m24sr02 Y-1696501

M24SR02-Y
Dynamic NFC/RFID tag IC with 2-Kbit EEPROM,

NFC Forum Type 4 Tag and I²C interface
Datasheet - production data
Package
• 8-lead small-outline package (SO8)
ECOPACK2
• TSSOP8 ECOPACK2
SO8 TSSOP8 UFDFPN8
• UFDFPN8 ECOPACK2
Digital pad
• GPO: configurable general purpose output
• RF disable: activation/deactivation of RF
Wafer commands
Temperature range
Features • From - 40 °C up to 85 °C
I2C interface
Description
• Two-wire I2C serial interface supports
1 MHz protocol M24SR02-Y belongs to the ST25 family, which
includes all STMicroelectronics NFC/RFID tag
• Single supply voltage: 2.7 V to 5.5 V
and reader products.
Contactless interface The M24SR02-Y device is a dynamic NFC/RFID
• NFC Forum Type 4 Tag tag IC with a dual interface embedding an
EEPROM. It can be operated from an I2C
• ISO/IEC 14443 Type A interface or by a 13.56 MHz RFID reader or from
• 106 Kbps data rate an NFC phone.
• Internal tuning capacitance: 25 pF The I2C interface uses a two-wire serial interface,
consisting of a bidirectional data line and a clock
Memory
line. It behaves as a slave in the I2C protocol.
• 256-byte (2-kbit) EEPROM
The RF protocol is compatible with ISO/IEC
• Support of NDEF data structure 14443 Type A and NFC Forum Type 4 Tag.
• Data retention: 200 years
• Write endurance:
– 1 million cycles at 25 °C
– 600 k cycles at 85 °C
• Read: up to 246 bytes in a single command
• Write: up to 246 bytes in a single command
• 7-byte unique identifier (UID)
• 128-bit passwords protection
April 2019 DS9985 Rev 12 1/88

This is information on a product in full production. www.st.com
Contents M24SR02-Y
Contents
1 Functional description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.1 Functional modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.1.1 I2C mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.1.2 Tag mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.1.3 Dual interface mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2 Description of signals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.1 Serial clock (SCL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.2 Serial data (SDA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.3 Antenna coil (AC0, AC1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.4 Ground (VSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.5 Supply voltage (VCC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.5.1 Operating supply voltage VCC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.5.2 Power-up conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.5.3 Device reset in I²C mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.5.4 Power-down conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.6 RF disable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.7 General purpose output (GPO) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
2.7.1 Session Open configuration (GPO field = 0xX1 or 0x1X) . . . . . . . . . . . 14
2.7.2 WIP Writing in Progress configuration (GPO field = 0xX2 or 0x2X) . . . 15
2.7.3 I2C answer ready configuration (GPO field = 0xX3) . . . . . . . . . . . . . . . 16
2.7.4 MIP NDEF Message writing in Progress configuration
(GPO field = 0x3X) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.7.5 INT interrupt configuration (GPO field = 0xX4 or 0x4X) . . . . . . . . . . . . . 18
2.7.6 State control configuration (GPO field = 0xX5 or 0x5X) . . . . . . . . . . . . . 19
2.7.7 RF busy configuration (GPO field = 0x6X) . . . . . . . . . . . . . . . . . . . . . . . 20
3 M24SR02-Y memory management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.1 Memory structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.1.1 File identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.1.2 CC file layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.1.3 NDEF file layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.1.4 System file layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.2 Read and write access rights to the memory . . . . . . . . . . . . . . . . . . . . . . 25
2/88 DS9985 Rev 12

M24SR02-Y Contents
3.2.1 State of the Read and Write access rights . . . . . . . . . . . . . . . . . . . . . . . 26

3.2.2 Changing the read access right to NDEF files . . . . . . . . . . . . . . . . . . . . 27
3.2.3 Changing the write access right to NDEF files . . . . . . . . . . . . . . . . . . . 28
3.3 Access right life time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.4 NDEF file passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.5 I2C password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.5.1 I²C password and I²C protect field of the System file . . . . . . . . . . . . . . . 29
4 Communication mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.1 Master and slave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.2 M24SR02-Y session mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.2.1 RF token . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.2.2 I2C token . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5 I²C and RF command sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

5.1 Structure of the command sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.2 I-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
5.2.1 C-APDU: payload format of a command . . . . . . . . . . . . . . . . . . . . . . . . 33
5.2.2 R-APDU: payload format of a response . . . . . . . . . . . . . . . . . . . . . . . . 33
5.3 R-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
5.4 S-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5.5 CRC of the I2C and RF frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
5.6 NFC Forum Type 4 Tag protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
5.6.1 Command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
5.6.2 Status and error codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
5.6.3 NDEF Tag Application Select command . . . . . . . . . . . . . . . . . . . . . . . . 38
5.6.4 Capability Container Select command . . . . . . . . . . . . . . . . . . . . . . . . . . 38
5.6.5 NDEF Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.6.6 System File Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
5.6.7 ReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
5.6.8 UpdateBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
5.7 ISO/IEC 7816-4 commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
5.7.1 Verify command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
5.7.2 Change Reference Data command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
5.7.3 Enable Verification Requirement command . . . . . . . . . . . . . . . . . . . . . . 45
5.7.4 Disable Verification Requirement command . . . . . . . . . . . . . . . . . . . . . 46
DS9985 Rev 12 3/88

5
Contents M24SR02-Y
5.8 ST proprietary command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

5.8.1 ExtendedReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
5.8.2 EnablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
5.8.3 DisablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
5.8.4 UpdateFileType command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
5.8.5 SendInterrupt command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
5.8.6 StateControl command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
5.9 Specific RF command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.9.1 Anticollision command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.9.2 RATS command and ATS response . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.9.3 PPS command and response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
5.10 Specific I²C command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
5.10.1 GetI2Csession command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
5.10.2 KillRFsession command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
6 RF device operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
6.1 Anticollision and Device activation command set for the RF interface . . . 56
6.2 Open an RF session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
6.3 Close an RF session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
6.4 Applicative command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
7 I2C device operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

7.1 I2C communication protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
7.2 Start condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
7.3 Stop condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
7.4 I²C token release sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
7.5 I²C timeout on clock period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
7.6 Acknowledge bit (ACK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
7.7 Data input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
7.8 I²C device address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
7.9 I²C frame format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
7.9.1 Example of I²C frame commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
7.10 Open an I²C session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
7.11 Close the I²C session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
4/88 DS9985 Rev 12

M24SR02-Y Contents
8 Functional procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
8.1 Selection of an NDEF message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
8.2 Reading of an NDEF message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
8.3 Reading a locked NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
8.4 Locking an NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
8.5 Unlocking an NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
8.6 Reaching the read-only state for an NDEF file . . . . . . . . . . . . . . . . . . . . . 64
8.7 Changing an NDEF password procedure . . . . . . . . . . . . . . . . . . . . . . . . . 64
8.8 Changing a File type Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
8.9 Updating an NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
9 UID: unique identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
10 Maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
11 I2C DC and AC parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

11.1 I2C timing measurement condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
12 GPO parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
13 Write cycle definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
14 RF electrical parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
15 Package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
15.1 SO8N package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
15.2 TSSOP8 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
15.3 UFDFPN8 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
16 Ordering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
17 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
DS9985 Rev 12 5/88

5
List of tables M24SR02-Y
List of tables
Table 1. Signal names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Table 2. Functional modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Table 3. File identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Table 4. CC file layout for 1 NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 5. NDEF file layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Table 6. Field list. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Table 7. Details about I2C watchdog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Table 8. Details about the GPO field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Table 9. Details about the RF session field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Table 10. Details about the ST reserved field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Table 11. Details about the RF enable field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Table 12. Read access right . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Table 13. Write access right . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Table 14. RF and I²C command sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Table 15. I-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Table 16. PCB field of the I-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Table 17. C-APDU format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Table 18. R-APDU format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Table 19. R-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Table 20. R-Block detailed format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Table 21. S-Block format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Table 22. S-Block detailed format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 23. Command set overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 24. Status code of the M24SR02-Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 25. Error codes of the M24SR02-Y. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 26. C-APDU of the NDEF Tag Application Select command . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Table 27. R-APDU of the NDEF Tag Application Select command . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Table 28. C-APDU of the Capability Container Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Table 29. R-APDU of the Capability Container Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Table 30. C-APDU of the NDEF Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Table 31. R-APDU of the NDEF Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Table 32. C-APDU of the System File Select command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Table 33. R-APDU of the System File Select command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Table 34. C-APDU of the ReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Table 35. R-APDU of the ReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Table 36. C-APDU of the UpdateBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Table 37. R-APDU of the UpdateBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Table 38. Verify command format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Table 39. R-APDU of the Verify command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Table 40. Change reference data command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Table 41. R-APDU of the Change Reference Data command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Table 42. Enable Verification Requirement command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Table 43. R-APDU of the Enable Verification Requirement command. . . . . . . . . . . . . . . . . . . . . . . . 46
Table 44. Disable Verification Requirement command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Table 45. R-APDU of the Disable Verification Requirement command . . . . . . . . . . . . . . . . . . . . . . . 47
Table 46. C-APDU of the ExtendedReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Table 47. R-APDU of the ExtendedReadBinary command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Table 48. EnablePermanentState command format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
6/88 DS9985 Rev 12

M24SR02-Y List of tables
Table 49. R-APDU table of the EnablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Table 50. DisablePermanentState command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Table 51. R-APDU of the DisablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Table 52. UpdateFileType command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Table 53. R-APDU of the UpdateFileType command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Table 54. SendInterrupt command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Table 55. R-APDU of the SendInterrupt command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Table 56. StateControl command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 57. R-APDU of the StateControl command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 58. Commands issues by the RF host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 59. RATS command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Table 60. Conversion from FDSI to FSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Table 61. ATS response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Table 62. PPS command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Table 63. Ascending and descending data rate coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Table 64. PPS response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Table 65. Specific I²C commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Table 66. GetI2Csession command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Table 67. KillRFsession command format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Table 68. I2C device address format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Table 69. I2C frame format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Table 70. I2C host to M24SR02-Y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Table 71. M24SR02-Y to I2C host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Table 72. UID format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Table 73. Absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Table 74. I2C operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Table 75. AC test measurement conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Table 76. Input parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Table 77. I2C DC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Table 78. I2C AC characteristics (400 kHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Table 79. I2C AC characteristics (1 MHz) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Table 80. Device select code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Table 81. GPO timings measurement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Table 82. Write cycle definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Table 83. Default operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Table 84. RF characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Table 85. SO8N - 8-lead plastic small outline, 150 mils body width,
package data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Table 86. TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,
package mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Table 87. UFDFPN8 - 8- lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch
dual flat package mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Table 88. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
DS9985 Rev 12 7/88

7
List of figures M24SR02-Y
List of figures
Figure 1. M24SR02-Y block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Figure 2. 8-pin package connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Figure 3. GPO configured as Session Open (GPO field = 0xX1 or 0x1X) . . . . . . . . . . . . . . . . . . . . . 14
Figure 4. GPO configured as WIP (GPO field = 0xX2 or 0x2X). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Figure 5. GPO configured as I2C answer ready (GPO field = 0xX3) . . . . . . . . . . . . . . . . . . . . . . . . . 16
Figure 6. GPO configured as MIP (GPO field = 0x3X). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Figure 7. GPO configured as INT (GPO field = 0xX4 or 0x4X) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Figure 8. GPO configured as State control (GPO field = 0xX5 or 0x5X) . . . . . . . . . . . . . . . . . . . . . . 19
Figure 9. GPO configured as RF busy (GPO field = 0x6X) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Figure 10. Changing the read access right to an NDEF file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Figure 11. Changing the write access right to an NDEF file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Figure 12. Command and response exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Figure 13. I²C token release sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Figure 14. NDEF tag Application Select command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Figure 15. AC test measurement I/O waveform. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Figure 16. I2C AC waveforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Figure 17. Maximum Rbus value with fC = 400 kHz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Figure 18. Maximum Rbus value with fC = 1 MHz. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Figure 19. I2C bus protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Figure 20. SO8N - 8-lead plastic small outline, 150 mils body width, package outline . . . . . . . . . . . . 79
Figure 21. SO8N - 8-lead plastic small outline, 150 mils body width,
package recommended footprint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Figure 22. TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,
package outline. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Figure 23. UFDFPN8 - 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch
dual flat package outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
8/88 DS9985 Rev 12

M24SR02-Y Functional description
1 Functional description
The M24SR02-Y device is a dynamic NFC/RFID tag that can be accessed either from the
I2C or the RF interface. The RF and I2C host can read or write to the same memory, as only
one host can communicate at a given time with the M24SR02-Y. The management of the
interface selection is controlled by the M24SR02-Y device itself.
The RF interface is based on the ISO/IEC 14443 Type A standard. The M24SR02-Y is
compatible with the NFC Forum Type 4 Tag specifications and supports all corresponding
commands.
The I2C interface uses a two-wire serial interface consisting of a bidirectional data line and a
clock line. The devices carry a built-in 4-bit device type identifier code in accordance with
the I²C bus definition.
The device behaves as a slave in the I2C protocol.
Figure 1 displays the block diagram of the M24SR02-Y device.
Figure 1. M24SR02-Y block diagram
6XSSO\YROWDJH 9&&
IRU,&LQWHUIDFH
h/ΘƐǇƐƚĞŵ
3RZHU ĂƌĞĂ
$QDORJ)URQWHQG PDQDJHPHQW
EDVHGRQ XQLW
5)LQWHUIDFH
,62,(&
EDVHGRQ $& 7\SH$VWDQGDUG
,62,(&
7\SH$ ,QWHUQDOWXQLQJ
$&
VWDQGDUG FDSDFLWDQFH
5) 1)&)RUXP
GLVDEOH 7\SH7DJ
SURWRFRO hƐĞƌŵĞŵŽƌǇ
*32 'LJLWDOXQLW
6&/
,&LQWHUIDFH 1)&B,&
9±9 LQWHUIDFH
6'$
*1'
069
DS9985 Rev 12 9/88

20
Functional description M24SR02-Y
Table 1. Signal names

Signal name Function Direction
SDA Serial data I/O

SCL Serial clock Input
AC0, AC1 Antenna coils -
VCC Supply voltage -
VSS Ground -
(1)
GPO Interrupt output Open drain output
RF disable Disables the RF communication (2)
Input
1. An external pull-up > 4.7 kΩ is required.
2. An external pull-down is required when the voltage on Vcc is above its POR level.
Figure 2. 8-pin package connections
5)GLVDEOH 9&&
$& *32
$& 6&/
966 6'$
069
1. See Section 15: Package information for package dimensions, and how to identify pin 1.
1.1 Functional modes

