STMicroelectronics-ST25TV02K-AP6F3

ST25TV02K ST25TV512  

Datasheet  

NFC Type 5 / RFID tag IC with up to 2-Kbit EEPROM, product identification and  

protection  

Features  

Contactless interface  

•

•

•

Based on ISO/IEC 15693  

NFC Forum Type 5 tag certified by the NFC Forum  

Supports all ISO/IEC 15693 modulations, coding, subcarrier modes and data  

rates  

•

•

•

•

•

Custom Fast read access up to 53 Kbit/s  

Single and multiple block reads  

Single block writes  

Wafer  

Internal tuning capacitance: 23 p

F

,

9

9.7 pF  

Proprietary Inventory commands for speeding up the inventory process  

Memory  

•

•

•

•

•

•

Up to 2 Kbits of EEPROM  

RF interface accesses blocks of four bytes  

Write time from RF: typical 5 ms for one block  

Data retention: 60 years  

Minimum endurance: 100 k write cycles  

16-bit event counter with anti-tearing  

Data protection  

Product status link  

•

User memory: two or three areas, read and/or write protected by two 32-bit  

encrypted passwords for three areas or one 64-bit encrypted password for two  

areas  

•

•

System configuration: write protected by a 32-bit encrypted password  

Permanent write locks at a block level  

Product identification and protection  

•

•

•

•

Kill mode and untraceable mode  

T

a

mper detect capability (patent pending)  

TruST25 digital signature  

EAS (electronic article surveillance) capability  

Privacy protection  

•

•

Consumer privacy can be protected through the following features:  

–

–

Kill mode  

Untraceable mode  

In association with:  

–

–

Passwords with cover coding  

Data and configuration locks (permanent or temporary)  

Temperature range  

From – 40 to 85 °C  

•

DS12074

–

Rev 11

–

February 2021  

For further information contact your local STMicroelectronics sales office.  

ST25TV02K ST25TV512  

Package  

•

•

Sawn and bumped wafer, ECOPACK2 (RoHS compliant)  

5-pin package, ECOPACK2 (RoHS compliant)  

Compatibility ST25TV02K / LRI2K  

Full compatibility in terms of functionality and capacitances with two exceptions:  

•

–

–

Kill command requires option_flag to be set to 0  

Error codes and error generation can be different on a per command basis  

DS12074

–

Rev 11  

page 2/90  

ST25TV02K ST25TV512  

Description  

1

Description  

and

are NFC/RFID tag ICs with a tamper-proof feature, and specific modes to protect  

tag access, such as Untraceable mode.  

These devices feature a digital signature used to prove the origin of the chip in cloning detection, embed a  

configurable EEPROM with 60-year data retention, and can be operated from a 13.56 MHz long-range RFID  

reader or an NFC phone.  

The contactless interface is compatible with the ISO/IEC 15693 standard and NFC Forum Type 5 tag.  

1.1  

ST25TV02K/512 block diagram (with tamper detect)  

Figure 1.

ST25TV02K/512 (with tamper detect) block diagram  

EEPROM  

xxx-bit  

ISO 15693  

256 bits  

(EAS)  

256 bits  

signature  

RF

T

a

g  

Long Range  

2×32-bit password  

TD

(1)  

(tamper detect)  

1. tamper detect is optional.  

Table 1.

Signal names  

Signal name  

AC0  

Function  

Direction  

I/O  

Antenna coil  

Antenna coil  

AC1  

I/O  

TD0  

T

a

mper detect loop  

T

a

mper detect loop  

I/O  

TD1  

I/O  

DS12074

–

Rev 11  

page 3/90  

ST25TV02K ST25TV512  

ST25TV02K/512 block diagram (with tamper detect)  

Figure 2.

DFN5 package connections diagram (with tamper detect)  

5

2

4

TD0 1  

NC

1  

AC0 3  

5 TD1  

2 NC

1  

4 AC1  

1

2

3

ABCD  

XYZW  

2

T

o

p view  

Bottom view  

(pads side)  

(marking side)  

1: Not Connected  

Figure 3.

Die connections for sawn and bumped wafer (bottom view)  

AC0  

AC1  

TD0  

TD1  

AC0  

AC1  

NC  

NC  

With tamper detect  

Without tamper detect  

DS12074

–

Rev 11  

page 4/90  

ST25TV02K ST25TV512  

Description of signals  

2

Description of signals  

2.1  

Antenna coil (AC0, AC1)  

These inputs are used exclusively to connect the ST25TV02K/512 devices to an external coil. It is advised not to  

connect any other DC or AC path to AC0 or AC1.  

When correctly tuned, the coil is used to power and access the device using the ISO/IEC 15693 and ISO 18000-3  

mode 1 protocols.  

2.2  

Tamper detect (TD0, TD1)  

These inputs are used to connect a wire loop to the ST25TV02K/512 devices to detect an open or a short  

between the two pins TD0, TD1.  

DS12074

–

Rev 11  

page 5/90  

ST25TV02K ST25TV512  

Power management  

3

Power management  

3.1  

Device set  

To

e

nsure a proper boot of the RF circuitry, the RF field must be turned ON without any modulation for a minimum  

period of time t

boot_RF

. Before this time, ST25TV02K/512 ignores all received RF commands. (See

).  

Figure 4.

RF power-up sequence  

RF interface ready  

RFfield  

None Access  

Allowed RF  

RF REQUEST  

RF ANSWER  

Power-up  

by RF  

t

boot_RF  

Vint_supply  

3.2  

Device reset  

To

e

nsure a proper reset of the RF circuitry, the RF field must be turned off (100% modulation) for a minimum  

t

RF_OFF

period of time.  

DS12074

–

Rev 11  

page 6/90  

ST25TV02K ST25TV512  

Memory management  

4

Memory management  

4.1  

Memory organization overview  

The ST25TV02K/512 memory is divided in two main memory areas:  

•

•

User memory  

System configuration area  

The ST25TV02K/512 user memory can be divided into two or three user areas. Area 0 starts at address 0, it has  

1 block size, it is always readable, and it can be locked.  

The rest of the user memory can be either configured as one single area (Area 1) and can be read – and/or  

– write-protected with one 64-bit password, or configured as two areas (Area 1 and Area 2), which can be  

individually read – and/or – write-protected with a 32-bit password each. When Area 2 exists, Area 2 starts at the  

block number corresponding to half the user memory.  

Furthermore, each block can be locked permanently and individually for larger flexibility in number of areas  

The ST25TV02K/512 system configuration area contains registers to configure all ST25TV02K/512 features,  

which can be tuned by user. Its access is protected by a 32 bit configuration password.  

This system configuration area also includes read only device information such as IC reference, memory size,  

as well as a 64-bit block that is used to store the 64-bit unique identifier (UID), the AFI (default 00h) and DSFID  

(default 00h) registers, the TruST25™ digital signature. The UID is compliant with the ISO 15693 description, and  

its value is used during the anticollision sequence (Inventory). The UID value is written by ST on the production  

line. The AFI register stores the application family identifier. The DSFID register stores the data storage family  

identifier used in the anticollision algorithm.  

The system configuration area includes blocks that store up to two RF user area access passwords and a RF  

configuration password.  

Figure 5.

Memory organization  

Area 0:  

Area 0:  

1 block (always readable)  

1 block (always readable)  

Area 1  

User memory  

(EEPROM up  

to 2-Kbits)  

Area 1  

Half user  

memory  

Password  

protected  

Area 2  

Note: Each block can be individually locked  

DS12074

–

Rev 11  

page 7/90  

ST25TV02K ST25TV512  

User memory  

4.2  

User memory  

User memory is addressed as blocks of 4 bytes, starting at address 0.

shows how memory is seen from RF interface.  

Table 2.

2Kb user memory as seen by RF  

RF command  

User memory  

(block addressing)  

RF block 00h  

Byte  

Byte  

Byte  

Byte  

0003h  

0002h  

0001h  

0000h  

RF block 01h  

Read Single Block  

Byte  

Byte  

Byte  

Byte  

Read Multiple Blocks  

Fast Read Single Block  

Fast Read Multiple Blocks  

Write Single Block  

0007h  

0006h  

0005h  

0004h  

RF block 02h  

Byte  

Byte  

Byte  

Byte  

Inventory Read  

0011h  

0010h  

0009h  

0008h  

Fast Inventory Read  

….  

RF block 3Fh  

Byte  

Byte  

Byte  

Byte  

03FFh  

03FEh  

03FDh  

03FCh  

4.2.1  

User memory areas  

The user memory can be split into two or three different areas as showed in

Table 3.

Memory Organization  

Three areas configuration  

Area 1  

Two areas configuration  

Area 0

 

Area 1  

Block 1 to 15  

Block 1 to 63  

Part Number  

Area 0  

Block 0  

Block 0  

Area 2  

Block 1 to 7  

Block 8 to 15  

Block 0  

Block 0  

Block 1 to 31  

Block 32 to 63  

Each area has a distinct access privilege as explained below:  

•

•

Area 0 is always readable. It can be locked.  

