STMicroelectronics-M24SR04-GMC5T-2

Signal descriptions

M24SR04-Y M24SR04-G

Signal descriptions

2.1

Serial clock (SCL)

This input signal is used to strobe all data in and out of the device. In applications where this

signal is used by slave devices to synchronize the bus to a slower clock, the bus master

must have an open drain output, and a pull-up resistor must be connected from Serial clock

(SCL) to V

. (

indicates how the value of the pull-up resistor can be calculated).

In most applications, though, this method of synchronization is not employed, and so the

pull-up resistor is not necessary, provided that the bus master has a push-pull (rather than

open drain) output.

2.2

2.3

Serial data (SDA)

This bidirectional signal is used to transfer data in or out of the device. It is an open drain

output that may be wire-OR’ed with other open drain or open collector signals on the bus. A

pull-up resistor must be connected from Serial data (SDA) to V

. (

indicates how

the value of the pull-up resistor can be calculated).

Antenna coil (AC0, AC1)

These inputs are used to connect the device to an external coil exclusively. It is advised not

to connect any other DC or AC path to AC0 or AC1.

When correctly tuned, the coil is used to access the device using NFC Forum Type 4

commands.

2.4

Ground (V

)

, when connected, is the reference for the V

supply voltage for all pads, even AC0

and AC1.

2.5

Supply voltage (V

)

This pin can be connected to an external DC supply voltage.

Note:

2.5.1

An internal voltage regulator allows the external voltage applied on V

to supply the

M24SR04.

Operating supply voltage V

Prior to selecting the M24SR04 and issuing instructions to it, a valid and stable V

voltage

within the specified [V

(min), V

(max)] range must be applied.

aintain a stable DC

supply voltage, it is recommended to decouple the V

line with suitable capacitors (usually

of the order of 10 nF and 100 pF) close to the V

/V package

pins.

CC SS

This voltage must remain stable and valid until the end of the transmission of the instruction

and, for a writing instruction (UpdateBinary, ChangeReferenceData,

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Signal descriptions

EnableVerificationRequirement, DisableVerificationRequirement, EnablePermanentState,

DisablePermanentState, until the completion of the internal I²C write cycle (t

2.5.2

2.5.3

Power-up conditions

When the power supply is turned on, V

rises from V

to V

. The V

rise time must not

vary faster than 1V/µs.

Device reset in I²C mode

In order to prevent inadvertent write operations during power-up, a power-on reset (POR)

circuit is included. At power-up (continuous rise of V

), the M24SR04 does not respond to

any I²C instruction until V

has reached the power-on reset threshold voltage (this

threshold is lower than the minimum V

operating voltage defined). When V

passes

over the POR threshold, the device is reset and enters the Standby power mode. However,

the device must not be accessed until V

has reached a valid and stable V

voltage

within the specified [V

(min), V

(max)] range.

In a similar way, during power-down (continuous decrease in V

), as soon as V

drops

below the power-on reset threshold voltage, the M24SR04 stops responding to any

instruction sent to it.

2.5.4

Power-down conditions

During power-down (continuous decay of V

), the M24SR04 must be in Standby power

mode (mode reached after decoding a Stop condition, assuming that there is no internal

operation in progress).

2.6

RF disable

This input signal is used to disable the RF communication. When the voltage on the V

is below the POR level or not connected, an internal pull-down resistor is connected on this

pad. Thus, the RF disable pad is maintained to the low level and the RF analog front end is

activated. When the voltage on the V

pin is higher than the POR level, the I²C host shall

set this pin to enable or disable the RF communication. In Dual interface mode, RF disable

must not be left floating.

2.7

General purpose output (GPO)

The GPO pad is an open drain pad and a external pull-up resistor shall be connected to it.

This pad is a configurable output signal. On delivery, GPO is configured as Session opened.

Its behavior is consistent with the I

C or RF session activated and with the mode chosen by

the user. The GPO pad is enable when an RF or an I

C session is open. When neither an

RF nor an I

C session is open, the GPO is high impedance.

DocID024754 Rev 16

Signal descriptions

M24SR04-Y M24SR04-G

(1)

The user can select one of these configurations

•

SessionOpen: an RF or I C session is ongoing.

MIP (NDEF Message updating In Progress): the RF host is writing an NDEF length

different from 0x0000. This mode can be used to detect when the RF host changes the

NDEF message as defined by the NFC Forum.

•

WIP (Writing In Progress): the M24SR04 is executing a writing operation.

INT (interrupt): the I C or RF host can force the M24SR04 to send a negative pulse on

the GPO pin.

•

I C ready response: an I C response is ready to be read by the I²C host.

State mode: the I C or RF host can control the state of the GPO pad during the RF

session.

•

RF busy: an RF host is communicating with the M24SR04.

2.7.1

Session Open configuration (GPO field = 0xX1 or 0x1X)

When the GPO is configured as “Session Open”, it goes to the Low state when an RF or I

session is ongoing (see

Figure 3

An RF session is taken when M24SR04 receives a valid Select Application. The session is

released after M24SR04 has received a valid Deselect command, if M24SR04 has received

a Kill RF session command in I

C or when the RF field became OF

An I C session is taken when M24SR04 receives a valid Get session command or a valid

Kill RF session command. The session is released after M24SR04 has received I C token

release sequence or after a Power Off.

GPO is driven low after a delay (1) or (3) when the session is open.

GPO is released after a delay (2) or (4) when the session is released.

Figure 3. GPO configured as Session Open (GPO field = 0xX1 or 0x1X)

^ĞƐƐŝŽŶ

Z&ꢁ

^ĞƐƐŝŽŶ

Z&ꢁ^ĞƐƐŝŽŶ

/Ϯꢂꢁ^ĞƐƐŝŽŶ

;ϰͿ

;ϯͿ

;ϭͿ

;ϮͿ

‘WKꢁĂƐꢁ^ĞƐƐŝŽŶꢁKƉĞŶ

D^ϯϬϳϴϰsϮ

1. CmdEOFtoGPlow

(RF command End of frame to GPORF Session pad low)

2. CmdEOFtoGPHZ

(RF command End of frame to GPORF Session pad HZ)

3. CmdSTPtoGPlow

(I2C command stop to GPO low)

4. AnswerlbLBtoGPHZ

(I2C answer last bit of last byte to GPO HZ)

1. See

Table 81

for more details.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Signal descriptions

2.7.2

WIP Writing in Progress configuration (GPO field = 0xX2 or 0x2X)

When the GPO is configured as “WIP”, it goes to the Low state during an I

C or RF writing

operation.

During an RF or I

C session, when M24SR04 updates a file, GPO is driven low after a delay

(1) or (3) following the beginning of the correspondent UpdateBinary command execution.

GPO will remain low during the writing time (2) or (4), before being released.

Figure 4. GPO configured as WIP (GPO field = 0xX2 or 0x2X)

;ϭͿꢁ

Z&ꢁŽƌꢁ/Ϯꢂꢁ

ĐŚĂŶŶĞůꢁꢁ

Žƌꢁ

;ϯͿ

hƉĚĂƚĞꢁ

ĐŽŵŵĂŶĚ

ꢄŶĚꢁŽĨꢁǁƌŝƚŝŶŐꢁ

ŽƉĞƌĂƚŝŽŶ

ꢃŶǇꢁŽƚŚĞƌꢁ

ĐŽŵŵĂŶĚ

‘WKꢁĂƐꢁt/W

;ϮͿꢁŽƌꢁ;ϰͿ

D^ϯϬϳϴϲsϯ

1. CmdSTPtoGPlow

(I2C Command Stop to GPO low)

2. Writing

time duration

3. CmdEOFtoGPlow

(RF Command End of frame to GPO low)

4. Writing

time duration

DocID024754 Rev 16

Signal descriptions

M24SR04-Y M24SR04-G

2.7.3

I C

answer ready configuration (GPO field = 0xX3)

When the GPO is configured as I C answer ready, it goes to the Low state when the

M24SR04 has finished to treat the I C command and is ready to send the I C response.

During an I

C session, after receiving a valid I

C command, GPO pin is driven low after a

delay when M24SR04 is ready to deliver a response on the I C bus.

GPO is released when M24SR04 receives a new command.

Figure 5. GPO configured as I C answer ready (GPO field = 0xX3)

/ϸꢂꢁĐŚĂŶŶĞů

KƉĞŶꢁ

^ĞƐƐŝŽŶ

ꢃŶǇꢁ/ϸꢂꢁ

ĐŽŵŵĂŶĚ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

ꢃŶǇꢁ/ϸꢂꢁ

ĐŽŵŵĂŶĚ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

ꢃŶǇꢁ/ϸꢂꢁ

ĐŽŵŵĂŶĚ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

‘WKꢁĂƐꢁ/ϸꢂꢁ

ĂŶƐǁĞƌꢁƌĞĂĚǇ

D^ϯϬϳϴϴsϰ

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Signal descriptions

2.7.4

MIP NDEF Message writing in Progress configuration

(GPO field = 0x3X)

When the GPO is configured as MI

ts state goes to the low state when the RF host writes

the NDEF length to another value than 0x0000.

During an RF session, when M24SR04 changes an NDEF file and updates the NDEF length

with a value different from 0x0000, GPO is driven low after a delay (1) following the

beginning of the correspondent UpdateBinary command execution.

GPO will remain low during the writing time (2), before being released.

Figure 6. GPO configured as MIP (GPO field = 0x3X)

Z&ꢁĐŚĂŶŶĞů

hƉĚĂƚĞꢁƚŚĞꢁEꢀꢄ&ꢁ

ůĞŶŐƚŚꢁ͊сꢁϬǆϬϬϬϬ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

ꢃŶǇꢁŽƚŚĞƌꢁ

ĐŽŵŵĂŶĚ

‘WKꢁĂƐꢁD/W

;ϭͿ

;ϮͿ

D^ϯϬϳϴϱsϯ

1. CmdEOFtoGPlow

(RF command End of frame to GPO low)

2. Writing

time duration

DocID024754 Rev 16

Signal descriptions

M24SR04-Y M24SR04-G

2.7.5

INT Interrupt configuration (GPO field = 0xX4 or 0x4X)

The I

C or RF host can send a negative pulse on the GPO pad. The GPO pad goes to the

low state at the end of the command and goes to the high state at the end of the M24SR04

response.

During an RF or I

C session, when M24SR04 receives a valid Interrupt command,

M24SR04 GPO pin is driven low after (1) or (3) for a duration of (4) in R

r after

responding in I2C (2). Then GPO pin is released.

Figure 7. GPO configured as INT (GPO field = 0xX4 or 0x4X)

Z&ꢁŽƌꢁ/ϸꢂꢁ

ĐŚĂŶŶĞů

;ϭͿꢁ

Žƌꢁ

;ϯͿ

;ϮͿꢁꢁ

DϮϰ^Zǆǆꢁ

ƌĞƐƉŽŶƐĞ

^ĞŶĚꢁ

/ŶƚĞƌƌƵƉƚ

ꢃŶǇꢁŽƚŚĞƌꢁ

ŽƉĞƌĂƚŝŽŶ

‘WKꢁĂƐꢁ/Ed

;ϰͿꢁꢁ

D^ϯϬϳϴϳsϯ

1. CmdSTPtoGPlow

(I2C command Stop to GPO low)

2. After

NewCmdlbFB (new I2C command last bit of first byte)

after AnswerlbFB (I2C answer last bit of first byte)

3. CmdEOFtoGPlow

(RF command End of frame to GPO low)

4. GPO

pulse duration

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Signal descriptions

2.7.6

State Control configuration (GPO field = 0xX5 or 0x5X)

When the GPO is configured as State Control, the I

C or RF host can control the state of the

GPO by sending a dedicated command.

During an RF or I

C session, the M24SR04 can control the GPO pin. After receiving a valid

Set GPO command, GPO pin is driven low after a delay (1) or (3). GPO will be released

after a valid Reset command or after a Power off or upon closing the RF session.

Figure 8. GPO configured as State Control (GPO field = 0xX5 or 0x5X)

5)ꢄRUꢄ,ð&ꢄ

FKDQQHO

ꢎꢂꢏꢄ

RUꢄ

ꢎꢀꢏ

ꢎꢁꢏꢄ

RUꢄ

ꢎꢆꢏ

5HVHWꢄ*32ꢄ

FRPPDQGꢄꢄ

$QꢄRWKHUꢄ

FRPPDQG

6HWꢄ*32ꢄ

FRPPDQG

*32ꢄDVꢄ

6WDWH&RQWURO

06ꢀꢊꢈꢃꢍ9ꢆ

1. CmdSTPtoGPlow

(I2C Set GPO command Stop to GPO low)

2. CmdSTPtoGPHZ

(I2C Reset GPO command Stop to GPO HZ)

3. CmdEOFtoGPlow

(RF Set GPO command End of frame to GPO low)

4. CmdEOFtoGPHZ

(RF Reset GPO command End of frame to GPO HZ)

DocID024754 Rev 16

Signal descriptions

M24SR04-Y M24SR04-G

2.7.7

RF busy configuration (GPO field = 0x6X)

When the GPO is configured as RF busy, the GPO goes to the low state when the

M24SR04 is processing an RF command or when an RFsession is ongoing.

