Professional Documents
Culture Documents
Mifare Manual
Mifare Manual
Reader Modules
H102014x (OEM), H6152 (Plug and play Proximity), H6154 (Plug and play Mid range), Hard-and Software-Documentation
Description:
The 13.56MHz MIFARE OEM read/write engine is a very compact device designed for fast integration into portable or stationary readers. The typical reading range of the module is up to 90 mm depending on the antenna and TAG. Also printed circuit board antennas are supported. Because of the small size the module can be integrated easily into existing data collection applications such as portable terminals, ticketing, machines vending or access control. The OEM reader module was designed for simple integration. The serial TTL-interface can be directly connected to microprocessors and easily converted to the RS232 serial interface device. The protocol can be tested using any terminal
Elatec GmBH Hans Stiessberger - Str. 2a 855 40 Haar Germany Phone: +49(0)89 462 307-0 Fax: +49(0)89 460 2403 www.ElatecEurope.com
Features
program without writing a single line of code. The antenna can be adapted in a wide range to fit the requirements of reading distance, power consumption and manufacturing cost of the antenna. A sophisticated receiver design makes sure that the reader is rugged against electromagnetic noise and antenna variations. Full MIFARE functionality including encryption Serial Interface, CMOS-TTL, Wiegand, OMRON Power down mode Power supply 5V/40 - 120 mA depending on antenna Very small size 30.5 x 25.5 x 9.5 mm Temperature range
Description:
plug The 13.56MHz MIFARE and play reader module is based on the OEM reader module. It includes an etched/PCB antenna on the back side. The reading range is up to 5 cm, * 9 cm depending on the TAG. A regulated supply voltage of 5 Volts is needed. The RS232 serial interface can be connected to COM1/COM2 connector of PC-station, laptop or notebook using a cable.
Features
! ! ! ! ! ! Included antenna Serial Interfacing, RS232/422/485 Operation LED, reading LED on board Power supply 5V/80 mA
! !
Compact size 70.0 x 45.5 x 11.5 mm *110.0 x 67.0 x 11.5 mm Temperature range -20C - +85C
Revision-No: VO.14D
Electrical specification:
OEM module
Operating Frequency Baud Rate Interface Antenna Impedance Output Supply Voltage Power Supply Operating Temperature Size Dimensions mm Reading Range max. 13.56 MHz 9600 Baud, 57000 Baud optionally Serial CMOS-TTL (software programmable) 50 symmetrical 5 VDC 40 120 mA 40C...+85C 30.5 x 25.5 x 9.5 Up to 90 mm depending on antenna TAG as well
Pin Function
OEM module
1 2 3 4 5 6 7 8 9 10 Antenna Rx Antenna Tx 1 + 5 VDC GND Antenna Tx 2 Antenna GND MFOUT MFIN GND (Reserved for future use) GND (Reserved for future use) 11 12 13 14 15 16 17 18 19 20 Rx (Data IN TTL) TX (Data Out TTL) Serial programming data Serial programming Clock Programming voltage input (Reset on low) Enable LED LED + GND +5 VDC
Notes: 1.Supply drain may vary according to antenna design, power down options etc. Usually resulting in lower consumption.
Mechanical specification
OEM module
Top view
27.94 1.27 2.54 1.27
25.44
22.86 3mm
Pin20
27.94 30.48
Pin1
Side view
9.5
Top view
70.00 63.00
45.55
J4 1
J3
1
Side view
11.5
39.00
2.4mm
Enable Serial progr. Data Processor 5V GND 2# 2# I/O I/O H102014 Data V CC I/O Tx Antenna Rx Door opener Turnstile
RS232
PC-Station
Rx
Data H102014
Antenna Tx
5 V
V CC I/O
I/O
H6152 H6154
Operation Flags
RS422/485
Contents
1 Getting started............................................................................................................................................................................. 2 2 Scope and Purpose..................................................................................................................................................................... 3 3 MIFARE Data Structures..................................................................................................................................................... 3 3.1 Definitions ........................................................................................................................................................................... 3 3.2 MIFARE Standard Card.............................................................................................................................................. 4 3.3 MIFARE States ............................................................................................................................................................... 5 4 Protocol........................................................................................................................................................................................ 6 4.1 ASCII Protocol .................................................................................................................................................................. 6 4.2 Binary Protocol .................................................................................................................................................................. 6 4.3 Command Overview......................................................................................................................................................... 6 5 Instruction Set ............................................................................................................................................................................ 7 5.1 Reset...................................................................................................................................................................................... 7 5.2 Version ................................................................................................................................................................................. 8 5.3 Continuous Read............................................................................................................................................................... 9 5.4 Select...................................................................................................................................................................................11 5.5 Login...................................................................................................................................................................................12 5.6 Read....................................................................................................................................................................................14 5.7 Write ...................................................................................................................................................................................19 5.8 Increment ..........................................................................................................................................................................22 5.9 Decrement .........................................................................................................................................................................23 5.10 Copy..................................................................................................................................................................................24 5.11 Turn on/off antenna power ........................................................................................................................................25 5.12 Read/Write User Port..................................................................................................................................................26 5.13 Get