STMicroelectronics-M24SR64-YMN8T-2

Signal descriptions

M24SR64-Y

Signal descriptions

2.1

Serial clock (SCL)

This input signal is used to strobe all data in and out of the device. In applications where this

signal is used by slave devices to synchronize the bus to a slower clock, the bus master

must have an open drain output, and a pull-up resistor must be connected from Serial clock

(SCL) to V

. (

indicates how the value of the pull-up resistor can be calculated).

In most applications, though, this method of synchronization is not employed, and so the

pull-up resistor is not necessary, provided that the bus master has a push-pull (rather than

open drain) output.

2.2

2.3

Serial data (SDA)

This bidirectional signal is used to transfer data in or out of the device. It is an open drain

output that may be wire-OR’ed with other open drain or open collector signals on the bus. A

pull-up resistor must be connected from Serial data (SDA) to V

. (

indicates how

the value of the pull-up resistor can be calculated).

Antenna coil (AC0, AC1)

These inputs are used to connect the device to an external coil exclusively. It is advised not

to connect any other DC or AC path to AC0 or AC1.

When correctly tuned, the coil is used to access the device using NFC Forum Type 4

commands.

2.4

Ground (V

)

, when connected, is the reference for the V

supply voltage for all pads, even AC0

and AC1.

2.5

Supply voltage (V

)

This pin can be connected to an external DC supply voltage.

Note:

2.5.1

An internal voltage regulator allows the external voltage applied on V

to supply the

M24SR64-Y.

Operating supply voltage V

Prior to selecting the M24SR64-Y and issuing instructions to it, a valid and stable V

voltage within the specified [V

(min), V

(max)] range must be applied.

aintain a

stable DC supply voltage, it is recommended to decouple the V

line with suitable

capacitors (usually of the order of 10 nF and 100 pF) close to the V

/V package

pins.

CC SS

This voltage must remain stable and valid until the end of the transmission of the instruction

and, for a writing instruction (UpdateBinary, ChangeReferenceData,

DocID023790 Rev 20

M24SR64-Y

Signal descriptions

EnableVerificationRequirement, DisableVerificationRequirement, EnablePermanentState,

DisablePermanentState, until the completion of the internal I²C write cycle (t

2.5.2

2.5.3

Power-up conditions

When the power supply is turned on, V

rises from V

to V

. The V

rise time must not

vary faster than 1V/µs.

Device reset in I²C mode

In order to prevent inadvertent write operations during power-up, a power-on reset (POR)

circuit is included. At power-up (continuous rise of V

), the M24SR64-Y does not respond

to any I²C instruction until V

has reached the power-on reset threshold voltage (this

threshold is lower than the minimum V

operating voltage defined). When V

passes

over the POR threshold, the device is reset and enters the Standby power mode. However,

the device must not be accessed until V

has reached a valid and stable V

voltage

within the specified [V

(min), V

(max)] range.

In a similar way, during power-down (continuous decrease in V

), as soon as V

drops

below the power-on reset threshold voltage, the M24SR64-Y stops responding to any

instruction sent to it.

2.5.4

Power-down conditions

During power-down (continuous decay of V

), the M24SR64-Y must be in Standby power

mode (mode reached after decoding a Stop condition, assuming that there is no internal

operation in progress).

2.6

RF disable

This input signal is used to disable the RF communication. When the voltage on the V

is below the POR level or not connected, an internal pull-down resistor is connected on this

pad. Thus, the RF disable pad is maintained to the low level and the RF analog front end is

activated. When the voltage on the V

pin is higher than the POR level, the I²C host shall

set this pin to enable or disable the RF communication. In Dual interface mode, RF disable

must not be left floating.

2.7

General purpose output (GPO)

The GPO pad is an open drain pad and a external pull-up resistor shall be connected to it.

This pad is a configurable output signal. On delivery, GPO is configured as Session opened.

Its behavior is consistent with the I

C or RF session activated and with the mode chosen by

the user. The GPO pad is enable when an RF or an I

C session is open. When neither an

RF nor an I

C session is open, the GPO is high impedance.

DocID023790 Rev 20

Signal descriptions

M24SR64-Y

(1)

The user can select one of these configurations

•

SessionOpen: an RF or I C session is ongoing.

MIP (NDEF Message updating In Progress): the RF host is writing an NDEF length

different from 0x0000. This mode can be used to detect when the RF host changes the

NDEF message as defined by the NFC Forum.

•

WIP (Writing In Progress): the M24SR64-Y is executing a writing operation.

INT (interrupt): the I C or RF host can force the M24SR64-Y to send a negative pulse

on the GPO pin.

•

I C ready response: an I C response is ready to be read by the I²C host.

State mode: the I C or RF host can control the state of the GPO pad during the RF

session.

•

RF busy: an RF host is communicating with the M24SR64-Y.

2.7.1

Session Open configuration (GPO field = 0xX1 or 0x1X)

When the GPO is configured as “Session Open”, it goes to the Low state when an RF or I

session is ongoing (see

Figure 3

An RF session is taken when M24SR64-Y receives a valid Select Application. The session

is released after M24SR64-Y has received a valid Deselect command, if M24SR64-Y has

received a Kill RF session command in I

C or when the RF field became OF

An I

C session is taken when M24SR64-Y receives a valid Get session command or a valid

Kill RF session command. The session is released after M24SR64-Y has received I

C token

release sequence or after a Power Off.

GPO is driven low after a delay (1) or (3) when the session is open.

GPO is released after a delay (2) or (4) when the session is released.

Figure 3. GPO configured as Session Open (GPO field = 0xX1 or 0x1X)

^ĞƐƐŝŽŶ

Z&ꢁ

^ĞƐƐŝŽŶ

Z&ꢁ^ĞƐƐŝŽŶ

/Ϯꢂꢁ^ĞƐƐŝŽŶ

;ϰͿ

;ϯͿ

;ϭͿ

;ϮͿ

‘WKꢁĂƐꢁ^ĞƐƐŝŽŶꢁKƉĞŶ

D^ϯϬϳϴϰsϮ

1. CmdEOFtoGPlow

(RF command End of frame to GPORF Session pad low)

2. CmdEOFtoGPHZ

(RF command End of frame to GPORF Session pad HZ)

3. CmdSTPtoGPlow

(I2C command stop to GPO low)

4. AnswerlbLBtoGPHZ

(I2C answer last bit of last byte to GPO HZ)

1. See

Table 81

for more details.

DocID023790 Rev 20

M24SR64-Y

Signal descriptions

2.7.2

WIP Writing in Progress configuration (GPO field = 0xX2 or 0x2X)

When the GPO is configured as “WIP”, it goes to the Low state during an I

C or RF writing

operation.

During an RF or I

C session, when M24SR64-Y updates a file, GPO is driven low after a

delay (1) or (3) following the beginning of the correspondent UpdateBinary command

execution.

GPO will remain low during the writing time (2) or (4), before being released.

Figure 4. GPO configured as WIP (GPO field = 0xX2 or 0x2X)

;ϭͿꢁ

Z&ꢁŽƌꢁ/Ϯꢂꢁ

ĐŚĂŶŶĞůꢁꢁ

Žƌꢁ

;ϯͿ

hƉĚĂƚĞꢁ

ĐŽŵŵĂŶĚ

ꢄŶĚꢁŽĨꢁǁƌŝƚŝŶŐꢁ

ŽƉĞƌĂƚŝŽŶ

ꢃŶǇꢁŽƚŚĞƌꢁ

ĐŽŵŵĂŶĚ

‘WKꢁĂƐꢁt/W

;ϮͿꢁŽƌꢁ;ϰͿ

D^ϯϬϳϴϲsϯ

1. CmdSTPtoGPlow

(I2C Command Stop to GPO low)

2. Writing

time duration

3. CmdEOFtoGPlow

(RF Command End of frame to GPO low)

4. Writing

time duration

DocID023790 Rev 20

Signal descriptions

M24SR64-Y

2.7.3

I C

answer ready configuration (GPO field = 0xX3)

When the GPO is configured as I C answer ready, it goes to the Low state when the

M24SR64-Y has finished to treat the I

C command and is ready to send the I C response.

During an I

C session, after receiving a valid I

C command, GPO pin is driven low after a

delay when M24SR64-Y is ready to deliver a response on the I C bus.

GPO is released when M24SR64-Y receives a new command.

Figure 5. GPO configured as I C answer ready (GPO field = 0xX3)

/ϸꢂꢁĐŚĂŶŶĞů

KƉĞŶꢁ

^ĞƐƐŝŽŶ

ꢃŶǇꢁ/ϸꢂꢁ

ĐŽŵŵĂŶĚ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

ꢃŶǇꢁ/ϸꢂꢁ

ĐŽŵŵĂŶĚ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

ꢃŶǇꢁ/ϸꢂꢁ

ĐŽŵŵĂŶĚ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

‘WKꢁĂƐꢁ/ϸꢂꢁ

ĂŶƐǁĞƌꢁƌĞĂĚǇ

D^ϯϬϳϴϴsϰ

DocID023790 Rev 20

M24SR64-Y

Signal descriptions

2.7.4

MIP NDEF Message writing in Progress configuration

(GPO field = 0x3X)

When the GPO is configured as MI

ts state goes to the low state when the RF host writes

the NDEF length to another value than 0x0000.

During an RF session, when M24SR64-Y changes an NDEF file and updates the NDEF

length with a value different from 0x0000, GPO is driven low after a delay (1) following the

beginning of the correspondent UpdateBinary command execution.

GPO will remain low during the writing time (2), before being released.

Figure 6. GPO configured as MIP (GPO field = 0x3X)

Z&ꢁĐŚĂŶŶĞů

hƉĚĂƚĞꢁƚŚĞꢁEꢀꢄ&ꢁ

ůĞŶŐƚŚꢁ͊сꢁϬǆϬϬϬϬ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

ꢃŶǇꢁŽƚŚĞƌꢁ

ĐŽŵŵĂŶĚ

‘WKꢁĂƐꢁD/W

;ϭͿ

;ϮͿ

D^ϯϬϳϴϱsϯ

1. CmdEOFtoGPlow

(RF command End of frame to GPO low)

2. Writing

time duration

DocID023790 Rev 20

Signal descriptions

M24SR64-Y

2.7.5

INT Interrupt configuration (GPO field = 0xX4 or 0x4X)

The I

C or RF host can send a negative pulse on the GPO pad. The GPO pad goes to the

low state at the end of the command and goes to the high state at the end of the M24SR64-

Y response.

During an RF or I

C session, when M24SR64-Y receives a valid Interrupt command,

M24SR64-Y GPO pin is driven low after (1) or (3) for a duration of (4) in R

r after

responding in I2C (2). Then GPO pin is released.

Figure 7. GPO configured as INT (GPO field = 0xX4 or 0x4X)

Z&ꢁŽƌꢁ/ϸꢂꢁ

ĐŚĂŶŶĞů

;ϭͿꢁ

Žƌꢁ

;ϯͿ

;ϮͿꢁꢁ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

^ĞŶĚꢁ

/ŶƚĞƌƌƵƉƚ

ꢃŶǇꢁŽƚŚĞƌꢁ

ŽƉĞƌĂƚŝŽŶ

‘WKꢁĂƐꢁ/Ed

;ϰͿꢁꢁ

D^ϯϬϳϴϳsϯ

1. CmdSTPtoGPlow

(I2C command Stop to GPO low)

2. After

NewCmdlbFB (new I2C command last bit of first byte)

after AnswerlbFB (I2C answer last bit of first byte)

3. CmdEOFtoGPlow

(RF command End of frame to GPO low)

4. GPO

pulse duration

DocID023790 Rev 20

M24SR64-Y

Signal descriptions

2.7.6

State Control configuration (GPO field = 0xX5 or 0x5X)

When the GPO is configured as State Control, the I

C or RF host can control the state of the

GPO by sending a dedicated command.

During an RF or I

C session, the M24SR64-Y can control the GPO pin. After receiving a

valid Set GPO command, GPO pin is driven low after a delay (1) or (3). GPO will be

released after a valid Reset command or after a Power off or upon closing the RF session.

Figure 8. GPO configured as State Control (GPO field = 0xX5 or 0x5X)

5)ꢄRUꢄ,ð&ꢄ

FKDQQHO

ꢎꢂꢏꢄ

RUꢄ

ꢎꢀꢏ

ꢎꢁꢏꢄ

RUꢄ

ꢎꢆꢏ

5HVHWꢄ*32ꢄ

FRPPDQGꢄꢄ

$QꢄRWKHUꢄ

FRPPDQG

6HWꢄ*32ꢄ

FRPPDQG

*32ꢄDVꢄ

6WDWH&RQWURO

06ꢀꢊꢈꢃꢍ9ꢆ

1. CmdSTPtoGPlow

(I2C Set GPO command Stop to GPO low)

2. CmdSTPtoGPHZ

(I2C Reset GPO command Stop to GPO HZ)

3. CmdEOFtoGPlow

(RF Set GPO command End of frame to GPO low)

4. CmdEOFtoGPHZ

(RF Reset GPO command End of frame to GPO HZ)

DocID023790 Rev 20

Signal descriptions

M24SR64-Y

2.7.7

RF busy configuration (GPO field = 0x6X)

When the GPO is configured as RF busy, the GPO goes to the low state when the

M24SR64-Y is processing an RF command or when an RFsession is ongoing.

