UltraLight C MF0ICU2
UltraLight C MF0ICU2
UltraLight C MF0ICU2
1. General description
NXP Semiconductors has developed the MIFARE Ultralight C - Contactless ticket IC
MF0ICU2 to be used in a contactless smart ticket or smart card in combination with
Proximity Coupling Devices (PCD). The communication layer (MIFARE RF Interface)
complies to parts 2 and 3 of the ISO/IEC 14443 Type A standard (see Ref. 1 and Ref. 2).
The MF0ICU2 is primarily designed for limited use applications such as public
transportation, event ticketing and loyalty applications.
TFC.1 ticket formats are supported by the MF0xxU20 chip featuring an on-chip resonance
capacitor of 16 pF.
The smaller TFC.0 tickets are supported by the MFxxU21 chip holding an on-chip
resonance capacitor of 50 pF.
When the ticket is positioned in the proximity of the coupling device (PCD) antenna, the
high speed RF communication interface allows the transmission of the data with a baud
rate of 106 kbit/s.
1.2 Anticollision
An intelligent anticollision function allows to operate more than one card in the field
simultaneously. The anticollision algorithm selects each card individually and ensures that
the execution of a transaction with a selected card is performed correctly without
interference from another card in the field.
energy
ISO/IEC 14443 A
PCD data
aaa-006271
1.3 Security
3DES Authentication
Anti-cloning support by unique 7-byte serial number for each device
32-bit user programmable OTP area
Field programmable read-only locking function per page for first 512-bit
Read-only locking per block for the memory above 512 bit
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
2.2 EEPROM
1536-bit total memory 512-bit compatible to MF0ICU1
36 pages, 1152-bit user r/w area Field programmable read-only locking
function per block
Field programmable read-only locking 16-bit one-way counter
function per page for first 512-bit
32-bit user definable One-Time Write endurance 100000 cycles
Programmable (OTP) area
Data retention of 10 years
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
4. Ordering information
Table 3. Ordering information
Type number Package
Name Description Version
MF0ICU2001DUF - 8 inch wafer (laser diced; 75 m thickness, on film frame carrier; electronic -
fail die marking according to SECSII format); 16 pF input capacitance
MF0ICU2101DUF - 8 inch wafer (laser diced; 75 m thickness, on film frame carrier; electronic -
fail die marking according to SECSII format), 50pF input capacitance
MF0ICU2001DUD - 8 inch wafer (laser diced; 120 m thickness, on film frame carrier; electronic -
fail die marking according to SECSII format); 16 pF input capacitance
MF0ICU2101DUD - 8 inch wafer (laser diced; 120 m thickness, on film frame carrier; electronic -
fail die marking according to SECSII format), 50pF input capacitance
MF0MOU2001DA4 PLLMC MOA4 plastic leadless module carrier package; 35 mm wide tape; SOT500-2
16 pF input capacitance
MF0MOU2101DA4 PLLMC MOA4 plastic leadless module carrier package; 35 mm wide tape; SOT500-2
50 pF input capacitance
MF0MOU2001DA8 PLLMC MOA8 plastic leadless module carrier package; 35 mm wide tape; SOT500-4
16 pF input capacitance
MF0MOU2101DA8 PLLMC MOA8 plastic leadless module carrier package; 35 mm wide tape; SOT500-4
50 pF input capacitance
5. Block diagram
CRYPTO
CO PROCESSOR
COMMAND
INTERPRETER
001aah999
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
6. Pinning information
LA top view LB
001aaj820
The pinning is shown as an example in for the MOA4 contactless module. For the contactless module MOA8, the
pinning is analogous and not explicitly shown.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
7. Functional description
RF-Interface:
Modulator/Demodulator
Rectifier
Clock Regenerator
Power On Reset
Voltage Regulator
Crypto coprocessor: Triple - Data Encryption Standard (3DES) coprocessor
Crypto control unit: controls Crypto coprocessor operations
Command Interpreter: Handles the commands supported by the MF0ICU2 in order to
access the memory
EEPROM-Interface
EEPROM: The 1536 bits are organized in 48 pages with 32 bits each. 80 bits are
reserved for manufacturer data. 32 bits are used for the read-only locking mechanism.
32 bits are available as OTP area. 1152 bits are user programmable read/write
memory.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
POR
IDLE HALT
REQA
WUPA
WUPA
READY 1
identification
ANTICOLLISION and
SELECT selection
HALT procedure
of cascade level 1
READ
from address 0 HALT
READY 2
READ ANTICOLLISION
from address 0
SELECT
of cascade level 2
ACTIVE
WRITE READ
of 4 byte of 16 byte
AUTHENTICATE memory
operations
001aai000
Remark: In each state the command interpreter returns to the Idle state if an unexpected
command is received or any other error occurs. If the IC has already been in the Halt state before it
returns to the Halt state in such a case. Those transitions are not explicitly shown in the state
diagram.
