NXP Semiconductors PN544 C2 User manual

UM191812
PN544 C2 User Manual
Rev. 1.2 — 2010-06-16 User Manual
Document information
Info Content
Keywords PN544 C2, Logical Link Control Protocol, Host controller interface, Single
Wire Protocol, NFC 2nd generation, SIM centered solution, Powered by
the Field
Abstract This is a user manual for the PN544 C2 NFC IC.
The aim of the document is to describe the PN544 Firmware API enabling
you to design your NFC system.

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 2 of 172
Contact information
For additional information, please visit: http://www.nxp.com
For sales office addresses, please send an email to: [e-mail]
Revision history
Rev Date Description
1.0 2010-04-28 Release for PN544 C2
1.1 2010-05-07 Add register: TX_Current_Check, 0x9F14 change default value,
NXP_EVT_NFC_DEACTIVATED description update, Add NAD usage NfcT (0x98A3),
0x997A, 0x9F19 default value update, registers 0x998 and 0x9931 removed (trimmed
value – do not change), Fig 47 update
1.2 2010-06-16 Updates: 7.4.5 Error Detection and Error Handling, 49 Information Event, 9.8 MIFARE
PCD, 9.4.5 CLK request in NFC active target mode, 9.12.1 Initiator: added maximum frame
length warning, typos, added list of tables and figures, Fig 7 HCI packet bigger than
maximum packet size, added EEPROM configurations SWP_Act_Retry, IFSLEW, Table
133 HW configuration in EEPROM, Table 13 HCI Gate Loopback, Type B PCD Anti-
collision, Type B PICC HIGHER_LAYER_RESPONSE, RF Configuration in Polling Loop,
Host Link Timing restriction

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 3 of 172
1. Introduction
The PN544 is a highly integrated transmission module for contact-less communication at
13.56 MHz. The User Manual describes the software interfaces (API). As this document
assumes pre-knowledge on certain technologies please check section “4 References”.
For further information please refer to the PN544 data sheet [7].
2. PN544 C2
This document is related to the PN544 C2, it gives an overview of the Software API
available.
Please refer to the ‘PN544 Release Note’ [10] for further information on PN544 samples
functionality level.

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 4 of 172
3. Abbreviations
Table 1. Abbreviations
Abbr. Abbreviation
API Application Program Interface
CLF Contact less front-end
CLT Contact less Tunnel
CRC Cyclic Redundancy Check (according to SWP specification)
DSR Control Line on RS232: Data Set Ready
DTR Control Line on RS232: Data Terminal Ready
EE EEPROM (non volatile memory)
HCI Host Controller Interface
HCP Host Controller Protocol
HDLC High Level Data Link Control
HSU High speed UART
HW Hardware
I Information frame (HDLC)
I2C Serial Data bus by Philips
LLC Logical Link Control
MAC Media Access Control
NFC-WI Near Field Communication – Wired Interface
PBTF Power By The Field
PRBS Pseudo Random Binary Sequence
PVDD Pad VDD (Supply)

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 5 of 172
Abbr. Abbreviation
RAM Random Access Module (volatile memory)
Reg Register
REJ Reject (HDLC)
RF Radio Frequency (here 13,56MHz)
RFU Reserved for future use
RI Control Line on RS232: Ring Indicator
RNR Receiver Not Ready (HDLC)
RO Read only
RR Receiver Ready (HDLC)
RSET Reset (ETSI)
RW Read / write
SHDLC Simplified HDLC
SPI Serial Peripheral Interface
SREJ Selective Reject (HDLC)
SWP Single Wire Protocol
UART Universal Asynchronous Receiver Transmitter
UI Unnumbered Information (HDLC)
UICC Universal Integrated Circuit Card