When an RF field is present, GPO is driven low after a delay (1) when M24SR64-Y detects

the first command. If the RF session is ongoing and M24SR64-Y receives a not-supported

command, GPO remains low. It will be released only at the end of the RF session, after (2).

Figure 9. GPO configured as RF busy (GPO field = 0x6X)

Z&ꢁĐŚĂŶŶĞů

;ϭͿ

;ϮͿ

;ϭͿ

;ϮͿ

Z&ꢁ

ĐŽŵŵĂŶĚ

^ĞŶƐZĞƋꢁΘꢁ

^ĞŶƐZĞƐ

Z&ꢁĐŽŵŵĂŶĚꢁ

ŶŽƚꢁƐƵƉƉŽƌƚĞĚꢁꢁꢁꢁ

^;ꢀꢄ^Ϳ

‘WKꢁĂƐꢁZ&ꢁďƵƐǇ

D^ϯϬϳϵϬsϯ

1. CmdSOFtoGPlow

(RF command Start of frame to GPO low)

2. CmdEOFtoGPHZ

(RF command End of frame to GPO HZ)

Section 8: Functional procedures

DocID023790 Rev 20

M24SR64-Y

M24SR64-Y memory management

3.1

Memory structure

The M24SR64-Y supports the NDEF

g Application as defined in the NFC Forum Type 4

g. The M24SR64-Y is composed of three files:

•

One Capability Container file

One NDEF file

One System file: this is an ST-proprietary file

The System file contains some information on the configuration of the M24SR64-Y device.

The CC file gives some information about the M24SR64-Y itself and the NDEF file. The

NDEF file contains the User data.

3.1.1

File identifier

The file identifier is the value used in the Select command to select a file.

Table 3. File identifier

File identifier

0xE101

Meaning

System file

CC file

0xE103

0x0001

NDEF file

3.1.2

CC file layout

The CC file gives some information about the M24SR64-Y and the NDEF file. This file is a

read-only file for the RF or I²C host and cannot be modified by issuing a write command.

The T field, Read Access and Write Access fields can be changed by the RF or I²C host by

issuing a specific process (refer to

DocID023790 Rev 20

Section 5.6.7: ReadBinary command

M24SR64-Y memory management

File offset

M24SR64-Y

Comments

Table 4. CC file layout for 1 NDEF file

Meaning Value

0x0000

0x0002

0x0003

0x0005

0x0007

0x0008

0x0009

Number of bytes of CC file

0x000F

15 bytes

Mapping version

(1)

0x20 or 0x10

0x00F6

V 2.0 or V 1.0

246 bytes

T field

Maximum number of bytes that can be read

Maximum number of bytes that can be written

0x00F6

0x04

(2)

0x06

L field

0x0001

FileID

NDEF file control TLV

0x2000

Maximum NDEF

file size

0x000B

0x000D

0x000E

0x00

(2)

0x00

(2)

Read access

Write access

1. According

to the reader.

2. Delivery

state.

3.1.3

NDEF file layout

The NDEF file contains the NDEF message which contains the User data. The RF host or

the I²C host can read and write data inside the file. The first two bytes named NDEF

Message Length define the size of the NDEF message. The NDEF Message Length shall

be managed by the application and the M24SR64-Y device does not check if its value is

relevant vs the data written by the RF or I²C host. The M24SR64-Y device uses the NDEF

Message Length, e. g. the standard read can be processed only inside the NDEF message;

otherwise, the M24SR64-Y device returns an error code. For more details about the read

command, refer to

22/89

DocID023790 Rev 20

M24SR64-Y

M24SR64-Y memory management

Table 5. NDEF file layout

Byte 0

Byte 1

NDEF message length

File offset

Byte 2

Byte 3

0x0000

0x0004

…

User data

…

0x1FFC

User data

3.1.4

System file layout

The system file specifies the configuration of the M24SR64-Y.

Table 6

lists the different

fields.

Table 6. Field list

Number

File offset

Field name

Read access

Write access

Delivery state

(1)

of bytes

Length system

file

0x0000

I²C or RF

–

0x0012

0x0002

0x0003

0x0004

0x0005

0x0006

I²C protect

I²C watchdog

GPO

I²C or RF

I²C

(2)

I²C

(2)

I²C

(2)

I²C

(2)

I²C

(2)

0x01

0x00

0x11

ST reserved

RF enable

0x00

0x xxxx xxx1

(3)

NDEF File

number (RFU)

0x0007

I²C or RF

none

0x00

0x0008

0x000F

0x0011

UID

I²C or RF

none

0x0284 xx xx xx xx xx

(4)

Memory Size

Product Code

0x1FFF

0x84

1. The

delivery state for all passwords = 0x00000000000000000000000000000000.

2. The

access is granted when the field I²C protect is set to the state Unprotected or when the right I²C

password was correctly received (see

Section 3.5: I2C password

3. Refer

ble 11

4. x

values are defined by ST to insure UID unicity.

DocID023790 Rev 20

M24SR64-Y memory management

File offset

M24SR64-Y

Table 7. Details about I2C watchdog

b7- b0

The “I

C Watchdog” ensures the I2C host will not keep the session open, while

there is no more activity on the I

C bus (between the stop bit of the previous

transaction and the start bit of the next one)

0x0003

– 0x00 (default value): the Watchdog is off

– Other values: If programmed to a non null value N, the Watchdog is enabled

and counts N*30 ms (30 ms is approximate) before releasing the I

C session.

Table 8. Details about the GPO field

File offset

b6-b4

b2-b0

0x0004

RFU

When an RF session is open:

0b000: High impedance

0b001: Session opened

0b010: WIP

0b011: MIP

0b100: Interrupt

0b101: State Control

0b110: RF Busy

0b111: RFU

RFU

When an I²C session is open:

0b000: High impedance

0b001: Session opened

0b010: WIP

0b011: I²C Answer Ready

0b100: Interrupt

0b101: State Control

0b110: RFU

0b111: RFU

Table 9. Details about the RF Session field

File offset

0x0004

b6-b4

b3-b0

RFU

When an RF session is open:

0b001: Session opened

RFU

Section 3.1.2: CC file layout

DocID023790 Rev 20

M24SR64-Y

M24SR64-Y memory management

ble 10

gives some details about the ST reserved field.

Table 10. Details about the ST reserved field

File offset

b7-b0

0x0005

0x00

ble 11

gives some details about the RF enable field.

Table 11. Details about the RF enable field

b7 b6-b4

b3 b2-b1

File offset

0x0006

0: the RF field is off

(1)

1: the RF field is on

(1)

RFU

0: the RF disable pad is at low state

(1)

1: the RF disable pad is at high state

(1)

RFU

0: the M24SR64-Y does not decode the command received from the RF interface

1: the M24SR64-Y decodes the command received from the RF interface

1. this

field is written by the M24SR64-Y.

3.2

Read and write access rights to the memory

An NDEF file can be locked for read or write accesses. It is also protected by a 128-bit

password that the host shall present before accessing the NDEF file. There are two 128-bit

passwords, one for the read access and the other one for the write access.

An NDEF file can be permanently locked for read or write accesses. Thus, the host cannot

access the NDEF file.

The read password shall be sent to the M24SR64-Y device before reading a read-locked

NDEF file.

The write password shall be present on the M24SR64-Y device before writing a write-locked

NDEF file. The write password shall be sent to change the read or write access. The read or

write access right is defined for the NDEF file.

3.2.1

State of the Read and Write access rights

Two bytes in the CC file are used to define the Read and Write access rights to the NDEF

file. For more details, refer to

DocID023790 Rev 20

Section 8.4: Locking an NDEF file

M24SR64-Y memory management

Value

M24SR64-Y

Table 12. Read access right

Meaning

0x00

0x80

0xFE

Read access without any security

Locked

(1)

Read not authorized

1. The

read password shall be sent before reading in the NDEF file.

Table 13. Write access right

Value

Meaning

0x00

0x80

0xFF

Write access without any security

Locked

(1)

Write not authorized

1. The

write password shall be sent before writing in the NDEF file.

The state 0xFF and 0xFE cannot be changed by using the Read or Write passwords.

3.2.2

Changing the read access right to NDEF files

The state diagram on

Figure 10

shows how to change the access right to read an NDEF file.

Figure 10. Changing the read access right to an NDEF file

ϬǆϬϬ

>ŽĐŬꢁƚŚĞꢁEꢀꢄ&ꢁĨŝůĞꢁ

;ϭͿ

hŶůŽĐŬꢁƚŚĞꢁEꢀꢄ&ꢁĨŝůĞꢁ

;ϮͿ

WĞƌŵĂŶĞŶƚůǇꢁůŽĐŬꢁƚŚĞꢁEꢀꢄ&ꢁĨŝůĞꢁ

;ϯͿ

ϬǆϴϬꢁ

;ϰͿ

Ϭǆ&ꢄꢁ

;ϰͿ

WĞƌŵĂŶĞŶƚůǇꢁƵŶůŽĐŬꢁƚŚĞꢁEꢀꢄ&ꢁĨŝůĞ

D^ϯϬϳϳϮsϰ

1. See

the procedure to lock the read access (

2. See

the procedure to unlock the read access (

Section 8.5: Unlocking an NDEF file

3. See

the procedure to permanently lock the read access (

Section 8.6: Reaching the read-only state for an

NDEF file

4. Proprietary

state, not defined by NFC Forum Type 4 Tag. For NFC Forum compatible tags, the only

possible value of the read access rights are 0x00 (no restrictions on reads).

Section 8.6: Reaching the read-only state for an

DocID023790 Rev 20

M24SR64-Y

M24SR64-Y memory management

3.2.3

Changing the write access right to NDEF files

The state diagram on

Figure 11

shows how to change the write access right to an NDEF file.

Figure 11. Changing the write access right to an NDEF file

ϬǆϬϬ

>ŽĐŬꢁƚŚĞꢁEꢀꢄ&ꢁĨŝůĞꢁ

;ϭͿ

hŶůŽĐŬꢁƚŚĞꢁEꢀꢄ&ꢁĨŝůĞꢁ

;ϮͿ

WĞƌŵĂŶĞŶƚůǇꢁůŽĐŬꢁƚŚĞꢁEꢀꢄ&ꢁĨŝůĞꢁ

;ϯͿ

ϬǆϴϬꢁ

;ϰͿ

Ϭǆ&&

WĞƌŵĂŶĞŶƚůǇꢁƵŶůŽĐŬꢁƚŚĞꢁEꢀꢄ&ꢁĨŝůĞ

D^ϯϬϳϳϯsϰ

1. See

the procedure to lock the write access.

2. See

the procedure to unlock the write access.

3. See

the procedure to permanently lock the write access (

NDEF file

4. Proprietary

state, not defined by NFC Forum Type 4 Tag. For NFC Forum compatible tags, it is mandatory

that the write access rights are set to either 0x00 (no restrictions on writes) or 0xFF (permanently locked).

0x80 might not be fully decoded with some smart phones.

3.3

3.4

Access right life time

The access right life time is validated while the NDEF file is selected or until the end of the

RF or I²C session. Once the read or write access right is granted, the host can send one or

more ReadBinary or UpdateBinary commands.

At the end of a session or when the host selects another file, the read and write access

rights are initialized.

NDEF file passwords

The NDEF file passwords protect the read or write access from an RF or I²C interface

from/to an NDEF file.

Two NDEF file passwords are available for each NDEF file:

•

Read password

Write password

The length of a password is 128 bits (16 bytes).

DocID023790 Rev 20

Section 3.1.4: System file layout

M24SR64-Y memory management

M24SR64-Y

3.5

C password

The I²C password can be sent only by the I²C host. It activates the SuperUser rights. The I²C

host with the SuperUser rights can:

•

Access the NDEF file regardless of the right access and without sending the NDEF file

passwords.

•

Change the access rights regardless of the current state.

The length of the I²C password is 128 bits (16 bytes).

3.5.1

I²C password and I²C protect field of the System file

The I²C protect field in the system file can be set to:

•

0x00: the I²C host has the SuperUser right access without sending the I²C password

0x01: the I²C host has the SuperUser right access after sending the I²C password

For more details about the system file layout, refer to

DocID023790 Rev 20

M24SR64-Y

Communication mechanism

This chapter describes the principle of communication between an RF or an I

C host and

the M24SR64-Y device.

4.1

4.2

Master and slave

The M24SR64-Y acts as a slave device on either the I C-bus or the RF channel and

therefore waits for a command from the I

C master or the RF host before sending its

response.

The RF host shall generate the RF field and the RF commands.

The I

C host shall supply the M24SR64-Y through the V

pin and shall generate the I

clock on the SCL pad.

M24SR64-Y session mechanism

The M24SR64-Y is a dynamic NFC/RFID tag which can be accessed either from the RF or

I C

interface. The M24SR64-Y implements a token system. This token has two possible

values, RF or I C. When the token exists and is assigned to one interface (RF or I

C), the

M24SR64-Y cannot communicate with the other host.

4.2.1

4.2.2

RF token

The token is given to the RF interface once the anticollision is done. The release condition

can be either an RF field cut-off, or the reception of the command deselect, or when the I²C

host sends the KillRFsession.

I C

token

The token is given to the I

C interface when the I

C host has sent the correct device Select.

The release condition can be either a power down condition on V

pin or the reception of a

I C token release sequence from the I C host, after which M24SR64-Y goes in Standby

power mode.