Fig 4. State diagram
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
7.2.1 IDLE
After Power On Reset (POR) the MF0ICU2 enters IDLE state. With a REQA or a WUPA
command sent from the PCD transits to the READY1 state. Any other data received in this
state is interpreted as an error and the MF0ICU2 remains waiting in the Idle state.
Please refer to Ref. 4 for implementation hints for a card polling algorithm that respects
relevant timing specifications from ISO/IEC 14443 Type A.
After a correctly executed HLTA command i.e. out of the ACTIVE or AUTHENTICATED
state, the default waiting state changes from the IDLE state to the HALT state. This state
can then be exited with a WUPA command only.
7.2.2 READY1
In the READY1 state the MF0ICU2 supports the PCD in resolving the first part of its UID
(3 bytes) with the ANTICOLLISION or a cascade level 1 SELECT command.
With the cascade level 1 SELECT command the PCD transits the MF0ICU2 into the
READY2 state where the second part of the UID can be resolved
With the READ (from page address 00h) command the complete anticollision
mechanism may be skipped and the MF0ICU2 changes directly into the ACTIVE state
Remark: If more than one MF0ICU2 is in the field of the PCD, a read from address 0 will
cause a collision because of the different serial numbers, but all MF0ICU2 devices will be
selected.
Remark: Any other data received in state READY1 state is interpreted as an error and the
MF0ICU2 falls back to its waiting state (IDLE or HALT, depending on its previous state).
The response of the MF0ICU2 to the cascade level 1 SELECT command is the SAK byte
with value 04h. It indicates that the UID has not been complete received by the PCD yet
and another anticollision level is required.
7.2.3 READY2
In the READY2 state the MF0ICU2 supports the PCD in resolving the second part of its
UID (4 bytes) with the ANTICOLLISION command of cascade level 2. This state is left
with the cascade level 2 SELECT command.
Alternatively, state READY2 state may be skipped via a READ (from block address 00h)
command as described in state READY1.
Remark: If more than one MF0ICU2 is in the field of the PCD, a read from address 00h
will cause a collision because of the different serial numbers, but all MF0ICU2 devices will
be selected.
Remark: The response of the MF0ICU2 to the cascade level 2 SELECT command is the
SAK byte with value 00h. According to ISO/IEC14443 this byte indicates whether the
anticollision cascade procedure is finished (see Ref. 6). In addition it defines for the
MIFARE architecture platform the type of the selected device. At this stage the MF0ICU2
is uniquely selected and only a single device will continue communication with the PCD
even if other contactless devices are in the field of the PCD.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
Any other command received in this state is interpreted as an error and the MF0ICU2 falls
back to its waiting state (IDLE or HALT, depending on its previous state).
7.2.4 ACTIVE
In the ACTIVE state READ (16 bytes), WRITE (4 bytes), COMPATIBILITY WRITE (16
bytes) commands or an authentication can be performed.
The ACTIVE state is gratefully exited with the HLTA command and upon reception the
MF0ICU2 transits to the HALT state.
Any other command received in this state is interpreted as an error and the MF0ICU2
goes back to its waiting state (IDLE or HALT, depending on its previous state).
7.2.5 HALT
Besides the IDLE state the HALT state constitutes the second waiting state implemented
in the MF0ICU2. A MF0ICU2 that has already been processed can be set into this state
via the HLTA command. This state helps the PCD to distinguish between already
processed cards and cards that have not been selected yet. The only way to get the
MF0ICU2 out of this state is the WUPA command or a RF reset. Any other data received
in this state is interpreted as an error and the MF0ICU2 remains in this state.
7.2.6 AUTHENTICATED
In the AUTHENTICATED state either a READ or a WRITE command may be performed to
memory areas, which are only readable and/or writeable after authentication.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
7.4 RF interface
The RF-interface is implemented according to the standard for contactless smart cards
ISO/IEC 14443 Type A (see Ref. 1 and Ref. 2).
The RF-field from the PCD is always present (with short modulation pulses when
transmitting), because it is used for the power supply of the card.
For both directions of data communication there is one start bit at the beginning of each
frame. Each byte is transmitted with a parity bit (odd parity) at the end. The LSBit of the
byte with the lowest byte address within selected page is transmitted first. The maximum
frame length is 164 bits (16 data bytes + 2 CRC bytes = 16 * 9 + 2 * 9 + 1 start bit + 1 end
bit).
