Pi-931 The Intelligence and Innovation Demonstration

The Intelligence and Innovation Pi-931 Demonstration Software Manual Proprietary and Confidential SIC_PD_DTS_0009 Rev 1.2 and...

0 downloads 103 Views 6MB Size
The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Demonstration Software User Manual Copyright © 2010, All Rights Reserved No part of this publication may be reproduced or distributed in any form or by any means, or stored in a data base or retrieval system, without prior written permission from Silicon Craft Co., Ltd.

Silicon Craft Co., Ltd. www.sic.co.th

Proprietary and Confidential Copyright  2010 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 1 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Revision History Revision 1.0 1.1 1.2

Date March 2010 July 2010 Sep 2010

Software Version 1.2.7.0 1.3.0.0 1.3.0.0

2.0

Nov 2012

1.5.0.0

Description/ Change / Updated / Comment st 1 Release Add command for PicoTag and Felica Correct Document content Section 6.3.1.1 B) Correct typo value in example "0001" => "1001" C) Correct typo value in example "0001 1110 0110" => "1001 1110 0110 " D) Correct typo value in example "0001 1110 0110 0" => "1001 1110 0110 0" Section 6.3.3.10 Correct typo "Lock Password" => "Load Password" - Add command for NFC tag type 1 (Topaz) , NFC tag type 2 (MIFARE Ultralight/C), and EMV Analogue test - Revise content allover the document to support SIC9410 and Software version 1.5.0.0

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 2 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Contents 1. Introduction ...................................................................................................................................................... 12 2. Getting Started.................................................................................................................................................. 12 2.1 System and Hardware Requirements ....................................................................................................................12 2.2 Content in CD ...........................................................................................................................................................12 2.3 Software Installation ...............................................................................................................................................13 2.3.1 Driver Installation for Windows XP (For Virtual RS232 on USB) .................................................................13 2.3.2 Driver Installation for Windows 7 (For Virtual RS232 on USB) ...................................................................16 3. Quick Start with Demonstration Software ........................................................................................................ 21 4. Demonstration Software Component ............................................................................................................... 23 4.1 Port-and-Constant Setup ........................................................................................................................................23 4.1.1 OPEN PORT......................................................................................................................................................23 4.1.2 CLOSE PORT ....................................................................................................................................................24 4.1.3 SET INIT SEQNUM ...........................................................................................................................................24 4.1.4 SET DEV ID .......................................................................................................................................................24 4.1.5 GET CHIP NUMBER .........................................................................................................................................25 4.1.6 GET FW VERSION ............................................................................................................................................25 4.2 RFID standard taps and Reader Configuration tap ...............................................................................................25 4.2.1 RFID standard taps .........................................................................................................................................26 4.2.1.1 4.2.1.2 4.2.1.3 4.2.1.4 4.2.1.5 4.2.1.6 4.2.1.7 4.2.1.8 4.2.1.9

“Standard Setup” Button ....................................................................................................................26 “Send” Button .....................................................................................................................................26 “Start Send Multi Cmd” Button ..........................................................................................................26 Reader TX and Rx Speed selection .....................................................................................................26 “Enable once check” Check box .........................................................................................................27 Command List ......................................................................................................................................27 Parameter setup..................................................................................................................................28 Command Response ...........................................................................................................................28 Run Multiloop ......................................................................................................................................28

4.2.2 Reader Configuration tap ...............................................................................................................................29 4.2.2.1 4.2.2.2

“Device ID” Setup ................................................................................................................................29 “RF Driver Configuration” Setup ........................................................................................................29

4.3 Raw data input and output for developer .............................................................................................................29 4.3.1 “Reset ASIC” button .......................................................................................................................................30 4.3.2 “ON RF” button ...............................................................................................................................................30 4.3.3 “OFF RF” button ..............................................................................................................................................30 4.3.4 “RF Power Level” Selection ............................................................................................................................30 4.3.5 “Set up” button (Power Level) .......................................................................................................................30 4.3.6 "Width Restore (<)” button ...........................................................................................................................30 4.3.7 "Send” button .................................................................................................................................................30 4.3.8 "Clear” button .................................................................................................................................................30 4.3.9 Direct TX Input and RX Output ......................................................................................................................30 4.3.10 “Clear Logs” button ........................................................................................................................................31 4.3.11 “Show Raw Pck” Check box ...........................................................................................................................31 4.3.12 Additional TX Input section ............................................................................................................................31 4.3.13 "<” button .......................................................................................................................................................32 4.3.14 Run Multiloop for Additional TX input ..........................................................................................................32 Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 3 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

4.3.15 Save/Load Command .....................................................................................................................................32 4.4 Transaction Logs ......................................................................................................................................................32 5. Pi-931 Protocol .................................................................................................................................................. 34 6. Using Demonstration Software ......................................................................................................................... 36 6.1 ISO14443A ...............................................................................................................................................................36 6.1.1 ISO14443A standard commands ...................................................................................................................36 6.1.1.1 6.1.1.2 6.1.1.3 6.1.1.4 6.1.1.5 6.1.1.6 6.1.1.7 6.1.1.8

A_Request ............................................................................................................................................36 A_WakeUp ...........................................................................................................................................37 A_Anticoll .............................................................................................................................................37 A_Select ...............................................................................................................................................38 A_RATS (Request for answer to select) .............................................................................................38 A_PPS (Protocol and parameter selection request) .........................................................................39 A_Deselect ...........................................................................................................................................40 A_Halt ..................................................................................................................................................40

6.1.2 Performing Basic operation in ISO14443A standard ...................................................................................40 6.1.3 MIFARE ............................................................................................................................................................42 6.1.3.1 6.1.3.2 6.1.3.3 6.1.3.4 6.1.3.5 6.1.3.6 6.1.3.7 6.1.3.8 6.1.3.9 6.1.3.10 6.1.3.11 6.1.3.12 6.1.3.13 6.1.3.14 6.1.3.15 6.1.3.16 6.1.3.17

A_LoadKey ...........................................................................................................................................44 A_Authentication ................................................................................................................................44 A_ReadBlock ........................................................................................................................................44 A_WriteBlock .......................................................................................................................................45 A_WriteValueBlock .............................................................................................................................46 A_WriteSectorTrailerBlock .................................................................................................................47 A_Increment ........................................................................................................................................49 A_Decrement.......................................................................................................................................49 A_Restore ............................................................................................................................................49 A_Transfer .....................................................................................................................................50 A_Req_Anti_LoadKey_Authent ....................................................................................................50 A_Req_Anti_LoadKey_Authent_Read .........................................................................................51 A_Req_Anti_LoadKey_Authent_Write ........................................................................................52 A_Increment_Transfer ..................................................................................................................53 A_Decrement_Transfer.................................................................................................................53 A_Restore_Transfer ......................................................................................................................54 A_Req_Anti_Select ........................................................................................................................54

6.2 ISO14443B ................................................................................................................................................................56 6.2.1 ISO14443B standard commands ...................................................................................................................56 6.2.1.1 6.2.1.2 6.2.1.3 6.2.1.4 6.2.1.5 6.2.1.6 6.2.1.7 6.2.1.8 6.2.1.9

B_Request ............................................................................................................................................56 B_WakeUp ...........................................................................................................................................57 B_ATTRIB..............................................................................................................................................57 B_Halt...................................................................................................................................................58 B_Deselect ...........................................................................................................................................58 B_TransparentWithCRC ......................................................................................................................59 B_TransparentWithoutCRC ................................................................................................................60 B_TransparentConfigCRC ...................................................................................................................60 B_TransparentRXMultiple ..................................................................................................................60

6.3 ISO15693 ..................................................................................................................................................................61 6.3.1 ISO15693 Standard Command ......................................................................................................................64 6.3.1.1 6.3.1.2 6.3.1.3 6.3.1.4 6.3.1.5 6.3.1.6 6.3.1.1

Inventory 1slot ....................................................................................................................................65 Inventory 16 slot .................................................................................................................................66 Stay Quiet ............................................................................................................................................68 ReadSingleBlocks .................................................................................................................................68 WriteSingleBlocks................................................................................................................................68 Lock Block ............................................................................................................................................69 ReadMultipleBlocks ............................................................................................................................69

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 4 of 115

www.sic.co.th

The Intelligence and Innovation

6.3.1.2 6.3.1.3 6.3.1.4 6.3.1.5 6.3.1.6 6.3.1.7 6.3.1.8 6.3.1.9 6.3.1.10

Pi-931 Demonstration Software Manual

WriteMultipleBlocks ...........................................................................................................................70 Select ....................................................................................................................................................71 ResetToReady ......................................................................................................................................71 WriteAFI ...............................................................................................................................................71 LockAFI .................................................................................................................................................72 WriteDSFID ..........................................................................................................................................72 Lock DSFID ...........................................................................................................................................73 Get System Information .....................................................................................................................73 Get Multiple Block Security status ...............................................................................................74

6.3.2 Example of ISO15693 standard command usage .........................................................................................74 6.3.3 Custom command for SIC5600 ......................................................................................................................75 6.3.3.1 6.3.3.2 6.3.3.3 6.3.3.4 6.3.3.5 6.3.3.6 6.3.3.7 6.3.3.8 6.3.3.9 6.3.3.10 6.3.3.11 6.3.3.12 6.3.3.13 6.3.3.14 6.3.3.15

Set EAS .................................................................................................................................................77 Reset EAS .............................................................................................................................................77 Lock EAS ...............................................................................................................................................77 EAS Alarm ............................................................................................................................................78 Write Password ...................................................................................................................................78 Lock Password .....................................................................................................................................78 Set Password Mode ............................................................................................................................78 Lock Password Mode ..........................................................................................................................80 Get Password Mode ............................................................................................................................80 Load Password ...............................................................................................................................81 Kill ...................................................................................................................................................83 Set OTP ...........................................................................................................................................84 Get OTP ..........................................................................................................................................84 Write XUID .....................................................................................................................................85 Read XUID ......................................................................................................................................85

6.3.4 Special command............................................................................................................................................85 6.4 Pico Tag ....................................................................................................................................................................86 6.4.1 Pico Tag standard commands ........................................................................................................................87 6.4.1.1 6.4.1.2 6.4.1.3 6.4.1.4 6.4.1.5 6.4.1.1 6.4.1.1

ACTALL .................................................................................................................................................88 IDENTIFY...............................................................................................................................................88 SELECT ASNB ........................................................................................................................................89 SELECT SNB ..........................................................................................................................................89 HALT .....................................................................................................................................................89 READ .....................................................................................................................................................89 READ4...................................................................................................................................................90

6.4.2 Special command............................................................................................................................................91 6.5 Felica.........................................................................................................................................................................92 6.5.1 Polling command ............................................................................................................................................92 6.5.2 Special command............................................................................................................................................93 6.6 NFC tag type 1 (Topaz) ............................................................................................................................................94 6.6.1 ISO14443A standard commands ...................................................................................................................95 6.6.1.1 6.6.1.2

A_Request command ..........................................................................................................................95 A_Wakeup command .........................................................................................................................95

6.6.2 NFC Tag type 1 proprietary commands ........................................................................................................96 6.6.2.1 6.6.2.2 6.6.2.3 6.6.2.4 6.6.2.5

N1_ReadUID ........................................................................................................................................96 N1_ReadAll ..........................................................................................................................................96 N1_ReadByte .......................................................................................................................................97 N1_WriteWithErase ............................................................................................................................97 N1_WriteWithoutErase ......................................................................................................................97

6.6.3 Special commands ..........................................................................................................................................98 6.7 NFC tag type 2 (MIFARE Ultralight/C) ....................................................................................................................98 Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 5 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.7.1 ISO14443A standard commands ...................................................................................................................99 6.7.1.1 6.7.1.2 6.7.1.3 6.7.1.4 6.7.1.5

A_Request ............................................................................................................................................99 A_Wakeup ........................................................................................................................................ 100 A_AntiCall ......................................................................................................................................... 100 A_Select ............................................................................................................................................ 101 A_Halt ............................................................................................................................................... 101

6.7.2 MIFARE Ultralight proprietary command .................................................................................................. 101 6.7.2.1 6.7.2.2 6.7.2.3 6.7.2.4

UL_Read ............................................................................................................................................ 102 UL_Write ........................................................................................................................................... 102 UL_CompatibilityWrite .................................................................................................................... 103 UL_3DES_Authentication ................................................................................................................ 103

6.7.3 Combo command ........................................................................................................................................ 103 6.7.3.1

A_Req_Anti_Select ........................................................................................................................... 103

6.7.4 Special commands ....................................................................................................................................... 104 6.8 EMV analogue test command ............................................................................................................................. 104 6.8.1 Analog Configuration commands ............................................................................................................... 105 6.8.1.1 6.8.1.2 6.8.1.3

Initial_Analog_Parameter_All ......................................................................................................... 105 Get_Analog_Parameter ................................................................................................................... 106 Set_Analog_Parameter .................................................................................................................... 106

6.8.2 Pre-Validation commands ........................................................................................................................... 107 6.8.2.1 6.8.2.2 6.8.2.3 6.8.2.4 6.8.2.5 6.8.2.6 6.8.2.7 6.8.2.8 6.8.2.9 6.8.2.10

EMV_OFF_RF .................................................................................................................................... 107 EMV_ON_RF ..................................................................................................................................... 107 EMV_WUPA ...................................................................................................................................... 108 EMV_WUPA->RATS .......................................................................................................................... 108 EMV_PPS ........................................................................................................................................... 109 EMV_WUPB ...................................................................................................................................... 109 EMV_ATTRIB ..................................................................................................................................... 110 EMV_APDU1, 2 and 3....................................................................................................................... 110 EMV_Deselect .................................................................................................................................. 111 EMV_Polling ................................................................................................................................ 111

6.8.3 Load Modulation commands ...................................................................................................................... 113 6.8.3.1 6.8.3.2

ISO14443A_EMV_Load_Mod .......................................................................................................... 113 ISO14443B_EMV_Load_Mod .......................................................................................................... 114

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 6 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