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 6 of 172
4. References
[1] Standard ETSI (ETSI TS 102 622 V7.5.0) Smart Cards; UICC-CLF Interface; Host
Controller Interface – Release 7 (June 2009)
[2] Standard ETSI (ETSI TS 102 613 V7.7.0) Smart Cards; UICC-CLF interface;
Physical and data link layer characteristics – Release 7 (October 2009)
[3] Standard ECMA-373 Near Field Communication Wired Interface (NFC-WI)
http://www.ecma-international.org/
[4] Standard ISO18092 Near Field Communication -- Interface and Protocol (NFCIP-1)
http://www.iso.org
[5] NXP Mifare Portfolio www.mifare.net
[6] ISO 14443 part 1 to part 4 Identification cards – Contact-less integrated circuit(s)
cards -- Proximity cards http://www.iso.org
[7] PN544 C2 Datasheet – Doc Number 1878xx
[8] Application Note “PN544 Software update” – 1581xx
[9] PN544 Custom Clock settings (Excel Worksheet Formula) – Doc Number 1610xx
[10] PN544 C2 Release Note – Doc Number 1882xx
[11] PN544 RF Configuration – Doc Number 1659xx

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 7 of 172
5. PN544 Software Architecture
5.1 System Overview
Host Interface
SPI or I2C or HSU
Secure chip Interface
NFC – WI
UICC interface
SWP
RF Interface
13,56MHz
PN544
ETSI
LLC
NXP
HCI
ETSI
HCI
PN544
HCI
RF Protocols
Wired interface to
connect Secure Element
NXP
LLC
RF Frontend
Configuration
(1) A high level view on the PN544 interface / software structure
Fig 1. System Overview
The PN544 offered physical interfaces and their functionalities are
•Host Interfaces
consisting of I2C, SPI and HSU as physical interfaces
•RF Interface
This interface features 13,56MHz based protocols such as NFCIP-1 [4], MIFARE1[5]
and ISO14443 [6]
•SWP
Interface
This interface is according to the ETSI [2] specification
•NFC-WI
This interface is according to ECMA 373 [3]
1 Reader modes as well as card emulation modes

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 8 of 172
From software point of view we refer to “PN544 HCI”. Depending on the interface used
the ETSI or the NXP proprietary one is used. For ease of nomenclature we refer to HCI
meaning NXP PN544 HCI.
HCI is used for host interfaces and UICC interface (See [1]).
The following chapters describe how to access PN544 over HCI and how to configure it.
Main parts cover the PN544 NXP HCI specifics.
6. Host hardware interface configuration
6.1 General points
The system host controller can communicate with the PN544 by using the SPI, I2C or
HSU (High Speed UART) serial links.
Only one link can be used at once, and the choice is done by a hardware configuration
(interface mode lines IFSEL [2:0]) during the power up sequence of the chip.
Note: The host interface check is performed by the firmware at PN544 power-up (PVDD
available) and after any Reset (Hardware or Software). See ‘Boot Sequence’ chapter of
PN544 Datasheet [7] .
Table 2. Host Interface Selection
Here is the description of the physical connections on pins IFSEL [2:0] (define the interface) and IF
[3:0] (physical host interface)
Interface
Selection
Pin Name
Interface Pin Name Link
IFSEL[2:0] IF0 IF1 IF2 IF3
000 nc RX nc TX RS232
001 - - - - rfu
010 ADDR0 ADDR1 SDA SCL I2C
011 - - - - rfu
100 NSS MOSI SCK MISO SPI
(CPOL=0, CPHA=0) (1)
101 NSS MOSI SCK MISO SPI
(CPOL=0, CPHA=1) (1)
110 NSS MOSI SCK MISO SPI
(CPOL=1, CPHA=0) (1)
111 NSS MOSI SCK MISO SPI
(CPOL=1, CPHA=1) (1)

