CR95HF
CR95HF
CR95HF
VFQFPN32 5x5 mm
Applications
Features
Hardware features
Dedicated internal frame controller
Highly integrated Analog Front End (AFE)
for RF communications
Transmission and reception modes
Optimized power management
Tag Detection mode
October 2014
This is information on a product in full production.
DocID018669 Rev 10
1/72
www.st.com
Contents
CR95HF
Contents
1
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1
Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2
List of terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2/72
3.1
Operating modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2
Startup sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Communication protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4.1
4.2
Polling mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.2.2
Interrupt mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.3
Error codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
4.4
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
5.1
Command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
5.2
List of commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
5.3
5.4
5.5
5.6
5.6.2
5.6.3
5.6.4
5.6.5
5.7
5.8
Improving RF performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5.8.2
DocID018669 Rev 10
CR95HF
Contents
5.8.3
5.9
5.10
Electrical characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
6.1
6.2
DC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
6.3
6.4
SPI characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
6.5
RF characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
6.6
Oscillator characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Part numbering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
D.2
D.3
ISO/IEC 18092 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
D.3.1
D.4
ISO/IEC 15693 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
D.4.1
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
DocID018669 Rev 10
3/72
3
Description
CR95HF
Description
The CR95HF is an integrated transceiver IC for contactless applications.
The CR95HF manages frame coding and decoding in Reader mode for standard
applications such as near field communication (NFC), proximity and vicinity standards.
The CR95HF embeds an Analog Front End to provide the 13.56 MHz Air Interface.
The CR95HF supports ISO/IEC 14443 Type A and B, ISO/IEC 15693 (single or double
subcarrier) and ISO/IEC 18092 communication protocols.
The CR95HF also supports the detection, reading and writing of NFC Forum Type 1, 2, 3
and 4 tags.
Figure 1. CR95HF application overview
Interrupt Management
CR95HF
SPI
UART
1.1
Block diagram
Figure 2. CR95HF block diagram
4/72
DocID018669 Rev 10
Host
Controller
(MCU)
CR95HF
1.2
Description
List of terms
Table 1. List of terms
Term
Meaning
DAC
GND
Ground
HFO
LFO
MCU
Microcontroller unit
NFC
RFID
RFU
SPI
tL
tREF
Reference time
UART
WFE
DocID018669 Rev 10
5/72
7
CR95HF
25
TX1
NC
NC
NC
NC
XIN
XOUT
GND_TX
VPS_TX
TX2
NC
NC
NC
GND
NC
ST_R1
RX1
SSI_1
RX2
SSI_0
NC
SPI_SCK
GND_RX
17
SPI_MISO
SPI_SS
UART_TX / IRQ_OUT
VPS
UART_RX / IRQ_IN
NC
NC
ST_R0
SPI_MOSI
6/72
Pin name
Type(1)
Main function
TX1
Driver output 1
TX2
Driver output 2
NC
Not connected
NC
Not connected
RX1
Receiver input 1
RX2
Receiver input 2
NC
GND_RX
Ground (analog)
ST_R0
ST Reserved(2)
10
NC
Not connected
11
NC
Not connected
Not connected
DocID018669 Rev 10
Alternate function
CR95HF
Pin name
12
UART_RX / IRQ_IN
13
VPS
14
15
UART_TX / IRQ_OUT
SPI_SS
Type(1)
Main function
(3)
(5)
(6)
(6)
(4)
Interrupt input
Interrupt output
16
SPI_MISO
17
SPI_MOSI
I (6)
18
SPI_SCK
I (7)
19
SSI_0
I (6)
20
SSI_1
I (6)
21
ST_R1
I (8)
ST Reserved
22
GND
23
NC
Not connected
24
NC
Not connected
25
NC
Not connected
26
NC
Not connected
27
NC
Not connected
28
NC
Not connected
29
XIN
30
XOUT
31
GND_TX
32
VPS_TX
Alternate function
Ground (digital)
DocID018669 Rev 10
7/72
7
CR95HF
3.1
Operating modes
The CR95HF has 2 operating modes: Wait for Event (WFE) and Active. In Active mode, the
CR95HF communicates actively with a tag or an external host (an MCU, for example). WFE
mode includes four low consumption states: Power-up, Hibernate, Sleep and Tag Detector.
The CR95HF can switch from one mode to another.
Table 3. CR95HF operating modes and states
Mode
Wait For
Event
(WFE)
State
Description
Power-up
Hibernate
Sleep
Tag Detector
Ready
In this mode, the RF is OFF and the CR95HF waits for a command
(PROTOCOLSELECT, ...) from the external host via the selected serial
interface (UART or SPI).
Reader
Active
Hibernate, Tag Detector, and Sleep states can only be activated by a command from the
external host. As soon as any of these three states are activated, the CR95HF can no
longer communicate with the external host. It can only be woken up.
The behavior of the CR95HF in 'Tag Detector' state is defined by the Idle command.
8/72
DocID018669 Rev 10
CR95HF
3.2
Startup sequence
After the power supply is established at power-on, the CR95HF waits for a low pulse on the
pin IRQ_IN (t1) before automatically selecting the external interface (SPI or UART) and
entering Ready state after a delay (t3).