List of Figures Figure 1 A “Found New Hardware” pops up .......................................................................................................................13 Figure 2 Select “No, not this time”. .....................................................................................................................................13 Figure 3 Select Option “Install from a list or specific location (Advanced)” .....................................................................14 Figure 4 Browse to folder "Pi931_Driver" in CD or where the driver is located .............................................................14 Figure 5 Click “Continue Anyway” .......................................................................................................................................14 Figure 6 Windows is installing the driver. ...........................................................................................................................15 Figure 7 Installation completes. ...........................................................................................................................................15 Figure 8 pop up shows hardware is ready to use ...............................................................................................................15 Figure 9 COM Port for Pi-931 Hardware displays in Device Manager. ..............................................................................16 Figure 10 An “Installing device driver software” notification .............................................................................................16 Figure 11 A ”Device driver software was not successfully installed” notification ............................................................16 Figure 12 “Driver Software Installation” Window ...............................................................................................................16 Figure 13 “Skip getting driver software” window ................................................................................................................17 Figure 14 Device Manager window, shows the SIC PI931 on the Other devices group ...................................................17 Figure 15 “How do you want to search for driver software” window ...............................................................................18 Figure 16 “Browse for driver software” window .................................................................................................................18 Figure 17 “Windows Security” window ................................................................................................................................19 Figure 18 “Driver software installing” window ....................................................................................................................19 Figure 19 Driver software installation successful window ..................................................................................................20 Figure 20 COM Port for Pi-931 Hardware displays in Device Manager .............................................................................20 Figure 21 Demonstration software ......................................................................................................................................21 Figure 22 Demonstration software ......................................................................................................................................21 Figure 23 TX and RX Speed for reader CODEC in ISO15693 protocol ................................................................................22 Figure 24 Sections in Demonstration software ...................................................................................................................23 Figure 25 Port-and-Constant Setup .....................................................................................................................................23 Figure 26 OPEN PORT Menu ................................................................................................................................................23 Figure 28 CLOSE PORT Menu ...............................................................................................................................................24 Figure 29 closed com port .....................................................................................................................................................24 Figure 30 SET INIT SEQNUM Menu .....................................................................................................................................24 Figure 31 SET DEV ID Menu..................................................................................................................................................25 Figure 33 GET FW VERSION Menu.......................................................................................................................................25 Figure 34 Firmware version report ......................................................................................................................................25 Figure 35 Example of button and setup in ISO 15693 tab..................................................................................................27 Figure 36 “Load Saved UID” checked box ...........................................................................................................................28 Figure 37 “Save UID” checked box .......................................................................................................................................28 Figure 38 Command and setup in Reader Configuration tap ............................................................................................29 Figure 39 Raw data input and output for developer ..........................................................................................................30 Figure 40 Example of Direct TX Input and RX Output..........................................................................................................31 Figure 41 Effect of “Show Raw Pck” in transaction display................................................................................................31 Figure 42 Usage of additional TX input and RX output section .........................................................................................31 Figure 43 Example of save file format from the additional Tx commands in Figure 43. ..................................................32 Figure 44 Transaction Logs text box. ...................................................................................................................................33 Figure 45 Command Frame Format .....................................................................................................................................34 Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 7 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 48 Decomposition of abridged frame format displayed in demonstration software...........................................35 Figure 49 ISO14443A command list .....................................................................................................................................36 Figure 50 A_Request Command ..........................................................................................................................................36 Figure 51 ISO14443A standard commands available in Pi-931 .........................................................................................37 Figure 52 A_Wakeup Command ..........................................................................................................................................37 Figure 53 Parameters in A_AntiColl command ..................................................................................................................38 Figure 54 Result ID from CollMaskVal .................................................................................................................................38 Figure 55 Parameters in A_Select command ......................................................................................................................39 Figure 57 Parameters in A_PPS command ..........................................................................................................................40 Figure 58 A_Deselect command ..........................................................................................................................................40 Figure 59 A_Halt command...................................................................................................................................................40 Figure 60 Running multiple commands in ISO14443A .......................................................................................................41 Figure 61 The Special Command for ISO14443A ................................................................................................................42 Figure 62 Available commands related to MIFARE in Pi-931 .............................................................................................42 Figure 63 MIFARE Standard commands ..............................................................................................................................43 Figure 64 MIFARE Combo commands .................................................................................................................................43 Figure 65 A_LoadKey command ..........................................................................................................................................44 Figure 66 A_Authentication commands .............................................................................................................................44 Figure 67 A_ReadBlock commands .....................................................................................................................................45 Figure 68 A_WriteBlock commands ....................................................................................................................................46 Figure 69 A_WriteValueBlock commands ..........................................................................................................................46 Figure 70 Structure of value block .......................................................................................................................................47 Figure 71 Structure of the sector trailer block ....................................................................................................................47 Figure 72 Access conditions for data blocks .......................................................................................................................47 Figure 73 Access conditions for the sector trailer ..............................................................................................................48 Figure 74 A_WriteSectorTrailerBlock commands ..............................................................................................................48 Figure 75 A_Increment commands .....................................................................................................................................49 Figure 76 A Decrement commands .....................................................................................................................................49 Figure 77 A_Restore commands ..........................................................................................................................................50 Figure 78 A_Transfer commands .........................................................................................................................................50 Figure 80 A_Req_Anti_LoadKey_Authent_Read commands ...........................................................................................52 Figure 81 A_Req_Anti_LoadKey_Authent_Write commands ..........................................................................................52 Figure 83 A_Decrement_Transfer commands ...................................................................................................................54 Figure 84 A_Restore_Transfer commands .........................................................................................................................54 Figure 85 A_Req_Anti_Select command ............................................................................................................................55 Figure 86 ISO14443B command list .....................................................................................................................................56 Figure 87 ISO14443B standard commands available in Pi-931..........................................................................................56 Figure 88 B_Request Command ..........................................................................................................................................57 Figure 89 B_WakeUp Command ..........................................................................................................................................57 Figure 90 B_ATTRIB Command ............................................................................................................................................58 Figure 91 B_Halt Command .................................................................................................................................................58 Figure 92 B_Deselect Command ..........................................................................................................................................59 Figure 93 Example of using B_ TransparentWithCRC with SRI4K card .............................................................................59 Figure 94 Timeout setting for TransparentWithCRC and TransparentWithoutCRC command .....................................59 Figure 95 Example of running multiple ISO14443B command ..........................................................................................60 Figure 96 B_TransparentConfigCRC command ...................................................................................................................60 Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 8 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 97 GUI in ISO15693 Tab ............................................................................................................................................61 Figure 99 command mode in ISO15693 ..............................................................................................................................62 Figure 100 State transition diagram of the ISO15693 card ................................................................................................62 Figure 102 Sub mode in Non-inventory mode ....................................................................................................................63 Figure 103 Standard Commands in ISO15693 .....................................................................................................................64 Figure 105 Example of Inventory 16 slot ............................................................................................................................67 Figure 106 An example of Using Inventory 16 slot in anti-collision ..................................................................................67 Figure 107 Stay Quiet Command .........................................................................................................................................68 Figure 108 ReadSingleBlock command ...............................................................................................................................68 Figure 109 WriteSingleBlock command ..............................................................................................................................69 Figure 110 Lock Block command .........................................................................................................................................69 Figure 111 ReadMultipleBlock command ..........................................................................................................................70 Figure 112 WriteMultipleBlocks command ........................................................................................................................70 Figure 113 Select command .................................................................................................................................................71 Figure 114 ResetToReady command ...................................................................................................................................71 Figure 115 WriteAFI command ............................................................................................................................................72 Figure 116 LockAFI command ..............................................................................................................................................72 Figure 117 WriteDSFID command .......................................................................................................................................73 Figure 118 LockDSFID command .........................................................................................................................................73 Figure 119 GetSystemInformation command ....................................................................................................................74 Figure 120 GetMultipleBlockSecuritystatus command.....................................................................................................74 Figure 121 Example of ISO15693 standard command usage ............................................................................................75 Figure 123 Set EAS command ..............................................................................................................................................77 Figure 124 Reset EAS command ..........................................................................................................................................77 Figure 125 Lock EAS command ............................................................................................................................................78 Figure 126 Write Password command ................................................................................................................................78 Figure 127 Lock Password command ..................................................................................................................................79 Figure 128 Set Password Mode command .........................................................................................................................79 Figure 130 Get Password Mode command ........................................................................................................................80 Figure 132 Example of Kill operation...................................................................................................................................83 Figure 134 Get OTP command .............................................................................................................................................84 Figure 136 Read XUID command .........................................................................................................................................85 Figure 138 Timeout setting for Special command..............................................................................................................86 Figure 139 Reading data from block 0 by using TransparentWithCRC .............................................................................86 Figure 141 Speed setup for PICO Tag ..................................................................................................................................87 Figure 142 State diagram of PicoTag / PicoPass .................................................................................................................88 Figure 143 ACTALL command and response .......................................................................................................................88 Figure 144 IDENTIFY command ...........................................................................................................................................88 Figure 145 SELECT ASNB command .....................................................................................................................................89 Figure 146 SELECT SNB command .......................................................................................................................................89 Figure 147 HALT command ..................................................................................................................................................90 Figure 148 READ command ..................................................................................................................................................90 Figure 149 READ4 command ................................................................................................................................................90 Figure 150 Felica command tab ...........................................................................................................................................92 Figure 151 C_Polling command in reading a Felica card....................................................................................................92 Figure 153 NFC tag type 1 tab ...............................................................................................................................................94 Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 9 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 154 NFC tag type 1 State diagram .............................................................................................................................94 Figure 155 ISO14443A command related to NFC tag type 1 ..............................................................................................95 Figure 156 A_Request command .........................................................................................................................................95 Figure 157 A_Wakeup command .........................................................................................................................................95 Figure 159 N1_ReadUID command ......................................................................................................................................96 Figure 160 N1_ReadAll command ........................................................................................................................................96 Figure 161 N1_ReadByte command .....................................................................................................................................97 Figure 163 N1_WriteWithoutErase command ...................................................................................................................98 Figure 165 MIFARE Ultralight Tab .........................................................................................................................................98 Figure 166 MIFARE Ultralight / Ultralight C state diagram .................................................................................................99 Figure 167 MIFARE Ultralight ISO14443A commands .........................................................................................................99 Figure 168 A_Request command ...................................................................................................................................... 100 Figure 169 A_Wakeup command ...................................................................................................................................... 100 Figure 170 A_AntiCall commands..................................................................................................................................... 100 Figure 172 A_Halt command ............................................................................................................................................. 101 Figure 173 MIFARE Ultralight command ........................................................................................................................... 102 Figure 174 UL_Read command ......................................................................................................................................... 102 Figure 176 UL_CompatibilityWrite command................................................................................................................. 103 Figure 178 A_Req_Anti_Select command ........................................................................................................................ 104 Figure 180 EMV analogue test command tab ................................................................................................................... 105 Figure 181 Initial_Analog_Parameter_All command ...................................................................................................... 106 Figure 182 Get_Analog_Parameter command ................................................................................................................ 106 Figure 183 Set_Analog_Parameter command ................................................................................................................. 107 Figure 184 EMV_OFF_RF command .................................................................................................................................. 107 Figure 185 EMV_ON_RF command ................................................................................................................................... 108 Figure 186 EMV_WUPA command .................................................................................................................................... 108 Figure 187 EMV_WUPA->RATS command........................................................................................................................ 109 Figure 188 EMV_PPS command......................................................................................................................................... 109 Figure 189 EMV_WUPB command .................................................................................................................................... 110 Figure 190 EMV_ATTRIB command................................................................................................................................... 110 Figure 191 EMV_APDU command ..................................................................................................................................... 111 Figure 192 EMV_Deselect command ................................................................................................................................ 111 Figure 193 EMV_Polling command .................................................................................................................................. 112 Figure 194 ISO14443A_EMV_Load_Mod command ....................................................................................................... 114 Figure 195 ISO14443B_EMV_Load_Mod command ........................................................................................................ 115

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 10 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

List of Table Table 1-1 Card or card that Pi-931 supports .......................................................................................................................12 Table 4-1 Dev ID ....................................................................................................................................................................25 Table 5-1 Meaning of byte in Command Frame Format ....................................................................................................34 Table 5-2 Meaning of bytes in Response Frame .................................................................................................................34 Table 6-1 Supported RF transmission speed .......................................................................................................................61 Table 6-2 operable mode between command mode and card state ................................................................................62 Table 6-3 Standard Command for ISO15693.......................................................................................................................64 Table 6-4 Custom Command for SIC5600............................................................................................................................75 Table 6-5 Summarized protection function controlled by PA (Password Allocation ) and SM (Security Mode) ...........79 Table 6-6 Password mode (PWD Mode)..............................................................................................................................80 Table 6-7 Kill Enable : Set up Kill-Enable bit .......................................................................................................................80 Table 6-8 M : Specify password in card used to compare with transmitted password during loading password.........80 Table 6-9 PA (Password Allocation) : Define passwords to be used in protection...........................................................81 Table 6-10 SM ( Security Mode(1:0) ) : Define protection function of the password ......................................................81 Table 6-11 OTP Mode ...........................................................................................................................................................84 Table 6-12 L : Lock Control to Lock current status of OTP MODE .....................................................................................85 Table 6-13 OTP MODE(1:0)...................................................................................................................................................85 Table 6-14 Pico Product Family ............................................................................................................................................86 Table 6-15 NFC tag type 1 Address byte...............................................................................................................................97 Table 6-16 Default Analog Parameter ............................................................................................................................... 105 Table 6-17 ISO14443A Load Modulation command sequence ........................................................................................ 113 Table 6-18 ISO14443B Load Modulation command sequence ........................................................................................ 114

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 11 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

1. Introduction The Pi-931 is a series of miniaturized 13.56MHz RFID reader module. Based on high-performance RFID contactless reader IC SIC9310 from Silicon Craft Technology, the Pi-931 supports all major global secured baseband standards namely ISO14443-A, -B, JIS: X6319-4 (Felica), NFC tag type 1, NFC tag type 2, and ISO15693 as well as the MIFARE classic cards. Moreover, the Pi-931 is also supports test requirements for EMV analogue testing such as Prevalidation and Load Modulation. This manual describes how to use demonstration software for evaluating and exploring various features of Pi-931 through providing protocol. The Pi-931 protocol contains basic commands as stated in the standards and combo commands for one-stop operation as well as arbitrary commands for higher layer protocol communication. Performing RFID operation through the providing protocol is suitable for system integrators or hardware/software developers who have to be involved in the 13.56MHz RFID applications without dealing low level operation with SIC9410 chip set. Demonstration software is designed to guide user/developer to quickly understand the Pi-931 protocol and be capable to implement your own RFID software applications. Moreover, the open source C# of the demonstration software is also provided in CD for reference. The cards or cards that Pi-931 can support are summarized in Table 1-1. Table 1-1 Card or card that Pi-931 supports Standard

Cards or cards that Pi-931 can supports

ISO 14443A

MIFARE Family, ISO14443A memory card, ISO14443A smart card

ISO 14443B

Type-B SRI Series (ST), ISO14443B memory card, ISO14443B smart card

ISO 15693

SIC5600 (SIC), I-Code Family (NXP), Card-it (TI), LRI Series (ST), ISO15693 Label

JIS: X6319-4 (Felica)

Felica(Sony)

NFC tag type 1

Topaz(Innovision)

NFC tag type 2

SIC4310(SIC), MIFARE Ultralight/C(NXP),

2. Getting Started Before user can operate the demonstration software, proper operational environment and the following requirements must be prepared. 2.1 System and Hardware Requirements 

Computer

: PC with USB Port



Operating System

: Windows 7, Windows VISTA, Windows XP SP2



RFID Reader

: Pi-931 Reader



Software Requirement

: .NET framework version higher than 2.0 Installed



Others

: Card/Tag, DC Adaptor ( if it is required in some model )

2.2 Content in CD Content in CD, shown in , consists of 

Demonstration Software in folder “Demo_Software”



Documents namely Module Datasheets and Software Manuals in folder “Documents”



.Net Framework in folder “Dot_Net_Framework”



Pi931 Driver for emulating RS232 on USB in folder “PI931_Driver”



Example software source code in “SW_Source_Codes”

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 12 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 1 Content in a CD 2.3 Software Installation 2.3.1 1.

Driver Installation for Windows XP (For Virtual RS232 on USB)

Connect USB cable to the Pi-931 reader Hardware. Then, there will be a “Found New Hardware” pop up indication.

Figure 2 A “Found New Hardware” pops up 2.

Windows will ask for the way for driver installation. Select “No, not this time”.

Figure 3 Select “No, not this time”. 3.

Windows will request for driver installation. Select Option “Install from a list or specific location (Advanced)”.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 13 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 4 Select Option “Install from a list or specific location (Advanced)” 4.

Select “Search for the best driver in these locations” and check “Include this location in the search” box. Then, Browse to folder “D:\Pi931_Driver” in CD or where the driver is located. Click “Next”.

Figure 5 Browse to folder "Pi931_Driver" in CD or where the driver is located 5.

Windows ask to ensure installation the driver from SIC as shown in Figure 6; please click “Continue Anyway”.

Figure 6 Click “Continue Anyway” 6.

Wait for driver installation.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 14 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 7 Windows is installing the driver. 7.

If installation completes, there will a window indicating installation finish as shown below displayed. Please click Finish.

Figure 8 Installation completes. 8. There is the pop up shows hardware is ready to use. At this time, the device is successfully connected to PC and the LED on the module is turn on.

Figure 9 pop up shows hardware is ready to use 9.

User can check the number of comport from Device Manager. As shown in Figure 10, the number of comport for this Pi-931 hardware in this example is “COM4”. Note that the assigned number of comport is different for each computers.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 15 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 10 COM Port for Pi-931 Hardware displays in Device Manager.

2.3.2 1.

Driver Installation for Windows 7 (For Virtual RS232 on USB) Connect USB cable to the Pi-931 reader Hardware. Then, there will be a “Installing device driver software” notification

Figure 11 An “Installing device driver software” notification 2.

Wait for a ”Device driver software was not successfully installed” notification

Figure 12 A ”Device driver software was not successfully installed” notification Sometimes it takes very long time, User can click at the device installing icon (the white verticle bar with green ball circling on) to see the driver software installation window

Figure 13 “Driver Software Installation” Window

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 16 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Click “Skip obtaining driver software from Windows Update”. After that, the confirmation pop up window will be shown. Click “Yes” to confirm.

Figure 14 “Skip getting driver software” window 3.

Open “Control Panel”Device Manager. Click on “Other devices” to see the “SIC PI931” on the list. Right click at “SIC PI931” and select “Update driver software” or select “SIC PI931” and click “Update driver software button”

Figure 15 Device Manager window, shows the SIC PI931 on the Other devices group 4.

