Essel Technology RFID A1 User manual

1
RFID A1 Module User Manual
V1.183
Table of Contents
1 Introduction...............................................................................................................................................................4
1.1 Device Overview ................................................................................................................................................4
1.2 Pinout.................................................................................................................................................................5
1.3 Application.........................................................................................................................................................6
2 Electrical Characteristics............................................................................................................................................7
2.1 Test Conditions ..................................................................................................................................................7
2.2 Absolute Maximum Ratings...............................................................................................................................7
2.3 Operating Conditions.........................................................................................................................................7
2.4 Current Consumption ........................................................................................................................................7
2.5 GPIO...................................................................................................................................................................8
2.6 Antenna Output.................................................................................................................................................8
2.7 Communication Buses .......................................................................................................................................9
2.8 Flash...................................................................................................................................................................9
3 System .....................................................................................................................................................................10
3.1 Overview..........................................................................................................................................................10
3.2 Modules...........................................................................................................................................................12
3.2.1 Core..........................................................................................................................................................12
3.2.2 RFID..........................................................................................................................................................12
3.2.3 Communication System...........................................................................................................................12
3.2.4 Power Manager .......................................................................................................................................12
3.3 Memory Map...................................................................................................................................................13
3.3.1 Result Register.........................................................................................................................................15
3.3.2 Command Register ..................................................................................................................................16
3.3.3 Command Parameters Register...............................................................................................................16
3.3.4 Tag UID Register ......................................................................................................................................17
3.3.5 Tag Type Register.....................................................................................................................................17

2
3.3.6 Tag UID Size Register ...............................................................................................................................18
3.3.7 Data Buffer...............................................................................................................................................18
3.3.8 Password Register....................................................................................................................................18
3.3.9 AES Initialization Vector Register.............................................................................................................19
3.3.10 AES Key Register ......................................................................................................................................19
3.3.11 Authentication Key / Password Register .................................................................................................20
3.3.12 User Memory...........................................................................................................................................20
4 Functional Description.............................................................................................................................................21
4.1 Overview..........................................................................................................................................................21
4.2 Commands.......................................................................................................................................................21
4.2.1 Get UID and Type (0x01)..........................................................................................................................23
4.2.2 Read Block (0x02) ....................................................................................................................................24
4.2.3 Write Block (0x03) ...................................................................................................................................25
4.2.4 Read Data Block (0x04)............................................................................................................................26
4.2.5 Write Data Block (0x05)...........................................................................................................................27
4.2.6 Read Page (0x06) .....................................................................................................................................28
4.2.7 Write Page (0x07) ....................................................................................................................................29
4.2.8 Encrypt Data (0x08) .................................................................................................................................30
4.2.9 Decrypt Data (0x09).................................................................................................................................32
4.2.10 Read Value (0x0A)....................................................................................................................................34
4.2.11 Write Value (0x0B)...................................................................................................................................35
4.2.12 Increment Value (0x0C) ...........................................................................................................................36
4.2.13 Decrement Value (0x0D) .........................................................................................................................37
4.2.14 Restore Value (0x0E)................................................................................................................................38
4.2.15 Transfer Value (0x0F)...............................................................................................................................39
4.2.16 Recover Value (0x10)...............................................................................................................................40
4.2.17 Get Version (0x11) ...................................................................................................................................41
4.2.18 Read Signature (0x12)..............................................................................................................................42
4.2.19 Configure UID (0x13) ...............................................................................................................................42
4.2.20 Read Counter (0x14)................................................................................................................................44
4.2.21 Increment Counter (0x15) .......................................................................................................................45
4.2.22 Check Tearing Event (0x16) .....................................................................................................................46