DocID023790 Rev 20

Section 5.2: I-Block format

I²C and RF command sets

M24SR64-Y

I²C and RF command sets

The command sets of the M24SR64-Y can be split in different command families. Most

commands are common between the RF and the I²C interface. Some commands are

specific to the RF interface and some others are specific to the I²C interface. This section

describes the M24SR64-Y command sets that can be issued by the RF or the I²C host.

There are three command families:

•

the NFC Forum Type 4

g command set

the ISO/IEC 7816-4 command set

the proprietary command set

The NFC Forum Type 4

g command set and the ISO/IEC 7816-4 command set use the I-

Block format. For more details about the I-Block format, refer to

Two other command formats exist:

•

the commands using the R-Block format

the commands using the S-Block format

For more details about these formats, refer to the corresponding sections:

Section 5.3: R-

Block format

and

Section 5.4: S-Block format

This section gives a brief description of the RF and I²C host common commands. The

format of these command sets is the I-Block format.

ble 14

lists the RF and I²C command sets.

Table 14. RF and I²C command sets

Family

command set

Class Instruction

Command name

Brief description

byte

code

NDEF

g Application

Select

NDEF

g Application Select

0x00

0xA4

CC select

0x00

0xA4

0xB0

Select the CC file

NDEF select

System select

ReadBinary

Select the NDEF file

Select the system file

Read data from file

NFC Forum

Type 4 Tag

Write or erase data to a

NDEF file

UpdateBinary

Verify

0x00

0xD6

0x20

Checks the right access of

a NDEF file or sends a

password

Change a Read or write

password

ChangeReferenceData

0x24

0x28

0x26

ISO/IEC 7816-4

Activate the password

security

EnableVerificationRequirement 0x00

DisableVerificationRequirement 0x00

Disable the password

security

30/89

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

Table 14. RF and I²C command sets (continued)

Class Instruction

Family

command set

Command name

Brief description

byte

code

Enables the Read Only or

Write Only security state

ST Proprietary

EnablePermanentState

ST Proprietary

ExtendedReadBinary

0xA2

0x28

0xB0

Read data from file

5.1

Structure of the command sets

The exchange of data between the RF or the I²C host and the M24SR64-Y uses three kinds

of data formats, called blocks:

•

I-Block: to exchange the command and the response

R-Block: to exchange positive or negative acknowledgment

S-Block: to use either the Deselect command or the Frame Waiting eXtension (WTX)

command or response

Note:

max WTX value = 0x0B

This section describes the structure of the I-Block, R-block and S-Block. This format is used

for the application command set.

5.2

I-Block format

The I-Block is used to exchange data between the RF or the I²C host and the M24SR64-Y.

It is composed of three fields.

ble 15

details the I-Block format.

Table 15. I-Block format

SoD

Payload

EoD

CRC

Name

PCB

DID

Length

1 byte

1 to 251 bytes

2 bytes

PCB field

DID field (optional)

RF or I²C host to M24SR64-Y: C-APDU

M24SR64-Y to RF or I²C host: R-APDU

2 CRC bytes

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

Table 16. PCB field of the I-Block format

b7-b6

0b00

I-Block

RFU

Must be set to 0

DID field, if bit is set

Must be set to 0

Must be set to 1

Block number

When the RF or I²C host sends a command to the M24SR64-Y the format of the payload is

the C-APDU.

When the M24SR64-Y sends a command to the RF or I²C host, the format of the payload is

the R-APDU.

5.2.1

C-APDU: payload format of a command

The C-APDU format is used by the RF or the I²C host to send a command to the M24SR64-

Table 17

describes its format.

Table 17. C-APDU format

Payload field

Name

CLA

INS

Data

Length

1 byte

Lc byte

1 byte

Class byte

0x00: standard command

0xA2: ST command

Instruction byte

Param Byte 1

Param Byte 2

Number of bytes of the Data field

Data bytes

Number of bytes to be read in the M24SR64-Y memory

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

5.2.2

R-APDU: payload format of a response

the M24SR64-Y uses the I-Block format to reply to a command which used the I-Block

format. This format is described in

ble 18

Table 18. R-APDU format

Payload field

Name

Data (optional)

Le byte

SW1

SW2

Length

1 byte

Data

Status byte 1

Status byte 2

5.3

R-Block format

The R-Block is used to convey positive or negative acknowledgment between the RF or I²C

host and the M24SR64-Y.

Table 19. R-Block format

PCB

CRC

R(ACK) without the DID field: 0xA2 or 0xA3

R(ACK) with the DID field: 0xAA or 0xAB

R(NAK) without the DID field: 0xB2 0xB3

R(NAK) with the DID field: 0xBA 0xBB

2 CRC bytes

There are two kinds of R-Blocks:

•

R(ACK): the acknowledgment block sent by the RF or I²C host or by the M24SR64-Y.

NAK

): the non-acknowledgment block sent by the RF or I²C host or by the

M24SR64-Y.

DocID023790 Rev 20

ble 22: S-Block detailed format

I²C and RF command sets

M24SR64-Y

Table 20. R-Block detailed format

b7-b6

0b10

R-Block

RFU

1: NAK

0: ACK

0: DID field is not present

1: DID field is present

Must be set to 0

RFU

Block number

5.4

S-Block format

The S-Block is used to exchange control information between a reader and a contactless

tag.

Table 21. S-Block format

SoD

EoD

CRC

NFC frame

Length

PCB

DID

Payload

1 byte

0 to 1 byte

2 bytes

0xC2: for S(DES) when the DID field is not present

0xCA: for S(DES) when the DID field is present

0xF2: for S(WTX) when the DID field is not present

0xFA: for S(WTX) when the DID field is present

DID field (optional)

WTX field

(1)

2 CRC bytes

1. This

field is present when b5-b4 bits are set to 0b11 (S-Block is a WTX). see

There are two requests using the S-Block format:

•

S(DES): the deselect command

S(DES) is only applicable to RF

S(WTX): the Waiting Frame eXtension command or response.

A Waiting Time eXtension request occurs, in RF or I C, when the operating time

needed by M24SRxx is greater than 9.6 ms.

The WTX field indicates the increase time factor to be used in this command execution

(FDTtemp = WTX * 9.6 ms). The max WTX value is equal 0x0B.

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

Table 22. S-Block detailed format

b7-b6

0b11

b5-b4

S-Block

0b00: Deselect

0b11: WTX

0: DID field is not present

1: DID field is present

–

RFU

Note:

After receiving the deselect command, the session is released and M24SR64-Y enters the

Standby power mode. In I

C, the session is released after executing the I2C token release

sequence.

In response to a RATS command, M24SR64-Y returns FWI parameter (default frame waiting

time used); when M24SR64-Y needs more time for a command execution, it requests a

frame waiting time extension by responding 0xF2 0xWTX (Request waiting time = FWI *

WTX). If the reader accepts M24SR64-Y request, it acknowledges by sending the command

0xF2 0xWTX. The frame waiting time becomes FWI * WTX for the current command only.

5.5

CRC of the I

C and RF frame

The two CRC bytes check the data transmission between the RF host or I²C host and the

M24SR64-Y. For the RF frame, the CRC is computed on all the data bits in the frame,

excluding parity bits, SOF and EO

nd the CRC itself.

For the I²C frames, the CRC is computed on all data bits of the frame excluding Device

select and the CRC itself.

The CRC is as defined in ISO/IEC 13239. The initial register content shall be 0x6363 and

the register content shall not be inverted after calculation.

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

5.6

NFC Forum Type 4 Tag protocol

5.6.1

Commands set

With the NFC Forum Type 4

g protocol, the commands are common to RF and I²C.

Table 23. Command set overview

Command name

NDEF

g Application Select

Brief description

Select the NDEF

g Application

Select the capability container (CC) file using the

Select command

Capability Container Select

NDEF Select

System File Select

ReadBinary

Select the NDEF file

Select the system file

Read data from a file

Write new data to a file

UpdateBinary

5.6.2

Status and error codes

This section lists the status and the error code of the M24SR64-Y.

Table 24. Status code of the M24SR64-Y

SW1

SW2

Comment

Command completed

successfully

Value

0x90

0x00

Table 25. Error code of the M24SR64-Y

SW1

SW2

Comment

Length

1 byte

Value

0x62

0x80

File overflow (Le error)

End of file or record reached

before reading Le bytes

Value

0x62

0x63

0x82

0x00

Password is required

Password is incorrect, X further

retries allowed (X can take

value 0,1, 2)

Value

0x63

0xCX

Value

0x65

0x67

0x81

0x00

Unsuccessful updating

Wrong length

Cmd is incompatible with the

file structure

Value

0x69

0x81

Value

0x69

0x82

0x84

Security status not satisfied

Reference data not usable

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

Table 25. Error code of the M24SR64-Y (continued)

SW1

SW2

Comment

Length

1 byte

Value

0x6A

0x6D

0x6E

0x80

0x82

0x84

0x86

0x00

Incorrect parameters Le or Lc

File or application not found

File overflow (Lc error)

Incorrect P1 or P2 values

INS field not supported

Class not supported

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

5.6.3

NDEF Tag Application Select command

the RF or the I²C host shall send this command to activate the NDEF

g Application.

ctivate the NDEF

g Application, the RF host sends the Select command (see

ble 26

) in addition to the sequence defined in the NFC Forum digital protocol.

ctivate the NDEF

g Application, the I²C host sends the Select command (see

ble 26

) in addition to the GetSession or the Kill RF session command.

ble 26

defines the C-APDU of the Select command to select the NDEF

g Application

(called NDEF

g Application Select).

Table 26. C-APDU of the NDEF Tag Application Select command

Name

Value

Class byte

CLA

INS

Data

0xD27600

00850101

0x00

0xA4

0x04

0x00

0x07

0x00

Select instruction code

P1 field

P2 field

Number of bytes of data

Application ID

Le field

ble 27

defines the R-APDU of the NDEF

g Application Select command.

Table 27. R-APDU of the NDEF Tag Application Select command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x6A

0x6D

1 byte

0x00

0x82

0x00

–

Command completed

NDEF

g Application not found

Class not supported

5.6.4

Capability Container Select command

The RF or I²C host uses the Capability Container Select procedure to select the capability

container (CC) file.

The CC file is selected when this command returns “command completed” in the R-APDU.

ble 28

defines the C-APDU of the Select command to select the CC file (called Capability

Container Select).

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

Table 28. C-APDU of the Capability Container Select command

Name

Value

Class byte

CLA

INS

Data

0x00

0xA4

0x00

0x0C

0x02

0xE103

–

Select instruction code

P1 field

P2 field

Number of bytes of data

CC file ID

–

ble 29

defines the R-APDU of the CC Select command.

Table 29. R-APDU of the Capability Container Select command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x6A

0x6D

1 byte

0x00

0x82

0x00

–

Command completed

File or application not found

Class not supported

5.6.5

NDEF Select command

The RF or I²C host uses the NDEF Select command to select the NDEF file.

The NDEF file is selected when this command returns “command completed” in the R-

APDU.

ble 30

defines the C-APDU of the Select command to select the NDEF file (called

NDEF Select).

In case of a password is required to access the NDEF file, the NDEF Select command will

disable any previously granted access rights to this file. The Verify command might be

required to access the file.

Table 30. C-APDU of the NDEF Select command

Name

Value

Class byte

CLA

INS

Data

0x00

0xA4

0x00

0x0C

0x02

0x000X

–

Select instruction code

P1 field

P2 field

Number of bytes of data

0x0001: first NDEF file

–

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

ble 31

defines the R-APDU of the NDEF Select command.

Table 31. R-APDU of the NDEF Select command

Data

SW1

1 byte

SW2

1 byte

Comment

Length

Value

–

0x90

0x6A

0x00

0x82

Command completed

File or application not found

5.6.6

System File Select command

The RF or I²C host uses this command to select the system file.

The System file is selected when this command returns “command completed” in the R-

APDU.

ble 32

defines the C-APDU of the command to select the System file (called System

Select).

Table 32. C-APDU of the System File Select command

Name

CLA

INS

Data

0x00

0xA4

0x00

0x0C

0x02

0xE101

–

Class byte

Select instruction code

P1 field

P2 field

Number of bytes of data

System file ID

–

ble 33

defines the R-APDU of the System File Select command.

Table 33. R-APDU of the System File Select command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

1 byte

0x00

–

Command completed

Capability container not found, no data

is returned

Value

–

0x6A

0x82

Section 3.1.2: CC file layout

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

5.6.7

ReadBinary command

On receiving the ReadBinary command, the M24SR64-Y reads the requested memory field

and sends back its value in the R-APDU response.

Before sending a ReadBinary command, a file shall be selected by using a Select

command.

The Response of the ReadBinary command is successful when the data to be read is within

(1)

the selected file

; in other words, when the sum of P1-P2 and Le fields is equal to or lower

than the selected file length.

ble 34

defines the ReadBinary command.

Table 34. C-APDU of the ReadBinary command

Name

CLA

INS

P1 & P2

Data

0x00

0xB0

2 bytes

–

1 byte

Class byte

Read instruction code

Offset in the file selected

–

Number of bytes to read between

0x01

≤

max(Selected File length, 0xF6)

ble 35

defines the R-APDU of the ReadBinary command.

Table 35. R-APDU of the ReadBinary command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x67

0x69

0x6A

0x6E

1 byte

–

Content read

Don’t care

(1)

Command completed

–

0x00

0x82

0x00

Wrong length

Security status not satisfied

File or application not found

Class not supported

1. For

more information, please contact your local ST support.