ID...............................................................................................................................................................................27 5.14 Multi Tag Selection ......................................................................................................................................................29 5.15 Transfer data telegram................................................................................................................................................31 6 Binary Protocol Mode.............................................................................................................................................................33 7 Timing ........................................................................................................................................................................................35 8 Sector Trailer and Access Conditions .................................................................................................................................37 8.1 Examples for Sector Trailers / Access Conditions .................................................................................................37 8.1.1 Ticketing Applications ......................................................................................................................................37 8.1.2 Data Handling Applications .............................................................................................................................37 8.1.3 No Security, open configuration......................................................................................................................37 9 Frequently Asked Questions..................................................................................................................................................39
1 Getting started
To test and interface the MIFARE OEM Module, you do not need a sophisticated uP development system. All you need is a PC, a connection cable and a power supply for the reader. If you are using Windows 95/98/NT, take the following steps: 1. 2. 3. 4. 5. 6. 7. Make sure, that your reader is RS232-interface type Start HyperTerminal Create a new connection (FILE/NEW CONNECTION) Enter name of connection as you like (f.e. MIFARE) Select connect COM2 (COM1) direct connection Connection setup 9600,8,n,1,no handshake Connect your reader to COM2 (COM1) of the PC and apply appropriate the supply voltage. A string (f.e. Mifare V 0.14) is transmitted to the PC by the reader. This String denotes the firmware provided by your reader module 8. Put a tag to your reader. Serial numbers should be displayed properly 9. Enter commands via keyboard. They should be transmitted to the reader and the reader should reply How does ticketing work with MIFARE ? To get a quick impression, connect the reader to a terminal program, take a new card and try the following steps: 1. Put the card in the field. The terminal program should show continuously the serial numbers of the card, for example D1635640. 2. Enter space. The transmission of serial numbers should stop. 3. Enter s for select. A MIFARE card always has to be selected, before it can be accessed. 4. Enter l01<ENTER> for login to sector 01. This uses key A and the transport key A0A1A2A3A4A5. Alternatively you can type in L01AAA0A1A2A3A4A5, specifying that you want to use key A which is A0A1A2A3A4A5 on a new card. A login is always needed before a sector can be accessed. For new Philips cards use l01FF<ENTER> since they have FFFFFFFFFF as transport key. 5. Now you can access block 04, 05, 06, 07 which are on sector 01. If you enter w04000123456789AABBCCDDEEFFDDEE0375 then the value 000123456789AABBCCDDEEFFDDEE0375 gets written to block 04. To read it, enter r04. 6. To format block 04 as a value block and store 1500 points (1500dec=000005DChex) enter wv04000005DC. 7. To use up 100 points (100dec=00000064hex) enter -0400000064 8. To backup the value into block 05 enter =0405 9. You also can add to the values on the card. To charge 500 points (500dec=000001F4hex) enter +04000001F4.
Card ID
Sectors Block 8: Data or value (16 bytes) Block 9: Data or value (16 bytes) Block 10: Data or value (16 bytes) Block 11: Access Conditions, Key A, Key B (16 bytes)
Sector 0 / Block 0
Serial Number (4 byte) This block is read only Check byte (1 byte) Manufacturer data (11 byte)
Transport keys (keys after manufacturing, on delivery): Key A: A0 A1 A2 A3 A4 A5 (Infineon) or FF FF FF FF FF FF (new Philips cards) Key B: B0 B1 B2 B3 B4 B5 (Infineon) or FF FF FF FF FF FF (new Philips cards) Access Conditions: FF 07 80 xx (key A used to read or write, the key A itself is not readable; key B is data only) Remark 1: enabled keys read as 00 00 00 00 00 00 Remark 2: using key B as data area will cause a security gap, due to the fact that it is necessary to rewrite key A and Access Conditions at every write access (MIFARE does only support read/write whole blocks). Therefore this configuration is not recommended for security sensitive applications.
Get Serial Number (Anticollision if more tags are in the field) and select one card. (Select) Card ID (serialnumber)
Login to a sector (Autenticate) Sector, key, keytype Halt (internally implemented, used for handling of multiple tags)
Increment,
This state machine structure is mapped in application oriented reader commands: Get Serial Number Select Login Read, Write, Increment, Decrement, Copy c continuously reads serial numbers of all cards in the field m<CR> displays a list of all tags in the field s reads a serial number and selects a single card in the field m selects a specific card in the field l does the autentication procedure for a sector; always requires a select (using s or m) before r, w, +, -, = does the reading, writing and value handling; always requires a select and a login before
4 Protocol
As a default data is transmitted at 9600,n,8,1. Two protocol modes are supported. The protocol mode is configured in the reader EEPROM. As a factory default, the ASCII protocol is used. For changing to Binary Protocol see page 41ff.
Execute a power on (software) reset. Start Up configuration This command will reset the reader module and all TAGs in the field. After reset the continuous read command may be executed automatically (depending on the Protocol Configuration register). Firmware Version On Start Up the reader is transmitting a string (f.e. Mifare V indicates the firmware provided by the reader module. This string is only transmitted in ASCII mode.
Hardware Reset using PIN 15 Alternatively you may use the Reader Enable Pin (PIN 15 of the OEM module to low) to reset the reader. Reset Timing The power up timing depends on environmental conditions such as voltage rampup. So for portables the timing may depend on the charging state of the battery. It also may change due to future firmware version. POWER ON Timing 1) at t=0 power is turned on 2) at t=136 msec the antenna field is activated 3) at t=155 msec the bootup message "MIFARE V014d" is finished 4) at t=178 msec the first serial number has been sent to the PC (card touches antenna) RESET (Pin 15) Timing 1) at t=0 reset pin 15 is released 0 V -> 5V 2) at t=75 msec the antenna field is activated 3) at t=93 msec the bootup message "MIFARE V014d" is finished 4) at t=116 msec the first serial number has been sent to the PC (card touches antenna)
5.2 Version
Command CMD v Binary Frame Answer ANS none DATA None 02 01 01 76 76 03 DATA ASCII: Mifare 0.14d + CR + LF Binary: 02 00 0C 4D 69 66 61 72 65 20 30 2E 31 34 64 67 03
Display Firmware information string. Firmware Version This string indicates the firmware provided by the reader module. It is the same string which is transmitted in ASCII mode at power up reset.