3
4.2.23 Password Authentication (0x17) .............................................................................................................47
4.2.24 Halt (0x18) ...............................................................................................................................................48
4.2.25 Calculate CRC (0x19)................................................................................................................................48
4.2.26 Copy Data (0x1A) .....................................................................................................................................50
4.2.27 Unlock (0x1B)...........................................................................................................................................50
4.2.28 Lock (0x1C)...............................................................................................................................................51
4.2.29 Get Module Version (0x1D) .....................................................................................................................51
4.2.30 Reset to Default (0x1E)............................................................................................................................51
4.3 Power Down Mode..........................................................................................................................................52
4.4 Memory Locking ..............................................................................................................................................52
5 Communication Interface........................................................................................................................................53
5.1 nBUSY line........................................................................................................................................................53
5.2 SPI Bus..............................................................................................................................................................53
5.2.1 Bus signals and timings requirements.....................................................................................................53
5.2.2 Exchanging data (reading or reading and writing) ..................................................................................54
5.2.3 Command processing ..............................................................................................................................55
5.3 I2C Bus .............................................................................................................................................................56
5.3.1 I2C Address Construction ........................................................................................................................56
5.3.2 Writing to the memory............................................................................................................................56
5.3.3 Reading from the memory ......................................................................................................................57
6 Mechanical...............................................................................................................................................................58
6.1 Dimensions ......................................................................................................................................................58
6.2 Recommended Footprint ................................................................................................................................59

4
1Introduction
1.1 Device Overview
Features
Low cost RFID Reader with Mifare
Classic, Ultralight and NTAG2 support
Command interface via I2C and SPI
I2C speed up to 400kHz
SPI speed up to 500kHz
Compact form factor
Castellated SMT pads for easy and
reliable PCB mounting
High transponder read and write
speed
Low power design
Single operating voltage: 2.5V to 3.6V
-25°C to 85°C operating range
AES-128 encryption engine
RoHS compliant
Applications
Access control
Monitoring goods
Approval and monitoring
consumables
Pre-payment systems
Managing resources
Connection-less data storage
systems
Description
The RFID A1 module is the first in an evolving family of 13.56MHz
sub assemblies from Eccel Technology Ltd (IB Technology). The
product is designed with embedded applications in mind. This
product is an ideal design choice if the user wishes to add RFID
capability to their design quickly and without requiring extensive
RFID and embedded software expertise and time. An on board
low power ARM microcontroller handles the RFID configuration
setup and provides the user with a powerful yet simple
command interface to facilitate fast and easy read/write access
to the memory and features of the various transponders
supported by this module.
The module simply requires a single power and GND connection
from the user PCB, along with two connections to an antenna.
Eccel Technology Ltd (IB Technology) provide a range of suitable
antennas designed for use with this module.

5
1.2 Pinout
Table 1.1
Pin Number Symbol Type Description
1 GND Ground
2 nRESET
Digital input with
pull-up
Reset input signal (active low). This pin requires no external pull-up / down resitor
unless the module is used in noisy environments, in which case connection of an
external pull-up resistor combined with HF filter is recommended.
3 nBUSY
Digital push-pull
output
Busy signal output indicating the device is working and the user should wait with
any communication (active low) except status reading.
4 nPWRDN
Digital input with
no pull resistors
Power Down Request input signal (active low). This pin has no pull-up/down
resistor and should NOT be left floating. For power optimization it is
recommended that the user drives this pin with a push-pull GPIO or similar.
5 I2C SDA
Digital input-
outut with no pull
resistors
Data input / output for the I2C Interface Bus. This pin has no pull-up / down
resistor and should not be left floating. When using I2C communication external
pull-up resistor is required matching the I2C bus requirements.
6 I2C SCL
Digital input with
no pull resistors
Clock input for the I2C Interface Bus. This pin has no pull-up/down resistor and
should not be left floating. External pull-up resistor is required matching the I2C
bus requirements.
7 SPI MISO
Digital push-pull
output
Master In Slave Out output for the Serial Peripheral Interface Bus.
8 SPI MOSI
Digital input with
no pull resistors
Master Out Slave In input for for the Serial Peripheral Interface Bus.
9 SPI CS
Digital input with
no pull resistors
Chip Select input for the Serial Peripheral Interface Bus. This pin has no pull-up /
down resistor and should not be left floating.
10 SPI CLK
Digital input with
no pull resistors
Clock input for the Serial Peripheral Interface Bus. This pin has no pull-up / down
resistor and should not be left floating.
11 GND Ground
12 GND Ground
13 I2C AD2
Digital input with
no pull resistors
Digital input for configuring the I2C Address bit 2. Value is sampled after the reset
or power up. This pin has no pull-up / down resistor and should not be left floating.
14 I2C AD1
Digital input with
no pull resistors
Digital input for configuring the I2C Address bit 1. Value is sampled after the reset
or power up. This pin has no pull-up / down resistor and should not be left floating.
15 I2C AD0
Digital input with
no pull resistors
Digital input for configuring the I2C Address bit 0. Value is sampled after the reset
or power up. This pin has no pull-up / down resistor and should not be left floating.
16 NOT USED - -
17 NOT USED - -
18 VDD Power supply pin
Power Supply pin. Low ESR capacitor with capacitance 10uF or higher should be
connected close to this pin.
19 GND Ground
20 ANT2 Analog output Antenna output.
21 ANT1 Analog output Antenna output.
22 GND Ground