Click “Browse my computer for driver software” to select the driver’s location.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 17 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 16 “How do you want to search for driver software” window

5.

Click “Browse” button and select the “Pi931 Driver” folder on a CD or where the driver is located. Then, click “Next”.

Figure 17 “Browse for driver software” window 6.

Windows ask to ensure installation the driver. click “Install this driver anyway” for continuing..

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 18 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 18 “Windows Security” window 7.

Wait for driver installation.

Figure 19 “Driver software installing” window

8.

If the driver is installed successfully, there is a pop-up windows shows the successfully installation.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 19 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 20 Driver software installation successful window 10. User can check the number of comport from Device Manager. The number of comport for this Pi-931 hardware in this example is “COM4”. Note that the assigned number of comport is different for each computers.

Figure 21 COM Port for Pi-931 Hardware displays in Device Manager

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 20 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

3. Quick Start with Demonstration Software The demonstration software is “SIC HF SDK.exe” provided in the folder “Demo_Software”. There is no software setup required; just double click the “SIC HF SDK.exe”. The demonstration software can run either from CD or a copy on hard drive. The GUI of software is shown in Figure 22 and ready to use.

Figure 22 Demonstration software Following steps, as shown in Figure 23, demonstrate a simple usage in reading UID of ISO15693 card for quick understanding.

1 10 2

3 5

6

4 7 8 11

12 9 13

2

Figure 23 Demonstration software

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 21 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

1) Connect a Pi-931 device to computer and wait until computer recognize COMPORT as shown in Figure 23. Then, click “OPEN PORT” Menu tap to query available COMPORT in computer. 2) Available COMPORT in computer is shown. Click the COMPORT number belonging to reader hardware. If connection is successful, there will be the connected comport with communication speed displayed at bottom of the GUI. 3) Click “ISO15693” tap to selection operation related to ISO15693 4) Click “Setup” button to configure reader IC to be ready to transmit and receive ISO15693 frame format 5) Select preferred speed using in RF transaction. In this example, select “1 out of 256 (1.65 Kbits/s)” for TX (downlink) and “1 Sub Low Rate (6.62 Kbits/s)” (Uplink).

Figure 24 TX and RX Speed for reader CODEC in ISO15693 protocol

6) Click “SET” button, shown in Figure 24, to configure codec speed of reader 7) Select Command “Inventory 1 Slot” by clicking on the name of that command in order to read the card UID. The selected command will be highlighted. 8) Input necessary parameters. The parameters required in this command are Inventory mode, Mark Len and Mark Value. User can left these inputs blank in this case. Then, value of “0” is used. 9) Check “Save UID” check box to save readable UID in software buffer. This UID might be used in further operation. 10) Ensure that ISO15693 card is placed in operation range of the hardware reader. Click “Send” to transmit the command to reader hardware to read UID of ISO15693 card. 11) Transaction between reader hardware and PC is display in communication logs. For more information about response frame format, please refer to “Pi-931 Protocol” Document. 12) For standard commands in command list, the response is translated and displayed in command response section for easy understand. In this case, response is successful by response code “01” while DFSID and UID are shown. Note that user can watch transactions between reader hardware and PC to be ideas in developing application from each step.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 22 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

4. Demonstration Software Component This software mainly consists of four sections as shown in Figure 25 namely 1) Port-and-Constant Setup 2) RFID standard taps and Reader Configuration tap 3) Raw data input and output for developer 4) Transaction logs. 1 3 2

4

Figure 25 Sections in Demonstration software 4.1 Port-and-Constant Setup This section consists of Menus related to hardware setup namely OPEN PORT, CLOSE PORT, SET INIT SEQNUM, GET CHIP NUMBER, SET DEV ID, GET FW VERSION and ABOUT.

Figure 26 Port-and-Constant Setup 4.1.1

OPEN PORT

OPEN PORT is used to query and open communication port to the reader device.

Figure 27 OPEN PORT Menu Following steps describe opening the communication port with Pi-931. Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 23 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual



Click OPEN PORT menu to search available com port present in computer.



Available COM ports are shown in menu content under OPEN PORT menu.



Click on the COM port number belonging to reader hardware being operated to open communication.



If connection is successful, there will be a connected comport with communication speed displayed at bottom of the GUI, as shown in Figure 28.

Figure 28 connected com port and communication speed (kbps) 4.1.2

CLOSE PORT

CLOSE PORT is used to close current communication port.

Figure 29 CLOSE PORT Menu 

Click CLOSE PORT to close current operating COM port.



The connection shown at bottom of the GUI indicated that the comport was closed, as shown in Figure 30.

Figure 30 closed com port 4.1.3

SET INIT SEQNUM

SET INIT SEQNUM is used to set initial sequence number SEQNUM in transmission command packet. The SEQNUM, 1-byte information, is automatically increased after transmission of each packet by this software. As shown in Figure 31, user can input two-hexadecimal number to set the initial sequence number.

Figure 31 SET INIT SEQNUM Menu 4.1.4

SET DEV ID

SET DEV ID is used to define target Device ID in transmission command packet. The Device ID (Dev ID) indicates specific device or all in a network to operate. The Dev ID is consisted of an ID and a silent control bit. The ID can be between 0x00 and 0x7F. The most significant bit in the Dev ID is the silent bit in which the operating devices will not response back to host. The device that receives matched ID from incoming packet will operate and respond back to host. The Dev ID in this setting can be from 0x00 and 0xFF. Then, there will be no response from packet containing the Dev ID between 0x80 and 0xFF. For Device ID of 0x00, all devices will operate and response back to host. The detail of Dev ID is summarized in Table 4-1. User can define Dev ID in packet by entering two- hexadecimal number as shown in Figure 32.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 24 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 32 SET DEV ID Menu

Table 4-1 Dev ID (1)

Silence Bit Dev_ID[7] 0

Device ID Dev_ID [6:0] 0x00

(2)

0

0x01 – 0x7F

1

0x00

Meaning All devices that receive command operate and respond back to host with Dev_ID of 0x00. The ID-matched device operates and responds back to host. The operating device will not respond back to host

(1)

The silence bit is an option for preventing data collision in reader network from simultaneous response.

(2)

Device ID 0x80 can use for broadcasting if there are multiple readers connected in a network. 4.1.5

GET CHIP NUMBER

GET CHIP NUMBER is used to get the number of the reader IC. Chip number is reported as shown in Figure 33.

Figure 33 Chip Number report 4.1.6

GET FW VERSION

GET FW VERSION is used to get firmware version from the connected device. Firmware version is reported as shown in Figure 35

Figure 34 GET FW VERSION Menu

Figure 35 Firmware version report

4.2 RFID standard taps and Reader Configuration tap This section consists of three RFID standard taps and Reader Configuration tap. For example, GUI in ISO15693 standard tap is shown in Figure 36. In ISO14443A and ISO14443B tap contains similar component with different Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 25 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

commands. For Reader configuration as shown in Figure 39, the provided GUI is for setting up and getting Device ID and RF Driver configuration. 4.2.1

RFID standard taps

Each RFID standard tap contains data transmission button, RF communication speed selection, parameters setup of each associated command as well as response reports from RF transaction of each command. 4.2.1.1 “Standard Setup” Button “Setup” Button is used to setup parameters in the reader to be ready to transmit and receive following standard in tap name. User must activate this setup before performing any RF-related operations in associated RFID protocol. 4.2.1.2 “Send” Button “Send” Button is used to transmit command that is currently highlighted in command list 4.2.1.3 “Start Send Multi Cmd” Button “Start Send Multi Cmd” button is used to transmission multiple commands consecutively that are checked in command list. From example in Figure 36, providing that no any command fail during each operation, Inventory 1 Slot, Read Single Block, Write Single Block and Select are operated in chronological order respectively. Note that command in the list is run from top to button. 4.2.1.4 Reader TX and Rx Speed selection This section is used to setup transmission and reception speed of CODEC in reader IC. User must setup the transaction speed before performing any RF-related operations in associated RFID protocol. In addition, current setup speed in the reader can be retrieved by “Get” button.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 26 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

3

2

9

4

1 5 6 7

8

Figure 36 Example of button and setup in ISO 15693 tab 4.2.1.5 “Enable once check” Check box The “Enable Once check” is an option in selecting command on command list. If “Enable Once check” box is checked, a pointed command in command list is checked on one click. 4.2.1.6 Command List The command list provides air-interface commands in each RFID standard. The commands include primitive command based on operating RFID standard and combo command for one stop operation as well as some proprietary commands for SIC RFID.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 27 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

4.2.1.7 Parameter setup The section is for setting up parameters required by each command. The section is different from command to command. User may have to refer to ISO standards for meaning and function of each parameter. If the inputs are left blank, value of “0” is used. In some command, there is a “Load Saved UID” checked box to load UID from previous operation to use in current operation. For the command required UID in operation, the “Load Saved UID” checked box is provided.

Figure 37 “Load Saved UID” checked box 4.2.1.8 Command Response The Command Response section displays and translates operation result and available response of each command. As shown in Figure 38, “01” indicates response is successful without any error. Also, received UID and DSFID in ISO15693 are displayed. The UID in response packet starts from least significant byte to most significant byte which reflects to what transmit from card in chronological order. For more information about meaning of response, please refer to Pi-931 Protocol. In some command, there is a “Save UID” check box for storing UID form current transaction for further operations. To store UID in software buffer, this checked box must be set prior operating command.

Figure 38 “Save UID” checked box 4.2.1.9 Run Multiloop This section is for setting multiple commands transmission in multiple loops. Button “Run” in this section is used to transmit multiple commands consecutively as “Start Send Multi Cmd”, but the transmission can perform in multiple loops. “Loop” text box is for defining the number of loop to be run. “Delay(ms)” text box is for defining the delay time between loop in milliseconds. “Count” textbox is for indicating the current running loop. Moreover, “Stop when error“ checkbox is for setting the running continuity. If it is checked, the sequence of transmission will be stopped if there is an error occurs. If not, the sequence of transmission is running through until the last loop without stop.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 28 of 115

www.sic.co.th

The Intelligence and Innovation

4.2.2

Pi-931 Demonstration Software Manual

Reader Configuration tap

1

2

Figure 39 Command and setup in Reader Configuration tap 4.2.2.1 “Device ID” Setup “Set Device ID” is for programming Device ID for individual reader. Only device ID between 0x00 and 0x7F is allowed. Also, device ID of connected device can be read from “Get Device ID” button. 4.2.2.2 “RF Driver Configuration” Setup This section is for setup driver configuration of the hardware. The driver configuration is information used by microcontroller to set up driver characteristic to serve specific RF topology in Pi931 family. This information is stored in EEPROM of SIC9310. To make the reader properly operable and achieve the highest performance, the driver configuration must be specifically set to match to RF topology of hardware. The RF topology can be one of these configurations namely 1. Differential driver with internal envelop detector, 2. Differential driver with external envelop detector, 3. Single ended driver with external envelop detector, 4. 50-ohm-output Class-E driver with external envelop detector. For every Pi-931 reader manufactured from Silicon Craft, the “RF Driver Configuration” is pre-programmed to match RF driver topology of the reader hardware. So, the “RF Driver Configuration” is provided for users who designs their own hardware based on Pi931-MD module and requires to reconfigure hardware constant to different RF driver topology. 4.3 Raw data input and output for developer This section is provided for developers to communicate with the hardware by hexadecimal code. Example of usage this section are transmitting commands not provided in command list. This is a common situation in 13.56MHz RFID application development. Moreover, this section can be used for debugging developing applications. To use this section, users have to input command in Hexadecimal format in TX and decode responses from hardware shown in RX by user defined programming or manually. For more information about module communication protocol and hexadecimal code, please refer to Pi-931 protocol document. The section is consisted of six components, which will be described below.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 29 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

14 13

1 2

15

3 12

4

5

6

7

8

9

10

11

Figure 40 Raw data input and output for developer 4.3.1

“Reset ASIC” button

This button is used to reset reader IC (SIC9310) 4.3.2

“ON RF” button

This “ON RF” button starts 13.56-MHz carrier emission. 4.3.3

“OFF RF” button

This “OFF RF” button stops 13.56-MHz carrier emission. 4.3.4

“RF Power Level” Selection

This pull down menu is for selecting transmitting strength of 13.56-MHz carrier. 4.3.5

“Set up” button (Power Level)

The Set up button is for configuring strength of transmitting carrier following defined RF Power Level. 4.3.6

"Width Restore (<)” button

This button is used to restore width and show all part of sub panel “RFID standard taps”. 4.3.7

"Send” button

The “Send” button is used to transmit command and data in TX box in section 4.3.9. 4.3.8

"Clear” button

The “Clear” button is used to clear content in section 4.3.9. 4.3.9

Direct TX Input and RX Output

TX Input consists of command box and its associated data to be send to RFID reader while RX output consists of feedback command mode and response data from RFID reader. As shown in Figure 41, “0x0A13”, which performs select command in ISO14443A, is the transmitted command and “0x001CBB4FCD” is the transmitted data to RFID reader. In RX box, “0x0A13” is feedback command to confirm operation and “0x0108” is response data from RFID reader.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 30 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual Module Command Tx Data to Module

Rx Data from Module Feedback module command

Figure 41 Example of Direct TX Input and RX Output 4.3.10

“Clear Logs” button

The “Clear Logs” button is used to clear all logs event in Transaction Log display. User can push F5 on the keyboard to perform the same operation. 4.3.11

“Show Raw Pck” Check box

If “Show Raw Pck” is checked, all every transaction between reader and host is displayed in full format. This will help user understand frame format structure of Pi-931 Protocol from header to checksum. The effect of “Show Raw Pck” is shown in Figure 42.

Figure 42 Effect of “Show Raw Pck” in transaction display 4.3.12

Additional TX Input section

The function of this section is similar as described in 4.3.9.The purpose of this section is for testing consecutive arbitrary command unavailable in command list. User can review each result in the Transaction Log. In addition, the box on the most right is for recording and comment. This help developer recognize meaning of each hexadecimal command. Usage of this section is shown in Figure 43.

Figure 43 Usage of additional TX input and RX output section Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 31 of 115

www.sic.co.th

The Intelligence and Innovation

4.3.13

Pi-931 Demonstration Software Manual

"<” button

The “<” button in “Additional TX Input and RX Output section” is used to extend or shrink this section for easy accessibility. When the symbol on the button is “<”, click the button extend the section. Once, the symbol on the button become “>”, click the button shrink this section. 4.3.14

Run Multiloop for Additional TX input

For each additional command entered (shown as an example in Figure 43), they can be transmitted consecutively from top to bottom in multiple loops in the same way as the “Run Multiloop” described in section 4.2.1.9 does. Please note that the transmission sequence is including the active (checked) commands only. 4.3.15

Save/Load Command

User can save the commands in the additional TX input section as a formatted text file using “Save” button. Therefore, the file with the same format can be load to the program using “Load” button. Moreover, since the file’s format is easy to understand, so user can create the file manually for batch inputting instead of keying each command on the screen.

Figure 44 Example of save file format from the additional Tx commands in Figure 43.

4.4 Transaction Logs If “Communication Logs” check box is checked, transaction between host and the device is logged and displayed in this section as shown in Figure 45. Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 32 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 45 Transaction Logs text box.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 33 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

5. Pi-931 Protocol To operate with Pi-931 module effectively, user should prior be familiar with technical terms, transaction speeds and parameters required in ISO14443, ISO15693, MIFARE and Felica as well as NFC tag type 1 and 2. The command available in this demonstration software is directly mapped from existing command in the protocol. So, user can understand how to interact with card step by step by manually inputting and activating commands at appropriate state of card and can learn how to use our protocol and compose correct structure from this demonstration software. To create application based on Pi-931 module, user should be able to transmit command in hexadecimal code and review response from the reader device. The Pi-931 protocol itself is basically a series of hexadecimal code. The command frame format is shown Figure 46 while Table 5-1 summarize meaning of bytes in frame. For the response frame, frame format detail is shown Figure 47 and Table 5-2.