Areas 1 and 2 can be protected in read and/or write access by password.  

Each block of Areas 1 and 2 can be individually locked (see

).  

4.3  

System configuration area  

In addition to the user memory, the ST25TV02K/512 include a set of registers located in the system configuration  

area memory (EEPROM nonvolatile registers). These registers are set during device configuration (i.e.: area  

extension), or by the application (i.e.: area protection)., their content is read during the boot sequence and defines  

basic ST25TV02K/512 behaviour.  

The registers located in the system configuration area can be accessed via dedicated Read Configuration and  

Write Configuration commands, with a pointer acting as the register address.  

The configuration security session must first be open, by presenting a valid configuration password, to grant write  

access to system configuration registers.  

shows the complete map of the system configuration area.  

DS12074

–

Rev 11  

page 8/90  

ST25TV02K ST25TV512  

System configuration area  

Table 4.

System configuration memory map accessible through write_cfg and read_cfg commands  

RF access  

Address  

Static Register  

Type  

RW

Name  

Function  

00h  

01h  

02h  

03h  

04h  

05h  

06h  

07h  

Area 1 access protection  

Area 2 access protection  

EAS Security  

RW

RW

RW

RO  

Counter Configuration  

Counter Value  

RO  

T

a

mper Detect  

RW

RO  

Configuration locked  

Key identifier  

1. Write

 

access is granted if RF configuration security session is open and configuration is not locked (LOCK_CFG register  

equals to 0).  

Table 5.

System configuration memory map for registers accessed through dedicated commands  

RF access  

Address Type  

N/A  

Static Register  

Name  

Function  

WO

WO

WO

WO

RO  

DSFID lock status  

N/A  

N/A  

N/A  

N/A  

N/A  

N/A  

N/A  

N/A  

N/A  

AFI lock status  

DSFID value  

AFI value  

IC reference value  

Unique identifier, 8 bytes  

RO  

WO

WO

WO

WO

Kill or untraceable password, 4 bytes  

User Area 1 security session password, 4 bytes  

User Area 2 security session password, 4 bytes  

Configuration security session password, 4 bytes  

1. Write

 

access if DSFID is not locked  

2. Write

 

access if AFI is not locked.  

3. Write

 

access only if not locked.  

4. Write

 

access only if corresponding security session is open.  

DS12074

–

Rev 11  

page 9/90  

ST25TV02K ST25TV512  

ST25TV02K/512 specific features  

5

ST25TV02K/512 specific features  

ST25TV02K/512 offer the data protection feature, both user memory and system configuration, a kill mode, and a  

untraceable mode.  

Those features can be programmed by setting registers of the ST25TV02K/512. ST25TV02K/512 can be partially  

customized using configuration registers located in the EEPROM system area.  

These registers are dedicated to:  

•

•

•

•

•

•

•

•

•

Data Memory organization and protection AiSS, LOCK_BLOCK.  

Kill mode, KILL  

The device’s structure LOCK_CFG  

Electronic Article Surveillance (EAS)  

TruST25™ digital signature  

Counter  

T

a

mper Detect  

Random Number generation  

Untraceable mode  

A set of additional registers allows to identify and customize the product (DSFID, AFI, IC_RE

F

,

e

tc.).  

Dedicated commands Read Configuration and Write Configuration must be used to access the configuration  

registers. Update is only possible when the access right has been granted by presenting the configuration  

password (PWD_CFG), and if the system configuration was not previously locked (LOCK_CFG=1).  

After any valid write access to the configuration registers, the new configuration is immediately applied.  

5.1  

Kill mode  

5.1.1  

Kill registers  

Table 6.

KILL  

Command  

Type  

Kill (cmd code A6h) UID @00h  

WO if PWD_KILL is correctly presented in the Kill command.  

Function  

RF  

Bit  

Name  

Factory value  

Inactive  

N/A  

KILL_MUTE  

Status of the KILL feature  

Table 7.

PWD_KILL  

Command  

Type  

Write pswd (cmd code B1h) with pswd_id = 0h  

WO: only possible if PWD_KILL is not locked.  

Function  

RF  

Bit  

Name  

Factory value  

00000000h  

b31-b0  

KILL_PSWD  

Password value for kill feature or untraceable mode  

Note:  

Refer to

.  

DS12074

–

Rev 11  

page 10/90  

ST25TV02K ST25TV512  

Data protection  

5.1.2  

Kill mode description  

KILL register allows the user to permanently kill the ST25TV02K/512 tag.  

Two working modes are offered by ST25TV02K/512:  

•

Kill mute mode:  

–

When KILL_MUTE is set with the Kill command code, the ST25TV02K/512 are killed. They can not be  

read or written and stays mute to any request. Kill mute mode is definitive.  

•

Normal mode:  

In normal usage, KILL_MUTE is set to 0, ST25TV02K/512 will process the request and respond  

accordingly.  

–

The Kill Password PWD_KILL must be presented in the Kill command for setting the Kill Mute mode.  

Kill Password lock  

By default, the Kill password is not write protected. The kill password can be locked with Lock kill (cmd code B2h).  

For safe operation, it is recommended to change the default value of the Kill Password and lock it even if not used  

in the final product  

When not used in an end application, a random value should be written into the KILL_PWD and the KILL_PWD  

should be locked with Lock kill.  

5.2  

Data protection  

ST25TV02K/512 provide a special data protection mechanism based on encrypted passwords that unlock  

security sessions.  

User memory can be protected for read and/or write access and system configuration can be protected from write  

access. User memory can also be permanently locked. Each block can be independently locked from each other  

with the Lock block command (refer to

).  

5.2.1  

Data protection registers  

Table 8.

A1SS  

Read Configuration (cmd code A0h) @00h  

Command  

Write Configuration (cmd code A1h) @00h  

RF  

Type  

R always, W if configuration security session is open and configuration not locked  

Function Factory

 

value  

Bit  

Name  

Area 1 access rights:  

00: Area 1 access: Read is always allowed / Write always allowed  

01: Area 1 access: Read is always allowed and if user security  

session is open (i.e. the proper area 1 password has been presented),  

write is allowed.  

b1-b0  

RW_PROTECTION_A1  

00b  

10: Area 1 access: Read and Write are allowed only if user security  

session is open (the proper area 1 password has been presented).  

11: Area 1 access: Read is allowed only if user security session is  

open (the proper area 1 password has been presented). Write is  

always forbidden.  

0: memory is split in three areas (Areas 0, 1 and 2)  

1: memory is composed of two areas (Areas 0 and 1)  

b2  

MEM_ORG  

RFU  

1b  

b7-b3  

–

00000b  

Note:  

Refer to

DS12074

–

Rev 11  

page 11/90  

ST25TV02K ST25TV512  

Data protection  

Table 9.

A2SS  

Read Configuration (cmd code A0h) @01h  

Write Configuration (cmd code A1h) @01h  

Command  

RF  

Bit  

Type  

R always, W if configuration security session is open and configuration not locked  

Function Factory

 

value  

Name  

Area 2 access rights:  

00: Area 2 access: Read and write are always allowed  

01: Area 2 access: Read is always allowed, and if the user  

security session is open (i.e. the proper Area 2 password has been  

presented), then write is allowed.  

b1-b0  

b7-b2  

RW_PROTECTION_A2  

00b  

10: Area 2 access: Read and Write are allowed only if the user  

security session is open (the proper Area 2 password has been  

presented)  

11: Area 2 access: Read is allowed only if user security session is  

open (the proper Area 2 password has been presented). Write is  

always forbidden.  

RFU  

–

000000b  

Note:  

Refer to

Table 10.

LOCK_CFG  

Read Configuration (cmd code A0h) @06h  

Command  

Write Configuration (cmd code A1h) @06h  

RF  

R: always possible  

Type  

W: if RF configuration security session is open (configuration password has been presented  

before) and configuration not locked  

Bit  

b0  

Name  

LCK_CFG  

RFU  

Function  

Factory value  

0b  

0: Configuration is unlocked (configuration registers can be written)  

1: Configuration is locked (configuration registers are definitively  

locked)  

b7-b1  

–

0000000b  

Note:  

Refer to

Table 11.

PWD_CFG  

Command  

Type  

Write pswd (cmd code B1h) with pswd_id = 3h  

WO: if RF configuration security session is open (configuration password has been presented  

before). If the configuration is locked, and the EAS configuration is protected by password, the  

new PWD_CFG value is only applicable to the EAS configuration.  

RF  

Bit  

Name  

Function  

Factory value  

00000000h  

b31-b0  

CFG_PSWD  

Password value for configuration area  

Note:  

Refer to

DS12074

–

Rev 11  

page 12/90  

ST25TV02K ST25TV512  

Data protection  

Table 12.

PWD_A1  

Command  

Type  

Write pswd (cmd code B1h) with pswd_id = 1h  

RF  

Bit  

WO: if RF area 1 security session is open (area 1 password has been presented before).  

Name  

Function  

Factory value  

When MEM_ORG=0: Password value for user area 1  

b31-b0  

A1_PSWD  

00000000h  

When MEM_ORG=1: 32 least significant bits of the 64-bit Password  

value for user area 1  

Note:  

Refer to

Table 13.