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
MSB LSB
0 0 0 0 0 1 0 0 manufacturer ID for NXP Semiconductors (04h)
The three least significant bits of lock byte 0 are the block-locking bits. Bit 2 deals with
pages 0Ah to 0Fh, bit 1 deals with pages 04h to 09h and bit 0 deals with page 03h (OTP).
Once the block-locking bits are set, the locking configuration for the corresponding
memory area is frozen. The functionality of the bits inside the lock bytes 0 and 1 are
shown in Table 6.
page 2
0 1 2 3
For example if BL15-10 is set to logic 1, then bits L15 to L10 (lock byte 1, bit[7:2]) can no
longer be changed. A WRITE command or COMPATIBILITY_WRITE command to page
02h, sets the locking and block-locking bits. Byte 2 and byte 3 of the WRITE or
COMPATIBILITY_WRITE command, and the contents of the lock bytes are bit-wise
ORed and the result then becomes the new content of the lock bytes. This process is
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
irreversible. If a bit is set to logic 1, it cannot be changed back to logic 0. Therefore, before
writing the lock bytes, the user has to ensure that the corresponding user memory area
and/or configuration bytes to be locked are correctly written.
The contents of bytes 0 and 1 of page 02h are unaffected by the corresponding data bytes
of the WRITE (see Section 9.3) or COMPATIBILITY_WRITE (see Section 9.4) command.
For compatibility reasons, the first 512 bits of the memory area have the same
functionality as the MIFARE Ultralight MF0ICU1 (see also Ref. 8), meaning that the two
lock bytes used for the configuration of this memory area have identical functionality. The
mapping of single lock bits to memory area for the first 512 bits is shown in Figure 6 and
Table 6.
Any write operation to the lock bytes 0 and 1, features anti-tearing support.
Remark: The configuration written in the lock bytes is valid upon the next REQA or WUPA
command.
Remark: Set all bits marked with RFUI to 0, when writing to the lock bytes.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
BLOCK LOCKING
BLOCK LOCKING
BLOCK LOCKING
BLOCK LOCKING
BLOCK LOCKING
BLOCK LOCKING
LOCKBIT AUTH1
LOCKBIT AUTH0
LOCKBIT AUTH1
LOCKBIT AUTH0
PAGES 29 - 39
PAGES 16 - 27
LOCKBIT CNT
LOCKBIT CNT
LOCKBIT KEY
LOCKBIT KEY
PAGE 44 - 47
LOCK PAGE
LOCK PAGE
LOCK PAGE
LOCK PAGE
LOCK PAGE
LOCK PAGE
PAGE 43
PAGE 42
PAGE 41
36 - 39
32 - 35
28 - 31
24 - 27
20 - 23
16 - 19
bit 7 6 5 4 3 2 1 0 bit 7 6 5 4 3 2 1 0
The default value of lock bytes 2 and 3 is 00 00h. The value of byte 3 on page 28h (see
Figure 7) is always BDh when read.
The contents of bytes 2 and 3 of page 28h are unaffected by the corresponding data bytes
of the WRITE (see Section 9.3) or COMPATIBILITY_WRITE (see Section 9.4) command.
Any write operation to the lock bytes 2 and 3, features anti-tearing support.
Remark: The configuration written in the lock bytes is valid upon the next REQA or WUPA
command.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
EXAMPLE
page 3 default value OTP bytes
byte 0 1 2 3 00000000 00000000 00000000 00000000
OTP bytes 1st write command to page 3
11111111 11111100 00000101 00000111
result in page 3
11111111 11111100 00000101 00000111
result in page 3
11111111 11111100 00111101 10000111
001aai004
(1) Remark: This memory area may be used as a 32 ticks one-time counter.
Fig 8. OTP bytes
The bytes of the WRITE command and the current contents of the OTP bytes are bit-wise
OR-ed and the result forms the new content of the OTP bytes. This process is
irreversible. If a bit is set to 1, it cannot be changed back to 0 again.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
See command details in Section 9.5. The used key is a double length DES Key; where the
parity bits are not checked or used.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
A2 2C 07 06 05 04 CRC
A2 2D 03 02 01 00 CRC
A2 2E 0F 0E 0D 0C CRC
A2 2F 0B 0A 09 08 CRC
The memory pages holding the authentication key can never be read, independent of the
configuration.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
AUTH0 defines the page address from which the authentication is required. Valid
address values for byte AUTH0 are from 03h to 30h.
Setting AUTH0 to 30h effectively disables memory protection.
AUTH1 determines if write access is restricted or both read and write access are
restricted, see Table 12
A write access to data memory is done with a WRITE (see Section 9.3) or a
COMPATIBILITY WRITE (see Section 9.4) command. In both cases, 4 bytes of memory -
(one page) - will be written. Write access to data memory can be permanently restricted
via lock bytes (see Section 7.5.2 and Section 7.5.3) and/or permanently or temporary
restricted using an authentication (see Section 7.5.5).