When an RF field is present, GPO is driven low after a delay (1) when M24SR04 detects the

first command. If the RF session is ongoing and M24SR04 receives a not-supported

command, GPO remains low. It will be released only at the end of the RF session, after (2).

Figure 9. GPO configured as RF busy (GPO field = 0x6X)

Z&ꢁĐŚĂŶŶĞů

;ϭͿ

;ϮͿ

;ϭͿ

;ϮͿ

Z&ꢁ

ĐŽŵŵĂŶĚ

^ĞŶƐZĞƋꢁΘꢁ

^ĞŶƐZĞƐ

Z&ꢁĐŽŵŵĂŶĚꢁ

ŶŽƚꢁƐƵƉƉŽƌƚĞĚꢁꢁꢁꢁ

^;ꢀꢄ^Ϳ

‘WKꢁĂƐꢁZ&ꢁďƵƐǇ

D^ϯϬϳϵϬsϯ

1. CmdSOFtoGPlow

(RF command Start of frame to GPO low)

2. CmdEOFtoGPHZ

(RF command End of frame to GPO HZ)

Section 8: Functional procedures

DocID024754 Rev 16

M24SR04-Y M24SR04-G

M24SR04 memory management

3.1

Memory structure

The M24SR04 supports the NDEF

g Application as defined in the NFC Forum Type 4

g. The M24SR04 is composed of three files:

•

One Capability Container file

One NDEF file

One System file: this is an ST-proprietary file

The System file contains some information on the configuration of the M24SR04 device.

The CC file gives some information about the M24SR04 itself and the NDEF file. The NDEF

file contains the User data.

3.1.1

File identifier

The file identifier is the value used in the Select command to select a file.

Table 3. File identifier

File identifier

0xE101

Meaning

System file

CC file

0xE103

0x0001

NDEF file

3.1.2

CC file layout

The CC file gives some information about the M24SR04 and the NDEF file. This file is a

read-only file for the RF or I²C host and cannot be modified by issuing a write command.

The T field, Read Access and Write Access fields can be changed by the RF or I²C host by

issuing a specific process (refer to

DocID024754 Rev 16

Section 5.6.7: ReadBinary command

M24SR04 memory management

File offset

M24SR04-Y M24SR04-G

Table 4. CC file layout for 1 NDEF file

Meaning

Value

Comments

15 bytes

0x0000

0x0002

0x0003

0x0005

0x0007

0x0008

0x0009

Number of bytes of CC file

Mapping version

(1)

Maximum number of bytes that can be read

0x000F

0x20 or 0x10

0x00F6

V 2.0 or V 1.0

246 bytes

T field

Maximum number of bytes that can be written

0x00F6

0x04

(2)

0x06

L field

0x0001

FileID

NDEF file control TLV

0x0200

Maximum NDEF

file size

0x000B

0x000D

0x000E

0x00

(2)

0x00

(2)

Read access

Write access

1. According

to the reader.

2. Delivery

state.

3.1.3

NDEF file layout

The NDEF file contains the NDEF message which contains the User data. The RF host or

the I²C host can read and write data inside the file. The first two bytes named NDEF

Message Length define the size of the NDEF message. The NDEF Message Length shall

be managed by the application and the M24SR04 device does not check if its value is

relevant vs the data written by the RF or I²C host. The M24SR04 device uses the NDEF

Message Length, e. g. the standard read can be processed only inside the NDEF message;

otherwise, the M24SR04 device returns an error code. For more details about the read

command, refer to

22/89

DocID024754 Rev 16

M24SR04-Y M24SR04-G

M24SR04 memory management

Table 5. NDEF file layout

Byte 0

Byte 1

NDEF message length

File offset

Byte 2

Byte 3

0x0000

0x0004

…

User data

…

0x01FC

User data

3.1.4

System file layout

The system file specifies the configuration of the M24SR04.

Table 6

lists the different fields.

Table 6. Field list

Number

File offset

Field name

Read access

Write access

Delivery state

(1)

of bytes

Length system

file

0x0000

I²C or RF

–

0x0012

0x0002

0x0003

0x0004

0x0005

0x0006

I²C protect

I²C watchdog

GPO

I²C or RF

I²C

(2)

I²C

(2)

I²C

(2)

I²C

(2)

I²C

(2)

0x01

0x00

0x11

ST reserved

RF enable

0x00

0x xxxx xxx1

(3)

NDEF File

number (RFU)

0x0007

I²C or RF

none

0x00

0x0008

0x000F

0x0011

UID

I²C or RF

none

0x0286 xx xx xx xx xx

0x01FF

Memory Size

Product Code

0x86 or 0x8E

1. The

delivery state for all passwords = 0x00000000000000000000000000000000.

2. The

access is granted when the field I²C protect is set to the state Unprotected or when the right I²C

password was correctly received (see

Section 3.5: I2C password

3. Refer

ble 11

Table 7. Details about I2C watchdog

File offset

b7- b0

The “I

C Watchdog” ensures the I2C host will not keep the session open, while

there is no more activity on the I

C bus (between the stop bit of the previous

transaction and the start bit of the next one)

0x0003

– 0x00 (default value): the Watchdog is off

– Other values: If programmed to a non null value N, the Watchdog is enabled

and counts N*30 ms (30 ms is approximate) before releasing the I

C session.

DocID024754 Rev 16

M24SR04 memory management

File offset

M24SR04-Y M24SR04-G

b2-b0

Table 8. Details about the GPO field

b7 b6-b4 b3

0x0004

RFU

When an RF session is open:

0b000: High impedance

0b001: Session opened

0b010: WIP

0b011: MIP

0b100: Interrupt

0b101: State Control

0b110: RF Busy

0b111: RFU

RFU

When an I²C session is open:

0b000: High impedance

0b001: Session opened

0b010: WIP

0b011: I²C Answer Ready

0b100: Interrupt

0b101: State Control

0b110: RFU

0b111: RFU

Table 9. Details about the RF Session field

File offset

0x0004

b6-b4

b3-b0

RFU

When an RF session is open:

0b001: Session opened

RFU

Section 3.1.2: CC file layout

DocID024754 Rev 16

M24SR04-Y M24SR04-G

M24SR04 memory management

ble 10

gives some details about the ST reserved field.

Table 10. Details about the ST reserved field

File offset

b7-b0

0x0005

0x00

ble 11

gives some details about the RF enable field.

Table 11. Details about the RF enable field

b7 b6-b4

b3 b2-b1

File offset

0x0006

0: the RF field is off

(1)

1: the RF field is on

(1)

RFU

0: the RF disable pad is at low state

(1)

1: the RF disable pad is at high state

(1)

RFU

0: the M24SR04 does not decode the command received from the RF interface

1: the M24SR04 decodes the command received from the RF interface

1. this

field is written by the M24SR04.

3.2

Read and write access rights to the memory

An NDEF file can be locked for read or write accesses. It is also protected by a 128-bit

password that the host shall present before accessing the NDEF file. There are two 128-bit

passwords, one for the read access and the other one for the write access.

An NDEF file can be permanently locked for read or write accesses. Thus, the host cannot

access the NDEF file.

The read password shall be sent to the M24SR04 device before reading a read-locked

NDEF file.

The write password shall be present on the M24SR04 device before writing a write-locked

NDEF file. The write password shall be sent to change the read or write access. The read or

write access right is defined for the NDEF file.

3.2.1

State of the Read and Write access rights

Two bytes in the CC file are used to define the Read and Write access rights to the NDEF

file. For more details, refer to

DocID024754 Rev 16

Section 8.4: Locking an NDEF file

M24SR04 memory management

Value

M24SR04-Y M24SR04-G

Table 12. Read access right

Meaning

0x00

0x80

0xFE

Read access without any security

Locked

(1)

Read not authorized

1. The

read password shall be sent before reading in the NDEF file.

Table 13. Write access right

Value

Meaning

0x00

0x80

0xFF

Write access without any security

Locked

(1)

Write not authorized

1. The

write password shall be sent before writing in the NDEF file.

The state 0xFF and 0xFE cannot be changed by using the Read or Write passwords.

3.2.2

Changing the read access right to NDEF files

The state diagram on

Figure 10

shows how to change the access right to read an NDEF file.

Figure 10. Changing the read access right to an NDEF file

ꢊ[ꢊꢊ

/RFNꢄWKHꢄ1′()ꢄILOHꢄ

ꢎꢂꢏ

3HUPDQHQWOꢄORFNꢄWKHꢄ1′()ꢄILOHꢄ

ꢎꢀꢏ

8QORFNꢄWKHꢄ1′()ꢄILOHꢄ

ꢎꢁꢏ

3HUPDQHQWOꢄORFNꢄWKHꢄ1′()ꢄILOHꢄ

ꢎꢀꢏ

ꢊ[ꢃꢊꢄ

ꢎꢆꢏ

ꢊ[)(ꢄ

ꢎꢆꢏ

3HUPDQHQWOꢄXQORFNꢄWKHꢄ1′()ꢄILOH

06Yꢆꢃꢊꢀꢀ9ꢂ

1. See

the procedure to lock the read access (

2. See

the procedure to unlock the read access (

Section 8.5: Unlocking an NDEF file

3. See

the procedure to permanently lock the read access (

Section 8.6: Reaching the read-only state for an

NDEF file

4. Proprietary

state, not defined by NFC Forum Type 4 Tag. For NFC Forum compatible tags, the only

possible value of the read access rights are 0x00 (no restrictions on reads).

Section 8.6: Reaching the read-only state for an

DocID024754 Rev 16

M24SR04-Y M24SR04-G

M24SR04 memory management

3.2.3

Changing the write access right to NDEF files

The state diagram on

Figure 11

shows how to change the write access right to an NDEF file.

Figure 11. Changing the write access right to an NDEF file

ꢊ[ꢊꢊ

/RFNꢄWKHꢄ1′()ꢄILOHꢄ

ꢎꢂꢏ

3HUPDQHQWOꢄORFNꢄWKHꢄ1′()ꢄILOHꢄ

ꢎꢀꢏ

8QORFNꢄWKHꢄ1′()ꢄILOHꢄ

ꢎꢁꢏ

3HUPDQHQWOꢄORFNꢄWKHꢄ1′()ꢄILOHꢄ

ꢎꢀꢏ

ꢊ[ꢃꢊꢄ

ꢎꢆꢏ

ꢊ[))

3HUPDQHQWOꢄXQORFNꢄWKHꢄ1′()ꢄILOH

06Yꢆꢃꢊꢀꢆ9ꢂ

1. See

the procedure to lock the write access.

2. See

the procedure to unlock the write access.

3. See

the procedure to permanently lock the write access (

NDEF file

4. Proprietary

state, not defined by NFC Forum Type 4 Tag. For NFC Forum compatible tags, it is mandatory

that the write access rights are set to either 0x00 (no restrictions on writes) or 0xFF (permanently locked).

0x80 might not be fully decoded with some smart phones.

3.3

3.4

Access right life time

The access right life time is validated while the NDEF file is selected or until the end of the

RF or I²C session. Once the read or write access right is granted, the host can send one or

more ReadBinary or UpdateBinary commands.

At the end of a session or when the host selects another file, the read and write access

rights are initialized.

NDEF file passwords

The NDEF file passwords protect the read or write access from an RF or I²C interface

from/to an NDEF file.

Two NDEF file passwords are available for each NDEF file:

•

Read password

Write password

The length of a password is 128 bits (16 bytes).

DocID024754 Rev 16

Section 3.1.4: System file layout

M24SR04 memory management

M24SR04-Y M24SR04-G

3.5

C password

The I²C password can be sent only by the I²C host. It activates the SuperUser rights. The I²C

host with the SuperUser rights can:

•

Access the NDEF file regardless of the right access and without sending the NDEF file

passwords.

•

Change the access rights regardless of the current state.

The length of the I²C password is 128 bits (16 bytes).

3.5.1

I²C password and I²C protect field of the System file

The I²C protect field in the system file can be set to:

•

0x00: the I²C host has the SuperUser right access without sending the I²C password

0x01: the I²C host has the SuperUser right access after sending the I²C password

For more details about the system file layout, refer to

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Communication mechanism

This chapter describes the principle of communication between an RF or an I

C host and

the M24SR04 device.

4.1

Master and slave

The M24SR04 acts as a slave device on either the I

C-bus or the RF channel and therefore

waits for a command from the I

C master or the RF host before sending its response.

The RF host shall generate the RF field and the RF commands.

The I

C host shall supply the M24SR04 through the V

pin and shall generate the I C

clock on the SCL pad.

4.2

M24SR04 session mechanism

The M24SR04 is a dynamic NFC/RFID tag which can be accessed either from the RF or I

interface. The M24SR04 implements a token system. This token has two possible values,

RF or I

C. When the token exists and is assigned to one interface (RF or I

C), the M24SR04

cannot communicate with the other host.

4.2.1

4.2.2

RF token

The token is given to the RF interface once the anticollision is done. The release condition

can be either an RF field cut-off, or the reception of the command deselect, or when the I²C

host sends the KillRFsession.

I C

token

The token is given to the I

C interface when the I

C host has sent the correct device Select.

The release condition can be either a power down condition on V

pin or the reception of a

I C

token release sequence from the I

C host, after which M24SR04 goes in Standby power

mode.