Figure 5. Power-up sequence
T
603
33)?
T
33)?
)21?).
T
T
&IRST VALID
COMMAND
T
-36
Note:
When CR95HF leaves WFE mode (from Power-up, Hibernate, Tag Detector, or Sleep)
following an IRQ_IN/RX low level pulse, this pulse is NOT interpreted as the UART start bit
character.
DocID018669 Rev 10
9/72
71
CR95HF
10/72
Serial interface
SSI_0
UART: 0
SPI: 1
SSI_1
UART: 0
SPI: 0
DocID018669 Rev 10
CR95HF
Communication protocols
Communication protocols
4.1
LEN
DATA
DATA
LEN
DATA
DATA
When sending commands, no data must be sent if the LEN field is zero.
When receiving data from the CR95HF, no data will be received if the LEN field is zero.
The formats of send and receive packets are identical.
If an ECHO command is sent, only one byte (0x55) is sent by the host.
Figure 7 shows an example of an ECHO command.
Figure 7. ECHO command and response example
CR95HF
Internal
Clock
Host to CR95HF
RX (Echo 0x55)
0
(Start)
1
(Stop)
TX
CR95HF to Host
RX
TX (Echo 0x55)
0
(Start)
1
(Stop)
Ai18122a
Caution:
UART communication is LSB first. Stop bit duration is two Elementary Time Units
(ETUs).
Note:
When CR95HF leaves WFE mode (from Power-up, Hibernate, Sleep Detector or Tag
Detector) following an |RQ_IN/RX low level pulse, this pulse is NOT interpreted as the UART
start bit character.
If the user loses UART synchronization, it can be recovered by sending an ECHO command
until a valid ECHO reply is received. Otherwise, after a maximum of 528 ECHO commands,
DocID018669 Rev 10
11/72
71
Communication protocols
CR95HF
CR95HF will reply with an error code meaning its input buffer is full. The user can now
restart a UART exchange.
4.2
4.2.1
Polling mode
In order to send commands and receive replies, the application software has to perform 3
steps.
1. Send the command to the CR95HF.
2. Poll the CR95HF until it is ready to transmit the response.
3. Read the response.
The application software should never read data from the CR95HF without being sure that
the CR95HF is ready to send the response.
The maximum allowed SPI communication speed is fSCK.
A Control byte is used to specify a communication type and direction:
00000000
CMD
LEN
DATA
Control Byte
MISO
DATA
00000011
XXXXXX11
Control Byte
MISO
XXXXXXXX 00000XXX
XXXXXX11 XXXXXX11
Flag
Flag
00000XXX
00001XXX
Flags are polled until data is ready (Bit 3 is set when data is ready)
12/72
DocID018669 Rev 10
CR95HF
Communication protocols
Table 5. Interpretation of flags
Bit
[7:4]
[1:0]
Not significant
00000010
Control Byte
MISO
XXXXXXXX
Resp Code
LEN
DATA
DATA
00000001
Control Byte 01
MISO
XXXXXXXX
To reset the CR95HF using the SPI, the application sends the SPI Reset command (Control
Byte 01, see Figure 11) which starts the internal controller reset process and puts the
CR95HF into Power-up state. The CR95HF will wake up when pin IRQ_IN goes low. The
CR95HF reset process only starts when the SPI_SS pin returns to high level.
Caution:
DocID018669 Rev 10
13/72
71
Communication protocols
4.2.2
CR95HF
Interrupt mode
When the CR95HF is configure to use the SPI serial interface, pin IRQ_OUT is used to give
additional information to user. When the CR95HF is ready to send back a reply, it sends an
Interrupt Request by setting a low level on pin IRQ_OUT, which remains low until the host
reads the data.
The application can use the Interrupt mode to skip the polling stage.
Caution:
4.3
Error codes
Table 6. Possible error codes and their meaning
Code
14/72
Name
Meaning
0x80
EFrameRecvOK
0x85
EUserStop
0x86
ECommError
0x87
EFrameWaitTOut
0x88
EInvalidSof
Invalid SOF
0x89
EBufOverflow
0x8A
EFramingError
0x8B
EEgtError
0x8C
EInvalidLen
0x8D
ECrcError
0x8E
ERecvLost
0x8F
ENoField
0x90
EUnintByte
DocID018669 Rev 10
CR95HF
4.4
Communication protocols
Meaning
Always 1
Bit 9 of Length
Bit 8 of Length
If set, there are residual bits in the last byte. Applicable only for Type-A protocol.
3:0
Always 0
Len
Length of data
0x80
0x00
0x80
0x01
0x80
0xFF
255
0xA0
0x00
256
0xA0
0x01
257
0xA0
0xFF
511
0xC0
0x00
512
0xC0
0x01
513
DocID018669 Rev 10
15/72
71
Commands
CR95HF
Commands
5.1
Command format
The frame from the Host to the CR95HF has the following format:
<CMD><Len><Data>
The frame from the CR95HF to Host has the following format:
<RespCode><Len><Data>
These two formats are available either in both UART and SPI modes.
Fields <Cmd>, <RespCode> and <Len> are always 1 byte long. <Data> can be from 0 to
253 bytes.
Note:
5.2
List of commands
Table 9 summarizes the available commands.