The M24SR02-Y has two functional modes available. The difference between the modes
lies in the power supply source (see Table 2).
Table 2. Functional modes

Modes Supply source Comments
I2C mode Vcc The I2C interface is available

Tag mode RF field only The I2C interface is disconnected
Dual interface mode RF field or Vcc Both I2C and RF interfaces are available
1.1.1 I2C mode

M24SR02-Y is powered by VCC. The I2C interface is connected to the M24SR02-Y. The I2C
host can communicate with the M24SR02-Y device.
1.1.2 Tag mode

The M24SR02-Y is supplied by the RF field and can communicate with an RF host (RFID
reader or an NFC phone). The User memory can only be accessed by the RF commands.
10/88 DS9985 Rev 12

M24SR02-Y Functional description
1.1.3 Dual interface mode

Both interfaces, RF and I2C, are connected to the M24SR02-Y and both RF or I2C host can
communicate with the M24SR02-Y device. The power supply and the access management
are carried out by the M24SR02-Y itself. For further details refer to Section 4.2.1: RF token
and Section 4.2.2: I2C token.
DS9985 Rev 12 11/88

20
Description of signals M24SR02-Y
2 Description of signals
2.1 Serial clock (SCL)

This input signal is used to strobe all data in and out of the device. In applications where this
signal is used by slave devices to synchronize the bus to a slower clock, the bus master
must have an open drain output, and a pull-up resistor must be connected from Serial clock
(SCL) to VCC. (Figure 17 indicates how the value of the pull-up resistor can be calculated).
In most applications, though, this method of synchronization is not employed, and so the
pull-up resistor is not necessary, provided that the bus master has a push-pull (rather than
an open drain) output.
2.2 Serial data (SDA)

This bidirectional signal is used to transfer data in or out of the device. It is an open drain
output that may be wire-OR'ed with other open drain or open collector signals on the bus. A
pull-up resistor must be connected from Serial data (SDA) to VCC. (Figure 17 indicates how
the value of the pull-up resistor can be calculated).
2.3 Antenna coil (AC0, AC1)

These inputs are used to connect the device to an external coil exclusively. It is advised not
to connect any other DC or AC path to AC0 or AC1.
When correctly tuned, the coil is used to access the device using NFC Forum Type 4
commands.
2.4 Ground (VSS)

VSS, when connected, is the reference for the VCC supply voltage for all pads, including AC0
and AC1.
2.5 Supply voltage (VCC)

This pin can be connected to an external DC supply voltage.
Note: An internal voltage regulator allows the external voltage applied on VCC to supply the
M24SR02-Y.
2.5.1 Operating supply voltage VCC

Prior to selecting the M24SR02-Y and issuing instructions to it, a valid and stable VCC
voltage within the specified [VCC(min), VCC(max)] range must be applied. To maintain a
stable DC supply voltage, it is recommended to decouple the VCC line with suitable
capacitors (usually of the order of 10 nF and 100 pF) close to the VCC / VSS package pins.
This voltage must remain stable and valid until the end of the transmission of the instruction
and, for a writing instruction (UpdateBinary, ChangeReferenceData,
12/88 DS9985 Rev 12

M24SR02-Y Description of signals
EnableVerificationRequirement, DisableVerificationRequirement, EnablePermanentState,

DisablePermanentState, until the completion of the internal I²C write cycle (tW).
2.5.2 Power-up conditions

When the power supply is turned on, VCC rises from VSS to VCC. The VCC rise time must not
vary faster than 1 V/µs.
2.5.3 Device reset in I²C mode

In order to prevent inadvertent write operations during power-up, a power-on reset (POR)
circuit is included. At power-up (continuous rise of VCC), the M24SR02-Y does not respond
to any I²C instruction until VCC has reached the power-on reset threshold voltage (this
threshold is lower than the minimum VCC operating voltage defined). When VCC passes
over the POR threshold, the device is reset and enters the Standby power mode. However,
the device must not be accessed until VCC has reached a valid and stable VCC voltage
within the specified [VCC(min), VCC(max)] range.
In a similar way, during power-down (continuous decrease in VCC), as soon as VCC drops
below the power-on reset threshold voltage, the M24SR02-Y stops responding to any
instruction sent to it.
2.5.4 Power-down conditions

During power-down (continuous decay of VCC), the M24SR02-Y must be in Standby power
mode (mode reached after decoding a Stop condition, assuming that there is no internal
operation in progress).
2.6 RF disable
This input signal is used to disable the RF communication. When the voltage on the VCC pin
is below the POR level or not connected, an internal pull-down resistor is connected on this
pad. Thus, the RF disable pad is maintained to the low level and the RF analog front end is
activated. When the voltage on the VCC pin is higher than the POR level, the I²C host must
set this pin to enable or disable the RF communication. In Dual interface mode, RF disable
must not be left floating.
2.7 General purpose output (GPO)

The GPO pad is an open drain pad and a external pull-up resistor must be connected to it.
This pad is a configurable output signal. On delivery, GPO is configured as Session opened.
Its behavior is consistent with the I2C or RF session activated and with the mode chosen by
the user. The GPO pad is enable when an RF or an I2C session is open. When neither an
RF nor an I2C session is open, the GPO is high impedance.
DS9985 Rev 12 13/88

20
The user can select one of these configurations(a):

• SessionOpen: an RF or I2C session is ongoing.
• MIP (NDEF Message updating In Progress): the RF host is writing an NDEF length
different from 0x0000. This mode can be used to detect when the RF host changes the
NDEF message as defined by the NFC Forum.
• WIP (Writing In Progress): the M24SR02-Y is executing a writing operation.
• INT (interrupt): the I2C or RF host can force the M24SR02-Y to send a negative pulse
on the GPO pin.
• I2C ready response: an I2C response is ready to be read by the I²C host.
• State mode: the I2C or RF host can control the state of the GPO pad during the RF
session.
• RF busy: an RF host is communicating with the M24SR02-Y.
2.7.1 Session Open configuration (GPO field = 0xX1 or 0x1X)

When the GPO is configured as “Session Open”, it goes to the Low state when an RF or I2C
session is ongoing (see Figure 3).
An RF session is taken when M24SR02-Y receives a valid Select Application. The session
is released after M24SR02-Y has received a valid Deselect command, if M24SR02-Y has
received a Kill RF session command in I2C or when the RF field became OFF.
An I2C session is taken when M24SR02-Y receives a valid Get session command or a valid
Kill RF session command. The session is released after M24SR02-Y has received I2C token
release sequence or after a power-off.
GPO is driven low after a delay (1) or (3) when the session is open.
GPO is released after a delay (2) or (4) when the session is released.
Figure 3. GPO configured as Session Open (GPO field = 0xX1 or 0x1X)

ŶƚŝĐŽůůŝƐŝŽŶΘ
<ŝůůƐĞƐƐŝŽŶŽƌ
E&ƐĞůĞĐƚ
'ĞƚƐĞƐƐŝŽŶ
ĞƐĞůĞĐƚ
ĞƐĞůĞĐƚ
^ĞƐƐŝŽŶ
Z&
Z&^ĞƐƐŝŽŶ /Ϯ^ĞƐƐŝŽŶ
^ĞƐƐŝŽŶ
'WKĂƐ^ĞƐƐŝŽŶKƉĞŶ ;ϭͿ ;ϮͿ ;ϯͿ ;ϰͿ
D^ϯϬϳϴϰsϮ
1. CmdEOFtoGPlow (RF command End of frame to GPORF Session pad low)

2. CmdEOFtoGPHZ (RF command End of frame to GPORF Session pad HZ)
3. CmdSTPtoGPlow (I2C command stop to GPO low)
4. AnswerlbLBtoGPHZ (I2C answer last bit of last byte to GPO HZ)
a. See Table 81 for more details.
14/88 DS9985 Rev 12

2.7.2 WIP Writing in Progress configuration (GPO field = 0xX2 or 0x2X)

When the GPO is configured as “WIP”, it goes to the Low state during an I2C or RF writing
operation.
During an RF or I2C session, when M24SR02-Y updates a file, GPO is driven low after a
delay (1) or (3) following the beginning of the correspondent UpdateBinary command
execution.
GPO will remain low during the writing time (2) or (4), before being released.
Figure 4. GPO configured as WIP (GPO field = 0xX2 or 0x2X)

;ϭͿ
Z&Žƌ/Ϯ Žƌ
ĐŚĂŶŶĞů ;ϯͿ
hƉĚĂƚĞ ŶĚŽĨǁƌŝƚŝŶŐ ŶǇŽƚŚĞƌ

ĐŽŵŵĂŶĚ ŽƉĞƌĂƚŝŽŶ ĐŽŵŵĂŶĚ
'WKĂƐt/W
;ϮͿŽƌ;ϰͿ
D^ϯϬϳϴϲsϯ
1. CmdSTPtoGPlow (I2C Command Stop to GPO low)

2. Writing time duration
3. CmdEOFtoGPlow (RF Command End of frame to GPO low)
DS9985 Rev 12 15/88

20
2.7.3 I2C answer ready configuration (GPO field = 0xX3)

When the GPO is configured as I2C answer ready, it goes to the low state when the
M24SR02-Y has finished to treat the I2C command and is ready to send the I2C response.
During an I2C session, after receiving a valid I2C command, GPO pin is driven low after a
delay when M24SR02-Y is ready to deliver a response on the I2C bus.
GPO is released when M24SR02-Y receives a new command.
Figure 5. GPO configured as I2C answer ready (GPO field = 0xX3)
/ϸĐŚĂŶŶĞů
KƉĞŶ ŶǇ/ϸ DϮϰ^Zǆǆ ŶǇ/ϸ DϮϰ^Zǆǆ ŶǇ/ϸ DϮϰ^Zǆǆ

^ĞƐƐŝŽŶ ĐŽŵŵĂŶĚ ƌĞƐƉŽŶƐĞ ĐŽŵŵĂŶĚ ƌĞƐƉŽŶƐĞ ĐŽŵŵĂŶĚ ƌĞƐƉŽŶƐĞ
'WKĂƐ/ϸ
ĂŶƐǁĞƌƌĞĂĚǇ
D^ϯϬϳϴϴsϰ
16/88 DS9985 Rev 12

2.7.4 MIP NDEF Message writing in Progress configuration

(GPO field = 0x3X)
When the GPO is configured as MIP, its state goes to the low state when the RF host writes
the NDEF length to another value than 0x0000.
During an RF session, when M24SR02-Y changes an NDEF file and updates the NDEF
length with a value different from 0x0000, GPO is driven low after a delay (1) following the
beginning of the correspondent UpdateBinary command execution.
GPO will remain low during the writing time (2), before being released.
Figure 6. GPO configured as MIP (GPO field = 0x3X)

Z&ĐŚĂŶŶĞů
hƉĚĂƚĞƚŚĞE& DϮϰ^Zǆǆ ŶǇŽƚŚĞƌ

ůĞŶŐƚŚ͊сϬǆϬϬϬϬ ƌĞƐƉŽŶƐĞ ĐŽŵŵĂŶĚ
'WKĂƐD/W
;ϭͿ
;ϮͿ
D^ϯϬϳϴϱsϯ
1. CmdEOFtoGPlow (RF command End of frame to GPO low)

DS9985 Rev 12 17/88

20
2.7.5 INT interrupt configuration (GPO field = 0xX4 or 0x4X)

The I2C or RF host can send a negative pulse on the GPO pad. The GPO pad goes to the
low state at the end of the command and goes to the high state at the end of the M24SR02-
Y response.
During an RF or I2C session, when M24SR02-Y receives a valid Interrupt command,
M24SR02-Y GPO pin is driven low after (1) or (3) for a duration of (4) in RF, or after
responding in I2C (2). Then GPO pin is released.
Figure 7. GPO configured as INT (GPO field = 0xX4 or 0x4X)
Z&Žƌ/ϸ ;ϭͿ
Žƌ
ĐŚĂŶŶĞů ;ϯͿ ;ϮͿ
^ĞŶĚ DϮϰ^Zǆǆ ŶǇŽƚŚĞƌ

/ŶƚĞƌƌƵƉƚ ƌĞƐƉŽŶƐĞ ŽƉĞƌĂƚŝŽŶ
'WKĂƐ/Ed
;ϰͿ
D^ϯϬϳϴϳsϯ
1. CmdSTPtoGPlow (I2C command Stop to GPO low)

2. After NewCmdlbFB (new I2C command last bit of first byte)
or
after AnswerlbFB (I2C answer last bit of first byte)
3. CmdEOFtoGPlow (RF command End of frame to GPO low)
4. GPO pulse duration
18/88 DS9985 Rev 12

2.7.6 State control configuration (GPO field = 0xX5 or 0x5X)

When the GPO is configured as State control, the I2C or RF host can control the state of the
GPO by sending a dedicated command.
During an RF or I2C session, the M24SR02-Y can control the GPO pin. After receiving a
valid Set GPO command, GPO pin is driven low after a delay (1) or (3). GPO will be
released after a valid Reset command or after a power-off or upon closing the RF session.
Figure 8. GPO configured as State control (GPO field = 0xX5 or 0x5X)

5)RU,ð&
FKDQQHO RU RU

5HVHW*32 $Q\RWKHU 6HW*32

FRPPDQG FRPPDQG FRPPDQG
*32DV
6WDWH&RQWURO
069
1. CmdSTPtoGPlow (I2C Set GPO command Stop to GPO low)

2. CmdSTPtoGPHZ (I2C Reset GPO command Stop to GPO HZ)
3. CmdEOFtoGPlow (RF Set GPO command End of frame to GPO low)
4. CmdEOFtoGPHZ (RF Reset GPO command End of frame to GPO HZ)
DS9985 Rev 12 19/88

20
2.7.7 RF busy configuration (GPO field = 0x6X)

When the GPO is configured as RF busy, the GPO goes to the low state when the
M24SR02-Y is processing an RF command or when an RF session is ongoing.
When an RF field is present, GPO is driven low after a delay (1) when M24SR02-Y detects
the first command. If the RF session is ongoing and M24SR02-Y receives a not-supported
command, GPO remains low. It will be released only at the end of the RF session, after (2).
Figure 9. GPO configured as RF busy (GPO field = 0x6X)

Z&ĐŚĂŶŶĞů
;ϭͿ ;ϮͿ ;ϭͿ ;ϮͿ
Z&ĐŽŵŵĂŶĚ ^ĞŶƐZĞƋΘ Z&

ŶŽƚƐƵƉƉŽƌƚĞĚ
^;^Ϳ
^ĞŶƐZĞƐ ĐŽŵŵĂŶĚ
'WKĂƐZ&ďƵƐǇ
D^ϯϬϳϵϬsϯ
1. CmdSOFtoGPlow (RF command Start of frame to GPO low)

2. CmdEOFtoGPHZ (RF command End of frame to GPO HZ)
20/88 DS9985 Rev 12

M24SR02-Y M24SR02-Y memory management
3 M24SR02-Y memory management
3.1 Memory structure

