMD command
PN7150B0HN/C11006 version only allows recovering from such memory corruption. Refer to 4.3.8.3 for more details about this mechanism. PN7150 only supports RF_TRANSITION_CFG with command CORE_SET_CONFIG_CMD. CORE_GET_CONFIG_CMD is not supported. To read out the values a specific command RF_GET_TRANSITION_CMD is to be used. Table 87. RF_GET_TRANSITION_CMD GID OID Numbers of parameter(s) Description 1111b 0x14 2 The DH asks to read out the value of an RF Transition Table 88. RF_ GET_TRANSITION_CMD parameters Payload Field(s) Length Value/Description RF Transition ID 1 Octet RF Transition Identifier UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 94 of 127 UM10936 PN7150 User Manual Payload Field(s) Length Value/Description CLIF Register Offset 1 Octet Offset of the register to read out from the CLIF Table 89. RF_ GET_TRANSITION_RSP GID OID Numbers of parameter(s) Description 1111b 0x14 2 The PN7150 acknowledges the command received from the DH and sends the RF Transition value to the DH. Table 90. RF_ GET_TRANSITION_RSP parameters Payload Field(s) Length Value/Description STATUS 1 Octet One of the following Status codes, as defined in [NCI_Table1]
0x00 0x01 0x06 STATUS_OK STATUS_REJECTED STATUS_SEMANTIC_ERROR Others Forbidden RF Transition Length 1 Octet Length of the following parameter (RF Transition Value):
0x01 0x02 0x04 1 Octet to follow 2 Octets to follow 4 Octets to follow Others RFU RF Transition Value 1, 2 or 4 Octets RF Transition Value
Value coded in Little Endian. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 95 of 127 UM10936 PN7150 User Manual 11. Test Mode 11.1 Test Session The PN7150 has the ability to generate a continuous PRBS pattern on the RF interface. Whatever the test command used by the DH, it is necessary to implement a "test session", which isolates the test mode from a regular "NCI session" of PN7150. This test session is defined thanks to the following sequence:
Reset/Initialize the PN7150 using CORE_RESET_CMD/CORE_INIT_CMD Launch selected test function Get the response transporting executed test status Reset/ Initialize the PN7150 using CORE_RESET_CMD/CORE_INIT_CMD (except for TEST_PRBS_CMD, which requires a HW reset first to stop the pattern generation on RF). 11.2 TEST_PRBS_CMD/RSP This command is used to start PRBS infinite stream generation:
Table 91. TEST_PRBS_CMD GID OID Numbers of parameter(s) Description 1111b 0x30 6 Command to start PRBS generation Table 92. TEST_PRBS_CMD parameters Payload Field(s) Length Value/Description PRBS Mode 1 Octet PRBS type 1 Octet Technology to stream 1 Octet Bitrate 1 Octet 0x00 Firmware PRBS 0x01 Hardware PRBS 0x00 PRBS9 0x01 PRBS15 0x00 Type A 0x01 Type B 0x02 Type F 0x00 106 kbps (Type A,B) 0x01 212 kbps (Type A,B& F) 0x02 424 kbps (Type A,B & F) 0x03 848 kbps (Type A,B) PRBS series length 2 Octets A value between 0x0001 0x01FF UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 96 of 127 UM10936 PN7150 User Manual Table 93. TEST_PRBS_RSP GID OID Numbers of parameter(s) Description 1111b 0x30 1 PN7150 reports if the TEST_PRBS_CMD is successful or not. Table 94. TEST_PRBS_RSP parameters Payload Field(s) Length Value/Description STATUS 1 Octet 0x00 0x06 0x09 STATUS_OK STATUS_SYNTAX_ERROR STATUS_INVALID_PARAM Others Forbidden
The only way to stop the on-going PRBS pattern generation is to apply a HW reset (through the VEN pin). 11.3 TEST_ANTENNA_CMD/RSP This command is used to execute the antenna self-test measurements, which allow to check that all the discrete components connected between PN7150 and the contactless antenna are properly soldered on the PCB. Four different measurements are necessary to check the correct connection of all the discrete components, therefore a complete Antenna Self-Test requires to execute the TEST_ANTENNA_CMD 4 consecutive times, with a different set of parameters for each execution. Table 95. TEST_ANTENNA_CMD GID OID Numbers of parameter(s) Description 1111b 0x3D 2-4 Command to execute antenna self-test measurements. Table 96. TEST_ANTENNA_CMD parameters Payload Field(s) Length Value/Description Measurement ID 1 Octet Parameters of individual test measurement 1-3 Octets 0x01 0x02 0x04 TxLDO current measurement AGC value reading AGC value NFCLD level reading with fixed 0x20 Switch RF Field On/Off RFU 0x03, 0x05-0x1F, 0x21-0xFF For individual test parameters please refer to Table 98 UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 97 of 127 UM10936 PN7150 User Manual Typ. value 0x80 Table 97. Parameters to include in TEST_ANTENNA_CMD depending on the measurement to perform Meas. ID Measurement Description Param. number Parameter name Length Description 0x01 TxLDO measurement current 0x02 AGC value reading 0x04 AGC value reading with fixed NFCLD level 0x201 Switch RF Field On/Off 1 1 2 3 1 2 3 1 Wait_Time 1 Octet Time to wait (in s) before capturing the TX-
LDO current Wait_Time 1 Octet Time to wait (in s) before capturing the 0xC8 AGC value CLIF AGC input
[7:0]
CLIF AGC input
[9:8]
1 Octet Value to write in CLIF AGC input register, 0x60 bits [7:0]