6
1.3 Application
The RFID A1 module is specifically designed for embedded applications, where a fast or low pin count connection to
a host microcontroller is required. Fastest data exchange speed can be obtained by using the Serial Peripheral
Interface Bus. The lowest pin count connection can be achieved by using the I2C Bus. For the module to be a fully
functional RFID reader/writer it only requires connection to a power supply and antenna. Eccel Technology Ltd
manufactures a wide range of such antennas designed to give optimal performance with this module. Please contact
us for further details of our range of antennas.

7
2Electrical Characteristics
2.1 Test Conditions
Typical device parameters have been measured at ambient temperature 22°C ±3°C and a power supply of 3.3V ±5%.
2.2 Absolute Maximum Ratings
Table 2.1
2.3 Operating Conditions
Table 2.2
2.4 Current Consumption
Table 2.3
Symbol Parameter Min Max Uni t Notes
TSStorage Temperature -40 150 °C Tested for 10'000 hours at 150°C.
VDDMAX Supply Voltage 0 3.8 V
VIOMAX Input Pin Voltage -0.3 VDD + 0.3 V
IIOMAX Output Pin Current 0 6 mA
IANT ANT1 and ANT2 Current 0 100 mA
Maximum continuous current. This depends upon the impedance of the
circuit between ANT1 and ANT2 at 13.56MHz.
Symbol Parameter Min Max Unit
TOAmbient Temperature -25 85 °C
VDD Supply Voltage 2.5 3.6 V
Symbol Parameter Typ Max Unit Comment
0.9 1.1 µA T = 25°C, Vdd = 3.3V.
1.8 µA Full range of temperature and power supply voltage.
20 40 nA T = 25°C, Vdd = 3.3V.
400 nA Full range of temperature and power supply voltage.
ITX Power Up Current 14 24 mA T = 25°C, Vdd = 3.3V, 50Ωantenna connected between ANT1 and ANT2.
ITXMAX Maximum Current 120 mA Maximum current consumed by the module in the worst conditions.
Iddle Current
IIDDLE
IPWRDN
Power Down State
Current

8
Current measurement was taken place with all digital input pins connected to Vdd. Pins number 16 and 17 was left
floating. Antenna was not connected except for the Power Up Current measurement and Maximum Current
measurement.
2.5 GPIO
Table 2.4
2.6 Antenna Output
Table 2.5
Symbol Parameter Min Typ Max Unit Notes
VIOIL Input Low Voltage 0.3VDD V
VIOIH Input High Voltage 0.7VDD V
IIOMAX Output Pin Current ± 6mA
IIOLEAK Input Leakage Current ± 0.1 ± 40 nA High impedance IO connected to VDD or GND.
RIOESD
Internal ESD Series
Resistor
200 Ω
VIOHYST IO Pin Histeresis 0.1VDD V
Symbol Parameter Min Typ Max Unit Notes
fANT
Antenna Signal
Frequency
13.56 MHz ±30 ppm (-20°C - 70°C).
fANTAG
Antenna Signal
Frequency Aging
0 3 ppm At 25°C.
VANTH
Antenna High Level
Output Voltage
VDD - 0.64 V VDD = 2.5V, IANT = 80mA.
VANTL
Antenna Low Level
Output Voltage
0.64 V VDD = 2.5V, IANT = 80mA.
IANT ANT1 and ANT2 Current 0 60 100 mA
Maximum continuous current. This depends upon the impedance of
the circuit between ANT1 and ANT2 at 13.56MHz.