Reading data is done using the READ command (see Section 9.2).
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
This configuration ensures that the complete memory area is available for personalization,
without knowledge of the authentication key. All lock bytes are set to zero meaning that no
page or functionality is locked. The Counter is set to zero.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
7.6 Counter
The MF0ICU2 features a 16-bit one-way counter, located at the first two bytes of page
29h. The default counter value is 0000h.
The first1 valid WRITE or COMPATIBILITY WRITE to address 29h can be performed with
any value in the range between 0001h and FFFFh and corresponds to the initial counter
value. Every consecutive WRITE command, which represents the increment, can contain
values between 0001h and 000Fh. Upon such WRITE command and following mandatory
RF reset, the value written to the address 29h is added to the counter content.
After the initial write, only the lower nibble of the first data byte is used for the increment
value (0h-Fh) and the remaining part of the data is ignored. Once the counter value
reaches FFFFh and an increment is performed via a valid WRITE command, the
MF0ICU2 will reply a NAK. If the sum of counter value and increment is higher than
FFFFh, MF0ICU2 will reply a NAK and will not increment the counter.
An increment by zero (0000h) is always possible, but does not have any impact to the
counter value.
Byte Nr 0 1 2 3
00 00 00 00
initial WRITE F0 00 00 00
F0 00 00 00
increment by 1 01 00 00 00
F1 00 00 00
increment by 15 0F 00 00 00
00 01 00 00
increment by 15 0F 00 00 00
0F 01 00 00
increment by 7 07 00 00 00
16 01 00 00
aaa-013579
1. The first valid write is defined as a write to a counter value of 0000h with an argument different than zero
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
8. Command overview
The MIFARE Ultralight C card activation follows the ISO/IEC 14443 Type A. After the
MIFARE Ultralight C card has been selected, it can either be deactivated using the
ISO/IEC 14443 Halt command, or the MIFARE Ultralight C commands can be performed.
For more details about the card activation refer to Ref. 2.
All commands use the coding and framing as described in Ref. 1 and Ref. 2 if not
otherwise specified.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
8.2 Timings
The timing shown in this document are not to scale and values are rounded to 1 s.
All given command and response transmission times refer to the data frames including
start of communication and end of communication. A PCD data frame contains the start of
communication (1 start bit) and the end of communication (one logic 0 + 1 bit length of
unmodulated carrier). A PICC data frame contains the start of communication (1 start bit)
and the end of communication (1 bit length of no subcarrier).
All command timings are according to ISO/IEC 14443-3 frame specification as shown for
the Frame Delay Time in Figure 10. For more details refer to Ref. 1 and Ref. 2.
last data bit transmitted by the PCD first modulation of the PICC
aaa-006279
Fig 10. Frame Delay Time (from PCD to PICC) and TACK and TNAK
Remark: Due to the coding of commands, the measured timings usually excludes (a part
of) the end of communication. Consider this factor when comparing the specified with the
measured times.
The MIFARE Ultralight C - Contactless ticket IC distinguishes between positive (ACK) and
negative (NAK) acknowledge. Valid values for ACK and NAK are shown in Table 15.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
After every NAK, the MF0ICU2 performs an internal reset and returns to IDLE or HALT
state.
Remark: Any 4-bit response different from Ah shall be interpreted as NAK, although not
all 4-bit values are detailed in Table 15
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
9.2 READ
The READ command takes the page address as a parameter. Only addresses 00h to 2Bh
are decoded. For higher addresses the MF0ICU2 returns a NAK. The MF0ICU2 responds
to the READ command by sending 16 bytes starting from the page address defined in the
command (e.g. if ADR is 03h, pages 03h, 04h, 05h, 06h are returned). The command
structure is shown in Figure 11 and Table 17.
A roll-over mechanism is implemented to continue reading from page 00h once the end of
the accessible memory is reached. For example, reading from address 29h on a
MF0ICU2 results in pages 29h, 2Ah, 2Bh and 00h being returned.
The following conditions apply if part of the memory is protected by the 3DES
authentication for read access:
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
9.3 WRITE
The WRITE command is used to program the lock bytes in page 02h, the OTP bytes in
page 03h, data bytes in pages 04h to 27h, configuration data from page 28h to 2B and
keys from page 2Ch to 2Fh. A WRITE command is performed page-wise, programming 4
bytes in a page.The WRITE command is shown in Figure 12 and Table 19.
708 s TACK 57 s
aaa-006286
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
Personalization of authentication key: For writing the authentication key, one needs to
write the key with four commands. The first command shall have the 4 least significant
bytes of the key and shall be written on page 2Ch, the second 4 bytes shall be written on
page 2Dh, the next 4 bytes shall be written on page 2Eh, the last 4 bytes shall be written
on page 2Fh.
