NXP Semiconductors OM27642 User manual

UM11038
OM27642 Smart Lock KIT
Rev. 1.1 — 11 October 2018
407611
User manual
COMPANY PUBLIC
Document information
Info
Content
Keywords
OM27462NBR Smart Lock KIT User manual
Abstract
This document describes the content, the hardware implementation and
the usage of the Android application as well as the access token structure
and processing of the NFC Bluetooth®Low Energy Smart Lock KIT -
OM27462NBR. It also describes how to update the QN9021 and PN7462
firmware.

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
2 of 38
Contact information
For more information, please visit:
http://www.nxp.com
Revision history
Rev
Date
Description
1.1
20181011
•Fig. 14 updated
•Editorial updates
1.0
20161116
First release

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
3 of 38
1. Introduction
This document describes the implementation of a battery-operated Bluetooth®Low Energy NFC
Smart Lock for the hospitality market. This document does not replace the PN7462AU or QN9021
datasheets and respective application notes. Please refer to the datasheets for detailed information
of the ICs. This document also describes the process of firmware upgrade for both the PN7462 and
QN9021 (QS9322 module) as well as for the implemented demonstration functionality.
The Smart Lock KIT hardware design consists of two PCBs and incorporate the following
main IC components:
•PN7462AU – all-in-one full NFC application controller with freely programmable
µController
(PN from now on)
•QN9020 – for Bluetooth Low Energy communication (QN from now on)
•PCF8883T – for capacitive wake up of the application processor circuitry
(PN7x62)
•NX5P2553 - precision adjustable current-limited power switch
The PN and the QN ICs communicate with each other by means of serial communication
over a UART interface.
Each of the micro-controllers contains its own firmware which performs the required
actions depending on the origin of the unlock token. The token can be delivered to the
lock in two ways:
•over RFID – with the help of an MIFARE DESFire ISO14443 Type A card or via
an Android based phone using HCE.
•over Bluetooth Low Energy – with help of any Bluetooth Low Energy compliant
device
In this document the term „MIFARE DESFire card“ refers to a MIFARE DESFire IC-
based contactless card.

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
4 of 38
2. Smart Lock KIT Package Content
Fig 1. OM27462NBR Smart Lock module, power cable, programming cable, touch sensor plate,
set of demonstration cards

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
5 of 38
3. Smart Lock Module Hardware
The core module – stack on board contains all necessary blocking capacitors, XTAL, 2
status LEDs and the antenna EMC filter.
The Core module is designed for general purpose use therefore all power supply options
(e.g. internal/external LDO etc.) are configured on the base board. The core Module /
stack on approach was taken in order to create a high density low PCB area
implementation.
Fig 2. OM27462NBR Smart Lock module consisting of PN7462AU core module V1.2 and the 40mm Ø
base board NFC- Bluetooth Low Energy Smart Lock V1.1

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
6 of 38
3.1 Smart lock system block diagram
Fig 3. Main building blocks
Fig 4. OM27462NBR NFC- Bluetooth Low Energy Module with PN7462 stack on core module
Figure 4 shows the functional block diagram of the Smart Lock module including the
main components used.

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
7 of 38
4. Schematics
Fig 5. Base board schematic part 1

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
8 of 38
4.1 Base board schematics continued
Fig 6. Base board schematic part 2

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
9 of 38
4.2 Core Module schematics
Fig 7. Core Module pin out vs. PN7462AU pin out

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
10 of 38
4.3 Antenna matching
The antenna matching of the Smart Lock main PCB is shown below. The EMC filter is
part of the stack-on core Module. The base board consists of the matching circuit with
the damping resistors and the serial and parallel matching capacitors.
Fig 8. Antenna matching on stack on Core Module
Fig 9. Antenna matching components on the base board
Please Note: high resolution schematics are available as PDF files in the download
section under manufacturing data here: www.nxp.com/demoboard/OM27462NBR

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
11 of 38
5. Base board connectors
Fig 10. Base board connection description
6. Getting started
6.1 Setting up the hardware module
1) Connect the Touch sensor plate as shown in fig. 1.
2) Connect a DC power source (2V-3.3V) to the pins labeled “BAT” (see fig. 1)
6.1.1 Smart Lock power connection
As the Smart Lock is intended to be operated by a single cell battery (e.g. CR2
~780 mAh or CR123 ~1,450 mAh) with a nominal voltage of 3V (typically ~2.5 V
depending on load current). An ultra-low-power step up converter which operates down
to below 1 V input voltage is used to generate 3.3 V circuitry supply.
Fig 11. Power Supply Connector location on Smart Lock base board