The M24SR02-Y supports the NDEF tag application as defined in the NFC Forum Type 4
Tag. The M24SR02-Y is composed of three files:
• a CC (capability container) file
• an NDEF file
• a System file: this is an ST-proprietary file
The System file contains information on the configuration of the M24SR02-Y device. The
CC file gives information about the M24SR02-Y itself and the NDEF file. The NDEF file
contains the User data.
3.1.1 File identifier

The file identifier is the value used in the Select command to select a file.
Table 3. File identifier

File identifier Meaning
0xE101 System file

0xE103 CC file
0x0001 NDEF file
3.1.2 CC file layout

The CC file gives information about the M24SR02-Y and the NDEF file. This is a read-only
file for the RF or I²C host and cannot be modified by issuing a write command.
The T field, Read Access and Write Access fields can be changed by the RF or I²C host by
issuing a specific process (refer to Section 8: Functional procedures).
DS9985 Rev 12 21/88

29
M24SR02-Y memory management M24SR02-Y
Table 4. CC file layout for 1 NDEF file

File offset Meaning Value Comments
0x0000 Number of bytes of CC file 0x000F 15 bytes

(1)
0x0002 Mapping version 0x20 or 0x10 V 2.0 or V 1.0
0x0003 Maximum number of bytes that can be read 0x00F6 246 bytes
0x0005 Maximum number of bytes that can be written 0x00F6 246 bytes
(2)
0x0007 0x04 T field
0x0008 0x06 L field
0x0009 0x0001 FileID
NDEF file control TLV Maximum NDEF
0x000B 0x0100
file size
0x000D 0x00 (2) Read access
(2)
0x000E 0x00 Write access
1. According to the reader.
2. Delivery state.
3.1.3 NDEF file layout

The NDEF file contains the NDEF message, which contains the user data. The RF host or
the I²C host can read and write data inside the file. The first two bytes (named NDEF
message length) define the size of the NDEF message. The NDEF message length must be
managed by the application and the M24SR02-Y device does not check if its value is
relevant vs. the data written by the RF or I²C host. The M24SR02-Y device uses the NDEF
message length, e. g. the standard read can be processed only inside the NDEF message;
otherwise, the M24SR02-Y device returns an error code. For more details about the read
command, refer to Section 5.6.7: ReadBinary command.
22/88 DS9985 Rev 12

Table 5. NDEF file layout

File offset Byte 0 Byte 1 Byte 2 Byte 3
0x0000 NDEF message length User data User data

0x0004 User data User data User data User data
... ... ... ... ...
... ... ... ... ...
... ... ... ... ...
0x00FC ... ... ... User data
3.1.4 System file layout

The system file specifies the configuration of the M24SR02-Y. Table 6 lists the different
fields.
Table 6. Field list

File Number Read Write
Field name Delivery state (1)
offset of bytes access access
0x0000 Length system file 2 I²C or RF - 0x0012

0x0002 I²C protect 1 I²C or RF I²C (2) 0x01
0x0003 I²C watchdog 1 I²C or RF I²C (2)
0x00
(2)
0x0004 GPO 1 I²C or RF I²C 0x11
(2)
0x0005 ST reserved 1 I²C or RF I²C 0x00
0x0006 RF enable 1 I²C or RF I²C (2) 0x xxxx xxx1(3)
0x0007 NDEF file number (RFU) 1 I²C or RF none 0x00
0x0008 UID 7 I²C or RF none 0x0282 xx xx xx xx xx(4)
0x000F Memory size 2 I²C or RF none 0x00FF
0x0011 Product code 1 I²C or RF none 0x82
1. The delivery state for all passwords is 0x00000000000000000000000000000000.
2. The access is granted when the field I²C protect is set to the state Unprotected or when the right I²C
password is correctly received (see Section 3.5: I2C password).
3. Refer to Table 11.
4. x values are defined by ST to insure UID unicity.
DS9985 Rev 12 23/88

29
Table 7. Details about I2C watchdog

File offset b7- b0
The I2C watchdog ensures that the I2C host will not keep the session open while there
is no more activity on the I2C bus (between the stop bit of the previous transaction and
the start bit of the next one).
– b7-b3: RFU
– b2-b0(1): 000: watchdog disabled
001: N = 1 → 30 ms
0x0003
010: N = 2 → 60 ms
011: N = 4 → 120 ms
100: N = 8 → 240 ms
101: N = 16 → 480 ms
110: N = 32→ 960 ms
111: N = 64 → 1920 ms
1. If b2-b0 are programmed to a non null value (N), the watchdog is enabled and starts counting for the
indicated (approximate) duration, before releasing the I2C session.
Table 8. Details about the GPO field

File offset b7 b6-b4 b3 b2-b0
0x0004
RFU
When an RF session is open:
0b000: High impedance
0b001: Session opened
0b010: WIP
0b011: MIP
0b100: Interrupt
0b101: State control
0b110: RF busy
0b111: RFU
RFU
When an I²C session is open:
0b000: High impedance
0b010: WIP
0b011: I²C answer ready
0b100: Interrupt
0b101: State control
0b110: RFU
0b111: RFU
24/88 DS9985 Rev 12

Table 9. Details about the RF session field

File offset b7 b6-b4 b3-b0
0x0004
RFU
When an RF session is open:
RFU
Table 10 gives some details about the ST reserved field.
Table 10. Details about the ST reserved field

File offset b7-b0
0x0005
0x00
Table 11 gives some details about the RF enable field.
Table 11. Details about the RF enable field

File offset b7 b6-b4 b3 b2-b1 b0
0x0006
0: the RF field is off (1)
1: the RF field is on (1)
RFU
0: the RF disable pad is at low state (1)
1: the RF disable pad is at high state (1)
RFU
0: the M24SR02-Y does not decode the command received from the RF interface
1: the M24SR02-Y decodes the command received from the RF interface
1. this field is written by the M24SR02-Y.
3.2 Read and write access rights to the memory

An NDEF file can be locked for read or write accesses. It is also protected by a 128-bit
password that the host must present before accessing the NDEF file. There are two 128-bit
passwords, one for the read access and the other one for the write access.
An NDEF file can be permanently locked for read or write accesses. Thus, the host cannot
access the NDEF file.
The read password must be sent to the M24SR02-Y device before reading a read-locked
NDEF file.
DS9985 Rev 12 25/88

29
The write password must be present on the M24SR02-Y device before writing a write-
locked NDEF file. The write password must be sent to change the read or write access. The
read or write access right is defined for the NDEF file.
3.2.1 State of the Read and Write access rights

Two bytes in the CC file are used to define the Read and Write access rights to the NDEF
file. For more details refer to Section 3.1.2: CC file layout.
Table 12. Read access right

Value Meaning
0x00 Read access without any security

0x80 Locked (1)
0xFE Read not authorized
1. The read password must be sent before reading in the NDEF file.
Table 13. Write access right

Value Meaning
0x00 Write access without any security

0x80 Locked (1)
0xFF Write not authorized
1. The write password must be sent before writing in the NDEF file.
The state 0xFF and 0xFE cannot be changed by using the Read or Write passwords.
26/88 DS9985 Rev 12

3.2.2 Changing the read access right to NDEF files

The state diagram on Figure 10 shows how to change the access right to read an NDEF file.
Figure 10. Changing the read access right to an NDEF file
[
/RFNWKH1'()ILOH 3HUPDQHQWO\ORFNWKH1'()ILOH
8QORFNWKH1'()ILOH
3HUPDQHQWO\ORFNWKH1'()ILOH
[ [)(
3HUPDQHQWO\XQORFNWKH1'()ILOH
06Y9
1. See the procedure to lock the read access (Section 8.4: Locking an NDEF file).
2. See the procedure to unlock the read access (Section 8.5: Unlocking an NDEF file).
3. See the procedure to permanently lock the read access (Section 8.6: Reaching the read-only state for an
NDEF file).
4. Proprietary state, not defined by NFC Forum Type 4 Tag. For NFC Forum compatible tags, the only
possible value of the read access rights are 0x00 (no restrictions on reads).
DS9985 Rev 12 27/88

29
3.2.3 Changing the write access right to NDEF files

The state diagram on Figure 1 shows how to change the write access right to an NDEF file.
Figure 11. Changing the write access right to an NDEF file
[
/RFNWKH1'()ILOH 3HUPDQHQWO\ORFNWKH1'()ILOH
8QORFNWKH1'()ILOH
3HUPDQHQWO\ORFNWKH1'()ILOH

[ [))
3HUPDQHQWO\XQORFNWKH1'()ILOH
06Y9
1. See the procedure to lock the write access.

2. See the procedure to unlock the write access.
3. See the procedure to permanently lock the write access (Section 8.6: Reaching the read-only state for an
NDEF file).
4. Proprietary state, not defined by NFC Forum Type 4 Tag. For NFC Forum compatible tags, it is mandatory
that the write access rights are set to either 0x00 (no restrictions on writes) or to 0xFF (permanently
locked). 0x80 might not be fully decoded by some smart phones.
3.3 Access right life time

The access right life time is validated while the NDEF file is selected or until the end of the
RF or I²C session. Once the read or write access right is granted, the host can send one or
more ReadBinary or UpdateBinary commands.
At the end of a session or when the host selects another file, the read and write access
rights are initialized.
3.4 NDEF file passwords

The NDEF file passwords protect the read or write access from an RF or I²C interface
from/to an NDEF file.
Two NDEF file passwords are available for each NDEF file:
• Read password
• Write password
The length of a password is 128 bits (16 bytes).
28/88 DS9985 Rev 12

3.5 I2C password

The I²C password can be sent only by the I²C host. It activates the SuperUser rights. The I²C
host with the SuperUser rights can:
• access the NDEF file regardless of the right access and without sending the NDEF file
passwords
• change the access rights regardless of the current state.
The length of the I²C password is 128 bits (16 bytes).
3.5.1 I²C password and I²C protect field of the System file
The I²C protect field in the system file can be set to:
• 0x00: the I²C host has the SuperUser right access without sending the I²C password
• 0x01: the I²C host has the SuperUser right access after sending the I²C password.
For more details about the system file layout, refer to Section 3.1.4: System file layout.
DS9985 Rev 12 29/88

29
Communication mechanism M24SR02-Y
4 Communication mechanism
This section describes the principle of communication between an RF or an I2C host and the
M24SR02-Y device.
4.1 Master and slave

The M24SR02-Y acts as a slave device on either the I2C-bus or the RF channel and
therefore waits for a command from the I2C master or the RF host before sending its
response.
The RF host must generate the RF field and the RF commands.
The I2C host must supply the M24SR02-Y through the VCC pin and must generate the I2C
clock on the SCL pad.
4.2 M24SR02-Y session mechanism

The M24SR02-Y is a dynamic NFC/RFID tag that can be accessed either from the RF or I2C
interface. The M24SR02-Y implements a token system. This token has two possible values,
RF or I2C. When the token exists and is assigned to one interface (RF or I2C), the
M24SR02-Y cannot communicate with the other host.
4.2.1 RF token
The token is given to the RF interface once the anticollision is done. The release condition
can be either an RF field cut-off, or the reception of the command deselect, or when the I²C
host sends the KillRFsession.
4.2.2 I2C token

The token is given to the I2C interface when the I2C host has sent the correct device Select.
The release condition can be either a power down condition on VCC pin or the reception of a
I2C token release sequence from the I2C host, after which M24SR02-Y goes in Standby
power mode.
30/88 DS9985 Rev 12

M24SR02-Y I²C and RF command sets
5 I²C and RF command sets
The command sets of the M24SR02-Y can be split in different command families. Most
commands are common between the RF and the I²C interface. Some commands are
specific to the RF interface and some others are specific to the I²C interface. This section
describes the M24SR02-Y command sets that can be issued by the RF or the I²C host.
There are three command families:
• the NFC Forum Type 4 Tag command set
• the ISO/IEC 7816-4 command set
• the proprietary command set
The NFC Forum Type 4 Tag command set and the ISO/IEC 7816-4 command set use the
I-Block format. For more details about the I-Block format, refer to Section 5.2.
Two other command formats exist:
• the commands using the R-Block format (refer to Section 5.3)
• the commands using the S-Block format (refer to Section 5.4).
This section gives a brief description of the RF and I²C host common commands. The
format of these command sets is the I-Block format.
Table 14 lists the RF and I²C command sets.
Table 14. RF and I²C command sets

Family Class Instruction
Command name Brief description
command set byte code
NDEF Tag Application

NDEF Tag Application Select 0x00 0xA4
Select
CC select 0x00 0xA4 Select the CC file
NFC Forum NDEF select 0x00 0xA4 Select the NDEF file
Type 4 Tag System select 0x00 0xA4 Select the system file
ReadBinary 0x00 0xB0 Read data from file
Write or erase data to a
UpdateBinary 0x00 0xD6
NDEF file
Checks the right access of
Verify 0x00 0x20 a NDEF file or sends a
password
Change a Read or write
ChangeReferenceData 0x00 0x24
ISO/IEC 7816-4 password
Activate the password
EnableVerificationRequirement 0x00 0x28
security
Disable the password
DisableVerificationRequirement 0x00 0x26
security
Enable the Read only or
EnablePermanentState 0xA2 0x28
ST proprietary Write only security state
ExtendedReadBinary 0xA2 0xB0 Read data from file
DS9985 Rev 12 31/88

78
I²C and RF command sets M24SR02-Y
5.1 Structure of the command sets

The exchange of data between the RF or the I²C host and the M24SR02-Y uses three kinds
of data formats, called blocks:
• I-Block: to exchange the command and the response
• R-Block: to exchange positive or negative acknowledgment
• S-Block: to use either the Deselect command or the Frame waiting extension (WTX)
command or response.
Note: Max WTX value = 0x0B
This section describes the structure of the I-Block, R-block and S-Block. This format is used
for the application command set.
5.2 I-Block format

The I-Block is used to exchange data between the RF or the I²C host and the M24SR02-Y.
It is composed of three fields. Table 15 details the I-Block format.
Table 15. I-Block format

SoD Payload EoD
Name
PCB DID 0 CRC
Length 1 byte 1 byte 1 to 251 bytes 2 bytes
PCB field
DID field (optional)
RF or I²C host to M24SR02-Y: C-APDU
M24SR02-Y to RF or I²C host: R-APDU
2 CRC bytes
32/88 DS9985 Rev 12

Table 16. PCB field of the I-Block format

b7-b6 b5 b4 b3 b2 b1 b0
-
0b00 0 0 X 0 1 X
I-Block
RFU
Must be set to 0
DID field, if bit is set
Must be set to 0
Must be set to 1
Block number
When the RF or I²C host sends a command to the M24SR02-Y the format of the payload is
the C-APDU.
When the M24SR02-Y sends a command to the RF or I²C host, the format of the payload is
the R-APDU.
5.2.1 C-APDU: payload format of a command