DocID024754 Rev 16

Section 5.2: I-Block format

I²C and RF command sets

M24SR04-Y M24SR04-G

I²C and RF command sets

The command sets of the M24SR04 can be split in different command families. Most

commands are common between the RF and the I²C interface. Some commands are

specific to the RF interface and some others are specific to the I²C interface. This section

describes the M24SR04 command sets that can be issued by the RF or the I²C host.

There are three command families:

•

the NFC Forum Type 4

g command set

the ISO/IEC 7816-4 command set

the proprietary command set

The NFC Forum Type 4

g command set and the ISO/IEC 7816-4 command set use the I-

Block format. For more details about the I-Block format, refer to

Two other command formats exist:

•

the commands using the R-Block format

the commands using the S-Block format

For more details about these formats, refer to the corresponding sections:

Section 5.3: R-

Block format

and

Section 5.4: S-Block format

This section gives a brief description of the RF and I²C host common commands. The

format of these command sets is the I-Block format.

ble 14

lists the RF and I²C command sets.

Table 14. RF and I²C command sets

Family

command set

Class Instruction

Command name

Brief description

byte

code

NDEF

g Application

Select

NDEF

g Application Select

0x00

0xA4

CC select

0x00

0xA4

0xB0

Select the CC file

NDEF select

System select

ReadBinary

Select the NDEF file

Select the system file

Read data from file

NFC Forum

Type 4 Tag

Write or erase data to a

NDEF file

UpdateBinary

Verify

0x00

0xD6

0x20

Checks the right access of

a NDEF file or sends a

password

Change a Read or write

password

ChangeReferenceData

0x24

0x28

0x26

ISO/IEC 7816-4

Activate the password

security

EnableVerificationRequirement 0x00

DisableVerificationRequirement 0x00

Disable the password

security

30/89

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

Table 14. RF and I²C command sets (continued)

Class Instruction

Family

command set

Command name

Brief description

byte

code

Enables the Read Only or

Write Only security state

ST Proprietary

EnablePermanentState

ST Proprietary

ExtendedReadBinary

0xA2

0x28

0xB0

Read data from file

5.1

Structure of the command sets

The exchange of data between the RF or the I²C host and the M24SR04 uses three kinds of

data formats, called blocks:

•

I-Block: to exchange the command and the response

R-Block: to exchange positive or negative acknowledgment

S-Block: to use either the Deselect command or the Frame Waiting eXtension (WTX)

command or response

Note:

max WTX value = 0x0B

This section describes the structure of the I-Block, R-block and S-Block. This format is used

for the application command set.

5.2

I-Block format

The I-Block is used to exchange data between the RF or the I²C host and the M24SR04. It is

composed of three fields.

Table 15

details the I-Block format.

Table 15. I-Block format

SoD

Payload

EoD

CRC

Name

PCB

DID

Length

1 byte

1 to 251 bytes

2 bytes

PCB field

DID field (optional)

RF or I²C host to M24SR04: C-APDU

M24SR04 to RF or I²C host: R-APDU

2 CRC bytes

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

Table 16. PCB field of the I-Block format

b7-b6

0b00

I-Block

RFU

Must be set to 0

DID field, if bit is set

Must be set to 0

Must be set to 1

Block number

When the RF or I²C host sends a command to the M24SR04 the format of the payload is the

C-APDU.

When the M24SR04 sends a command to the RF or I²C host, the format of the payload is

the R-APDU.

5.2.1

C-APDU: payload format of a command

The C-APDU format is used by the RF or the I²C host to send a command to the M24SR04.

ble 17

describes its format.

Table 17. C-APDU format

Payload field

Name

CLA

INS

Data

Length

1 byte

Lc byte

1 byte

Class byte

0x00: standard command

0xA2: ST command

Instruction byte

Param Byte 1

Param Byte 2

Number of bytes of the Data field

Data bytes

Number of bytes to be read in the M24SR04 memory

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

5.2.2

R-APDU: payload format of a response

the M24SR04 uses the I-Block format to reply to a command which used the I-Block format.

This format is described in

Table 18

Table 18. R-APDU format

Payload field

Name

Data (optional)

Le byte

SW1

SW2

Length

1 byte

Data

Status byte 1

Status byte 2

5.3

R-Block format

The R-Block is used to convey positive or negative acknowledgment between the RF or I²C

host and the M24SR04.

Table 19. R-Block format

PCB

CRC

R(ACK) without the DID field: 0xA2 or 0xA3

R(ACK) with the DID field: 0xAA or 0xAB

R(NAK) without the DID field: 0xB2 0xB3

R(NAK) with the DID field: 0xBA 0xBB

2 CRC bytes

There are two kinds of R-Blocks:

•

R(ACK): the acknowledgment block sent by the RF or I²C host or by the M24SR04.

NAK

): the non-acknowledgment block sent by the RF or I²C host or by the

M24SR04.

DocID024754 Rev 16

ble 22: S-Block detailed format

I²C and RF command sets

M24SR04-Y M24SR04-G

Table 20. R-Block detailed format

b7-b6

0b10

R-Block

RFU

1: NAK

0: ACK

0: DID field is not present

1: DID field is present

Must be set to 0

Must be set to 1

Block number

5.4

S-Block format

The S-Block is used to exchange control information between a reader and a contactless

tag.

Table 21. S-Block format

SoD

EoD

CRC

NFC frame

Length

PCB

DID

Payload

1 byte

0 to 1 bytes

2 bytes

0xC2: for S(DES) when the DID field is not present

0xCA: for S(DES) when the DID field is present

0xF2: for S(WTX) when the DID field is not present

0xFA: for S(WTX) when the DID field is present

DID field (optional)

WTX field

(1)

2 CRC bytes

1. This

field is present when b5-b4 bits are set to 0b11 (S-Block is a WTX). see

There are two requests using the S-Block format:

•

S(DES): the deselect command

S(DES) is only applicable to RF

S(WTX): the Waiting Frame eXtension command or response.

A Waiting Time eXtension request occurs, in RF or I C, when the operating time

needed by M24SRxx is greater than 9.6 ms.

The WTX field indicates the increase time factor to be used in this command execution

(FDTtemp = WTX * 9.6 ms). The max WTX value is equal 0x0B.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

Table 22. S-Block detailed format

b7-b6

0b11

b5-b4

S-Block

0b00: Deselect

0b11: WTX

0: DID field is not present

1: DID field is present

–

RFU

Note:

After receiving the deselect command, the session is released and M24SR04 enters the

Standby power mode. In I

C, the session is released after executing the I2C token release

sequence.

In response to a RATS command, M24SR04 returns FWI parameter (default frame waiting

time used); when M24SR04 needs more time for a command execution, it requests a frame

waiting time extension by responding 0xF2 0xWTX (Request waiting time = FWI * WTX). If

the reader accepts M24SR04 request, it acknowledges by sending the command 0xF2

0xWTX. The frame waiting time becomes FWI * WTX for the current command only.

5.5

CRC of the I

C and RF frame

The two CRC bytes check the data transmission between the RF host or I²C host and the

M24SR04. For the RF frame, the CRC is computed on all the data bits in the frame,

excluding parity bits, SOF and EO

nd the CRC itself.

For the I²C frames, the CRC is computed on all data bits of the frame excluding Device

select and the CRC itself.

The CRC is as defined in ISO/IEC 13239. The initial register content shall be 0x6363 and

the register content shall not be inverted after calculation.

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

5.6

NFC Forum Type 4 Tag protocol

5.6.1

Commands set

With the NFC Forum Type 4

g protocol, the commands are common to RF and I²C.

Table 23. Command set overview

Command name

NDEF

g Application Select

Brief description

Select the NDEF

g Application

Select the capability container (CC) file using the

Select command

Capability Container Select

NDEF Select

System File Select

ReadBinary

Select the NDEF file

Select the system file

Read data from a file

Write new data to a file

UpdateBinary

5.6.2

Status and error codes

This section lists the status and the error code of the M24SR04.

Table 24. Status code of the M24SR04

SW1

SW2

Comment

Command completed

successfully

Value

0x90

0x00

Table 25. Error code of the M24SR04

SW1

SW2

Comment

Length

1 byte

Value

0x62

0x80

File overflow (Le error)

End of file or record reached

before reading Le bytes

Value

0x62

0x63

0x82

0x00

Password is required

Password is incorrect, X further

retries allowed (X can take

value 0,1, 2)

Value

0x63

0xCX

Value

0x65

0x67

0x81

0x00

Unsuccessful updating

Wrong length

Cmd is incompatible with the

file structure

Value

0x69

0x81

Value

0x69

0x82

0x84

Security status not satisfied

Reference data not usable

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

Table 25. Error code of the M24SR04 (continued)

SW1

SW2

Comment

Length

1 byte

Value

0x6A

0x6D

0x6E

0x80

0x82

0x84

0x86

0x00

Incorrect parameters Le or Lc

File or application not found

File overflow (Lc error)

Incorrect P1 or P2 values

INS field not supported

Class not supported

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

5.6.3

NDEF Tag Application Select command

the RF or the I²C host shall send this command to activate the NDEF

g Application.

ctivate the NDEF

g Application, the RF host sends the Select command (see

ble 26

) in addition to the sequence defined in the NFC Forum digital protocol.

ctivate the NDEF

g Application, the I²C host sends the Select command (see

ble 26

) in addition to the GetSession or the Kill RF session command.

ble 26

defines the C-APDU of the Select command to select the NDEF

g Application

(called NDEF

g Application Select).

Table 26. C-APDU of the NDEF Tag Application Select command

Name

Value

Class byte

CLA

INS

Data

0xD27600

00850101

0x00

0xA4

0x04

0x00

0x07

0x00

Select instruction code

P1 field

P2 field

Number of bytes of data

Application ID

Le field

ble 27

defines the R-APDU of the NDEF

g Application Select command.

Table 27. R-APDU of the NDEF Tag Application Select command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x6A

0x6D

1 byte

0x00

0x82

0x00

–

Command completed

NDEF

g Application not found

Class not supported

5.6.4

Capability Container Select command

The RF or I²C host uses the Capability Container Select procedure to select the capability

container (CC) file.

The CC file is selected when this command returns “command completed” in the R-APDU.

ble 28

defines the C-APDU of the Select command to select the CC file (called Capability

Container Select).

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Name

I²C and RF command sets

Table 28. C-APDU of the Capability Container Select command

CLA

INS

Data

Value

0x00

0xA4

0x00

0x0C

0x02

0xE103

–

Class byte

Select instruction code

P1 field

P2 field

Number of bytes of data

CC file ID

–

ble 29

defines the R-APDU of the CC Select command.

Table 29. R-APDU of the Capability Container Select command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x6A

0x6D

1 byte

0x00

0x82

0x00

–

Command completed

File or application not found

Class not supported

5.6.5

NDEF Select command

The RF or I²C host uses the NDEF Select command to select the NDEF file.

The NDEF file is selected when this command returns “command completed” in the R-

APDU.

ble 30

defines the C-APDU of the Select command to select the NDEF file (called

NDEF Select).

In case of a password is required to access the NDEF file, the NDEF Select command will

disable any previously granted access rights to this file. The Verify command might be

required to access the file.

Table 30. C-APDU of the NDEF Select command

Name

Value

Class byte

CLA

INS

Data

0x00

0xA4

0x00

0x0C

0x02

0x000X

–

Select instruction code

P1 field

P2 field

Number of bytes of data

0x0001: first NDEF file

–

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

ble 31

defines the R-APDU of the NDEF Select command.

Table 31. R-APDU of the NDEF Select command

Data

SW1

1 byte

SW2

1 byte

Comment

Length

Value

–

0x90

0x6A

0x00

0x82

Command completed

File or application not found

5.6.6

System File Select command

The RF or I²C host uses this command to select the system file.

The System file is selected when this command returns “command completed” in the R-

APDU.

ble 32

defines the C-APDU of the command to select the System file (called System

Select).

Table 32. C-APDU of the System File Select command

Name

CLA

INS

Data

0x00

0xA4

0x00

0x0C

0x02

0xE101

–

Class byte

Select instruction code

P1 field

P2 field

Number of bytes of data

System file ID

–

ble 33

defines the R-APDU of the System File Select command.

Table 33. R-APDU of the System File Select command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

1 byte

0x00

–

Command completed

Capability container not found, no data

is returned

Value

–

0x6A

0x82

Section 3.1.2: CC file layout

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

5.6.7

ReadBinary command

On receiving the ReadBinary command, the M24SR04 reads the requested memory field

and sends back its value in the R-APDU response.

Before sending a ReadBinary command, a file shall be selected by using a Select

command.

The Response of the ReadBinary command is successful when the data to be read is within

(1)

the selected file

; in other words, when the sum of P1-P2 and Le fields is equal to or lower

than the selected file length.

ble 34

defines the ReadBinary command.

Table 34. C-APDU of the ReadBinary command

Name

CLA

INS

P1 & P2

Data

0x00

0xB0

2 bytes

–

1 byte

Class byte

Read instruction code

Offset in the file selected

–

Number of bytes to read between

0x01

≤

max(Selected File length, 0xF6)

ble 35

defines the R-APDU of the ReadBinary command.