PWD_A2  

Command  

Type  

Write pswd (cmd code B1h) with pswd_id = 2h  

RF  

Bit  

WO: if RF area 2 security session is open (area 2 password has been presented before). Only  

applicable to the case of MEMORG=0  

Name  

Function  

Factory value  

When MEM_ORG=0: Password value for user area 2 in case of three  

area memory setup  

b31-b0  

A2_PSWD  

When MEM_ORG=1: 32 most significant bits of area 1 password in  

case of two area memory setup  

00000000h  

(in this last case area 1 password is 64-bit long)  

Note:  

Refer to

.  

5.2.2  

Passwords and security sessions  

ST25TV02K/512 provide protection of user memory and system configuration registers. The users can access  

those protected data by opening security sessions with the help of passwords. Access rights are more restricted  

when security sessions are closed, and less restricted when security sessions are open.  

There are two types of security sessions, as shown in

:  

Table 14.

Security session type  

Right granted when security session is open, and until it is  

Security session  

Open by presenting  

closed  

user access to protect user memory as defined in AiSS registers  

user write access to password A1 or A2

password Area 1, Area 2  

(PWD_A1, PWD_A2)  

user  

Configuration password  

(PWD_CFG)  

configuration  

user write access to configuration registers  

1. Write

 

access to the password number corresponding to the password number presented.  

In a three areas set up (MEM_ORG set at 0), each of the User Area 1 and 2 passwords is 32-bits long, and  

default factory passwords value is 00000000h.  

In a two areas setup (MEM_ORG set at 1), User Area 1 password is 64-bits long, and default factory password  

value is 0000000000000000h.  

The ST25TV02K/512 passwords management is organized around dedicated set of commands to access the  

dedicated registers in system configuration area.  

The dedicated password commands are:  

•

•

Write Password command (code B1h): See

.  

Present Password command (code B3h): See

User possible actions for security sessions are:  

DS12074

–

Rev 11  

page 13/90  

ST25TV02K ST25TV512  

Data protection  

•

•

Open user security session

: Present Password command, with password identifier 1 for PWD_A1 and 2  

for PWD_A2 for three areas configuration or identifier 1 for PWD_A1 for two areas configuration, and the  

valid corresponding password  

Write password

:  

–

When MEMORG=0:  

Present Password command, with password identifier 1 for PWD_A1 and 2 for PWD_A2 and the  

current valid corresponding password. Then Write Password command, with same password number  

(1 or 2) and the new corresponding password.  

–

When MEMORG=1:  

present PWD_A1 (64 bits), then Write Password command with PWD_A1 and then PWD_A2  

•

•

•

Close user security session

: Present Password command, with a different password number than the one  

used to open session or any wrong password. Or remove tag from RF field (POR).  

Open configuration security session

: Present Password command, with password number 3 and the valid  

password PWD_CFG.  

Close configuration security session

: Present Password command, with a password number different  

than 3, or password number 3 and wrong password PWD_CFG. Or remove tag from field (POR).  

Opening any new security session (user or configuration) automatically close the previously open one (even if it  

fails).  

Figure 6.

Security sessions management  

ST25TVxxx  

out of RF field  

Field ON  

Field OFF  

All security  

sessions  

closed  

Any other  

command  

Present any  

password not OK  

Present  

PWD_x OK  

Security  

session x  

opened  

(y closed)  

Any other  

command  

Present  

PWD_x OK  

Present  

PWD_y OK  

Security  

session y  

opened  

Any other  

command  

(x closed)  

DS12074

–

Rev 11  

page 14/90  

ST25TV02K ST25TV512  

Data protection  

5.2.3  

User memory protection  

On factory delivery, areas are not protected.  

Each area can be individually protected in read and/or write access.  

Area 0 is always readable.  

Furthermore, Area 0 can be independently write locked.  

Each memory area can also have individual Read/Write access conditions.  

For each area 1 and 2, an AiSS register is used to:  

•

Select the protection against read and write operations for this area  

(See

, and

for details about available read and write protections).  

When updating AiSS registers, the new protection value is effective immediately after the register write  

completion.  

•

Block 0 is an exception to this protection mechanism:  

–

Block 0 can be individually write locked by issuing a Lock Single Block command. Once locked, it  

cannot be unlock.  

–

–

–

User needs no password to lock block 0.  

Locking block 0 is possible even if the configuration is locked (LOCK_CFG=1).  

Unlocking Area 1 (through A1SS register) does not unlock block 0 if it has been locked though Lock  

Block command.  

–

Once locked, the user cannot unlock block 0.  

•

Other blocks can be individually locked.  

Retrieve the security status of a user memory block or byte  

User can read a block security status by issuing following commands:  

•

•

•

•

Get Multiple Blocks Security Status command  

(Fast) Read Single Block with option flag set to 1  

(Fast) Read Multiple Blocks with option flag set to 1  

(Fast) Inventory Read  

ST25TV02K/512 responds with a Block security status containing a Lock_bit flag as specified in ISO 15693  

standard. This lock_bit flag is set to 1 if block is locked against write.  

Lock_bit flag value may vary if corresponding user security session is open or closed.  

5.2.4  

System memory protection  

By default, the system memory is write protected, except the kill password and the EAS settings.  

Th system memory consists of all the registers defined in

. Some registers are read-only and can never be written.  

To

e

nable write access to system configuration registers, which have write capability, user must open the  

configuration security session (by presenting a valid password 3) and system configuration must not be locked  

(LOCK_CFG=00h).  

By default, user can read all system configuration registers, except all passwords, LOCK_DSFID and LOCK_AFI.  

Configuration lock:  

•

•

Write access to system configuration registers can be locked by writing 01h in the LOCK_CFG register.  

User cannot unlock system configuration if LOCK_CFG=01h, even after opening configuration security  

session (Lock is definitive).  

•

When system configuration is locked (LOCK_CFG=01h), it is still possible to change passwords (0 to 3).  

Device identification registers:  

•

AFI and DFSID registers can be independently locked by user, issuing respectively a Lock AFI and a Lock  

DSFID command. Lock is definitive: once locked, AFI and DSFID registers cannot be unlocked.  

•

Other device identification registers (MEM_SIZE, BLK_SIZE, IC_RE

F

,

U

ID) are read only registers.  

DS12074

–

Rev 11  

page 15/90  

ST25TV02K ST25TV512  

Untraceable mode  

5.3  

Untraceable mode  

5.3.1  

Untraceable mode register  

Table 15.

Untraceable mode register  

Command  

Enable untraceable mode (cmd code BAh) with pswd_id = 0h  

RF  

WO : only possible if untraceable mode password has been written before, always  

writable otherwise  

Type  

Bit  

Name  

Function  

Factory value  

00000000h  

UNTRACEABLE  

_MODE_PSWD  

b31-b0  

Password value for feature untraceable mode  

Note:  

Refer to

for the  

untraceable mode register.  

5.3.2  

Untraceable mode description  

With the

EnableUntraceableMode

command, the ST25TV02K/512 do not respond to any command except  

Present Password

and

Get Random Number

, guaranteeing the untraceability to customer requests.  

The

EnableUntraceableMode

command requires the untraceable access code (fixed value) and the crypted  

untraceable mode password to be presented for ST25TV02K/512 to enter into this mode.  

To

g

et out of the mode, the valid crypted untraceable mode password has to be transmitted to ST25TV02K/512  

with the Present password command. The crypted untraceable mode password is obtained from the random  

number and the untraceable mode password as explained in AN5103 “

Password encryption for ST25TV512 and  

ST25TV02K devices

“, available on

. When not used in an end application, a random value must be  

written into the KILL_PWD password, and the KILL_PWD must be locked with Lock kill.  

5.4  

Random number  

5.4.1  

Random number register  

Table 16.

Random number register  

Command  

Type  

Get random number (cmd code B4h)  

RO: is only possible with Get random number command.  

Function  

RF  

Bit  

Name  

Factory value  

N/A  

b15-b0  

RANDOM_NUMBER  

16-bit random number generated by ST25TV02K/512  

Note:  

Refer to

for the  

random number register.  

5.4.2  

Random number description  

The GET_RANDOM_NUMBER returns a 16-bit random number.  

DS12074

–

Rev 11  

page 16/90  

ST25TV02K ST25TV512  

Electronic article surveillance (EAS)  

5.5  

Electronic article surveillance (EAS)  

5.5.1  

EAS registers  

Table 17.

EAS_SEC  

Read Configuration (cmd code A0h) @02h  

Write Configuration (cmd code A1h) @02h  

Command  

Type  

R: always possible  

W: if RF configuration security session is open (the proper configuration password has been  

presented before) and configuration not locked  

Bit  

Name  

Function  

Factory value  

EAS security write protection:  

0: EAS parameters are always writable  

b0  

W_PROTECTION_EAS  

RFU  

0b  

1: EAS parameters are write protected by configuration password.  