The serial number is repeated continuously while one or more tags remain in the field. This command is stopped by transmitting any character to the reader module. Continuous read mode By changing the Cont. Mode Flag in the Protocol Configuration register (see register table page 15) the reader could be capable of continuously reading multiple tags. Start Up configuration This command is executed automatically at Start Up if the AutoStart Bit in the Protocol Configuration register is set(see register table page 15). TAG ID Byte This byte is only transmitted if the Extend ID in the Protocol Configuration register is set (refer table on page 40). Unknown Transponder types can be accessed as well if the transponder functionality is Mifare compliant. Disabled as factory default. binary mode Continuous read is supported in ASCII protocol only. Since the binary protocol is strictly master slave with readers as slaves, it is not supported there. cancelling the continuous read command This command is not stopped if all tags leave the field. If the tags are removed while executing this command the reader stops transmitting serial numbers. If another tag enters the field before this command is cancelled (by transmitting a space) the reader module starts transmitting the new serial number. simple access control applications Please consider that the serial number is not encrypted during the Anticollision/Select procedure. Data encryption is activated after a successful login instruction. For simple access control applications it is recommended to use read only blocks (see chapter 8 Sector Trailer and Access Conditions on page 37 and datasheets of your MIFARE chip manufacturer) for the identification of the tag.
9
Reading any block (even the manufacturer block) of the transponder will ensure a successful Authentication procedure. This will increase your security.
10
5.4 Select
Command CMD s Binary Frame: Answer ANS none DATA none 02 01 01 73 73 03 DATA TAG Type Identification (1 byte) 0x01 denotes a MIFARE Light Transponder (not supported) 0x02 denotes a MIFARE Standard Transponder 0x03 denotes a MIFARE Pro Transponder 0xFF denotes a unknown Transponder SN (4 bytes) none
N: no TAG
Selects a single card and returns the card ID (Serial Number). Select a single tag No previous continuous read is required. TAG ID Byte This byte is only transmitted if the Extend ID in the Protocol Configuration register is set (refer table on page 40). Disabled as factory default. data encryption Before a successful login instruction data encryption is inactive (serial number is transmitted as plain text). multiple tags This command is designed for fast access to a single tag in the field. If you are using multiple cards in the field you have to use the m instruction for the select procedure.
11
5.5 Login
Command CMD l DATA sector (1 byte) keytype (1 byte) AA FF BB 102F 304F
000F
authenticate with keytype A authenticate with keytype A, transport key FFFFFFFFFFFF authenticate with keytype B authenticate with keytype A using stored key (00..31) authenticate with keytype B using stored key (00..31)
This parameter is optional. By transmitting <CR> (Carriage Return, ASCII 13d) instead the authentication is done with transport key 1 (A0A1A2A3A4A5, keytype A). key (6 bytes) By transmitting <CR> instead of the keydata authentication is done with manufacturers transport keys (A0A1A2A3A4A5, B0B1B2B3B4B5, FFFFFFFFFFFF). sector 01, transport key A: 02 01 09 6C 01 AA A0 A1 A2 A3 A4 A5 CE 03 or 02 01 04 6C 01 AA 0D CF 03 or 02 01 03 6C 01 0D 62 03 with master key 0 (type A): 02 01 03 6C 01 10 7F 03 DATA none none none none
Binary Fame:
Answer ANS L: login success N: no TAG F: login fail, key wrong E: invalid key format (stored key)
Performs an authentication to access one sector of the card. Only one sector can be accessed at a time. Optionally also keys stored in the reader EEPROM can be used. To store keys in the EEPROM the write master key command (wm) is used. It is possible to store up to 32 master keys in the reader EEPROM. Login to a tag Requires a select before (using the Select or MultiTag instruction).
12
no tag error N This means that the tag does not respond, because there is either no tag present or none of the tags in the field is selected (s or m instruction). <CR> By transmitting <CR> (carriage return, ASCII 13d) instead of an expected parameter the reader module uses standard parameters (transport keys) for the login procedure. Standard parameters are available for keytype and keydata (l<sector><CR>), which uses the transport key 1 (A0A1A2A3A4A5), or for the keydata only (l<sector>AA<CR>, l<sector>BB<CR>, l<sector>FF<CR>), which uses one of the three supported transport keys (key 1: A0A1A2A3A4A5, key 2: B0B1B2B3B4B5, key 3: FFFFFFFFFFFF). login with keydata from EEPROM Each key stored in the reader EEPROM can be used as keytype A or keytype B. For using a specified key as keytype A the value for keytype character is the keynumber added to 10h. For using the keydata as key B 30h is added to the keynumber. So for a login with the key 0 from the EEPROM the instruction sequence is l<sector>10 by interpreting data as key A, and l<sector>30 by interpreting data as key B. usage of key A, key B MIAFRE cards support two different crypto keys for each sector. Each key is 32 bit long and stored in the sector trailer (last block of the sector) on the card. It is possible to set different access rights for the two keys. For more details of using different keys and access conditions (also stored in the sector trailer) refer the personalisation procedure on page 40. Examples: l01<CR> l02AA<CR> l3FBB<CR> l04FF<CR> l0FAAFFFFFFFFFFFF l0E14 l0530 l0732 l0110 l0ABBFF12FFFFFF35
authenticate for sector 1, using the transport key A (A0A1A2A3A4A5, keytype A) authenticate for sector 2, using the transport key A (A0A1A2A3A4A5, keytype A) authenticate for sector 63, using the transport key 2 (B0B1B2B3B4B5, keytype B) authenticate for sector 4, using the transport key 3 (FFFFFFFFFFFF, keytype A) Authenticate for sector 15, using key FFFFFFFFFFFF, keytype A Authenticate for sector 14, using EEPROM key 4, keytype A Authenticate for sector 5, using EEPROM key 0, keytype B Authenticate for sector 7, using EEPROM key 2, keytype B Authenticate for sector 1, using EEPROM key 0, keytype A Authenticate for sector 10, using key FF12FFFFFF35, keytype B
13
5.6 Read
Command CMD r read block rv read value block re read reader EEPROM Binary Fame: DATA block (1 byte) block (1 byte) register (1 byte)
read block 04h: 02 01 02 72 04 75 03 read value block 04h: 02 01 03 72 76 04 02 03 read register 10h(user data): 02 01 03 72 65 10 05 03 DATA read block: Data (16 bytes) read value: Value (4 bytes) read EEPROM: Data (1 byte) none none none
Reads a block, value or register. no value block I Specified block does not match the value format. The value block is corrupted, you may use a backup block for recovery (controlled by the application). reading blocks The reading procedure requires a successful authentication, which requires a select and login before. no tag error N This means that the tag does not respond, because there is either no tag present or none of the tags in the field is not authenticated (l instruction). read failure F Additional to an data read error caused by bad transmission conditions, this error appear if you want to read a block which is not in your currently authenticated sector. f.e. if you try to read the block 02 (sector 0) after you just logged in into sector 1 (using the l01.. command).