1. For

more details about CC file, refer to

For more details about NDEF file, refer to

Section 3.1.3: NDEF file layout

For more details about System file, refer to

Section 3.1.4: System file layout

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

5.6.8

UpdateBinary command

On receiving the UpdateBinary command, the M24SR64-Y writes the data field into the

selected file and sends back a status in the R-APDU response. If needed, M24SRxx will

request a timing extension (see

Section 5.4

Before sending an UpdateBinary command, a file shall be selected by issuing a Select

command.

ble 36

defines the UpdateBinary command.

Table 36. C-APDU of the UpdateBinary command

Name

CLA

INS

P1 & P2

Data

0x00

0xD6

2 bytes

1 byte

Lc bytes

–

Class byte

Write instruction code

Offset in the file selected

Number of bytes of data (0x01

≤

0xF6)

Data to write in the M24SR64-Y memory

–

ble 37

defines the R-APDU of the UpdateBinary command.

Table 37. R-APDU of the UpdateBinary command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x65

0x67

0x69

0x6A

0x6E

1 byte

0x00

0x81

0x00

0x82

0x00

–

Command completed

Unsuccessful updating

Wrong length

Security status not satisfied

File or application not found

Class not supported

Note:

Chaining is not supported on “UpdateBinay” command.

For further return codes and definitions, refer to

Status and error codes

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

5.7

ISO/IEC 7816-4 commands

The ISO/IEC 7816-4 command set offers some extended features such as the protection of

the NDEF file. This command set is used to manage the right access of the NDEF file.

5.7.1

Verify command

The Verify command has two functions:

1. Check

if a password is required to access to the NDEF file (the LC field = 0x00).

2. Check

that the password embedded in the Verify command allows the access to the

memory (the Lc field = 0x10 and the password is present).

When the Lc field if equal to 0x00, the verify command returns a success code (0x90 00)

provided that the access to the NDEF file does not require a password. When the access to

the NDEF file is protected, the response to the Verify command returns an error code

(0x63 00).

When the Lc field equals 0x10, on receiving the Verify command, the M24SR64-Y

compares the requested password with the data contained in the request and reports

whether the operation has been successful in the response.

Before sending this command, an NDEF file shall be selected by issuing the NDEF Select

command. Thus, this command checks the right access condition of the last NDEF file

selected.

After a successful command, an access is granted for the whole NDEF file.

ble 38

defines the Verify command.

Table 38. Verify command format

Name

CLA

INS

P1 & P2

Data

0x00

0x20

2 bytes

1 byte

Lc bytes

–

Class byte

Instruction code

Password identification

0x0001: Read NDEF password transmit

0x0002: Write NDEF password transmit

0x0003: I²C password transmit

(1)

Other: RFU

0x00: the password is not present

0x10: the password is present in the data field

Password

–

1. This

code can only be issued by the I²C host.

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

ble 39

defines the R-APDU of the Verify command.

Table 39. R-APDU of the Verify command

SW1 SW2

Comment

1 byte

Data

Length

Value

–

0x90

0x69

0x00

0x85

Command completed, the password is correct

The conditions of use are not satisfied (e.g. no

NDEF file was selected)

Value

–

Value

–

0x69

0x6A

0x63

0x81

0x82

0x80

0x00

Cmd incompatible with file structure

Security status not satisfied

Incorrect parameter in cmd data field

A password is required

The password transmitted is incorrect and X

encodes the number of further allowed retries.

Value

–

0x63

0x6E

0xCX

(1)

0x00

Class not supported

1. At

each session, the RF or I

C host can check a password 3 times.

5.7.2

Change Reference Data command

The Change Reference Data command replaces the read or write password related to the

NDEF files previously selected. It can be performed only if the security status satisfies the

security attributes for this command.

Before sending this command, the verify command with the correct NDEF write password

shall be issued. Thus, this command changes the reference data of the NDEF file.

ble 40

defines the Change Reference Data command.

Table 40. Change reference data command format

Name

CLA

INS

P1 & P2

Data

0x00

0x24

2 bytes

1 byte

Lc bytes

–

Class byte

Instruction code

Password identification

0x0001: Read password transmit

0x0002: Write password transmit

0x0003: I²C password transmit

(1)

Other: RFU

0x10: the password is present in the data field

NDEF file or I²C Password

–

1. This

code can only be issued by the I²C host.

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

ble 41

defines the R-APDU of the Change Reference Data command.

Table 41. R-APDU of the Change Reference Data command

Data

SW1

SW2

Comment

Length

Value

1 byte

–

Command completed, the access right has

been changed

–

0x90

0x69

0x00

0x81

Cmd is incompatible with the

file structure

Value

–

0x65

0x69

0x6A

0x6E

0x81

0x82

0x80

0x82

0x86

0x00

Unsuccessful updating

Security status not satisfied

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

Class not supported

5.7.3

Enable Verification Requirement command

The Enable Verification Requirement command activates the protection by password of the

NDEF file. When this command is successful, the read or write access to the NDEF file is

protected by a 128-bit password. It can be performed only if the security status satisfies the

security attributes for this command.

This command can update the right access of the NDEF file by writing into the EEPROM. In

this case, the response timing will be around 5 ms.

Before sending this command, the verify command with the correct NDEF write password

shall be issued. Thus, this command changes the access right of the NDEF file.

ble 42

defines the Enable Verification requirement command.

Table 42. Enable Verification Requirement command format

Name

CLA

INS

P1 & P2

Data

0x00

0x28

2 bytes

–

Class byte

Instruction code

New security attributes

0x0001: Enable the read protection of the NDEF file

0x0002: Enable the write protection of the NDEF file

Other: RFU

–

The last five bits identify the password sent in the Verify command.

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

ble 43

defines the R-APDU of the Enable Verification Requirement command.

Table 43. R-APDU of the Enable Verification Requirement command

Data

SW1

SW2

Comment

Length

Value

1 byte

–

Command completed, the password is

correct

–

0x90

0x00

Value

–

0x69

0x6A

0x81

0x82

0x80

0x82

0x86

Cmd is incompatible with the file structure

Security status not satisfied

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

5.7.4

Disable Verification Requirement command

The Disable Requirement command deactivates the protection by password of the NDEF

file. When this command is successful, the read or write access to the NDEF file is granted

without security requirements. It can be performed only if the security status satisfies the

security attributes for this command.

Before sending this command, the verify command with the correct NDEF write password

shall be issued. Thus, this command changes the access right of the NDEF file.

This command can update the right access of the NDEF file by writing into the EEPROM. In

this case, the response timing will be around 6 ms.

ble 44

defines the Disable Verification Requirement command.

Table 44. Disable Verification Requirement command format

Name

CLA

INS

P1 & P2

Data

0x00

0x26

2 bytes

–

Class byte

Instruction code

New security attributes

0x0001: Disable the read protection of the NDEF file

0x0002: Disable the write protection of the NDEF file

Other: RFU

–

ble 45

defines the R-APDU of the Disable Verification Requirement command.

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

Table 45. R-APDU of the Disable Verification Requirement command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x69

0x6A

0x6E

0x65

1 byte

0x00

0x81

0x82

0x80

0x82

0x86

0x00

0x81

–

Command completed, the password is correct

Cmd is incompatible with the file structure

Security status not satisfied

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

Class not supported

Update failed

5.8

ST Proprietary command set

The RF or I²C host can be issued with the command set described in this chapter.

5.8.1

ExtendedReadBinary command

On receiving the ExtendedReadBinary command, the M24SR64-Y reads the requested

memory field and sends back its value in the R-APDU response.

Before sending an ExtendedReadBinary command, a file shall be selected by issuing an

NDEF select command.

The response of the ExtendedReadBinary command will be successful even if the data to

be read is beyond the NDEF message. The command returns an error code if the data to be

read goes beyond the end of the file.

Table 46. C-APDU of the ExtendedReadBinary command

Name

Length

ST Class byte

CLA

INS

P1 & P2

Data

0xA2

0xB0

2 bytes

–

1 byte

Read instruction code

Offset in the file selected

–

Number of bytes to read between 0x01

≤

0xF6

ble 47

defines the R-APDU of the read binary command.

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

Table 47. R-APDU of the ExtendedReadBinary command

Data

SW1

SW2

comment

Length

Value

Le bytes

1 byte

0x90

0x67

0x69

0x6A

0x6E

1 byte

–

Content read

Don’t care

(1)

0x00

Command completed

Wrong length

–

0x82

Security status not satisfied

File or application not found

Incorrect P1 or P2 values

Class not supported

0x82

0x86

0x00

1. For

more information, please contact your local ST support.

5.8.2

EnablePermanentState command

The command configures the NDEF file to the ReadOnly or to the WriteOnly State.

This command can update the right access to the NDEF file by writing into the EEPROM. In

this case, the response timing will be around 6 ms.

ble 48

defines the EnablePermanentState requirement command.

Table 48. EnablePermanentState command format

Name

Length

CLA

INS

P1 & P2

Data

0xA2

0x28

2 bytes

–

Class byte

Instruction code

New security attributes

0x0001: Enable the read protection of the NDEF file

0x0002: Enable the write protection of the NDEF file

Other: RFU

–

ble 49

defines the R-APDU of the EnablePermanentState command.

Table 49. R-APDU table of the EnablePermanentState command

Data

SW1

SW2

comment

Length

Value

–

1 byte

0x90

0x65

0x67

1 byte

0x00

0x81

0x00

–

Command completed

Update failed

Wrong length

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

Table 49. R-APDU table of the EnablePermanentState command (continued)

Data

SW1

SW2

comment

Value

–

0x69

0x6A

0x6E

0x82

0x80

0x82

0x86

0x00

Security status not satisfied

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

Class not supported

5.8.3

DisablePermanentState command

The command configures the NDEF file to the Lock state.

This command can update the right access of the NDEF file by writing into the EEPROM. In

this case, the response timing will be around 6 ms. This command is only valid in I

C. The

SuperUser rights must have been granted to execute the command.

Before sending this command, an NDEF file shall be selected by issuing the NDEF Select

command.

ble 50

defines the DisablePermanentState requirement command.

Table 50. DisablePermanentState command format

Name

Length

CLA

INS

P1 & P2

Data

0xA2

0x26

2 bytes

–

Class byte

Instruction code

New security attributes

0x0001: Disable the read protection of the NDEF file

0x0002: Disable the write protection of the NDEF file

Other: RFU

–

ble 51

defines the R-APDU of the DisablePermanentState command.

Table 51. R-APDU of the DisablePermanentState command

Data

SW1

SW2

comment

Length

Value

–

1 byte

0x90

0x65

0x67

0x69

1 byte

0x00

0x81

0x00

0x82

–

Command completed

Update failed

Wrong length

Security status not satisfied

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

Table 51. R-APDU of the DisablePermanentState command (continued)

Data

SW1

SW2

comment

Value

–

0x6A

0x6E

0x80

0x82

0x86

0x00

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

Class not supported

5.8.4

UpdateFileType command

This command allows to modify the file type of a selected file to Proprietary file (0x05) or

NDEF file (0x04).

NFC Forum compatible tags must configure the file as NDEF file (0x04).

This command is granted only, when application and file are selected and if the file length

and access right have previously been set to 0X00h (message invalid, all access rights

granted).

This command will update the file type located in the CC file by writing into the EEPROM. In

this case, the response timing will be around 6 ms.

ble 52

defines the UpdateFileType command.

Table 52. UpdateFileType command format

Name

Value

Class byte

CLA

INS

Data

0x04 or

0x05

0xA2

0xD6

0x00

0x01

–

Select instruction code

P1 field

P2 field

Number of bytes of data

File type

–

ble 53

describes the R-APDU of the UpdateFileType command.

Table 53. R-APDU of the UpdateFileType command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x69

0x6A

1 byte

0x00

0x82

0x80

–

Command completed

Security status not satisfied

CC file or System file selected

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

Table 53. R-APDU of the UpdateFileType command (continued)

Data

SW1

SW2

Comment

File or application not found

Incorrect P1 or P2 values

Value

–

0x6A

0x82

0x86

5.8.5

SendInterrupt command

On receiving the SendInterrupt command, the M24SR64-Y generates a negative pulse on

the GPO pin. It starts at the end of the command and ends at the end of the RF response.

Before sending this command, the system file shall be selected by issuing the System

Select command.

ble 54

defines the SendInterrupt command.

Table 54. SendInterrupt command format

CLA

INS

P1&P2

Data

Length

Value

1 byte

0xA2

1 byte

0xD6

2 bytes

0x001E

1 byte

0x00

–

ble 55

describes the R-APDU of the SendInterrupt command.

Table 55. R-APDU of the SendInterrupt command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x6A

0x6E

1 byte

0x00

0x80

0x82

0x86

0x00

–

The interrupt has been sent

The GPO is not configured as an interrupt mode

File or application not found

Incorrect P1 or P2 values

Class not supported

5.8.6

StateControl command

On receiving the StateControl command with reset value: data 0x00, the M24SR64-Y drives

the GPO pin low. On receiving the StateControl command with set value: data 0x01, the

M24SR64-Y releases the GPO pin which returns to HZ.

Before sending this command, the system file shall be selected by issuing the System

Select command.

ble 56

defines the State Control command.

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

Table 56. StateControl command format

CLA

INS

P1&P2

Data

Length

1 byte

0xA2

1 byte

0xD6

2 bytes

0x001F

1 byte

0x01

–

Reset value

Set value

0x00

0x01

Table 57. R-APDU of the StateControl command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x6A

0x6E

1 byte

0x00

0x80

0x82

0x86

0x00

–

The set or reset has been sent

The GPO is not configured in StateControl mode

File or application not found

Incorrect P1 or P2 values

Class not supported

5.9

Specific RF command set

This section describes the command set that can be issued only by the RF host.