Name

SOP

LENG-H

LENG-L

Seq Num

Dev_ID

CMD Category

CMD

Data[0]… Data[n-1]

LRC

Values No. Byte

0xAA 1-byte

0x00 1-byte

0x00 1-byte

1-byte

1-byte

1-byte

1-byte

n-byte

1-byte

Figure 46 Command Frame Format Table 5-1 Meaning of byte in Command Frame Format Name

Meaning

SOP

Start-of-Package byte ( 0xAA )

LENG-H

High byte of packet length counting from sequence number to Data[n-1]

LENG-L

Low byte of packet length counting from sequence number to Data[n-1]

Seq Number

Sequence number of Package

Dev_ID

Device ID byte : Silence bit (1Bit MSB) + Device_ID (7 Bit)

CMD Category

Command Category byte to specify operating standard or reader setup mode

CMD

Command byte in specified Command Category standard

Data[0] … Data[n-1]

Data bytes

LRC

Check sum of the packet which is XORing result from LENGTH to Data[n-1]

Name

SOP

LENG-H

LENG-L

Values No. Byte

0xAA 1-byte

0x00 1-byte

0x00 1-byte

Seq Num

Dev_ID

CMD Category

FBP CMD

Resp

Data[0]… Data[n-1]

LRC

1-byte

1-byte

1-byte

1-byte

1-byte

n-byte

1-byte

Figure 47 Response Frame Format Table 5-2 Meaning of bytes in Response Frame Name

Meaning

SOP

Start-of-Package byte ( 0xAA )

LENG-H

High byte of packet length counting from sequence number to Data[n-1]

LENG-L

Low byte of packet length counting from sequence number to Data[n-1]

Seq Number

Sequence number of operated command packet

Dev_ID

Response device ID byte : 0 (1 Bit) + ID of operating Device (7 Bit)

CMD Category

Operated Command Category byte

FBP CMD

Operated command byte

Resp

Response flag of operated command

Data[0] … Data[n-1]

Response Data Bytes

LRC

Check sum of the packet which is XORing result from LENGTH to Data[n-1]

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 34 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

The relation between hexadecimal of command and response displayed in transaction logs window and frame format as stated above is shown in Figure 48. This example shows performing inventory1slot in ISO15693. To display only necessary numbers in command and response packet, user can uncheck “Show Raw Pck” as explain in 4.3.11. Figure 49 depicted decomposition of abridged frame format. SOP (Start of Package) LENG-H LENG-L Seq Num Dev_ID CMD Category CMD Data[0] … Data[n-1] LRC

LRC Data[0] … Data[n-1] Resp FBP CMD CMD Category Dev_ID Seq Num LENG-L LENG-H SOP (Start of Package)

Figure 48 Decomposition of raw frame format of Pi-931 Dev_ID Seq Num CMD Category CMD Data[0] … Data[n-1]

Data[0] … Data[n-1] Resp FBP CMD CMD Category Seq Num Dev_ID

Figure 49 Decomposition of abridged frame format displayed in demonstration software

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 35 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6. Using Demonstration Software 6.1 ISO14443A Figure 50 shows GUI in ISO14443 tab. In the tab, user can transmit single or multiple commands, setup transaction speed as well as review card response. Command list consists of standard commands, MIFARE commands, Combo commands and transparent commands.

Figure 50 ISO14443A command list 6.1.1

ISO14443A standard commands

The standard commands used in ISO14443A-3 and -4 are illustrated in Figure 52, showing relation of each command in card-state transition diagram. Hence, each command shall be applied at appropriate state. The commands in this section are A_Request, A_WakeUp, A_Anticoll, A_Select, A_RATS, A_PPS, A_Halt and A_Deselect. For more information about the commands, please refer to ISO14443-3 and -4 standards and Pi-931 Protocol. 6.1.1.1 A_Request The A_Request command GUI is shown Figure 51. This command is used to probe if ISO14443A cards are in their field. This command requires no input.

Figure 51 A_Request Command Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 36 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 52 ISO14443A standard commands available in Pi-931 6.1.1.2 A_WakeUp The A_WakeUp command GUI is shown Figure 53. This command is used to probe if ISO14443A cards are in their field. This command requires no input.

Figure 53 A_Wakeup Command 6.1.1.3 A_Anticoll The A_Anticoll command GUI is shown Figure 54. The A_Anticoll not only transmits command as in the standard but also automatically seek out a complete UID from cards in the RF field. Providing that the cards Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 37 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

performed anti-collision are in the same range, the parameter CollMaskVal, as shown in Figure 54, in A_Anticoll can be used to select a card that condition matches. If the CollMaskVal is 0, the reader selects the UID from the card where the first collided bit is 0, and vice versa. The example of CollMaskVal usage is shown in Figure 55. If CollMaskVal is 1, UID of “3A 2A 10 92”is selected. If CollMaskVal is 0, UID of “0A BD 0F 92” is selected. The collision occurs at the fifth bit where first byte response from one card is 0x3A (00111010) and other is 0x0A (00001010). Note that shown UID in response packet starts from least significant byte to most significant byte which reflects to what transmits from card in chronological order. However, other factors such as transmission energy, size of antenna and coupling factor from card and others in RF environment introduce performance of this feature CollMaskVal. This feature can work well in reader equipped with proper antenna. Moreover, the A_Anticoll supports UID cascade level from level-1 to level-3.

Figure 54 Parameters in A_AntiColl command

ATQA UID ( CollMaskVal = 1 ) OFF Field ON Field

ATQA UID ( CollMaskVal = 0 )

Figure 55 Result ID from CollMaskVal 6.1.1.4 A_Select The A_Select command GUI is shown Figure 56. This command requires complete UID from the A_Anticoll command before operating. The A_Select supports UID cascade level from level-1 to level-3. 6.1.1.5 A_RATS (Request for answer to select) The A_RATS command GUI is shown Figure 57. This command requires FSD (Maximum PCD frame size) and CID (Card Identifier). This command shall be activated after card is selected the active state by A_Select command. The response from this command indicates card capabilities namely transaction speed, Frame wait time, Start-up Frame guard time, NAD support, CID support and History bytes. For more information about meaning of the Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 38 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

parameters, please refer to ISO14443-4. This command is in ISO14443A-4 which is the beginning point in entering smartcard protocol ISO7816.

Figure 56 Parameters in A_Select command

Figure 57 Parameters in A_RATS command 6.1.1.6 A_PPS (Protocol and parameter selection request) The A_PPS command GUI is shown Figure 58. This command is used to select operating protocol and parameter to use in further operation. This command requires CID, PPS0 and PPS1. This command shall be activated next to A_RATS command. After executing this command, user shall set the transaction speed match to what card response. However, if “Change speed after successful PPS” check box was checked, the speed will be changed automatically. For more information about meaning of the parameters, please refer to ISO14443-4.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 39 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 58 Parameters in A_PPS command 6.1.1.7 A_Deselect The A_Deselect command GUI is shown Figure 59. This command is used to quit operation of ISO14443-4 or higher layer to idle state of ISO14443-3. if “Change speed after successful Deselect” check box was checked, the transaction speed will be changed to the lowest rate automatically. This command requires no input and, actually, this command is made up of A_TransparentWithCRC. For more information about meaning of the parameters, please refer to ISO14443-4.

Figure 59 A_Deselect command 6.1.1.8 A_Halt The A_Halt command GUI is shown in Figure 60. This command is used to halt operation and change the state to halt state of ISO14443-3. This command requires no input.

Figure 60 A_Halt command 6.1.2

Performing Basic operation in ISO14443A standard

Figure 61 shows steps in performing basic command in ISO14443A from wake up to Halt through “Start Send multiple cmd” button. The steps are described as follows. 1.

Select ISO14443A Tap

2.

Click “Setup” to initialize reader to received ISO14443A frame

3.

Define transaction speed. For ISO14443A, speed must be start from 106kbps for both TX and RX.

4.

Click “Set” to configure transaction speed

5.

Select command to be run by checking box in front of the command. In this example, A_WakeUp, A_Anticoll, A_Select and A_Halt are selected.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 40 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

5.1 Select Cascade Level in A_Anticoll command to Default value and ensure that “Save UID” box is checked. 5.2 Select Cascade Level in A_Select command to Default value and ensure that “Load Saved ID” box is checked 6.

Click “Start Send Multi Cmd” button to run all selected command in defined order. Ensure that ISO14443A card is placed in vicinity of reader.

7.

If no error occurs, transaction results of each step are shown.

8.

Results from running each command are shown in associated response box. Note that if user requires running command not in provided order; please use “Raw data input and output” section as described in 4.3.12.

1 6 2

3

4

5 7

8

5.2 5.1

Figure 61 Running multiple commands in ISO14443A If commands to be transmitted are not provided in command list such as command for smart card, user can use the Special Command (A_TransparentWithCRC, A_TransparentWithoutCRC, A_TransparentConfigCRC, and A_TransparentRXMultiple) to directly transmit hexadecimal code to air. User may have to select preferred timeout period for no response, if some smartcard take long time in processing before response. The Special Command GUI is shown in Figure 62. For more information about the commands, please refer to Pi-931 Protocol.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 41 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 62 The Special Command for ISO14443A 6.1.3

MIFARE

MIFARE is encryption applications based on ISO14443A and operate on transaction speed of 106kbps. Before performing MIFARE command, a card must be prior selected in active state. The MIFARE commands Pi-931 can support are shown in Figure 63. There are basic MIFARE commands and MIFARE combo commands. The basic command are single operation commands as stated in MIFARE datasheet while combo commands are consecutive specific-operation commands from REQA to specific command in MIFARE such as read and write. The combo commands ease user to shorten reader operating time, development time and complexity of coding in user application.

Figure 63 Available commands related to MIFARE in Pi-931 Relation between Pi-931 commands in MIFARE state transition diagram are shown in Figure 64 and Figure 65.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 42 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 64 MIFARE Standard commands

1

4 2

1

3

5

2

3 4

5

6

6

Figure 65 MIFARE Combo commands

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 43 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.1.3.1 A_LoadKey The A_LoadKey command GUI is shown Figure 66. This command requires a 48-bit hexadecimal key matched the key in memory sector on card being authenticated. The supplied key is loaded into key buffer in reader IC to be used authentication.

Figure 66 A_LoadKey command 6.1.3.2 A_Authentication The A_Authentication command GUI is shown Figure 67. Parameter as follows shall be specified. Select Key

: Key A or Key B on card used in authentication

Block Num

: The block address to be accessed

UID

: Unique ID of card to be accessed

This operation shall be performed after executing A_LoadKey. For typical 1k-byte MIFARE card, every four blocks is governed by keys (A and B) of each sector. For example, block 4, 5, 6 and 7 rely on the same key stored in block. If block 4 was authenticated, block 5, 6 and 7 can also be accessed with re-authentication. If authentication is successful, reader will return successful code “0x01”as shown in Figure 67.

Figure 67 A_Authentication commands 6.1.3.3 A_ReadBlock The A_ReadBlock command GUI, shown Figure 68, is to read data from target block address. Therefore, the target block address to be read is a required parameter. User should read data with in authenticated sector. Else, the card will response error and accessing process must be restart from A_Request command. This operation shall be performed after successful authentication. Software automatically reports characteristic of received data whether it is data block, value block or Sector Trailer Block. Reading result from plain data block, value block and sector trailer block are shown in Figure 68A, Figure 68B and Figure 68C respectively.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 44 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

A) Data Block

C) Sector Trailer block

B) Value Block

D) Sector Trailer Block with control block unchecked Figure 68 A_ReadBlock commands

6.1.3.4 A_WriteBlock The A_WriteBlock command GUI, shown Figure 69, is to write data to target block address. Parameters as follows shall be specified. Block Num : The target block address to be written Block Data : 16-byte data coded in hexadecimal format This operation shall be performed after successful authentication.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 45 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

Figure 69 A_WriteBlock commands 6.1.3.5 A_WriteValueBlock The A_WriteValueBlock command GUI, shown Figure 70, is to write value to target block address. Parameters as follows shall be specified. Address value

: a 1-byte data storing in value block for indicating address of back up block

Value

: a 4-byte data coded in 2’s complement format In this demonstration software, user can either input amount of value in hexadecimal or decimal number. To input value in hexadecimal, use box “Data Value (MSB)”. To input value in decimal, input data in box “Data Value (Dec)”. For hexadecimal, value of 0x00000000 to 0x7FFFFFFF is positive number from 0 to 2,147,483,647 while value of 0x80000000 to 0xFFFFFFFF is negative number from -2,147,483,648 to -1. For decimal number, data shall be within -2,147,483,648 to 2,147,483,647.

Block Num

: The target block address to be written.

This operation shall be performed after successful authentication. Note that value and address value is redundantly stored in 16-byte blocks as depicted in Figure 71.

Figure 70 A_WriteValueBlock commands

Byte # 0 1 2 Description Value Note _Value is inversion of Value

3

4

Value Blocks 5 6 7 8 9 10 _Value Value Note _Adr is inversion of Adr

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

11

12 Adr

13 _Adr

14 Adr

SIC_PD_DTS_0009 Rev 1.2 Page 46 of 115

www.sic.co.th

15 _Adr

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 71 Structure of value block 6.1.3.6 A_WriteSectorTrailerBlock The sector trailer located in last block of each sector contains secret key A and key B, which return logical “0” when read, and the access condition for the four blocks of each sector. The structure of the sector trailer block and access bit organization are shown in Figure 72. The accessibility of each block is controlled by three control bits namely C1x, C2x and C3x. The access condition is redundantly stored with its inversion to secure data protection. There are different meanings about accessibility for the sector trailer block and data blocks as shown in Figure 73 and Figure 74. Note that byte 9 in the sector trailer block is the user area.

Byte #

0

1

_C10 Bit # Byte 6 Byte 7 Byte 8 Byte 9

7 _C23 C13 C33

2

Key A _C10 _C10

_C10 6 _C22 C12 C32

3

4

5

_C10

_C10

Access Bits 5 4 3 _C21 _C20 _C13 C11 C10 _C33 C31 C30 C23

2 _C12 _C32 C22

Sector Trailer Blocks 6 7 8 Access Bits _C10 _C10 _C10 1 _C11 _C31 C21

0 _C10 _C30 C20

9

10

11

_C10

_C10

_C10

12 13 Key B _C10 _C10

Note _Cxx is inversion of Cxx

_C10

_C10

_C10

_C10

_C10

Access bit C1x

C2x

C3x

Description

Block0

C10

C20

C30

Data block 0 in the sector

Block1

C11

C21

C31

Data block 1 in the sector

Block2

C12

C22

C32

Data block 2 in the sector

Block3

C13

C23

C33

Data block 3 in the sector

Figure 72 Structure of the sector trailer block

Figure 73 Access conditions for data blocks

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 47 of 115

www.sic.co.th

14

15

_C10

_C10

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

Figure 74 Access conditions for the sector trailer The GUI for A_WriteSectorTrailerBlock is shown in Figure 75. Parameters as follows shall require. Key A

: A 6-bytes secret key

Key B

: A 6-bytes secret key

Access Condition : The access condition for Sector Trailer, Block0, Block1 and Block2 the number of 0 to 7 is selectable which a decimal result of bit “C1x-C2x-C3x” Block Num

: Target block to be written

User Area

: Value to be written in User Area. The value will be 0x00 if the textbox is left blank.

To ease beginner to understand the meaning of each access condition mode, the demonstration software summarizes accessibility of read and write of each block. Also, the check block “Original” can be optionally unchecked to display compatibility of each command. Before write the sector trailer, user must be aware the effect of written configuration because some configuration may be irreversible. Hence, the card is permanently locked in such mode. Original is not checked

Original is checked

<= Target Block

Figure 75 A_WriteSectorTrailerBlock commands Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 48 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Note that the demonstration software formats sector trailer from data in GUI and sent to reader by normal write command. 6.1.3.7 A_Increment The A_Increment command GUI is shown Figure 76A. Incremental value shall be specified either in hexadecimal or decimal value. Figure 76B shows example of incremental result of 200 from 1000 as in Figure 70. Increment which will result in amount of final value beyond 0x7FFFFFFF (2,147,483,647) is inhibited and cause error in operation. Note that result from increment is stored in card buffer. User must store to target address by using command A_Transfer. This operation shall be performed after successful authentication.

A) A_Increment command GUI B) Incremental result Figure 76 A_Increment commands 6.1.3.8 A_Decrement The A_Decrement command GUI is shown Figure 77A. Decreasing value shall be specified either in hexadecimal or decimal value. Figure 77B shows example of decrement of 100 from 1200 as in Figure 76. Decrement which will result in amount of final value below 0x80000000 (-2,147,483,648) is inhibited and cause error in operation. Note that result from increment is stored in card buffer. User must store to target address by using command A_Transfer. This operation shall be performed after successful authentication.