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 9 of 172
(1) CPOL and CPHA are part of SPI Configuration. For more information about these 2
parameters, please refer to following table:
Table 3. CPOL / CPHA description
Bit name description
CPOL Clock polarity:
selects the polarity of the shift clock
1: shift clock is active low.
0: shift clock is active high.
CPHA Clock phase:
This bit indicates, at which edge of the clock signal the data will be sampled. The
other edge initiates the value change on the data line
1: As soon as input pin NSS goes low, the transaction begins and the edge of SCK
invokes the first data sample. Sampling of the data happens at the even edges (2,
4…16) of the SCK clock.
0: if input pin NSS goes low, the outputs are enabled. Sampling of the data happens
at the odd edges (1, 3…15) of the SCK clock.
Table 4. Pin functional description
Here is the functional description of each pins used by all interfaces
Pin Name Dir Description
RX I Asynchronous UART receiver input, which is similar to an RS232 protocol on
PVDD level.
TX O Asynchronous UART transmitter output which is similar to an RS232
protocol on PVDD level.
ADDR0 I I2C slave address bit 0 (LSB)
ADDR1 I I2C slave address bit 1
SDA IO IO pin SDA
SCL I Clock Input pin SCL
NSS I Slave select active low for SPI slave mode
MOSI I Master Out Slave In
Data input pin in slave operation
SCK I Clock input pin in slave operation
MISO O Master In Slave Out
Data output pin in slave operation

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 10 of 172
6.2 SPI interface
The PN544 is a slave SPI.., The mode used for the clock can be chosen for the phase
(CPHA) and the polarity (CPOL). The pin IFSEL0 is used to set CPHA and IFSEL1 is
used to set CPOL.
(See Table 3 for CPHA& CPOL settings).
How to configure SPI interface:
SPI Interface Configuration
IF0 NSS
IF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF1 MOSI
IF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF2 SCK
IF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF3 MISO
IFSEL0
IFSEL1
IFSEL2 1
CPOL
CPHA
Fig 2. SPI interface configuration

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 11 of 172
6.3 I2C interface
The PN544 is an I2C slave.
To use this interface, an I2C address has to be set. The default address of the device is
set to binary “0 1 0 1 0 IF1 IF0”. The prefix “0 1 0 1 0” is a fixed value inside PN544.
How to configure I2C interface:
I2C Interface Configuration
IF0 ADDR0
IF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF1 ADDR1
IF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF2 SDA
IF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF0 NSSIF3 SCL
IFSEL0
IFSEL1
IFSEL2 0
1
0
2
)
Fig 3. I2C interface configuration

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 12 of 172
6.4 HSU interface
HSU interface default configuration is:
Data bit : 8 bits
Parity bit : none
Stop bit : 1 bit
Baud rate : 115200 bauds
Data order : LSB first
7. NXP Logical Link Layer
PN544 offers four interfaces using LLC on top of the physical layer. The logical link layer
of the SWP interface is according to the SWP specification (see [2]). The other interfaces
(i.e. I2C, SPI, and HSU) are derived from the SWP LLC layer to fit the needs of the
respective interface. We refer to the “NXP LLC” layer described in Fig 1 ‘System
Overview’.
1. Host Interfaces
a. I2C
b. SPI
c. HSU (i.e. High Speed UART)
2. ETSI SWP Interface

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 13 of 172
7.1 Overview on physical interfaces
Table 5. Physical host Interfaces Overview
I2C SPI HSU SWP
Communication
Flow
Half Duplex Full Duplex Full Duplex Full Duplex
Clock Generator Host Only Host Only Host and
Device
Device (CLF) Only
Speed Enforced by
host clock
Enforced by host
clock
Specified by
the host
Configurable by the
host.
Frame Start/ End
Condition
Guard times2Guard times Guard times As defined in SWP
(SOF, EOF)
Activation Host Host Host Device (CLF)
Bus Capabilities Yes Yes No No
Used Lines SDA, SCL,
IRQ
MOSI, MISO,
NSS, SCK, IRQ
RX, TX SWIO, VCC
The supported speeds of the interfaces are found in the PN544 Datasheet [7].
7.2 Link Layer Features
The link layer guarantees reliable data transfer and a balanced link over an unreliable
MAC layer. In order to guarantee reliability, the LLC layer is able to detect and able to
recover from erroneous situations.
The layer above (i.e. the HCI) can assume that all frames are delivered without errors
and in a sequential order.
7.3 LLC on SWP
The product will support all mandatory features as specified in the ETSI SWP
specification [2]. The optional features / parameters are as follows:
Default window size is 4. The UICC may negotiate the window size down to 2.
SREJ is not supported
For more information, please refer to ETSI SWP specification [2].
2. Configurable, typically between 1ms and 100ms. . Currently disabled.