368 s TACK 59 s
001aan015
1558 s TACK 59 s
001aan016
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
9.5 AUTHENTICATE
Description: The authentication process is detailed Section 7.5.5.
The command is performed in the same protocol as READ, WRITE and COMPATIBILITY
WRITE.
TNAK 57 s
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
TNAK 57 s
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
11. Characteristics
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
[1] The step size and the gap between chips may vary due to changing foil expansion
[2] Pads VSS and TESTIO are disconnected when wafer is sawn.
detail X
0 10 20 mm
scale
DIMENSIONS (mm are the original dimensions)
UNIT A (1) D
max.
For unspecified dimensions see PLLMC-drawing given in the subpackage code.
35.05
mm 0.33
34.95
Note
1. Total package thickness, exclusive punching burr.
03-09-17
SOT500-2 --- --- ---
06-05-22
detail X
0 10 20 mm
Dimensions scale
Unit A(1) D
max 0.26 35.05 For unspecified dimensions see PLLMC-drawing given in the subpackage code.
mm nom 35.00
min 34.95
Note
1. Total package thickness, exclusive punching burr. sot500-4_po
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
x [m] y [m]
Chip Step 710(1) 710(1)
Bump size
LA, LB, VSS, VDD, TEST 60 60
typ. 22(1)
min. 5
typ. 22(1)
min. 5
MF0ICU2
LA
VDD
typ. 710(1)
626
528.6
43.5
223.6
TEST GND LB
49.1
y
626
x typ. 710(1)
(1) the air gap and thus the step size may vary due to varying foil expansion
(2) all dimensions in m, pad locations measured from metal ring edge (see detail) aaa-013576
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
13. Abbreviations
Table 31. Abbreviations
Acronym Description
3DES Triple Data Encryption Standard
ACK Positive Acknowledge
ATQA Answer To ReQuest, type A
BCC Block Check Characters byte
CBC Cipher-Block Chaining
CRC Cyclic Redundancy Check
CT Cascade Tag, Type A
EEPROM Electrically Erasable Programmable Read-Only Memory
fc carrier frequency 13.56 MHz
HLTA Halt A command
IV Initial Value
LSB Least Significant Bit
MSB Most Significant Bit
NAK Negative AcKnowledge
OTP One Time Programmable
Passive ACK Implicit acknowledge without PICC answer
PCD Proximity Coupling Device
PICC Proximity Integrated Circuit Card
POR Power On Reset
REQA ReQuest Answer, type A
RF Radio Frequency
SAK Select AcKnowledge, type A
UID Unique Identifier
WUPA Wake-UP command, type A
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
14. References
[1] ISO/IEC 14443-2 2001
[2] ISO/IEC 14443-3 2001
[3] MIFARE Interface Platform Type Identification Procedure Application note,
BL-ID Doc. No.: 0184**2
[4] MIFARE ISO/IEC 14443 PICC Selection Application note,
BL-ID Doc. No.: 1308**
[5] MIFARE Ultralight Features and Hints Application note, BL-ID Doc. No.:
0731**
[6] MIFARE Ultralight as Type 2 Tag Application note, BL-ID Doc. No.: 1303**
[7] MIFARE (Card) Coil Design Guide Application note, BL-ID Doc. No.: 0117**
[8] MF0ICU1 Functional specification MIFARE Ultralight Product data sheet,
BL-ID Doc. No. 0286**
[9] NIST SP800-67: Recommendation for the Triple Data Encryption Algorithm
(TDEA) Block Cipher, Version 1.1 May 19, 2008 National Institute of Standards
and Technology
[10] ISO/IEC 10116: Information technology - Security techniques - Modes of
operation for an n-bit block cipher, February 1, 2006 International
Organization for Standardization
[11] Contactless smart card module specification MOA4 Delivery Type
Description, BU-ID Document number 0823**2
[12] Contactless smart card module specification MOA8 Delivery Type
Description, BU-ID Document number 1636**2
[13] General specification for 8" wafer on UV-tape; delivery types Delivery Type
Description, BU-ID Document number 1005**2
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
[1] Please consult the most recently issued document before initiating or completing a design.
[2] The term short data sheet is explained in section Definitions.
[3] The product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple devices. The latest product status
information is available on the Internet at URL http://www.nxp.com.