Table 35. R-APDU of the ReadBinary command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x67

0x69

0x6A

0x6E

1 byte

–

Content read

Don’t care

(1)

Command completed

–

0x00

0x82

0x00

Wrong length

Security status not satisfied

File or application not found

Class not supported

1. For

more information, please contact your local ST support.

1. For

more details about CC file, refer to

For more details about NDEF file, refer to

Section 3.1.3: NDEF file layout

For more details about System file, refer to

Section 3.1.4: System file layout

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

5.6.8

UpdateBinary command

On receiving the UpdateBinary command, the M24SR04 writes the data field into the

selected file and sends back a status in the R-APDU response. If needed, M24SRxx will

request a timing extension (see

Section 5.4

Before sending an UpdateBinary command, a file shall be selected by issuing a Select

command.

ble 36

defines the UpdateBinary command.

Table 36. C-APDU of the UpdateBinary command

Name

CLA

INS

P1 & P2

Data

0x00

0xD6

2 bytes

1 byte

Lc bytes

–

Class byte

Write instruction code

Offset in the file selected

Number of bytes of data (0x01

≤

0xF6)

Data to write in the M24SR04 memory

–

ble 37

defines the R-APDU of the UpdateBinary command.

Table 37. R-APDU of the UpdateBinary command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x65

0x67

0x69

0x6A

0x6E

1 byte

0x00

0x81

0x00

0x82

0x00

–

Command completed

Unsuccessful updating

Wrong length

Security status not satisfied

File or application not found

Class not supported

Note:

Chaining is not supported on “UpdateBinay” command.

For further return codes and definitions, refer to

Status and error codes

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

5.7

ISO/IEC 7816-4 commands

The ISO/IEC 7816-4 command set offers some extended features such as the protection of

the NDEF file. This command set is used to manage the right access of the NDEF file.

5.7.1

Verify command

The Verify command has two functions:

1. Check

if a password is required to access to the NDEF file (the LC field = 0x00).

2. Check

that the password embedded in the Verify command allows the access to the

memory (the Lc field = 0x10 and the password is present).

When the Lc field if equal to 0x00, the verify command returns a success code (0x90 00)

provided that the access to the NDEF file does not require a password. When the access to

the NDEF file is protected, the response to the Verify command returns an error code

(0x63 00).

When the Lc field equals 0x10, on receiving the Verify command, the M24SR04 compares

the requested password with the data contained in the request and reports whether the

operation has been successful in the response.

Before sending this command, an NDEF file shall be selected by issuing the NDEF Select

command. Thus, this command checks the right access condition of the last NDEF file

selected.

After a successful command, an access is granted for the whole NDEF file.

ble 38

defines the Verify command.

Table 38. Verify command format

Name

CLA

INS

P1 & P2

Data

0x00

0x20

2 bytes

1 byte

Lc bytes

–

Class byte

Instruction code

Password identification

0x0001: Read NDEF password transmit

0x0002: Write NDEF password transmit

0x0003: I²C password transmit

(1)

Other: RFU

0x00: the password is not present

0x10: the password is present in the data field

Password

–

1. This

code can only be issued by the I²C host.

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

ble 39

defines the R-APDU of the Verify command.

Table 39. R-APDU of the Verify command

SW1 SW2

Comment

1 byte

Data

Length

Value

–

0x90

0x69

0x00

0x85

Command completed, the password is correct

The conditions of use are not satisfied (e.g. no

NDEF file was selected)

Value

–

Value

–

0x69

0x6A

0x63

0x81

0x82

0x80

0x00

Cmd incompatible with file structure

Security status not satisfied

Incorrect parameter in cmd data field

A password is required

The password transmitted is incorrect and X

encodes the number of further allowed retries.

Value

–

0x63

0x6E

0xCX

(1)

0x00

Class not supported

1. At

each session, the RF or I

C host can check a password 3 times.

5.7.2

Change Reference Data command

The Change Reference Data command replaces the read or write password related to the

NDEF files previously selected. It can be performed only if the security status satisfies the

security attributes for this command.

Before sending this command, the verify command with the correct NDEF write password

shall be issued. Thus, this command changes the reference data of the NDEF file.

ble 40

defines the Change Reference Data command.

Table 40. Change reference data command format

Name

CLA

INS

P1 & P2

Data

0x00

0x24

2 bytes

1 byte

Lc bytes

–

Class byte

Instruction code

Password identification

0x0001: Read password transmit

0x0002: Write password transmit

0x0003: I²C password transmit

(1)

Other: RFU

0x10: the password is present in the data field

NDEF file or I²C Password

–

1. This

code can only be issued by the I²C host.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

ble 41

defines the R-APDU of the Change Reference Data command.

Table 41. R-APDU of the Change Reference Data command

Data

SW1

SW2

Comment

Length

Value

1 byte

–

Command completed, the access right has

been changed

–

0x90

0x69

0x00

0x81

Cmd is incompatible with the

file structure

Value

–

0x65

0x69

0x6A

0x6E

0x81

0x82

0x80

0x82

0x86

0x00

Unsuccessful updating

Security status not satisfied

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

Class not supported

5.7.3

Enable Verification Requirement command

The Enable Verification Requirement command activates the protection by password of the

NDEF file. When this command is successful, the read or write access to the NDEF file is

protected by a 128-bit password. It can be performed only if the security status satisfies the

security attributes for this command.

This command can update the right access of the NDEF file by writing into the EEPROM. In

this case, the response timing will be around 5 ms.

Before sending this command, the verify command with the correct NDEF write password

shall be issued. Thus, this command changes the access right of the NDEF file.

ble 42

defines the Enable Verification requirement command.

Table 42. Enable Verification Requirement command format

Name

CLA

INS

P1 & P2

Data

0x00

0x28

2 bytes

–

Class byte

Instruction code

New security attributes

0x0001: Enable the read protection of the NDEF file

0x0002: Enable the write protection of the NDEF file

Other: RFU

–

The last five bits identify the password sent in the Verify command.

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

ble 43

defines the R-APDU of the Enable Verification Requirement command.

Table 43. R-APDU of the Enable Verification Requirement command

Data

SW1

SW2

Comment

Length

Value

1 byte

–

Command completed, the password is

correct

–

0x90

0x00

Value

–

0x69

0x6A

0x81

0x82

0x80

0x82

0x86

Cmd is incompatible with the file structure

Security status not satisfied

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

5.7.4

Disable Verification Requirement command

The Disable Requirement command deactivates the protection by password of the NDEF

file. When this command is successful, the read or write access to the NDEF file is granted

without security requirements. It can be performed only if the security status satisfies the

security attributes for this command.

Before sending this command, the verify command with the correct NDEF write password

shall be issued. Thus, this command changes the access right of the NDEF file.

This command can update the right access of the NDEF file by writing into the EEPROM. In

this case, the response timing will be around 6 ms.

ble 44

defines the Disable Verification Requirement command.

Table 44. Disable Verification Requirement command format

Name

CLA

INS

P1 & P2

Data

0x00

0x26

2 bytes

–

Class byte

Instruction code

New security attributes

0x0001: Disable the read protection of the NDEF file

0x0002: Disable the write protection of the NDEF file

Other: RFU

–

ble 45

defines the R-APDU of the Disable Verification Requirement command.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

Table 45. R-APDU of the Disable Verification Requirement command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x69

0x6A

0x6E

0x65

1 byte

0x00

0x81

0x82

0x80

0x82

0x86

0x00

0x81

–

Command completed, the password is correct

Cmd is incompatible with the file structure

Security status not satisfied

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

Class not supported

Update failed

5.8

ST Proprietary command set

The RF or I²C host can be issued with the command set described in this chapter.

5.8.1

ExtendedReadBinary command

On receiving the ExtendedReadBinary command, the M24SR04 reads the requested

memory field and sends back its value in the R-APDU response.

Before sending an ExtendedReadBinary command, a file shall be selected by issuing an

NDEF select command.

The response of the ExtendedReadBinary command will be successful even if the data to

be read is beyond the NDEF message. The command returns an error code if the data to be

read goes beyond the end of the file.

Table 46. C-APDU of the ExtendedReadBinary command

Name

Length

ST Class byte

CLA

INS

P1 & P2

Data

0xA2

0xB0

2 bytes

–

1 byte

Read instruction code

Offset in the file selected

–

Number of bytes to read between 0x01

≤

0xF6

ble 47

defines the R-APDU of the read binary command.

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

Table 47. R-APDU of the ExtendedReadBinary command

Data

SW1

SW2

comment

Length

Value

Le bytes

1 byte

0x90

0x67

0x69

0x6A

0x6E

1 byte

–

Content read

Don’t care

(1)

0x00

Command completed

Wrong length

–

0x82

Security status not satisfied

File or application not found

Incorrect P1 or P2 values

Class not supported

0x82

0x86

0x00

1. For

more information, please contact your local ST support.

5.8.2

EnablePermanentState command

The command configures the NDEF file to the ReadOnly or to the WriteOnly State.

This command can update the right access to the NDEF file by writing into the EEPROM. In

this case, the response timing will be around 6 ms.

ble 48

defines the EnablePermanentState requirement command.

Table 48. EnablePermanentState command format

Name

Length

CLA

INS

P1 & P2

Data

0xA2

0x28

2 bytes

–

Class byte

Instruction code

New security attributes

0x0001: Enable the read protection of the NDEF file

0x0002: Enable the write protection of the NDEF file

Other: RFU

–

ble 49

defines the R-APDU of the EnablePermanentState command.

Table 49. R-APDU table of the EnablePermanentState command

Data

SW1

SW2

comment

Length

Value

–

1 byte

0x90

0x65

0x67

1 byte

0x00

0x81

0x00

–

Command completed

Update failed

Wrong length

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

Table 49. R-APDU table of the EnablePermanentState command (continued)

Data

SW1

SW2

comment

Value

–

0x69

0x6A

0x6E

0x82

0x80

0x82

0x86

0x00

Security status not satisfied

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

Class not supported

5.8.3

DisablePermanentState command

The command configures the NDEF file to the Lock state.

This command can update the right access of the NDEF file by writing into the EEPROM. In

this case, the response timing will be around 6 ms. This command is only valid in I

C. The

SuperUser rights must have been granted to execute the command.

Before sending this command, an NDEF file shall be selected by issuing the NDEF Select

command.

ble 50

defines the DisablePermanentState requirement command.

Table 50. DisablePermanentState command format

Name

Length

CLA

INS

P1 & P2

Data

0xA2

0x26

2 bytes

–

Class byte

Instruction code

New security attributes

0x0001: Disable the read protection of the NDEF file

0x0002: Disable the write protection of the NDEF file

Other: RFU

–

ble 51

defines the R-APDU of the DisablePermanentState command.

Table 51. R-APDU of the DisablePermanentState command

Data

SW1

SW2

comment

Length

Value

–

1 byte

0x90

0x65

0x67

0x69

1 byte

0x00

0x81

0x00

0x82

–

Command completed

Update failed

Wrong length

Security status not satisfied

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

Table 51. R-APDU of the DisablePermanentState command (continued)

Data

SW1

SW2

comment

Value

–

0x6A

0x6E

0x80

0x82

0x86

0x00

CC file or System file selected

File or application not found

Incorrect P1 or P2 values

Class not supported

5.8.4

UpdateFileType command

This command allows to modify the file type of a selected file to Proprietary file (0x05) or

NDEF file (0x04).

NFC Forum compatible tags must configure the file as NDEF file (0x04).

This command is granted only, when application and file are selected and if the file length

and access right have previously been set to 0X00h (message invalid, all access rights

granted).

This command will update the file type located in the CC file by writing into the EEPROM. In

this case, the response timing will be around 6 ms.

ble 52

defines the UpdateFileType command.

Table 52. UpdateFileType command format

Name

Value

Class byte

CLA

INS

Data

0x04 or

0x05

0xA2

0xD6

0x00

0x01

–

Select instruction code

P1 field

P2 field

Number of bytes of data

File type

–

ble 53

describes the R-APDU of the UpdateFileType command.

Table 53. R-APDU of the UpdateFileType command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x69

0x6A

1 byte

0x00

0x82

0x80

–

Command completed

Security status not satisfied

CC file or System file selected

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

Table 53. R-APDU of the UpdateFileType command (continued)

Data

SW1

SW2

Comment

File or application not found

Incorrect P1 or P2 values

Value

–

0x6A

0x82

0x86

5.8.5

SendInterrupt command

On receiving the SendInterrupt command, the M24SR04 generates a negative pulse on the

GPO pin. It starts at the end of the command and ends at the end of the RF response.

Before sending this command, the system file shall be selected by issuing the System

Select command.

ble 54

defines the SendInterrupt command.

Table 54. SendInterrupt command format

CLA

INS

P1&P2

Data

Length

Value

1 byte

0xA2

1 byte

0xD6

2 bytes

0x001E

1 byte

0x00

–

ble 55

describes the R-APDU of the SendInterrupt command.

Table 55. R-APDU of the SendInterrupt command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x6A

0x6E

1 byte

0x00

0x80

0x82

0x86

0x00

–

The interrupt has been sent

The GPO is not configured as an interrupt mode

File or application not found

Incorrect P1 or P2 values

Class not supported

5.8.6

StateControl command

On receiving the StateControl command with reset value: data 0x00, the M24SR04 drives

the GPO pin low. On receiving the StateControl command with set value: data 0x01, the

M24SR04 releases the GPO pin which returns to HZ.