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 14 of 172
7.4 LLC on I2C, SPI, UART
The link layer of the host protocol is derived from the ETSI SWP specification. The
deviations from the ETSI LLC layer are as follows:
•CLT protocol is not supported
•ACT protocol and SYNC_ID handling are not supported
HSU baudrate can be either configured by EEPROM or by an additional argument in
RSET from the host interface
•The host is supposed to start with the activation of the link layer
Note: This means that the host will start with the RSET frame.
The optional features / parameters are as follows:
Window size is 4, can be negotiated down to 2.
SREJ is not supported
Retry rate is set to 10
Inter-frame character timeout (See 7.4.5)
WARNING: A minimum delay of 1.1ms between to consecutive frames sent to
PN544 is required. Thus, Host Link driver must ensure to respect this timing when
sending U-Frame, I-Frame & S-Frame.
7.4.1 Frame definition
The frame format is the same for all host interfaces. It is derived from the LLC frame as
specified in the SWP specification. The major difference between host and SWP frame is
that the host interface frames contain the length information. Otherwise, things like the
LLC command set (I, RR, RNR, REJ, RSET), frame length and LLC handshaking is
identical. Bit stuffing is not used by the host interfaces.
HCI Command / Event / Response
LLC
Header
max 29 Bytes1 Byte
CRC
LLC
Length
2 Bytes1 Byte
LLC payload
Fig 4. LLC Frame Components

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 15 of 172
The LLC Length specifies the length of the frame to follow. The length itself is not
counted. The two CRC bytes are counted. The LLC frame is represented as follows:
•LLC Length is mandatory (valid range: 03h – 20h)
•LLC Header is mandatory.
•LLC Payload is optional. This is depending on the LLC command, which is
contained in the LLC Header.
•CRC is always present
the bit and byte order is Most Significant Bit / Byte first.
7.4.2 Chaining description
For HCI command, the format of a HCP packet is defined in Fig 5:
(1) CB is the chaining bit and its value is equal to 1 except when message fragmentation is used
(2) PID specifies the pipe identifier.
Fig 5. HCP packet
The LLC layer does not provide any chaining, segmentation or reassembly feature.
Therefore the HCI has to obey the maximum size rules as defined in this document.
If HCI determines that a certain HCI command does not fit into the negotiated packet
size, HCI needs to split up the big packet into smaller chunks by using the chaining
feature as specified in HCI. The LLC is and shall not be aware of this chaining
functionality. LLC does not care if a packet is split up into one or more LLC frames.
The length of the LLC frame is aligned with the length of the HCI packet. There is no
padding at the end of the HCI packet. When HCI is sent over LLC, the beginning of an
LLC frame implies the beginning of an HCI packet (without considering the LLC header),
the end of an LLC frame implies the end of an HCI packet (without considering the CRC).

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 16 of 172
Examples of possible usage of CB bit:
(1) HCI single frame without chaining
Fig 6. HCI packet smaller than maximum packet size
(1) The HCI component splits up the content into two different LLC frames. Therefore HCI must
perform two “LLC Send ()” commands. From the LLC point of view it looks like two regular I
frames. Therefore the LLC will generate two acknowledges.
Fig 7. HCI packet bigger than maximum packet size