16.2 Definitions Suitability for use NXP Semiconductors products are not designed,
authorized or warranted to be suitable for use in life support, life-critical or
safety-critical systems or equipment, nor in applications where failure or
Draft The document is a draft version only. The content is still under
malfunction of an NXP Semiconductors product can reasonably be expected
internal review and subject to formal approval, which may result in
to result in personal injury, death or severe property or environmental
modifications or additions. NXP Semiconductors does not give any
damage. NXP Semiconductors and its suppliers accept no liability for
representations or warranties as to the accuracy or completeness of
inclusion and/or use of NXP Semiconductors products in such equipment or
information included herein and shall have no liability for the consequences of
applications and therefore such inclusion and/or use is at the customers own
use of such information.
risk.
Short data sheet A short data sheet is an extract from a full data sheet
Applications Applications that are described herein for any of these
with the same product type number(s) and title. A short data sheet is intended
products are for illustrative purposes only. NXP Semiconductors makes no
for quick reference only and should not be relied upon to contain detailed and
representation or warranty that such applications will be suitable for the
full information. For detailed and full information see the relevant full data
specified use without further testing or modification.
sheet, which is available on request via the local NXP Semiconductors sales
office. In case of any inconsistency or conflict with the short data sheet, the Customers are responsible for the design and operation of their applications
full data sheet shall prevail. and products using NXP Semiconductors products, and NXP Semiconductors
accepts no liability for any assistance with applications or customer product
Product specification The information and data provided in a Product design. It is customers sole responsibility to determine whether the NXP
data sheet shall define the specification of the product as agreed between Semiconductors product is suitable and fit for the customers applications and
NXP Semiconductors and its customer, unless NXP Semiconductors and products planned, as well as for the planned application and use of
customer have explicitly agreed otherwise in writing. In no event however, customers third party customer(s). Customers should provide appropriate
shall an agreement be valid in which the NXP Semiconductors product is design and operating safeguards to minimize the risks associated with their
deemed to offer functions and qualities beyond those described in the applications and products.
Product data sheet.
NXP Semiconductors does not accept any liability related to any default,
damage, costs or problem which is based on any weakness or default in the
16.3 Disclaimers customers applications or products, or the application or use by customers
third party customer(s). Customer is responsible for doing all necessary
testing for the customers applications and products using NXP
Limited warranty and liability Information in this document is believed to
Semiconductors products in order to avoid a default of the applications and
be accurate and reliable. However, NXP Semiconductors does not give any
the products or of the application or use by customers third party
representations or warranties, expressed or implied, as to the accuracy or
customer(s). NXP does not accept any liability in this respect.
completeness of such information and shall have no liability for the
consequences of use of such information. NXP Semiconductors takes no Limiting values Stress above one or more limiting values (as defined in
responsibility for the content in this document if provided by an information the Absolute Maximum Ratings System of IEC 60134) will cause permanent
source outside of NXP Semiconductors. damage to the device. Limiting values are stress ratings only and (proper)
operation of the device at these or any other conditions above those given in
In no event shall NXP Semiconductors be liable for any indirect, incidental,
the Recommended operating conditions section (if present) or the
punitive, special or consequential damages (including - without limitation - lost
Characteristics sections of this document is not warranted. Constant or
profits, lost savings, business interruption, costs related to the removal or
repeated exposure to limiting values will permanently and irreversibly affect
replacement of any products or rework charges) whether or not such
the quality and reliability of the device.
damages are based on tort (including negligence), warranty, breach of
contract or any other legal theory. Terms and conditions of commercial sale NXP Semiconductors
Notwithstanding any damages that customer might incur for any reason products are sold subject to the general terms and conditions of commercial
whatsoever, NXP Semiconductors aggregate and cumulative liability towards sale, as published at http://www.nxp.com/profile/terms, unless otherwise
customer for the products described herein shall be limited in accordance agreed in a valid written individual agreement. In case an individual
with the Terms and conditions of commercial sale of NXP Semiconductors. agreement is concluded only the terms and conditions of the respective
agreement shall apply. NXP Semiconductors hereby expressly objects to
Right to make changes NXP Semiconductors reserves the right to make applying the customers general terms and conditions with regard to the
changes to information published in this document, including without purchase of NXP Semiconductors products by customer.
limitation specifications and product descriptions, at any time and without
notice. This document supersedes and replaces all information supplied prior No offer to sell or license Nothing in this document may be interpreted or
to the publication hereof. construed as an offer to sell products that is open for acceptance or the grant,
conveyance or implication of any license under any copyrights, patents or
other industrial or intellectual property rights.