Before sending this command, the system file shall be selected by issuing the System

Select command.

ble 56

defines the State Control command.

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

Table 56. StateControl command format

CLA

INS

P1&P2

Data

Length

1 byte

0xA2

1 byte

0xD6

2 bytes

0x001F

1 byte

0x01

–

Reset value

Set value

0x00

0x01

Table 57. R-APDU of the StateControl command

Data

SW1

SW2

Comment

Length

Value

–

1 byte

0x90

0x6A

0x6E

1 byte

0x00

0x80

0x82

0x86

0x00

–

The set or reset has been sent

The GPO is not configured in StateControl mode

File or application not found

Incorrect P1 or P2 values

Class not supported

5.9

Specific RF command set

This section describes the command set that can be issued only by the RF host.

5.9.1

Anticollision command set

ble 58

lists the commands that can be issued only by the RF host. The format of these

commands is described in the NFC Forum Digital Protocol specification.

Table 58. Commands issues by the RF host

Family command set

Command name

Instruction code

0x52

(1)

ALL_REQ

SENS_REQ

SDD_REQ

SEL_REQ

SLP_REQ

0x26

(1)

NFC-A technology

1. Code

on 7 bits.

0x93 or 0x95 or 0x97

0x50

5.9.2

RATS command and ATS response

RATS command and ATS response are used for NFC Forum Type 4A

g Platform Device

Activation (as defined in NFC Forum Digital Protocol specification).

ble 59

details the RATS command. This command shall be sent after the anticollision

process.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

Table 59. RATS command

Param

Name

Byte field

Bit field

INS

CRC

0xE0

1 byte

b7-b4

2 bytes

b3-b0

Instruction code

FSDI

DID (0

≤

DID

≤

14)

2 CRC bytes

The FSDI field codes the FSD that defines the maximum size that an RF or I²C host is able

to receive.

ble 60

gives the conversion from FDSI to FSD.

Table 60. Conversion from FDSI to FSD

0x9h-

FSDI

0x0

0x1

0x2

0x3

0x4

0x5

0x6

0x7

0x8

0xF

0xE

FSD

128

256

RFU

256

The DID field defines the value of the addressed M24SR04.

Table 61. ATS response

Name

Byte field

Bit field

TA(1)

TB(1)

TC(1)

0x02

CRC

0x05

0x78

1 byte

2 bytes

b8-b5

b4-b1

Length of the ATS

response

FSCI = 256 bytes

The maximum ascending data rate is 106 kbps

The maximum descending data rate is 106 kbps

FWI field (9.6 ms when TB = 0x50)

SFGI field (302 µs when TB = 0x50)

The DID is supported

2 CRC bytes

The FSCI codes the FSC which stands for the maximum frame size that the M24SR04 is

able to receive. The M24SR04 is able to receive up to 256 bytes of command. If the RF or

I²C host sends a command with more than 256 bytes, the M24SR04 will not be able to treat

the command and will not reply.

The FWI which stands for the Frame Waiting time Integer codes the FW

his time

corresponds to the maximum duration while an RF or I²C host shall send before sending the

next command.

DocID024754 Rev 16

I²C and RF command sets

M24SR04-Y M24SR04-G

The SFGI which stands for the Start-up Frame Guard Time is the minimum time that the

reader shall wait after receiving the response of the M24SR04.

5.9.3

PPS command & response

PPS (Protocol and Parameter Selection) command and response are defined in ISO/IEC

14443-4, in the Protocol Activation of PICC Type A.

The PPS command allows to change the data rates of the ascending (RF host to M24SR04)

and descending (M24SR04 to RF host) data rates.

Table 62. PPS command

Name

Byte field

Bit field

INS

PPS0

0x11

PPS1

1 byte

b3-b2

CRC

–

0xDX

2 bytes

b7-b4

b3-b0

0b0000

b1-b0

Instruction code

DID

INS

PPS1 is present

RFU

PPS1 Descending

data rate

Ascending data rate

2 CRC bytes

The ascending and descending data rates shall be coded as described in

ble 63

Table 63. Ascending and descending data rate coding

Value

Data rate

0b00

0b01

0b10

0b11

106 kbps

RFU

When the M24SR04 is able to change both data rates, it returns the following response. The

data rate of this response is 106 kbps; then, the M24SR04 changes the ascending and

descending data rates.

ble 64

gives the details of the PPS response.

Table 64. PPS response

Name

Byte field

Bit field

INS

–

PPS0

0x11

0xDX

b8-b5

b4-b1

Response code

DID field

2 CRC bytes

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I²C and RF command sets

5.10

Specific I

C command set

ble 65

lists the commands that can only be issued by the I²C host.

Table 65. Specific I

C commands

Instruction

Command name

Format

Class byte

Brief description

code

Open an I

C session when the

RF session is not ongoing

GetI2Csession

KillRFsession

–

0x26

Kill the RF session and open an

C session

0x52

5.10.1

GetI2Csession command

The GetI2Csession command opens an I²C session if an RF session is not ongoing.

ble 66

defines the GetI2Csession command.

Table 66. GetI2Csession command format

INS

Length

Value

1 byte

0x26

The GetI2Csession command does not create a reply.

When an RF session is ongoing, the M24SRxx will not acknowledge the command.

When no RF session is ongoing, the M24SRxx will acknowledge the command and open an

I²C session.

5.10.2

KillRFsession command

The KillRF session command closes the RF session and opens an I²C session.

ble 67

defines the KillRFsession command.

Table 67. KillRFsession command format

INS

Length

Value

1 byte

0x52

The KillRFsession command does not create a reply. The RF session is closed when the

device acknowledges the command.

Caution:

A successful completion of the RF command is not certain.

DocID024754 Rev 16

RF device operation

M24SR04-Y M24SR04-G

RF device operation

6.1

Anticollision and Device Activation command set for the RF

interface

The M24SR04 device supports the command set defined in the NFC-A

chnology and the

Type 4A

g Platform chapters of the NFC Digital Protocol V1.0 specification.

6.2

Open an RFsession

Once the RF host has terminated the anticollision procedure and retrieve the ATS response,

it shall send the SelectApplication command. The M24SR04 will open an RF session. At this

point, the RF host can send the applicative command set and the I²C cannot communicate

with the M24SR04 without closing first the RF session using the I C KillRFsession

command.

6.3

6.4

Close an RFsession

The RF host can close the RF session by issuing one of these methods:

•

send an S(DES) command

turn off the RF field

Applicative command set

The applicative command set is composed of the following command sets:

•

the NFC Forum Type 4

g command set

the ISO/IEC 7816-4 command set

the proprietary command set

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I2C device operation

I C

device operation

The M24SR04 device supports the I

C protocol. The device that controls the data transfer is

known as the bus master, and the other one as the slave device. A data transfer can only be

initiated by the bus master, which also provides the serial clock for synchronization. The

M24SR04 device is a slave in all communications.

7.1

C communication protocol

The I C communication is built on a system of command and reply exchange. The I

C host

starts the communication by sending a request. Once a valid request is received by the

M24SR04 device, it carries out an internal operation and creates its answer.

As defined in this document, and except for the GetI2C session and Kill RF session

commands, the definition of a valid request is a command with a right CRC value.

Figure 12

shows an exchange of a command and a response between the I²C host and the

M24SR04. Once the I²C session is open, the I²C host can send a command. The command

is composed of:

•

a Device Select field with the R/W bit set to 0.

the command field.

The M24SR04 acknowledges on the reception of each byte.

Once the M24SR04 is ready to send the answer, the I²C host shall:

•

send a Device Select field with the R/W bit set to 1.

release the SDA line and send an SCL clock.

The I²C host shall acknowledge on the reception of each byte.

Figure 12. Command and response exchange

,ꢁ&ꢄEXV

5ꢅ:ꢄ ꢄꢊ

5ꢅ:ꢄ ꢄꢂ

‘HYLFH6HOHFW

&RPPDQG

‘HYLFH6HOHFW

5HVSRQVH

06ꢀꢊꢈꢍꢁ9ꢂ

Legend:

S is the I C Start bit sequence

P is the I C Stop bit sequence

R/W is the 8

bit of Device Select.

Note:

A restart during a command and response exchange is not supported by the M24SR04.

After a command, the I

C host can execute a Polling sequence to determine when the

response is available.

Polling sequence: Loop on

< START (S) + DeviceSelect with RW=0 + read NACK/ACK

+ STOP (P) >

The response is available as soon as the M24SR04 sends an ACK ( host read will a

‘0’).

DocID024754 Rev 16

I2C device operation

M24SR04-Y M24SR04-G

7.2

Start condition

A Start condition is identified by a falling edge of serial data (SDA) while the serial clock

(SCL) is stable in the high state. A Start condition must precede any data transfer command.

The device continuously monitors (except during an instruction processing) the SDA and the

SCL for a Start condition, and does not respond unless one is given.

7.3

7.4

Stop condition

A Stop condition is identified by a rising edge of serial data (SDA) while the serial clock

(SCL) is stable and driven high. A Stop condition terminates a command between the device

and the bus master.

I²C token release sequence

As explained in the M24SR04-Y M24SR04-G session mechanism, the I²C communication is

reserved to the I²C host when the session token has the I²C value.

The following sequence explains how to release the I²C value of the session token.

I²C communication with the M24SR04 starts with a valid Start condition, followed by a

device select code.

If the delay between the Start condition and the following rising edge of the Serial Clock

(SCL) that samples the most significant of the Device Select exceeds the t

START_OUT_MAX

time (see

Table 78

), the I²C logic block is reset and further incoming data transfer is ignored

until the next valid Start condition.

Figure 13. I²C token release sequence

ꢄ

!ꢄW

67$57B287BPD[ꢄ

6&/

6’$

0ꢁꢆ65ꢄ’HYLFHꢄ

6HOHFWꢄFRGH

6WDUWꢄ

FRQGLWLRQ

6WRSꢄ

FRQGLWLRQ

06Yꢆꢀꢊꢍꢈ9ꢂ

Note:

If the above delay is below t

unmodified.

(see

ble 78

), I

C session token stays

START_OUT_min

If the delay is between t

and t

, I C session token might or not

START_OUT_min

START_OUT_max

be released. This range of delay is not authorized for safe operation.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I2C device operation

7.5

I²C timeout on clock period

During a data transfer on the I

C bus, if the serial clock high pulse or serial clock low pulse

exceeds t

value that is the maximum value specified in

ble 78

, the I

C logic

CL_RESET

block is reset and any further incoming data transfer is ignore

d until the ne

xt valid Start

condition.

If the serial clock high pulse is under the maximum value of

CHCL

and the serial clock low

pulse is under the maximum value of t

ble 78

, the I

C logic block is not reset.

CLCH

For proper operation, the serial clock high pulse should not be higher than

CHCL

and lesser

than t

, and the serial clock low pulse should not be higher than

CHCH

and lesser

CL_RESET

7.6

Acknowledge bit (ACK)

The acknowledge bit is used to indicate a successful byte transfer. The bus transmitter,

whether a bus master or a slave device, releases the serial data (SDA) after sending eight

bits of data. During the 9th clock pulse period, the receiver pulls the SDA low to

acknowledge the receipt of the eight data bits.

7.7

7.8

Data input

During data input, the device samples serial data (SDA) on the rising edge of the serial clock

(SCL). For a correct device operation, the SDA must be stable during the rising edge of the

SCL, and the SDA signal must change only when the SCL is driven low.

I²C device address

The device address is the concatenation of the group number coded on 4 bits and the I C

address coded on 3 bits, as shown in

ble 68

Table 68. I

C device address format

b7-b4

0b1010

0bx

Group number

E2 bit

E1 bit

E0 bit

0 = Request

1 = Answer

DocID024754 Rev 16

I2C device operation

M24SR04-Y M24SR04-G

7.9

I²C frame format

The I

C frame is composed of three fields:

1. SOD

field: contains the device select and the PCB. The PCB field is detailed in

Section 5.2

2. Payload

field: contains the command and its parameter, as defined in the I

C command

set.

3. EOD

field: contains the two CRC bytes computed on the SOD but excluding the device

select byte field.

ble 69

shows the format of an I

C frame.

Table 69. I C frame format

C frame

SOD

Payload

EOD

0xAC or 0xAD

1 byte

1 to 251 bytes

2 bytes

Device select

0xAC: to send a request to the M24SR04

0xAD: to read a response of the M24SR04

PCB field

C command or I

C answer

2 CRC bytes

7.9.1

Example of I²C frame commands

NDEF Tag Application command

This example presents the I

C frame of an NDEF

g Application Select command. The I

frame is detailed in

ble 70

Table 70. I C host to M24SR04

Field

SOD

Payload

EOD

Value

0xAC

0x02 or 0x03

Command field

35 C0 or DF BE

Device select

PCB field

0x00 A4 04 00 07 D2 76 00 00 85 01 01 00

2 CRC bytes

Before sending a new command, the I

C host can send an I

C frame to read the M24SR04

answer to the NDEF tag Application Select command.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Field

I2C device operation

EOD

Table 71. M24SR04 to I

C host

SOD

Payload

C host to

M24SR04

M24SR04 to I

C host

0x90 00

Value

0xAD

0x02 or 0x03

F1 09 or 2D 53

Device select

PCB field

C command

2 CRC bytes

Figure 14

shows the I

C frame of the NDEF tag Application Select command.