5.9.1

Anticollision command set

ble 58

lists the commands that can be issued only by the RF host. The format of these

commands is described in the NFC Forum Digital Protocol specification.

Table 58. Commands issues by the RF host

Family command set

Command name

Instruction code

0x52

(1)

ALL_REQ

SENS_REQ

SDD_REQ

SEL_REQ

SLP_REQ

0x26

(1)

NFC-A technology

1. Code

on 7 bits.

0x93 or 0x95 or 0x97

0x50

5.9.2

RATS command and ATS response

RATS command and ATS response are used for NFC Forum Type 4A

g Platform Device

Activation (as defined in NFC Forum Digital Protocol specification).

ble 59

details the RATS command. This command shall be sent after the anticollision

process.

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

Table 59. RATS command

Param

Name

Byte field

Bit field

INS

CRC

0xE0

1 byte

b7-b4

2 bytes

b3-b0

Instruction code

FSDI

DID (0

≤

DID

≤

14)

2 CRC bytes

The FSDI field codes the FSD that defines the maximum size that an RF or I²C host is able

to receive.

ble 60

gives the conversion from FDSI to FSD.

Table 60. Conversion from FDSI to FSD

0x9h-

FSDI

0x0

0x1

0x2

0x3

0x4

0x5

0x6

0x7

0x8

0xF

0xE

FSD

128

256

RFU

256

The DID field defines the value of the addressed M24SR64-Y.

Table 61. ATS response

Name

Byte field

Bit field

TA(1)

TB(1)

TC(1)

0x02

CRC

0x05

0x78

1 byte

2 bytes

b8-b5

b4-b1

Length of the ATS

response

FSCI = 256 bytes

The maximum ascending data rate is 106 kbps

The maximum descending data rate is 106 kbps

FWI field (9.6 ms when TB = 0x50)

SFGI field (302 µs when TB = 0x50)

The DID is supported

2 CRC bytes

The FSCI codes the FSC which stands for the maximum frame size that the M24SR64-Y is

able to receive. The M24SR64-Y is able to receive up to 256 bytes of command. If the RF or

I²C host sends a command with more than 256 bytes, the M24SR64-Y will not be able to

treat the command and will not reply.

The FWI which stands for the Frame Waiting time Integer codes the FW

his time

corresponds to the maximum duration while an RF or I²C host shall send before sending the

next command.

DocID023790 Rev 20

I²C and RF command sets

M24SR64-Y

The SFGI which stands for the Start-up Frame Guard Time is the minimum time that the

reader shall wait after receiving the response of the M24SR64-Y.

5.9.3

PPS command & response

PPS (Protocol and Parameter Selection) command and response are defined in ISO/IEC

14443-4, in the Protocol Activation of PICC Type A.

The PPS command allows to change the data rates of the ascending (RF host to M24SR64-

Y) and descending (M24SR64-Y to RF host) data rates.

Table 62. PPS command

Name

Byte field

Bit field

INS

PPS0

0x11

PPS1

1 byte

b3-b2

CRC

–

0xDX

2 bytes

b7-b4

b3-b0

0b0000

b1-b0

Instruction code

DID

INS

PPS1 is present

RFU

PPS1 Descending

data rate

Ascending data rate

2 CRC bytes

The ascending and descending data rates shall be coded as described in

ble 63

Table 63. Ascending and descending data rate coding

Value

Data rate

0b00

0b01

0b10

0b11

106 kbps

RFU

When the M24SR64-Y is able to change both data rates, it returns the following response.

The data rate of this response is 106 kbps; then, the M24SR64-Y changes the ascending

and descending data rates.

ble 64

gives the details of the PPS response.

Table 64. PPS response

Name

Byte field

Bit field

INS

–

PPS0

0x11

0xDX

b8-b5

b4-b1

Response code

DID field

2 CRC bytes

DocID023790 Rev 20

M24SR64-Y

I²C and RF command sets

5.10

Specific I

C command set

ble 65

lists the commands that can only be issued by the I²C host.

Table 65. Specific I

C commands

Instruction

Command name

Format

Class byte

Brief description

code

Open an I

C session when the

RF session is not ongoing

GetI2Csession

KillRFsession

–

0x26

Kill the RF session and open an

C session

0x52

5.10.1

GetI2Csession command

The GetI2Csession command opens an I²C session if an RF session is not ongoing.

ble 66

defines the GetI2Csession command.

Table 66. GetI2Csession command format

INS

Length

Value

1 byte

0x26

The GetI2Csession command does not create a reply.

When an RF session is ongoing, the M24SRxx will not acknowledge the command.

When no RF session is ongoing, the M24SRxx will acknowledge the command and open an

I²C session.

5.10.2

KillRFsession command

The KillRF session command closes the RF session and opens an I²C session.

ble 67

defines the KillRFsession command.

Table 67. KillRFsession command format

INS

Length

Value

1 byte

0x52

The KillRFsession command does not create a reply. The RF session is closed when the

device acknowledges the command.

Caution:

A successful completion of the RF command is not certain.

DocID023790 Rev 20

RF device operation

M24SR64-Y

RF device operation

6.1

Anticollision and Device Activation command set for the RF

interface

The M24SR64-Y device supports the command set defined in the NFC-A

chnology and

the Type 4A

g Platform chapters of the NFC Digital Protocol V1.0 specification.

6.2

Open an RFsession

Once the RF host has terminated the anticollision procedure and retrieve the ATS response,

it shall send the SelectApplication command. The M24SR64-Y will open an RF session. At

this point, the RF host can send the applicative command set and the I²C cannot

communicate with the M24SR64-Y without closing first the RF session using the I C

KillRFsession command.

6.3

6.4

Close an RFsession

The RF host can close the RF session by issuing one of these methods:

•

send an S(DES) command

turn off the RF field

Applicative command set

The applicative command set is composed of the following command sets:

•

the NFC Forum Type 4

g command set

the ISO/IEC 7816-4 command set

the proprietary command set

DocID023790 Rev 20

M24SR64-Y

I2C device operation

I C

device operation

The M24SR64-Y device supports the I

C protocol. The device that controls the data transfer

is known as the bus master, and the other one as the slave device. A data transfer can only

be initiated by the bus master, which also provides the serial clock for synchronization. The

M24SR64-Y device is a slave in all communications.

7.1

C communication protocol

The I C communication is built on a system of command and reply exchange. The I

C host

starts the communication by sending a request. Once a valid request is received by the

M24SR64-Y device, it carries out an internal operation and creates its answer.

As defined in this document, and except for the GetI2C session and Kill RF session

commands, the definition of a valid request is a command with a right CRC value.

Figure 12

shows an exchange of a command and a response between the I²C host and the

M24SR64-Y. Once the I²C session is open, the I²C host can send a command. The

command is composed of:

•

a Device Select field with the R/W bit set to 0.

the command field.

The M24SR64-Y acknowledges on the reception of each byte.

Once the M24SR64-Y is ready to send the answer, the I²C host shall:

•

send a Device Select field with the R/W bit set to 1.

release the SDA line and send an SCL clock.

The I²C host shall acknowledge on the reception of each byte.

Figure 12. Command and response exchange

,ꢁ&ꢄEXV

5ꢅ:ꢄ ꢄꢊ

5ꢅ:ꢄ ꢄꢂ

‘HYLFH6HOHFW

&RPPDQG

‘HYLFH6HOHFW

5HVSRQVH

06ꢀꢊꢈꢍꢁ9ꢂ

Legend:

S is the I C Start bit sequence

P is the I C Stop bit sequence

R/W is the 8

bit of Device Select.

Note:

A restart during a command and response exchange is not supported by the M24SR64-Y.

After a command, the I

C host can execute a Polling sequence to determine when the

response is available.

Polling sequence: Loop on

< START (S) + DeviceSelect with RW=0 + read NACK/ACK

+ STOP (P) >

The response is available as soon as the M24SR64-Y sends an ACK ( host read will a

‘0’).

DocID023790 Rev 20

I2C device operation

M24SR64-Y

7.2

Start condition

A Start condition is identified by a falling edge of serial data (SDA) while the serial clock

(SCL) is stable in the high state. A Start condition must precede any data transfer command.

The device continuously monitors (except during an instruction processing) the SDA and the

SCL for a Start condition, and does not respond unless one is given.

7.3

7.4

Stop condition

A Stop condition is identified by a rising edge of serial data (SDA) while the serial clock

(SCL) is stable and driven high. A Stop condition terminates a command between the device

and the bus master.

I²C token release sequence

As explained in the M24SR64-Y session mechanism, the I²C communication is reserved to

the I²C host when the session token has the I²C value.

The following sequence explains how to release the I²C value of the session token.

I²C communication with the M24SR64-Y starts with a valid Start condition, followed by a

device select code.

If the delay between the Start condition and the following rising edge of the Serial Clock

(SCL) that samples the most significant of the Device Select exceeds the t

START_OUT_MAX

time (see

Table 78

), the I²C logic block is reset and further incoming data transfer is ignored

until the next valid Start condition.

Figure 13. I²C token release sequence

ꢄ

!ꢄW

67$57B287BPD[ꢄ

6&/

6’$

0ꢁꢆ65ꢄ’HYLFHꢄ

6HOHFWꢄFRGH

6WDUWꢄ

FRQGLWLRQ

6WRSꢄ

FRQGLWLRQ

06Yꢆꢀꢊꢍꢈ9ꢂ

Note:

If the above delay is below t

unmodified.

(see

ble 78

), I

C session token stays

START_OUT_min

If the delay is between t

and t

, I C session token might or not

START_OUT_min

START_OUT_max

be released. This range of delay is not authorized for safe operation.

DocID023790 Rev 20

M24SR64-Y

I2C device operation

7.5

I²C timeout on clock period

During a data transfer on the I

C bus, if the serial clock high pulse or serial clock low pulse

exceeds t

value that is the maximum value specified in

ble 78

, the I

C logic

CL_RESET

block is reset and any further incoming data transfer is ignore

d until the ne

xt valid Start

condition.

If the serial clock high pulse is under the maximum value of

CHCL

and the serial clock low

pulse is under the maximum value of t

ble 78

, the I

C logic block is not reset.

CLCH

For proper operation, the serial clock high pulse should not be higher than

CHCL

and lesser

than t

, and the serial clock low pulse should not be higher than

CHCH

and lesser

CL_RESET

7.6

Acknowledge bit (ACK)

The acknowledge bit is used to indicate a successful byte transfer. The bus transmitter,

whether a bus master or a slave device, releases the serial data (SDA) after sending eight

bits of data. During the 9th clock pulse period, the receiver pulls the SDA low to

acknowledge the receipt of the eight data bits.

7.7

7.8

Data input

During data input, the device samples serial data (SDA) on the rising edge of the serial clock

(SCL). For a correct device operation, the SDA must be stable during the rising edge of the

SCL, and the SDA signal must change only when the SCL is driven low.

I²C device address

The device address is the concatenation of the group number coded on 4 bits and the I C

address coded on 3 bits, as shown in

ble 68

Table 68. I

C device address format

b7-b4

0b1010

0bx

Group number

E2 bit

E1 bit

E0 bit

0 = Request

1 = Answer

DocID023790 Rev 20

I2C device operation

M24SR64-Y

7.9

I²C frame format

The I

C frame is composed of three fields:

1. SOD

field: contains the device select and the PCB. The PCB field is detailed in

Section 5.2

2. Payload

field: contains the command and its parameter, as defined in the I

C command

set.

3. EOD

field: contains the two CRC bytes computed on the SOD but excluding the device

select byte field.

ble 69

shows the format of an I

C frame.

Table 69. I C frame format

C frame

SOD

Payload

EOD

0xAC or 0xAD

1 byte

1 to 251 bytes

2 bytes

Device select

0xAC: to send a request to the M24SR64-Y

0xAD: to read a response of the M24SR64-Y

PCB field

C command or I

C answer

2 CRC bytes

7.9.1

Example of I²C frame commands

NDEF Tag Application command

This example presents the I

C frame of an NDEF

g Application Select command. The I

frame is detailed in

ble 70

Table 70. I C host to M24SR64-Y

Field

SOD

Payload

EOD

Value

0xAC

0x02 or 0x03

Command field

35 C0 or DF BE

Device select

PCB field

0x00 A4 04 00 07 D2 76 00 00 85 01 01 00

2 CRC bytes

Before sending a new command, the I

C host can send an I

C frame to read the M24SR64-

Y answer to the NDEF tag Application Select command.

DocID023790 Rev 20

M24SR64-Y

Field

I2C device operation

EOD

Table 71. M24SR64-Y to I C host

SOD

Payload

C host to

M24SR64-Y

M24SR64-Y to I

C host

0x90 00

Value

0xAD

0x02 or 0x03

F1 09 or 2D 53

Device select

PCB field

C command

2 CRC bytes

Figure 14

shows the I

C frame of the NDEF tag Application Select command.

Figure 14. NDEF tag Application Select command

6WDUWꢄRIꢄWKHꢄ

WUDQVPLVVLRQꢄ

RIꢄWKHꢄUHTXHVW

,ð&ꢄEXV

$&.