9
2.7 Communication Buses
Table 2.6
2.8 Flash
Table 2.7
Symbol Parameter Min Typ Max Unit Notes
fI2CMAX
I2C Maximum Clock
Frequency
400 kHz
fSPIMAX
SPI Maximum Clock
Frequency
500 kHz
TCSCLK SPI CS To CLK Time Delay 2 µs
Minimum time delay between falling edge of Chip Select and first clock
edge.
TCSHMIN SPI CS high Minimum Time 50 µsMinimum time when CS is in HIGH state between SPI transmissions.
Symbol Parameter Min Typ Max Unit Notes
CFE
Flash Erase Cycles Before
Failure
20000 cycles
10 years For ambient temperature < 85°C
20 years For ambient temperature < 70°C
TFDR
Flash Data Retention Time

10
3System
3.1 Overview
The general overview of system components is shown in Figure 3.1. The system internally consists of four main parts:
CORE –the main processing part of the microcontroller firmware responsible for managing all system tasks,
parsing and the execution of commands received from the user’s master controller.
RFID –dedicated RFID IC together with its firmware drivers responsible for communication with the RFID tag.
COMMUNICATION SYSTEM –microcontroller’s peripherals (I2C and SPI) and its firmware drivers providing
communication functionality to the user.
POWER MANAGER –a subsystem responsible for managing power states and clocks in the module to
minimise power consumption during operation.

11
CORE
I2C
SPI
RFID
ANT1
ANT2
COMMUNICATION
SYSTEM
SDA
SCL
CS
CLK
MOSI
MISO
nBUSY
POWER MANAGER nPWRDN
ADDR0
ADDR1
ADDR2
Figure 3.1

12
3.2 Modules
3.2.1 Core
The core of the system shown above in figure 3.1, is the part of the modules’ hardware and firmware responsible for
managing tasks, prioritizing them and allocating resources to other components of the system. When the user sends
a command, the core is the part of the system which ensures that the command is executed properly, that the
outcome is saved and that a response is sent back to the user’s master controller.
3.2.2 RFID
The RFID component is the part of the hardware and module firmware responsible for the complete communication
interaction with the transponder via RF. In the RFID A1 module this part currently provides communication
capabilities with Mifare Classic, Ultralight and NTAG2 transponder types. The key features of this RFID section are
both fastest speed of transmission and system responsiveness, and optimal low power consumption.
3.2.3 Communication System
The Communication System component of the RFID A1 module is responsible for the entire communication with the
user master controller, together with parsing commands for subsequent execution by the module core. Two
communication interfaces are available: SPI and I2C. Both have equivalent access to the Communication System. It is
possible to communicate with the module using all two interfaces at the same time, but it is strongly recommended
to select and use only one at a time.
Communication peripherals are always active unless the nPWRDN signal is asserted. Doing so will put the module
into Deep Sleep Mode and turn off entire Communication System.
3.2.4 Power Manager
The Power Manager is the part of the firmware, together with hardware support, that manages the power states of
the system and tries to minimize power consumption as much as possible. The user has the option to put the module
into Power Down Mode by pulling low the nPWRDN pin.
When the system enters Power Down Mode, all clocks and submodules are disabled and no response to user
communication commands will occur until the system is re-enabled by the nPWDN being taken high by the user’s
system.

13
3.3 Memory Map
The device memory layout is shown below in Table 3.1.
In the RFID A1 module there are 728 bytes of user accessible memory. Each byte of the memory has a defined
factory default value and these values can be recovered by using the ‘Reset to Factory Defaults’ command. The first
288 bytes are volatile memory which also have a default reset state that is the same as the factory default value. The
other memory is buffered non-volatile memory and can be modified and stored using ‘Unlock’ and ‘Lock’ commands.
The RFID A1 module is automatically returned to factory default state if after power up there is no valid
configuration stored in non-volatile memory. The first 288 bytes of this user accessible memory are not stored in
non-volatile memory and are always reset to factory defaults after a power-up sequence or after exit from the Power
Down Mode.
Reading and writing to the registers can be done via one of two interfaces available on the module –I2C or SPI. The
rest of the memory is accessible only when the module is unlocked. The default state of the module after power up is
locked.