Figure 14. NDEF tag Application Select command

6WDUWꢄRIꢄWKHꢄ

WUDQVPLVVLRQꢄ

RIꢄWKHꢄUHTXHVW

,ð&ꢄEXV

$&.

͘͘͘

Ϭǆꢃꢂ

ǆϬϮ ϬǆϬϬ Ϭǆꢃϰ ϬǆϬϰ ϬǆϬϬ ϬǆϬϳ ϬǆꢀϮ Ϭǆϳϲ ϬǆϬϬ ϬǆϬϬ Ϭǆϴϱ ϬǆϬϭ ϬǆϬϭ

(QGꢄRIꢄWKHꢄ

WUDQVPLVVLRQꢄ

RIꢄWKHꢄUHTXHVW

,ð&ꢄEXV

$&.

͘͘͘

ꢊ[ꢊꢊ

ꢊ

[ꢀꢉ

ꢊ[&ꢊ

6WDUWꢄRIꢄWKHꢄ

WUDQVPLVVLRQꢄ

RIꢄWKHꢄDQVZHU

ꢄŶĚꢁŽĨꢁƚŚĞꢁ

ƚƌĂŶƐŵŝƐƐŝŽŶꢁ

ŽĨꢁƚŚĞꢁĂŶƐǁĞƌ

,ð&ꢄEXV

ꢃꢂ< ꢃꢂ< ꢃꢂ< ꢃꢂ< ꢃꢂ< EŽꢃꢂ<

͘͘͘

Ϭǆꢃꢀ ϬǆϬϮ ϬǆϵϬ ϬǆϬϬ Ϭǆ&ϭ ϬǆϬϵ

$&.

$FNQRZOHGJHꢄEꢄ0ꢁꢆ65[[ꢋ<

$&.

1R$&.

/HJHQG

$FNQRZOHGJHꢄEꢄWKHꢄ,ð&ꢄKRVW

1Rꢄ$FNQRZOHGJHꢄEꢄWKHꢄ,ð&ꢄKRVW

%WHꢄVHQWꢄEꢄWKHꢄ0ꢁꢆ65[[ꢋ<

ꢊ[ꢊꢊ

%WHꢄVHQWꢄEꢄWKHꢄ,ð&ꢄKRVW

%WHꢄVHQWꢄEꢄWKHꢄ0ꢁꢆ65[[ꢋ<

ꢊ[ꢊꢁ

ꢊ[ꢊꢊ

6WDUWꢄVHQWꢄEꢄWKHꢄ,ð&ꢄKRVW

6WRSꢄVHQWꢄEꢄWKHꢄ,ð&ꢄKRVW

06Yꢀꢌꢈꢊꢉ9ꢂ

DocID024754 Rev 16

I2C device operation

M24SR04-Y M24SR04-G

7.10

Open an I²C session

pen an I²C session, the I²C host shall send either the GetSession command or the

KillRFsession command. The GetSession Command opens an I²C session if an RF session

in not currently opened.

A KillRFsession command closes the current RF session if it exist and opens an I²C

session.

When an I²C session is opened, the RF host cannot communicate with the M24SR04 and

cannot close the I²C session.

7.11

Close the I²C session

There are three ways to close an I²C session:

•

turn off the Vcc power supply

send the I2C token release sequence

wait for the I²C watchdog when it is enabled

wait for the I²C timeout on clock period

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Functional procedures

This section describes some procedure to access the memory or manage its protection.

8.1

Selection of an NDEF message

The RF or I²C host shall use this procedure to detect the NDEF message inside an

M24SR04.

The NDEF detection procedure is as follows:

1. Open

an RF or an I²C session

2. Send

the SelectNDEF

gApplication command

3. Select

the CC file

4. Read

the CC file

5. Select

the NDEF file.

8.2

Reading of an NDEF message

The RF or I²C host executes the NDEF read procedure to read the NDEF file.

1. Detect

successfully the NDEF file using the NDEF detection procedure

2. Check

that the read access without any security is granted for the NDEF file from the

information provided by the CC file

3. Select

the NDEF file

4. Read

the NDEF file.

Note:

Reading the NDEF file should not go beyond the NDEF Length field (NLEN), which

indicates the size of the NDEF message stored in the NDEF file.

8.3

Reading a locked NDEF file

The RF or I²C host executes this procedure to read an NDEF file which has been locked

previously.

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Verify

the Read password by using the Verify command

4. Read

the data in the NDEF file.

DocID024754 Rev 16

Functional procedures

M24SR04-Y M24SR04-G

8.4

Locking an NDEF file

The RF or I²C host executes this procedure to protect an NDEF file.

1. Select

the NDEF

g Application

2. Check

the right access provided by the CC file

3. Select

the NDEF file

4. Transmit

the NDEF file Write password by using the Verify command

5. Lock

the NDEF file by sending the Enable verification command.

8.5

8.6

Unlocking an NDEF file

The RF or I²C host executes this procedure to unlock an NDEF file which has been locked

previously.

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Verify

the NDEF file Write password or the I²C password by using the Verify command

4. Unlock

the NDEF file by sending the Disable verification command.

Reaching the read-only state for an NDEF file

The RF or I²C host executes this procedure to reach the read-only state for an NDEF file.

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Transmit

the NDEF file Write password or the I²C password by using the Verify

command

4. Send

an EnablePermanentState command as the Write access right of the previous

Select NDEF file.

8.7

Changing an NDEF password procedure

The RF or I²C host could use this procedure to change one NDEF password. it can be a

Read or Write password.

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Transmit

the NDEF file Write password or the I²C password by using the Verify

command

4. Change

the password by sending a ChangeReferenceData command.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Functional procedures

8.8

Changing a File type Procedure

The RF or I²C host executes this procedure to change the File Type of a file for which all

access rights were previously granted.

1. Select

the NDEF

g Application

2. Select

the File to be modified

3. Set

the File Length to 0x00 using the UpdateBinary command

4. Send

an UpdateFileType command with the New file Type as data.

8.9

Updating a NDEF file

When there’s enough space in the file to update it with new content, the following steps

should be followed to update the NDEF message:

1. Select

the NDEF

g Application

2. Select

the NDEF file

3. Unlock

the NDEF file if necessary

4. Write

the NDEF length to 0x0000 with the Update Binary command.

5. Write

the NDEF message in the NDEF message field using one or more Update Binary

commands.

6. Write

the NDEF length of the NDEF message using the Update Update command.

It is recommended the NDEF length is read back and checked against the desired value to

ensure the Update sequence has been correctly performed.

DocID024754 Rev 16

UID: Unique identifier

M24SR04-Y M24SR04-G

UID: Unique identifier

The M24SR04 is uniquely identified by a 7 bytes unique identifier (UID). The UID is a read-

only code and comprises:

•

The IC manufacturer code on 1 byte (0x02 for STMicroelectronics).

The Product code on 1 byte.

A device number on 5 bytes.

ble 72

describes the UID format.

Table 72. UID format

0x02 0x86

5 bytes

IC manufacturer code

M24SR04 product code

Device number

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Maximum ratings

Stressing the device above the ratings listed in

Table 73

may cause permanent damage to

the device. These are stress ratings only and operation of the device at these or any other

conditions above those indicated in the operating sections of this specification is not implied.

Exposure to absolute maximum rating conditions for extended periods may affect the device

reliability.

Table 73. Absolute maximum ratings

Symbol

Parameter

Min.

Max.

Unit

Ambient operating temperature

for grade 6

– 40

°C

Ambient operating temperature

for grade 5

– 25

UFDFPN8,

SO8, TSSOP8

Storage temperature

– 65

150

°C

Sawn Bumped

Wafer (kept in

its antistatic

bag)

STG

Storage time

–

months

°C

Lead temperature

during soldering

UFDFPN8,

SO8, TSSOP8

LEAD

see note

(1)

C input or output range and GPO

RF supply current AC0 – AC1

RF input voltage

– 0.50

–

6.5

(2)

100

amplitude between

AC0 and AC1, GND

(2)

MAX_1

VAC0-VAC1

–

pad left floating

AC voltage between

VAC0-GND or

(2)

MAX_2

AC0 and GND, or AC1

VAC1-GND

– 0.5

4.5

and GND

Electrostatic discharge

ESD

voltage (human body

AC0-AC1

–

1000

3500

model)

(3)

Electrostatic discharge

voltage (human body

model)

(3)

ESD

Other pads

1. Compliant

with JEDEC Std J-STD-020D (for small body, Sn-Pb or Pb assembly), the ST ECOPACK

7191395 specification, and the European directive on Restrictions on Hazardous Substances (ROHS

directive 2011/65/EU, July 2011).

2. Based

on characterization, not tested in production. Maximum absorbed power = 100 mW @ 7.5 A/m

3. AEC-Q100-002

(compliant with JEDEC Std JESD22-A114A, C1 = 100 p

1 = 1500

, R2 = 500

)

DocID024754 Rev 16

I2C DC and AC parameters

M24SR04-Y M24SR04-G

I C

DC and AC parameters

This section summarizes the operating and measurement conditions, and the DC and AC

characteristics of the device in I

C mode. The parameters in the DC and AC characteristic

tables that follow are derived from tests performed under the measurement conditions

summarized in the relevant tables. Designers should check that the operating conditions in

their circuit match the measurement conditions when relying on the quoted parameters.

Table 74. I C operating conditions

Symbol

Parameter

Supply voltage range Y

Min.

Max.

Unit

2.7

2.4

–40

-25

5.5

Supply voltage range G

Ambient operating temperature for grade 6

Ambient operating temperature for grade 5

°C

Table 75. AC test measurement conditions

Symbol

Parameter

Min.

Max.

Unit

Load capacitance

100

Input rise and fall times

Input levels

–

hi-lo

ref(t)

0.2 V

to 0.8 V

0.3 V

to 0.7 V

Input and output timing reference levels

Figure 15. AC test measurement I/O waveform

,QSXWꢄOHYHOV

,QSXWꢄDQGꢄRXWSXW

WLPLQJꢄUHIHUHQFHꢄOHYHOV

ꢊꢇꢃꢄ9

ꢊꢇꢈꢄ9

ꢊꢇꢀꢄ9

ꢀꢁꢂ 6

06ꢆꢈꢉꢊꢂ9ꢂ

Table 76. Input parameters

Parameter

Symbol

Min.

Max.

Unit

Input capacitance (SDA)

–

Input capacitance (other pins)

Pulse width ignored (Input filter on SCL and SDA)

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I2C DC and AC parameters

Table 77. I C DC characteristics

Symbol

Parameter

Test condition

Min.

Max.

Unit

Input leakage current

(SCL, SDA)

= V

or V

device in Standby mode

–

± 2

µA

SDA in Hi-Z, external voltage applied on SDA:

or V

Output leakage current

–

± 2

µA

_{CC
= 3.3
V
,
w
ith RF ON}

_{CC
= 3.3 V, with RF OFF}

_{CC
= 5.5
V
,
w
ith RF ON
(1)}

= 5.5

ith RF OFF

_{CC
= 3.3
V
, with RF ON}

_{CC
= 3.3 V, with RF OFF}

= 5.5

ith RF ON

–

Standby power mode

supply current

CC0

µA

150

250

200

250

200

550

500

550

500

Supply current

CC1

CC2

CC3

µA

C Session open)

= 5.5

ith RF OFF

= 3.3 V (f

= 1 MHz), with RF ON

(3)

Supply current

(2)

(Read binary)

_{CC
= 3.3 V (f
C
= 1 MHz), with RF OFF
(3)}

_{CC
= 5.5 V (f
C
= 1 MHz),with RF ON
(3)}

= 5.5 V (f

= 1 MHz),with RF OFF

(3)

_{CC
= 3.3 V (f
C
= 1 MHz),with RF ON
(3)}

_{CC
= 3.3 V (f
C
= 1 MHz),with RF OFF
(3)}

Supply current

(2)

(Update binary)

= 5.5 V (f

= 1 MHz), with RF ON

(3)

= 5.5 V (f

= 1 MHz), with RF OFF

(3)

= 2.7 V (grade Y)

= 2.4 V (grade G)

= 5.5 V

Input low voltage

(SDA, SCL)

0.3

-0.45

= 2.7 V (grade Y)

Input high voltage

(SDA, SCL)

= 2.4 V (grade G)

0.7 V

6.5

= 5.5 V

= 2.7 V (grade Y)

Input low voltage

(RF disable)

–

= 2.4 V (grade G)

0.45

= 5.5 V

= 2.7 V (grade Y)

= 2.4 V (grade G)

= 5.5 V

Input high voltage

(RF disable)

1.4

–

Output low voltage (SDA)

Output low voltage (GPO)

= 3 mA, V

= 5.5 V

–

0.4

= 1 mA,

= 2.7 V (grade Y) or 2.4 V (grade G)

to V

= 5.5 V

1. When

an RF session is Opened, I

corresponds to the standby power mode.

2. Characterized

only.