͘͘͘

Ϭǆꢃꢂ

ǆϬϮ ϬǆϬϬ Ϭǆꢃϰ ϬǆϬϰ ϬǆϬϬ ϬǆϬϳ ϬǆꢀϮ Ϭǆϳϲ ϬǆϬϬ ϬǆϬϬ Ϭǆϴϱ ϬǆϬϭ ϬǆϬϭ

(QGꢄRIꢄWKHꢄ

WUDQVPLVVLRQꢄ

RIꢄWKHꢄUHTXHVW

,ð&ꢄEXV

$&.

͘͘͘

ꢊ[ꢊꢊ

ꢊ

[ꢀꢉ

ꢊ[&ꢊ

6WDUWꢄRIꢄWKHꢄ

WUDQVPLVVLRQꢄ

RIꢄWKHꢄDQVZHU

ꢄŶĚꢁŽĨꢁƚŚĞꢁ

ƚƌĂŶƐŵŝƐƐŝŽŶꢁ

ŽĨꢁƚŚĞꢁĂŶƐǁĞƌ

,ð&ꢄEXV

ꢃꢂ< ꢃꢂ< ꢃꢂ< ꢃꢂ< ꢃꢂ< EŽꢃꢂ<

͘͘͘

Ϭǆꢃꢀ ϬǆϬϮ ϬǆϵϬ ϬǆϬϬ Ϭǆ&ϭ ϬǆϬϵ

$&.

$FNQRZOHGJHꢄEꢄ0ꢁꢆ65[[ꢋ<

$&.

1R$&.

/HJHQG

$FNQRZOHGJHꢄEꢄWKHꢄ,ð&ꢄKRVW

1Rꢄ$FNQRZOHGJHꢄEꢄWKHꢄ,ð&ꢄKRVW

%WHꢄVHQWꢄEꢄWKHꢄ0ꢁꢆ65[[ꢋ<

ꢊ[ꢊꢊ

%WHꢄVHQWꢄEꢄWKHꢄ,ð&ꢄKRVW

%WHꢄVHQWꢄEꢄWKHꢄ0ꢁꢆ65[[ꢋ<

ꢊ[ꢊꢁ

ꢊ[ꢊꢊ

6WDUWꢄVHQWꢄEꢄWKHꢄ,ð&ꢄKRVW

6WRSꢄVHQWꢄEꢄWKHꢄ,ð&ꢄKRVW

06Yꢀꢌꢈꢊꢉ9ꢂ

DocID023790 Rev 20

I2C device operation

M24SR64-Y

7.10

Open an I²C session

pen an I²C session, the I²C host shall send either the GetSession command or the

KillRFsession command. The GetSession Command opens an I²C session if an RF session

in not currently opened.

A KillRFsession command closes the current RF session if it exist and opens an I²C

session.

When an I²C session is opened, the RF host cannot communicate with the M24SR64-Y and

cannot close the I²C session.

7.11

Close the I²C session

There are three ways to close an I²C session:

•

turn off the Vcc power supply

send the I2C token release sequence

wait for the I²C watchdog when it is enabled

wait for the I²C timeout on clock period

DocID023790 Rev 20

M24SR64-Y

Functional procedures

This section describes some procedure to access the memory or manage its protection.

8.1

Selection of an NDEF message

The RF or I²C host shall use this procedure to detect the NDEF message inside an

M24SR64-Y.

The NDEF detection procedure is as follows:

1. Open

an RF or an I²C session

2. Send

the SelectNDEF

gApplication command

3. Select

the CC file

4. Read

the CC file

5. Select

the NDEF file.

8.2

Reading of an NDEF message

The RF or I²C host executes the NDEF read procedure to read the NDEF file.

1. Detect

successfully the NDEF file using the NDEF detection procedure

2. Check

that the read access without any security is granted for the NDEF file from the

information provided by the CC file

3. Select

the NDEF file

4. Read

the NDEF file.

Note:

Reading the NDEF file should not go beyond the NDEF Length field (NLEN), which

indicates the size of the NDEF message stored in the NDEF file.

8.3

Reading a locked NDEF file

The RF or I²C host executes this procedure to read an NDEF file which has been locked

previously.

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Verify

the Read password by using the Verify command

4. Read

the data in the NDEF file.

DocID023790 Rev 20

Functional procedures

M24SR64-Y

8.4

Locking an NDEF file

The RF or I²C host executes this procedure to protect an NDEF file.

1. Select

the NDEF

g Application

2. Check

the right access provided by the CC file

3. Select

the NDEF file

4. Transmit

the NDEF file Write password by using the Verify command

5. Lock

the NDEF file by sending the Enable verification command.

8.5

8.6

Unlocking an NDEF file

The RF or I²C host executes this procedure to unlock an NDEF file which has been locked

previously.

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Verify

the NDEF file Write password or the I²C password by using the Verify command

4. Unlock

the NDEF file by sending the Disable verification command.

Reaching the read-only state for an NDEF file

The RF or I²C host executes this procedure to reach the read-only state for an NDEF file.

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Transmit

the NDEF file Write password or the I²C password by using the Verify

command

4. Send

an EnablePermanentState command as the Write access right of the previous

Select NDEF file.

8.7

Changing an NDEF password procedure

The RF or I²C host could use this procedure to change one NDEF password. it can be a

Read or Write password.

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Transmit

the NDEF file Write password or the I²C password by using the Verify

command

4. Change

the password by sending a ChangeReferenceData command.

DocID023790 Rev 20

M24SR64-Y

Functional procedures

8.8

Changing a File type Procedure

The RF or I²C host executes this procedure to change the File Type of a file for which all

access rights were previously granted.

1. Select

the NDEF

g Application

2. Select

the File to be modified

3. Set

the File Length to 0x00 using the UpdateBinary command

4. Send

an UpdateFileType command with the New file Type as data.

8.9

Updating a NDEF file

When there’s enough space in the file to update it with new content, the following steps

should be followed to update the NDEF message:

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Unlock

the NDEF file if necessary

4. Write

the NDEF length to 0x0000 with the Update Binary command.

5. Write

the NDEF message in the NDEF message field using one or more Update Binary

commands.

6. Write

the NDEF length of the NDEF message using the Update Update command.

It is recommended the NDEF length is read back and checked against the desired value to

ensure the Update sequence has been correctly performed.

DocID023790 Rev 20

UID: Unique identifier

M24SR64-Y

UID: Unique identifier

The M24SR64-Y is uniquely identified by a 7 bytes unique identifier (UID). The UID is a

read-only code and comprises:

•

The IC manufacturer code on 1 byte (0x02 for STMicroelectronics).

The Product code on 1 byte.

A device number on 5 bytes.

ble 72

describes the UID format.

Table 72. UID format

0x02 0x84

5 bytes

IC manufacturer code

M24SR64-Y product code

Device number

DocID023790 Rev 20

M24SR64-Y

Maximum ratings

Stressing the device above the ratings listed in

Table 73

may cause permanent damage to

the device. These are stress ratings only and operation of the device at these or any other

conditions above those indicated in the operating sections of this specification is not implied.

Exposure to absolute maximum rating conditions for extended periods may affect the device

reliability. The RF operation is guaranteed to work up to 85C ambient operating

temperature.

Table 73. Absolute maximum ratings

Symbol

Parameter

Min.

Max.

Unit

Ambient operating temperature

-40

105

°C

, h

STG

Sawn wafer on

UV tape

Storage conditions

(1)

months

STG

kept in its original packing form

UFDFPN8,

SO8, TSSOP8

STG

Storage temperature

–65

150

°C

Sawn Bumped

Wafer

(kept in its

antistatic bag)

STG

Storage time

months

°C

Lead temperature

during soldering

UFDFPN8,

SO8, TSSOP8

LEAD

see note

(2)

C input or output range and GPO

RF supply current AC0 – AC1

RF input voltage

-0.50

–

6.5

(3)

100

amplitude between

AC0 and AC1, GND

(3)

MAX_1

VAC0-VAC1

–

pad left floating

AC voltage between

VAC0-GND or

(3)

MAX_2

AC0 and GND, or AC1

VAC1-GND

-0.5

4.5

and GND

Electrostatic discharge

ESD

voltage (human body

AC0-AC1

–

1000

3500

model)

(4)

Electrostatic discharge

voltage (human body

model)

(4)

ESD

Other pads

1. Counted

from ST shipment date.

2. Compliant

with JEDEC Std J-STD-020D (for small body, Sn-Pb or Pb assembly), the ST ECOPACK

7191395 specification, and the European directive on Restrictions on Hazardous Substances (ROHS

directive 2011/65/EU, July 2011).

3. Based

on characterization, not tested in production. Maximum absorbed power = 100 mW @ 7.5 A/m

4. AEC-Q100-002

(compliant with JEDEC Std JESD22-A114A, C1 = 100 p

1 = 1500

, R2 = 500

)

DocID023790 Rev 20

I2C DC and AC parameters

M24SR64-Y

I C

DC and AC parameters

This section summarizes the operating and measurement conditions, and the DC and AC

characteristics of the device in I

C mode. The parameters in the DC and AC characteristic

tables that follow are derived from tests performed under the measurement conditions

summarized in the relevant tables. Designers should check that the operating conditions in

their circuit match the measurement conditions when relying on the quoted parameters.

Table 74. I C operating conditions

Symbol

Parameter

Min.

Max.

Unit

Supply voltage

2.7

5.5

Ambient operating temperature for grade 6

Ambient operating temperature for grade 8

– 40

°C

105

Table 75. AC test measurement conditions

Symbol

Parameter

Min.

Max.

Unit

Load capacitance

100

Input rise and fall times

Input levels

–

hi-lo

ref(t)

0.2 V

to 0.8 V

0.3 V

to 0.7 V

Input and output timing reference levels

Figure 15. AC test measurement I/O waveform

,QSXWꢄOHYHOV

,QSXWꢄDQGꢄRXWSXW

WLPLQJꢄUHIHUHQFHꢄOHYHOV

ꢊꢇꢃꢄ9

ꢊꢇꢈꢄ9

ꢊꢇꢀꢄ9

ꢀꢁꢂ 6

06ꢆꢈꢉꢊꢂ9ꢂ

Table 76. Input parameters

Parameter

Symbol

Min.

Max.

Unit

Input capacitance (SDA)

–

Input capacitance (other pins)

Pulse width ignored (Input filter on SCL and SDA)

DocID023790 Rev 20

M24SR64-Y

Symbol

I2C DC and AC parameters

Table 77. I C DC characteristics

Parameter

Test condition

Min.

Max.

Unit

Input leakage current

(SCL, SDA)

= V

or V

device in Standby mode

–

± 2

µA

SDA in Hi-Z, external voltage applied on

SDA: V

or V

Output leakage current

–

± 2

µA

_{CC
= 3.3
V
,
w
ith RF ON}

_{CC
= 3.3
V
,
w
ith RF OFF}

_{CC
= 5.5 V, with RF ON
(1)}

= 5.5

ith RF OFF

_{CC
= 3.3
V
,
w
ith RF ON}

_{CC
= 3.3
V
,
w
ith RF OFF}

= 5.5

ith RF ON

–

Standby power mode supply

current

CC0

CC1

CC2

CC3

µA

150

250

200

250

200

550

500

550

500

Supply current

µA

C Session open)

= 5.5

ith RF OFF

= 3.3 V (f

= 1 MHz), with RF ON

(3)

Supply current

(2)

(Read binary)

_{CC
= 3.3 V (f
C
= 1 MHz), with RF OFF
(3)}

_{CC
= 5.5 V (f
C
= 1 MHz), with RF ON
(3)}

= 5.5 V (f

= 1 MHz), with RF OFF

(3)

_{CC
= 3.3 V (f
C
= 1 MHz), with RF ON
(3)}

_{CC
= 3.3 V (f
C
= 1 MHz),with RF OFF
(3)}

Supply current

(2)

(Update binary)

= 5.5 V (f

= 1 MHz), with RF ON

(3)

= 5.5 V (f

= 1 MHz), with RF OFF

(3)

_{CC
= 2.7 V}

Input low voltage (SDA, SCL)

Input high voltage (SDA, SCL)

Input low voltage (RF disable)

Input high voltage (RF disable)

-0.45

0.7 V

–

0.3 V

6.5

= 5.5 V

= 2.7 V

= 5.5 V

= 2.7 V

= 5.5 V

0.45

–

= 2.7 V

1.4

= 5.5 V

Output low voltage (SDA)

Output low voltage (GPO)

= 3 mA, V

= 5.5 V

_{OL
= 1 mA, V
CC
= 2.7 to 5.5 V}

–

0.4

1. When

an RF session is Opened, I

corresponds to the standby power mode.

2. Characterized

only.

3. Input

levels as defined in

Figure 15

DocID023790 Rev 20

I2C DC and AC parameters

M24SR64-Y

Table 78. I

C AC characteristics (400 kHz)

Test conditions specified in

Table 74

(preliminary data based on design simulations)

Symbol

Alt.

Parameter

Min.

Max.