1 Octet The 2 LSbits of parameter 3 are mapped on bits [9:8] of CLIF AGC input register. The 6 MSbits of parameter 3 have to be set to '0'. 0x03 Wait_Time 1 Octet Time to wait (in s) before capturing the 0x20 AGC value CLIF NFCLD
[3:0]
ANA value 1 Octet The 4 LSbits of parameter 2 are mapped on bits [3:0] of CLIF ANA NFCLD input register. The 4 MSbits of parameter 2 have to be set to '0'
PMU Masked TxLDO control bit
[5]
1 Octet bit [5] of parameter 3 is mapped to bit [5] in PMU TxLDO cntrl register. All other bits in parameter 3 ([7:6] & [4:0]) have to be set to
'0'
0x08 0x20 RF Generation Field 1 Octet
=> RF
'1'
'0' => RF Field is not generated Field is generated
1 Option 0x20 (Switch RF Field On/Off) absolutely requires to first disable the Standby mode, thanks to the CORE_SET_POWER_MODE_CMD (see 9.6.1). Table 98. TEST_ANTENNA_RSP Numbers of parameter(s) GID OID Description 1111b 0x3D 5 PN7150 returns individual measurement status code and the result of the measurement. Table 99. TEST_ANTENNA_RSP parameters Payload Field(s) Length Value/Description STATUS 1 Octet 0x00 0x01 0x04 0x09 STATUS_OK Test execution rejected (PN7150 in wrong state) STATUS_TEST_EXEC_FAILED STATUS_INVALID_PARAM Others Forbidden Result_Parameter_1 1 Octet Value depending on the measurement performed :
see Table 101 UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 98 of 127 UM10936 PN7150 User Manual Payload Field(s) Length Value/Description Result_Parameter_2 1 Octet Result_Parameter_3 1 Octet Result_Parameter_4 1 Octet Value depending on the measurement performed :
see Table 101 Value depending on the measurement performed :
see Table 101 Value depending on the measurement performed :
see Table 101 Table 100. Parameters provided in TEST_ANTENNA_RSP as a result of the measurement performed Meas. ID Measurement Description Param. nbr Parameter name Length Description 0x01 TxLDO current measurement 0x02 AGC reading value 0x04 AGC reading fixed level value with NFCLD 0x20 Switch RF Field On/Off 1 2 3 4 1 2 3 4 1 2 3 4 4 1 2 3 4
TxLDO output value 1 Octet Raw value (RawVal) of TxLDO measurement (0x00-
0x7F) 0x00 0x01 50-100 mA Absolute value = 0.4 x RawVal + 50 [mA]
20-70 mA Absolute value = 0.4 x RawVal + 20 [mA]
Measured range 1 Octet RFU RFU 1 Octet 1 Octet AGC Value LSB 1 Octet AGC Value MSB 1 Octet RFU RFU 1 Octet 1 Octet AGC Value LSB 1 Octet AGC Value MSB 1 Octet RFU RFU 1 Octet 1 Octet AGC Value MSB 1 Octet RFU RFU RFU RFU 1 Octet 1 Octet 1 Octet 1 Octet RFU Bytes in TEST_ANTENNA_RSP can have any value from 0x00 to 0xFF. 11.4 TEST_GET_REGISTER_CMD/RSP This command is used to retrieve the current Value of the AGC_VALUE_REGISTER. UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 99 of 127 Table 101. TEST_GET_REGISTER_CMD GID OID Numbers of parameter(s) Description 1111b 0x33 0 Command AGC_VALUE_REGISTER retrieve to UM10936 PN7150 User Manual the Value of the Table 102. TEST_GET_REGISTER_CMD parameters Payload Field(s) Length Value/Description Fix parameters 4 Octet The parameters have fixed values and shall be 0x40 0x00 0x40 0xD8. Table 103. TEST_GET_REGISTER_RSP GID OID Numbers of parameter(s) Description 1111b 0x33 1 4 Bytes containing the current Value of AGC_VALUE_REG UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 100 of 127 UM10936 PN7150 User Manual 12. PN7150 Practical approach 12.1 Basic examples for Reader/Writer Mode 12.1.1 R/W Mode with 1 NFC endpoint DH NCI NFCC RF Endpoint RF_DISCOVER_MAP_CMD
(RF Prot. = ISO_DEP,Mode = Poll, RF Intf. = Frame) RF_DISCOVER_MAP_RSP RF_DISCOVER_CMD(NFC_A_PASSIVE_POLL_MODE) Map ISO-DEP protocol to Frame RF Interface (optional, done by default) Start Discovery
(move to RFST_DISCOVERY) RF_DISCOVER_RSP Activation sequence: driven by the NFCC RF Field On SENSE_REQ / REQA SENS_RES / ATQA SDD_REQ / AntiColl CL1 SDD_RES / AntiColl CL1 SEL_REQ / SELECT SEL_RES / SAK NCI RF State Machine moved to RFST_POLL_ACTIVE RATS ATS PPS REQ PPS RES I-Block(C-APDU_1) I-Block(R-APDU_1) I-Block(C-APDU_n) I-Block(R-APDU_n) S-Block(DESELECT req) S-Block(DESELECT res) RF Field OFF NCI RF State Machine moved to RFST_DISCOVERY RF_INTF_ACTIVATED_NTF
(Prot = ISO-DEP, Intf = Frame RF INTF.) Protocol activation : handled by DH NCI_DATA_MSG(RATS) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(ATS) Parameters exchange (optional) : handled by DH NCI_DATA_MSG(PPS REQ) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(PPS RES) RF_PARAMETER_UPDATE_CMD(Trans. Bit rate, ...) RF_PARAMETER_UPDATE_RSP Application level: data exchange. NCI_DATA_MSG(I-Block(C-APDU_1)) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(I-Block(R-APDU_1)) NCI_DATA_MSG(I-Block(C-APDU_n)) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(I-Block(R-APDU_n)) Frame RF INTF deactivation => Card deselection handled by DH NCI_DATA_MSG(S-Block(DESELECT_req)) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(S-Block(DESELECT res)) RF_DEACTIVATE_CMD(Discovery) RF_DEACTIVATE_RSP RF_DEACTIVATE_NTF Fig 45. Poll Mode, NFC-A, ISO-DEP protocol / RF Frame Interface UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 101 of 127 UM10936 PN7150 User Manual DH NCI NFCC RF Endpoint RF_DISCOVER_MAP_CMD