14
Table 3.1
Address [DEC] Address [HEX] Size [bytes] Description Access
Locked and Stored in non-
volatile memory
00x0000 1 Result Read Only No
10x0001 1 Command R / W No
20x0002 18 Command Parameters R / W No
20 0x0014 10 Tag UID Read Only No
30 0x001E 1 Tag Type Read Only No
31 0x001F 1 Tag UID Size Read Only No
32 0x0020 256 Data Buffer R / W No
288 0x0120 8 Password R / W when unlocked Yes
296 0x0128 16 AES Initialization Vector 0 R / W when unlocked Yes
312 0x0138 16 AES Initialization Vector 1 R / W when unlocked Yes
328 0x0148 16 AES Key 0 R / W when unlocked Yes
344 0x0158 16 AES Key 1 R / W when unlocked Yes
360 0x0168 6 Authentication Key / Password 0 R / W when unlocked Yes
366 0x016E 6 Authentication Key / Password 1 R / W when unlocked Yes
372 0x0174 6 Authentication Key / Password 2 R / W when unlocked Yes
378 0x017A 6 Authentication Key / Password 3 R / W when unlocked Yes
384 0x0180 6 Authentication Key / Password 4 R / W when unlocked Yes
390 0x0186 6 Authentication Key / Password 5 R / W when unlocked Yes
396 0x018C 6 Authentication Key / Password 6 R / W when unlocked Yes
402 0x0192 6 Authentication Key / Password 7 R / W when unlocked Yes
408 0x0198 6 Authentication Key / Password 8 R / W when unlocked Yes
414 0x019E 6 Authentication Key / Password 9 R / W when unlocked Yes
420 0x01A4 6 Authentication Key / Password 10 R / W when unlocked Yes
426 0x01AA 6 Authentication Key / Password 11 R / W when unlocked Yes
432 0x01B0 6 Authentication Key / Password 12 R / W when unlocked Yes
438 0x01B6 6 Authentication Key / Password 13 R / W when unlocked Yes
444 0x01BC 6 Authentication Key / Password 14 R / W when unlocked Yes
450 0x01C2 6 Authentication Key / Password 15 R / W when unlocked Yes
456 0x01C8 6 Authentication Key / Password 16 R / W when unlocked Yes
462 0x01CE 6 Authentication Key / Password 17 R / W when unlocked Yes
468 0x01D4 6 Authentication Key / Password 18 R / W when unlocked Yes
474 0x01DA 6 Authentication Key / Password 19 R / W when unlocked Yes
480 0x01E0 6 Authentication Key / Password 20 R / W when unlocked Yes
486 0x01E6 6 Authentication Key / Password 21 R / W when unlocked Yes
492 0x01EC 6 Authentication Key / Password 22 R / W when unlocked Yes
498 0x01F2 6 Authentication Key / Password 23 R / W when unlocked Yes
504 0x01F8 6 Authentication Key / Password 24 R / W when unlocked Yes
510 0x01FE 6 Authentication Key / Password 25 R / W when unlocked Yes
516 0x0204 6 Authentication Key / Password 26 R / W when unlocked Yes
522 0x020A 6 Authentication Key / Password 27 R / W when unlocked Yes
528 0x0210 6 Authentication Key / Password 28 R / W when unlocked Yes
534 0x0216 6 Authentication Key / Password 29 R / W when unlocked Yes
540 0x021C 6 Authentication Key / Password 30 R / W when unlocked Yes
546 0x0222 6 Authentication Key / Password 31 R / W when unlocked Yes
552 0x0228 6 Authentication Key / Password 32 R / W when unlocked Yes
558 0x022E 6 Authentication Key / Password 33 R / W when unlocked Yes
564 0x0234 6 Authentication Key / Password 34 R / W when unlocked Yes
570 0x023A 6 Authentication Key / Password 35 R / W when unlocked Yes
576 0x0240 6 Authentication Key / Password 36 R / W when unlocked Yes
582 0x0246 6 Authentication Key / Password 37 R / W when unlocked Yes
588 0x024C 6 Authentication Key / Password 38 R / W when unlocked Yes
594 0x0252 6 Authentication Key / Password 39 R / W when unlocked Yes
600 0x0258 128 User Memory R / W when unlocked Yes