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 17 of 172
7.4.3 LLC Header description
The LLC Header (called also SHDLC control field) is part of the LLC frame structure
defined in the following figure:
Fig 8. LLC layer (SHDLC)
7.4.3.1 SHDLC frame types
SHDLC uses several types in order to transfer data and to manage or supervise the
communication channel between the two endpoints (ends of the communication
channel):
I-Frames (Information frames): Carry upper-layer information and some control
information. I-frame functions include sequencing, flow control, and error detection and
recovery. I-frames carry send and receive sequence numbers.
S-Frames (Supervisory Frames): Carry control information. S-frame functions include
requesting and suspending transmissions, reporting on status, and acknowledging the
receipt of I-frames. S-frames carry only receive sequence numbers.
U-Frames (Unnumbered Frames): Carry control information. U-frame functions include
link setup and disconnection, as well as error reporting. U-frames carry no sequence
numbers.
7.4.3.2 Control field
The SHDLC control field has the structure described in following table.
Table 6. SHDLC Control field coding
Bit FieldFrame Types
8 7 6 5 4 3 2 1
I 1 0 N(S) N(R)
S 1 1 0 TYPE N(R)
U 1 1 1 M

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 18 of 172
Where:
- N(S): Number of the information frame
- N(R): Number of next information frame to receive
- TYPE: Type of S-Frame
- M: Modifier bits for U-Frame
I-Frames coding
The functions of the information(I) command and response is to transfer sequentially
numbered frames, each containing an information field, which might be empty, across the
data link.
S-Frames coding
Supervisory(S) commands and responses are used to perform numbered supervisory
functions such as acknowledgment, temporary suspension of information transfer, or
error recovery. Frames with the S format control field do not contain an information field.
Supervisory Format commands and responses are as follows:
RR: Receive Ready is used by an endpoint to indicate that it is ready to receive an
information frame and/or acknowledge previously received frames.
RNR: Receive Not Ready is used to indicate that an endpoint is not ready to receive any
information frames or acknowledgments.
REJ: Reject is used to request the retransmission of frames.
SREJ: This optional command is not supported by the PN544. If received SREJ is
treated like an erroneous frame.
The type coding is given by the following table:
Table 7. Type coding of the S-Frames
Frames type status
RR 00 Mandatory
REJ 01 Mandatory
RNR 10 Mandatory
SREJ 11 Not supported
Optional type of frame shall not be used before capability negotiation is defined during
initialization.

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 19 of 172
U-Frames coding
The unnumbered (U) format commands and responses are used to extend the number of
data link control functions. The unnumbered format frames have 5 modifier bits which
allow for up to 32 additional commands and responses. Only a subset of the HDLC
commands and responses are used for SHDLC:
RSET: Reset of the data link layer is used to reset the sequence number variables in the
both endpoints.
UA: Unnumbered Acknowledgment is used to acknowledge the receipt and acceptance
of a RSET command.
Table 8. modifier coding of the U-Frames
Frames modifier status
RSET 11001 Mandatory
UA 00110 Mandatory
The optional command UI is not supported.
7.4.3.3 RSET Frame
The RSET command is used to reset the link status. The behavior is the same as
described in the respective SWP specification [2].
1111 1001 nnnn nnnn
8 bits 8 bits
RSET
Window
size
b8...b1
Endpoint
capabilities
8 bits
2 nnnn nnnn 4
(1) Window size = 4 for PN544
Fig 9. RSET Frame
WARNING: Before initiating an HCI communication with PN544, at Power up,
or after a Reset (VEN), it is mandatory to send a RSET frame. The recommended
frame is defined in the following figure:

NXP Semiconductors UM191812
PN544 C2 User Manual
191812 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2010. All rights reserved.
User Manual Rev. 1.2 — 2010-06-16 20 of 172
(1) U RSET frame (with 115200 baud rate for HSU)
Fig 10. LLC RSET frame example
Another example of complete LLC frame:
(1) U RSET frame (without HSU baud rate setup)
Fig 11. Recommended RSET frame
It is recommended to use the frame with no baud rate indicator if the baud rate is not
changed. It prevents writing the baud rate to EEPROM and therefore saves time and
energy.