In case of lock_EAS command has been previously used, this bit is  

don’t care and EAS parameters are non-writable.  

b7-b1  

–

0000000b  

Note:  

Refer to

for  

the AES security activation register.  

Table 18.

EAS_TELEGRAM register  

Enable EAS (cmd code A5h) with option flag set to 0  

Enable EAS (cmd code A5h) with option flag set to 1 and mask length ≠ 00h and EAS_ID  

Command  

Write Single (cmd code 21h) to Blocks [248 to 255]

RF  

Read Single blocks at @248 to 255 returns an error.  

R: possible with enable EAS command only if set EAS command has been presented before  

Type  

W: possible under conditions set in the EAS_SEC configuration register and EAS  

configuration not locked  

Bit  

Name  

Function  

Factory value  

All bits = 0b  

b255-b0  

EAS_TELEGRAM  

Electronic article surveillance telegram.  

1. Write

 

Single Block at addresses 248 to 255 correspond to EAS blocks 1 to 8 respectively.  

5.5.2  

EAS ID  

Table 19.

EAS_ID  

Enable EAS (cmd code A5h) with option flag set to 1 and mask length set to 0h  

Write EAS ID (cmd code A7h)  

Command  

Type  

RF  

R: possible with enable EAS command only if set EAS command has been presented before  

W: possible under conditions set in the EAS_SEC configuration register and EAS  

configuration not locked  

Bit  

Name  

Function  

Factory value  

0000h  

b15-b0  

EAS_ID  

Electronic article surveillance identifier value.  

DS12074

–

Rev 11  

page 17/90  

ST25TV02K ST25TV512  

Electronic article surveillance (EAS)  

5.5.3  

EAS configuration  

Table 20.

EAS_CFG  

Enable EAS (cmd code A5h) with option flag set to 1 and mask length ≠ 00h and EAS_ID, or  

with option flag set to 0  

Command  

Write EAS config (cmd code A8h)  

RF  

WO: possible under conditions set in the EAS_SEC configuration register and configuration  

not locked  

Type  

Bit  

Name  

Function  

Factory value  

Electronic article surveillance identifier configuration:  

00: 256 bit payload (EAS block 1 to 8)  

01: 128 bit payload (EAS block 1 to 4)  

10: 64 bit payload (EAS block 1 to 2)  

11: 32 bit payload (EAS block 1)  

b1-b0  

b15-b2  

EAS_CFG  

RFU  

00h  

–

000000b  

The EAS parameters (ID,

T

e

legram, mode (set/reset) can be definitely locked with the Lock EAS command (refer  

to

).  

5.5.4  

EAS description  

The EAS (electronic article surveillance) feature is mainly used for library management, applications, requiring an  

anti-theft protection.  

This is programmable and configured by custom commands and optionally protected by the configuration  

password (when programming EAS_SEC to 1) and can be locked.  

A telegram can be stored using standard write command depending of its configured length (EAS block 1 – EAS  

Block 8).  

The EAS feature can be activated, reset, locked using a set of custom commands (see

,  

,

,

,

and

).  

The EAS feature is reset (deactivated) by default.  

DS12074

–

Rev 11  

page 18/90  

ST25TV02K ST25TV512  

Electronic article surveillance (EAS)  

Figure 7.

Nominal EAS operation  

RF Reader  

ST25TV  

EAS – Normal  

operation  

EAS deactivated  

(reset)  

Repeated  

based on EAS  

telegram size  

Write Single (EAS, EAS block x)  

Write EAS config  

Write EAS ID  

Set EAS  

Optional  

step  

Lock EAS  

EAS ready  

Enable EAS (selective ID or none)  

If selected: EAS ID or telegram  

Reset EAS (if not locked)  

EAS deactivated  

(reset)  

By default, the EAS configuration (EAS telegram, EAS ID, EAS configuration, lock EAS, EAS mode) is not write  

protected.  

The EAS configuration can be write protected by the configuration password (PWD_CFG) by writing 1b1 into the  

W_PROTECTION_EAS (EAS_SEC register). If W_PROTECTION_EAS bit is set, the EAS configuration can be  

changed only if the configuration password has been presented just before in the same RF session.  

Write access to the EAS configuration can be locked by executing the lock_EAS command. User cannot unlock  

system configuration if the EAS configuration has already been locked earlier with the Lock_EAS command, even  

after opening configuration security session (Lock is definitive).  

DS12074

–

Rev 11  

page 19/90  

ST25TV02K ST25TV512  

TruST25 digital signature  

5.6  

TruST25 digital signature  

ST25TV02K/512 support TruST25 digital signature, a feature that allows to verify the authenticity of the device,  

based on a unique digital signature.  

TruST25 solution encompasses secure industrialization processes and tools deployed by STMicroelectronics to  

generate, store and check the signature in the device.  

Table 21.

KID  

Command  

Type  

Read Cfg (cmd code A0h) @7h  

RO  

Bit  

Name  

Function  

Factory value  

Contains a key identifier used for TruST25 digital signature  

identification and possible revocation.  

b7-b0  

KID  

ST key number  

Note:  

Refer to

for  

the KID register.  

5.7  

Counter  

5.7.1  

Counter registers  

Counter configuration  

Table 22.

CNT_CFG  

Read Cfg (cmd code A0h) @3h  

Command  

Write Cfg (cmd code A1h) @3h  

R: always possible  

Bit  

Type  

W: if RF configuration security session is open (the proper configuration password has been  

presented before) and configuration not locked.  

Name  

Function  

Factory value  

0b  

Counter enable  

0: counter is disabled  

b0  

CNT_EN  

1: counter is enabled on successful write operation (one increment  

per RF session)  

Counter clear:  

0: don’t care  

b1  

CNT_CLR  

RFU  

0b  

1: counter is cleared and automatically disabled (CNT_EN is put to 0)  

This bit is self-cleared  

b7-b2  

–

000000b  

Note:  

Refer to

for  

the CNT_CFG register.  

Counter value  

Table 23.

CNT_VAL  

Command  

Read Cfg (cmd code A0h) @4h  

Bit  

DS12074

–

Rev 11  

page 20/90  

ST25TV02K ST25TV512  

Inventory Read  

Type  

Name  

RO  

Bit  

Function  

Factory value  

0h  

b15-b0  

CNT_VAL  

Counter value  

Note:  

Refer to

for  

the CNT_VAL register.  

5.7.2  

Counter description  

A 16 bits counter can track the write events on the NDEF file.  

It benefits from an anti-tearing mechanism that ensures the consistency of the counter, even if there is an  

electrical problem during its increment.  

The value of the counter (CNT_VAL) can be checked by any application, by reading the Counter register.  

If enabled (when CNT_EN = 1), the Write counter will be incremented on first successful Write event which  

is performed in the user area, inside an RF session (an RF session is entered when ST25TV02K/512 receive  

enough power from the RF field). After enabling the counter, the counter will not count until the next RF field on/off  

cycle.  

The default configuration is with a counter disabled.  

The counter cannot be locked. When the counter reach its maximum (2

16

-1) the increment mechanism is blocked.  

The counter is cleared and automatically disabled when CNT_CLR is set to 1.  

Apart from these procedures, there is no way to act on the value of this counter.  

The Read/Write counter can be configured through the Counter Configuration register.  

This Counter Configuration register allows to:  

•

•

Enable or disable this counter (CNT_EN)  

Clear the counter (CNT_CLR)  

The Counter Configuration register is protected by the configuration password.  

5.8  

5.9  

Inventory Read  

ST25TV02K/512 have the ability to perform in a single command Inventory Read (Refer to  

), an Inventory in accordance with the regular anticollision sequence followed by  

a Multiple Block Read, reducing the overall communication time. ST25TV02K/512 return the requested memory  

content if ST25TV02K/512 match the mask specified in the command.  

When using the Fast Inventory Read (refer to

), the response is twice the data  

rate.  

Inventory Initiated  

ST25TV02K/512 provide a special feature to improve the inventory time response of moving tags using the  

Initiate_flag value. This flag, controlled by the Initiate command (refer to

), allows tags to  

answer to Inventory Initiated commands (refer to

).  

For applications where multiple tags are moving in front of a reader, it is possible to miss tags using the standard  

inventory command. The reason is that the inventory sequence has to be performed on a global tree search. For  

example, a tag with a particular UID value may have to wait the run of a long tree search before being inventoried.  

If the delay is too long, the tag may be out of the field before it has been detected.  

Using the Initiate command, the inventory sequence is optimized. When multiple tags are moving in front of a  

reader, the ones which are within the reader field will be initiated by the Initiate command. In this case, a small  

batch of tags will answer to the Inventory Initiated command which will optimize the time necessary to identify all  

the tags. When finished, the reader has to issue a new Initiate command in order to initiate a new small batch of  

tags which are new inside the reader field.  

It is also possible to reduce the inventory sequence time using the Fast Initiate (refer to

), and Fast Inventory Initiated commands (refer to

). These  

commands allow the ST25TV02K/512 to increase their response data rate by a factor of 2, up to 53 kbit/s.  