(RF Prot. = ISO_DEP,Mode = Poll, RF Intf. = ISO-DEP) RF_DISCOVER_MAP_RSP RF_DISCOVER_CMD(NFC_A_PASSIVE_POLL_MODE) Map ISO-DEP protocol to ISO-DEP RF Interface Start Discovery
(move to RFST_DISCOVERY) RF_DISCOVER_RSP Activation sequence: driven by the NFCC Protocol activation : handled by NFCC Parameters exchange (optional): handled by NFCC RF_INTF_ACTIVATED_NTF
(Prot = ISO-DEP, Intf = ISO-DEP INTF.) Application level: data exchange. NCI_DATA_MSG(C-APDU_1) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(R-APDU_1) NCI_DATA_MSG(C-APDU_n) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(R-APDU_n) DH asks to come back to RFST_DISCOVERY RF_DEACTIVATE_CMD(Discovery) RF_DEACTIVATE_RSP RF_DEACTIVATE_NTF RF Field On SENSE_REQ / REQA SENS_RES / ATQA SDD_REQ / AntiColl CL1 SDD_RES / AntiColl CL1 SEL_REQ / SELECT SEL_RES / SAK RATS ATS PPS REQ PPS RES NCI RF State Machine moved to RFST_POLL_ACTIVE I-Block(C-APDU_1) I-Block(R-APDU_1) I-Block(C-APDU_n) I-Block(R-APDU_n) S-Block(DESELECT req) S-Block(DESELECT res) RF Field OFF NCI RF State Machine moved to RFST_DISCOVERY Fig 46. Poll Mode, NFC-A, ISO-DEP protocol / ISO-DEP Interface UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 102 of 127 UM10936 PN7150 User Manual 12.1.2 R/W Mode with 2 NFC endpoints DH NCI NFCC RF Endpoint 1 Endpoint 2 RFST_IDLE RF_DISCOVER_MAP_CMD
(RF Prot. = ISO_DEP,Mode = Poll, RF Intf. = ISO-DEP) RF_DISCOVER_MAP_RSP RFST_DISCOVERY RFST_W4_ALL_DISC. RF_DISCOVER_CMD(NFC_A_PASSIVE_POLL_MODE) RF_DISCOVER_RSP RF_DISCOVER_NTF (RF Disc. ID = 0x01, RF Prot. = ISO-DEP, NTF type = 0x02) Map ISO-DEP protocol to ISO-DEP RF Interface Start Discovery
(move to RFST_DISCOVERY) RF Field On REQA / ATQA AntiColl CL1 : Collision Detection Activate Endpoint 1 up to SAK HLTA DH notified for 1st NFC Endpoint detected Activation sequence Activate Endpoint 2 up to SAK HLTA RFST_W4_HOST_SELECT RF_DISCOVER_NTF
(RF Disc. ID = 0x02, RF Prot. = ISO-DEP, NTF type = 0x00) RF_DISCOVER_SELECT_CMD(RF Disc. ID = 0x01) RF_DISCOVER_RSP RFST_POLL_ACTIVE Protocol activation : handled by NFCC Parameters exchange (optional): handled by NFCC RF_INTF_ACTIVATED_NTF
(RF Prot. = ISO-DEP, RF Intf. = ISO-DEP) Application level: data exchange. NCI_DATA_MSG(C-APDU_1) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(R-APDU_1) NCI_DATA_MSG(C-APDU_n) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(R-APDU_n) DH asks to come back to RFST_W4_HOST_SELECT RF_DEACTIVATE_CMD(Sleep) RF_DEACTIVATE_RSP NFCC Activates again Endpoint 1 up to SAK DH notified for 2nd NFC Endpoint detected DH Selects NFC Endpoint with NFC Discov. ID = 0x01 (Endpoint 1) REQA / ATQA AntiColl CL1 SELECT/SAK RATS ATS PPS REQ PPS RES NCI RF State Machine moved to RFST_POLL_ACTIVE I-Block(C-APDU_1) I-Block(R-APDU_1) I-Block(C-APDU_n) I-Block(R-APDU_n) S-Block(DESELECT req) S-Block(DESELECT res) RFST_W4_HOST_SELECT RF_DEACTIVATE_NTF DH Selects NFC Endpoint with NFC Discov. ID = 0x02:
RF_DISCOVER_SELECT_CMD(RF Disc. ID = 0x02) RF_DISCOVER_SELECT_CMD(RF Disc. ID = 0x02) RF_DISCOVER_RSP Fig 47. Poll Mode, 2 NFC-A Cards, ISO-DEP protocol / ISO-DEP Interface UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 103 of 127 UM10936 PN7150 User Manual RFST_IDLE RFST_DISCOVERY RFST_W4_ALL_DISC. RFST_W4_HOST_SELECT RFST_POLL_ACTIVE DH NCI NFCC RF Endpoint 1 RF_DISCOVER_MAP_CMD
(RF Prot. = ISO_DEP,Mode = Poll, RF Intf. = ISO-DEP RF Prot. = NFC_DEP,Mode = Poll, RF Intf. = NFC-DEP) RF_DISCOVER_MAP_RSP RF_DISCOVER_CMD(NFC_A_PASSIVE_POLL_MODE) RF_DISCOVER_RSP Map ISO-DEP prot. to ISO-DEP RF Intf & NFC-DEP prot. To NFC-DEP Intf Start Discovery
(move to RFST_DISCOVERY) Activation sequence RF Field On SAK displays 2 protocols here:
NFC-DEP & ISO-DEP RF_DISCOVER_NTF
(RF Disc. ID = 0x01, RF Prot. = NFC-DEP, NTF type = 0x02) RF_DISCOVER_NTF
(RF Disc. ID = 0x01, RF Prot. = ISO-DEP, NTF type = 0x00) RF_DISCOVER_SELECT_CMD
(RF Disc. ID = 0x01, RF prot = ISO-DEP) RF_DISCOVER_RSP If the NFCC has put the Remote NFC Enpoint is HALT state, it activates again the Endpoint up to SAK Protocol activation : handled by NFCC Parameters exchange (optional): handled by NFCC RF_INTF_ACTIVATED_NTF
(RF Prot. = ISO-DEP, RF Intf. = ISO-DEP) Application level: data exchange. NCI_DATA_MSG(C-APDU_1) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(R-APDU_1) NCI_DATA_MSG(C-APDU_n) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(R-APDU_n) DH asks to come back to RFST_W4_HOST_SELECT RF_DEACTIVATE_CMD(Sleep) RF_DEACTIVATE_RSP SENS_REQ / REQA SENS_RES / ATQA SDD_REQ / AntiColl CL1 SDD_RES / AntiColl CL1 SEL_REQ / SELECT SEL_RES / SAK HLTA DH notified for 1st NFC Endpoint detected (for NFC-DEP protocol) DH notified for 2nd NFC Endpoint detected (for ISO-DEP protocol) DH Selects NFC Endpoint with NFC protocol = ISO-DEP WUPA / ATQA AntiColl CL1 SELECT/SAK RATS ATS PPS REQ PPS RES NCI RF State Machine moved to RFST_POLL_ACTIVE I-Block(C-APDU_1) I-Block(R-APDU_1) I-Block(C-APDU_n) I-Block(R-APDU_n) S-Block(DESELECT req) S-Block(DESELECT res) RFST_W4_HOST_SELECT RF_DEACTIVATE_NTF DH Selects NFC Endpoint with NFC Discov. ID = 0x01:
(NFC-DEP) RF_DISCOVER_SELECT_CMD(RF Disc. ID = 0x02) RF_DISCOVER_SELECT_CMD(RF Disc. ID = 0x02) RF_DISCOVER_RSP Fig 48. Poll Mode, 1 NFC-A Device, 2 RF protocols (merged SAK) UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 104 of 127 UM10936 PN7150 User Manual Note: this sequence is not according to [NCI] on the ISO-DEP RF Intf activation with respect to the PPS reception. This sequence describes the NXP NFCC behavior, not the
[NCI] expectation:
RF_INTF_ACTIVATED_NTF will always indicate 106kbps 12.2 Basic examples for Card Emulation Mode DH NCI NFCC RF Endpoint RF_DISCOVER_MAP_CMD
(RF Prot.=ISO-DEP, Mode=Listen, RF Intf.=ISO-DEP) RF_DISCOVER_MAP_RSP RF_SET_LISTEN_MODE_ROUTING_CMD
(NFCEE ID=DH-NFCEE, Prot.=PROTOCOL_ISO-DEP) RF_SET_LISTEN_MODE_ROUTING_RSP RF_DISCOVER_CMD(NFC_A_PASSIVE_LISTEN_MODE) RF_DISCOVER_RSP RF_FIELD_INFO_NTF(0x01) NFCC informs DH that an RF Field is detected Activation sequence: driven by the NFCC Protocol activation :
handled by NFCC RF_INTF_ACTIVATED_NTF
(Prot = ISO-DEP, Intf = ISO-DEP Intf.)
(Optional) 1st RF frame received after ATS is PPS: handled by the NFCC. Application level: data exchange. NCI_DATA_MSG(C-APDU_1) NCI_DATA_MSG(R-APDU_1) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(C-APDU_n) NCI_DATA_MSG(R-APDU_n) CORE_CONN_CREDITS_NTF Optional: Poller deselects the card. ISO-DEP RF INTF deactivation RF_DEACTIVATE_NTF
(Sleep Mode, Endpoint_ Request) End of transaction: Poller switches RF Field OFF RF_FIELD_INFO_NTF(0x00) RF_DEACTIVATE_NTF(Discovery, Link Loss) Map ISO-DEP protocol to ISO-DEP Interface Fill the Listen Routing Table for protocol-based routing Start Discovery
(move to RFST_DISCOVERY) RF Field On SENS_REQ / REQA SENS_RES / ATQA SDD_REQ / AntiColl CL1 SDD_RES / AntiColl CL1 SEL_REQ / SELECT SEL_RES / SAK RATS ATS NCI RF State Machine moved to RFST_LISTEN_ACTIVE PPS REQ PPS RES The NFCC converts data to/from DH into I-Blocks over RF I-Block(C-APDU_1) I-Block(R-APDU_1) I-Block(C-APDU_n) I-Block(R-APDU_n) S-Block(DESELECT req) S-Block(DESELECT res) NCI RF State Machine moved to RFST_LISTEN_SLEEP RF Field OFF NCI RF State Machine moved to RFST_DISCOVERY Fig 49. Card Emulation, NFC-A, ISO-DEP protocol / ISO-DEP Interface, optional PPS UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 105 of 127 UM10936 PN7150 User Manual DH NCI NFCC RF Endpoint RF_DISCOVER_MAP_CMD
(RF Prot.=ISO-DEP, Mode=Listen, RF Intf.=ISO-DEP) RF_DISCOVER_MAP_RSP RF_SET_LISTEN_MODE_ROUTING_CMD
(NFCEE ID=DH-NFCEE, Prot.=PROTOCOL_ISO-DEP) RF_SET_LISTEN_MODE_ROUTING_RSP RF_DISCOVER_CMD(NFC_B_PASSIVE_LISTEN_MODE) RF_DISCOVER_RSP RF_FIELD_INFO_NTF(0x01) NFCC informs DH that an RF Field is detected Activation sequence: driven by the NFCC Protocol activation : handled by NFCC RF_INTF_ACTIVATED_NTF
(Prot = ISO-DEP, Intf = ISO-DEP Intf.) Application level: data exchange. NCI_DATA_MSG(C-APDU_1) NCI_DATA_MSG(R-APDU_1) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(C-APDU_n) NCI_DATA_MSG(R-APDU_n) CORE_CONN_CREDITS_NTF Optional: Poller deselects the card. ISO-DEP RF INTF deactivation RF_DEACTIVATE_NTF
(Sleep Mode, Endpoint_ Request) End of transaction: Poller switches RF Field OFF RF_FIELD_INFO_NTF(0x00) RF_DEACTIVATE_NTF(Discovery, Link Loss) Map ISO-DEP protocol to ISO-DEP Interface Fill the Listen Routing Table for protocol-based routing Start Discovery
(move to RFST_DISCOVERY) RF Field On SENSB_REQ(AFI) / REQB SENSB_RES(AFI) / ATQB ATTRIB CMD ATTRIB RSP NCI RF State Machine moved to RFST_LISTEN_ACTIVE The NFCC converts data to/from DH into I-Blocks over RF I-Block(C-APDU_1) I-Block(R-APDU_1) I-Block(C-APDU_n) I-Block(R-APDU_n) S-Block(DESELECT req) S-Block(DESELECT res) NCI RF State Machine moved to RFST_LISTEN_SLEEP RF Field OFF NCI RF State Machine moved to RFST_DISCOVERY Fig 50. Card Emulation, NFC-B, ISO-DEP protocol / ISO-DEP Interface UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 106 of 127 UM10936 PN7150 User Manual 12.3 Basic examples for P2P Passive Mode 12.3.1 Target in P2P Passive Mode / NFC-A @ 106kbps DH NCI NFCC RF Endpoint RF_DISCOVER_MAP_CMD
(RF Prot.=NFC-DEP, Mode=Listen, RF Intf.=NFC-DEP) RF_DISCOVER_MAP_RSP RF_SET_LISTEN_MODE_ROUTING_CMD
(NFCEE ID=DH-NFCEE, Prot.=PROTOCOL_NFC-DEP) RF_SET_LISTEN_MODE_ROUTING_RSP RF_DISCOVER_CMD(NFC_A_PASSIVE_LISTEN_MODE) RF_DISCOVER_RSP RF_FIELD_INFO_NTF(0x01) NFCC informs DH that an RF Field is detected Activation sequence: driven by the NFCC Protocol activation :
handled by NFCC Map NFC-DEP protocol to NFC-DEP Interface Fill the Listen Routing Table for protocol-based routing Start Discovery
(move to RFST_DISCOVERY) RF Field On SENS_REQ / REQA SENS_RES / ATQA SDD_REQ / AntiColl CL1 SDD_RES / AntiColl CL1 SEL_REQ / SELECT SEL_RES / SAK ATR_REQ ATR_RES NFCC waits for the 1st RF frame after ATR_RES, to detect the PSL_REQ or DEP_REQ Application level: data exchange. RF_INTF_ACTIVATED_NTF