Unit

SCL

HIGH

LOW

–

Clock frequency

0.05

0.6

400

kHz

µs

(1)

CHCL

Clock pulse width high

Clock pulse width low

Clock reset

20000

(2)

CLCH

1.3

CL_reset

XH1XH2

XL1XL2

DL1DL2

DXCX

40000

–

(3)

Input signal rise time

Input signal fall time

SDA (out) fall time

(3)

100

300

SU:DAT

Data in set up time

HD:DAT

Data in hold time

–

CLDX

(4)

CLQX

Data out hold time

100

–

(5)

CLQV

Clock low to next data valid (access time)

900

–

(6)

CHDX

SU:STA

Start condition set up time

HD:STA

Start condition hold time

SU:STO

Stop condition set up time

600

1300

–

DLCL

CHDH

DHDL

–

BUF

Time between Stop condition and next Start condition

–

I²C write time in one page

I²C write time up to 246 bytes

–

(7)

–

Pulse width ignored (input filter on SCL and SDA)

Delay for I²C token release

–

START_OUT

1. t

CHCL

timeout.

2. t

CLCH

timeout.

3. There

is no min. or max. value for the input signal rise and fall times. It is however recommended by the I²C specification that the input

signal rise and fall times be more than 20 ns and less than 300 ns when f

< 400 kHz.

void spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or rising edge of

SDA.

5. t

CLQV

is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8V

in a compatible way with the

C specification (which specifies t

SU:DAT

(min) = 100 ns), assuming that the R

bus

× C

bus

time constant is less than 500 ns

(as specified in

6. For

a restart condition, or following a write cycle.

7. Characterized

only, not tested in production.

DocID023790 Rev 20

M24SR64-Y

I2C DC and AC parameters

Table 79. I C AC characteristics (1 MHz)

Test conditions specified in

Table 74

(preliminary data based on design simulations)

Symbol

Alt.

Parameter

Min.

Max.

Unit

SCL

Clock frequency

0.05

260

1000

–

kHz

(1)

CHCL

HIGH

Clock pulse width high

LOW

Clock pulse width low

(2)

CLCH

500

–

(3)

XH1XH2

XL1XL2

DL1DL2

DXCX

Input signal rise time

Input signal fall time

SDA (out) fall time

(3)

120

SU:DAT

Data in set up time

HD:DAT

Data in hold time

–

CLDX

–

CLQX

Data out hold time

100

–

(4)(5)

CLQV

Clock low to next data valid (access time)

450

(6)

CHDX

SU:STA

Start condition set up time

HD:STA

Start condition hold time

SU:STO

Stop condition set up time

250

–

DLCL

CHDH

Time between Stop condition and next Start

condition

DHDL

BUF

–

500

–

I²C write time in one page

I²C write time up to 246 bytes

–

Pulse width ignored (input filter on SCL and

SDA)

(7)

–

1. t

CHCL

timeout.

2. t

CLCH

timeout.

3. There

is no min. or max. value for the input signal rise and fall times. It is however recommended by the I²C

specification that the input signal rise and fall times be less than 120 ns when f

< 1 MHz.

void spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or

rising edge of SDA.

5. t

CLQV

is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8V

in a

compatible way with the I

C specification (which specifies t

SU:DAT

(min) = 100 ns), assuming that the R

bus

× C

bus

time constant is less than 500 ns (as specified in

6. For

a reStart condition, or following a write cycle.

7. Characterized

only, not tested in production.

DocID023790 Rev 20

I2C DC and AC parameters

M24SR64-Y

Figure 16. I C AC waveforms

&+&/

;/ꢂ;/ꢁ

&/&+

;+ꢂ;+ꢁ

6&/

‘/&/

;/ꢂ;/ꢁ

6’$ꢄ,Q

‘;&+

6’$

&KDQJH

‘+’/

&+’/

6WDUW

FRQGLWLRQ

&/’;

;+ꢂ;+ꢁ

&+’+

6WDUW

6’$

,QSXW

6WRS

FRQGLWLRQ

6&/

6’$ꢄ,Q

&+’+

&+’/

6WRS

FRQGLWLRQ

:ULWHꢄFFOH

6WDUW

FRQGLWLRQ

&+&/

6&/

4/ꢂ4/ꢁ

&/49

&/4;

‘DWDꢄYDOLG

6’$ꢄ2XW

06ꢆꢈꢉꢀꢁ9ꢂ

DocID023790 Rev 20

M24SR64-Y

I2C DC and AC parameters

11.1

C timing measurement condition

represents the Maximum Rbus value versus bus parasitic capacitance (Cbus) for

an I

C bus at maximum frequency f

= 400 kHz.

Figure 17. Maximum Rbus value with f

= 400 kHz

ꢃꢀꢀ

4HE 2

X #

TIME CONSTANT

BUS

MUST BE BELOW THE ꢄꢀꢀ NS

TIME CONSTANT LINE REPRESENTED

ON THE LEFTꢁ

ꢃꢀ

BUS

(ERE 2

BUS

§ #

ꢋ ꢃꢂꢀ NS

BUS

ꢄ K

3#,

3$!

)£# BUS

MASTER

-ꢂꢄXXX

ꢃ

ꢌꢀ P&

BUS

ꢃꢀ

ꢃꢀꢀ

“US LINE CAPACITOR ꢈP&ꢉ

ꢃꢀꢀꢀ

AIꢃꢄꢅꢆꢇB

Figure 18

represents the Maximum Rbus value versus bus parasitic capacitance (Cbus) for

an I

C bus at maximum frequency f

= 1 MHz.

Figure 18. Maximum Rbus value with f

= 1 MHz

ꢃ

ꢀ

BUS

4HE 2

§ #

TIME CONSTANT

BUS

MUST BE BELOW THE ꢃꢍꢀ NS

TIME CONSTANT LINE REPRESENTED

ON THE LEFTꢁ

3#,

3$!

)£# BUS

MASTER

ꢃꢀ

ꢄ

-ꢂꢄXXX

(EREꢎ

BUS

ꢋ ꢃꢂꢀ NS

BUS

ꢃ

ꢃꢀ

ꢌꢀ

“US LINE CAPACITOR ꢈP&ꢉ

ꢃꢀꢀ

-3ꢃꢆꢅꢄꢍ6ꢃ

DocID023790 Rev 20

I2C DC and AC parameters

M24SR64-Y

Figure 19. I

C bus protocol

6&/

6’$

,QSXW

6’$

&KDQJH

6WDUW

6WRS

FRQGLWLRQ

6&/

6’$

ꢂ

ꢁ

ꢀ

ꢈ

ꢃ

ꢍ

$&.

06%

6WDUWꢄ

FRQGLWLRQ

ꢂ

ꢁ

ꢀ

ꢈ

ꢃ

ꢍ

6&/

6’$

06%

$&.

6WRS

FRQGLWLRQ

-3ꢄꢅꢍꢃꢌ6ꢃ

Table 80. Device select code

Device type identifier

(1)

Chip Enable address

b3 b2 b1

Device select code

1. The

most significant bit, b7, is sent first.

DocID023790 Rev 20

M24SR64-Y

GPO parameters

This section lists the timing of the GPO according to its configuration.

(1)

Table 81. GPO timings measurement

GPO field

I/F

Condition

Command

Kill session

Get session

Symbol

Typ. Unit

CmdSTPtoGPlow

*add 100 µs for boot

after POR

15*

µs

GPO low when

session active

0xX1

0x1X

C token release

sequence

GPO return HZ

AnswerlbLBtoGPHZ 105

µs

Session Open

GPO low when

session active

NDEF select

Deselect

CmdEOFtoGPlow

170

GPO return HZ

CmdEOFtoGPHZ

CmdSTPtoGPlow

370

µs

GPO low when

programming

Update Binary

Writing time duration

(No time extension)

0xX2

0x2X

µs

WIP

CmdEOFtoGPlow

GPO low when

programming

Writing time duration

(No time extension)

µs

GPO low when a

command is

computed

ReadBinary

UpdateBinary

CmdSTPtoGPlow

Answer Ready

0xX3

0x3X

GPO return HZ on

new command

After NewCmdlbFB

or AnswerlbFB

All commands

105

GPO low when

modifying NDEF

UpdateBinary

(Msg Length #0)

CmdEOFtoGPlow

µs

Message In

Progress

GPO low when

modifying NDEF

Writing time duration

(No time extension)

UpdateBinary

SendInterrupt

All commands

SendInterrupt

GPO low after

receiving an

Interrupt command

CmdSTPtoGPlow

µs

0xX4

0x4X

After NewCmdlbFB

or AnswerlbFB

Interrupt

GPO return HZ

105

GPO low after

receiving an

Interrupt command

CmdEOFtoGPlow

Pulse duration

µs

540

DocID023790 Rev 20

GPO parameters

GPO field

M24SR64-Y

Typ. Unit

(1)

Table 81. GPO timings measurement

(continued)

I/F

Condition

Command

Symbol

GPO low when

reset

Reset GPO

CmdSTPtoGPlow

µs

0xX5

0x5X

GPO return HZ

when set

Set GPO

Reset GPO

Set GPO

CmdSTPtoGPHZ

CmdEOFtoGPlow

CmdEOFtoGPHZ

State Control

GPO low when

reset

GPO return HZ

when set

Anticollision

command or start

of RF disturb

(command using

another RF

GPO low after

receiving an RF

command

CmdSOFtoGPlow

CmdEOFtoGPHZ

µs

protocol)

RF Busy

0x6X

Deselect or end of

RF disturb

(command using

another RF

GPO return HZ

afte

eselectio

RF command in

another protocol

460

protocol)

1. Characterized

only.

DocID023790 Rev 20

M24SR64-Y

Write cycle definition

(1)

Table 82. Write cycle definition

Test Conditions

Symbol

Parameter

Min

Max

Units

≤

25 °C, V

CC(min)

< V

CC(max)

≤

85 °C, V

CC(min)

< V

CC(max)

≤

105 °C, V

CC(min)

< V

CC(max)

–

1,000,000

600,000

500,000

Write cycle

Ncycle

Write cycle

endurance

(2)

1. A

write cycle is calculated per byte, and corresponds to a write to this byte.

2. Write

cycle endurance is defined by characterization and qualification.

DocID023790 Rev 20

RF electrical parameters

M24SR64-Y

RF electrical parameters

This section summarizes the operating and measurement conditions, and the DC and AC

characteristics of the device in RF mode.

The parameters in the DC and AC characteristics tables that follow are derived from tests

performed under the Measurement Conditions summarized in the relevant tables.

Designers should check that the operating conditions in their circuit match the measurement

conditions when relying on the quoted parameters.

Table 83. Default operating conditions

Symbol

Parameter

Min.

Max.

Unit

Ambient operating temperature

–40

°C

(1)

Table 84. RF characteristics

Symbol

Parameter

Condition

Min

Typ

Max

Unit

External RF signal frequency

13.553

1500

13.56 13.567 MHz

H_ISO

Operating field according to ISO

= 0 °C to 50 °C

–

7500 mA/m

Operating field in extended

temperature range

H_Extended

= -40 °C to 85 °C

500

CARRIER

100% carrier modulation index

MI=(A-B)/(A+B)

28/f

7/f

1.5xt4

–

100

40.5/f

µs

Pause A length

–

Pause A low time

Pause A rise time

Pause A rise time section

16/f

6/f

Minimum time from carrier

generation to first data

MIN CD

From H-field min

–

RF write time (including internal

Verify) for one page

TUN

Internal tuning capacitor in SO8

(2)

= 13.56 MHz

Chip reset

22.5

–

27.5

RF_OFF

RF OFF time

1. All

timing characterizations were performed on a reference antenna with the following characteristics:

External size: 75 mm x 48 mm

Number of turns: 6

Width of conductor: 0.6 mm

Space between two conductors: 0.6 mm

Value of the tuning capacitor in SO8: 25 pF (M24SR64-Y)

Value of the coil: 5 µH

Tuning frequency: 14.2 MHz.

2. Characterized

only, at room temperature only, measured at VAC0-VAC1 = 2 V peak to peak at 13.56 MHz.

DocID023790 Rev 20

M24SR64-Y

Package information

In order to meet environmental requirements, ST offers these devices in different grades of

ECOPACK packages,

depending on their level of environmental compliance. ECOPACK

specifications, grade definitions and product status are available at:

www.st.com

ECOPACK is

an ST trademark.

15.1

SO8N package information

Figure 20. SO8N – 8-lead plastic small outline, 150 mils body width, package outline

H X

ꢂ

ꢃ

!ꢄ

CCC

ꢀꢁꢂꢃꢄPP

*$8*(ꢄ3/$1(

ꢁ

%ꢀ

ꢀ

!ꢀ

,ꢀ

62ꢋ$B9ꢁ

1. Drawing

is not to scale.

Table 85. SO8N – 8-lead plastic small outline, 150 mils body width,

package data

millimeters

Typ

inches

(1)

Symbol

Min

Max

Min

Typ

Max

–

1.750

0.250

–

0.0689

0.0098

–

0.100

1.250

0.280

0.170

4.800

5.800

3.800

–

0.0039

0.0492

0.0110

0.0067

0.1890

0.2283

0.1496

–

0.480

0.230

5.000

6.200

4.000

–

0.0189

0.0091

0.1969

0.2441

0.1575

–

4.900

6.000

3.900

1.270

–

0.1929

0.2362

0.1535

0.0500

0.250

0°

0.500

8°

0.0098

0°

–

0.0197

8°

–

0.400

–

1.270

0.0157

0.0500

DocID023790 Rev 20

Package information

M24SR64-Y

Table 85. SO8N – 8-lead plastic small outline, 150 mils body width,

package data (continued)

millimeters

inches

(1)

Symbol

Min

Typ

Max

Min

Typ

Max

–

1.040

–

0.0409

–

ccc

0.100

0.0039

1. Values

in inches are converted from mm and rounded to 4 decimal digits.