DS12074

–

Rev 11  

page 21/90  

ST25TV02K ST25TV512  

Tamper detect  

5.10  

Tamper detect  

5.10.1  

Tamper detect register  

Tamper detection  

Table 24.

TAMPER_DETECT  

Command  

Type  

Read Cfg (cmd code A0h) @5h  

Bit  

RO  

Name  

Function  

Factory value  

0b  

State of

T

a

mper:  

b0  

TAMPER_DETECT  

RFU  

0: loop is open.

T

a

mper is detected  

1: loop is closed. No tamper is detected  

b7-b1  

–

000000b  

Note:  

Refer to

for  

the TAMPER_DETECT register.  

5.10.2  

Tamper detection description  

The

T

a

mper detection allows to check the shortage between the 2 TD0 and TD1 pins of the ST25TV02K/512.  

This state TAMPER_DETECT is captured by ST25TV02K/512 each time that the ST25TV02K/512 are powered  

and available upon demand by the reader using the Read Cfg command with CFG_ID 5. (

T

a

mper detection)  

This information will be lost during power off. (No permanent storage of the status.)  

This is the customer responsibility to check the register status and behave accordingly.  

The short impedance should be less than 50 Ω.  

The tamper detect feature is available for the ST25TV02K/512-AD devices only. On other configurations, a Read  

Cfg of the

T

a

mper Detection register will return an error code.  

If the two inputs pins TD0, TD1 are shorted with a wire at the time RF field is turned on, the tamper register will  

have a value “1”. If TD0, TD1 are not shorted at the time RF field is turned on, the tamper register will have a  

value “0”.  

5.11  

Device parameter registers  

Table 25.

LOCK_DSFID  

Command  

Type  

Lock DSFID (cmd code 2Ah)  

WO if DSFID not locked  

Bit  

Name  

Function  

Factory value  

0b  

0: DSFID is not locked  

1: DSFID is locked  

b0  

LOCK_DSFID  

RFU  

b7-b1  

–

0000000b  

Note:  

Refer to

for the  

LOCK_DSFID register.  

Table 26.

LOCK_AFI  

Command  

Lock AFI (cmd code 28h)  

Bit  

DS12074

–

Rev 11  

page 22/90  

ST25TV02K ST25TV512  

Device parameter registers  

Type  

WO if AFI not locked  

Bit  

Name  

Function  

Factory value  

0b  

0: AFI is not locked  

1: AFI is locked  

b0  

LOCK_AFI  

RFU  

b7-b1  

–

0000000b  

Note:  

Refer to

for the  

LOCK_AFI register.  

Table 27.

DSFID  

Inventory (cmd code 01h)  

Command  

Get System Info (cmd code 2Bh)  

Write DSFID (cmd code 28h)  

Bit  

Type  

Name  

DSFID  

R always, W if DSFID not locked  

Function  

ISO/IEC 15693 Data Storage Format Identifier  

Factory value  

00h  

b7-b0  

Note:  

Refer to

for the  

DSFID register.  

Table 28.

AFI  

Inventory (cmd code 01h)  

Command  

Get System Info (cmd code 2Bh)  

Write AFI (cmd code 27h)  

Bit  

Type  

Name  

AFI  

R always, W if AFI not locked  

Function  

ISO/IEC 15693 Application Family Identifier  

Factory value  

00h  

b7-b0  

Note:  

Refer to

for the  

AFI register.  

Table 29.

IC_REF  

Command  

Type  

Get System Info (cmd code 2Bh)  

RO  

Bit  

Name  

Function  

ISO/IEC 15693 IC Reference  

Factory value  

45h  

b7-b0  

IC_REF  

Note:  

Refer to

for the  

IC_REF register.  

Table 30.

UID  

Inventory (cmd code 01h)  

Command  

Get System Info (cmd code 2Bh)  

Bit  

Type  

RO  

Name  

Function  

Factory value  

DS12074

–

Rev 11  

page 23/90  

ST25TV02K ST25TV512  

Device parameter registers  

b7-b0  

b7-b0  

b7-b0  

b7-b0  

b7-b0  

b7-b0  

b7-b0  

b7-b0  

ISO/IEC 15693 UID byte 0 (LSB)  

ISO/IEC 15693 UID byte 1  

IC manufacturer  

serial number  

ISO/IEC 15693 UID byte 2  

ISO/IEC 15693 UID byte 3  

UID  

ISO/IEC 15693 UID byte 4  

ISO/IEC 15693 UID byte 5: ST Product code  

ISO/IEC 15693 UID byte 6: IC Mfg code  

ISO/IEC 15693 UID byte 7 (MSB)  

23h  

02h  

E0h  

Note:  

Refer to

for the  

UID register.  

DS12074

–

Rev 11  

page 24/90  

ST25TV02K ST25TV512  

RF operations  

6

RF operations  

Contactless exchanges are performed as specified by ISO/IEC 15693 and NFC Forum Type 5. The  

ST25TV02K/512 communicate via the 13.56 MHz carrier electromagnetic wave on which incoming data are  

demodulated from the received signal amplitude modulation (ASK: amplitude shift keying). The received ASK  

wave is 10% or 100% modulated with a data rate of 1.6 Kbit/s using the 1/256 pulse coding mode or a data rate of  

26 Kbit/s using the 1/4 pulse coding mode.  

Outgoing data are generated by the ST25TV02K/512 load variation using Manchester coding with one or two  

subcarrier frequencies at 423 kHz and 484 kHz. Data are transferred from the ST25TV02K/512 at 6.6 Kbit/s in low  

data rate mode and 26 Kbit/s in high data rate mode. The ST25TV02K/512 support the 53 Kbit/s data rate mode  

in one sub-carrier frequency at 423 kHz.  

The ST25TV02K/512 follow ISO/IEC 15693 and NFC Forum Type 5 recommendation for radio-frequency power  

and signal interface and for anticollision and transmission protocol.  

6.1  

RF communication  

6.1.1  

Access to a ISO/IEC 15693 device  

The dialog between the “reader” and the ST25TV02K/512 take place as follows:  

These operations use the power transfer and communication signal interface described below (see Power  

transfer, Frequency and Operating field). This technique is called RTF (Reader talk first).  

•

•

•

Activation of the ST25TV02K/512 by the operating field of the reader,  

Transmission of a command by the reader (ST25TV02K/512 detect carrier amplitude modulation)  

Transmission of a response by the ST25TV02K/512 (ST25TV02K/512 modulate is load clocked at subcarrier  

rate)  

Operating field  

The ST25TV02K/512 operate continuously between the minimum and maximum values of the electromagnetic  

field H defined in

. The Reader has to generate a field within these limits.  

Power transfer  

Power is transferred to the ST25TV02K/512 by radio frequency at 13.56 MHz via coupling antennas in the  

ST25TV02K/512 and the Reader. The operating field of the reader is transformed on the ST25TV02K/512  

antenna to an AC voltage which is rectified, filtered and internally regulated. During communications, the  

amplitude modulation (ASK) on this received signal is demodulated by the ASK demodulator.  

Frequency  

The ISO 15693 standard defines the carrier frequency (f

C

) of the operating field as  

13.56 MHz

 

± 7 kHz.  

6.2  

RF protocol description  

6.2.1  

Protocol description  

The transmission protocol (or simply “the protocol”) defines the mechanism used to exchange instructions and  

data between the VCD (Vicinity Coupling Device) and the VICC (Vicinity integrated circuit card) in both directions.  

It is based on the concept of “VCD talks first”. The ST25TV02K/512 act as the VICC.  

This means that a ST25TV02K/512 do not start transmitting unless it has received and properly decoded an  

instruction sent by the VCD. The protocol is based on an exchange of:  

•

•

a request from the VCD to the ST25TV02K/512,  

a response from the ST25TV02K/512 to the VCD.  

DS12074

–

Rev 11  

page 25/90  

ST25TV02K ST25TV512  

RF protocol description  

Each request and each response are contained in a frame. The frames are delimited by a Start of Frame (SOF)  

and End of Frame (EOF).  

The protocol is bit-oriented. The number of bits transmitted in a frame is a multiple of eight (8), that is an integer  

number of bytes.  

A single-byte field is transmitted least significant bit (LSBit) first. A multiple-byte field is transmitted least  

significant byte (LSByte) first and each byte is transmitted least significant bit (LSBit) first.  

Figure 8.

ST25TV02K/512 protocol timing  

Request  

frame  

Request  

frame  

VCD  

Response  

frame  

Response  

frame  

ST25TV02K/512  

Timing  

t

1  

t

2  

t

1  

t

2  

6.2.2  

ST25TV02K/512 states referring to protocol  

The ST25TV02K/512 can be in one of four states:  

•

•

•

•

Power-off  

Ready  

Quiet  

Selected  

Transitions between these states are specified in

and

.  

Power-off state  

The ST25TV02K/512 are in the power-off state when it does not receive enough energy from the VCD.  

Ready state  

The ST25TV02K/512 are in the Ready state when it receives enough energy from the VCD. When in the Ready  

state, the ST25TV02K/512 answer any request where the Select_flag is not set.  