Table 9. List of CR95HF commands
Code
Command
0x01
IDN
0x02
PROTOCOLSELECT
0x04
SendRecv
Sends data using the previously selected protocol and receives the
tag response.
0x07
IDLE
0x08
RDREG
0x09
WRREG
0x0A
BaudRate
0x55
Echo
Other codes
16/72
Description
ST Reserved
DocID018669 Rev 10
CR95HF
5.3
Commands
CR95HF to
Host
Data
Comments
0x01
Command code
0x00
Length of data
0x00
Result code
<Len>
Length of data
<Device ID>
<ROM CRC>
Example
>>>0x0100
<<<0x000F4E4643204653324A415354
34002ACE
In this example,
<<<0x4E4643204653324A4153543400
: NFC FS2JAST4, #4 (Last Character of
NFC FS2JAST4 means ROM code
CRC calculated for ROM revision 4.)
content (2 bytes)
0x2ACE: CRC of ROM (real CRC may
differ from this example)
It takes approximately 6 ms to calculate the CRC for the entire ROM. The application must
allow sufficient time for waiting for a response for this command.
5.4
Host to
CR95HF
Data
Comments
0x02
Command code
<Len>
Length of data
<Protocol>
Protocol codes:
00: Field OFF
01: ISO/IEC 15693
02: ISO/IEC 14443-A
03: ISO/IEC 14443-B
04: ISO/IEC 18092 /NFC
Forum Tag Type 3
Example
0x00
Result code
0x00
Length of data
CR95HF to
Host
0x82
Error code
0x00
Length of data
DocID018669 Rev 10
<<<0x0000
Protocol is successfully selected
<<<0x8200
Invalid command length
17/72
71
Commands
CR95HF
Table 11. PROTOCOLSELECT command description (continued)
Direction
CR95HF to
Host
Data
Comments
0x83
Error code
0x00
Length of data
Example
<<<0x8300
Invalid protocol
Code
Examples of commands
Byte
Field OFF
ISO/IEC 15693
0x00 0
0x01 0
Bit
7:0
RFU
7:6
RFU
5:4
18/72
Function
DocID018669 Rev 10
>>>0x02020000
H 100 S: >>>0x02 02 01 01
H 100 D: >>>0x02 02 01 03
H 10 S: >>>0x02 02 01 05
H 10 D: >>>0x02 02 01 07
L 100 S: >>>0x02 02 01 21
L 100 D: >>>0x02 02 01 23
L 10 S: >>>0x02 02 01 25
L 10 D: >>>0x02 02 01 27
In these examples, the CRC is
automatically appended.
CR95HF
Commands
Table 12. List of <Parameters> values for the PROTOCOLSELECT command for different
protocols (continued)
Parameters
Protocol
Code
Examples of commands
Byte
ISO/IEC 14443
Type A
NFC Forum Tag
Type 1
(Topaz)
NFC Forum Tag
Type 2
NFC Forum Tag
Type 4A
Bit
Function
7:6
5:4
RFU
2:0
RFU
7:0
PP
7:0
MM
7:0
DD (optional to PP:MM)
7:0
ST Reserved (Optional)
7:0
ST Reserved (Optional)
0x02
DocID018669 Rev 10
>>>0x02020200: ISO/IEC
14443 Type A tag, 106 Kbps
transmission and reception
rates, Time interval 86/90
Note that REQA, WUPA,
Select20 and Select70
commands use a fixed interval
of 86/90 s between a request
and its reply. Other commands
use a variable interval with
fixed granularity.
Refer to the ISO/IEC 14443
standard for more details.
These 5 bytes are optional. The
default PP:MM:DD value is 0
(corresponds to FDT 86/90s) .
For other values, FDT =
(2^PP)*(MM+1)*(DD+128)
*32/13.56 s
19/72
71
Commands
CR95HF
Table 12. List of <Parameters> values for the PROTOCOLSELECT command for different
protocols (continued)
Parameters
Protocol
Code
Examples of commands
Byte
Bit
7:6
5:4
3:1
RFU
ISO/IEC 14443
Type B
0x03
NFC Forum Tag
Type 4B
20/72
Function
>>>0x02020301:
ISO/IEC 14443 Type B tag with
CRC appended
7:0
PP
7:0
MM
7:0
DD (optional to PP:MM)
5:4
7:0
TTTT (Optional)
7:0
YY (Optional)
7:0
ZZ (Optional)
7:0
ST Reserved (Optional)
7:0
ST Reserved (Optional)
DocID018669 Rev 10
CR95HF
Commands
Table 12. List of <Parameters> values for the PROTOCOLSELECT command for different
protocols (continued)
Parameters
Protocol
Code
Examples of commands
Byte
Bit
7:6
5:4
3:1
RFU
ISO/IEC 18092
NFC Forum Tag
Type 3
7:5
0x04
Function
4
1
3:0
RFU
0: FWT = 2.4 ms
1: FWT is specified by
PP:MM bits
Slot counter
0: 1 slot
1: 2 slots
F: 16 slots
7:0
PP
7:0
MM
7:0
DD (optional to PP:MM)
>>>0x02020451:
ISO/IEC18092 tag, 212 Kbps
transmission and reception
rates with CRC appended.