(Prot = NFC-DEP, Intf = NFC-DEP Intf.) DEP_REQ(C-APDU_1) NCI RF State Machine moved to RFST_LISTEN_ACTIVE NCI_DATA_MSG(C-APDU_1) NCI_DATA_MSG(R-APDU_1) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(C-APDU_n) NCI_DATA_MSG(R-APDU_n) CORE_CONN_CREDITS_NTF Optional: Poller deselects the card. NFC-DEP RF INTF deactivation RF_DEACTIVATE_NTF
(Sleep Mode, Endpoint_ Request) End of transaction: Poller switches RF Field OFF RF_FIELD_INFO_NTF(0x00) RF_DEACTIVATE_NTF(Discovery, Link Loss) The NFCC converts data to/from DH into DEP_REQ/DEP_RES over RF DEP_RES(R-APDU_1) DEP_REQ(C-APDU_n) DEP_RES(R-APDU_n) DSL_REQ DSL_RES NCI RF State Machine moved to RFST_LISTEN_SLEEP RF Field OFF NCI RF State Machine moved to RFST_DISCOVERY Fig 51. P2P/Target, NFC-A Passive, NFC-DEP protocol / NFC-DEP Interface, NO PSL UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 107 of 127 UM10936 PN7150 User Manual DH NCI NFCC RF Endpoint RF_DISCOVER_MAP_CMD
(RF Prot.=NFC-DEP, Mode=Listen, RF Intf.=NFC-DEP) RF_DISCOVER_MAP_RSP RF_SET_LISTEN_MODE_ROUTING_CMD
(NFCEE ID=DH-NFCEE, Prot.=PROTOCOL_NFC-DEP) RF_SET_LISTEN_MODE_ROUTING_RSP RF_DISCOVER_CMD(NFC_A_PASSIVE_LISTEN_MODE) RF_DISCOVER_RSP RF_FIELD_INFO_NTF(0x01) NFCC informs DH that an RF Field is detected Activation sequence: driven by the NFCC Protocol activation :
handled by NFCC 1st RF frame received after ATR_REQ is PSL_REQ:
handled by the NFCC. RF_INTF_ACTIVATED_NTF
(Prot = NFC-DEP, Intf = NFC-DEP Intf.) Application level: data exchange. NCI_DATA_MSG(C-APDU_1) NCI_DATA_MSG(R-APDU_1) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(C-APDU_n) NCI_DATA_MSG(R-APDU_n) CORE_CONN_CREDITS_NTF Optional: Poller deselects the card. NFC-DEP RF INTF deactivation RF_DEACTIVATE_NTF
(Sleep Mode, Endpoint_ Request) End of transaction: Poller switches RF Field OFF RF_FIELD_INFO_NTF(0x00) RF_DEACTIVATE_NTF(Discovery, Link Loss) Map NFC-DEP protocol to NFC-DEP Interface Fill the Listen Routing Table for protocol-based routing Start Discovery
(move to RFST_DISCOVERY) RF Field On SENS_REQ / REQA SENS_RES / ATQA SDD_REQ / AntiColl CL1 SDD_RES / AntiColl CL1 SEL_REQ / SELECT SEL_RES / SAK ATR_REQ ATR_RES PSL_REQ(A) PSL_RES(A) NCI RF State Machine moved to RFST_LISTEN_ACTIVE The NFCC converts data to/from DH into I-Blocks over RF DEP_REQ(C-APDU_1) DEP_RES(R-APDU_1) DEP_REQ(C-APDU_n) DEP_RES(R-APDU_n) DSL_REQ DSL_RES NCI RF State Machine moved to RFST_LISTEN_SLEEP RF Field OFF NCI RF State Machine moved to RFST_DISCOVERY Fig 52. P2P/Target, NFC-A Passive, NFC-DEP protocol / NFC-DEP Interface + PSL UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 108 of 127 UM10936 PN7150 User Manual 12.3.2 Initiator in P2P Passive Mode DH NCI NFCC RF Endpoint RF_DISCOVER_MAP_CMD
(RF Prot. = NFC-DEP,Mode = Poll, RF Intf. = NFC-DEP) RF_DISCOVER_MAP_RSP RF_DISCOVER_CMD(NFC_A_PASSIVE_POLL_MODE) Map NFC-DEP protocol to NFC-DEP RF Interface Start Discovery
(move to RFST_DISCOVERY) RF_DISCOVER_RSP Activation sequence: driven by the NFCC Protocol activation : handled by NFCC Parameters exchange (optional): handled by NFCC RF_INTF_ACTIVATED_NTF
(Prot = NFC-DEP, Intf = NFC-DEP INTF.) Application level: data exchange. NCI_DATA_MSG(C-APDU_1) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(R-APDU_1) NCI_DATA_MSG(C-APDU_n) CORE_CONN_CREDITS_NTF NCI_DATA_MSG(R-APDU_n) DH asks to come back to RFST_DISCOVERY RF_DEACTIVATE_CMD(Discovery) RF_DEACTIVATE_RSP RF_DEACTIVATE_NTF RF Field On SENSE_REQ / REQA SENS_RES / ATQA SDD_REQ / AntiColl CL1 SDD_RES / AntiColl CL1 SEL_REQ / SELECT SEL_RES / SAK ATR_REQ ATR_RES PSL_REQ PSL_RES NCI RF State Machine moved to RFST_POLL_ACTIVE DEP_REQ(C-APDU_1) DEP_RES(R-APDU_1) DEP_REQ(C-APDU_n) DEP_RES(R-APDU_n) DEP_REQ(DSL REQ) DEP_RES(DSL RES) RF Field OFF NCI RF State Machine moved to RFST_DISCOVERY Fig 53. P2P/Initiator, NFC-A Passive, NFC-DEP protocol / NFC-DEP RF Interface UM10936 All information provided in this document is subject to legal disclaimers. User manual COMPANY PUBLIC 348120 Rev. 2.0 6 November 2020 109 of 127 FCC Statement:
Please take attention that changes or modification not expressly approved by the party responsible for compliance could void the users authority to operate the equipment. This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions:
(1) This device may not cause harmful interference, and
(2) This device must accept any interference received, including interference that may cause undesired operation. IC Statement:
This device complies with Industry Canada licence-exempt RSS standard(s). Operation is subject to the following two conditions:
(1) this device may not cause interference, and
(2) this device must accept any interference, including interference that may cause undesired operation of the device. Le prsent appareil est conforme aux CNR d'Industrie Canada applicables aux appareils radioexempts de licence. L'exploitation est autorise aux deux conditions suivantes :
(1) l'appareil ne doit pas produire de brouillage, et
(2) l'utilisateur de l'appareil doit accepter tout brouillage radiolectrique subi, mme si le brouillage est susceptible d'en compromettre le fonctionnement.