Quiet state  

When in the Quiet state, the ST25TV02K/512 answer any request with the Address_flag set, except for Inventory  

requests.  

Selected state  

In the Selected state, the ST25TV02K/512 answer any request in all modes (see

):  

•

•

•

Request in Select mode with the Select_flag set  

Request in Addressed mode if the UID matches  

Request in Non-Addressed mode as it is the mode for general requests  

DS12074

–

Rev 11  

page 26/90  

ST25TV02K ST25TV512  

RF protocol description  

Table 31.

response depending on Request_flags  

Address_flag  

0

Select_flag  

1 0  

Flags  

1

Addressed Non

 

addressed Selected Non

 

selected  

ST25TV02K/512 in Ready or Selected state (Devices in Quiet state  

do not answer)  

–

–

X

X

–

–

X

–

X

–

ST25TV02K/512 in Selected state  

ST25TV02K/512 in Ready, Quiet or Selected state (the device  

which matches the UID)  

X

X

X

–

Error (03h) or no response (command dependent)  

–

X

Figure 9.

state transition diagram  

Power off  

Out of field  

after t

RF_OFF  

In RF field  

Any other command  

where Select_Flag  

is not set  

Ready  

Inventory  

Out of RF field  

after t

RF_OFF  

Out of RF field  

after t

RF_OFF  

Select (UID)  

Quiet  

Selected  

Stay quiet(UID)  

Any other command where the  

Address_Flag is set AND where  

the Inventory_Flag is not set  

Any other command  

1.  

The ST25TV02K/512 return to the Power Off state if the tag is out of the field for at least t

RF_OFF

.  

The intention of the state transition method is that only one ST25TV02K/512 should be in the Selected state at a  

time.  

When the Select_flag is set to 1, the request shall NOT contain a unique ID.  

When the address_flag is set to 0, the request shall NOT contain a unique ID.  

6.2.3  

Modes  

The term “mode” refers to the mechanism used in a request to specify the set of ST25TV02K/512 devices that  

shall execute the request.  

Addressed mode  

When the Address_flag is set to 1 (Addressed mode), the request contains the Unique ID (UID) of the addressed  

ST25TV02K/512.  

DS12074

–

Rev 11  

page 27/90  

ST25TV02K ST25TV512  

RF protocol description  

Any ST25TV02K/512 that receive a request with the Address_flag set to 1 compares the received Unique ID to its  

own. If it matches, then the ST25TV02K/512 execute the request (if possible) and return a response to the VCD  

as specified in the command description.  

If the UID does not match, then it remains silent.  

Non-addressed mode (general request)  

When the Address_flag is cleared to 0 (Non-Addressed mode), the request does not contain a UID.  

Select mode  

When the Select_flag is set to 1 (Select mode), the request does not contain a unique ID. The ST25TV02K/512 in  

the Selected state that receives a request with the Select_flag set to 1 executes it and returns a response to the  

VCD as specified in the command description.  

Only the ST25TV02K/512 in the Selected state answers a request where the Select_flag is set to 1.  

The system design ensures that only one ST25TV02K/512 can be in the Select state at a time.  

6.2.4  

Request format  

The request consists of:  

•

•

•

•

•

•

an SOF  

flags  

a command code  

parameters and data  

a CRC  

an EOF  

Table 32.

General request format  

SOF  

Request_flags  

Command code  

Parameters  

Data  

2 byte CRC  

EOF  

6.2.5  

Request flags  

In a request, the “flags” field specifies the actions to be performed by the ST25TV16K/64K and whether  

corresponding fields are present or not.  

The flags field consists of eight bits. Bit 3 (Inventory_flag) of the request flag defines the contents of the four  

MSBs (bits 5 to 8). When bit 3 is reset (0), bits 5 to 8 define the ST25TV16K/64K selection criteria. When bit 3 is  

set (1), bits 5 to 8 define the ST25TV16K/64K Inventory parameters.  

Table 33.

Definition of request flags 1 to 4  

Bit No  

Flag  

Level  

Description  

A single subcarrier frequency is used by the ST25TV16K/64K  

Two subcarriers are used by the ST25TV16K/64K  

Low data rate is used  

0

1

0

1

Subcarrier_flag

Bit 1  

Data_rate_flag

Inventory_flag  

Bit 2  

Bit 3  

Bit 4  

High data rate is used  

The meaning of flags 5 to 8 is described in

0

1

The meaning of flags 5 to 8 is described in

0

1

No Protocol format extension  

Protocol_extension_flag  

Protocol format extension. Reserved for future use.  

1. Subcarrier_flag

 

refers to the ST25TV16K/64K-to-VCD communication.  

2. Data_rate_flag

 

refers to the ST25TV16K/64K-to-VCD communication.  

DS12074

–

Rev 11  

page 28/90  

ST25TV02K ST25TV512  

RF protocol description  

Table 34.

Request flags 5 to 8 when inventory_flag, Bit 3 = 0  

Bit nb  

Flag  

Level  

Description  

0

1

The request is executed by any ST25TV16K/64K according to the setting of Address_flag  

The request is executed only by the ST25TV16K/64K in Selected state  

Select flag

Bit 5  

The request is not addressed. UID field is not present. The request is executed by all  

ST25TV16K/64Ks.  

0

1

Bit 6  

Address flag  

The request is addressed. UID field is present. The request is executed only by the  

ST25TV16K/64K whose UID matches the UID specified in the request.  

0

1

0

Option not activated.  

Bit 7  

Bit 8  

Option flag  

RFU  

Option activated.  

–

1. If

 

the Select_flag is set to 1, the Address_flag is set to 0 and the UID field is not present in the request.  

Table 35.

Request flags 5 to 8 when inventory_flag, Bit 3 = 1  

Bit nb  

Flag  

Level  

Description  

AFI field is not present  

0

1

0

1

0

0

Bit 5  

AFI flag  

AFI field is present  

16 slots  

Bit 6  

Nb_slots flag  

1 slot  

Bit 7  

Bit 8  

Option flag  

RFU  

–

–

6.2.6  

Response format  

The response consists of:  

•

•

•

•

•

an SOF  

flags  

parameters and data  

a CRC  

an EOF  

Table 36.

General response format  

SOF  

Response_flags  

Parameters  

Data  

2-byte CRC  

EOF  

6.2.7  

Response flags  

In a response, the flags indicate how actions have been performed by the ST25TV02K/512 and whether  

corresponding fields are present or not. The response flags consist of eight bits.  

DS12074

–

Rev 11  

page 29/90  

ST25TV02K ST25TV512  

Timing definition  

Table 37.

Definitions of response flags 1 to 8  

Bit Nb  

Bit 1  

Flag  

Error_flag  

Level  

Description  

0

1

0

0

0

0

0

0

0

No error  

Error detected. Error code is in the “Error” field.  

Bit 2  

Bit 3  

Bit 4  

Bit 5  

Bit 6  

Bit 7  

Bit 8  

RFU  

RFU  

RFU  

RFU  

RFU  

RFU  

RFU  

–

–

–

–

–

–

–

6.2.8  

Response and error code  

If the Error_flag is set by the ST25TV02K/512 in the response, the Error code field is present and provides  

information about the error that occurred.  

Error codes not specified in

are reserved for future use.  

Table 38.

Response error code definition  

Error code  

Meaning  

01h  

02h  

03h  

0Fh  

10h  

11h  

12h  

13h  

14h  

15h  

Command is not supported.  

Command is not recognized (format error).  

The option is not supported.  

Error with no information given.  

The specified block is not available.  

The specified block is already locked and thus cannot be locked again.  

The specified block is locked and its contents cannot be changed.  

The specified block was not successfully programmed.  

The specified block was not successfully locked.  

The specified block is protected in read.  

No response  

It might indicate illegal programming  

6.3  

Timing definition  

t

1

: VICC response delay  

Upon detection of the rising edge of the EOF received from the VCD, the ST25TV02K/512 wait for a t

1nom

time  

before transmitting their response to a VCD request or switching to the next slot during an inventory process.  

Values of t

1

are given in

.  

t

2

: VCD new request delay  

t

2

is the time after which the VCD may send an EOF to switch to the next slot when one or more ST25TV02K/512  

responses have been received during an Inventory command. It starts from the reception of the EOF from the  

ST25TV02K/512s.  

The EOF sent by the VCD may be either 10% or 100% modulated regardless of the modulation index used for  

transmitting the VCD request to the ST25TV02K/512.  

DS12074

–

Rev 11  

page 30/90  

ST25TV02K ST25TV512  

RF commands  

t

2

is also the time after which the VCD may send a new request to the ST25TV02K/512, as described in  

.  

Values of t

2

are given in

.  

t

3

: VCD new request delay when no response is received from the VICC  

t

3

is the time after which the VCD may send an EOF to switch to the next slot when no ST25TV02K/512 response  

has been received.  

The EOF sent by the VCD may be either 10% or 100% modulated regardless of the modulation index used for  

transmitting the VCD request to the ST25TV02K/512.  