Parameter Slot counter is not
mandatory. If it is not present, it
is assumed that SlotCounter =
0x00 (1 slot)
For device detection
commands, byte 1 bit 4 must
be set to 0. In this case, the
FWT is 2.4 ms for the 1st slot
and 1.2 ms more for each
following slot, if slot counter is
specified.
If slot counter = 0x10, the
CR95HF does not respect reply
timings, but polls incoming data
and searches a valid response
during ~8.4 ms.
These 3 bytes are optional.
Default value PP:MM:DD: is 0
and corresponds to RWT
~302s.
RWT = (2^PP)*(MM+1)*
(DD+128)*32/13.56s
DocID018669 Rev 10
21/72
71
Commands
5.5
CR95HF
CR95HF to
Host
Data
0x04
Command code
<Len>
Length of data
<Data>
Data to be sent
0x80
Result code
<Len>
Length of data
<Data>
CR95HF to
Host
Comments
Example
See Table 14 and Table 18 for detailed
examples.
<<<0x800F5077FE01B30000000000
71718EBA00
The tag response is decoded. This is an
Data received.
example of an ISO/IEC 14443 ATQB
Interpretation depends on
response (Answer to Request Type B)
protocol
0x90
Result code
<Len>
Length of data
ACK or NAK
ISO 14443-A
ACK or NAK detection
xx yy zz
CR95HF to
Host
22/72
CR95HF to
Host
0x86
Error code
0x00
Length of data
CR95HF to
Host
0x87
Error code
0x00
Length of data
DocID018669 Rev 10
CR95HF
Commands
Table 13. SENDRECV command description (continued)
Direction
Data
Comments
CR95HF to
Host
0x88
Error code
0x00
Length of data
CR95HF to
Host
0x89
Error code
0x00
Length of data
CR95HF to
Host
0x8A
Error code
0x00
Length of data
CR95HF to
Host
0x8B
Error code
0x00
Length of data
CR95HF to
Host
0x8C
Error code
0x00
Length of data
CR95HF to
Host
0x8D
Error code
0x00
Length of data
CR95HF to
Host
0x8E
Error code
0x00
Length of data
Example
<<<0x8800 Invalid SOF
<<<0x8900 Receive buffer overflow
(too many bytes received)
<<<0x8A00 Framing error (start bit = 0,
stop bit = 1)
<<<0x8B00 EGT time out (for ISO/IEC
14443-B)
<<<0x8C00 Invalid length. Used in NFC
Forum Tag Type 3, when field Length <
3
<<<0x8D00 CRC error (Used in NFC
Forum Tag Type 3 protocol)
<<<0x8E00 Reception lost without EOF
received
Table 14 gives examples of communication between the CR95HF and a contactless tag.
The CR95HF receives a SendRecv command (>>> 0x04...) from the host and returns its
response to the host (<<< 0x80...). Table 14 provides more details on the CR95HF
response format.
Table 14. List of <Data> Send values for the SENDRECV command for different
protocols
Protocol
Explanation
Send example
Command example
04
03
022000
Command code
Length of entire data field
ISO/IEC
15693
Data
DocID018669 Rev 10
Comments
Example of an Inventory command
using different protocol configuration:
Uplink: 100% ASK, 1/4 coding
Downlink: High data rate, Single subcarrier
>>> 0x0403260100 (Inventory - 1 slot)
<<< 0x800D0000CDE0406CD62902
E0057900
If length of data is 0, only the EOF will
be sent. This can be used for an anticollision procedure.
23/72
71
Commands
CR95HF
Table 14. List of <Data> Send values for the SENDRECV command for different
protocols (continued)
Protocol
Explanation
Send example
Command example
04
07
9370800
28
F8C8E
Command code
Length of entire data field
Data
Comments
Example of an NFC Forum Type 2
request sequence:
>>>0x04022607 (REQA)
<<<0x800544002800 (ATQA)
>>>0x0403932008 (Anti-collision CL1)
<<<0x80088804A8D5F1280000 (UID
CL1)...
Example of an NFC Forum Type 1
(Topaz) request sequence:
>>>0x04022607 (REQA)
<<<0x8005000C280000 (ATQ0 ATQ1)
>>>0x040878000000000000A8 (RID)
<<<0x800B11486E567A003E450800
00 (Header0 Header1 UID0 UID 1 UID2
UID3 CRC0 CRC1Signifcant bits
indexColbyte IndexColbit)
ISO/IEC
14443
Type A
NFC
Forum Tag
Type 4A
Transmission flags:
7: Topaz send format. Use EOF instead of
NFC
Forum Tag parity bit and use SOF at beginning of each
byte. Pause between bytes and assume 1st
Type 1
byte is 7 bits.