(1) Operational use conditions limitations, Host product Module has professional users use condition manufacturer please ensure giving such warning like Product is limited to professional users use in your products instruction.
(2) Antenna used Antenna Type PCB Max. Gain 0dBi Antenna
(3) Labelling Instruction for Host Product Integrator Please notice that if the FCC and IC identification number is not visible when the module is installed inside another device, then the outside of the device into which the module is installed must also display a label referring to the enclosed module. For FCC, this exterior label should follow Contains FCC ID: 2A769-PN7150. In accordance with FCC KDB guidance 784748 Labeling Guidelines. For IC, this exterior label can use wording Contains IC: 28842-PN7150. 15.19 and RSS-Gen Labelling requirements shall be complied on end user device. Labelling rules for special device, please refer to 2.925, 15.19 (a)(5) and relevant KDB publications. For E-label, please refer to 2.935.
(4) Installation Notice to Host Product Manufacturer The OEM integrator is responsible for ensuring that the end-user has no manual instruction to remove or install module. The module is limited to installation in mobile application, a separate approval is required for all other operating configurations, including portable configurations with respect to 2.1093 and difference antenna configurations.
(5) Antenna Change Notice to Host manufacturer If you desire to increase antenna gain and either change antenna type or use same antenna type certified, a Class II permissive change application is required to be filed by us, or you (host manufacturer) can take responsibility through the change in FCC ID and IC ID (new application) procedure followed by a Class II permissive change application.
(6) FCC other Parts, Part 15B Compliance Requirements for Host product manufacturer This modular transmitter is only FCC authorized for the specific rule parts listed on our grant, host product manufacturer is responsible for compliance to any other FCC rules that apply to the host not covered by the modular transmitter grant of certification. Host manufacturer in any case shall ensure host product which is installed and operating with the module is in compliant with Part 15B requirements. Please note that For a Class B or Class A digital device or peripheral, the instructions furnished the user manual of the end-user product shall include statement set out in 15.105 Information to the user or such similar statement and place it in a prominent location in the text of host product manual. Original texts as following:
For Class B Note: This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. Consult the dealer or an experienced radio/TV technician for help. For Class A Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense.
1 | Label | ID Label/Location Info | 75.55 KiB | September 27 2022 |
Remark:Its hard to put FCC statement on the product due to devices irregular appearance. FCC statement will be placed in the user manual which the device is marketed.
1 | Applicant Declaration Letter | Cover Letter(s) | 162.71 KiB | September 27 2022 |
SGS North America Inc. 620 Old Peachtree Road SUITE 100 Suwanee, Georgia 30024 United States Applicant Declaration Applicant Legal Business Name K-tronics (Suzhou) Technology Co., Ltd. Address Grantee Code FCC ID Authorized Contact Name Contact Email Contact Phone No.1088, Dajing Road, Economic and Technological Development Zone, Wujiang District, Suzhou, 215200 Jiangsu, P.R. Chinac 2A769 2A769-PN7150 Liu Chunge liuchunge@boe.com.cn
+86-512-63456336 I, the undersigned, certify that I am an authorized signatory for the Applicant and therefore declare;
a) b) c) d) e) in accordance with 47CFR2.911(d), all of the statements herein and the exhibits attached hereto are true and correct to the best of my knowledge and belief. in accepting a Grant of Equipment Authorization issued by a TCB, under the authority of the FCC, as a result of the representations made in this application, the Applicant is responsible for:
(1)
(2)
(3) labeling the equipment with the exact FCC ID as specified in this application, compliance statement labeling pursuant to the applicable rules, compliance of the equipment with the applicable technical rules, if the Applicant is not the actual manufacturer of the equipment, appropriate arrangements have been made with the manufacturer to ensure that production units of this equipment will continue to comply with the FCCs technical requirements. in accordance with 47 CFR 2.909 and KDB394321, the Applicant has read, understood and agrees to accept that they are the responsible party and agree to abide by their responsibilities as specified under 47 CFR 2.909 and KDB394321. in accordance with ISO17065, FCC KDB641163, FCC KDB610077, KDB394321 and RSP-100, the Applicant has read, understood, accepts and agrees to abide by the post market surveillance requirements.