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
Export control This document as well as the item(s) described herein NXP Semiconductors specifications such use shall be solely at customers
may be subject to export control regulations. Export might require a prior own risk, and (c) customer fully indemnifies NXP Semiconductors for any
authorization from competent authorities. liability, damages or failed product claims resulting from customer design and
use of the product for automotive applications beyond NXP Semiconductors
Quick reference data The Quick reference data is an extract of the
standard warranty and NXP Semiconductors product specifications.
product data given in the Limiting values and Characteristics sections of this
document, and as such is not complete, exhaustive or legally binding. Translations A non-English (translated) version of a document is for
reference only. The English version shall prevail in case of any discrepancy
Non-automotive qualified products Unless this data sheet expressly
between the translated and English versions.
states that this specific NXP Semiconductors product is automotive qualified,
the product is not suitable for automotive use. It is neither qualified nor tested
in accordance with automotive testing or application requirements. NXP
Semiconductors accepts no liability for inclusion and/or use of
16.4 Trademarks
non-automotive qualified products in automotive equipment or applications. Notice: All referenced brands, product names, service names and trademarks
In the event that customer uses the product for design-in and use in are the property of their respective owners.
automotive applications to automotive specifications and standards, customer MIFARE is a trademark of NXP Semiconductors N.V.
(a) shall use the product without NXP Semiconductors warranty of the
product for such automotive applications, use and specifications, and (b) MIFARE Ultralight is a trademark of NXP Semiconductors N.V.
whenever customer uses the product for automotive applications beyond
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
18. Tables
Table 1. Naming conventions . . . . . . . . . . . . . . . . . . . . . .2
Table 2. Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . .3
Table 3. Ordering information . . . . . . . . . . . . . . . . . . . . . .4
Table 4. Pin allocation table . . . . . . . . . . . . . . . . . . . . . . .5
Table 5. Memory organization . . . . . . . . . . . . . . . . . . . .10
Table 6. Functionality of lock bits in lock byte 0 and 1 . .12
Table 7. Functionality of lock bits in lock byte 2 and 3 . .13
Table 8. 3DES authentication . . . . . . . . . . . . . . . . . . . . .15
Table 9. Numerical 3DES authentication example . . . . .16
Table 10. Key memory configuration . . . . . . . . . . . . . . . .17
Table 11. Memory content based on example
configuration . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Table 12. AUTH1 bit description. . . . . . . . . . . . . . . . . . . .18
Table 13. Initial memory organization . . . . . . . . . . . . . . .19
Table 14. Command overview . . . . . . . . . . . . . . . . . . . . .21
Table 15. ACK and NAK values . . . . . . . . . . . . . . . . . . . .23
Table 16. Summary of relevant data for device
identification . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Table 17. READ command . . . . . . . . . . . . . . . . . . . . . . . .25
Table 18. READ timing . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Table 19. WRITE command . . . . . . . . . . . . . . . . . . . . . . .26
Table 20. WRITE timing . . . . . . . . . . . . . . . . . . . . . . . . . .26
Table 21. COMPATIBILITY_WRITE command . . . . . . . .28
Table 22. COMPATIBILITY_WRITE timing. . . . . . . . . . . .28
Table 23. AUTHENTICATE part 1 command . . . . . . . . . .29
Table 24. AUTHENTICATE part 1 timing . . . . . . . . . . . . .29
Table 25. AUTHENTICATE Step 2 . . . . . . . . . . . . . . . . . .29
Table 26. AUTHENTICATE part 2 command . . . . . . . . . .30
Table 27. AUTHENTICATE part 2 timing . . . . . . . . . . . . .30
Table 28. Limiting values . . . . . . . . . . . . . . . . . . . . . . . . .31
Table 29. Characteristics . . . . . . . . . . . . . . . . . . . . . . . . .31
Table 30. Wafer specifications MF0ICU2x01DUy . . . . . .32
Table 31. Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . .36
Table 32. Revision history . . . . . . . . . . . . . . . . . . . . . . . .38
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
19. Figures
Fig 1. Contactless System . . . . . . . . . . . . . . . . . . . . . . . .1
Fig 2. Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
Fig 3. Contact assignments for SOT500-2 (MOA4) . . . .5
Fig 4. State diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
Fig 5. UID/serial number . . . . . . . . . . . . . . . . . . . . . . . . 11
Fig 6. Lock bytes 0 and 1. . . . . . . . . . . . . . . . . . . . . . . . 11
Fig 7. Lock bytes 2 and 3. . . . . . . . . . . . . . . . . . . . . . . .13
Fig 8. OTP bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
Fig 9. Counter example . . . . . . . . . . . . . . . . . . . . . . . . .20
Fig 10. Frame Delay Time (from PCD to PICC)
and TACK and TNAK. . . . . . . . . . . . . . . . . . . . . . . .22
Fig 11. READ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
Fig 12. WRITE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
Fig 13. COMPATIBILITY WRITE part 1 . . . . . . . . . . . . . .27
Fig 14. COMPATIBILITY WRITE part 2 . . . . . . . . . . . . . .27
Fig 15. AUTHENTICATE Step 1 . . . . . . . . . . . . . . . . . . .29
Fig 16. AUTHENTICATE Step 2 . . . . . . . . . . . . . . . . . . .30
Fig 17. Package outline SOT500-2 . . . . . . . . . . . . . . . . .33
Fig 18. Package outline SOT500-4 . . . . . . . . . . . . . . . . .34
Fig 19. Bare die outline MF0ICU2x01DUy. . . . . . . . . . . .35
137632 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2014. All rights reserved.