(Topaz)
6: SplitFrame
5: Append CRC
NFC
(2)
Forum Tag 4: Parity Framing mode
Type 2
[3:0]: Number of significant bits in last byte
ISO/IEC
14443
Type B
Send example
04
03
050000
Command code
24/72
DocID018669 Rev 10
CR95HF
Commands
Table 14. List of <Data> Send values for the SENDRECV command for different
protocols (continued)
Protocol
ISO/IEC
18092
Explanation
Send example
Command example
04
05
00FFFF0000
Command code
Comments
Example of an ISO/IEC 18092 / NFC
Forum Type 3 request sequence:
>>>0x040500FFFF0000 (REQC)
<<<0x801201010102148E0DB41310
0B4B428485D0FF00 (ATQC)
1. For more information on using split frames, refer to Appendix D on page 54.
2. If Parity Framing mode is used (Bit 4 of transmission flag byte is set to 1), then the parity bit must be
coded inside the data for each byte to be sent using the send/receive command in Transmit mode, and is
not decoded by the CR95HF in Receive mode. In Receive mode, each data byte is accompanied by an
additional byte which encodes the parity: <data byte> <parity byte> <data byte > ...
Examples of data received by send / receive in Parity Framing mode:
80 05 32 80 34 00 00
meaning: if the CR95HF received 2 data bytes:
0x32 with parity = 1 (0x80) and 0x34 with parity = 0 (0x0) in Parity Framing mode. For more details,
see NFC Forum Tag Type 2 on page 60.
The Parity Framing mode is compatible with MIFARE Classic requirements. However, access to
Authenticated state must be supported by the external secure host which embeds the MIFARE Classic
library.
Figure 13. Data transfer (in both command and response) when Parity Framing mode
is enabled
Bytes
sent or
received
XXXXXXXX
P0000000
Data Byte
Parity Byte
2nd CRC
P0000000
Parity Byte
Table 15. List of <Data> Response values for the SENDRECV command for different
protocols
Protocol
Explanation
Response
example
Response example
80 08
0000000000
77CF
Result code
ISO/IEC
15693
DocID018669 Rev 10
Comments
00
This is a response to Read
Single Block command for
ISO/IEC 15693 TAG. Actual
TAG response is
<<<0x000000000077CF,
other fields are added by the
CR95HF.
25/72
71
Commands
CR95HF
Table 15. List of <Data> Response values for the SENDRECV command for different
protocols (continued)
Protocol
ISO/IEC
14443
Type A
Explanation
Response
example
Response example
80
or
09
90
80B30B8DB500
(1)
Result code
NFC
Forum
Length of entire data
Tag Type field
4A
Data received from TAG
NFC
Forum
Tag Type
1
(Topaz)
Comments
7: Collision is detected
6: RFU
5: CRC error
4: Parity error
[3:0]: Shows how many significant bits are there
in the first byte
NFC
7:0: Index of the first byte where collision is detected
Forum
Tag Type [7:4]: RFU
2
[3:0]: Index of the first bit where collision is detected
Response
example
ISO/IEC
14443
Type B
5092036A8D0
80 0F 00000000071
71
3411
Result code
Length of entire data
field
NFC
Data received from tag
Forum
Tag Type Original (received) value of CRC
4B
[7:2]: RFU
1: CRC error if set
0: RFU
Response
example
ISO/IEC
18092
80 12
01010105017B0...93FF
00
Result code
Length of entire data
field
NFC
Forum
Data received from tag
Tag Type
[7:2]: RFU
3
1: CRC error if set
0: RFU
1. Result code 90: Response is decoded but number of byte is not an integer.
2. For more information on using split frames, refer to Appendix D on page 54.
26/72
DocID018669 Rev 10
<<<0x801201010105017B
06941004014B024F4993F
F00
CR95HF
Commands
For more detailed examples of use with NFC Forum and ISO/IEC 15693 tags, refer to
Appendix D on page 54.
If Parity Framing mode is used, the parity bit stays unchanged. On transmission, it is not
encoded and on reception it is not decoded. The length of Data must be even. Each data
byte is accompanied by an additional byte which encodes the parity:
<DataByte>, <Parity>, <DataByte>, <Parity>
Table 16. Structure of Parity byte
Bit
7
[6:0]
Description
Parity bit
Reserved for future use
On reception, bits [6:0] of the parity byte are zeroes; on transmission, bits [6:0] are ignored.
5.6
DocID018669 Rev 10
27/72
71
Commands
CR95HF
Table 17. IDLE command description
Direction
Data
07
Command code
0E
Length of data
<WU Source>
EnterCtrlL
EnterCtrlH
WUCtrlL
WUCtrlH
LeaveCtrlL
LeaveCtrlH
<WUPeriod>
<OscStart>
Host to
CR95HF
<DacStart>
<DacDataL>
28/72
Comments
Example
<DacDataH>
<SwingsCnt>
Number of swings HF
during tag detection
(Default value = 0x3F)
<MaxSleep>
DocID018669 Rev 10
CR95HF
Commands
Table 17. IDLE command description (continued)
Direction
Data
Example
0x00
Result code
0x01
Length of data
<Data>
CR95HF to
Host
CR95HF to
Host
Comments
0x82
Error code
0x00
Length of data
1. An initial calibration is necessary to determine DacDataL and DacDataH values required for leaving Tag
Detector state. For more information, contact your ST sales office for the corresponding application note.
5.6.1
07
0E
xx
yy zz
yy zz
yy zz
aa
bb
cc
dd ee
ff
gg
Comma
nd code
Data
length
WU
source
Enter
Control
WU
Control
Leave
Control
WU
Period
Osc
Start
DAC
Start
DAC
Data
Swing
Count
Max
Sleep
Description
Command code
This byte is the command code. 07 represents the Idle command. This
command switches the device from Active mode to WFE mode.