(1)
(2)
(3) the Applicant understands, accepts and agrees that a sample may be requested for surveillance testing. the Applicant shall make provisions to always have a production sample available upon request by SGS, FCC and/or ISED. the Applicant shall, upon request by SGS, at the Applicants expense, provide a production sample of the requested product to SGS, FCC and/or ISED as instructed. The sample shall include all support devices, cables, software, accessories or other hardware or software required for evaluation, review, certification and audit surveillance of products certified by SGS. f) neither the Applicant nor any party to the application is subject to a denial of Federal benefits, that includes FCC benefits, pursuant to Section 5301 of the Anti-Drug Abuse Act of 1988, 21 U.S.C. 862 because of a conviction for possession or distribution of a controlled substance. See 47CFR 1.2002(b) for the definition of a party for these purposes. g) the Applicant has read, understood, accepts and agrees to abide by the SGS North America, Inc.(TCB) terms and conditions. Link to CFRs: https://www.fcc.gov/wireless/bureau-divisions/technologies-systems-and-innovation-division/rules-regulations-title-47 Link to KDBs: https://apps.fcc.gov/oetcf/kdb/index.cfm Link to RSP-100: https://www.ic.gc.ca/eic/site/smt-gst.nsf/eng/sf01130.html Applicant Signature:
Date:2022/09/01 Print Name:
Title:
Liu Chunge Certification Manager
*NOTE: This declaration cannot be signed by an Agent, it shall be signed by an authorized person listed in the FCC database Applicant Declaration Rev:0.0
1 | Auth letter | Cover Letter(s) | 68.77 KiB | September 27 2022 |
K-tronics (Suzhou) Technology Co., Ltd. TO:
Federal Communication Commission Equipment Authorization Branch 7435 Oakland Mills Road Columbia, MID 21046 Regarding: FCC ID: 2A769-PN7150 To whom it may concern:
Date: 2022-09-01 We, the undersigned, hereby authorize Parlam Zhan to act on our behalf in all manners relating to application for equipment authorization with respect to the FCC ID above, including signing of all documents relating to these matters. Any and all acts carried out by the agent on our behalf shall have the same effect as acts of our own. We, the undersigned, hereby certify that we are not subject to a denial of federal benefits, that includes FCC benefits, pursuant to Section 5301 of the Anti-Drug Abuse Act of 1988, 21 U.S.C. 853(a). Where our agent signs the application for certification on our behalf, I acknowledge that all responsibility for complying with the terms and conditions for Certification, as specified by SGS North America, Inc., still resides with K-tronics (Suzhou) Technology Co., Ltd. This authorization is valid until further written notice from the applicant. Name (Printed): Liu Chunge Title: Certification Manager Signature:
On behalf of Company: K-tronics (Suzhou) Technology Co., Ltd. Telephone: +86-512-63456336
1 | Confidentiality FCC | Cover Letter(s) | 86.26 KiB | September 27 2022 |
K-tronics (Suzhou) Technology Co., Ltd. To:
SGS North America Inc. 620 Old Peachtree Road SUITE 100 Suwanee, Georgia United States From: K-tronics (Suzhou) Technology Co., Ltd. No.1088, Dajing Road, Economic and Technological Development Zone, Wujiang District, Suzhou, 215200 Jiangsu, P.R. Chinac Regarding:
Confidentiality Request regarding application for FCC ID: 2A769-PN7150 LONG TERM CONFIDENTIALITY Pursuant to 47 CFR Section 0.459 and 0.457 of the commissions rules, the applicant hereby request confidential treatment of the documents listed below, associated with the certification application referenced above. Schematic(s) Block Diagrams Operational Descriptions The documents above contain proprietary information not released to the public. Public disclosure of this information may prove harmful to the business of the applicant. Sincerely, Signature:
Printed Name (on file with the FCC associated with the Grantee Code): Liu Chunge Title: Certification Manager Company Name: K-tronics (Suzhou) Technology Co., Ltd.
1 | SGS FCC modular request letter | Attestation Statements | 178.26 KiB | September 27 2022 |
K-tronics (Suzhou) Technology Co., Ltd. Date:2022-09-22 To:
SGS North America Inc. 620 Old Peachtree Road SUITE 100 Suwanee, Georgia United States Dear Sir/Madam, Re: Request for FCC module certification FCC ID: 2A769-PN7150 We hereby request a Modular certification for the FCC ID referenced above. The device meets the requirements below. The module has metal case covering top and sides as its own RF shielding. The shielding at bottom is implemented by the GND copper plane in PCB substrate. Answer: Yes. Please see External Photo.pdf The module has buffered modulation/data inputs to ensure that the device will comply with Part 15 requirements with any type of input signal;
Answer: Yes. SRAM is used for Tx f /Rx data buffers, it's controlled by the internal ARM The module has power supply regulation on the module;
Answer:Yes. The Power Management Unit of PN7150 generates internal suppliesThe power supply of the module ranges from 4.75V to 5.25V The module has demonstrated compliance in a stand-alone configuration;
Answer: Yes. please see test report The module has a permanently attached antenna, or contain a unique antenna connector, and be marketed and operated only with specific antenna(s), per Sections 15.203, 15.204(b), 15.204(c), 15.212(a), 2.929(b);
Answer: Yes. please see test report & Internal Photos. The module will be labeled with its permanently affixed FCC ID label. Answer: Yes. The label position of module is clearly indicated. Please see the Label &
Location.pdf The module does comply with all specific rules applicable to the transmitter including all the conditions provided in the integration instructions by the grantee;
Answer: The module is compliant with all applicable FCC rules. Detail instructions are given in the User Manual The module does comply with RF exposure requirements. Answer: Yes. The modular comply with applicable RF exposure requirements. Please see MPE Report. Sincerely, Name: Liu Chunge Title: Compliance Engineer Company: K-tronics (Suzhou) Technology Co., Ltd. Telephone: +86-512-63456336 Signature:
K-tronics (Suzhou) Technology Co., Ltd. FCC Modular definitions, From FCC KDB 996369 D01 Module Equip Auth Guide v02 A. Single-modular transmitter is a self-contained, physically delineated, component for which compliance can be demonstrated independent of the host operating conditions, and which complies with all eight requirements of Section 15.212(a)(1) as summarized below. See Section 15.212 for more detailed information, and Section 2.901 (and sub-
sections that follow) for general certification requirements. B. Limited single-modular transmitter is a transmitter that does not meet all eight requirements listed in Section 15.212(a) (1), and compliance can be demonstrated only for specific host and applicable operating conditions in which the transmitter will be used. For example, manufacturers have flexibility with respect to requirements such as module shielding, buffered modulation/data inputs and power supply regulation. If one or more of these functions (shielding, buffered modulation/data inputs and power supply regulation) are provided by a specific host or hosts, then the module can be granted as a limited module that is limited to that specific host or hosts. The responsible party must demonstrate how it will retain control over the final installation of the device, such that compliance of the product is ensured by limiting the installation to a specific host or hosts, for example.