The C-APDU format is used by the RF or the I²C host to send a command to the M24SR02-
Y. Table 17 describes its format.
Table 17. C-APDU format

Payload field
Name
CLA INS P1 P2 LC Data Le
Length 1 byte 1 byte 1 byte 1 byte 1 byte Lc byte 1 byte
Class byte
0x00: standard command
0xA2: ST command
Instruction byte
Parameter Byte 1
Parameter Byte 2
Number of bytes of the Data field
Data bytes
Number of bytes to be read in the M24SR02-Y memory
5.2.2 R-APDU: payload format of a response

The M24SR02-Y uses the I-Block format to reply to a command that used the I-Block
format. This format is described in Table 18.
DS9985 Rev 12 33/88

78
Table 18. R-APDU format

Payload field
Name
Data (optional) SW1 SW2
Length Le byte 1 byte 1 byte
Data
Status byte 1
Status byte 2
5.3 R-Block format

The R-Block is used to convey positive or negative acknowledgment between the RF or I²C
host and the M24SR02-Y.
Table 19. R-Block format

PCB CRC
R(ACK) without the DID field: 0xA2 or 0xA3

R(ACK) with the DID field: 0xAA or 0xAB
2 CRC bytes
R(NAK) without the DID field: 0xB2 0xB3
R(NAK) with the DID field: 0xBA 0xBB
There are two kinds of R-Blocks:

• R(ACK): the acknowledgment block sent by the RF or I²C host or by the M24SR02-Y.
• R(NAK): the non-acknowledgment block sent by the RF or I²C host or by the
M24SR02-Y.
34/88 DS9985 Rev 12

Table 20. R-Block detailed format

b7-b6 b5 b4 b3 b2 b1 b0
-
0b10 1 X X 0 1 X
R-Block
RFU
1: NAK
0: ACK
0: DID field is not present
1: DID field is present
Must be set to 0
Must be set to 1
Block number
5.4 S-Block format

The S-Block is used to exchange control information between a reader and a contactless
tag.
Table 21. S-Block format

SoD EoD
NFC frame
PCB DID Payload CRC
Length 1 byte 1 byte 1 to 255 bytes 2 bytes
0xC2: for S(DES) when the DID field is not present

0xCA: for S(DES) when the DID field is present
0xF2: for S(WTX) when the DID field is not present
0xFA: for S(WTX) when the DID field is present
DID field (optional)
WTX field (1)
2 CRC bytes
1. This field is present when b5-b4 bits are set to 0b11 (S-Block is a WTX). see Table 22.
There are two requests using the S-Block format:

• S(DES): the deselect command
• S(DES) is only applicable to RF
• S(WTX): the Waiting frame extension command or response.
A Waiting time extension request occurs, in RF or I2C, when the operating time needed
by M24SRxx is greater than 9.6 ms.
The WTX field indicates the increase time factor to be used in this command execution
(FDTtemp = WTX * 9.6 ms). The max WTX value is equal to 0x0B.
DS9985 Rev 12 35/88

78
Table 22. S-Block detailed format

b7-b6 b5-b4 b3 b2 b1 b0
0b11 X X 0 1 0
S-Block
0b00: Deselect
0b11: WTX
0: DID field is not present
1: DID field is present
-
RFU
RFU
Note: After receiving the deselect command, the session is released and M24SR02-Y enters the
Standby power mode. In I2C, the session is released after executing the I2C token release
sequence.
In response to a RATS command, M24SR02-Y returns FWI parameter (default frame waiting
time used); when M24SR02-Y needs more time for a command execution, it requests a
frame waiting time extension by responding 0xF2 0xWTX (request waiting time = FWI *
WTX). If the reader accepts M24SR02-Y request, it acknowledges by sending the command
0xF2 0xWTX. The frame waiting time becomes FWI * WTX for the current command only.
5.5 CRC of the I2C and RF frame

The two CRC bytes check the data transmission between the RF host or I²C host and the
M24SR02-Y. For the RF frame, the CRC is computed on all the data bits in the frame,
excluding parity bits, SOF and EOF, and the CRC itself.
For the I²C frames, the CRC is computed on all data bits of the frame excluding Device
select and the CRC itself.
The CRC is as defined in ISO/IEC 13239. The initial register content must be 0x6363 and
the register content must not be inverted after calculation.
36/88 DS9985 Rev 12

5.6 NFC Forum Type 4 Tag protocol
5.6.1 Command set

With the NFC Forum Type 4 Tag protocol, the commands are common to RF and I²C.
Table 23. Command set overview

Command name Brief description
NDEF Tag Application Select Select the NDEF Tag Application

Capability Container Select Select the capability container (CC) file using the Select command
NDEF Select Select the NDEF file
System File Select Select the system file
ReadBinary Read data from a file
UpdateBinary Write new data to a file
5.6.2 Status and error codes

This section lists the status and the error code of the M24SR02-Y.
Table 24. Status code of the M24SR02-Y

- SW1 SW2 Comment
Value 0x90 0x00 Command completed successfully
Table 25. Error codes of the M24SR02-Y

- SW1 SW2 Comment
Length 1 byte 1 byte -

Value 0x62 0x80 File overflow (Le error)
Value 0x62 0x82 End of file or record reached before reading Le bytes
Value 0x63 0x00 Password is required
Value 0x63 0xCX Password is incorrect, X further retries allowed (X = 0, 1, 2)
Value 0x65 0x81 Unsuccessful updating
Value 0x67 0x00 Wrong length
Value 0x69 0x81 Command is incompatible with the file structure
Value 0x69 0x82 Security status not satisfied
Value 0x69 0x84 Reference data not usable
Value 0x6A 0x80 Incorrect parameters Le or Lc
Value 0x6A 0x82 File or application not found
Value 0x6A 0x84 File overflow (Lc error)
Value 0x6A 0x86 Incorrect P1 or P2 values
DS9985 Rev 12 37/88

78
Table 25. Error codes of the M24SR02-Y (continued)

- SW1 SW2 Comment
Value 0x6D 0x00 INS field not supported

Value 0x6E 0x00 Class not supported
5.6.3 NDEF Tag Application Select command

The RF or the I²C host must send this command to activate the NDEF Tag Application.
To activate the NDEF Tag Application, the RF host sends the Select command (see
Table 26) in addition to the sequence defined in the NFC Forum digital protocol.
To activate the NDEF Tag Application, the I²C host sends the Select command (see
Table 26) in addition to the GetSession or the Kill RF session command.
Table 26 defines the C-APDU of the Select command to select the NDEF Tag Application
(called NDEF Tag Application Select).
Table 26. C-APDU of the NDEF Tag Application Select command

Name CLA INS P1 P2 Lc Data Le
0xD27600
Value 0x00 0xA4 0x04 0x00 0x07 0x00
00850101
Class byte
Select instruction code
P1 field
P2 field
Number of bytes of data
Application ID
Le field
Table 27 defines the R-APDU of the NDEF Tag Application Select command.
Table 27. R-APDU of the NDEF Tag Application Select command

- Data SW1 SW2 Comment
Length - 1 byte 1 byte -

Value - 0x90 0x00 Command completed
Value - 0x6A 0x82 NDEF Tag Application not found
Value - 0x6D 0x00 Class not supported
5.6.4 Capability Container Select command

The RF or I²C host uses the Capability Container Select procedure to select the capability
container (CC) file.
38/88 DS9985 Rev 12

The CC file is selected when this command returns “command completed” in the R-APDU.
Table 28 defines the C-APDU of the Select command to select the CC file (called Capability
Container Select).
Table 28. C-APDU of the Capability Container Select command

Value 0x00 0xA4 0x00 0x0C 0x02 0xE103 -

Class byte
P1 field
P2 field
CC file ID
-
Table 29 defines the R-APDU of the CC Select command.
Table 29. R-APDU of the Capability Container Select command


Value - 0x6A 0x82 File or application not found
Value - 0x6D 0x00 Class not supported
5.6.5 NDEF Select command

The RF or I²C host uses the NDEF Select command to select the NDEF file.
The NDEF file is selected when this command returns “command completed” in the
R-APDU. Table 30 defines the C-APDU of the Select command to select the NDEF file
(called NDEF Select).
In case of a password is required to access the NDEF file, the NDEF Select command will
disable any previously granted access rights to this file. The Verify command might be
required to access the file.
DS9985 Rev 12 39/88

78
Table 30. C-APDU of the NDEF Select command

Value 0x00 0xA4 0x00 0x0C 0x02 0x000X -

Class byte
P1 field
P2 field
0x0001: first NDEF file
-
Table 31 defines the R-APDU of the NDEF Select command.
Table 31. R-APDU of the NDEF Select command


5.6.6 System File Select command

The RF or I²C host uses this command to select the system file.
The System file is selected when this command returns "command completed" in the R-
APDU.
Table 32 defines the C-APDU of the command to select the System file (called System
Select).
Table 32. C-APDU of the System File Select command

0x00 0xA4 0x00 0x0C 0x02 0xE101 -

Class byte
P1 field
P2 field
System file ID
-
Table 33 defines the R-APDU of the System File Select command.
40/88 DS9985 Rev 12

Table 33. R-APDU of the System File Select command


Value - 0x6A 0x82 Capability container not found, no data is returned
5.6.7 ReadBinary command

On receiving the ReadBinary command, the M24SR02-Y reads the requested memory field
and sends back its value in the R-APDU response.
Before sending a ReadBinary command, a file must be selected by using a Select
command.
The Response of the ReadBinary command is successful when the data to be read is within
the selected file (a); in other words, when the sum of P1-P2 and Le fields is equal to or lower
than the selected file length.
Table 34 defines the ReadBinary command.
Table 34. C-APDU of the ReadBinary command

Name CLA INS P1 and P2 Lc Data Le
- 0x00 0xB0 2 bytes - - 1 byte

Class byte
Read instruction code
Offset in the file selected
-
-
Number of bytes to read between
0x01 ≤ Le ≤ max(Selected File length, 0xF6)
Table 35 defines the R-APDU of the ReadBinary command.
Table 35. R-APDU of the ReadBinary command


Value Content read 0x90 Don’t care(1) Command completed
Value - 0x67 0x00 Wrong length
Value - 0x69 0x82 Security status not satisfied
a. For more details about CC file, refer to Section 3.1.2: CC file layout.
For more details about NDEF file, refer to Section 3.1.3: NDEF file layout.
For more details about System file, refer to Section 3.1.4: System file layout.
DS9985 Rev 12 41/88

78
Table 35. R-APDU of the ReadBinary command (continued)


Value - 0x6E 0x00 Class not supported
1. For more information, please contact your local ST support.
5.6.8 UpdateBinary command

On receiving the UpdateBinary command, the M24SR02-Y writes the data field into the
selected file and sends back a status in the R-APDU response. If needed, the device will
request a timing extension (see Section 5.4).
Before sending an UpdateBinary command, a file must be selected by issuing a Select
command.
Table 36 defines the UpdateBinary command.
Table 36. C-APDU of the UpdateBinary command

- 0x00 0xD6 2 bytes 1 byte Lc bytes -

Class byte
Write instruction code
Number of bytes of data (0x01 ≤ Lc ≤ 0xF6)
Data to write in the M24SR02-Y memory
-
Table 37 defines the R-APDU of the UpdateBinary command.
Table 37. R-APDU of the UpdateBinary command


Value - 0x65 0x81 Unsuccessful updating
Note: Chaining is not supported on “UpdateBinay” command. For further return codes and
definitions, refer to Status and error codes.
42/88 DS9985 Rev 12

5.7 ISO/IEC 7816-4 commands

The ISO/IEC 7816-4 command set offers some extended features such as the protection of
the NDEF file. This command set is used to manage the right access of the NDEF file.
5.7.1 Verify command

The Verify command has two functions:
1. check if a password is required to access to the NDEF file (the LC field = 0x00)
2. check that the password embedded in the Verify command enables the access to the
memory (the Lc field = 0x10 and the password is present).
When the Lc field is equal to 0x00, the verify command returns a success code (0x90 00)
provided that the access to the NDEF file does not require a password. When the access to
the NDEF file is protected, the response to the Verify command returns an error code
(0x63 00).
When the Lc field equals 0x10, on receiving the Verify command, the M24SR02-Y
compares the requested password with the data contained in the request and reports
whether the operation has been successful in the response.
Before sending this command, an NDEF file must be selected by issuing the NDEF Select
command. Thus, this command checks the right access condition of the last NDEF file
selected.
After a successful command, an access is granted for the whole NDEF file.
Table 38 defines the Verify command.
Table 38. Verify command format

- 0x00 0x20 2 bytes 1 byte Lc bytes -

Class byte
Instruction code
Password identification
0x0001: Read NDEF password transmit
0x0002: Write NDEF password transmit
0x0003: I²C password transmit (1)
Other: RFU
0x00: the password is not present
0x10: the password is present in the data field
Password
-
1. This code can only be issued by the I²C host.
DS9985 Rev 12 43/88

78
Table 39 defines the R-APDU of the Verify command.
Table 39. R-APDU of the Verify command


Value - 0x90 0x00 Command completed, the password is correct
The conditions of use are not satisfied (e.g. no
Value - 0x69 0x85
NDEF file was selected)
Value - 0x69 0x81 Cmd incompatible with file structure
Value - 0x6A 0x80 Incorrect parameter in cmd data field
Value - 0x63 0x00 A password is required
The password transmitted is incorrect and X
Value - 0x63 0xCX (1)
encodes the number of further allowed retries.
1. At each session, the RF host can check a password 3 times.
5.7.2 Change Reference Data command

The Change Reference Data command replaces the read or write password related to the
NDEF files previously selected. It can be performed only if the security status satisfies the
security attributes for this command.
Before sending this command, the verify command with the correct NDEF write password
must be issued. Thus, this command changes the reference data of the NDEF file.
Table 40 defines the Change Reference Data command.
Table 40. Change reference data command format

- 0x00 0x24 2 bytes 1 byte Lc bytes -

Class byte
Instruction code
Password identification
0x0001: Read password transmit
0x0002: Write password transmit
0x0003: I²C password transmit (1)
Other: RFU
0x10: the password is present in the data field
NDEF file or I²C Password
-
1. This code can only be issued by the I²C host.
44/88 DS9985 Rev 12

Table 41 defines the R-APDU of the Change Reference Data command.
Table 41. R-APDU of the Change Reference Data command

Length 0 1 byte 1 byte -

Command completed, the access right has
Value - 0x90 0x00
been changed
Value - 0x69 0x81 Command is incompatible with the file structure
Value - 0x65 0x81 Unsuccessful updating
Value - 0x6A 0x80 CC file or System file selected
Value - 0x6A 0x86 Incorrect P1 or P2 values
5.7.3 Enable Verification Requirement command