14
read reader EEPROM Reads the internal reader EEPROM. It contains non-volatile parameters. MIFARE Reader Module EEPROM Memory Organisation Number Name Description 00h03h unique device ID This number is unique for each device and (32 bit) therefore read only. 04h Station ID Indicates the address ID for every station. The ID is used for addressing within a party line and is read only. 05h Protocol Configuration Set protocol type, power on behaviour 06h Baud Rate Selection Defines communication speed 07h0Fh reserved 10h13h user data free usage Station ID 0 and 255 are reserved for the bus master (controller) and the get ID instruction and are therefore not allowed for any reader module. As a factory default the Station ID is set to the value 01h. It is possible to address up to 254 (01254) different readers on a single RS485/RS422/RS232 bus. At delivery the reader module is in ASCII protocol mode (9600,n,8,1) with AutoStart enabled and the Station ID set to 01. In ASCII mode the Station ID is ignored. It is not recommended to use the MIFARE reader modules without an appropriate personalization (refer personalization procedure on page 41) in bus applications (binary protocol only). The register 10h to 13h are available for application specific user data and not interpreted by the reader module. The register locations 07h to 0Fh are reserved for future usage and not available for user data. Protocol Configuration Register (05h)
Bit 8 (MSB) Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 (LSB)
Cont. Mode
BinaryTimeout ExtendID
Binary AutoStart
Extend ID: Extend TAG ID (serial number) 0 (factory default) The TAG ID Byte is not transmitted before the serial number 1 TAG ID Byte is transmitted before the serial number This setting does only affect the commands continuos reading (c), select (s) and MultiTagSelect (m). If set a the unique serial number (4 bytes) of the transponder is extended by a single prefix byte. The values for the prefix byte are: 0x01 denotes a MIFARE Light Transponder (not supported) 0x02 denotes a MIFARE Standard Transponder 0x03 denotes a MIFARE Pro Transponder 0xFF denotes a unknown Transponder
15
Binary: binary mode flag 0 (factory default) reader operates in ASCII protocol mode 1 reader operates in binary protocol mode AutoStart: 0 1(factory default)
reader is in command mode at start up reader executes the command c (read serial numbers continuously) at start up automatically. In binary protocol mode this bit is ignored (The binary protocol does not support continuos reading).
BinaryTimeout 0 (factory default) Binary Time-out disabled. 1 Binary Time-out enabled. This flag is only interpreted if the reader operates in binary mode. If the serial bus stays idle for more than 96 ms (no data is transmitted), the reader will clear its command buffer ant enter Command Read mode. Command Read mode means that the reader is waiting for valid data frames (beginning with the STX code). Example: You transmit the sequence 02h 00h FFh to a third party module (a door opener, turnstile control unit, ). Since this sequence starts with a valid Mifare reader protocol but does not terminate properly, the Mifare reader would wait infinitely. Termination can be enforced using the binary timeout. Cont. Mode (continuous read mode) 0 (factory default) continuous reading does only support single tags 1 continuous reading does support multiple tags Using single tag reading is much faster than using multiple tag reading. If in single mode more than one card is in the field the reader does transmit none or only one of the serial numbers (depending on reading conditions and transponder positioning). Baud Rate Selection (06h)
Bit 8 (MSB) Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 (LSB)
reserved reserved reserved reserved reserved reserved BS1 BS1, BS0: BS1 0 0 1 1 BS0 0 1 0 1 Baudrate 9600 baud (factory default) 19200 baud 38400 baud 57600 baud
BS0
Communication is always 8 data bits, no parity, 1 stop bit. At delivery the Communication speed is set to 9600 baud.
16
To take over changes in any of these register the reader must be reset. It is recommended to clear reserved bits for ensure compatibility with further firmware versions.