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
12 of 38
7. Smart Lock operation
The Smart Lock KIT comes with pre-configured functionality.
7.1 Operating the Smart Lock using the demonstration cards
1) Configure Room 201 by bringing the “Lock Configuration Room 201” card in close
proximity of the module. Wait for lock configuration sequence completion which is
indicated by the RGB LED and on-board buzzer while active.
2) Present “Room 201 ACCESS Guest 1” card or “Room 201 ACCESS Guest 1 re-issued”
card in close proximity of the module. If the card is valid and accepted, LED will light up
green and the buzzer will give a brief beep indicating acceptance. If an invalid card is
used, the LED will light up in red and the buzzer will beep 3 times.
Note: By presenting the “Room 201 Guest 1 re-issued” card, the “Guest 1” card will be
invalidated and not accepted further until you re-configure Room 201 with the respective
configuration card.
3) In order to set the Smart Lock to an alternative room / guest, re-configure the lock to
room 202 / guest 3 with the respective “Lock Configuration Room 202” card. Guest 3 will
be accepted whereas Guest 1 – Room 201 cards are declined.
Fig 12. Set of demonstration cards

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
13 of 38
7.2 Operating the Smart Lock using the mobile Smart Lock App
Download the “NXP SMARTLOCK” app from Google Play Store and install it on your mobile
NFC enabled Android device.
Fig 13. Download link Google Playstore

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
14 of 38
Fig 14. Quick reference for Smart Lock App

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
15 of 38
8. Firmware design description
8.1 Power saving
As RFID and Bluetooth Low Energy Smart Lock Reference Design is powered by a
battery it is important that we consume as little energy as possible. The PN spends most
of its time shut down and can be woken in multiple ways:
•over proximity touch sensor switch
•over micro-switch – external input
•by QN (Bluetooth Low Energy module)
QN is powered all the time and sends out Bluetooth Low Energy advertisements
periodically so that Bluetooth Low Energy devices can discover the lock. Between
Bluetooth Low Energy advertisements broadcasts it is running in low power mode. In this
mode most peripherals are switched off and QN is running on
32 kHz clock to support RTC. PN can wake up QN from low power mode any time by
interrupt on GPIO when PN requires the current time from QNs RTC to check the token.
8.2 Interaction between PN and QN when token is delivered over RFID
When the token is delivered over RFID the PN gets powered up by means of proximity
sensor or switch and starts polling for RFID cards or NFC phones with HCE. If a device is
found it tries to retrieve the access token. After successful retrieval of the token, the
validity of the token must be checked. As time and date is required to do so, the PN must
wake up the QN to retrieve the current date and time from QNs RTC. After date/time is
retrieved from the QN and the token is deemed valid the process of unlocking the door is
started.
8.3 Interaction between PN and QN when token is delivered over
Bluetooth Low Energy
When the token is delivered over Bluetooth Low Energy, the QN powers up the PN after
a connection was established successfully between the QN and the Bluetooth Low
Energy client. Commands to retrieve the token are issued by the PN. After successful
retrieval of the token, validity of the token must be verified. If the token is deemed valid
the process of unlocking the door proceeds.

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
16 of 38
9. Communication protocol between QN and PN
Communication between QN and PN is done using two GPIO lines and UART
communication (115200 bps and data format 8N1).
The GPIO lines are used to power the PN (in case a Bluetooth Low Energy client
connects) or to wake-up QN (in case a card or phone is presented to the PN via NFC).
The UART is used to transfer data for
•Handshake
•Data exchange
Data is transferred using a single character command, a 2-byte length indicator and the
data bytes. All data is sent using little endian format.
Only during the handshake phase the PN sends repeatedly a single character ‘P’ without
any additional bytes until QN responds.
Fig 15. Communication interface between QN and PN

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
17 of 38
10. Handshake between the QN and PN
According to the use cases NFC and Bluetooth Low Energy communication, two
scenarios exist to start the communication between QN and PN
10.1.1 NFC Transaction
In this use case the PN is powered up either by the proximity switch or the micro switch.
In both cases the PN has to wake-up the QN to leave low power mode and activate its
UART peripheral. Therefore, the PN triggers a GPIO interrupt using the BLE_DETECT
line. At the same time the PN sends ‘P’.
This procedure is repeated until QN responds with ‘V’ and a 4-byte UNIX timestamp (little
endian).
Fig 16. Communication procedure between QN and PN - details
Example:
PN
QN
0x50
→
←
0x560400FB435E54