B) Decrement result A) A Decrement command GUI Figure 77 A Decrement commands 6.1.3.9 A_Restore The A_Restore command GUI is shown Figure 78. Parameter for this command is block address in which content will be loaded into card buffer. This operation shall be performed after successful authentication.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 49 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.1.3.10 A_Transfer The A_Transfer command GUI is shown Figure 79A. Parameter for this command is target block address where active content in card buffer will be written. Once content in card buffer is used, the content cannot used again. Transferring inactive content causes error response. Figure 79B shows data transfer to block 5. This operation shall be performed after successful authentication.

Figure 78 A_Restore commands

A) A_Transfer command GUI Figure 79 A_Transfer commands

B) Transfer result

6.1.3.11 A_Req_Anti_LoadKey_Authent The A_Req_Anti_LoadKey_Authent is a combo command performing ISO14443A from card power-on to authentication as listed below. 1.

A_Request or A_Wake_up

2.

A_Anticoll

3.

A_Select

4.

A_Loadkey

5.

A_Authent

This command requires parameters as follows before operating. Req Mode

: Select Request or Wakeup command used to probe card in field

CollMaskVal

: Select CollMaskVal to select card as explain in A_Anticoll command

Select Key

: Select Key A or Key B on card used in authentication

Key

: 48-bit key

Block Num

: The block address to be accessed

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 50 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

If operation is successful, reader will return UID and card will be ready to use MIFARE commands such as write, read, restore and transfer. Figure 80A shows successful authentication while Figure 80B shows error from authentication. Notice that error code in Figure 80B is “05”. This reflects to state that error occurs. The error state is authentication.

B) Authentication with wrong key A) Authentication with correct key Figure 80 A_Req_Anti_LoadKey_Authent commands 6.1.3.12 A_Req_Anti_LoadKey_Authent_Read The A_Req_Anti_LoadKey_Authent_Read is a combo command performing ISO14443A command from card power-on to read block as listed below. 1.

A_Request or A_Wake_up

2.

A_Anticoll

3.

A_Select

4.

A_Loadkey

5.

A_Authent

6.

A_ReadBlock

This command requires parameters as follows before operating. Req Mode

: Select Request or Wakeup command used to probe card in field

CollMaskVal

: Select CollMaskVal to select card as explain in A_Anticoll command

Select Key

: Select Key A or Key B on card used in authentication

Key

: 48-bit key

Block Num

: The block address to be read

Figure 81 shows reading result from block 6 from this combo command.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 51 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 81 A_Req_Anti_LoadKey_Authent_Read commands 6.1.3.13 A_Req_Anti_LoadKey_Authent_Write The A_Req_Anti_LoadKey_Authent_Write is a combo command performing ISO14443A command from card power-on to write block as listed below. 1.

A_Request or A_Wake_up

2.

A_Anticoll

3.

A_Select

4.

A_Loadkey

5.

A_Authent

6.

A_WriteBlock

This command requires parameters as follows before operating. Req Mode

: Select Request or Wakeup command used to probe card in field

CollMaskVal

: Select CollMaskVal to select card as explain in A_Anticoll command

Select Key

: Select Key A or Key B on card used in authentication

Key

: 48-bit key Block Num

: The block address to be written

Figure 82 shows writing result into block 6 from this combo command.

Figure 82 A_Req_Anti_LoadKey_Authent_Write commands Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 52 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.1.3.14 A_Increment_Transfer The A_Increment_Transfer is a combo command performing MIFARE command as listed below. 1.

A_Increment

2.

A_Transfer

This command requires parameters as follows before operating. Address value

: A 1-byte data storing in value block for indicating address of back up block

Block Num

: The block address to perform increment

Value

: A 4-byte data coded in 2’s complement format or decimal number between -2,147,483,648 and 2,147,483,647.

Transfer Block

: Target block address where increasing value will be written

This operation shall be performed after successful authentication. Figure 83 shows incremental result in block 6 from 1100 by 100. Note that increment which will result in amount of final value beyond 0x7FFFFFFF (2,147,483,647) is inhibited and cause error in operation.

A) Input in A_Increment_Transfer

B) Incremental result Figure 83 A_Increment_Transfer commands

6.1.3.15 A_Decrement_Transfer The A_Decrement_Transfer is a combo command performing MIFARE command as listed below. 1.

A_Increment

2.

A_Transfer

This command requires parameters as follows before operating. Address value

: A 1-byte data storing in value block for indicating address of back up block

Block Num

: The block address to perform decrement

Value

: A 4-byte data coded in 2’s complement format or decimal number between -2,147,483,648 and 2,147,483,647.

Transfer Block

: Target block address where decreasing value will be written

This operation shall be performed after successful authentication. Figure 84 shows decrement result in block 6 from 1200 by 3000. Note that decrement which will result in amount of final value below 0x80000000 (2,147,483,648) is inhibited and cause error in operation. Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 53 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

A) Input in A_Decrement_Transfer

B) Decrement result Figure 84 A_Decrement_Transfer commands

6.1.3.16 A_Restore_Transfer The A_Decrement_Transfer is a combo command performing MIFARE command as listed below. 1.

A_Restore

2.

A_Transfer

This command requires parameters as follows before operating. Block Num

: The block address in which content will be loaded into card buffer

Transfer Block

: Target block address where active content in card buffer will be written

This operation shall be performed after successful authentication. Figure 85 shows decrement result in transferring data from block 6 to block 5.

A) Input in A_Restore_Transfer B) Transfer result Figure 85 A_Restore_Transfer commands 6.1.3.17 A_Req_Anti_Select The A_Req_Anti_Select command is a combo command used in getting UID and selecting ISO14443A card from card power-on to authentication as listed below. 1.

A_Request or A_Wake_up

2.

A_Anticoll

3.

A_Select

This command requires parameters as follows before operating. Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 54 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Req Mode

: Select Request or Wakeup command used to probe card in field

CollMaskVal

: Select CollMaskVal to select card as explain in A_Anticoll command

Figure 86 A_Req_Anti_Select command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 55 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.2 ISO14443B The ISO14443B commands list of Pi-931 is shown Figure 87.

Figure 87 ISO14443B command list 6.2.1

ISO14443B standard commands

Figure 88 depicts the relation of the commands with card state transition diagram. Each command shall be applied at an appropriate state. The commands in this section are B_Request, B_WakeUp, B_ATTRIB, B_Halt, B_Deselect, B_TransparentWithCRC, B_TransparentWithoutCRC, B_TransparentConfigCRC, and B_TransparentRXMultiple. For more information about the commands, please refer to ISO14443-3 standards and Pi-931 Protocol.

Figure 88 ISO14443B standard commands available in Pi-931 6.2.1.1 B_Request The GUI of the B_Request is shown Figure 89. The AFI value and the number of slot are required parameters. The B_Request command of Pi-931 not only transmits the REQB command following ISO14443B but also performs anti-collision if the number of slot more than 1 is specify. The first card of which PUPI is completely received in anti-collision slot is reported. Hence, the slot Marker is already embedded; that correspond command for Slot Marker is not provided. However, user can transmits by the slot market via transparent command. The Proprietary and Confidential SIC_PD_DTS_0009 Rev 1.2 Copyright  2012 Silicon Craft Technology

Page 56 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

responses from this command, called ATQB, are PUPI, application data and protocol information. The demonstration software decomposes the responses to show card properties. A Pseudo-Unique PICC Identifier (PUPI) is used to differentiate cards during anti-collision. User can check “Save PUPI” check block to collect in software buffer to use in further operation. The Application data field is used to inform the PCD which applications are currently installed in the PICC. The Protocol Info field indicates the parameters supported by the card. For more information, please refer to ISO14443-3.

Figure 89 B_Request Command 6.2.1.2 B_WakeUp The operation of B_WakeUp is similar to B_Request. Different from B_Request, B_WakeUp can also wake up card in Halt state. The B_WakeUp GUI is shown in Figure 90.

Figure 90 B_WakeUp Command 6.2.1.3 B_ATTRIB This command is used to select operating protocol and parameter to use in further operation of smartcard. This command requires Param1, Param2, Param3 and Param4 as stated in ISO14443B. This command shall be activated next to B_Request or B_WakeUp command. After executing this command, user shall set the transaction Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 57 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

speed match to what card response. However, if “Change speed after successful ATTRIB” check box was checked, the speed will be changed automatically. For more information about meaning of the parameters, please refer to ISO14443-3 and -4. The GUI of B_ATTRIB as shown in Figure 91 aids user in composing Param1, Param2, Param3 and Param4.

Figure 91 B_ATTRIB Command 6.2.1.4 B_Halt The B_Halt command is used to put card in Halt state. The GUI of B_Halt is shown in Figure 92. The PUPI is a required parameter. This command shall be applied after receiving ATQB from B_Request or B_wakeup.

Figure 92 B_Halt Command 6.2.1.5 B_Deselect The B_Deselect is used to exit active state. This command requires no input and, actually, this command is made up of B_TransparentWithCRC. However, if “Change speed after successful Deselect” check box was checked, the speed will be changed to the lowest rate automatically. The GUI of B_Deselect is shown in Figure 93

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 58 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 93 B_Deselect Command 6.2.1.6 B_TransparentWithCRC If commands to be transmitted are not provided in command list such as command for smart card or slot marker, user can input raw hexadecimal code in B_TransparentWithCRC to invoke operation as stated in the RF protocol. Before executing, user might need to adjust timeout for card response to be suitable for user applications. The timeout setting option in the GUI is shown in Figure 95. The example of “initiate” command in SRI4K card is shown in Figure 94. User shall review results in transaction logs windows. For example, subsequent operations from Figure 94 to read data are shown in Figure 96. For more information about SRI4K, please refer to the datasheet from ST.

Figure 94 Example of using B_ TransparentWithCRC with SRI4K card

Figure 95 Timeout setting for TransparentWithCRC and TransparentWithoutCRC command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 59 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual Initiate() ID Select() Read(0) Data Block 0 Read(1) Data Block 1

Figure 96 Example of running multiple ISO14443B command 6.2.1.7 B_TransparentWithoutCRC The operation of this command is similar to B_ TransparentWithCRC. The different is there is no calculated CRC appending at the end of transmitted RF frame. 6.2.1.8 B_TransparentConfigCRC The operation of this command is similar to B_ TransparentWithCRC. The different is user can select whether the calculated would be appended at the end of transmitted and received RF frame.

Figure 97 B_TransparentConfigCRC command 6.2.1.9 B_TransparentRXMultiple The operation of this command is similar to B_ TransparentWithCRC. The different is this command set the RxMultiple bit to activate continuous reception.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 60 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.3 ISO15693 The GUI in ISO15693 tab is shown in Figure 98 in which user can select RF transaction speed and operating command. The command list consists of ISO15693 standard commands, Custom command for SIC RFID card IC and special command as is shown in Figure 99. The RF transaction speeds for downlink and uplink are summarized in Table 6-1.

Figure 98 GUI in ISO15693 Tab Table 6-1 Supported RF transmission speed Transaction Supported RF Coding RF Speed Downlink 1 out of 4 26.48 Kbits/s 1 out of 256 1.65 Kbits/s Uplink 1 Sub Low rate 6.62 Kbits/s 1 Sub High rate 26.48 Kbits/s 1 Sub Ultrahigh rate 52.96 Kbits/s 2 Sub Low Rate 6.67 Kbits/s 2 Sub High Rate 26.69 Kbits/s

Description 1 out of 4 coding 1 out of 256 coding One subcarrier at Low data rate One subcarrier at High data rate One subcarrier at Ultrahigh data rate Two subcarrier at Low data rate Two subcarrier at High data rate

The ISO15693 command in Pi-931 requires operating mode supplied in command packet before executing. Command mode in operation can be primarily divided into two groups namely inventory mode and non-inventory mode. Inventory mode is for accessing the UID while non-inventory is for any normal card operations. The noninventory mode can be subdivided into three modes namely non-address mode, address mode and select mode. Figure 100 illustrates command modes and related operable command. Similar to other RFID standards, card itself do occupy a specific state at certain time. Transition state diagram in ISO15693 is shown in Figure 101. In each state, card reacts to transmitted command differently. Table 6-2 summarizes operable mode between command mode and card state.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 61 of 115

www.sic.co.th

The Intelligence and Innovation

Part of Standard Command

Pi-931 Demonstration Software Manual

Part of Custom SIC Command Figure 99 ISO15693 standard command

Special Command

Mode in ISO15693 Command

Inventory Mode

Non-inventory Mode

Address Mode

- Inventory1Slot - Inventory16Slot

All normal command.

Non Address Mode

All normal commands except - Select - Stay Quiet

Select Mode

All normal commands except - Select - Stay Quiet

Figure 100 command mode in ISO15693

Figure 101 State transition diagram of the ISO15693 card

Table 6-2 operable mode between command mode and card state Proprietary and Confidential Copyright  2012 Silicon Craft Technology

Page 62 of 115

SIC_PD_DTS_0009 Rev 1.2 www.sic.co.th

The Intelligence and Innovation

Command Mode Card State Ready State Selected State Quiet State

Pi-931 Demonstration Software Manual

Inventory Mode

Yes Yes No

Address Mode ( with UID ) Yes Yes Yes

Non-Inventory Mode Non-Address Mode ( without UID) Yes Yes No

Selected Mode No Yes No

In inventory mode, there are four control flags as shown in Figure 102. The RFU Flag, Option Flag and Protocol Extension Flag can be optionally checked to perform special functions. The functions of these flags are depended on purpose of card IC manufacturer. For Enable AFI flag, if this flag is checked, AFI value must be supplied. The benefit of the AFI (Application family identifier) is to pre-discriminate type of card and reduces the number of card in anti-collision process.

Enable AFI

Disable AFI Figure 102 Flag in inventory mode

Figure 103 Sub mode in Non-inventory mode The non-inventory mode is for general operations. In this mode, UID is not required. Except quiet state, all cards in field will be affected. The address mode is for specific-card operation. In this mode, UID is required and the card UID match will only be affected. The select mode is for performing group operation. All cards in selected state will be affected in this mode. Selection of Non-inventory in the demonstration software is shown in Figure 103. Meaning and functionality of the flags in non-inventory mode is depended on card IC manufacturer. Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 63 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Note that the inventory mode is mandatory for command “Inventory1Slot” and “Inventory16Slot”. Command “Select” and “Stay Quiet” must only be used in address mode. Then, UID is mandatory for these commands. The GUI in demonstration software guides applicable modes for each command. 6.3.1

ISO15693 Standard Command

Figure 104 Standard Commands in ISO15693 Table 6-3 Standard Command for ISO15693 Command Name

Description

Mandatory Input*

Perform Inventory 1-slot command

MaskLen, MaskValue

Perform Inventory 16-slot command

MaskLen, MaskValue

Stay Quiet

Perform Stay-Quiet Command

UID

Read Single Blocks

Read Block

Block Address

Write Single Blocks

Write Block

Block Address, Data Block

Lock Block

Lock block

Block Address

Read Multiple Blocks

Read Multiple Block

Block Address, Num of Block

Write Multiple Blocks

Write Multiple Blocks

Block Address, Num of Block, Block size, Data Multi Block

Select

Perform Select Command

UID

Reset to Ready

Perform Reset-to-Ready Command

-

Write AFI

Write AFI value

AFI Value

Lock AFI

Lock AFI value

-

Write DSFID

Write DSFID value

DSFID Value

Lock DSFID

Lock DSFID value

-

Get System Information

Get system information

-

Get Multiple Block Security status

Get multiple block security status

Block Address, Num of Block

Inventory 1 slot Inventory 16 slot

(1)

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 64 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.3.1.1 Inventory 1slot Command Inventory1slot is used in determining UID. Except from four flags in inventory mode, parameter Mask Len and Mask Value must be supplied. Mask Value is part of UID used in selecting cards in anti-collision process. Only cards in which part of UID matches to Mask Value will response back. Mask Len is a one-byte data specifying length in bit of Mask Value to be used. Mask Value and Mask Len shall be input in hexadecimal number. If these parameters are input with “00” or left blank, all cards will response. UID in response packet starts from least significant byte to most significant byte, which reflects to what transmit from card in chronological order.