17
Examples: r05
00112233445566778899AABBCCEEDDFF
r00 rv04
00112233
re04
01
re05
01
re06
03
reads block 4 (sector 1) reply from reader if Mifare Standard block 5 contains 001122 reads Manufacturer Code (sector 0) reads value of block 4 reply from reader if Mifare Standard value block 4 contains 00112233 reads register 4 (Station ID) reply if Station ID is set to 01 reads register 5 (Protocol Configuration) reply if Protocol Configuration register is set to 01 reads register 6 (Baud Rate Selection) reply if baudrate is set to 57600 baud
18
5.7 Write
Command CMD w write block DATA block (1 byte) 003F data (16 bytes) wv write block (1 byte) 003F value block value (4 bytes) we write register register (1 byte) 00..0F data (1 byte) wm write master key number (1 byte) 001F key key (6 bytes) Binary Frame: write block 04h, data 001122:
02 01 12 77 04 00 11 22 33 44 55 66 77 88 99 AA BB CC DD EE FF 60 03
write value block 04h, value 00112233: 02 01 07 77 76 04 00 11 22 33 03 03 write register 10h (user data), data AAh 02 01 04 77 65 10 AA AD 03 write master key 0, keydata A0A1A2A3A4A5: 02 01 09 77 6D 00 A0 A1 A2 A3 A4 A5 13 03 Answer ANS None DATA write block: write value: write register: write master key: X: unable to read none after write U: read after write none error N: no TAG none F: write failure none I: write failure none
written data (16 bytes) written value (4 bytes) written value (1 byte) written key (6 bytes)
Writes a block or sets a value. A read after write is performed automatically. writing blocks The writing procedure requires a successful authentication, which requires a select and login before. no tag error N This means that the tag does not respond, because there is either no tag present or none of the tags in the field is not authenticated (login instruction). invalid value I The value read back after the write value instruction is a not a value block. Data was written corruptly. In almost all cases you can handle this similar to a write failure F. unable to read after write X TAG was removed from field immediately after the write instruction.
19
Data was written but the TAG did not response to the Read after Write Instruction (which is done automatically by the reader module). Data stored on the TAG may be corrupted. read after write error U After each write access to the TAG a read is done automatically. This error occurs if the data read does not match the written one. This is caused when data was not stored on the TAG or if the sector is protected (f.e. keys of sector trailers are read protected and will always cause a read after write error although written correctly). write failure F Additional to an data write error caused by bad transmission conditions, this error appear if you want to write a block which is not in your currently authenticated sector. f.e. if you try to read the block 02 (sector 0) after you just logged in into sector 1 (using the l01.. command). writing values The write value block command is designed to create blocks which match the value format. This command requires write access to specified block. It is not recommended to use this instruction for ticketing operations. For ticketing algorithms special instructions (Increment/Decrement/Copy) are supported. writing to the EEPROM Writing to the internal reader EEPROM takes approximately 3 ms per byte. If the supply voltage is turned off while the reader is programming, data in the EEPROM may be corrupted. The reader is transmitting the write acknowledge (6 bytes key data) after successful programming of the EEPROM. Reset reader to actiovate parameter changes. master keys Master keys are not readable. Due to data security reasons master keys are stored redundant, consuming 12 bytes per key. The reader module allows to store up to 32 master keys. They are stored non-volatile. writing master keys Due to the fact that master keys are stored in a write only area the reader module is not able to do a read after write for this sections. Nevertheless the reader does check if the programming cycle was executed correctly. Error codes are returned also. To prove the master key stored is valid a login instruction (by using the EEPROM key, f.e. lxx20 and an appropriately formatted card) is needed. writing to the Sector Trailer Because of some parts of the sector Trailer are write only (key areas) writing to the Sector Trailer will cause a read after write (U) error. If a part of the Sector Trailer is write protected (f.e. key A area), dummy data is required for a successful write operation.
20
Examples: w08000102030405060708090A0B0C0D0E0F writes a data stream (000102) to block 8 (sector 2) wv05010055EF writes value 010055EF to block 5. we0464 write the value 64h to the STATIONID register we0502 set the reader in binary mode (write 02h into the Protocol Configuration register) wm00112233445566 store key 112233445566 in EEPROM (key number 0) wm02A0A1A2A3A4A5 store transport key 1 in EEPROM key 2 we0600 sets the reader to 9600 baud
21
5.8 Increment
Command CMD + Binary Frame: Answer ANS None X: unable to read after increment N: no TAG I: no value block F: increment failure DATA Block (1 byte) 003F Value (4 bytes) 32 Bit value Increment Block 04h, value 01010102 02 01 06 2B 04 01 01 01 02 2B 03 DATA new Value (4 bytes) none none none none
increments a value block by adding a value to the value stored. A read after write is performed automatically. Call fails, if source block is not in value format. incrementing values Requires a select and login before. no value block I specified block does not match the value format Value block is corrupted, you may use a backup block for recovery (controlled by the application). unable to read after increment X TAG was removed from field immediately after the increment instruction. Data was incremented but the TAG did not response to the read after increment instruction (which is done automatically by the reader module). no tag error N This means that the tag does not respond, because there is either no tag present or none of the tags in the field is not authenticated (l instruction). Examples: +0400000001 +0500000100
22
5.9 Decrement
Command CMD - Binary Frame Answer ANS none X: unable to read after decrement N: no TAG I: no value block F: decrement failure E: decrement failure, empty DATA Block (1 byte) 003F Value (4 bytes) 32 Bit value Decrement Block 04h, value 01010102 02 01 06 2D 04 01 01 01 02 2D 03 DATA new Value (4 bytes) none
decrements a value block by subtracting a value to the value stored. A read after write is performed automatically. Call fails, if source block is not in value format. decrementing values Requires a select and login before. no tag error N, no value block I Same as Increment. unable to read after decrement X TAG was removed from field immediately after the decrement instruction. Data was decremented but the TAG did not response to the read after decrement instruction (which is done automatically by the reader module). decrement failure E The error return E denotes, that the value block does not contain sufficient value to decrement. Some cardtypes will return F instead. On a 2s complement representation the smallest value is 80000000h, not 00000000h!.