Data length
This byte is the length of the command in bytes. Its value depends on the
following parameter values.
WU Source
This byte defines the authorized wake-up sources in the Wake-up source
register. Predefined values are:
0x01: Time out
0x02: Tag Detection
0x08: Low pulse on IRQ_IN
0x10: Low pulse on SPI_SS
Enter Control
These two bytes (EnterCtrlL and EnterCtrlH) define the resources when
entering WFE mode.
0x0400: Hibernate
0x0100: Sleep (or 0x2100 if Timer source is enabled)
0xA200: Tag Detector Calibration
0x2100: Tag Detection
WU Control
These two bytes (WuCtrlL and WuCtrlH) define the wake-up resources.
0x0400: Hibernate
0x3800: Sleep
0xF801: Tag Detector Calibration
0x7901: Tag Detection
DocID018669 Rev 10
29/72
71
Commands
CR95HF
Table 19. Summary of Idle command parameters (continued)
Parameter
5.6.2
Description
Leave Control
These two bytes (LeaveCtrlL and LeaveCtrlH) define the resources when
returning to Ready state.
0x1800: Hibernate
0x1800: Sleep
0x1800: Tag Detector Calibration
0x1800: Tag Detection
WU Period
This byte is the coefficient used to adjust the time allowed between two tag
detections. Also used to specify the duration before Timeout. (Typical
value: 0x20)
Duration before Timeout = 256 * tL * (WU period + 2) * (MaxSleep + 1)
Osc Start
This byte defines the delay for HFO stabilization. (Recommended value:
0x60)
Defines the Wait time for HFO to stabilize: <OscStart> * tL
DAC Start
This byte defines the delay for DAC stabilization. (Recommended value:
0x60)
Defines the Wait time for DAC to stabilize: <DacStart> * tL
DAC Data
These two bytes (DacDataL and DacDataH) define the lower and higher
comparator values, respectively. These values are determined by a
calibration process.
When using the demo board, these values should be set to approximately
0x64 and 0x74, respectively.
Swing Count
This byte defines the number of HF swings allowed during Tag Detection.
(Recommended value: 0x3F)
Max Sleep
This byte defines the maximum number of tag detection trials or the
coefficient to adjust the maximum inactivity duration before Timeout.
MaxSleep must be: 0x00 < MaxSleep < 0x1F
This value must be set to 0x01 during tag detection calibration.
Also used to specify duration before Timeout.
Duration before Timeout = 256 * tL * (WU period + 2) * (MaxSleep + 1)
(Typical value: 0x28)
30/72
DocID018669 Rev 10
CR95HF
5.6.3
Commands
5.6.4
The Wake-up flag value is NOT significant when returning to Ready state from Hibernate
state or after a POR.
DocID018669 Rev 10
31/72
71
Commands
CR95HF
The Duration before Timeout is defined by parameters WU period and MaxSleep,
respectively 0x60 and 0x08 in the following example.
Duration before Timeout = 256 * tL * (WU period + 2) * (MaxSleep + 1)
Note:
The Timeout bit (bit 0) must be set to 1 in order to manage a certain number of
emitted bursts. Otherwise, bursts will be sent indefinitely until a stop event occurs
(for example, tag detection or a low pulse on pin IRQ_IN).
The Tag Detect bit (bit 1) must be set to 1 to enable RF burst emissions.
WU period (Byte 10): Defines the period of inactivity (tINACTIVE) between two RF bursts:
tINACTIVE = (WuPeriod + 2) * tREF
OscStart, DacStart (Bytes 11 and 12): Define the set-up time of the HFO and Digital
Analog Converter, respectively. In general, 3 ms is used both set-up times.
HFO | DAC set-up time = (OscStart | DacStart) * tL
DacDataL, DacDataH (Bytes 13 and 14): Reference level for Tag Detection (calculated
during the tag detection calibration process).
SwingsCnt (Byte 15): Represents the number of 13.56-MHz swing allowed during a
Tag Detection burst. We recommend using 0x3F.
32/72
DocID018669 Rev 10
CR95HF
Commands
Note:
Maxsleep (Byte 16): The CR95HF emits (MaxSleep +1) bursts before leaving Tag
Detection mode if bit 0 (Timer Out) of the WU source register is set to 1. Otherwise,
when this bit is set to 0, a burst is emitted indefinitely.
Bytes 4 to 9 should be used as shown in the examples in Section 5.6: Idle command (0x07)
description.
Note that the MaxSleep value is coded on the 5 least significant bits, thus:
0x00 < MaxSleep < 0x1F.
All the previously described command parameters must be chosen accordingly for the initial
tag detection calibration when setting up the CR95HF.
Their value will impact tag detection efficiency, and CR95HF power consumption during Tag
Detection periods.
5.6.5
DocID018669 Rev 10
33/72
71
Commands
CR95HF
An efficient 8-step calibration algorithm is described in Example of tag detection calibration
process on page 50.
An example of a basic Idle command used during the Tag Detection Calibration process:
>>>0x07 0E 03 A1 00 F8 01 18 00 20 60 60 00 xx 3F 01
where xx is the DacDataH value.