A) Mask Len = 04, Mask Value = 08

B) Mask Len = 04, Mask Value = 0F

C) Mask Len = 0C, Mask Value = 2F04

D) Mask Len = 0D, Mask Value = 2F04

Figure 105 Example of Inventory 1 slot Figure 105 shows example in executing Inventory1slot to a single card with various value of Mask Len and Mask value. The UID of card is “2F 34 06 31 00 04 39 E0”. Then, UID can be written in chronological order from left to right hand side as follows. UID Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 Hex 2F 34 06 31 00 04 39 E0 Transmitted 1111 0100 0010 1100 0110 0000 1000 1100 0000 0000 0100 0000 1001 1100 0000 0111 Binary LSB MSB

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 65 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

A) Mask Len = 04, Mask Value = 08 Four bits of “0001” representing “8” is transmitted with this command. This part of UID is not matched the LSB part the card UID. Therefore, there is no response from card. UID Hex 2F UID in Transmitted binary 1111 0100 Transmitted mask value 0001 B) Mask Len = 04, Mask Value = 0F Four bits of “1111” representing “F” is transmitted with this command. This part of UID is matched the LSB part the card UID. Therefore, card response a complete UID. UID Hex 2F UID in Transmitted binary 1111 0100 Transmitted mask value 1111 C) Mask Len = 0C, Mask Value = 2F04 12 bits of “1111 0100 0010” is transmitted with this command. This part of UID is not matched the LSB part the card UID. Therefore, card response a complete UID. UID Hex 2F 34 UID in Transmitted binary 1111 0100 0010 1100 Transmitted mask value 1111 0100 0010 D) Mask Len = 0D, Mask Value = 2F04 13 bits of “1111 0100 0010 0” is transmitted with this command. This part of UID is not matched the LSB part the card UID. Therefore, there is no response from card. UID Hex 2F 34 UID in Transmitted binary 1111 0100 0010 1100 Transmitted mask value 1111 0100 0010 0 6.3.1.2 Inventory 16 slot Command Inventory16slot is used in anti-collision process and determining UID. This command reduces data collision by spreading response from multiple cards into 16 slots systematically. Card will response if Mask Value with in specific Mask Len matches. This is similar to Mask Len and Mask Value in Inventory 1slot. In addition, card answers in slot number coincident to 4-bit number in UID next to mask value. Figure 106 shows example in executing Inventory16slot to a single card with various value of Mask Len and Mask value. The UID of card is “2F 34 06 31 00 04 39 E0”. Mask Len = 00, Mask Value = 00 (None) th The card responds in 15 slot because the UID next to Mask Value is F as shown in red number below. UID = “2F 34 06 31 00 04 39 E0”. A) Mask Len = 08, Mask Value = 2F (None) th The card responds in 4 slot because the UID next to Mask Value is 4 as shown in red number below. UID = “2F 34 06 31 00 04 39 E0”.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 66 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

A) Mask Len = 00, Mask Value = 00 (None)

B) Mask Len = 04, Mask Value = 2F

Figure 106 Example of Inventory 16 slot The response from this command is a concatenated frame of response in each slot. For more information, please refer to “Pi-931 Module Protocol”. Diagram in Figure 107 shows an idea of anti-collision process by using scanning technique. The collision slot, which is slot 3 and slot E in this example, in the first round, is possibly that multiple cards have responded in the same slot. Hence, the Mask Value is set to the number of slot that collision occurred and Mask Len is increased by 4. This process is repetitive until there is no collision detected and processing unit collect the UID in slot there is no collision. Practically, error may cause errors in collision slot.

Figure 107 An example of Using Inventory 16 slot in anti-collision

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 67 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.3.1.3 Stay Quiet The Stay Quiet put UID-specific card in quiet state. Therefore, UID is mandatory parameter for this command.

Figure 108 Stay Quiet Command

6.3.1.4 ReadSingleBlocks The ReadSingleBlocks performs data reading from a specified block. Block address is only a require parameter.

Figure 109 ReadSingleBlock command 6.3.1.5 WriteSingleBlocks The WriteSingleBlocks performs data programming to specified block. Block address and data to be written are required parameters. The GUI, as shown in Figure 110, provides 4-byte data to be default block length. For some special card in which block data is wider than the default, user can check “Over 4 bytes” box to accept input up to 8 bytes.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 68 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 110 WriteSingleBlock command 6.3.1.6 Lock Block The LockBlock command performs content lock in a specific block from modification later. The required parameter is a block address. 6.3.1.1 ReadMultipleBlocks The ReadMultipleBlocks performs data reading from a specified range of data. Parameters as follows must be specified before executing. Block Address

: The first block address to be written

Num of Blocks

: The number of additional block from first block to be written

The demonstration software can divide and display data for each block as shown Figure 112, providing that the block size, parameter in software, be specified correctly. Note that cards from some manufacturers might not support this command.

Figure 111 Lock Block command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 69 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 112 ReadMultipleBlock command

6.3.1.2 WriteMultipleBlocks The WriteMultipleBlocks performs data reading from a specified range of data. Parameters as follows must be specified before executing. Block Address

: The first block address to be written

Num of Blocks

: The number of additional block from first block to be written

Block Size

: The number of bytes in one block

Data Multi Block : Consecutive data for all block to be written The demonstration software can divide and display data for each block as shown Figure 113, providing that the block size, parameter in software, be specified correctly. Note that cards from most manufacturers might not support this command.

Figure 113 WriteMultipleBlocks command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 70 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.3.1.3 Select The Select put UID-specific card in selected state. UID is mandatory parameter for this command.

Figure 114 Select command

6.3.1.4 ResetToReady The ResetToReady puts card into ready state. No parameter, except UID in selected mode, is required for this command.

Figure 115 ResetToReady command 6.3.1.5 WriteAFI The WriteAFI performs AFI programming. One bytes data for AFI shall be supplied before executing.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 71 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 116 WriteAFI command 6.3.1.6 LockAFI The LockAFI performs AFI content locking. Once the AFI was locked, AFI content cannot be modified later. No parameter, except UID in selected mode, is required for this command.

Figure 117 LockAFI command 6.3.1.7 WriteDSFID The WriteDSFID performs DSFID programming. One bytes data for DSFID shall be supplied before executing.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 72 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 118 WriteDSFID command 6.3.1.8 Lock DSFID The LockAFI performs DSFID programming. Once the DSFID was locked, DSFID content cannot be modified later. No parameter, except UID in selected mode, is required for this command.

Figure 119 LockDSFID command

6.3.1.9 Get System Information The GetSystemInformation retrieves card system information. Information as listed are displayed. UID

: Unique ID

IC reference

: 8-bit IC reference number

VICC Memory Size

: Card memory size information consisting of block size and number of block

AFI

: Application family identifier

DSFID

: Data storage format identifier

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 73 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 120 GetSystemInformation command

6.3.1.10 Get Multiple Block Security status The GetMultipleBlockSecurityStatus retrieves condition if specific blocks are locked. Parameters as follows must be specified before executing. Block Address

: The first block address to be written

Num of Blocks

: The number of additional block from first block to be written

Figure 121 GetMultipleBlockSecuritystatus command 6.3.2

Example of ISO15693 standard command usage

Figure 122 shows example of operating standard command. The operations in this example go through ready mode, selected mode and quiet mode. In each mode, inventory command and read block 0 in three noninventory mode are performed. User can notice that the operating results coincide with the Table 6-2. For more information about standard command, please refer to ISO15693-3 protocol.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 74 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Selected Mode

Ready Mode

UID Data in block 0 Data in block 0 No response

Data in block 0 Data in block 0

Quiet Mode

No response No response

Data in block 0 No response

Figure 122 Example of ISO15693 standard command usage 6.3.3

Custom command for SIC5600

SIC5600 is an ISO15693 card IC from silicon craft. To communicate with SIC5600 requires SIC-defined custom commands. The supported custom command in Pi-931 is shown in Figure 123 and summarized in Table 6-4. For more information about SIC5600, please refer to SIC5600 datasheet.

Table 6-4 Custom Command for SIC5600 Command Name (1) Set EAS Reset EAS (2) Lock EAS EAS Alarm Kill

(3)

Description Enable EAS mode ( If EAS mode is not locked ) Disable EAS mode ( If EAS mode is not locked ) Lock current status of EAS mode Invoke SIC5600 to transmit EAS code (Card must be preset in EAS mode) Destroy a specific-UID card

Load Password

Login to enable accessing card content

Write Password (2) Lock Password (4) Set Password Mode (2),(4) Lock Password Mode (4) Get Password Mode (5) Set OTP (5) Get OTP (6) Write XUID (6) Read XUID

Write password 0, password 1 or kill code Lock current password or kill code Setup password mode or kill enable Lock current status of the password mode Get current status of the password mode Set OTP mode Get current status of the OTP mode Write XUID to a specific-UID card Write XUID from a specific-UID card

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

Mandatory Input* UID, Kill Code UID, PWD Mode, Random Number, Password UID, Selected Password, Password UID, Selected Password UID, PWD Mode UID UID UID, OTP Mode UID UID, XUID UID

SIC_PD_DTS_0009 Rev 1.2 Page 75 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 123 Custom commands for SIC5600

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 76 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.3.3.1 Set EAS EAS (Electronic Article Surveillance) is a configurable mode in SIC5600. If EAS mode is set, EAS Alarm command can invoke card to transmit EAS code. The command Set EAS requires no input parameter.Figure 124A shows successful response from Set EAS and Figure 124B show response of EAS Alarm after performing Set EAS.

A) Perform Set EAS

B) EAS Alarm Response after performing Set EAS Figure 124 Set EAS command

6.3.3.2 Reset EAS If EAS mode is reset, EAS Alarm command cannot invoke card to transmit EAS code. The command Reset EAS requires no input parameter. Figure 125A shows successful response from Reset EAS and Figure 125B shows no response of EAS Alarm after performing Set EAS.

A) Perform Reset EAS B) EAS Alarm response after performing Reset EAS Figure 125 Reset EAS command 6.3.3.3 Lock EAS Command Lock EAS locks EAS setting configuration permanently. After performing Lock EAS, Set EAS and Reset EAS cannot successfully execute as shown in Figure 126.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 77 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

A) Perform Lock EAS

B) SetEAS response after performing Lock EAS Figure 126 Lock EAS command

6.3.3.4 EAS Alarm Command EAS Alarm can invoke card to transmit EAS code. As shown in Figure 124B and Figure 125B, EAS value for SIC5600 is "2FB36270D5A7907FE8B18038D281497682DA9A866FAF8BB0F19CD112A57237EF". 6.3.3.5 Write Password Command Write Password used to program Password 0, Password 1 and Kill code. UID, password value and target password are required parameters for this command. If password being written was locked, programming will not be successful with return code as shown in Figure 127B.

A) Write Password successful

B) Perform Write Password while password was locked Figure 127 Write Password command

6.3.3.6 Lock Password Command Lock Password, the GUI is shown Figure 128, locks current target password value permanently. UID and target password are required parameters for this command. 6.3.3.7 Set Password Mode Command Set Password Mode is for enabling Kill-enable bit and defining password mode. If Kill-enable bit is set, Kill command can be disable card. Password mode, consists of two control parameters namely Password Allocation (PA) and Security Mode(SM), defines password to be used and accessibility for read and writes SIC5600 content. Functionality of each password mode, which is combination Password Allocation, and Security Mode is summarized in Table 6-5. Figure 129A shows effect from setting Password 0 for read protection and Password 1 for Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 78 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

write protection. As a result, reading block 0 without loading password is inhibit as shown in Figure 129B. UID, Killenable and password mode are required parameters for this command.

Figure 128 Lock Password command

A) Set Password Mode ( PA = 00 , SM = 11)

B) Reading during read protection Figure 129 Set Password Mode command

Table 6-5 Summarized protection function controlled by PA (Password Allocation ) and SM (Security Mode) PA (Password Allocation) 00b Use Password 0 for read protection and Password 1 for write protection

01b

Use Password 0 for all protection

10b

Use Password 1 for all protection

11b

Use Both Password 0 and Password 1 (64 Bits) for all protection

SM (Security Mode) 00b No protection 01b Read Protection Only 10b Write Protection Only 11b Read and Write Protection 00b 01b 10b 11b 00b 01b 10b 11b 00b 01b 10b 11b

No protection Read Protection Only Write Protection Only Read and Write Protection No protection Read Protection Only Write Protection Only Read and Write Protection No protection Read Protection Only Write Protection Only Read and Write Protection

Copyright  2012 Silicon Craft Technology

Page 79 of 115

Proprietary and Confidential

Protection Function No protection Read Protection by Password 0, M = 0 Write Protection by Password 1, M = 1 Read Protection by Password 0, M = 0 and Write Protection by Password 1, M = 1 No protection Read Protection by Password 0 Write Protection by Password 0 Read & Write Protection by Password 0 No protection Read Protection by Password 1 Write Protection by Password 1 Read & Write Protection by Password 1 No protection Read Protection by Password 0 + Password 1 Write Protection by Password 0 + Password 1 Read & Write Protection by Password 0 + Password 1

SIC_PD_DTS_0009 Rev 1.2 www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.3.3.8 Lock Password Mode Command Lock Password Mode, the GUI is shown Figure 130, freezes current password mode value permanently. UID is a required parameter for this command.

Figure 130 Lock Password Mode command 6.3.3.9 Get Password Mode Command Get Password Mode, the GUI is shown Figure 131, is used to obtain current password mode. UID is a required parameter for this command. The structure of returned password mode is shown in Table 6-6 to Table 6-10.

Figure 131 Get Password Mode command Table 6-6 Password mode (PWD Mode) Bit Name

7 0

6 0

5 Kill Enable

4 M

3 2 PA (Password Allocation)

1 0 SM (Security Mode)

Table 6-7 Kill Enable : Set up Kill-Enable bit 0b 1b

Reset Kill-Enable bit in SIC5600 to protect card from Kill command Set Kill-Enable bit in SIC5600 to enable Kill command to operate.

Table 6-8 M : Specify password in card used to compare with transmitted password during loading password 0b 1b

Use Password 0 Use Password 1

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 80 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Table 6-9 PA (Password Allocation) : Define passwords to be used in protection 00b

01b 10b 11b

Use Password 0 for read protection and Password 1 for write protection. If card was set in this mode, input PWD shall match Password 0 during loading password with M value of 0 to read content. To write data to card, input PWD shall match Password 1 during loading password with M value of 1. Use Password 0 for protection. If card was set in this mode, input PWD shall match Password 0 during loading password with M value of 0 to read/write content. Use Password 1 for protection. If card was set in this mode, input PWD shall match Password 1 during loading password with M value of 1 to read/write content. Use Both Password 0 and Password 1 (64 Bits) for protection. If card was set in this mode, input 8-bytes PWD matched Password 0 and Password 1 must be used for loading password with any value of M to read/write content.

Table 6-10 SM ( Security Mode(1:0) ) : Define protection function of the password 00b 01b 10b 11b

No protection Read Protection Only Write Protection Only Read and Write Protection

6.3.3.10 Load Password Command Load Password, the GUI is shown Figure 132A, is used to login to grant accessibility to read or write. Parameters as follows must be specified before executing. UID

: Card Unique ID

Access Password

: Card Password (0 or 1) used to compare with transmitted password

Password Allocation

: Password protection function in card being access

Security Mode

: Security mode in card being access

Random Number

: 4-byte or 8-byte random number used to encrypt transmitted data on air

Password

: 4-byte or 8-byte password value matched access password

If Password Allocation is “Use PWD 64 bit (PWD0+PWD1)”, 8-byte random number and 8-byte password value matched password 0 consecutive with password 1 shall be supplied. Practically, RNG should be altered every time to prevent playback attack The example of steps in executing Load Password and its results are shown in Figure 132. Assume that card being accessed was previously programmed with password 0 of 00000000 and password 1 of 00000000, and password mode was set in “Password 0 for read protection and Password 1 for write protection” (from Figure 129).

A) Reading data from block 0 is protected

B) Programming data from block 0 is protected

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 81 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

C) Load password with password 0 to access read Successful

E) Load password with password 1 to access write Successful

D) Successful reading data from block “0”

F)

Successful programming data from block “0”

G) Confirm that data was programmed into block 0 Figure 132 Load Password command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 82 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.3.3.11 Kill The Kill command will permanently disable card function. The card has been killed will not response to any request from reader. The Kill GUI is shown in Figure 133E. The UID and Kill code are required for this command. Following steps, depicting in Figure 133, demonstrate preparation for kill and Kill operation.

A) Set Kill-Enable by Set Password Mode.

B) Write Kill Code by Write Password Command.

C) Check Password Mode if Kill-Enable was set.