20. Contents
1 General description . . . . . . . . . . . . . . . . . . . . . . 1 9.2 READ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.1 Contactless energy and data transfer. . . . . . . . 1 9.3 WRITE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
1.2 Anticollision. . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 9.4 COMPATIBILITY WRITE . . . . . . . . . . . . . . . . 27
1.3 Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 9.5 AUTHENTICATE . . . . . . . . . . . . . . . . . . . . . . 29
1.4 Naming conventions . . . . . . . . . . . . . . . . . . . . . 2 10 Limiting values . . . . . . . . . . . . . . . . . . . . . . . . 31
2 Features and benefits . . . . . . . . . . . . . . . . . . . . 3 11 Characteristics . . . . . . . . . . . . . . . . . . . . . . . . 31
2.1 MIFARE RF Interface (ISO/IEC 14443 A). . . . . 3 11.1 Electrical characteristics . . . . . . . . . . . . . . . . 31
2.2 EEPROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 12 Wafer specification . . . . . . . . . . . . . . . . . . . . . 32
3 Quick reference data . . . . . . . . . . . . . . . . . . . . . 3 12.1 Fail die identification . . . . . . . . . . . . . . . . . . . 32
4 Ordering information . . . . . . . . . . . . . . . . . . . . . 4 12.2 Package outline. . . . . . . . . . . . . . . . . . . . . . . . 33
5 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 4 12.3 Bare die outline . . . . . . . . . . . . . . . . . . . . . . . . 35
6 Pinning information . . . . . . . . . . . . . . . . . . . . . . 5 13 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . 36
6.1 Smart card contactless module . . . . . . . . . . . . 5 14 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
7 Functional description . . . . . . . . . . . . . . . . . . . 6 15 Revision history . . . . . . . . . . . . . . . . . . . . . . . 38
7.1 Block description . . . . . . . . . . . . . . . . . . . . . . . 6 16 Legal information . . . . . . . . . . . . . . . . . . . . . . 39
7.2 State diagram and logical states description . . 7
16.1 Data sheet status . . . . . . . . . . . . . . . . . . . . . . 39
7.2.1 IDLE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
16.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
7.2.2 READY1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
16.3 Disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . . 39
7.2.3 READY2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
16.4 Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . 40
7.2.4 ACTIVE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
7.2.5 HALT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 17 Contact information . . . . . . . . . . . . . . . . . . . . 40
7.2.6 AUTHENTICATED . . . . . . . . . . . . . . . . . . . . . . 9 18 Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.3 Data integrity. . . . . . . . . . . . . . . . . . . . . . . . . . . 9 19 Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
7.4 RF interface . . . . . . . . . . . . . . . . . . . . . . . . . . 10 20 Contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
7.5 Memory organization . . . . . . . . . . . . . . . . . . . 10
7.5.1 UID/serial number. . . . . . . . . . . . . . . . . . . . . . 10
7.5.2 Lock byte 0 and 1 . . . . . . . . . . . . . . . . . . . . . . 11
7.5.3 Lock byte 2 and 3 . . . . . . . . . . . . . . . . . . . . . . 12
7.5.4 OTP bytes. . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
7.5.5 3DES Authentication . . . . . . . . . . . . . . . . . . . 15
7.5.6 3DES Authentication example . . . . . . . . . . . . 16
7.5.7 Programming of 3DES key to memory . . . . . . 17
7.5.8 Configuration for memory access via 3DES
Authentication . . . . . . . . . . . . . . . . . . . . . . . . . 18
7.5.9 Data pages . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
7.5.10 Initial memory configuration . . . . . . . . . . . . . . 19
7.6 Counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
8 Command overview . . . . . . . . . . . . . . . . . . . . . 21
8.1 MIFARE Ultralight C command overview . . . . 21
8.2 Timings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
8.3 MIFARE Ultralight C ACK and NAK . . . . . . . . 22
8.4 Summary of device identification data . . . . . . 23
9 MIFARE Ultralight C - Contactless ticket IC
commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
9.1 MIFARE Ultralight C - Contactless ticket IC
card activation . . . . . . . . . . . . . . . . . . . . . . . . 24
Please be aware that important notices concerning this document and the product(s)
described herein, have been included in section Legal information.