The Enable Verification Requirement command activates the protection by password of the
NDEF file. When this command is successful, the read or write access to the NDEF file is
protected by a 128-bit password. It can be performed only if the security status satisfies the
This command can update the right access of the NDEF file by writing into the EEPROM. In
this case, the response timing will be around 5 ms.
must be issued. Thus, this command changes the access right of the NDEF file.
Table 42 defines the Enable Verification requirement command.
Table 42. Enable Verification Requirement command format

- 0x00 0x28 2 bytes - - -

Class byte
Instruction code
New security attributes
0x0001: Enable the read protection of the NDEF file
0x0002: Enable the write protection of the NDEF file
Other: RFU
-
-
-
The last five bits identify the password sent in the Verify command.
DS9985 Rev 12 45/88

78
Table 43 defines the R-APDU of the Enable Verification Requirement command.
Table 43. R-APDU of the Enable Verification Requirement command


5.7.4 Disable Verification Requirement command

The Disable Requirement command deactivates the protection by password of the NDEF
file. When this command is successful, the read or write access to the NDEF file is granted
without security requirements. It can be performed only if the security status satisfies the
must be issued. Thus, this command changes the access right of the NDEF file.
Table 44 defines the Disable Verification Requirement command.
Table 44. Disable Verification Requirement command format

- 0x00 0x26 2 bytes - - -

Class byte
Instruction code
0x0001: Disable the read protection of the NDEF file
0x0002: Disable the write protection of the NDEF file
Other: RFU
-
-
-
Table 45 defines the R-APDU of the Disable Verification Requirement command.
46/88 DS9985 Rev 12

Table 45. R-APDU of the Disable Verification Requirement command


Value - 0x65 0x81 Update failed
5.8 ST proprietary command set

The RF or I²C host can be issued with the command set described in this section.
5.8.1 ExtendedReadBinary command

On receiving the ExtendedReadBinary command, the M24SR02-Y reads the requested
memory field and sends back its value in the R-APDU response.
Before sending an ExtendedReadBinary command, a file must be selected by issuing an
NDEF select command.
The response of the ExtendedReadBinary command will be successful even if the data to
be read is beyond the NDEF message. The command returns an error code if the data to be
read goes beyond the end of the file.
Table 46. C-APDU of the ExtendedReadBinary command

Length 0xA2 0xB0 2 bytes - - 1 byte

ST Class byte
Read instruction code
-
-
-
Number of bytes to read between 0x01 ≤ Le ≤ 0xF6
Table 47 defines the R-APDU of the read binary command.
DS9985 Rev 12 47/88

78
Table 47. R-APDU of the ExtendedReadBinary command

Length Le bytes 1 byte 1 byte -

(1)
Value Content read 0x90 Don’t care Command completed
1. For more information, please contact your local ST support.
5.8.2 EnablePermanentState command

The command configures the NDEF file to the ReadOnly or to the WriteOnly State.
This command can update the right access to the NDEF file by writing into the EEPROM. In
Table 48 defines the EnablePermanentState requirement command.
Table 48. EnablePermanentState command format

Length 0xA2 0x28 2 bytes - - -

Class byte
Instruction code
0x0001: Enable the read protection of the NDEF file
0x0002: Enable the write protection of the NDEF file
Other: RFU
-
-
-
-
Table 49 defines the R-APDU of the EnablePermanentState command.
Table 49. R-APDU table of the EnablePermanentState command


48/88 DS9985 Rev 12

Table 49. R-APDU table of the EnablePermanentState command (continued)


5.8.3 DisablePermanentState command

The command configures the NDEF file to the Lock state.
this case, the response timing will be around 6 ms. This command is only valid in I2C. The
SuperUser rights must have been granted to execute the command.
Before sending this command, an NDEF file must be selected by issuing the NDEF Select
command.
Table 50 defines the DisablePermanentState requirement command.
Table 50. DisablePermanentState command format

Length 0xA2 0x26 2 bytes - - -

Class byte
Instruction code
0x0001: Disable the read protection of the NDEF file
0x0002: Disable the write protection of the NDEF file
Other: RFU
-
-
-
Table 51 defines the R-APDU of the DisablePermanentState command.
Table 51. R-APDU of the DisablePermanentState command


DS9985 Rev 12 49/88

78
Table 51. R-APDU of the DisablePermanentState command (continued)


5.8.4 UpdateFileType command

This command allows to modify the file type of a selected file to Proprietary file (0x05) or
NDEF file (0x04).
NFC Forum compatible tags must configure the file as NDEF file (0x04).
This command is granted only, when application and file are selected and if the file length
and access right have previously been set to 0X00h (message invalid, all access rights
granted).
This command will update the file type located in the CC file by writing into the EEPROM. In
Table 52 defines the UpdateFileType command.
Table 52. UpdateFileType command format

0x04 or
Value 0xA2 0xD6 0x00 0x00 0x01 -
0x05
Class byte
P1 field
P2 field
File type
-
Table 53 describes the R-APDU of the UpdateFileType command.
Table 53. R-APDU of the UpdateFileType command


50/88 DS9985 Rev 12

Table 53. R-APDU of the UpdateFileType command (continued)


5.8.5 SendInterrupt command

On receiving the SendInterrupt command, the M24SR02-Y generates a negative pulse on
the GPO pin. It starts at the end of the command and ends at the end of the RF response.
Before sending this command, the system file must be selected by issuing the System
Select command.
Table 54 defines the SendInterrupt command.
Table 54. SendInterrupt command format

- CLA INS P1&P2 Lc Data Le
Length 1 byte 1 byte 2 bytes 1 byte - -

Value 0xA2 0xD6 0x001E 0x00 - -
Table 55 describes the R-APDU of the SendInterrupt command.
Table 55. R-APDU of the SendInterrupt command

Data SW1 SW2 Comment

Value - 0x90 0x00 The interrupt has been sent
Value - 0x6A 0x80 The GPO is not configured as an interrupt mode
5.8.6 StateControl command

On receiving the StateControl command with reset value: data 0x00, the M24SR02-Y drives
the GPO pin low. On receiving the StateControl command with set value: data 0x01, the
M24SR02-Y releases the GPO pin, which returns to HZ.
Before sending this command, the system file must be selected by issuing the System
Select command.
Table 56 defines the StateControl command.
DS9985 Rev 12 51/88

78
Table 56. StateControl command format

- CLA INS P1&P2 Lc Data Le
Length 1 byte 1 byte 2 bytes 1 byte - -

Reset value 0xA2 0xD6 0x001F 0x01 0x00 -
Set value 0xA2 0xD6 0x001F 0x01 0x01 -
Table 57. R-APDU of the StateControl command


Value - 0x90 0x00 The set or reset has been sent
Value - 0x6A 0x80 The GPO is not configured in StateControl mode
5.9 Specific RF command set

This section describes the command set that can be issued only by the RF host.
5.9.1 Anticollision command set

Table 58 lists the commands that can be issued only by the RF host. The format of these
commands is described in the NFC Forum Digital Protocol specification.
Table 58. Commands issues by the RF host

Family command set Command name Instruction code
ALL_REQ 0x52 (1)

SENS_REQ 0x26 (1)
NFC-A technology SDD_REQ 0x93 or 0x95 or 0x97
SEL_REQ 0x93 or 0x95 or 0x97
SLP_REQ 0x50
1. Coded on 7 bits.
5.9.2 RATS command and ATS response

RATS command and ATS response are used for NFC Forum Type 4A Tag Platform Device
Activation (as defined in NFC Forum Digital Protocol specification).
Table 59 details the RATS command. This command must be sent after the anticollision
process.
52/88 DS9985 Rev 12

Table 59. RATS command

Name INS Param CRC
Byte field 0xE0 1 byte 2 bytes
Bit field - b7-b4 b3-b0 -
Instruction code
FSDI
DID (0 ≤ DID ≤ 14)
2 CRC bytes
The FSDI field codes the FSD that defines the maximum size that an RF or I²C host is able
to receive. Table 60 gives the conversion from FDSI to FSD.
Table 60. Conversion from FDSI to FSD

0x9h-
FSDI 0x0 0x1 0x2 0x3 0x4 0x5 0x6 0x7 0x8 0xF
0xE
FSD 16 24 32 40 48 64 96 128 256 RFU 256
The DID field defines the value of the addressed M24SR02-Y.
Table 61. ATS response

Name TL T0 TA(1) TB(1) TC(1) CRC
Byte field 0x05 0x78 1 byte 1 byte 0x02 2 bytes
Bit field - - - b8-b5 b4-b1 - -
Length of the ATS

response
FSCI = 256 bytes
The maximum ascending data rate is 106 kbps
The maximum descending data rate is 106 kbps
FWI field (9.6 ms when TB = 0x50)
SFGI field (302 µs when TB = 0x50)
The DID is supported
2 CRC bytes
The FSCI codes the FSC, which stands for the maximum frame size that the M24SR02-Y is
able to receive. The M24SR02-Y is able to receive up to 256 bytes of command. If the RF or
I²C host sends a command with more than 256 bytes, the M24SR02-Y will not be able to
treat the command and will not reply.
The FWI, which stands for the frame waiting time integer codes the FWT. This time
corresponds to the maximum duration while an RF or I²C host must wait before sending the
next command.
DS9985 Rev 12 53/88

78
The SFGI, which stands for the start-up frame guard time is the minimum time that the
reader must wait after receiving the response of the M24SR02-Y.
5.9.3 PPS command and response

PPS (protocol and parameter selection) command and response are defined in ISO/IEC
14443-4, in the protocol activation of PICC Type A.
The PPS command makes possible to change the data rates of the ascending (RF host to
M24SR02-Y) and descending (M24SR02-Y to RF host) data rates.
Table 62. PPS command

Name INS PPS0 PPS1 CRC
- Byte field 0xDX 0x11 1 byte 2 bytes
Bit field b7-b4 b3-b0 - 0b0000 b3-b2 b1-b0 -
Instruction code
INS
DID
- PPS1 is present
RFU
PPS1 Descending data rate
Ascending data rate
- 2 CRC bytes
The ascending and descending data rates must be coded as described in Table 63.
Table 63. Ascending and descending data rate coding

Value 0b00 0b01 0b10 0b11
Data rate 106 kbps RFU RFU RFU
When the M24SR02-Y is able to change both data rates, it returns the following response.
The data rate of this response is 106 kbps; then, the M24SR02-Y changes the ascending
and descending data rates.
Table 64 gives the details of the PPS response.
Table 64. PPS response

Name INS - PPS0
Byte field 0xDX - 0x11
Bit field b8-b5 b4-b1
Response code
DID field
2 CRC bytes
54/88 DS9985 Rev 12

5.10 Specific I²C command set

Table 65 lists the commands that can only be issued by the I²C host.
Table 65. Specific I²C commands

Command name Format Class byte Instruction code Brief description
Open an I²C session when the

GetI2Csession - - 0x26
RF session is not ongoing
Kill the RF session and open an
KillRFsession - - 0x52
I²C session
5.10.1 GetI2Csession command

The GetI2Csession command opens an I²C session if an RF session is not ongoing.
Table 66 defines the GetI2Csession command.
Table 66. GetI2Csession command format

- INS
Length 1 byte
Value 0x26
The GetI2Csession command does not create a reply.

When an RF session is ongoing, the M24SRxx will not acknowledge the command.
When no RF session is ongoing, the M24SRxx will acknowledge the command and open an
I²C session.
5.10.2 KillRFsession command

The KillRF session command closes the RF session and opens an I²C session.
Table 67 defines the KillRFsession command.
Table 67. KillRFsession command format

- INS
Length 1 byte
Value 0x52
The KillRFsession command does not create a reply. The RF session is closed when the
device acknowledges the command.
Caution: A successful completion of the RF command is not certain.
DS9985 Rev 12 55/88

78
RF device operation M24SR02-Y
6 RF device operation
6.1 Anticollision and Device activation command set for the RF

interface
The M24SR02-Y device supports the command set defined in the NFC-A Technology and
the Type 4A Tag Platform chapters of the NFC Digital Protocol V1.0 specification.
6.2 Open an RF session

Once the RF host has terminated the anticollision procedure and retrieve the ATS response,
it must send the SelectApplication command. The M24SR02-Y will open an RF session. At
this point, the RF host can send the applicative command set and the I²C cannot
communicate with the M24SR02-Y without closing first the RF session using the I2C
KillRFsession command.
6.3 Close an RF session

The RF host can close the RF session through one of these methods:
• send an S(DES) command
• turn off the RF field.
6.4 Applicative command set

The applicative command set is composed of the following command sets:
• the NFC Forum Type 4 Tag command set
• the ISO/IEC 7816-4 command set
• the proprietary command set.
56/88 DS9985 Rev 12

M24SR02-Y I2C device operation
7 I2C device operation
The M24SR02-Y device supports the I2C protocol. The device that controls the data transfer
is known as the bus master, and the other one as the slave device. A data transfer can only
be initiated by the bus master, which also provides the serial clock for synchronization. The
M24SR02-Y device is a slave in all communications.
7.1 I2C communication protocol

The I2C communication is built on a system of command and reply exchange. The I2C host
starts the communication by sending a request. Once a valid request is received by the
M24SR02-Y device, it carries out an internal operation and creates its answer.
As defined in this document, and except for the GetI2C session and Kill RF session
commands, the definition of a valid request is a command with a right CRC value.
Figure 12 shows an exchange of a command and a response between the I²C host and the
M24SR02-Y. Once the I²C session is open, the I²C host can send a command. The
command is composed of:
• a Device Select field with the R/W bit set to 0
• the command field.
The M24SR02-Y acknowledges on the reception of each byte.
Once the M24SR02-Y is ready to send the answer, the I²C host must:
• send a Device Select field with the R/W bit set to 1
• release the SDA line and send an SCL clock.
The I²C host must acknowledge on the reception of each byte.
Figure 12. Command and response exchange
,&EXV
5: 5:
6 'HYLFH6HOHFW &RPPDQG 3 6 'HYLFH6HOHFW 5HVSRQVH 3
069
Legend:
S is the I2C Start bit sequence
P is the I2C Stop bit sequence
R/W is the 8th bit of Device Select.
Note: A restart during a command and response exchange is not supported by the M24SR02-Y.
After a command, the I2C host can execute a Polling sequence to determine when the
response is available.
Polling sequence: Loop on < START (S) + DeviceSelect with RW=0 + read NACK/ACK
+ STOP (P) >
The response is available as soon as the M24SR02-Y sends an ACK ( host read will a
'0').
DS9985 Rev 12 57/88

78
I2C device operation M24SR02-Y
7.2 Start condition

A Start condition is identified by a falling edge of serial data (SDA) while the serial clock
(SCL) is stable in the high state. A Start condition must precede any data transfer command.
The device continuously monitors (except during an instruction processing) the SDA and the
SCL for a Start condition, and does not respond unless one is given.
7.3 Stop condition