3. Input

levels as defined in

Figure 15

DocID024754 Rev 16

I2C DC and AC parameters

M24SR04-Y M24SR04-G

Table 78. I

C AC characteristics (400 kHz)

Test conditions specified in

Table 74

(preliminary data based on design simulations)

Symbol

Alt.

Parameter

Min.

Max.

Unit

SCL

Clock frequency

0.05

0.6

400

kHz

µs

(1)

CHCL

HIGH

Clock pulse width high

LOW

Clock pulse width low

20000

(2)

CLCH

1.3

CL_reset

XH1XH2

XL1XL2

DL1DL2

DXCX

–

Clock reset

40000

–

(3)

Input signal rise time

Input signal fall time

SDA (out) fall time

(3)

100

300

SU:DAT

Data in set up time

HD:DAT

Data in hold time

–

CLDX

(4)

CLQX

Data out hold time

100

–

(5)

CLQV

Clock low to next data valid (access time)

900

–

(6)

CHDX

SU:STA

Start condition set up time

HD:STA

Start condition hold time

SU:STO

Stop condition set up time

600

1300

–

DLCL

CHDH

DHDL

–

BUF

Time between Stop condition and next Start condition

–

I²C write time in one page

I²C write time up to 246 bytes

–

(7)

–

Pulse width ignored (input filter on SCL and SDA)

Delay for I²C token release

–

START_OUT

1. t

CHCL

timeout.

2. t

CLCH

timeout.

3. There

is no min. or max. value for the input signal rise and fall times. It is however recommended by the I²C specification that the input

signal rise and fall times be more than 20 ns and less than 300 ns when f

< 400 kHz.

void spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or rising edge of

SDA.

CLQV

is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8V

in a compatible way with the

C specification (which specifies t

SU:DAT

(min) = 100 ns), assuming that the R

bus

× C

bus

time constant is less than 500 ns

(as specified in

6. For

a restart condition, or following a write cycle.

7. Characterized

only, not tested in production.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I2C DC and AC parameters

Table 79. I C AC characteristics (1 MHz)

Test conditions specified in

Table 74

(preliminary data based on design simulations)

Symbol

Alt.

Parameter

Min.

Max.

Unit

SCL

Clock frequency

0.05

260

1000

–

kHz

(1)

CHCL

HIGH

Clock pulse width high

LOW

Clock pulse width low

(2)

CLCH

500

–

(3)

XH1XH2

XL1XL2

DL1DL2

DXCX

Input signal rise time

Input signal fall time

SDA (out) fall time

(3)

120

SU:DAT

Data in set up time

HD:DAT

Data in hold time

–

CLDX

–

CLQX

Data out hold time

100

–

(4)(5)

CLQV

Clock low to next data valid (access time)

450

(6)

CHDX

SU:STA

Start condition set up time

HD:STA

Start condition hold time

SU:STO

Stop condition set up time

250

–

DLCL

CHDH

Time between Stop condition and next Start

condition

DHDL

BUF

–

500

–

I²C write time in one page

I²C write time up to 246 bytes

–

150

Pulse width ignored (input filter on SCL and

SDA)

(7)

–

1. t

CHCL

timeout.

2. t

CLCH

timeout.

3. There

is no min. or max. value for the input signal rise and fall times. It is however recommended by the I²C

specification that the input signal rise and fall times be less than 120 ns when f

< 1 MHz.

void spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or

rising edge of SDA.

5. t

CLQV

is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8V

in a

compatible way with the I

C specification (which specifies t

SU:DAT

(min) = 100 ns), assuming that the R

bus

× C

bus

time constant is less than 500 ns (as specified in

6. For

a reStart condition, or following a write cycle.

7. Characterized

only, not tested in production.

DocID024754 Rev 16

I2C DC and AC parameters

M24SR04-Y M24SR04-G

Figure 16. I C AC waveforms

&+&/

;/ꢂ;/ꢁ

&/&+

;+ꢂ;+ꢁ

6&/

‘/&/

;/ꢂ;/ꢁ

6’$ꢄ,Q

‘;&+

6’$

&KDQJH

‘+’/

&+’/

6WDUW

FRQGLWLRQ

&/’;

;+ꢂ;+ꢁ

&+’+

6WDUW

6’$

,QSXW

6WRS

FRQGLWLRQ

6&/

6’$ꢄ,Q

&+’+

&+’/

6WRS

FRQGLWLRQ

:ULWHꢄFFOH

6WDUW

FRQGLWLRQ

&+&/

6&/

4/ꢂ4/ꢁ

&/49

&/4;

‘DWDꢄYDOLG

6’$ꢄ2XW

06ꢆꢈꢉꢀꢁ9ꢂ

DocID024754 Rev 16

M24SR04-Y M24SR04-G

I2C DC and AC parameters

11.1

C timing measurement condition

represents the Maximum Rbus value versus bus parasitic capacitance (Cbus) for

an I

C bus at maximum frequency f

= 400 kHz.

Figure 17. Maximum Rbus value with f

= 400 kHz

ꢃꢀꢀ

4HE 2

X #

TIME CONSTANT

BUS

MUST BE BELOW THE ꢄꢀꢀ NS

TIME CONSTANT LINE REPRESENTED

ON THE LEFTꢁ

ꢃꢀ

BUS

(ERE 2

BUS

§ #

ꢋ ꢃꢂꢀ NS

BUS

ꢄ K

3#,

3$!

)£# BUS

MASTER

-ꢂꢄXXX

ꢃ

ꢌꢀ P&

BUS

ꢃꢀ

ꢃꢀꢀ

“US LINE CAPACITOR ꢈP&ꢉ

ꢃꢀꢀꢀ

AIꢃꢄꢅꢆꢇB

Figure 18

represents the Maximum Rbus value versus bus parasitic capacitance (Cbus) for

an I

C bus at maximum frequency f

= 1 MHz.

Figure 18. Maximum Rbus value with f

= 1 MHz

ꢃ

ꢀ

BUS

4HE 2

§ #

TIME CONSTANT

BUS

MUST BE BELOW THE ꢃꢍꢀ NS

TIME CONSTANT LINE REPRESENTED

ON THE LEFTꢁ

3#,

3$!

)£# BUS

MASTER

ꢃꢀ

ꢄ

-ꢂꢄXXX

(EREꢎ

BUS

ꢋ ꢃꢂꢀ NS

BUS

ꢃ

ꢃꢀ

ꢌꢀ

“US LINE CAPACITOR ꢈP&ꢉ

ꢃꢀꢀ

-3ꢃꢆꢅꢄꢍ6ꢃ

DocID024754 Rev 16

I2C DC and AC parameters

M24SR04-Y M24SR04-G

Figure 19. I

C bus protocol

6&/

6’$

,QSXW

6’$

&KDQJH

6WDUW

6WRS

FRQGLWLRQ

6&/

6’$

ꢂ

ꢁ

ꢀ

ꢈ

ꢃ

ꢍ

$&.

06%

6WDUWꢄ

FRQGLWLRQ

ꢂ

ꢁ

ꢀ

ꢈ

ꢃ

ꢍ

6&/

6’$

06%

$&.

6WRS

FRQGLWLRQ

-3ꢄꢅꢍꢃꢌ6ꢃ

Table 80. Device select code

Device type identifier

(1)

Chip Enable address

b3 b2 b1

Device select code

1. The

most significant bit, b7, is sent first.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

GPO parameters

This section lists the timing of the GPO according to its configuration.

(1)

Table 81. GPO timings measurement

GPO field

I/F

Condition

Command

Kill session

Get session

Symbol

Typ. Unit

CmdSTPtoGPlow

*add 100 µs for boot

after POR

15*

µs

GPO low when

session active

0xX1

0x1X

C token release

sequence

GPO return HZ

AnswerlbLBtoGPHZ 105

µs

Session Open

GPO low when

session active

NDEF select

Deselect

CmdEOFtoGPlow

170

GPO return HZ

CmdEOFtoGPHZ

CmdSTPtoGPlow

370

µs

GPO low when

programming

Update Binary

Writing time duration

(No time extension)

0xX2

0x2X

µs

WIP

CmdEOFtoGPlow

GPO low when

programming

Writing time duration

(No time extension)

µs

GPO low when a

command is

computed

ReadBinary

UpdateBinary

CmdSTPtoGPlow

Answer Ready

0xX3

0x3X

GPO return HZ on

new command

After NewCmdlbFB

or AnswerlbFB

All commands

105

GPO low when

modifying NDEF

UpdateBinary

(Msg Length #0)

CmdEOFtoGPlow

µs

Message In

Progress

GPO low when

modifying NDEF

Writing time duration

(No time extension)

UpdateBinary

SendInterrupt

All commands

SendInterrupt

GPO low after

receiving an

Interrupt command

CmdSTPtoGPlow

µs

0xX4

0x4X

After NewCmdlbFB

or AnswerlbFB

Interrupt

GPO return HZ

105

GPO low after

receiving an

Interrupt command

CmdEOFtoGPlow

Pulse duration

µs

540

DocID024754 Rev 16

GPO parameters

GPO field

M24SR04-Y M24SR04-G

(1)

Table 81. GPO timings measurement

(continued)

I/F

Condition

Command

Symbol

Typ. Unit

GPO low when

reset

Reset GPO

CmdSTPtoGPlow

µs

0xX5

0x5X

GPO return HZ

when set

Set GPO

Reset GPO

Set GPO

CmdSTPtoGPHZ

CmdEOFtoGPlow

CmdEOFtoGPHZ

State Control

GPO low when

reset

GPO return HZ

when set

Anticollision

command or start

of RF disturb

(command using

another RF

GPO low after

receiving an RF

command

CmdSOFtoGPlow

CmdEOFtoGPHZ

µs

protocol)

RF Busy

0x6X

Deselect or end of

RF disturb

(command using

another RF

GPO return HZ

afte

eselectio

RF command in

another protocol

460

protocol)

1. Characterized

only.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Write cycle definition

(1)

Table 82. Write cycle definition

Test Conditions

Symbol

Ncycle

Parameter

Min

Max

Units

≤

25 °C, V

CC(min)

< V

CC(max)

≤

85 °C, V

CC(min)

< V

CC(max)

–

1,000,000

600,000

Write cycle

endurance

(2)

1. A

write cycle is calculated per byte, and corresponds to a write to this byte.

2. Write

cycle endurance is defined by characterization and qualification.

DocID024754 Rev 16

RF electrical parameters

M24SR04-Y M24SR04-G

RF electrical parameters

This section summarizes the operating and measurement conditions, and the DC and AC

characteristics of the device in RF mode.

The parameters in the DC and AC characteristics tables that follow are derived from tests

performed under the Measurement Conditions summarized in the relevant tables.

Designers should check that the operating conditions in their circuit match the measurement

conditions when relying on the quoted parameters.

Table 83. Default operating conditions

Symbol

Parameter

Min.

Max.

Unit

Ambient operating temperature for grade 6

Ambient operating temperature for grade 5

–40

-25

°C

(1)

Table 84. RF characteristics

Symbol

Parameter

Condition

Min

Typ

Max

Unit

External RF signal frequency

13.553

1500

13.56 13.567 MHz

H_ISO

Operating field according to ISO

= 0 °C to 50 °C

–

7500 mA/m

Operating field in extended

temperature range

H_Extended

= -40 °C to 85 °C

500

CARRIER

100% carrier modulation index

MI=(A-B)/(A+B)

28/f

7/f

1.5xt4

–

100

40.5/f

µs

Pause A length

–

Pause A low time

Pause A rise time

Pause A rise time section

16/f

6/f

Minimum time from carrier

generation to first data

MIN CD

From H-field min

–

RF write time (including internal

Verify) for one page

TUN

Internal tuning capacitor in SO8

(2)

= 13.56 MHz

Chip reset

22.5

–

27.5

RF_OFF

RF OFF time

1. All

timing characterizations were performed on a reference antenna with the following characteristics:

External size: 75 mm x 48 mm

Number of turns: 6

Width of conductor: 0.6 mm

Space between two conductors: 0.6 mm

Value of the tuning capacitor in SO8: 25 pF (M24SR04)

Value of the coil: 5 µH

Tuning frequency: 14.2 MHz.

2. Characterized

only, at room temperature only, measured at VAC0-VAC1 = 2 V peak to peak at 13.56 MHz.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Package information

In order to meet environmental requirements, ST offers these devices in different grades of

ECOPACK packages,

depending on their level of environmental compliance. ECOPACK

specifications, grade definitions and product status are available at:

www.st.com

ECOPACK is

an ST trademark.

15.1

SO8N package information

Figure 20. SO8N – 8-lead plastic small outline, 150 mils body width, package outline

H X

ꢂ

ꢃ

!ꢄ

CCC

ꢀꢁꢂꢃꢄPP

*$8*(ꢄ3/$1(

ꢁ

%ꢀ

ꢀ

!ꢀ

,ꢀ

62ꢋ$B9ꢁ

1. Drawing

is not to scale.