frequency | equipment class | purpose | ||
---|---|---|---|---|
1 | 2022-09-27 | 13.56 ~ 13.56 | DXX - Part 15 Low Power Communication Device Transmitter | Original Equipment |
app s | Applicant Information | |||||
---|---|---|---|---|---|---|
1 | Effective |
2022-09-27
|
||||
1 | Applicant's complete, legal business name |
K-tronics (Suzhou) Technology Co., Ltd.
|
||||
1 | FCC Registration Number (FRN) |
0032720088
|
||||
1 | Physical Address |
No.1088, Dajing Road, Economic and Technological Development Zone
|
||||
1 |
No.1088, Dajing Road, Economic and
|
|||||
1 |
Wujiang District, Suzhou,, N/A
|
|||||
1 |
China
|
|||||
app s | TCB Information | |||||
1 | TCB Application Email Address |
U******@SGS.COM
|
||||
1 | TCB Scope |
A1: Low Power Transmitters below 1 GHz (except Spread Spectrum), Unintentional Radiators, EAS (Part 11) & Consumer ISM devices
|
||||
app s | FCC ID | |||||
1 | Grantee Code |
2A769
|
||||
1 | Equipment Product Code |
PN7150
|
||||
app s | Person at the applicant's address to receive grant or for contact | |||||
1 | Name |
C****** L******
|
||||
1 | Telephone Number |
+86-5********
|
||||
1 | Fax Number |
+86-5********
|
||||
1 |
l******@boe.com.cn
|
|||||
app s | Technical Contact | |||||
1 | Firm Name |
SGS-CSTC Standards Technical Services Co., Ltd.
|
||||
1 | Name |
P****** Z******
|
||||
1 | Physical Address |
588 West Jindu Road, Xinqiao, Songjiang
|
||||
1 |
ShangHai, 201612
|
|||||
1 |
China
|
|||||
1 | Telephone Number |
+8621********
|
||||
1 | Fax Number |
02161********
|
||||
1 |
P******@sgs.com
|
|||||
app s | Non Technical Contact | |||||
1 | Firm Name |
SGS-CSTC Standards Technical Services Co., Ltd.
|
||||
1 | Name |
P******** Z********
|
||||
1 | Physical Address |
588 West Jindu Road, Xinqiao, Songjiang
|
||||
1 |
ShangHai, 201612
|
|||||
1 |
China
|
|||||
1 | Telephone Number |
+8621********
|
||||
1 | Fax Number |
02161********
|
||||
1 |
P******@sgs.com
|
|||||
app s | Confidentiality (long or short term) | |||||
1 | Does this application include a request for confidentiality for any portion(s) of the data contained in this application pursuant to 47 CFR § 0.459 of the Commission Rules?: | Yes | ||||
1 | Long-Term Confidentiality Does this application include a request for confidentiality for any portion(s) of the data contained in this application pursuant to 47 CFR § 0.459 of the Commission Rules?: | No | ||||
if no date is supplied, the release date will be set to 45 calendar days past the date of grant. | ||||||
app s | Cognitive Radio & Software Defined Radio, Class, etc | |||||
1 | Is this application for software defined/cognitive radio authorization? | No | ||||
1 | Equipment Class | DXX - Part 15 Low Power Communication Device Transmitter | ||||
1 | Description of product as it is marketed: (NOTE: This text will appear below the equipment class on the grant) | Door Station | ||||
1 | Related OET KnowledgeDataBase Inquiry: Is there a KDB inquiry associated with this application? | No | ||||
1 | Modular Equipment Type | Single Modular Approval | ||||
1 | Purpose / Application is for | Original Equipment | ||||
1 | Composite Equipment: Is the equipment in this application a composite device subject to an additional equipment authorization? | No | ||||
1 | Related Equipment: Is the equipment in this application part of a system that operates with, or is marketed with, another device that requires an equipment authorization? | No | ||||
1 | Grant Comments | Single Modular Approval. | ||||
1 | Is there an equipment authorization waiver associated with this application? | No | ||||
1 | If there is an equipment authorization waiver associated with this application, has the associated waiver been approved and all information uploaded? | No | ||||
app s | Test Firm Name and Contact Information | |||||
1 | Firm Name |
Compliance Certification Services (Kunshan) Inc.
|
||||
1 | Name |
J******** C********
|
||||
1 | Telephone Number |
+ 86-******** Extension:
|
||||
1 |
J******@sgs.com
|
|||||
Equipment Specifications | |||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Line | Rule Parts | Grant Notes | Lower Frequency | Upper Frequency | Power Output | Tolerance | Emission Designator | Microprocessor Number | |||||||||||||||||||||||||||||||||
1 | 1 | 15C | 13.56000000 | 13.56000000 |
some individual PII (Personally Identifiable Information) available on the public forms may be redacted, original source may include additional details
This product uses the FCC Data API but is not endorsed or certified by the FCC