A Stop condition is identified by a rising edge of serial data (SDA) while the serial clock
(SCL) is stable and driven high. A Stop condition terminates a command between the device
and the bus master.
7.4 I²C token release sequence

As explained in the M24SR02-Y session mechanism, the I²C communication is reserved to
the I²C host when the session token has the I²C value.
The following sequence explains how to release the I²C value of the session token.
I²C communication with the M24SR02-Y starts with a valid Start condition, followed by a
device select code.
If the delay between the Start condition and the following rising edge of the Serial Clock
(SCL) that samples the most significant of the Device Select exceeds the tSTART_OUT_MAX
time (see Table 78), the I²C logic block is reset and further incoming data transfer is ignored
until the next valid Start condition.
Figure 13. I²C token release sequence
!W67$57B287BPD[
6&/
6'$
065'HYLFH
6HOHFWFRGH
6WDUW 6WRS
FRQGLWLRQ FRQGLWLRQ
06Y9
Note: If the above delay is below tSTART_OUT_min (see Table 78), I2C session token stays
unmodified.
If the delay is between tSTART_OUT_min and tSTART_OUT_max, I2C session token might or not
be released. This range of delay is not authorized for safe operation.
58/88 DS9985 Rev 12

7.5 I²C timeout on clock period

During a data transfer on the I2C bus, if the serial clock high pulse or serial clock low pulse
exceeds tCL_RESET value that is the maximum value specified in Table 78, the I2C logic
block is reset and any further incoming data transfer is ignored until the next valid Start
condition.
If the serial clock high pulse is under the maximum value of tCHCL and the serial clock low
pulse is under the maximum value of tCLCH in Table 78, the I2C logic block is not reset.
For proper operation, the serial clock high pulse must not be higher than tCHCL and lower
than tCL_RESET, and the serial clock low pulse must not be higher than tCHCH and lower
tCL_RESET.
7.6 Acknowledge bit (ACK)

The acknowledge bit is used to indicate a successful byte transfer. The bus transmitter,
whether a bus master or a slave device, releases the serial data (SDA) after sending eight
bits of data. During the 9th clock pulse period, the receiver pulls the SDA low to
acknowledge the receipt of the eight data bits.
7.7 Data input

During data input, the device samples serial data (SDA) on the rising edge of the serial clock
(SCL). For a correct device operation, the SDA must be stable during the rising edge of the
SCL, and the SDA signal must change only when the SCL is driven low.
7.8 I²C device address

The device address is the concatenation of the group number coded on 4 bits and the I2C
address coded on 3 bits, as shown in Table 68.
Table 68. I2C device address format

b7-b4 b3 b2 b1 b0
-
0b1010 1 1 0 0bx
Group number
E2 bit
E1 bit
E0 bit
0 = Request
1 = Answer
DS9985 Rev 12 59/88

78
7.9 I²C frame format

The I2C frame is composed of three fields:
1. SOD field: contains the device select and the PCB. The PCB field is detailed in
Section 5.2.
2. Payload field: contains the command and its parameter, as defined in the I2C command
set.
3. EOD field: contains the two CRC bytes computed on the SOD but excluding the device
select byte field.
Table 69 shows the format of an I2C frame.
Table 69. I2C frame format

SOD Payload EOD
I2C frame
0xAC or 0xAD 1 byte 1 to 251 bytes 2 bytes
Device select
0xAC: to send a request to the M24SR02-Y
0xAD: to read a response of the M24SR02-Y
PCB field
I2C command or I2C answer
2 CRC bytes
7.9.1 Example of I²C frame commands

NDEF Tag Application command
This example presents the I2C frame of an NDEF Tag Application Select command. The I2C
frame is detailed in Table 70.
Table 70. I2C host to M24SR02-Y

Field SOD Payload EOD
Value 0xAC 0x02 or 0x03 Command field 35 C0 or DF BE
Device select
PCB field
0x00 A4 04 00 07 D2 76 00 00 85 01 01 00
2 CRC bytes
Before sending a new command, the I2C host can send an I2C frame to read the
M24SR02-Y answer to the NDEF tag Application Select command.
60/88 DS9985 Rev 12

Table 71. M24SR02-Y to I2C host

SOD Payload EOD
Field
I2C host to M24SR02-Y M24SR02-Y to I2C host
Value 0xAD 0x02 or 0x03 0x90 00 F1 09 or 2D 53
Device select
PCB field
I2C command
2 CRC bytes
Figure 14 shows the I2C frame of the NDEF tag Application Select command.
Figure 14. NDEF tag Application Select command
6WDUWRIWKH
WUDQVPLVVLRQ
RIWKHUHTXHVW
,ð&EXV
6 $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. $&. $&.
ϬǆϬϮ ϬǆϬϬ Ϭǆϰ ϬǆϬϰ ϬǆϬϬ ϬǆϬϳ ϬǆϮ Ϭǆϳϲ ϬǆϬϬ ϬǆϬϬ Ϭǆϴϱ ϬǆϬϭ ϬǆϬϭ ͘͘͘
Ϭǆ Ϭ
,ð&EXV (QGRIWKH
WUDQVPLVVLRQ
$&. $&. $&.
RIWKHUHTXHVW
͘͘͘ [
[ [&
W
6WDUWRIWKH
WUDQVPLVVLRQ
RIWKHDQVZHU
,ð&EXV ŶĚŽĨƚŚĞ
ƚƌĂŶƐŵŝƐƐŝŽŶ
^ < < < < < < ŽĨƚŚĞƌĞƋƵĞƐƚ
Ϭǆ ϬǆϬϮ ϬǆϵϬ ϬǆϬϬ Ϭǆ&ϭ ϬǆϬϵ ͘͘͘
W
/HJHQG $&. $&.

$FNQRZOHGJHE\065[[< $FNQRZOHGJHE\WKH,ð&KRVW
[ %\WHVHQWE\WKH,ð&KRVW [ %\WHVHQWE\WKH065[[<
6
6WDUWVHQWE\WKH,ð&KRVW 6WRSVHQWE\WKH,ð&KRVW
3
069
DS9985 Rev 12 61/88

78
7.10 Open an I²C session

To open an I²C session, the I²C host must send either the GetSession command or the
KillRFsession command. The GetSession Command opens an I²C session if an RF session
in not currently opened.
A KillRFsession command closes the current RF session if it exists, and opens an I²C
session.
When an I²C session is opened, the RF host cannot communicate with the M24SR02-Y and
cannot close the I²C session.
7.11 Close the I²C session

There are four ways to close an I²C session:
• turn off the Vcc power supply
• send the I²C token release sequence
• wait for the I²C watchdog when it is enabled
• wait for the I²C timeout on clock period.
62/88 DS9985 Rev 12

M24SR02-Y Functional procedures
8 Functional procedures
This section describes some procedure to access the memory or manage its protection.
8.1 Selection of an NDEF message

The RF or I²C host must use this procedure to detect the NDEF message inside an
M24SR02-Y.
The NDEF detection procedure is as follows:
1. Open an RF or an I²C session
2. Send the SelectNDEFTagApplication command
3. Select the CC file
4. Read the CC file
5. Select the NDEF file
8.2 Reading of an NDEF message

The RF or I²C host executes the NDEF read procedure to read the NDEF file.
1. Detect successfully the NDEF file using the NDEF detection procedure
2. Check that the read access without any security is granted for the NDEF file from the
information provided by the CC file
4. Read the NDEF file
Note: Reading the NDEF file must not go beyond the NDEF Length field (NLEN), which indicates
the size of the NDEF message stored in the NDEF file.
8.3 Reading a locked NDEF file

The RF or I²C host executes this procedure to read an NDEF file that has been previously
locked.
1. Select the NDEF Tag Application
3. Verify the Read password by using the Verify command
4. Read the data in the NDEF file
DS9985 Rev 12 63/88

78
Functional procedures M24SR02-Y
8.4 Locking an NDEF file

The RF or I²C host executes this procedure to protect an NDEF file.
2. Check the right access provided by the CC file
4. Transmit the NDEF file Write password by using the Verify command
5. Lock the NDEF file by sending the Enable verification command.
8.5 Unlocking an NDEF file

The RF or I²C host executes this procedure to unlock an NDEF file that has been previously
locked.
3. Verify the NDEF file Write password or the I²C password by using the Verify command
4. Unlock the NDEF file by sending the Disable verification command.
8.6 Reaching the read-only state for an NDEF file

The RF or I²C host executes this procedure to reach the read-only state for an NDEF file.
3. Transmit the NDEF file Write password or the I²C password by using the Verify
command
4. Send an EnablePermanentState command as the Write access right of the previous
Select NDEF file.
8.7 Changing an NDEF password procedure

The RF or I²C host could use this procedure to change one NDEF password. it can be a
Read or Write password.
3. Transmit the NDEF file Write password or the I²C password by using the Verify
command
4. Change the password by sending a ChangeReferenceData command.
64/88 DS9985 Rev 12

M24SR02-Y Functional procedures
8.8 Changing a File type Procedure

The RF or I²C host executes this procedure to change the File Type of a file for which all
access rights were previously granted.
2. Select the File to be modified
3. Set the File Length to 0x00 using the UpdateBinary command
4. Send an UpdateFileType command with the New file Type as data.
8.9 Updating an NDEF file

When there's enough space in the file to update it with new content, the following steps must
be followed to update the NDEF message:
3. Unlock the NDEF file if necessary
4. Write the NDEF length to 0x0000 with the Update Binary command.
5. Write the NDEF message in the NDEF message field using one or more Update Binary
commands.
6. Write the NDEF length of the NDEF message using the Update Update command.
It is recommended the NDEF length is read back and checked against the desired value to
ensure the Update sequence has been correctly performed.
DS9985 Rev 12 65/88

78
UID: unique identifier M24SR02-Y
9 UID: unique identifier
The M24SR02-Y is uniquely identified by a 7-byte unique identifier (UID). The UID is a
read-only code and comprises:
• the IC manufacturer code on 1 byte (0x02 for STMicroelectronics)
• the product code on 1 byte
• a device number on 5 bytes.
Table 72 describes the UID format.
Table 72. UID format

- 0x02 0x82 5 bytes
IC manufacturer code
M24SR02-Y product code
Device number
66/88 DS9985 Rev 12

M24SR02-Y Maximum ratings
10 Maximum ratings
Stressing the device above the ratings listed in Table 73 may cause permanent damage to
the device. These are stress ratings only and operation of the device at these or any other
conditions above those indicated in the operating sections of this specification is not implied.
Exposure to absolute maximum rating conditions for extended periods may affect the device
reliability.
Table 73. Absolute maximum ratings

Symbol Parameter Min. Max. Unit
TA Ambient operating temperature -40 85 °C

15 25 °C
TSTG, hSTG, Sawn wafer on (1)
Storage conditions 9 months
tSTG UV tape
Kept in its original packing form
UFDFPN8, SO8,
TSTG Storage temperature –65 150 °C
TSSOP8
Storage temperature Sawn bumped 15 25 °C
TSTG wafer (kept in its
Storage time antistatic bag) 9 months
Lead temperature UFDFPN8, SO8,

TLEAD See note (2) °C
during soldering TSSOP8
VIO I2C input or output range and GPO -0.50 6.5 V
(3)
ICC RF supply current AC0 - AC1 - 100 mA
RF input voltage
(3) amplitude between AC0
VMAX_1 VAC0-VAC1 - 10 V
and AC1, GND pad left
floating
AC voltage between
VAC0-GND or
VMAX_2 (3) AC0 and GND, or AC1 -0.5 4.5 V
VAC1-GND
and GND
Electrostatic discharge
VESD voltage (human body AC0-AC1 - 1000 V
model) (4)
Electrostatic discharge
VESD voltage (human body Other pads - 3500 V
model) (4)
1. Counted from ST shipment date.
2. Compliant with JEDEC Std J-STD-020D (for small body, Sn-Pb or Pb assembly), the ST ECOPACK
7191395 specification, and the European directive on Restrictions on Hazardous Substances (ROHS
directive 2011/65/EU, July 2011).
3. Based on characterization, not tested in production. Maximum adsorbed power = 100 mW @ 7.5 A/m
4. AEC-Q100-002 (compliant with JEDEC Std JESD22-A114A, C1 = 100 pF, R1 = 1500 Ω, R2 = 500 Ω)
DS9985 Rev 12 67/88

78
I2C DC and AC parameters M24SR02-Y
11 I2C DC and AC parameters
This section summarizes the operating and measurement conditions, and the DC and AC
characteristics of the device in I2C mode. The parameters in the DC and AC characteristic
tables that follow are derived from tests performed under the measurement conditions
summarized in the relevant tables. Designers must check that the operating conditions in
their circuit match the measurement conditions when relying on the quoted parameters.
Table 74. I2C operating conditions

VCC Supply voltage 2.7 5.5 V

TA Ambient operating temperature – 40 85 °C
Table 75. AC test measurement conditions

CL Load capacitance 100 pF

tr, tf Input rise and fall times - 50 ns
Vhi-lo Input levels 0.2 VCC to 0.8 VCC V
Vref(t) Input and output timing reference levels 0.3 VCC to 0.7 VCC V
Figure 15. AC test measurement I/O waveform
,QSXWOHYHOV ,QSXWDQGRXWSXW
WLPLQJUHIHUHQFHOHYHOV
9FF
9FF
9FF
6CC
069
Table 76. Input parameters

CIN Input capacitance (SDA) - 8 pF

CIN Input capacitance (other pins) - 6 pF
tNS Pulse width ignored (Input filter on SCL and SDA) - 80 ns
68/88 DS9985 Rev 12

M24SR02-Y I2C DC and AC parameters
Table 77. I2C DC characteristics

Symbol Parameter Test condition Min. Max. Unit
Input leakage current VIN = VSS or VCC

ILI - ±2 µA
(SCL, SDA) device in Standby mode
SDA in Hi-Z, external voltage applied on
ILO Output leakage current - ±2 µA
SDA: VSS or VCC
VCC = 3.3 V, with RF ON - 30
Standby power mode supply VCC = 3.3 V, with RF OFF - 5

ICC0 µA
current VCC = 5.5 V, with RF ON (1)
- 30
VCC = 5.5 V, with RF OFF - 5
VCC = 3.3 V, with RF ON - 150
Supply current VCC = 3.3 V, with RF OFF - 150