subtract 1099 (=0000044Bh) from value block 4 subtract 256 from value block 5
23
5.10 Copy
Command CMD = Binary Frame: Answer ANS none X: unable to read after copy N: no TAG I: no value block F: copy failure DATA source block (1 byte) target block (1 byte) Copy value Block 4 to block 5 02 01 03 3D 04 05 3E 03 DATA new Value of target block (4 bytes) none none none none
copies a value block to another block of the same sector. A read after write is performed automatically. Used for backup and error recovery. copy blocks Requires a select and login before. target block The target block need not to be a valid value block. Call fails, if source block is not in value format. access conditions This command requires the same access conditions than the decrement instruction. unable to read after copy X, no tag error N Same as Increment decrement. no tag error Nno value block I Same as increment/decrement, but only source block has to be a value block, target block is overwritten. Examples: =0405 =0506
24
This command turns OFF or ON the antenna power. This reduces power consumption of the module. pon A power on is done automatically by the reader if necessary (before TAG access commands like s/m). After executing the Power On command the reader is operational instantly. poff Pleas keep in mind that turning off the antenna power will reset all TAGs in the field and therefore a new select, and login is required before card access. It is not recommended to use this option while the host is processing data from the card (f.e. between the read and decrement instruction). sequential usage Neither does a poff instruction does affect the reader if the field is already turned off nor does the pon if the antenna field is turned on. Power Down PIN By using the Power Down Pin (PIN 16 of the OEM module), the reader enters the Hard Power Down mode which will require less power consumption. In difference to the poff instruction this mode is only left when the PIN is released and set to GND level again. Leaving the Hard Power Down mode will require as much time as a reader reset (approx. 68ms). Examples: pon poff
25
This command returns the state of the user port (PIN 14 of the OEM module). This port may be used as 1 bit I/O port. read port Even a 8 bit value is returned at reading only the LSB of the answer does indicate the port state. write port As the user port is only 1 bit wide the port pin is cleared if data is zero or set if data is unequal zero. Examples: pr pw00 pw01
reads the user port clears the user port sets the user port
26
5.13 Get ID
Command CMD g Binary Frame: Answer ANS none DATA none 02 FF 01 67 99 03 DATA Station ID (1 byte)
This command is used to get the Station IDs for all reader modules on the bus. time slotted answer To avoid bus collisions, the answer of each reader is transmitted in a different timeslot. The Station ID of each device denotes the timeslot (see table below). In binary mode the Station ID is packed into a correct data frame (STX 0 1 ID BCC ETX), in ASCII mode data is terminated by CR+LF. The length of a timeslot depends on the selected baudrate. Therefore values for T0 are: Baudrate 9600 19200 38400 57600 T0 7,4 ms 3,7 ms 1,85 ms 1,24 ms
This command supports 256 different timeslots. After the last timeslot (256*T0) this command is done and all available readers should have transmitted their serial number. It is not supported to use different baudrates on the same bus.
0
T0
1
T0
2
T0
3
T0
4
T0
5
T0
33
T0
34
T0
35
T0
g 01 03 04
reader (35)
35
27
For a example of use refer to page 41 (personalisation of MIFARE reader) ASCII mode If the reader is used in ASCII protocol mode the personalisation procedure is not necessary. In ASCII mode the station ID does not affect readers functionality (even if set to an reserved value like 0 or FFh).
28
N: no TAG
This command is used instead of the Select (s) instruction, when using multiple tags in the antenna field. The serial number indicates the tag which is selected. All other tags are not affected by this instruction. m<CR> By transmitting the carriage return code instead of the 4 byte serial number the reader listens up the serial numbers of all tags which are in readable antenna range, terminated by a single data byte which indicates the number of tags found. Each serial number is terminated by a CR/LF sequence in ASCII mode or put into a particular STX-ETX data frame in binary mode. This command is finished after the reader transmits a single byte (the number of tags found) to the application host. If the tag search is not successful the reader will reply 00 (zero tags found) at command termination. reading distance As each card in the field affects the antenna tuning, and reduce field strength the reading distance is reduced for each new transponder added to the antenna field. Depending on the physical construction of each tag the interference between these tags may also affect reading quality. Use this command instead of the select (s) instruction if more tags are in reading range. This command replaces the s instruction, therefore a valid login sequence for multiple tags is: m<CR>: To display a tag list (you may alternatively use the c instruction for a single tag). m81635640: To Select a specific tag. l01<CR>: To login into sector 1 After the MultiTag selection all other tag interfacing commands (l, r, w, +, ) are the same.
29
maximum number of tags The maximum number of tags in the field is only limited by physical characteristics of your antenna design. The implementation detects up to 17 tags. Examples: m<CR>
00112233 85431557 81BF565D 03
tag list reply from reader (three tags found) select second tag (SN: 85431557) reply: select successful
m85431557
85431557
30
Binary Frame
This command is used to transfer user specific data frames to a ISO 14443 (Part 2) compliant Transponder, such as Mifare PRO. This command is extreme low level. If using Mifare Light or Mifare Standard cards there is absolutely no need for implementing this instruction in your application. It is not recommended to use this command without detailed low level knowledge of ISO 14443 protocol. length code Number of Bytes you want to transmit. In Binary mode this byte is transferred too for compatibility reasons even though it could be calculated with the binary frame length code. Due to internal buffer ranges the maximum length byte is 34 (maximal f ame length is r therefore 39 bytes). If the transponder/host does tranmit more than 34 bytes further data is ignored. option byte This bytes holds transfer options. Bit 0: if set Parity generation is enabled Bit 1: if set Parity is even, otherwise Parity bit is odd Bit 2: if set CRC generation for transmission is enabled Bit 3: if set CRC checking for receiving is enabled Bit 4: if set Crypto unit is deactivated before transmission start Activation of the Crypto unit is only possible by using the login (l) instruction Bit 5,6,7: Bit Framing (Number of Bits from last Byte transmitted) CRC generation CRC generation described in ISO 14443-3 Appendix B. Receiving answer Immediately after transmitting the reader is set into receive mode. If receiving no data the reader returns N to the application host. Due to this timeout it is not recommended to use instructions with no response. In this case a acknowledge byte from the card may be used to speed up transmission (receiving a single byte is much faster than the timeout).