15
3.3.1 Result Register
The Result Register is 1-byte long, with located at address 0x0000, with both read and write access. Writing to this
register has no effect. The register contains the result (error code) of the last executed command. The list of all
possible results is shown in Table 3.2.
Table 3.2
Value Type Description
0x00 No Error
Command was executed successfully and results were
stored in the registers.
0x01 Invalid Command Value written to command register is invalid.
0x02 Invalid Command Parameter
One of the parameters taken by the command is
invalid.
0x03 Indexes Out Of Range Indexes passed as command parameters exceed limit.
0x04
Error When Writing To Non
Volatile Memory
There was an internal error during writing to the non-
volatile memory.
0x05 System Error Internal system error. Shall be considered as fatal.
0x06 Tag CRC Error
During communication with the tag a CRC was not
correct.
0x07 Tag Collision Reserved for future use.
0x08 Tag is not present There is no tag within range.
0x09 Tag Authentication Error
Authentication failed due to incorrect Autentication
Key or Password.
0x0A Tag Value Block Corrupted At least one value block is corrupted in the tag
memory.
0x0B Module Overheated A overheat was detected.
0x0C Tag Not Supported There is a tag in the field which is not supported.
0x0D Tag Communication Error There was an error during communication with the tag.
0x0E Invalid Password
The Password used in the Unlock command string was
invalid.
0x0F Already Locked
You are trying to lock a module that is already locked.
0xFF Module Busy
Your command was ignored because the module is
busy. Retry later.
Result Register Values

16
3.3.2 Command Register
The Command Register is 1-byte, located at address 0x0001, with both read and write access. Writing to this register
is recognized by the module as a command execution request. Depending upon the command (value written to the
register) the Command Parameters Register is parsed to extract arguments for the command. Whilst commands are
executing, the Result Register value is set to 0xFF and the nBUSY line is driven low. When command execution is
complete the memory is updated and the nBUSY line returns to the high state indicating that the module is ready to
receive another command.
3.3.3 Command Parameters Register
Table 3.3
The Command Parameters Register is 18-bytes long, located at addresses from 0x0002 to 0x0013, with both read
and write access. This is the place from where the system parses the arguments necessary to perform requested
operation when a command is executed. Depending upon the command, this register is parsed and interpreted in
different ways. The details of interpretation of the data stored in this register can be found in chapter 4.2. The
module never changes the values inside this register except after power-up or exit from Deep Sleep Mode.
Reg i ster Name
Reg i ster Addr ess
Byte Offset 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F 0x10
Byte Positi on 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Access R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W
Fa ctory D efault Val ue 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Rea d Function
Write Functi on
Parameters taken when executing commands. Each command has various number and order of parameters.
Command Parameters
0x0002

17
3.3.4 Tag UID Register
Table 3.4
Tag UID Register is 10-bytes long, located at addresses from 0x0014 to 0x001D, with read only access. In most cases
the tag UIDs are 4 bytes, 7 bytes or 10 bytes long, thus this register can cover the longest UID but not necessarily all
bytes available in the register will be used. Bytes within the register are ordered from the least significant byte to the
most significant byte. This register is updated whenever Get UID and Type commands are used. The Tag UID Size
Register contains information detailing how many bytes of the ten available represent the tag UID.
3.3.5 Tag Type Register
The Tag Type Register is 1-byte long located at address 0x001E, with read only access. This register contains
information about the type of tag which was last seen in the field. Possible tag types are shown in Table 3.5.
Table 3.5
Register Name
Register Address
Byte Offset 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09
Byte Position 0123456789
Access RRRRRRRRRR
Factory Default Value 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Read Function UID[0] UID[1] UID[2] UID[3] UID[4] UID[5] UID[6] UID[7] UID[8] UID[9]
Tag UID
0x0014
Retur ned va lue Ta g type
0x00 No Tag
0x01 Incomplete Type
0x02 Ultralight
0x03 Ultralight EV1 80B
0x04 Ultralight EV1 164B
0x05 Classic Mini
0x06 Classic 1K
0x07 Classic 4K
0x08 NTAG203F
0x09 NTAG210
0x0A NTAG212
0x0B NTAG213F
0x0C NTAG216F
0x0D NTAG213
0x0E NTAG215
0x0F NTAG216
0x10 Unknown

18
3.3.6 Tag UID Size Register
The Tag UID Size Register is 1-byte long, located at address 0x001F, with read only access. It contains the information
of what the UID size in bytes was of the last tag in the field.
3.3.7 Data Buffer
The Data Buffer is a 256-byte long, located at address 0x0020 to 0x011F, with both read and write access. This buffer
is used for data transfers between the tag and the user of the module.
3.3.8 Password Register
Table 3.6
The Password Register is 8-bytes long, located at address 0x0120 to 0x0127, with both read and write access but only
after first unlocking the device. This register is inaccessible when the module is locked. It contains an 8-byte long
password which must be used with the Unlock Command to unlock protected memory. This password can be
changed when the device is unlocked. The password change will only be updated and become valid after executing
the Lock command.
Register Name
Register Address
Byte Offset 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07
Byte Position 0 1 2 3 4 5 6 7
Access R/W R/W R/W R/W R/W R/W R/W R/W
Factory Default Value 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Read Function PASS[0] PASS[1] PASS[2] PASS[3] PASS[4] PASS[5] PASS[6] PASS[7]
Write Function PASS[0] PASS[1] PASS[2] PASS[3] PASS[4] PASS[5] PASS[6] PASS[7]
Password
0x0120