ICC1 µA
(I2C Session open) VCC = 5.5 V, with RF ON - 150
VCC = 5.5 V, with RF OFF - 150
(3)
VCC = 3.3 V (fC = 1 MHz), with RF ON - 250
VCC = 3.3 V (fC = 1 MHz), with RF OFF (3)
Supply current (2) - 200
ICC2 µA
(Read binary) VCC = 5.5 V (fC = 1 MHz), with RF ON (3)
- 250
VCC = 5.5 V (fC = 1 MHz), with RF OFF (3) - 200
VCC = 3.3 V (fC = 1 MHz), with RF ON (3)
- 550
VCC = 3.3 V (fC = 1 MHz),with RF OFF (3)
Supply current (2) - 500
ICC3 µA
(Update binary) VCC = 5.5 V (fC = 1 MHz), with RF ON (3)
- 550
VCC = 5.5 V (fC = 1 MHz), with RF OFF (3) - 500
VCC = 2.7 V
VIL Input low voltage (SDA, SCL) -0.45 0.3 VCC V
VCC = 5.5 V
VCC = 2.7 V
VIH Input high voltage (SDA, SCL) 0.7 VCC 6.5 V
VCC = 5.5 V
VCC = 2.7 V
VIL Input low voltage (RF disable) - 0.45 V
VCC = 5.5 V
VCC = 2.7 V
VIH Input high voltage (RF disable) 1.4 - V
VCC = 5.5 V
Output low voltage (SDA) IOL = 3 mA, VCC = 5.5 V - 0.4 V
VOL
Output low voltage (GPO) IOL = 1 mA, VCC = 2.7 to 5.5 V - 0.4 V
1. When an RF session is Opened, Icc corresponds to the standby power mode.
2. Characterized only.
3. Input levels as defined in Figure 15.
DS9985 Rev 12 69/88

78
Table 78. I2C AC characteristics (400 kHz)

Test conditions specified in Table 74
(preliminary data based on design simulations)
Symbol Alt. Parameter Min. Max. Unit
fC fSCL Clock frequency 0.05 400 kHz

tCHCL (1) tHIGH Clock pulse width high 0.6 20000 µs
(2)
tCLCH tLOW Clock pulse width low 1.3 20000 µs
tCL_reset - Clock reset 40000 - µs
(3) (3)
tXH1XH2 tR Input signal rise time ns
(3) (3)
tXL1XL2 tF Input signal fall time ns
tDL1DL2 tF SDA (out) fall time 20 300 ns
tDXCX tSU:DAT Data in set up time 100 - ns
tCLDX tHD:DAT Data in hold time 0 - ns
tCLQX(4) tDH Data out hold time 100 - ns
(5)
tCLQV tAA Clock low to next data valid (access time) - 900 ns
tCHDX (6) tSU:STA Start condition set up time 600 - ns
tDLCL tHD:STA Start condition hold time 600 - ns
tCHDH tSU:STO Stop condition set up time 600 - ns
tDHDL tBUF Time between Stop condition and next Start condition 1300 - ns
I²C write time in one page - 5 ms
tW tWR
I²C write time up to 246 bytes - 90 ms
tNS (7) - Pulse width ignored (input filter on SCL and SDA) - 80 ns
tSTART_OUT - Delay for I²C token release 20 40 ms
1. tCHCL timeout.
2. tCLCH timeout.
3. There is no min. or max. value for the input signal rise and fall times. It is however recommended by the I²C specification that the input
signal rise and fall times be more than 20 ns and less than 300 ns when fC < 400 kHz.
4. To avoid spurious Start and Stop conditions, a minimum delay is placed between SCL=1 and the falling or rising edge of
SDA.
5. tCLQV is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8VCC in a compatible way with the
I2C specification (which specifies tSU:DAT (min) = 100 ns), assuming that the Rbus × Cbus time constant is less than 500 ns
(as specified in Figure 16).
6. For a restart condition, or following a write cycle.
7. Characterized only, not tested in production.
70/88 DS9985 Rev 12

Table 79. I2C AC characteristics (1 MHz)

Test conditions specified in Table 74
(preliminary data based on design simulations)
Symbol Alt. Parameter Min. Max. Unit
fC fSCL Clock frequency 0.05 1000 kHz

(1)
tCHCL tHIGH Clock pulse width high 260 - ns
tCLCH (2) tLOW Clock pulse width low 500 - ns
(3) (3)
tXH1XH2 tR Input signal rise time ns
(3) (3)
tXL1XL2 tF Input signal fall time ns
tDL1DL2 tF SDA (out) fall time 20 120 ns
tDXCX tSU:DAT Data in set up time 50 - ns
tCLDX tHD:DAT Data in hold time 0 - ns
tCLQX tDH Data out hold time 100 - ns
(4)(5)
tCLQV tAA Clock low to next data valid (access time) - 450 ns
tCHDX (6) tSU:STA Start condition set up time 250 - ns
tDLCL tHD:STA Start condition hold time 250 - ns
tCHDH tSU:STO Stop condition set up time 250 - ns
Time between Stop condition and next Start
tDHDL tBUF 500 - ns
condition
I²C write time in one page - 5 ms
tW tWR
I²C write time up to 246 bytes - 90 ms
Pulse width ignored (input filter on SCL and
tNS (7) - - 80 ns
SDA)
1. tCHCL timeout.
2. tCLCH timeout.
3. There is no min. or max. value for the input signal rise and fall times. It is however recommended by the I²C
specification that the input signal rise and fall times be less than 120 ns when fC < 1 MHz.
4. To avoid spurious Start and Stop conditions, a minimum delay is placed between SCL = 1 and the falling or
rising edge of SDA.
5. tCLQV is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8VCC in a
compatible way with the I2C specification (which specifies tSU:DAT (min) = 100 ns), assuming that the Rbus
× Cbus time constant is less than 500 ns (as specified in Figure 16).
6. For a reStart condition, or following a write cycle.
7. Characterized only, not tested in production.
DS9985 Rev 12 71/88

78
Figure 16. I2C AC waveforms
W;/;/ W&+&/
W;+;+ W&/&+
6&/
W'/&/ W;/;/
6'$,Q
W&+'/ W;+;+ W&/'; 6'$ W';&+ W&+'+ W'+'/

6WDUW 6'$ &KDQJH 6WRS 6WDUW
FRQGLWLRQ ,QSXW FRQGLWLRQ FRQGLWLRQ
6&/
6'$,Q W:
W&+'+ W&+'/
6WRS :ULWHF\FOH 6WDUW
FRQGLWLRQ FRQGLWLRQ
W&+&/
6&/
W&/49 W&/4; W4/4/
6'$2XW 'DWDYDOLG 'DWDYDOLG
069
72/88 DS9985 Rev 12

11.1 I2C timing measurement condition

Figure 17 represents the maximum Rbus value versus bus parasitic capacitance (Cbus) for
an I2C bus at maximum frequency fC = 400 kHz.
Figure 17. Maximum Rbus value with fC = 400 kHz

"US LINE PULL UP RESISTOR
4HE 2 BUS X #BUS TIME CONSTANT

MUST BE BELOW THE NS 6##
TIME CONSTANT LINE REPRESENTED
K
2 ON THE LEFT
BU
S §
#
BU 2BUS
(ERE 2BUS § #BUS NS S

K½
NS
)£# BUS 3#,
-XXX
MASTER
3$!
P&
#BUS

"US LINE CAPACITOR P&
AIB
Figure 18 represents the Maximum Rbus value versus bus parasitic capacitance (Cbus) for
an I2C bus at maximum frequency fC = 1 MHz.
Figure 18. Maximum Rbus value with fC = 1 MHz
6##
"US LINE PULL UP RESISTOR K
2BUS
2 4HE 2BUS § #BUS TIME CONSTANT
BUS § MUST BE BELOW THE NS
#
BUS 3#,
NS TIME CONSTANT LINE REPRESENTED )£# BUS -XXX
ON THE LEFT MASTER
3$!
(ERE
2 BUS § #BUS NS
#BUS

"US LINE CAPACITOR P&
-36
DS9985 Rev 12 73/88

78
Figure 19. I2C bus protocol
6&/
6'$
6'$ 6'$
6WDUW ,QSXW &KDQJH 6WRS
FRQGLWLRQ FRQGLWLRQ
6&/

6'$
06% $&.
6WDUW
FRQGLWLRQ

6&/
6'$
06% $&.
6WRS
FRQGLWLRQ
-36
Table 80. Device select code

Device type identifier (1) Chip Enable address RW
b7 b6 b5 b4 b3 b2 b1 b0
1 0 1 0 1 1 0 RW
1. The most significant bit, b7, is sent first.
74/88 DS9985 Rev 12

M24SR02-Y GPO parameters
12 GPO parameters
This section lists the timing of the GPO according to its configuration.
Table 81. GPO timings measurement (1)

GPO field I/F Condition Command Symbol Typ. Unit
(2)
GPO low when Kill session 15
I2C CmdSTPtoGPlow µs
session active Get session 15(2)
0xX1
I2C token release
I2C GPO return HZ AnswerlbLBtoGPHZ 105 ns
Session open sequence
GPO low when
RF NDEF select CmdEOFtoGPlow 170
0x1X session active µs
RF GPO return HZ Deselect CmdEOFtoGPHZ 370
2C
I CmdSTPtoGPlow 45 µs
GPO low when
Update Binary Writing time duration
0xX2 I2C programming 5 ms
(No time extension)
WIP
RF CmdEOFtoGPlow 75 µs
GPO low when
Update Binary Writing time duration
0x2X RF programming 5 ms
(No time extension)
GPO low when a ReadBinary 55 µs
I2C command is or CmdSTPtoGPlow or
Answer ready 0xX3 computed UpdateBinary 5 ms
GPO return HZ on After NewCmdlbFB
I2C All commands 105 ns
new command or AnswerlbFB
GPO low when UpdateBinary
RF CmdEOFtoGPlow 75 µs
Message in modifying NDEF (Msg Length #0)
0x3X
progress GPO low when Writing time duration
RF UpdateBinary 5 ms
modifying NDEF (No time extension)
GPO low after
I2C receiving an SendInterrupt CmdSTPtoGPlow 50 µs
0xX4 Interrupt command
After NewCmdlbFB
Interrupt I2C GPO return HZ All commands 105 ns
or AnswerlbFB
RF GPO low after CmdEOFtoGPlow 75
0x4X receiving an SendInterrupt µs
RF Interrupt command Pulse duration 540
DS9985 Rev 12 75/88

78
GPO parameters M24SR02-Y
Table 81. GPO timings measurement (1) (continued)

GPO field I/F Condition Command Symbol Typ. Unit
GPO low when

I2C Reset GPO CmdSTPtoGPlow 40
reset
0xX5
GPO return HZ
I2C Set GPO CmdSTPtoGPHZ 40
when set
State control
GPO low when
RF Reset GPO CmdEOFtoGPlow 60
reset
0x5X
GPO return HZ
RF Set GPO CmdEOFtoGPHZ 60
when set
Anticollision µs
command or start
GPO low after
of RF disturb
RF receiving an RF CmdSOFtoGPlow 6
(command using
command
another RF
RF busy 0x6X protocol)
Deselect or end of
GPO return HZ
RF disturb
after deselection or
RF (command using CmdEOFtoGPHZ 460
RF command in
another RF
another protocol
protocol)
1. Characterized only.
2. Add 100 µs for boot after POR.
76/88 DS9985 Rev 12

M24SR02-Y Write cycle definition
13 Write cycle definition
Table 82. Write cycle definition(1)

Symbol Parameter Test Conditions Min Max Units
Write cycle TA ≤ 25 °C, VCC(min) < VCC < VCC(max) - 1,000,000

Ncycle Write cycle
endurance(2) TA ≤ 85 °C, VCC(min) < VCC < VCC(max) - 600,000
1. A write cycle is calculated per byte, and corresponds to a write to this byte.
2. Write cycle endurance is defined by characterization and qualification.
DS9985 Rev 12 77/88

78
RF electrical parameters M24SR02-Y
14 RF electrical parameters
This section summarizes the operating and measurement conditions, and the DC and AC
characteristics of the device in RF mode.
The parameters in the following tables are derived from tests performed under the
measurement conditions summarized in the relevant tables. Designers have to check that
the operating conditions in their circuit match the measurement conditions when relying on
the quoted parameters.
Table 83. Default operating conditions

TA Ambient operating temperature –40 85 °C
Table 84. RF characteristics (1)

Symbol Parameter Condition Min Typ Max Unit
fC External RF signal frequency 13.553 13.560 13.567 MHz

H_ISO Operating field according to ISO TA = 0 °C to 50 °C 1500 - 7500 mA/m
Operating field in extended
H_Extended TA = -40 °C to 85 °C 500 - 7500 mA/m
temperature range
MICARRIER 100% carrier modulation index MI=(A-B)/(A+B) 90 - 100 %
t1 Pause A length - 28 / fC - 40.5 / fC
t2 Pause A low time - 7 / fC - t1
µs
t3 Pause A rise time - 1.5 x t4 - 16 / fC
t4 Pause A rise time section - 0 - 6 / fC
Minimum time from carrier
tMIN CD From H-field min - - 5
generation to first data
ms
RF write time (including internal
Wt - - 6 -
verify) for one page
CTUN Internal tuning capacitor in SO8 (2) fC = 13.56 MHz 22.5 25 27.5 pF
tRF_OFF RF OFF time Chip reset - - 5 ms
1. All timing characterizations are performed on a reference antenna with the following characteristics:
External size: 75 mm x 48 mm
Number of turns: 6
Width of conductor: 0.6 mm
Space between two conductors: 0.6 mm
Value of the tuning capacitor in SO8: 25 pF (M24SR02-Y)
Value of the coil: 5 µH
Tuning frequency: 14.2 MHz.
2. Characterized only, at room temperature only, measured at VAC0-VAC1 = 2 V peak to peak at 13.56 MHz.
78/88 DS9985 Rev 12

M24SR02-Y Package information
15 Package information
In order to meet environmental requirements, ST offers these devices in different grades of

ECOPACK packages, depending on their level of environmental compliance. ECOPACK
specifications, grade definitions and product status are available at: www.st.com.
ECOPACK is an ST trademark.
15.1 SO8N package information

Figure 20. SO8N - 8-lead plastic small outline, 150 mils body width, package outline
H X
! !
C
CCC
B
E
PP
$ *$8*(3/$1(
K

% %
,
!
,
62$B9
1. Drawing is not to scale.
package data
millimeters inches (1)
Symbol
Min Typ Max Min Typ Max
A - - 1.750 - - 0.0689
A1 0.100 - 0.250 0.0039 - 0.0098
A2 1.250 - 0.0492 - -
b 0.280 - 0.480 0.0110 - 0.0189
c 0.170 - 0.230 0.0067 - 0.0091
D 4.800 4.900 5.000 0.1890 0.1929 0.1969
E 5.800 6.000 6.200 0.2283 0.2362 0.2441
E1 3.800 3.900 4.000 0.1496 0.1535 0.1575
e - 1.270 - - 0.0500 -
h 0.250 - 0.500 0.0098 - 0.0197
k 0° - 8° 0° - 8°
L 0.400 - 1.270 0.0157 - 0.0500
DS9985 Rev 12 79/88

84
Package information M24SR02-Y
package data (continued)
Symbol
L1 - 1.040 - - 0.0409 -
ccc - - 0.100 - - 0.0039
1. Values in inches are converted from mm and rounded to four decimal digits.
Figure 21. SO8N - 8-lead plastic small outline, 150 mils body width,
package recommended footprint
[

2B621B)3B9
80/88 DS9985 Rev 12

15.2 TSSOP8 package information

Figure 22. TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,
package outline

ϴ ϱ
Đ
ϭ
ϭ ϰ
ϭ >
Ϯ
W >ϭ
ď Ğ
76623$0B9

/
Table 86. TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm, 0.65 mm pitch,
package mechanical data
Symbol
Typ Min Max Typ Min Max
A - - 1.200 - - 0.0472
A1 0.050 - 0.150 0.0020 - 0.0059
A2 0.800 1.000 1.050 0.0315 0.0394 0.0413
b 0.190 - 0.300 0.0075 - 0.0118
c 0.090 - 0.200 0.0035 - 0.0079
CP - - 0.100 - - 0.0039
D 2.900 3.000 3.100 0.1142 0.1181 0.1220
e - 0.650 - - 0.0256 -
E 6.200 6.400 6.600 0.2441 0.2520 0.2598
E1 4.300 4.400 4.500 0.1693 0.1732 0.1772
L 0.450 0.600 0.750 0.0177 0.02636 0.0295
L1 - 1.000 - - 0.0394 -
α 0° 8° 0° - 8°
DS9985 Rev 12 81/88

84
Package information M24SR02-Y
15.3 UFDFPN8 package information

Figure 23. UFDFPN8 - 8-lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch
dual flat package outline
' $ %
1
$
FFF
$
3LQ &
,'PDUNLQJ
( HHH &
6HDWLQJSODQH $
6LGHYLHZ
[ DDD &
[ DDD &
7RSYLHZ
' 'DWXP$
H E

/
/ / /
3LQ
,'PDUNLQJ (
H /
H 7HUPLQDOWLS
.
/ 'HWDLO³$´
(YHQWHUPLQDO
1'[ H
%RWWRPYLHZ 6HH'HWDLO³$´
=:EB0(B9
1. Max package warpage is 0.05 mm.