An example of a tag detection sequence is provided in Example of tag detection command
using results of tag detection calibration on page 53.
5.7
Host to
CR95HF
Data
Comments
0x08
Command code
0x03
Length of data
0x62 or 0x69
Register size
0x00
ST Reserved
0x00
Result code
<Len>
Length of data (=
RegCount)
CR95HF to
Host
CR95HF to
Host
Ex 1. >>>0x0803690100
Reads the ARC_B register. (1)
Register address
0x01
<RegData>
Example
Register data
0x82
Error code
0x00
Length of data
Ex 2. >>>0x0803620100
Reads the Wake-up event register.
<<<0x000101 Wake-up by Timeout (Ex. 1)
<<<0x000102 Wake-up by Tag Detect (Ex.
1)
<<<0x000113 Depth = 1, Gain = 3 (Ex. 2)
<<< 0x000113 (ARC_B register)
Depth = 1, Gain = 3 (Ex. 2). See Write
Register description for more information on
received data.
<<<0x8200 Invalid command length
1. This command must be preceded by the setting of the ARC_B register index (0x0903680004).
Note:
34/72
DocID018669 Rev 10
CR95HF
5.8
Commands
set the Analog Register Configuration address index value before reading or
overwriting the Analog Register Configuration register (ARC_B) value
set the Timer Window (TimerW) value used to improve CR95HF demodulation when
communicating with ISO/IEC 14443 Type A tags
set the AutoDetect Filter used to help synchronization of CR95HF with ISO/IEC 18092
tags
configure the HF2RF bit(a) to manage ICC RF (VPS_TX) consumption in Ready state
5.8.1
Improving RF performance
Adjusting the Modulation Index and Receiver Gain parameters helps improve application
behavior.
The default value of these parameters (Table 24) is set by the PROTOCOLSELECT command,
but they can be overwritten using the Write Register (WRREG) command (0x09). Table 22
and Table 23 list possible values for the Modulation Index and Receiver Gain parameters
respectively.
This new configuration is valid until a new PROTOCOLSELECT or Write Register (of register
ARC_B) command is executed. Register values are cleared at power off.
Table 21. WRREG command description (Modulation Index and Receiver Gain)
Direction
Data
0x09
Comments
Example
Command code
0x03 or
Length of data
0x04
0x68
Host to
CR95HF
>>>0x090468010113
Update ARC_B value to 0x13
CR95HF to
Host
>>>0x0903680001
Set Analog Register Index to
Index pointing to the Modulation Index and
0x01 (ARC_B) (1)
Receiver Gain values in the ARC_B
register (0x01) (See Section 5.8.1)
0xXX
0x00
Result code
0x00
<<<0x0000
Register written
1. This command must be executed before reading the ARC_B register (0x0803690100).
The default value of these parameters (Table 24) is set by the PROTOCOLSELECT command,
but they can be overwritten using the Write Register (WRREG) command (0x09).
a. When the HF2RF bit is 0, Reader mode is possible (default mode). When set to 1, VPS_TX power
consumption is reduced (Ready mode).
DocID018669 Rev 10
35/72
71
Commands
CR95HF
This new configuration is valid until a new PROTOCOLSELECT or Write Register (of register )
command is executed. Register values are cleared at power off.
2.
3.
4.
10%
17%
25%
30%
33%
36%
95%
34 dB
32 dB
27 dB
20 dB
8 dB
36/72
DocID018669 Rev 10
CR95HF
Commands
Recommended
values for CR95HF
demo board
Possible
Modulation Index
values (MS nibble)
Possible Receiver
Gain values
(LS nibble)
ISO/IEC 14443
Type A reader
0xDF
0xD1 or 0xD3
0xD
ISO/IEC 14443
Type B reader
0x2F
0x20
ISO/IEC 18092
reader
0x5F
0x20
ISO/IEC 15693
reader 30%
0x53
0x50
ISO/IEC 15693
reader 100%
0xD3
0xD0
0xD
Communication
protocol
5.8.2
Data
0x09
Comments
Example
Command code
0x03 or
Length of data
0x04
Host to
CR95HF
CR95HF to
Host
5.8.3
0x3A
0x04
0x00
Result code
0x00
>>>0x09043A005804
Set recommended TimerW
value.
<<<0x0000
Register written
37/72
71
Commands
CR95HF
By default, this filter is disabled after the execution of the PROTOCOLSELECT command, but it
can be enabled using the WRREG command (0x09).
5.9
Data
Comments
0x0A
Command code
0x01
Length of data
<BaudRate>
0x55
Host to
CR95HF
CR95HF to
Host
Example
<<<0x55
New baud rate is used
to reply
Caution:
If the BaudRate command is not correctly executed, the baud rate value will remain
unchanged.
5.10
38/72
Data
Comments
Host to CR95HF
0x55
Command code
CR95HF to Host
0x55
Code response
DocID018669 Rev 10
Example
CR95HF
Electrical characteristics
Electrical characteristics
6.1
Parameter
Supply voltage
(1)
Value
Unit
0.3 to 7.0
0.3 to 7.0
14.0
25 to +85
25 to +85
TSTG
65 to +150
TLEAD
See note(2)
VESD
2000
TA
PTOT (3)
1. To properly reset the device, VPS_Main must be tied to 0V before executing the start-up sequence.
2. Compliant with JEDEC standard J-STD-020D (for small-body, Sn-Pb or Pb assembly), the ST ECOPACK
7191395 specification, and the European directive on Restrictions on Hazardous Substances (RoHS
directive 2011/65/EU of July 2011).