D) Check if card is still alive by inventory

F) No response confirms that card was killed E) kill card by Kill command Figure 133 Example of Kill operation Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 83 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

6.3.3.12 Set OTP OTP is one time programmable feature. If an OTP bit is set, the data in associated section cannot modified forever. Note that if the OTP is set to once, it cannot reset to zero. In the provided GUI of Set OTP as shown in Figure 134, user can lock target page or lock OTP configuration itself.

A) Perform lock Page 0 By Set OTP

B) Check OTP status By Get OTP

C) Perform lock OTP configuration By Set OTP

D) Perform lock Page 1 By Set OTP failed because OTP configuration was locked. Figure 134 Set OTP command

6.3.3.13 Get OTP The Get OTP command is used to obtain current status of OTP Mode. As shown in Figure 135, OTP Mode of “00” (hexadecimal) was reported. The structure of OTP Mode is shown in Table 6-11 to Table 6-13.

Figure 135 Get OTP command Table 6-11 OTP Mode Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 84 of 115

www.sic.co.th

The Intelligence and Innovation

Bit Name

7 0

6 0

5 0

Pi-931 Demonstration Software Manual 4 0

3 0

2 L

1 0 OTP MODE(1:0)

Table 6-12 L : Lock Control to Lock current status of OTP MODE 0b 1b

Not Lock OTP Lock OTP. If Lock OTP bit was set to one, it cannot reset back to zero and OTP MODE value cannot be altered later.

Table 6-13 OTP MODE(1:0) 00b 01b 10b

Not Lock Lock Page 0 (Address 0 - 15) Lock Page 1 (Address 16 - 31)

6.3.3.14 Write XUID XUID is a one-time writable 6-byte extended Unique ID which can be in some specific user purpose. If XUID has been once written, XUID cannot be modified later. User can input required XUID value in the GUI of Write XUID as shown in Figure 136. UID is required for this command.

Figure 136 Write XUID command 6.3.3.15 Read XUID The Read XUID is used to retrieve XUID. UID is required for this command. Result of 112-bit complete UID and XUID is reported.

Figure 137 Read XUID command 6.3.4

Special command

Similar to ISO14443A and B, the special command available in ISO15693 are V_TransparentWithCRC, V_TransparentWithoutCRC, V_TransparentConfigCRC, V_TransparentRXMultiple and SendEOF as shown in Figure 138. Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 85 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

For the transparent commands, user can input raw hexadecimal code to invoke operation as stated in the RF protocol. The example of Reading data from block 0 of ISO15693 card is shown in Figure 140. Also, User shall review result in transaction logs windows. Moreover, user might need to adjust timeout for card response to be suitable to user applications. The option for timeout in the GUI is shown in Figure 139. The SendEOF is used to transmit a gap in ISO15693 anti-collision process to indicate transition to next slot. However, inventory 16 slot command has already embeds transmitting gap in its process. So, the SendEOF can be used in conjunction with transparent command.

Figure 138 Special commands for ISO15693

Figure 139 Timeout setting for Special command

Figure 140 Reading data from block 0 by using TransparentWithCRC 6.4 Pico Tag PicoTag, PicoPass are families of contactless memory IC from INSIDE CONTACTLESS. PicoPass is secure version equipped with INSIDE security encryption mode. By using PI931, user cannot access Read/Write area of PicoPass and PicoCrypt except UID. For PicoTag 16K and 2K, the read/write area is unprotected. Table 6-14 Pico Product Family Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 86 of 115

www.sic.co.th

The Intelligence and Innovation

Product PicoPass 16KS PicoPass 2KS PicoTag 16K PicoTag 2K PicoTag 2KS

ISO standards ISO15693 & ISO14443B ISO15693

Pi-931 Demonstration Software Manual Cryptographic Security No No Yes

Memory size and personalization (8 x 2K pages) or (1 x 16K page) 2K bits 1 x 16K page 2K bits 2K bits

The radio frequency power and signal interface for data transmission of PicoTag and PicoPass rely on ISO15693-2 and ISO14443B-2. In another word, bit definition of RF signal in both transmission and reception follows ISO15693-2 and ISO14443B-2. Pico-family commands are proprietary and do not conform ISO15693-3. These commands are called “ISO15693-2 and ISO14443B -2 commands”. However, PicoPass does support ISO14443B-3 but the IC must be prior set in that mode. The Pi931-XX, where the SIC9310 is used as an RF front-end chip supporting such standards, can communicate to PicoPass contactless IC. Figure 141 shows GUI in Pico Tag tab. In this tab, user can transmit single or multiple commands, setup transaction speed as well as review card response. Command list consists of standard commands and transparent commands. The commands in this tag are actually realized from transparent command of ISO15693 and ISO14443B. First of all, user shall set up speed in transaction which can either be ISO15693 or ISO14443B. The options are shown in Figure 142.

Figure 141 Pico Tag command tap

Figure 142 Speed setup for PICO Tag 6.4.1

Pico Tag standard commands

The standard commands used in PicoTag/PicoPass are illustrated in Figure 143, showing relation of each command in card-state transition diagram. Hence, each command shall be applied at appropriate state. The commands in this section are ACTALL, IDENTIFY, SELECT ASNB, SELECT SNB, HALT, READ and READ4. For more information about the commands, please refer to PicoTag/PicoPass datasheet.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 87 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 143 State diagram of PicoTag / PicoPass 6.4.1.1 ACTALL The ACTALL command GUI is shown Figure 144. This command is used to switch card state from Idle to Activated. This command requires no input. Because response for this command is only SOF of standard we select, then the PI931xx report “E1” response error for ISO15693 and “E0” not response for ISO14443B. This is due to the SOF only is treated to be incomplete frame. Please don’t care the answer in this state, and please go to next command.

Figure 144 ACTALL command and response 6.4.1.2 IDENTIFY The IDENTIFY command is used to get the ASNB (Anti-collision serial number). The card/tag that be able to receive this command shall be in activated state. Result from this command is shown in Figure 145.

Figure 145 IDENTIFY command Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 88 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.4.1.3 SELECT ASNB The SELECT ASNB is used to get the real UID. The required parameter is ASNB from IDENTIFY command. If PICOtags receive this command correctly, command READ and READ4 will be operable.

Figure 146 SELECT ASNB command 6.4.1.4 SELECT SNB The SELECT SNB is used to get the real UID. The required parameter is UID from IDENTIFY command. If PicoTag receives this command correctly, command READ and READ4 will be operable.

Figure 147 SELECT SNB command 6.4.1.5 HALT The HALT command is used to put card in HALT state. In this state, card is silent and waits until receive SELECT ASNB and SELECT SNB again. Similar to ACTALL command, the response from this command is SOF only. Then, it is treated to be incomplete frame. Pi931 respond “E0” and “E1” for ISO14443B and ISO15693 respectably. The HALT command and response is shown in Figure 148. 6.4.1.1 READ The READ command is used to read data from specified block in card’s memory. Card must prior be set in selected state. The block address is required parameter. However, for some family such as PicoPass, content in memory is protected by proprietary encryption. Hence, reading memory block apart from UID and configuration (Block 0 and Block1) results in all “FF”. Pi931 cannot perform authentication for PicoPass. Example of READ command result is shown in Figure 149. Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 89 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 148 HALT command

Figure 149 READ command 6.4.1.1 READ4 The READ4 command is similar to READ but card answers 4 consecutive block. The required input parameter is starting block address. Example of READ command result is shown in Figure 150.

Figure 150 READ4 command Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 90 of 115

www.sic.co.th

The Intelligence and Innovation

6.4.2

Pi-931 Demonstration Software Manual

Special command

TransparentWithCRC, TransparentWithoutCRC, and TransparentConfigCRC are provided to support unavailable command in command list. To use these command, user have to know command code as stated in datasheet.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 91 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.5 Felica Felica is contactless smart card IC from SONY. Line coding of Felica is BPSK both transmission and reception. For more information about Felica frame format, please refer to ISO18092. In case of SIC9310 is used as a reader IC of Pi931, coding and decoding demonstrates in this section is not performed by the SIC9310 reader IC but it is implemented through raw signal decoding by microcontroller. However, SIC9410 is integrated the signal encoder and decoder inside the chip. Firmware version 1.5.0.0 or upper can detected the installed chip and select the encoding/decoding method automatically. Due to proprietary encryption, user cannot access Read/Write except UID. Figure 151 shows GUI in Felica tab. In this tab, user can read UID and transmit arbitrary command via C_TransparentWithCRC. First of all, user shall set up speed in transaction to be 212 kbps.

Figure 151 Felica command tab 6.5.1

Polling command

The C_Polling command is used to get UID from Felica card. This command can perform reading both single tag and multiple tags in case of anti-collision. The required parameters are system code, reserved and the number of slot in anti-collision process. Figure 152 shows reading a Felica card in 1 slot while Figure 153 shows reading multiple cards in 16 slots. Note that if there are slots that collision occurs, PI931 reports an error code (such as “E0”, “E1”) depending on signal characteristic at that time.

Figure 152 C_Polling command in reading a Felica card

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 92 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 153 C_Polling command in reading multiple Felica card in 16 slots 6.5.2

Special command

The TransparentWithCRC, TransparentWithoutCRC, TransparentConfigCRC, and TransparentRXMultiple commands are used to transmit command in hexadecimal code directly to air. For TransparentWithCRC command, Two byte calculated CRC following Felica standard are appended at the end of transmit data frame. For TransparentWithoutCRC command, the CRC is not appended. For TransparentConfigCRC, user can configure the CRC whether it will be appended with transmission frame, reception frame, or none. For TransparentRXMultiple command, it set the RxMultiple bit to activate continuous reception. For more information, please refer to commands data format in Felica card manual for constructing data bytes.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 93 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.6 NFC tag type 1 (Topaz) Topaz (IRT5011) is contactless IC from Innovision Research & Technology plc. It is conforming to ISO/IEC18092, ISO/IEC21481 and ISO/IEC14443A standards. Besides from those mentioned standards, Topaz also has its proprietary operations and commands. Figure 154 shows GUI in NFC type 1 tab. In this tab, user can read UID and transmit arbitrary command via N1_TransparentWithCRC, N1_TransparentWithoutCRC, N1_TransparentConfigCRC, and N1_TransparentRXMultiple.

Figure 154 NFC tag type 1 tab

Power OFF

Field

IDLE State REQA, WUPA

READY State N1_ReadUID N1_ReadAll N1_ReadByte N1_WriteWithErase N1_WriteWithoutErase

Execute

Figure 155 NFC tag type 1 State diagram

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 94 of 115

www.sic.co.th

The Intelligence and Innovation

6.6.1

Pi-931 Demonstration Software Manual

ISO14443A standard commands

The standard commands used in ISO14443A-3 which is related with NFC tag type 1 are illustrated in Figure 156, showing relation of each command in card-state transition diagram as displayed in Figure 155. Hence, each command shall be applied at appropriate state. The commands in this section are A_Request, and A_WakeUp. For more information about the commands, please refer to ISO14443A-3 standards and Pi-931 Protocol.

Figure 156 ISO14443A command related to NFC tag type 1 6.6.1.1 A_Request command A_Request command is used to probe if ISO14443A cards are in their field. This command requires no input. This command is similar to A_Request Command in section 6.1.1.1.

Figure 157 A_Request command 6.6.1.2 A_Wakeup command A_Wakeup command is used to probe if ISO14443A cards are in their field. This command requires no input. This command is similar to A_Wakeup Command in section 6.1.1.2.

Figure 158 A_Wakeup command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 95 of 115

www.sic.co.th

The Intelligence and Innovation

6.6.2

Pi-931 Demonstration Software Manual

NFC Tag type 1 proprietary commands

NFC tag type 1 proprietary commands are illustrated in Figure 159, showing relation of each command in card-state transition diagram. Hence, each command shall be applied at appropriate state as displayed in Figure 155. The commands in this section are N1_readUID, N1_ReadAll, N1_ReadByte, N1_WriteWithErase, and N1_WriteWithoutErase. For more information about the commands, please refer to Topaz datasheet and Pi-931 Protocol.

Figure 159 NFC tag type 1 proprietary commands 6.6.2.1 N1_ReadUID N1_ReadUID command is used to Read the masked header ROM bytes and the Unique Identification number (UID) of the NFC tag type 1. This command requires no input and its GUI is shown in Figure 160

Figure 160 N1_ReadUID command 6.6.2.2 N1_ReadAll N1_ReadAll command is used to read the masked header ROM bytes and the whole of the memory blocks. This command requires UID from N1_ReadUID command as an input and its GUI is shown in Figure 161

Figure 161 N1_ReadAll command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 96 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.6.2.3 N1_ReadByte N1_ReadByte command is used to read the specified single EEPROM memory byte. This command requires byte Address as define in Table 6-15 and the UID from N1_ReadUID command as inputs for the command. Its GUI is shown in Figure 162. Table 6-15 NFC tag type 1 Address byte MSB

LSB b7 ‘0’

b6

b5

b4

b3

Block

b2

b1 Byte

b0

Figure 162 N1_ReadByte command 6.6.2.4 N1_WriteWithErase N1_WriteWithErase command is used to perform erase-then-write cycle to the specified single EEPROM memory byte. This command requires target byte Address as define in Table 6-15, data to be written, and the UID as inputs for the command. Its GUI is shown in Figure 163. Please note that Pi-931 will shows the response as error, but actually the write is already completed, confirm by the Err response data showing.

A) N1_WriteWithErase command

B) Read data from Block 48 to check that the data is writen Figure 163 N1_WriteWithErase command

6.6.2.5 N1_WriteWithoutErase N1_WriteWithoutErase is used to perform write data to the specified single EEPROM memory byte without erase the target byte before. With this command, bits can be set to ‘1’ but cannot reset to ‘0’. It is available for writing a lock bit, set OTP bits, and performing fast-write. For more information, please refer to Topaz data sheet.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 97 of 115

www.sic.co.th

The Intelligence and Innovation

A) N1_WriteWithoutErase command

Pi-931 Demonstration Software Manual

B) Read data from Block 48 to check that the data is writen

Figure 164 N1_WriteWithoutErase command 6.6.3

Special commands

Special commands related to NFC tag type 1 are N1_TransparentWithCRC, N1_TransparentWithoutCRC, and N1_TransparentConfigCRC as shown in Figure 165. For the transparent commands, user can input raw hexadecimal code to invoke operation as stated in the RF protocol. Moreover, user might need to adjust timeout for card response to be suitable to user applications.

Figure 165 NFC tag type 1 Special command

6.7 NFC tag type 2 (MIFARE Ultralight/C) MIFARE Ultralight and Ultralight C are contactless IC from NXP Semiconductor. It is conforming to ISO/IEC14443A standard with its proprietary operations and commands. In addition to MIFARE Ultralight, MIFARE Ultralight C also included 3DES authentication. Figure 166 shows GUI in MF Ultralight tab. In this tab, user can read UID and transmit arbitrary command via A_TransparentWithCRC, A_TransparentWithoutCRC, and A_TransparentConfigCRC.

Figure 166 MIFARE Ultralight Tab

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 98 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 167 MIFARE Ultralight / Ultralight C state diagram 6.7.1

ISO14443A standard commands

The standard commands used in ISO14443A-3 which is related with MIFARE Ultralight are illustrated in Figure 168, showing relation of each command in card-state transition diagram as displayed in Figure 167. Hence, each command shall be applied at appropriate state. The commands in this section are A_Request, A_WakeUp, A_AntiCall, A_Select, and A_Halt. For more information about the commands, please refer to ISO14443A-3 standards and Pi-931 Protocol.

Figure 168 MIFARE Ultralight ISO14443A commands 6.7.1.1 A_Request A_Request command is used to probe if ISO14443A cards are in their field. This command requires no input. This command is similar to A_Request Command in section 6.1.1.1.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 99 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 169 A_Request command 6.7.1.2 A_Wakeup A_Wakeup command is used to probe if ISO14443A cards are in their field. This command requires no input. This command is similar to A_Wakeup Command in section 6.1.1.2.

Figure 170 A_Wakeup command 6.7.1.3 A_AntiCall A_AntiCall command is used to automatically seek out a complete UID from cards in the RF field. Providing that the cards performed anti-collision are in the same range, the parameter CollMaskVal in A_Anticoll can be used to select a card that condition matches. A_AntiCall command also requires the proper cascade level before operating. This command is similar to A_AntiCall command in section 6.1.1.3. For more information about the operation of A_AntiCall command, please refer to to A_AntiCall command in section 6.1.1.3.