Table 85. SO8N – 8-lead plastic small outline, 150 mils body width,

package data

millimeters

Typ

inches

(1)

Symbol

Min

Max

Min

Typ

Max

–

1.750

0.250

–

0.0689

0.0098

–

0.100

1.250

0.280

0.170

4.800

5.800

3.800

–

0.0039

0.0492

0.0110

0.0067

0.1890

0.2283

0.1496

–

0.480

0.230

5.000

6.200

4.000

–

0.0189

0.0091

0.1969

0.2441

0.1575

–

4.900

6.000

3.900

1.270

–

0.1929

0.2362

0.1535

0.0500

0.250

0°

0.500

8°

0.0098

0°

–

0.0197

8°

–

0.400

–

1.270

0.0157

0.0500

DocID024754 Rev 16

Package information

M24SR04-Y M24SR04-G

Table 85. SO8N – 8-lead plastic small outline, 150 mils body width,

package data (continued)

millimeters

inches

(1)

Symbol

Min

Typ

Max

Min

Typ

Max

–

1.040

–

0.0409

–

ccc

0.100

0.0039

1. Values

in inches are converted from mm and rounded to 4 decimal digits.

Figure 21. SO8N – 8-lead plastic small outline, 150 mils bosy width,

package recommended footprint

ꢊꢇꢌꢄꢎ[ꢃꢏ

ꢂꢇꢁꢈ

2ꢈB62ꢃ1B)3B9ꢂ

80/89

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Package information

15.2

TSSOP8 package information

Figure 22. TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,

package outline

ꢀ

ꢄϭ

ꢄ

ꢃϭ

ꢃϮ

ꢃ

>ϭ

ꢂW

76623ꢃ$0B9ꢁ

1. Drawing

is not to scale.

Table 86. TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,

package mechanical data

millimeters

Min

inches

(1)

Symbol

Typ

Max

Typ

Min

Max

–

1.200

0.150

1.050

0.300

0.200

0.100

3.100

–

0.0472

0.0059

0.0413

0.0118

0.0079

0.0039

0.1220

–

0.050

0.800

0.190

0.090

–

0.0020

0.0315

0.0075

0.0035

–

0.0394

–

1.000

–

2.900

–

3.000

0.650

6.400

4.400

0.600

1.000

0.1142

–

0.1181

0.0256

0.2520

0.1732

0.02636

0.0394

–

6.200

4.300

0.450

–

6.600

4.500

0.750

–

0.2441

0.1693

0.0177

–

0.2598

0.1772

0.0295

–

0°

8°

0°

8°

1. Values

in inches are converted from mm and rounded to 4 decimal digits.

DocID024754 Rev 16

Package information

M24SR04-Y M24SR04-G

15.3

UFDFPN8 package information

Figure 23. UFDFPN8 – 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch

dual flat package outline

‘

$ꢂ

FFF

ꢂ

3LQꢄꢐꢂꢄ

,’ꢄPDUNLQJ

(

HHH

6HDWLQJꢄSODQH

$ꢀ

6LGHꢄYLHZ

DDD

ꢁ[

ꢂ

ꢁ

ꢁ[

DDD

SꢄYLHZ

‘ꢁ

‘DWXPꢄ$

ꢂ

ꢁ

/ꢂ

/ꢀ

3LQꢄꢐꢂꢄ

/ꢀ

(ꢁ

,’ꢄPDUNLQJ

Hꢅꢁ

/ꢂ

UPLQDOꢄWLS

‘HWDLOꢄ³$´

(YHQꢄWHUPLQDO

1’ꢋꢂꢄ

[

%RWWRPꢄYLHZ

6HHꢄ’HWDLOꢄ³$´

=:EB0(B9ꢂ

1. Max

package warpage is 0.05 mm.

2. Exposed

copper is not systematic and can appear partially or totally according to the cross section.

3. Drawing

is not to scale.

4. The

central pad (the area E2 by D2 in the above illustration) must be either connected to V

or left floating

(not connected) in the end application.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Package information

Table 87. UFDFPN8 – 8- lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch

dual flat package mechanical data

millimeters

Typ

inches

(1)

Symbol

Min

Max

Min

Typ

Max

0.450

0.550

0.600

0.050

0.300

2.100

1.600

3.100

1.600

–

0.0177

0.0217

0.0236

0.0020

0.0118

0.0827

0.0630

0.1220

0.0630

–

0.000

0.020

0.0000

0.0008

(2)

0.200

0.250

0.0079

0.0098

1.900

2.000

0.0748

0.0787

D2 (rev MC)

1.200

–

0.0472

–

2.900

3.000

0.1142

0.1181

E2 (rev MC)

1.200

–

0.0472

–

K (rev MC)

–

0.500

–

0.0197

0.300

–

0.0118

–

0.300

0.500

0.150

–

0.0118

0.0197

0.0059

–

0.300

0.0118

aaa

–

0.150

0.100

0.050

0.080

–

0.0059

0.0039

0.0020

0.0031

bbb

ccc

ddd

eee

(3)

1. Values

in inches are converted from mm and rounded to 4 decimal digits.

2. Dimension

b applies to plated terminal and is measured between 0.15 and 0.30 mm from the terminal tip.

3. Applied

for exposed die paddle and terminals. Exclude embedded part of exposed die paddle from

measuring.

DocID024754 Rev 16

Ordering information

M24SR04-Y M24SR04-G

Ordering information

Table 88. Ordering information scheme for packaged devices

M24 SR

04- Y

Example:

Device type

M24 = I

C interface device

Device feature

SR = Short range

Memory size

04 = memory size in Kbits

Voltage range

Y = 2.7 to 5.5 V

G = 2.4 to 5.5 V, only available in grade 5 (-25 to 85 °C)

Package

MN = SO8N

DW = TSSOP8

MC = UFDFPN8

SG12I = 120 µm ± 15 µm bumped and sawn inkless wafer on 8-inch frame

(1)

Device grade

5 = industrial: device tested with standard test flow over -25 to 85 °C

6 = industrial: device tested with standard test flow over –40 to 85 °C

(No parameter for SG12I)

Option

T =

pe and reel packing

(No parameter for SG12I)

Capacitance

/2 = 25 pF

1. SG12I

is only available for voltage range “G”.

Note:

Parts marked as ES or E are not yet qualified and therefore not approved for use in

production. ST is not responsible for any consequences resulting from such use. In no event

will ST be liable for the customer using any of these engineering samples in production.

ST’s Quality department must be contacted prior to any decision to use these engineering

samples to run a qualification activity.

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Revision history

Table 89. Document revision history

Changes

Date

Revision

13-Jun-2013

Initial release.

Added UFDFPN8 drawing

on page 1

Edited

Section 2.6: RF disable

29-Aug-2013

Updated I

CC0

parameter in

Section 15.3: UFDFPN8 package information

and added a note.

Added

and UFDFPN8 package.

Updated the Capacitance value to 25 p

Removed all “Battery assisted” and “Wire power management” information (conditioned

for a future use).

Moved

GetI2Csession command

before

Section 5.10.2: KillRFsession command

Added 2 new sections:

Section 7.4: I²C token release sequence

and

Section 7.5: I²C

timeout on clock period

Removed “DID field” information from

Section 7.9: I²C frame format

and from

Table 69

Table 71

28-Oct-2013

Updated different values in

Table 74: I2C

operating conditions

Table 78: I2C AC characteristics

(400 kHz)

Table 79: I2C AC characteristics (1 MHz)

, and

Table 84: RF characteristics

and removed all “(forecast data)” from the table titles.

Moved

RF characteristics

table before

ble 84: RF characteristics

, deleted footnote (1)

and updated footnote (2).

Fully edited.

Added a note to

Section 7.1: I2C communication protocol

below

Figure 12: Command

and response exchange

08-Nov-2013

Changed the datasheet status from “Preliminary data” to “Production data”.

Restored the whole content of

Section 2.5.1: Operating supply voltage VCC

Updated the capacitor values in

Removed bullet (4) from

Section 8.6: Reaching the read-only state for an NDEF file

Updated V

ESD

value in

Table 73: Absolute maximum ratings

, I

values in

ble 77:

I2C DC characteristics

, and H_Extended value in

Table 84: RF chara

cteri

stics

18-Dec-2013

Added details to “S(WTX)” bullet in

Section 5.4: S-Block format

Added sentences to

Section 5.6.8: UpdateBinary command

and to

Section 5.8.3:

DisablePermanentState command

Changed ‘0x001E’ value into ‘0x001F’ in

Table 56: StateControl command format

Updated values in

Table 61: ATS response

Added Note (4) to

Figure 10: Changing the read access right to an NDEF file

and

Figure 11: Changing the write access right to an NDEF file

DocID024754 Rev 16

Figure 5: GPO configured as I2C answer ready (GPO field = 0xX3)

Revision history

M24SR04-Y M24SR04-G

Table 89. Document revision history (continued)

Changes

Date

Revision

Updated

and

Figure 8: GPO configured as State Control (GPO field = 0xX5 or 0x5X)

Added I

C text to the Note below

Table 22: S-Block detailed format

Edited the third paragraph of

Section 5.8.1: ExtendedReadBinary command

Added

Section 5.8.4: UpdateFileType command

and

Section 8.8: Changing a File

type Procedure

Updated bullet 3 in

Section 7.9: I²C frame format

, and the Payload row of

ble 70: I2C

host to M24SR04

. Updated bullet 2 in

Section 7.11: Close the I²C session

26-Feb-2014

Edited V

row and removed V

ESD

(machine model) row from

Table 73: Absolute

maximum ratings

Updated I

rows and added a Note to

Figure 20: SO8N – 8-lead plastic small outline, 150 mils body width, package

Updated

outline

Fixed a typo in

Figure 23: UFDFPN8 – 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile

fine pitch dual flat package outline

title: UFDPFN8 changed into UFDFPN8.

Added data for automotive grade in

Table 6: Field list

and

ble 72: UID format

Added WFDFPN8 package for automotive grade under qualification

Added

Figure 24: WFDFPN8 (MLP8) 8-lead, 2 x 3 mm, 0.5 mm pitch very thin fine pitch

dual flat package outline

Added WFDFPN8 package for automotive grade under qualification

11-Jun-2014

Added

ble 88: WFDFPN8 8-lead thin fine pitch dual flat package no lead mechanical

data

Added MF = WFDFPN8 inside

Table 88: Ordering information scheme for packaged

devices

Inserted byte <04> between A4 and 00 inside

Figure 14: NDEF tag Application

Select command

Added:

– New Root Part Number on cover page

– single supply voltage for I2C for grade G and note (1)

Updated:

20-Nov-2014

–

–

Added

–

Figure 21: SO8N – 8-lead plastic small outline, 150 mils bosy width, package

recommended footprint

Updated

–

Section 15: Package information

–

ble 74: I2C operating conditions

–

–

ble 78: I2C AC characteristics (400 kHz)

–

ble 88: Ordering information scheme for packaged devices

20-Aug-2015

86/89

DocID024754 Rev 16

M24SR04-Y M24SR04-G

Revision history

Table 89. Document revision history (continued)

Changes

Date

Revision

Updated:

–

Features

–

Section 2.7.6: State Control configuration (GPO field = 0xX5 or 0x5X)

Added:

04-Mar-2016

–

ble 7: Details about I2C watchdog

–

ble 82: Write cycle definition

Updated:

–

Features

–

ble 82: Write cycle definition

–

Added:

27-Apr-2016

–

Section 13: Write cycle definition

Updated:

–

Section 3.2.2: Changing the read access right to NDEF files

–

Section 3.2.3: Changing the write access right to NDEF files

–

Section 5.6.5: NDEF Select command

–

Section 5.8.4: UpdateFileType command

–

Section 5.8.5: SendInterrupt command

–

Section 8.2: Reading of an NDEF message

–

Section 8.5: Unlocking an NDEF file

–

Section 8.6: Reaching the read-only state for an NDEF file

–

Section 16: Ordering information

14-Oct-2016

Added:

–

Section 8.9: Updating a NDEF file

Updated:

–

ble 35: R-APDU of the ReadBinary command

–

ble 47: R-APDU of the ExtendedReadBinary command

–

ble 88: Ordering information scheme for packaged devices

18-Nov-2016

07-Feb-2017

Added:

– Note

Figure 23.: UFDFPN8 – 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile

fine pitch dual flat package outline

Updated:

–

ble 88: Ordering information scheme for packaged devices

DocID024754 Rev 16

Revision history

M24SR04-Y M24SR04-G

Table 89. Document revision history (continued)

Changes

Date

Revision

Package SB12I replaced with SG12I.

Updated:

08-Feb-2017

–

ble 88: Ordering information scheme for packaged devices

–

Updated:

–

Features

–

ble 6: Field list

–

ble 20: R-Block detailed format

–

ble 72: UID format

–

ble 74: I2C operating conditions

–

ble 78: I2C AC characteristics (400 kHz)

–

ble 86: TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,

package mechanical data

–

ble 88: Ordering information scheme for packaged devices

–

Figure 10: Changing the read access right to an NDEF file

–

Figure 11: Changing the write access right to an NDEF file

–

Figure 15: AC test measurement I/O waveform

–

Figure 16: I2C AC waveforms

12-Sep-2017

–

Figure 19: I2C bus protocol

–

Figure 22: TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,

package outline

–

Section 16: Ordering information

Deleted:

– Section 15.4: WFDFPN8 package information

– Figure 24: WFDFPN8 (MLP8) 8-lead, 2 x 3 mm, 0.5 mm pitch very thin fine pitch dual

flat package outline

–

ble 88: WFDFPN8 8-lead thin fine pitch dual flat package no lead mechanical data