31
Examples (in ASCII mode) select sequence for a single tags in the field: t01E326 t02039320 answer: answer: 020400 (REQA) 0581635640F4 (GetSN) answer: 0188 (Select card 81635640F4)
t070F937081635640F4
read block 4: (after login) command code is 0x30 t020F3004 answer: 10010203... this means: 2 bytes transmitted, option byte set to 0x0F, data bytes 0x30,0x04 (read command code and block number) It not possible to activate the Crypto unit using the 't' instruction. So if using a Mifare Classic compatible Operating system on a tag it is not possible to do an authentication (login). This must be done using the regular login-instruction ('l').
32
Start of Text (ASCII 02h) unique ID of the station ID 0: reserved for the bus master (controller device) ID FFh: reserved reply all (Get ID Instruction) Length: Data Length Indicator Denotes the length of the Command/Data block Command/Data: Instruction Block The instruction block contains the command and data information. The command values are the same as in ASCII protocol mode (x, s, ). Data is transmitted binary instead of ASCII Hex. The length of the command block depends on the instructions. BCC: Block Check Character This Byte is used to detect transmission errors. It is calculated by XORing each byte of the transmission frame excluding the STX/BCC and ETX character. BCC=(Station ID) XOR (Length) XOR (Data/Command 1) XOR (Data/Command 2) XOR XOR (Data/Command N) Example: read page 0 frame for station 01: (STX 01 02 r 00 BCC ETX): BCC = 01h XOR 02h XOR 72h XOR 00h = 71h ETX: End of Text (ASCII 03h) If the reader receives a invalid instruction frame (f.e. BCC wrong) or the transmitted Station ID does not match the internal ID (see register table page 15) the reader resets the internal command interpreter (clear the receive buffer) and waits for the next STX transmitted by the controller. To prevent that the reader module hang up in a undefined state after receiving uncompleted instruction frames a binary timeout can be enabled (refer Protocol Configuration Register on page 16). The reader module answers in the same telegram format, with the ID -field set to 0. The Command/Data block of the answers in binary protocol mode does match the ASCII mode answers, with the only difference that data values are transmitted binary instead of ASCII Hex.
33
Examples: 02h STX 64h Station ID 01h Length 78h x 1Dh BCC 03h ETX
This instruction frame will reset the reader module with the station ID 64h. The reader module would not send an acknowledge for this command (see chapter 5.1 Reset on page 7)
02h STX
25h Station ID
02h Length
72h r
04h block
51h BCC
03h ETX
This frame will read the fourth block of (the selected and authenticated) card in the field of the reader module 25h. If successful the reader will reply for example the frame
02h 00h 0Fh Bus Master ID 01h 00h 05h 03h Data Byte Nr 0 Data Byte Nr 1 Data Byte Nr 2 Data Byte Nr 3 04h 02h 06h 07h Data Byte Nr 4 Data Byte Nr 5 Data Byte Nr 6 Data Byte Nr 7 08h 0Fh Data Byte Nr 8 Data Byte Nr 9 0Eh 0Bh 0Ch Data Byte Nr 10 Data Byte Nr 11 Data Byte Nr 12 0Dh 0Ah 09h 0Fh Data Byte Nr 13 Data Byte Nr 14 Data Byte Nr 15 03h
Length
BCC
STX
The Data in block 4 is : 01 00 05 03 04 02 06 07 08 0F 0E 0B 0C 0D 0A 09 If the read operation fails because the TAG was removed the reader will reply. 02h STX 00h Master ID 01h Length 4Eh N 4Fh BCC 03h ETX
ETX
34
7 Timing
tCMD PC: Reader: Command Reset Cont. Read Select9 Multi Tag Login Read Data [r] Value [rv] EEPROM [re] Write10 Data [w] Value [wv] EEPROM [we] Master Key [m] Power ON Power OFF Port write [w] read [r] Get ID Transfer Telegram
1
tEXEC
tRES
Request Response Command Execution Response 1 1 2,3 4 5 1 tTYP tMAX tFAIL tSUCC tNOTG tMIN tTYP 1,4 tMAX1 1,0 1,0 1,0 2,1 67,6 -7 7,6 15,0 various 16,6 5,4 1,3 3,8 3,6 3,8 1,0 11,2 11,2 9,6 115,0 <0,3 <0,4 <0,1 <0,1 various various 30,06 10,4 3,1 10,4 various 3,1 3,1 3,1 35,4 10,4 1,0 35,4 10,4 1,0 6,3 1,0 1,0 1,0 1,0 1,0 various
tMIN
10,4
2,1 4,2
5,2 17,7
4,2 4,2 3,1 36,5 12,5 4,2 9,4 3,1 4,2 3,1 2,1 1,0 various
35,4 10,4
1,3 1,3
13,4 13,4
This values are defined by tranmission speed (RS232 @ 9600/19200/38400/57600,n,8,1 ~ 1,041/0,52/0,26/0,17 ms/character). The timing data in this table is calculated for 9600 baud. No delay between cherechters is assumed and the timing data is calculated for ASCII mode. When using binary mode this values will increase due to the binary mode frame, which requieres more data tranmitted (STX, ). 2 Execution time on faulty communication or data failure (f.e. key wrong, no value block, access to unauthenticated sector). Timing data in this table is typical error detection time and will vary with error type. 3 If the a data byte of the command instruction does not match the ASCII Hex Format (f.e. r0G) the reader module is responding almost immediately (<170us) after the second nibble of the faulty data byte by transmitting a question mark, carriage return and linefeed (?<CR><LF>). 4 Execution time on operation success. 5 Execution time on no Tag/timeout-error (max. processing time) 6 In binary Mode the reader module does not send a response to the reset command. Nevertheless the reader is executing a power on reset and ready again in approximately 68 ms. 7 If no TAGs is present the reader will wait until a TAG enters the field. If the TAGs remains in the field the serial numbers are repeated continuously. 8 This command will not terminate automatically (refer 5.3 Continuous Read on page 9) 9 Select includes a card reset before (10 ms). 10 All write operations include a read after write. 35
All values are ms. Grey marked cells are fixed values due to the fact that this instructions have a constant instruction/response length. All timing data is advisory application information and does not form part of the specification. It may change in further firmware releases.