From the time the VCD has generated the rising edge of an EOF:  

•

If this EOF is 100% modulated, the VCD waits for a time at least equal to t

3min

for 100% modulation before  

sending a new EO

F

.  

•

If this EOF is 10% modulated, the VCD waits for a time at least equal to t

3min

for 10% modulation before  

sending a new EO

F

.  

Table 39.

Timing values  

Minimum (min) values  

Nominal (nom) values  

Maximum (max) values  

100% modulation  

10% modulation  

4384 / f

 

= 323.3 µs

t

1

t

2

t

3

4320 / f

 

= 318.6 µs  

4352 / f

 

= 320.9 µs  

c

c

c

4192 / f

 

= 309.2 µs  

No t  

No t  

No t  

c

nom  

nom  

max  

max  

No t  

t

t

NRT 2min  

1max  

SOF  

1max  

1. VCD

 

request will not be interpreted during the first milliseconds following the field rising.  

2.  

3.  

4.  

t

does not apply for write-alike requests. Timing conditions for write-alike requests are defined in the command  

1max  

description.  

is the time taken by the ST25TV02K/512 to transmit an SOF to the VCD. t  

t

depends on the current data rate: High  

SOF  

SOF  

data rate or Low data rate.  

is the nominal response time of the ST25TV02K/512. t  

t

depends on VCD to ST25TV02K/512 data rate and  

NRT  

NRT  

sub-carrier modulation mode.  

Note:  

The tolerance of specific timing is ±32 / f

C

.  

6.4  

RF commands  

6.4.1  

RF command code list  

The ST25TV02K/512 support the following legacy and extended RF command set:  

•

•

Inventory

, used to perform the anticollision sequence.  

Stay Quiet

, used to put the ST25TV02K/512 in quiet mode, where it does not respond to any inventory  

command.  

•

Select

, used to select the ST25TV02K/512. After this command, the ST25TV02K/512 process all Read/  

Write commands with Select_flag set.  

•

•

•

Reset To Ready

, used to put the ST25TV02K/512 in the ready state.  

Read Single Block

, used to output the 32 bit of the selected block and its locking status.  

Write Single Block

, used to write and verify the new content for an update of a 32 bit block, provided that it  

is not in a locked memory area.  

•

Read Multiple Blocks

, used to read the selected 32 bit blocks and their locking statuses, and send back  

their value.  

•

•

•

Write AFI

, used to write the 8-bit value in the AFI register.  

Lock AFI

, used to lock the AFI register.  

Write DSFID

, used to write the 8-bit value in the DSFID register.  

DS12074

–

Rev 11  

page 31/90  

ST25TV02K ST25TV512  

RF commands  

•

•

•

Lock DSFID

, used to lock the DSFID register.  

Get System information

, used to provide the standard system information values.  

Write Password

, used to update the 32 or 64 bit of the selected areas or configuration password, but only  

after presenting the current one.  

•

•

•

Lock Block

, used to lock any user blocks.  

Present Password

, enables the user to present a password to open a security session.  

Fast Read Single Block

, used to output the 32 bits of the selected block and its locking status at doubled  

data rate.  

•

Fast Read Multiple Blocks

, used to output the selected blocks in one or multiple areas providing the  

access rights are granted at doubled data rate.  

•

•

•

•

Get multiple block security status

, used to send the security status of the selected block.  

Initiate

, used to trigger the tag response to the Inventory Initiated sequence.  

Inventory Initiated

, used to perform the anti-collision sequence triggered by the Initiate command.  

Fast Initiate

, used to trigger the tag response to the Fast Inventory Initiated sequence (fast commands are  

with higher data rate).  

•

Fast Inventory Initiated

, used to perform the anti-collision sequence triggered by the Fast Initiate  

command.  

•

•

Inventory read

performs anti-collision sequence then output selected blocks  

Fast Inventory read

performs inventory command then execute a read with data returned at doubled data  

rate.  

•

•

•

•

Lock Kill

, used to lock the Kill or untraceable mode password.  

Kill

, used to definitively deactivate the tag.  

Set EAS

, activates the EAS feature if the EAS feature is not locked. (Not protected by password or locked)  

Reset EAS

, deactivates the EAS feature if the EAS feature is not locked. (not protected by password or  

locked)  

•

Enable EAS

, ST25TV02K/512 answer to this command only if EAS state is set. Response will include the  

EAS

T

e

legram (32 up to 256 bits depending on the EAS config)  

•

•

Write EAS ID

writes a new EAS identifier Number. (Protected by configuration password).  

Write EAS CONFIG

, used to configure the EAS telegram data length with 2bits 00 = 256 bits 01= 128 bits  

10 = 64 bits 11= 32 bits (protected by configuration password).  

•

•

•

Lock EAS

will lock EAS mode: (reset / set) and EAS ID and the EAS

T

e

legram.  

Read Configuration

used to read the counter values, the tamper detect status, and the number of Area.  

Write Configuration

allows to enable the counter configuration, clear counter, set number of Area (1 or 2)  

and their access rights, and lock the configuration block.  

•

•

Set Untraceable mode

: sets the untraceable mode.  

Get Random Number

: generates a 16 bit number.  

DS12074

–

Rev 11  

page 32/90  

ST25TV02K ST25TV512  

RF commands  

6.4.2  

Command codes list  

The ST25TV02K/512 support the commands described in this section. Their codes are given in  

.  

Table 40.

Command codes  

Command code  

standard  

Command code  

custom  

Function  

Function  

01h  

02h  

20h  

21h  

22h  

23h  

25h  

26h  

27h  

28h  

29h  

2Ah  

2Bh  

A5h  

A6h  

A7h  

A8h  

B1h  

B2h  

B3h  

B4h  

BAh  

C0h  

C1h  

C2h  

2Ch  

C3h  

A0h  

A1h  

A2h  

A3h  

A4h  

D1h  

D2h  

D3h  

D4h  

–

–

6.4.3  

General Command Rules  

In case of a valid command, the following paragraphs will describe the expected behavior for each command.  

But in case of an invalid command, in a general manner, the ST25TV02K/512 will behave as follows:  

1.  

If flag usage is incorrect, the error code 03h will be issued only if the right UID is used in the command,  

otherwise no response will be issued.  

2.  

The error code 02h will be issued if the custom command is used with the manufacturer code different from  

the ST one  

6.4.4  

Inventory  

Upon receiving the Inventory request, the ST25TV02K/512 run the anticollision sequence. The Inventory_flag is  

set to 1. The meaning of flags 5 to 8 is shown in .  

The request parameters:  

•

•

•

•

Request flags  

AFI if the AFI flag is set  

Mask length  

Mask value if mask length is different from 0  

The ST25TV02K/512 do not generate any answer in case of error.  

DS12074

–

Rev 11  

page 33/90  

ST25TV02K ST25TV512  

RF commands  

Table 41.

Inventory request format  

Request SOF  

Request_flags  

Inventory  

Optional AFI  

Mask length  

Mask value

 

CRC16 Request

 

EOF  

–

8 bits  

01h  

8 bits  

8 bits  

0 – 64 bits  

16 bits  

–

The response contains:  

•

•

the flags  

the Unique ID  

Table 42.

Inventory response format  

Response SOF  

Response_flags  

DSFID  

8 bits  

UID  

64 bits  

CRC16  

16 bits  

Response EOF  

–

8 bits  

–

During an Inventory process, if the VCD does not receive an RF ST25TV02K/512 response, it waits for a time t

3  

before sending an EOF to switch to the next slot. t

3

starts from the rising edge of the request EOF sent by the  

VCD.  

•

•

•

•

If the VCD sends a 100% modulated EO

F

,

t

he minimum value of t

3

is:  

t

3

min = 4384/f

C

(323.3µs) + t

SOF  

If the VCD sends a 10% modulated EO

F

,

t

he minimum value of t

3

is:  

t

3

min = 4384/f

C

(323.3µs) +

 

t

NRT

+ t

2min  

where:  

•

•

t

SOF

is the time required by the ST25TV02K/512 to transmit an SOF to the VCD,  

t

NRT

is the nominal response time of the ST25TV02K/512.  

t

NRT

and t

SOF

are dependent on the ST25TV02K/512-to-VCD data rate and subcarrier modulation mode.  

Note:  

In case of error, no response is sent by ST25TV02K/512.  

6.4.5  

Stay Quiet  

On receiving the Stay Quiet command, the ST25TV02K/512 enter the Quiet state if no error occurs, and does  

NOT send back a response. There is NO response to the Stay Quiet command even if an error occurs.  

When in the Quiet state:  

•

•

the ST25TV02K/512 do not process any request if the Inventory_flag is set,  

the ST25TV02K/512 process any request with Address_flag set.  

The ST25TV02K/512 exit the Quiet state when:  

•

•

•

it is reset (power off),  

receiving a Select request. It then goes to the Selected state,  

receiving a Reset to Ready request. It then goes to the Ready state.  

Request parameters:  

•

•

request flags  

UID  

Table 43.