A) A_AntiCall (Cascade level 1)

B) A_AntiCall (Cascade level 2) after A_Select (Cascade level1) finished Figure 171 A_AntiCall commands

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 100 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.7.1.4 A_Select A_Select command is used to select the card that user wants to work with. This command requires complete UID from the A_Anticoll command and the proper cascade level before operating. This command is similar to A_Select command in section 6.1.1.4.

A) A_Select (Cascade level 1)

B) A_Select(Cascade level 2) after A_AntiCall (Cascade level1) finished Figure 172 A_Select commands

6.7.1.5 A_Halt A_Halt command is used to halt operation and change the state to halt state of ISO14443-3. This command requires no input. This command is similar to A_Halt command in section 6.1.1.8.

Figure 173 A_Halt command 6.7.2

MIFARE Ultralight proprietary command

MIFARE Ultralight proprietary commands are illustrated in Figure 174, showing relation of each command in card-state transition diagram. Hence, each command shall be applied at appropriate state as displayed in Figure 167. The commands in this section are UL_Read, UL_Write, UL_CompatibilityWrite, and UL_3DES_Authentication. For more information about the commands, please refer to MIFARE Ultralight / Ultralight C datasheet and Pi-931 protocol.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 101 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 174 MIFARE Ultralight command 6.7.2.1 UL_Read UL_Read command is used to read the specified EEPROM memory pages. This command requires starting page address as an input for the command. Its GUI is shown in Figure 175A. The response of this command is the 16byte (4-page) data starting from the starting page address. For example, if the starting page is 0x03, the responded data will contain page 0x03, 0x04, 0x05, and 0x06. A roll back to block 0x00 (circular memory architecture) is implemented if the reading reaches the end of the memory as described in Figure 175B. The data of page 0x00, 0x01 and 0x02 are read when reading at page 0x0F.

A) UL_Read Page 0x00

B) UL_Read Page 0x0F Figure 175 UL_Read command

6.7.2.2 UL_Write UL_Write command is used to program the data into a specified EEPROM memory page. This command requires page address and data to be written as inputs for the command. Its GUI is shown in Figure 176.

A) UL_Write at Page 0x04

B) check UL_Write result by reading at page 0x04 Figure 176 UL_Write command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 102 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

6.7.2.3 UL_CompatibilityWrite UL_CompatibilityWrite command is used to program the data into specified EEPROM memory pages. Its required inputs are page address and data to be written. This command was implemented to accommodate the established MIFARE infrastructure which is using 16 bytes data. However, only the least significant 4 bytes (byte 0 to 3) will be written to the specified address. It is recommended to set the remaining bytes 4 to 15 to all ‘0’. Its GUI is shown in Figure 177.

A) UL_CompatibilityWrite at Page 0x04

B) check UL_CompatibilityWrite result by reading at page 0x04 Figure 177 UL_CompatibilityWrite command

6.7.2.4 UL_3DES_Authentication UL_3DES_Authentication command is only applicable for MIFARE Ultralight C. Unlike the general MIFARE Ultralight, MIFARE Ultralight C uses 3DES encryption to secure its memory. Therefore, this command is used to authenticate the card and the reader with the specified key, using the 3DES method. After the successful authentication, the EEPROM memory of the card is able to access by UL_Read, UL_Write, and UL_CompatibilityWrite command.

Figure 178 UL_3DES_Authentication command 6.7.3

Combo command 6.7.3.1 A_Req_Anti_Select

The A_Req_Anti_Select is a combo command used in getting UID and selecting ISO14443A card from card power-on to authentication as listed below. 1.

A_Request or A_Wake_up

2.

A_Anticoll

3.

A_Select

This command requires parameters as follows before operating. Req Mode

: Select Request or Wakeup command used to probe card in field

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 103 of 115

www.sic.co.th

The Intelligence and Innovation

CollMaskVal

Pi-931 Demonstration Software Manual

: Select CollMaskVal to select card as explain in A_Anticoll command

This command is similar to A_Req_Anti_Select command in section 6.1.3.17

Figure 179 A_Req_Anti_Select command 6.7.4

Special commands

Special commands related to MIFARE ultralght are A_TransparentWithCRC, A_TransparentWithoutCRC, and A_TransparentConfigCRC as shown in Figure 180. These commands are similar to A_TransparentWithCRC, A_TransparentWithoutCRC, and A_TransparentConfigCRC in section 6.1.2. For the transparent commands, user can input raw hexadecimal code to invoke operation as stated in the RF protocol. Moreover, user might need to adjust timeout for card response to be suitable to user applications.

Figure 180 Special commands related to MIFARE ultralght

6.8 EMV analogue test command Pi-931 has one derivative which is designed to support EMV testing and verification. It is call “Pi-931-EMV”. The commands and sequences in this tab was created to support the procedures of EMV testing and verification. Please see the “PCD Analogue Test Bench and Test Case Requirements” document from EMVCo for further details. Figure 181 shows GUI in EMV tab.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 104 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

Figure 181 EMV analogue test command tab 6.8.1

Analog Configuration commands

Analog Configuration commands are the commands which is use to configure the registers of the reader IC which are related to analogue part. They are Initial_Analog_Parameter_All, Get_Analog_Parameter, and Set_Analog_Parameter. For more information about the commands, please refer “PCD Analogue Test Bench and Test Case Requirements” document from EMVCo and Pi-931 Protocol. 6.8.1.1 Initial_Analog_Parameter_All Initial_Analog_Parameter_All command is used to set all register values of the reader IC with default setting for each standards and speed. The related registers and the default values (in hexadecimal) are listed in Table 6-16. This command requires no input. Its GUI is shown in Figure 182. Table 6-16 Default Analog Parameter Standard

ISO14443A

ISO14443B

ISO15693

Felica

Speed 106 kbits/s 212 kbits/s 424 kbits/s 848 kbits/s 106 kbits/s 212 kbits/s 424 kbits/s 848 kbits/s 1 Sub Low rate 1 Sub High rate 1 Sub Ultrahigh rate 2 Sub Low Rate 2 Sub High rate 212 kbits/s 414 kbits/s

GsCfgMod @0x12 0x10 0x10 0x10 0x10 0x10 0x10 0x10 0x10 0x10 0x10

RxThreshold @0x1C 0x4C 0x4C 0x4C 0x4C 0x4C 0x4C 0x4C 0x4C 0xAA 0x6A

BPSKDemod @0x1D 0x02 0x02 0x02 0x02 0x02 0x02 0x02 0x02 0x02 0x02

RxControl3 @0x1F 0xF0 0xF0 0xF0 0xF0 0xF0 0xF0 0xF0 0xF0 0xF0 0xF0

AnalogAdj1 @0x3E 0x19 0x19 0x19 0x19 0x19 0x19 0x19 0x19 0x21 0x21

AnalogAdj2 @0x3F 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

AnalogAdj3 @0x3C 0xB9 0xB9 0xB9 0xB9 0xB9 0xB9 0xB9 0xB9 0xB9 0xB9

0x10

0x6A

0x02

0xF0

0x21

0x00

0xB9

0x10 0x10 0x10 0x10

0xAA 0xAA 0x4C 0x4C

0x02 0x02 0x02 0x02

0xF0 0xF0 0xF0 0xF0

0x21 0x21 0x19 0x19

0x00 0x00 0x00 0x00

0xB9 0xB9 0xB9 0xB9

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 105 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 182 Initial_Analog_Parameter_All command 6.8.1.2 Get_Analog_Parameter Get_Analog_Parameter is used to get the values (in hexadecimal) of the analogue related registers as listed in Table 6-16. User shall select the specified standard and speed from DropdownBox before operate this command. Its GUI is shown in Figure 183.

Figure 183 Get_Analog_Parameter command 6.8.1.3 Set_Analog_Parameter Set_Analog_Parameter is used to set the specified values (in hexadecimal) to the analogue related registers as listed in Table 6-16. User shall select the specified standard and speed from DropdownBox before operate this command. Moreover, user shall get the stored values before setting the new values by click “Get” button on top-right corner of the command section. If any value in each textbox was blank, the value ‘0x00’ will be written to the register and it may cause an error operation or malfunction. Its GUI is shown in Figure 184.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 106 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 184 Set_Analog_Parameter command 6.8.2

Pre-Validation commands

Pre-Validation commands are the commands are used for the EMV testing, according to the section called”Pre-Validation”. The commands in this section are EMV_OFF_RF, EMV_ON_RF, EMV_WUPA, EMV_WUPA->RATS, EMV_PPS, EMV_WUPB, EMV_ATTRIB, EMV_APDU1, EMV_APDU2, EMV_APDU3, EMV_Deselect, and EMV_Polling. User can select the command and use the “Start send Multi Cmd” button to create the multiple command sequence from top to bottom and send to the card. With this method, user can design the test sequence matched with the target card. For more information about the commands, please refer “PCD Analogue Test Bench and Test Case Requirements” document from EMVCo and Pi-931 Protocol. 6.8.2.1 EMV_OFF_RF EMV_OFF_RF is used to switch the RF field off. This command requires no input. Its GUI is shown in Figure 185.

Figure 185 EMV_OFF_RF command 6.8.2.2 EMV_ON_RF EMV_ON_RF is used to switch the RF field on. This command requires no input. Its GUI is shown in Figure 186.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 107 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 186 EMV_ON_RF command 6.8.2.3 EMV_WUPA EMV_WUPA command is used to probe if ISO14443A cards are in their field. This command requires no input. Its GUI is shown Figure 187. This command is similar to A_Wakeup Command in section 6.1.1.2.

Figure 187 EMV_WUPA command

6.8.2.4 EMV_WUPA->RATS EMV_WUPA->RATS command is used in getting UID and selecting ISO14443A card from card power-on to RATS as listed below. 1.

A_Wake_up

2.

A_Anticoll

3.

A_Select

4.

A_RATS

This command requires parameters as follows before operating. FSD

: Maximum PCD frame size

CID

: Card Identification

Req Mode

: Select Request or Wakeup command used to probe card in field

CollMaskVal

: Select CollMaskVal to select card as explain in A_Anticoll command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 108 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 188 EMV_WUPA->RATS command 6.8.2.5 EMV_PPS EMV_PPS command is used to select operating protocol and parameter to use in further operation. This command requires CID, PPS0 and PPS1. Its GUI is shown Figure 189. This command is similar to A_PPS Command in section 6.1.1.6.

Figure 189 EMV_PPS command 6.8.2.6 EMV_WUPB EMV_WUPB command is used to transmit the WUPB command following ISO14443B and perform anticollision if the number of slot more than 1 is specify. The AFI value and the number of slot are required parameters. Its GUI is shown Figure 190. This command is similar to B_Wakeup Command in section 6.2.1.2.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 109 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 190 EMV_WUPB command 6.8.2.7 EMV_ATTRIB EMV_ATTRIB command is used to select operating protocol and parameter to use in further operation of smartcard. This command requires Param1, Param2, Param3 and Param4 as stated in ISO14443B. Its GUI is shown Figure 191. This command is similar to B_ATTRIB Command in section 6.2.1.3.

Figure 191 EMV_ATTRIB command 6.8.2.8 EMV_APDU1, 2 and 3 EMV_APDU command is similar to the A_TransparentWithCRC command as described in section 6.1.2. The main propose of EMV_APDU command is for user to insert the specified APDU command to be tested in PreValidation section. There are three EMV_APDU commands for user to creating various command sequences. Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 110 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Moreover, user might need to adjust timeout for card response to be suitable to user applications. Its GUI is shown Figure 192.

Figure 192 EMV_APDU command 6.8.2.9 EMV_Deselect EMV_Deselect command is used to quit operation of ISO14443-4 or higher layer to idle state of ISO144433. This command requires no input. Its GUI is shown Figure 193, and this command is similar to A_Deselect command in section 6.1.1.7.

Figure 193 EMV_Deselect command 6.8.2.10 EMV_Polling EMV_Polling command is used to detect the card type in the RF field. It can check the cards which are conform to ISO14443A, ISO14443B, ISO15693, and Felica. The operation of EMV_Polling command is to send multiple commands to detect card type. If the detected card conforms to ISO14443A or ISO14443B, the multiple commands with a constant sequence according to EMV Load Modulation testing (see section 6.8.3) will be performed. If the detected card conforms to ISO15693 or Felica, the UID reading will be performed. User shall set the protocol to be polled before operates EMV_Polling command. For other settings, please see section 6.8.3 for details.

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 111 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

A) EMV_Polling command with 4 card types detected

B) EMV_Polling command with only 2 card types selected

C) EMV_Polling command with ISO14443A card detected

D) EMV_Polling command with ISO14443B card detected

E) EMV_Polling command with ISO15693 card detected

F) EMV_Polling command with Felica card detected

Figure 194 EMV_Polling command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 112 of 115

www.sic.co.th

Pi-931 Demonstration Software Manual

The Intelligence and Innovation

6.8.3

Load Modulation commands

Load Modulation commands are the commands are used for the EMV testing, according to the section called”Load Modulation”. The commands in this section are ISO14443A_EMV_Load_Mod, and ISO14443B_EMV_Load_Mod. For more information about the commands, please refer “PCD Analogue Test Bench and Test Case Requirements” document from EMVCo and Pi-931 Protocol. 6.8.3.1 ISO14443A_EMV_Load_Mod ISO14443A_EMV_Load_Mod command is used to perform multiple commands with a constant sequence according to EMV Load Modulation testing. The sequences are listed in Table 6-17 below. Please note that PPSE and Loopback commands are defined from EMVCo. These command settings can be explained in detail below: 

“Reset Field Before Execute” checkbox: This option is used to select whether the RF field will be reset before performing the commands or not.



“Run All (Neglect transmission Error)” checkbox: This option is used to select whether the command run continuously or stop when error.



“Category” dropdownbox : This option is used to select the command sequence category.



“Start Command Index” textbox: This option is used to specify the starting command in the sequence.



“Number of command” textbox: This option is used to specify the commands to be run start from Start command Index. o

For Example: If Start command index is 3 and Number of command is 2, the commands will be run are B_Wakeup, A_Wakeup and A_Anticoll (category 0 is selected).

o

If the Start command index plus Number to be run is over the command sequence, the last command will be repeated.

Table 6-17 ISO14443A Load Modulation command sequence Number 1 2 3 4 5 6 7 8 9 10 11 12

WUPA HLTA WUPB WUPA ANTI SELECT RATS PPSE Loopback

Category 0 A_WakeUp A_Halt B_WakeUp A_WakeUp A_Anticoll A_Select A_RATS PPSE* Loopback*

WUPA HLTA WUPB WUPA ANTI SELECT RATS PPS APDU1

Reset Field

RF_OF -> RF_ON

APDU2

WUPA

A_WakeUp

Reset Field WUPA

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

Category 1 A_WakeUp A_Halt B_WakeUp A_WakeUp A_Anticoll A_Select A_RATS A_PPS User defined APDU command User defined APDU command RF_OF -> RF_ON A_WakeUp

SIC_PD_DTS_0009 Rev 1.2 Page 113 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 195 ISO14443A_EMV_Load_Mod command 6.8.3.2 ISO14443B_EMV_Load_Mod ISO14443B_EMV_Load_Mod command is used to perform multiple commands with a constant sequence according to EMV Load Modulation testing. The sequences are listed in table XX below. Please note that PPSE and Loopback commands are defined from EMVCo. This command settings are the same as ISO14443A_EMV_Load_Mod command,and they are explained in section 6.8.3.1

Table 6-18 ISO14443B Load Modulation command sequence Number 1 2 3 4 5 6 7 8

Category 0 B_WakeUp A_WakeUp B_WakeUp B_ATTRIB PPSE*

WUPB WUPA WUPB ATTRIB APDU1

Loopback

Loopback*

APDU2

Reset Field WUPB

RF_OF -> RF_ON B_WakeUp

Reset Field WUPB

WUPB WUPA WUPB ATTRIB PPSE

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

Category 1 B_WakeUp A_WakeUp B_WakeUp B_ATTRIB User defined APDU command User defined APDU command RF_OF -> RF_ON B_WakeUp

SIC_PD_DTS_0009 Rev 1.2 Page 114 of 115

www.sic.co.th

The Intelligence and Innovation

Pi-931 Demonstration Software Manual

Figure 196 ISO14443B_EMV_Load_Mod command

Proprietary and Confidential Copyright  2012 Silicon Craft Technology

SIC_PD_DTS_0009 Rev 1.2 Page 115 of 115

www.sic.co.th