3. Depending on the thermal resistance of package.
Note:
Stresses listed above may cause permanent damage to the device. This is a stress rating
only and functional operation of the device at these or any other conditions above those
indicated in the operational sections of the specification is not implied.
Exposure to absolute maximum rating conditions for extended periods may affect device
reliability.
DocID018669 Rev 10
39/72
71
Electrical characteristics
6.2
CR95HF
DC characteristics
Table 29. DC characteristics
Symbol
Parameter
VPS_Main
VPS_TX
Min.
Typ.
Max.
Unit
Supply voltage
2.7
3.0
5.5
2.7
3.0
5.5
0.2 x VPS_Main
0.7 x VPS_Main
VPS_Main
0.7 x VPS_Main
VPS_Main
0.15 x
VPS_Main
VIL
Condition
VIH
VOH
IOH = - 8 A
VOL
IOLMAX = 500 A
POR
6.3
1.8
Parameter
Condition
Typ.
Max.
Unit
ICC (VPS)
Power-up
TA = 25C
200
600
ICC (VPS)
Hibernate
TA = 25C
TA = 25C
20
80
TA = 25C
2.5
5.0
mA
TA = 25C,
4 RF bursts
per second
50
100
The CR95HF supports two VPS_TX supply ranges for RF drivers: 2.7V to 3.3V or 4.5V to
5.5V. Antenna matching circuit must be defined accordingly.
Table 31. Power consumption characteristics (VPS_TX from 2.7 to 3.3 V)
Symbol
Parameter
Condition
Typ.
Max.
Unit
ICC RF (VPS_TX)
Supply current in RF Field (Reader mode) (1)
RF Field ON
TA = 25C
70
100
mA
ICC RF (VPS_TX)
Supply current in RF Field (Ready mode) (2)
RF Field OFF
TA = 25C
200
ICC RF (VPS_TX)
Peak(3) current during Burst detection
Tag Detect
TA = 25C
100
mA
70
1. Parameter measured using recommended output matching network. (Z load is 27 and 0).
2. This consumption can be reduced to approximately 2 A (typ.) by setting a control bit (bit HF2RF) to 1 using command
090468010710. In this case, Reader mode is not available.
To re-enable Reader mode, reset the HF2RF bit to 0 using the command 090468010700 or execute a new
PROTOCOLSELECT command.
3. The maximum differential input voltage between pins RX1 and RX2 (VRx1-Rx2) has a peak-peak of 18 V.
40/72
DocID018669 Rev 10
CR95HF
Electrical characteristics
Table 32. Power consumption characteristics (VPS_TX from 4.5 to 5.5 V)
Symbol
Parameter
Condition
Typ.
Max.
Unit
ICC RF (VPS_TX)
Supply current in RF Field (Reader mode) (1)
RF Field ON
TA = 25C
120
200
mA
ICC RF (VPS_TX)
Supply current in RF Field (Ready mode) (2)
RF Field OFF
TA = 25C
300
ICC RF (VPS_TX)
Peak(3) current during Burst detection
Tag Detect
TA = 25C
200
mA
120
1. Parameter measured using recommended output matching network. (Z load is 16 and 0).
2. This consumption can be reduced to approximately 2 A (typ.) by setting a control bit (bit HF2RF) to 1 using command
090468010710. In this case, Reader mode is not available.
To re-enable Reader mode, reset the HF2RF bit to 0 using the command 090468010700 or execute a new
PROTOCOLSELECT command.
3. The maximum differential input voltage between pins RX1 and RX2 (VRx1-Rx2) has a peak-peak of 18 V. This voltage can
be limited by adding a damping resistor in parallel of the antenna or between ST_R0 and Ground.
DocID018669 Rev 10
41/72
71
Electrical characteristics
6.4
CR95HF
SPI characteristics
The CR95HF supports (CPOL = 0, CPHA = 0) and (CPOL = 1, CPHA = 1) modes.
Table 33. SPI interface characteristics
Symbol
fSCK
1/ tc(SCK)
Parameter
Condition
Min.
VIL
VIH
VOL
VOH
0.7 x VPS
70
ns
200
200
tSU(SI)(1)
20
th(SI)(1)
80
tv(SO)(1)
th(SO)(1)
Cb_SPI_OUT
MHz
0.4 x VPS
Cb_SPI_IN
2.0
0.7 x VPS
th(NSS)(1)
tCH(SCKH)
Unit
0.3 x VPS
tSU(NSS)(1)
(1)
Max.
ns
ns
80
After enable
edge
ns
150
pF
20
pF
1. Values based on design simulation and/or characterization results, and not on tested in production.
Figure 14. SPI timing diagram (Slave mode and CPOL = 0, CPHA = 0)
3#+ )NPUT
.33 INPUT
T35.33
TC3#+
#0/,
#0(!
T#(3#+(
T63/
-)3/
TH.33
T#(3#+,
TH3/
-3"