19
3.3.9 AES Initialization Vector Register
Table 3.7
The AES Initialization Vector Registers are two 16-bytes long registers, located at address 0x0128 to 0x0147, with
both read and write access but only after first unlocking the device. These registers are inaccessible when the
module is locked. They can be used as an initialization vector for the first encrypted data block. The byte order in the
memory is from the least significant byte. Their role during data encryption and decryption is described in detail in
chapter 4.2.8 and 4.2.9.
3.3.10 AES Key Register
Table 3.8
The AES Key Registers are two 16-bytes long registers, located at address 0x0148 to 0x0167, with both read and
write access but only after first unlocking the device. These registers are inaccessible when the module is locked.
Both registers contain an AES encryption key which can be used for encryption of the Data Buffer. Their role during
encryption and decryption of the data in the buffer is described in detail in chapter 4.2.8 and 4.2.9.
Reg ister Name
Reg ister Address
Byte Offset 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F
Byte Position 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Access R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W
Factor y Defa ul t Va l ue 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Rea d Functi on InVec[0] InVec[1] InVec[2] InVec[3] InVec[4] InVec[5] InVec[6] InVec[7] InVec[8] InVec[9] InVec[10] InVec[11] InVec[12] InVec[13] InVec[14] InVec[15]
Write Function InVec[0] InVec[1] InVec[2] InVec[3] InVec[4] InVec[5] InVec[6] InVec[7] InVec[8] InVec[9] InVec[10] InVec[11] InVec[12] InVec[13] InVec[14] InVec[15]
0x0128,0x0138
AES Initialization Vector
Reg ister Name
Reg ister Address
Byte Offset 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F
Byte Position 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Access R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W R/W
Factor y Defa ul t Va l ue 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Rea d Functi on Key[0] Key[1] Key[2] Key[3] Key[4] Key[5] Key[6] Key[7] Key[8] Key[9] Key[10] Key[11] Key[12] Key[13] Key[14] Key[15]
Write Function Key[0] Key[1] Key[2] Key[3] Key[4] Key[5] Key[6] Key[7] Key[8] Key[9] Key[10] Key[11] Key[12] Key[13] Key[14] Key[15]
0x0148, 0x0158
AES Key

20
3.3.11 Authentication Key / Password Register
Table 3.9
The Authentication Key and Password Registers are forty 6-bytes long registers, located at address 0x0168 to 0x0257,
with both read and write access but only after first unlocking the device. These registers are inaccessible when the
module is locked. When working with Mifare Classic tags these registers contain the password keys used for block
authentication in the tag. When working with Ultralight and NTAG transponders, these registers contain 4-byte
passwords. There are forty Authentication Key and Password registers numbered from 0 to 39. The number of the
key register to be used is passed as an argument in some commands.
3.3.12 User Memory
There are 128 bytes of memory available for the user as a protected memory space from address 0x0258 to 0x02D7.
This memory is inaccessible when the device is locked. This data is stored into non-volatile memory when the Lock
command is executed.
Register Name
Register Address
Byte Offset 0x00 0x01 0x02 0x03 0x04 0x05
Byte Position 0 1 2 3 4 5
Access R/W R/W R/W R/W R/W R/W
Factory Default Value 0x00 0x00 0x00 0x00 0x00 0x00
Read Function
KEY[0] /
PASS[0]
KEY[1] /
PASS[1]
KEY[2] /
PASS[2]
KEY[3] /
PASS[3]
KEY[4] KEY[5]
Write Function
KEY[0] /
PASS[0]
KEY[1] /
PASS[1]
KEY[2] /
PASS[2]
KEY[3] /
PASS[3]
KEY[4] KEY[5]
0x0168, 0x016E … 0x0252
Authentication Key / Password