Stay Quiet request format  

Request SOF  

Request flags  

8 bits  

Stay Quiet  

UID  

64 bits  

CRC16  

16 bits  

Request EOF  

–

02h  

–

The Stay Quiet command must always be executed in Addressed mode (Select_flag is reset to 0 and  

Address_flag is set to 1).  

DS12074

–

Rev 11  

page 34/90  

ST25TV02K ST25TV512  

RF commands  

Figure 10.

Stay Quiet frame exchange between VCD and ST25TV02K/512  

VCD  

Stay Quiet  

request  

SOF  

EOF  

ST25TV02K/512  

6.4.6  

Read Single Block  

On receiving the Read Single Block command, the ST25TV02K/512 read the requested block and sends back its  

32-bit value in the response. The Option_flag is supported, when set response include the Block Security Status.  

Block number is coded on 1 Byte.  

Table 44.

Read Single Block request format  

UID

Request SOF  

Request_flags  

8 bits  

Read Single Block  

20h  

Block number  

8 bits  

CRC16  

Request EOF  

–

64 bits  

16 bits  

–

1. The

 

field is optional.  

Request parameters:  

•

•

•

Request flags  

UID (optional)  

Block number  

Table 45.

Read Single Block response format when Error_flag is NOT set  

Block security status

8 bits  

Response SOF  

Response_flags  

8 bits  

Data  

CRC16  

Response EOF  

–

32 bits  

16 bits  

–

1. The

 

field is optional.  

Response parameters:  

•

•

Block security status if Option_flag is set (see

)  

Four bytes of block data  

Table 46.

Block security status  

b

7

b

6

b

5

b

b

3

b

2

b

1

b

0

4

Reserved for future use.  

All at 0.  

0: Current block not locked  

1: Current block locked  

Table 47.

Read Single Block response format when Error_flag is set  

Response SOF  

Response_flags  

Error code  

8 bits  

CRC16  

16 bits  

Response EOF  

–

8 bits  

–

Response parameter:  

DS12074

–

Rev 11  

page 35/90  

ST25TV02K ST25TV512  

RF commands  

•

Error code as Error_flag is set  

–

–

–

03h: command option not supported  

10h: the specified block is not available  

15h: the specified block is read-protected  

Figure 11.

Read Single Block frame exchange between VCD and ST25TV02K/512  

Read Single Block  

VCD  

SOF  

EOF  

request  

Read Single Block  

response  

ST25TV02K/512  

t

1  

SOF  

EOF  

6.4.7  

Write Single Block  

On receiving the Write Single Block command, the ST25TV02K/512 write the data contained in the request to the  

targeted block and reports whether the write operation was successful in the response. When the Option_flag is  

set, wait for EOF to respond.  

During the RF write cycle W

t

, there should be no modulation (neither 100% nor 10%), otherwise the  

ST25TV02K/512 may not program correctly the data into the memory. The W

t

time is equal to t

1nom

+ N ×  

302 µs (N is an integer).  

Block number is coded on 1 Byte and only first 256 blocks of ST25TV02K/512 can be addressed using this  

command.  

Table 48.

Write Single Block request format  

UID

Request SOF  

Request_flags  

Write Single Block  

21h  

Block number  

64 bits

 

8 bits  

Data  

CRC16 Request

 

EOF  

–

8 bits  

32 bits

 

16 bits  

–

1. The

 

field is optional.  

Request parameters:  

•

•

•

•

Request flags  

UID (optional)  

Block number  

Data  

Table 49.

Write Single Block response format when Error_flag is NOT set  

Response SOF  

Response_flags  

CRC16  

16 bits  

Response EOF  

–

8 bits  

–

Response parameter:  

No parameter. The response is sent back after the writing cycle.  

•

DS12074

–

Rev 11  

page 36/90  

ST25TV02K ST25TV512  

RF commands  

Table 50.

Write Single Block response format when Error_flag is set  

Response SOF  

Response_flags  

Error code  

8 bits  

CRC16  

16 bits  

Response EOF  

–

8 bits  

–

Response parameter:  

Error code as Error_flag is set  

•

–

–

–

–

03h: command option not supported

10h: the specified block is not available  

12h: the specified block is locked or protected and its contents cannot be changed  

13h: the specified block was not successfully programmed  

1. For

 

more details, see

Figure 12.

Write Single Block frame exchange between VCD and ST25TV02K/512  

Write Single  

Block request  

VCD  

SOF  

EOF  

Write Single  

Block response  

Write sequence  

when error  

ST25TV02K/512  

ST25TV02K/512  

t

1  

SOF  

EOF  

SOF  

Write Single  

Block response  

W

t  

EOF  

When the Option_flag is set, wait for EOF to respond.  

Block number is coded on 1 Byte.  

6.4.8  

Lock block  

On receiving the Lock block request, the ST25TV02K/512 lock the single block value permanently and protects its  

content against new writing.  

This command is applicable for all blocks of the user memory.  

For a global protection of a area, update accordingly the AiSS bits in the system area. The Option_flag is  

supported, when set wait for EOF to respond.  

During the RF write cycle W

t

, there should be no modulation (neither 100% nor 10%), otherwise the  

ST25TV02K/512 may not lock correctly the single block value in memory. The W

t

time is equal to t

1nom

+ N  

× 302 µs (N is an integer).  

Table 51.

Locking scheme  

Area x access rights  

Area access description  

Lock feature behavior  

Lock possible  

RW_PROTECTION_Ax [1:0]  

Area readable and writable  

00b  

Lock only possible if security session is open  

Error = 14h if Security Session is closed  

Area protected in write by password  

Area protected in read and write by password  

01b  

10b  

Lock only possible if security session is open  

DS12074

–

Rev 11  

page 37/90  

ST25TV02K ST25TV512  

RF commands  

Area x access rights  

RW_PROTECTION_Ax [1:0]  

Area access description  

Lock feature behavior  

Error = 14h if Security Session is closed  

Area protected in read.  

No lock is possible  

11b  

Area disabled in write (no matter if security session  

opened or not)  

Error = 11h (already locked)  

Table 52.

Lock block request format  

UID

Request SOF  

Request_flags  

8 bits  

Lock block  

22h  

block number  

8 bits  

CRC16  

Request EOF  

–

64 bits  

16 bits  

–

1. The

 

field is optional.  

Request parameter:  

•

•

•

Request Flags  

UID (optional)  

Block number (only value 00h or 01h) are allowed to protect the CCfile in case of NDEF usage.  

Table 53.

Lock block response format when Error_flag is NOT set  

Response SOF  

Response_flags  

CRC16  

16 bits  

Response EOF  

–

8 bits  

–

Response parameter:  

•

No parameter  

Table 54.

Lock single block response format when Error_flag is set  

Response SOF  

Response_flags  

Error code  

8 bits  

CRC16  

16 bits  

Response EOF  

–

8 bits  

–

Response parameter:  

Error code as Error_flag is set  

•

–

–

–

–

03h: command option not supported  

10h: block not available  

11h: the specified block is already locked and thus cannot be locked again  

14h: the specified block was not successfully locked  

DS12074

–

Rev 11  

page 38/90  

ST25TV02K ST25TV512  

RF commands  

Figure 13.

Lock single block frame exchange between VCD and ST25TV02K/512  

Lock block  

request  

VCD  

SOF  

EOF  

Lock block  

response  

Lock sequence  

when error  

ST25TV02K/512  

ST25TV02K/512  

t

1  

SOF  

EOF  

SOF  

Lock block  

response  

W

t  

EOF  

6.4.9  

Read Multiple Blocks  

When receiving the Read Multiple Block command, the ST25TV02K/512 read the selected blocks and sends back  

their value in multiples of 32 bits in the response. The blocks are numbered from 00h to 3Fh in the request and  

the value is minus one (-1) in the field. For example, if the “Number of blocks” field contains the value 06h, seven  

blocks are read. When the Option_flag is set, the response returns the Block Security Status.  

When a read multiple starts in an area with read access authorized and finishes in an area without read access  

authorized, only the data available in the area with read access authorized is returned. When a read access starts  

in an area with no read access authorized, an error is returned.  

Block number is coded on 1 Byte.  

Table 55.

Read Multiple Block request format  

Read Multiple  

Block  

First block  

number  

UID

Request SOF

 

Request_flags  

8 bits  

Number of blocks

 

CRC16 Request

 

EOF  

–

23h  

64 bits

 

8 bits  

8 bits  

16 bits  

–

1. The

 

field is optional.  

Request parameters:  

•

•

•

•

Request flags  

UID (optional)  

First block number  

Number of blocks  

Table 56.

Read Multiple Block response format when Error_flag is NOT set  

Response_  

Block security status

Response SOF  

Data  

CRC16  

Response EOF  

flags  

8 bits

32 bits

–

8 bits  

16 bits  

–

1. The

 

field is optional.  

2. Repeated

 

as needed.  

Response parameters:  

•

•

Block security status if Option_flag is set (see

)  

N blocks of data  

DS12074

–

Rev 11  

page 39/90  

ST25TV02K ST25TV512  

RF commands  

Table 57.

Block security status  

b

7

b

b

5

b

4

b

3

b

b

1

b

0