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
18 of 38
10.1.2 Bluetooth Low Energy Transaction
In this use case QN will power PN using the BLE_OUT line after establishing the
Bluetooth Low Energy connection. After power on the PN will start the communication by
triggering the QN GPIO interrupt using the BLE_DETECT line. At the same time PN will
send ‘P’.
This procedure is repeated until QN responds with ‘O’ and a 4-byte UNIX timestamp
(little endian).
The following figure shows the whole procedure:
Fig 17. Bluetooth Low Energy Transaction - details
Example:
PN
QN
0x50
→
←
0x4F0400FB435E54

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
19 of 38
10.2 Data exchange
After the initial handshake data exchange may start. The following commands are
available:
•‘C’: PN sends APDU command to QN (QN forwards data to the Bluetooth Low
Energy client)
•‘A’: QN responds with response APDU
•‘T’: PN sets RTC in QN
•‘N’: PN sets a new Bluetooth Low Energy device name in QN.
•‘D’: PN indicates QN that the transaction is finished and communication shall be
disconnected
All commands are followed by two bytes for length and then data. In case of 'T' command
the answer is the same as at power up ('O'<len><time>), but for 'C' command we return
'A'<len><data>:
PN
QN
'C'<len><data>
→
←
'A'<len><data>
Example:
PN
QN
0x4308000102030405060708
→
←
0x4102009000

NXP Semiconductors
UM11038
OM27642 Smart Lock KIT
UM11038
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2018. All rights reserved.
User manual
COMPANY PUBLIC
Rev. 1.1 — 11 October 2018
407611
20 of 38
11. Structure of the QN Firmware
The QN firmware is built on NXP Bluetooth Low Energy library. This library implements a
proprietary profile which is optimized sending and receiving APDU commands. It
automatically splits data onto several Bluetooth Low Energy packets if necessary. In
addition, the library uses the Bluetooth Low Energy feature to send several Bluetooth
Low Energy packets in one communication interval to speed up communication.
All data is transferred using unacknowledged Bluetooth Low Energy packets:
•Write Commands (Bluetooth Low Energy client to QN)
•Notifications (QN to Bluetooth Low Energy client)
Data sheet QN902x: http://www.nxp.com/documents/data_sheet/QN902X.pdf
Application note: http://www.nxp.com/documents/application_note/AN11664.pdf
The communication with PN is basically done by two modules:
•app_pn_task.c: The PN TASK handles the whole communication with the PN. It
controls the state, interprets the commands and starts/stops the communication
•pn_nfc.c: driver to communicate with PN. This module handles the low-level
functions to communicate with PN. It contains functions which run the context of
the GPIO interrupt as well as UART interrupt. In case of an event this module will
send a message to the PN TASK which will handle the event in a synchronous
way.
Note: In the download area only the binary files are provided.
11.1 src\app\pn\app_pn_task.c
The PN TASK has the overall responsibility to take actions and control the state of the
QN. This means that all input from PN (UART data but also GPIO wake-up events) is
converted to messages and sent via messages queues to the PN TASK.
To send messages to the PN TASK this module provides global functions which build
and send the appropriate messages.
From the QN point of view two events may start a transaction and thus the
communication with the PN:
•PN is woken up by proximity sensor or micro switch and wants to communicate
with QN. The handshake sequence may start immediately.
•A Bluetooth Low Energy client connects to QN. QN has to power on PN before
starting with the handshake sequence.
The PN_TASK basically uses three app states:
•PN_STATE_IDLE: QN advertises and uses low power mode. Sleep mode is not
possible since RTC must be powered. The task is waiting either for a Bluetooth
Low Energy connection or a wake-up event from PN via GPIO line.
•PN_STATE_BLE_ACTIVE: A Bluetooth Low Energy Client has connected and
subscribed to receive notifications from QN. In this state the PN_TASK acts as a
kind of proxy between the Bluetooth Low Energy client and the PN, meaning it
transfers APDU commands from PN to the Bluetooth Low Energy client and
APDU responses in the other direction.
•PN_STATE_NFC_ACTIVE: PN is powered up (e.g. proximity sensor) and wants
to read the current RTC value from QN. In this state no APDUs are exchanged
since those are handled locally between the PN and a NFC medium directly. Still