2. Exposed copper is not systematic and can appear partially or totally according to the cross section.
4. The central pad (the area E2 by D2 in the above illustration) must be either connected to VSS or left floating
(not connected) in the end application.
82/88 DS9985 Rev 12

Table 87. UFDFPN8 - 8- lead, 2 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch
dual flat package mechanical data
Symbol
A 0.450 0.550 0.600 0.0177 0.0217 0.0236

A1 0.000 0.020 0.050 0.0000 0.0008 0.0020
b(2) 0.200 0.250 0.300 0.0079 0.0098 0.0118
D 1.900 2.000 2.100 0.0748 0.0787 0.0827
D2 (rev MC) 1.200 - 1.600 0.0472 - 0.0630
E 2.900 3.000 3.100 0.1142 0.1181 0.1220
E2 (rev MC) 1.200 - 1.600 0.0472 - 0.0630
e - 0.500 - - 0.0197 -
K (rev MC) 0.300 - - 0.0118 - -
L 0.300 - 0.500 0.0118 - 0.0197
L1 - - 0.150 - - 0.0059
L3 0.300 - - 0.0118 - -
aaa - - 0.150 - - 0.0059
bbb - - 0.100 - - 0.0039
ccc - - 0.100 - - 0.0039
ddd - - 0.050 - - 0.0020
(3)
eee - - 0.080 - - 0.0031
2. Dimension b applies to plated terminal and is measured between 0.15 and 0.30 mm from the terminal tip.
3. Applied for exposed die paddle and terminals. Exclude embedded part of exposed die paddle from
measuring.
DS9985 Rev 12 83/88

84
Ordering information M24SR02-Y
16 Ordering information
Example: M24 SR 02- Y MN 6 T /2
Device type
M24 = I2C interface device
Device feature
SR = Short range
Memory size
02 = memory size in Kbits
Voltage range
Y = 2.7 to 5.5 V
Package
MN = SO8N
DW = TSSOP8
MC = UFDFPN8
SG12I = 120 µm ± 15 µm bumped and sawn inkless wafer on 8-inch frame
U = unsawn wafer 725 µm ± 20 µm
Device grade
6 = industrial: device tested with standard test flow over –40 to 85 °C
(no parameter for SG12I)
Option
T = Tape and reel packing
(no parameter for SG12I)
Capacitance
/2 = 25 pF
Note: Parts marked as “ES”, “E” or accompanied by an Engineering Sample notification letter, are
not yet qualified and therefore not approved for use in production. ST is not responsible for
any consequences resulting from such use. In no event will ST be liable for the customer
using any of these engineering samples in production. ST Quality has to be contacted prior
to any decision to use these Engineering samples to run qualification activity.
84/88 DS9985 Rev 12

M24SR02-Y Revision history
17 Revision history
Table 88. Document revision history

Date Revision Changes
29-Oct-2013 1 Initial release.

Added a note to Section 7.1: I2C communication protocol below
09-Nov-2013 2
Figure 12: Command and response exchange.
Changed the datasheet status from “Preliminary data” to “Production
data”.
Restored the whole content of Table 77: I2C DC characteristics.
Updated the capacitor values in Section 2.5.1: Operating supply voltage
VCC.
Removed bullet (4) from Section 8.6: Reaching the read-only state for an
NDEF file.
Updated VESD value in Table 73: Absolute maximum ratings, ICC
values in Table 77: I2C DC characteristics, and H_Extended value in
20-Dec-2013 3 Table 84: RF characteristics.
Added details to “S(WTX)” bullet in Section 5.4: S-Block format.
Added sentences to Section 5.6.8: UpdateBinary command and to
Section 5.8.3: DisablePermanentState command.
Changed ‘0x001E’ value into ‘0x001F’ in Table 56: StateControl
command format.
Updated values in Table 61: ATS response.
Added Note (4) to Figure 10: Changing the read access right to an
NDEF file and Figure 11: Changing the write access right to an NDEF
file.
Updated Figure 5: GPO configured as I2C answer ready (GPO field =
0xX3) and Figure 8: GPO configured as State control (GPO field = 0xX5
or 0x5X).
Added I2C text to the Note below Table 22: S-Block detailed format.
Edited the third paragraph of Section 5.8.1: ExtendedReadBinary
command.
Added Section 5.8.4: UpdateFileType command and Section 8.8:
Changing a File type Procedure.
Updated bullet 3 in Section 7.9: I²C frame format, and the Payload row
28-Feb-2014 4 of Table 70: I2C host to M24SR02-Y. Updated bullet 2 in Section 7.11:
Close the I²C session.
Edited VIO row and removed VESD (machine model) row from Table 73:
Absolute maximum ratings.
Updated ICC rows and added a Note to Table 77: I2C DC characteristics.
Updated Figure 20: SO8N - 8-lead plastic small outline, 150 mils body
width, package outline.
Fixed a typo in Figure 23: UFDFPN8 - 8-lead, 2 x 3 mm, 0.5 mm pitch
ultra thin profile fine pitch dual flat package outline title: UFDPFN8
changed into UFDFPN8.
DS9985 Rev 12 85/88

87
Revision history M24SR02-Y
Table 88. Document revision history (continued)

Added data for automotive grade in Table 6: Field list and Table 72: UID
format
Added WFDFPN8 package for automotive grade under qualification
Added Figure 24: WFDFPN8 (MLP8) 8-lead, 2 x 3 mm, 0.5 mm pitch
very thin fine pitch dual flat package outline
04-Jun-2014 5 Added Table 88: WFDFPN8 8-lead thin fine pitch dual flat package no
lead mechanical data
Added MF = WFDFPN8 inside Table 88: Ordering information scheme
for packaged devices
Inserted byte <04> between A4 and 00 inside Table 26: C-APDU of the
NDEF Tag Application Select command
Added
– Table 7: Details about I2C watchdog
– Table 82: Write cycle definition
– Section 13: Write cycle definition
04-May-2016 6 Updated:
– Features
– Section 2.7.6: State control configuration (GPO field = 0xX5 or 0x5X)
– Table 73: Absolute maximum ratings
– Table 74: I2C operating conditions
Updated:
– Section 2.7.1: Session Open configuration (GPO field = 0xX1 or 0x1X)
– Section 4.2.2: I2C token
– Section 7.4: I²C token release sequence
08-Aug-2016 7 – Figure 13: I²C token release sequence
– Section 7.5: I²C timeout on clock period
– Section 7.11: Close the I²C session
– Table 78: I2C AC characteristics (400 kHz)
– Table 81: GPO timings measurement
Updated:
– Section 3.2.2: Changing the read access right to NDEF files
– Section 3.2.3: Changing the write access right to NDEF files
– Section 5.6.5: NDEF Select command
– Section 5.8.4: UpdateFileType command
04-Oct-2016 8
– Section 5.8.5: SendInterrupt command
– Section 8.2: Reading of an NDEF message
– Section 8.5: Unlocking an NDEF file
– Section 8.6: Reaching the read-only state for an NDEF file
– Section 16: Ordering information
Updated:
23-Nov-2016 9 – Table 35: R-APDU of the ReadBinary command
– Table 47: R-APDU of the ExtendedReadBinary command
86/88 DS9985 Rev 12

M24SR02-Y Revision history
Table 88. Document revision history (continued)

Added:
– Note 4. on Figure 23.: UFDFPN8 - 8-lead, 2 x 3 mm, 0.5 mm pitch
07-Feb-2017 10 ultra thin profile fine pitch dual flat package outline
Updated:
– Table 88: Ordering information scheme for packaged devices
Updated:
– Table 6: Field list
– Table 20: R-Block detailed format
– Table 72: UID format
– Table 74: I2C operating conditions
– Table 78: I2C AC characteristics (400 kHz)
– Table 86: TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm,
0.65 mm pitch, package mechanical data
02-Oct-2017 11 – Table 88: Ordering information scheme for packaged devices
– Figure 10: Changing the read access right to an NDEF file
– Figure 11: Changing the write access right to an NDEF file
– Figure 15: AC test measurement I/O waveform
– Figure 16: I2C AC waveforms
– Figure 19: I2C bus protocol
– Figure 22: TSSOP8 – 8-lead thin shrink small outline, 3 x 6.4 mm,
0.65 mm pitch, package outline
– Section 16: Ordering information
Updated Features, Section 7.11: Close the I²C session and note in
Section 16: Ordering information.
Updated Table 7: Details about I2C watchdog and Table 81: GPO
04-Apr-2019 12 timings measurement.
Updated footnote 5 of Table 78 and footnote 5 of Table 79.
Minor text edits across the whole document.
DS9985 Rev 12 87/88

87
M24SR02-Y
IMPORTANT NOTICE – PLEASE READ CAREFULLY
STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and
improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on
ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order
acknowledgement.
Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or
the design of Purchasers’ products.
No license, express or implied, to any intellectual property right is granted by ST herein.
Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.
ST and the ST logo are trademarks of ST. For additional information about ST trademarks, please refer to www.st.com/trademarks. All other
product or service names are the property of their respective owners.
Information in this document supersedes and replaces information previously supplied in any prior versions of this document.
© 2019 STMicroelectronics – All rights reserved
88/88 DS9985 Rev 12

Mouser Electronics
Authorized Distributor
Click to View Pricing, Inventory, Delivery & Lifecycle Information:
STMicroelectronics:
M24SR02-YMN6T/2 M24SR02-YMC6T/2 M24SR02-YDW6T/2 M24SR02-YSG12I/2

m24sr02 Y-1696501

Uploaded by

Copyright:

Available Formats

m24sr02 Y-1696501

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

m24sr02 Y-1696501

Uploaded by

Copyright:

Available Formats

M24SR02-Y

Dynamic NFC/RFID tag IC with 2-Kbit EEPROM,

April 2019 DS9985 Rev 12 1/88

3 M24SR02-Y memory management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

2/88 DS9985 Rev 12

3.2.1 State of the Read and Write access rights . . . . . . . . . . . . . . . . . . . . . . . 26

5 I²C and RF command sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

DS9985 Rev 12 3/88

5.8 ST proprietary command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

7 I2C device operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

4/88 DS9985 Rev 12

9 UID: unique identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

11 I2C DC and AC parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

13 Write cycle definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

DS9985 Rev 12 5/88

Table 1. Signal names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

6/88 DS9985 Rev 12

Table 49. R-APDU table of the EnablePermanentState command . . . . . . . . . . . . . . . . . . . . . . . . . . 48

DS9985 Rev 12 7/88

Figure 1. M24SR02-Y block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

8/88 DS9985 Rev 12

Figure 1. M24SR02-Y block diagram

DS9985 Rev 12 9/88

Table 1. Signal names

SDA Serial data I/O

Figure 2. 8-pin package connections

1.1 Functional modes

Table 2. Functional modes

I2C mode Vcc The I2C interface is available

1.1.1 I2C mode

1.1.2 Tag mode

10/88 DS9985 Rev 12

1.1.3 Dual interface mode

DS9985 Rev 12 11/88

2.1 Serial clock (SCL)

2.2 Serial data (SDA)

2.3 Antenna coil (AC0, AC1)

2.4 Ground (VSS)

2.5 Supply voltage (VCC)

2.5.1 Operating supply voltage VCC

12/88 DS9985 Rev 12

EnableVerificationRequirement, DisableVerificationRequirement, EnablePermanentState,

2.5.2 Power-up conditions

2.5.3 Device reset in I²C mode

2.5.4 Power-down conditions

2.7 General purpose output (GPO)

DS9985 Rev 12 13/88

The user can select one of these configurations(a):

2.7.1 Session Open configuration (GPO field = 0xX1 or 0x1X)

Figure 3. GPO configured as Session Open (GPO field = 0xX1 or 0x1X)

1. CmdEOFtoGPlow (RF command End of frame to GPORF Session pad low)

a. See Table 81 for more details.

14/88 DS9985 Rev 12

2.7.2 WIP Writing in Progress configuration (GPO field = 0xX2 or 0x2X)

Figure 4. GPO configured as WIP (GPO field = 0xX2 or 0x2X)

hƉĚĂƚĞ ŶĚŽĨǁƌŝƚŝŶŐ ŶǇŽƚŚĞƌ

1. CmdSTPtoGPlow (I2C Command Stop to GPO low)

DS9985 Rev 12 15/88

2.7.3 I2C answer ready configuration (GPO field = 0xX3)

hƉĚĂƚĞ ŶĚŽĨǁƌŝƚŝŶŐ ŶǇŽƚŚĞƌ

KƉĞŶ ŶǇ/ϸ DϮϰ^Zǆǆ ŶǇ/ϸ DϮϰ^Zǆǆ ŶǇ/ϸ DϮϰ^Zǆǆ

hƉĚĂƚĞƚŚĞE& DϮϰ^Zǆǆ ŶǇŽƚŚĞƌ

5HVHW32 $Q\RWKHU 6HW32