Figure 21. SO8N – 8-lead plastic small outline, 150 mils bosy width,

package recommended footprint

ꢊꢇꢌꢄꢎ[ꢃꢏ

ꢂꢇꢁꢈ

2ꢈB62ꢃ1B)3B9ꢂ

80/89

DocID023790 Rev 20

M24SR64-Y

Package information

15.2

TSSOP8 package information

Figure 22. TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,

package outline

ꢀ

ꢄϭ

ꢄ

ꢃϭ

ꢃϮ

ꢃ

>ϭ

ꢂW

76623ꢃ$0B9ꢁ

1. Drawing

is not to scale.

Table 86. TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,

package mechanical data

millimeters

Min

inches

(1)

Symbol

Typ

Max

Typ

Min

Max

–

1.200

0.150

1.050

0.300

0.200

0.100

3.100

–

0.0472

0.0059

0.0413

0.0118

0.0079

0.0039

0.1220

–

0.050

0.800

0.190

0.090

–

0.0020

0.0315

0.0075

0.0035

–

0.0394

–

1.000

–

2.900

–

3.000

0.650

6.400

4.400

0.600

1.000

0.1142

–

0.1181

0.0256

0.2520

0.1732

0.02636

0.0394

–

6.200

4.300

0.450

–

6.600

4.500

0.750

–

0.2441

0.1693

0.0177

–

0.2598

0.1772

0.0295

–

0°

8°

0°

8°

1. Values

in inches are converted from mm and rounded to 4 decimal digits.

DocID023790 Rev 20

Package information

M24SR64-Y

15.3

UFDFPN8 package information

Figure 23. UFDFPN8 – 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch

dual flat package outline

‘

$ꢂ

FFF

ꢂ

3LQꢄꢐꢂꢄ

,’ꢄPDUNLQJ

(

HHH

6HDWLQJꢄSODQH

$ꢀ

6LGHꢄYLHZ

DDD

ꢁ[

ꢂ

ꢁ

ꢁ[

DDD

SꢄYLHZ

‘ꢁ

‘DWXPꢄ$

ꢂ

ꢁ

/ꢂ

/ꢀ

3LQꢄꢐꢂꢄ

/ꢀ

(ꢁ

,’ꢄPDUNLQJ

Hꢅꢁ

/ꢂ

UPLQDOꢄWLS

‘HWDLOꢄ³$´

(YHQꢄWHUPLQDO

1’ꢋꢂꢄ

[

%RWWRPꢄYLHZ

6HHꢄ’HWDLOꢄ³$´

=:EB0(B9ꢂ

1. Max

package warpage is 0.05 mm.

2. Exposed

copper is not systematic and can appear partially or totally according to the cross section.

3. Drawing

is not to scale.

4. The

central pad (the area E2 by D2 in the above illustration) must be either connected to V

or left floating

(not connected) in the end application.

DocID023790 Rev 20

M24SR64-Y

Package information

Table 87. UFDFPN8 – 8- lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch

dual flat package mechanical data

millimeters

Typ

inches

(1)

Symbol

Min

Max

Min

Typ

Max

0.450

0.550

0.600

0.050

0.300

2.100

1.600

3.100

1.600

–

0.0177

0.0217

0.0236

0.0020

0.0118

0.0827

0.0630

0.1220

0.0630

–

0.000

0.020

0.0000

0.0008

(2)

0.200

0.250

0.0079

0.0098

1.900

2.000

0.0748

0.0787

D2 (rev MC)

1.200

–

0.0472

–

2.900

3.000

0.1142

0.1181

E2 (rev MC)

1.200

–

0.0472

–

K (rev MC)

–

0.500

–

0.0197

0.300

–

0.0118

–

0.300

0.500

0.150

–

0.0118

0.0197

0.0059

–

0.300

0.0118

aaa

–

0.150

0.100

0.050

0.080

–

0.0059

0.0039

0.0020

0.0031

bbb

ccc

ddd

eee

(3)

1. Values

in inches are converted from mm and rounded to 4 decimal digits.

2. Dimension

b applies to plated terminal and is measured between 0.15 and 0.30 mm from the terminal tip.

3. Applied

for exposed die paddle and terminals. Exclude embedded part of exposed die paddle from

measuring.

DocID023790 Rev 20

Ordering information

M24SR64-Y

Ordering information

Table 88. Ordering information scheme for packaged devices

M24 SR

64- Y

Example:

Device type

M24 = I

C interface device

Device feature

SR = Short range

Memory size

64 = memory size in Kbits

Voltage range

Y = 2.7 to 5.5 V

Package

MN = SO8N

(1)

DW = TSSOP8

(1)

MC = UFDFPN8

(2)

SG12I = 120 µm ± 15 µm bumped and sawn inkless wafer on 8-inch frame

Device grade

6 = industrial: device tested with standard test flow over –40 to 85 °C

8 = industrial (device tested with standard test flow over – 40 °C to + 105 °C

(No parameter for SG12I)

Option

T =

pe and reel packing

(No parameter for SG12I)

Capacitance

/2 = 25 pF

1. Available

for device grade 6 and 8.

2. Available

for device grade 6 only.

Note:

Parts marked as ES or E are not yet qualified and therefore not approved for use in

production. ST is not responsible for any consequences resulting from such use. In no event

will ST be liable for the customer using any of these engineering samples in production.

ST’s Quality department must be contacted prior to any decision to use these engineering

samples to run a qualification activity.

Table 78: I2C AC characteristics (400 kHz)

DocID023790 Rev 20

M24SR64-Y

Revision history

Table 89. Document revision history

Changes

Date

Revision

15-Jan-2013

12-Apr-2013

16-May-2013

Initial release.

Global contents update.

Updated “Number of bytes in CC file” value and comment in

Table 4: CC file

layout for 1 NDEF file

17-May-2013

Added

and

Table 79: I2C AC

characteristics (1 MHz)

Added missing “TSSOP 8” below the second figure

on page 1

Removed a sentence in

Section 1: Functional description

and updated a

sentence in

Section 2.5: Supply voltage (VCC)

Updated

Section 2.7: General purpose output (GPO)

including all graphics.

Updated

Section 3.1.2: CC file layout

and

Section 3.2: Read and write access

rights to the memory

Section 4.1: Master and slave

Section 4.2.2: I2C token

Section 5.5: CRC of the I2C and RF frame

Added rows to

Table 6: Field list

Added a note to, updated

ble 9: Details about the RF Session field

and

ble 11: Details about the RF enable field

Updated

Figure 1: See the procedure to lock the write access.

and added a note

below

Figure 12: Command and response exchange

21-Jun-2013

Updated or added text to

Section 5.7.1: Verify command

Section 5.7.4: Disable

Verification Requirement command

Section 8.7: Changing an NDEF password

procedure

Updated

ble 63: Ascending and descending data rate coding

Added

Section 5.8: ST Proprietary command set

Section 5.10: Specific I²C

command set

and

Section 6: RF device operation

Changed “GetRFsession command into “GetI2Csession command”, and

“Detection of an NDEF message” into “Selection of an NDEF message”.

Updated ICCs in

Removed “ASK modulated signal” figure and text before from

Section 14: RF

electrical parameters

Added UFDFPN8 drawing

on page 1

Changed “dual interface device”, “dual interface EEPROM” and “dual interface

memory” into “NFC dynamic tag device”.

Changed “EnablePermanentSecurity” into “EnablePermanentState” in

Table 14:

RF and I²C command sets

Updated the bitfields in

and

29-Aug-2013

Changed the following commands:

– “ReadMemory” into “STReadMemory“,

– “Read binary” into “STReadBinary”,

– “EnablePermanentLock” into “EnablePermanentState”.

Updated I

CC0

parameter in

Section 15.3: UFDFPN8 package information

and added a note.

Added

and UFDFPN8 package.

DocID023790 Rev 20

Revision history

M24SR64-Y

Table 89. Document revision history (continued)

Revision Changes

Date

08-Nov-2013

Global changes.

Restored the whole content of

Section 2.5.1: Operating supply voltage VCC

Updated the capacitor values in

Removed bullet (4) from

Section 8.6: Reaching the read-only state for an NDEF

file

Updated V

ESD

value in

Table 73: Absolute maximum ratings

, I

values in

ble 77

: I2C DC characteristics

, and H_Extended value in

able 84: RF

characteristics

12-Dec-2013

Added details to “S(WTX)” bullet in

Section 5.4: S-Block format

Added sentences to

Section 5.6.8: UpdateBinary command

and to

Section 5.8.3:

DisablePermanentState command

Changed ‘0x001E’ value into ‘0x001F’ in

Table 56: StateControl command format

Updated values in

Table 61: ATS response

Changed the datasheet status from “Preliminary data” to “Production data”.

18-Dec-2013

Added Note (4) to

Figure 10: Changing the read access right to an NDEF file

and

Figure 11: Changing the write access right to an NDEF file

Updated

Figure 5: GPO configured as I2C answer ready (GPO field = 0xX3)

and

Figure 8: GPO configured as State Control (GPO field = 0xX5 or 0x5X)

Added I

C text to the Note below

Table 22: S-Block detailed format

Edited the third paragraph of

Section 5.8.1: ExtendedReadBinary command

Added

Section 5.8.4: UpdateFileType command

and

Section 8.8: Changing a File

type Procedure

Updated bullet 3 in

Section 7.9: I²C frame format

, and the Payload row

Table 70: I2C host to M24SR64-Y

. Updated bullet 2 in

Section 7.11: Close the

I²C session

17-Feb-2014

Edited V

row and removed V

ESD

(machine model) row from

Table 73: Absolute

maximum ratings

Updated I

rows and added a Note to

Figure 20: SO8N – 8-lead plastic small outline, 150 mils body width,

Updated

package outline

Fixed a typo in

Figure 23: UFDFPN8 – 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin

profile fine pitch dual flat package outline

title: UFDPFN8 changed into UFDFPN8.

Added WFDFPN8 package for automotive grade under qualification

Added data for automotive grade in

Table 6: Field list

and

ble 72: UID format

Added

Figure 24: WFDFPN8 (MLP8) 8-lead, 2 x 3 mm, 0.5 mm pitch very thin

fine pitch

dual flat package outline

Added

Table 88: WFDFPN8 8-lead thin fine pitch dual flat package no lead

mechanical data

14-Apr-2014

12-Jun-2014

86/89

Added MF = WFDFPN8 inside

Table 88: Ordering information scheme for

packaged devices

Inserted byte <04> between A4 and 00 inside

Figure 14: NDEF tag Application

Select command

Corrected las NDEF user data address to 0x1FFC inside

Table 5: NDEF file

layout

DocID023790 Rev 20

M24SR64-Y

Revision history

Table 89. Document revision history (continued)

Date

Revision

Changes

Updated

Figure 14: NDEF tag Application Select command

Updated

ble 78: I2C AC characteristics (400 kHz)

05-Jan-2015

Added note after

Table 88: Ordering information scheme for packaged devices

Updated:

–

Features

–

Section 2.7.6: State Control configuration (GPO field = 0xX5 or 0x5X)

–

ble 73: Absolute maximum ratings

–

ble 88: Ordering information scheme for packaged devices

Added

18-Mar-2016

–

ble 7: Details about I2C watchdog

–

ble 82: Write cycle definition

–

Section 13: Write cycle definition

Updated:

–

Features

–

Section 2.7.6: State Control configuration (GPO field = 0xX5 or 0x5X)

–

ble 73: Absolute maximum ratings

–

ble 74: I2C operating conditions

–

ble 82: Write cycle definition

29-Apr-2016

03-May-2016

Updated:

–

Features

Updated:

–

Section 3.2.2: Changing the read access right to NDEF files

–

Section 3.2.3: Changing the write access right to NDEF files

–

Section 5.6.5: NDEF Select command

–

Section 5.8.4: UpdateFileType command

–

Section 5.8.5: SendInterrupt command

–

Section 8.2: Reading of an NDEF message

–

Section 8.5: Unlocking an NDEF file

–

Section 8.6: Reaching the read-only state for an NDEF file

Added:

03-Nov-2016

–

Section 8.9: Updating a NDEF file

Updated:

22-Nov-2016

–

ble 35: R-APDU of the ReadBinary command

–

ble 47: R-APDU of the ExtendedReadBinary command

DocID023790 Rev 20

Figure 23.: UFDFPN8 – 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin

Revision history

Date

M24SR64-Y

Table 89. Document revision history (continued)

Revision Changes

Package SB12I replaced with SG12I.

Added:

– Note

profile fine pitch dual flat package outline

11-Feb-2017

Updated:

–

ble 88: Ordering information scheme for packaged devices

Updated:

–

ble 6: Field list

–

ble 20: R-Block detailed format

–

ble 72: UID format

–

ble 74: I2C operating conditions

–

ble 78: I2C AC characteristics (400 kHz)

–

ble 86: TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm

pitch, package mechanical data

–

ble 88: Ordering information scheme for packaged devices

–

Figure 15: AC test measurement I/O waveform

–

Figure 16: I2C AC waveforms

03-Aug-2017

–

Figure 19: I2C bus protocol

–

Figure 22: TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm

pitch, package outline

–

Section 16: Ordering information

Deleted:

–

Section 15.4: WFDFPN8 package information

–

Figure 24: WFDFPN8 (MLP8) 8-lead, 2 x 3 mm, 0.5 mm pitch very thin fine

pitch dual flat package outline

–

ble 88: WFDFPN8 8-lead thin fine pitch dual flat package no lead mechanical

data