36
Examples: To use a whole sector number 4 for data storage with key A (read only key) set to 001122334455 and key B (read/write key) set to 66778899AABB the following instruction sequence should be used. s l04<CR> w13001122334455787788FF66778899AABB select a single TAG login to the sector (or appropriate login) write keys and access conditions This command will cause a read after write error, due to the fact that key areas are read only. turn off the field (reset TAG) reselect the TAG do login with new keys (test writing)
poff s l04
To set the first two blocks of a sector for ticketing (f.e. value and backup block) and the third block to data mode and the keys same as above set the sector trailer to the value: 00112233445548778BFF66778899AABB
38
39
What happens, if somebody pulls the card out of the field during a transaction? Modifying memory content of a MIFARE card is an EEPROM write operation internally. It requires a sufficient energy supply to execute properly. If a card leaves the field during an EEPROM write, corrupted data may be left. However, a sophisticated transaction scheme inside the MIFARE tag reduces the chance of this happening significantly, maybe you will never encounter it in your tests. Incrementing or decrementing is safer than doing read-write explicitly. In addition to that the application can be designed in a way, that each value block is mirrored in a backup block. This allows for automatic recovery of lost data resulting in very reliable systems. However, carefully designing and testing the application is recommended. What type of MIFARE card should I use ? MIFARE Light was designed as a lean solution for a single application environment. It contains only one sector with 2 keys, access condition, 2 data blocks and one value block. MIFARE Standard was designed for a multiapplication environment. It contains 16 sectors each with 2 individual keys, access conditions, 3 data or value blocks. Some applications use the 1 kByte of the MIFARE Standard Card Memory just as a storage. How should MIFARE cards be personalized ? It depends on the application. Each sector of the Standard MIFARE card can be devoted to a specific application. A) Identification, access control, data storage applications MIFARE cards are delivered with transport keys (see section 3.2) and can be used already with those keys. Also the access conditions need not to be changed. B) Cashless payment, ticketing, metering Cashless payment is based on value blocks that can be incremented and decremented. Value blocks are generated easily using the Write Value command. A sector containing a value block should also contains a backup block to restore values after a write crash. After each transaction the value block should be copied into the backup using the copy command. Care has to be taken, that a sector with a value block does not contain other value blocks. Otherwise a security gap arises from the possibility of copying value blocks within a sector. In security sensitive applications it is recommended to change the access conditions and keys. Keys can be modified using the write command. It is strongly recommended to modify the sector trailer containing access conditions and keys (block 3, 7, 11, ) in a stable environment with good reading only. Otherwise sectors with badly formatted keys or access conditions never can be accessed again. For a cashless payment block the recommended access conditions are: 08 77 8F xx Which means, that key B (master key) can write values, access conditions and keys and key A (field key) can read and decrement values only.
40
How should the MIFARE reader be personalized ? In ASCII protocol applications no personalisation is necessary. For bus applications which are using the binary protocol mode a personalisation procedure is required. To configure the reader for binary protocol mode the following instruction flow is recommended. 1) Start HyperTerminal 2) Connect your reader to the PC and turn on the supply voltage 3) The reader transmit the Version String (f.e. MIFARE V0.14) after initialisation 4) Type we00xx (where xx denotes the Station ID for the reader) to set the ID 5) Wait until the reader replies with Wxx. Now the Station ID is set. You may read it by typing re00 6) To set the reader into binary protocol mode type we0102. It is stored nonvolatile in the binary mode flag (Protocol Configuration Byte). 7) Until you reset the reader (turn off the supply voltage or t pe x) the reader y stays in ASCII protocol mode 8) By typing x the reader execute a reset. In binary mode the reader does not transmit the version string at start up any more and does not respond to the ASCII command set. To restore the ASCII protocol mode you have to transmit the write EEPROM command (in binary mode: >02h FFh 04h 77h 65h 01h 01h E8h 03h<) which resets the binary mode flag. How to implement a device driver? For the implementation of device drivers using the Mifare OEM module a separated Applications Note is available including source code examples. Additionally a PC/SC compliant device for the MIFARE Module is already available from Elatec GmbH (http://www.ElatecEurope.com/). Furthermore a smart card service provider for MIFARE standard cards and a PC security application (PC logon) is offered. Major Differences between v. 0.11a and v. 0.14d 1. Support of multiple cards. The continuous read does an anticollision that delivers a list of all cards in the field at he cost of repetition speed. The new m command does a select out of several cards in the field. 2. Open interface to all ISO14443A cards through the transfer command. 3. Bug fix: Lockup on serial receive buffer overflow is fixed. 4. Bug fix: pon, poff working properly. V014 also supports enable pin function. 5. Bug fix GetID instruction, timing is now optimized for each baudrate. 6. RS485/422 interface (DEN pin) is now faster. 7. Frame timeout in binary mode can be activated by parameter setting. 8. Continuous read mode can be used as SingleTag read (as always) or as new MultiTag read by setting the Protocol Configuration register. 9. MIFARE Light is not fully supported any more.
41