MIFARE Ultralight Tags
The MIFARE MF0ICU1 has been developed by NXP Semiconductors for use with Proximity Coupling Devices (PCD) in accordance with ISO/IEC 14443 A. It is intended for use with single trip tickets in public transportation networks, loyalty cards or day passes for events as a replacement for conventional ticketing solutions such as paper tickets, magnetic stripe tickets or coins.
As the usage of contactless proximity smart cards becomes more and more common, transport and event operators are switching to completely contactless solutions. The introduction of the MIFARE Ultralight for limited use tickets will lead to a reduction of system installation and maintenance costs. Terminals will be less vulnerable to damage and mechanical failures caused by ticket jams. MF0ICU1 can easily be integrated into existing schemes and even standard paper ticket vending equipment can be upgraded. This solution for low cost tickets can help operators to reduce the circulation of cash within the system.
The mechanical and electronical specifications of MIFARE Ultralight are tailored to meet the requirements of paper ticket manufacturers.
Key applications
• Limited use tickets for public transport
• Limited use tickets for event ticketing
Contactless energy and data transfer
MF0ICU1 is connected to a coil with a few turns. The MF0ICU1 fits the TFC.0 (Edmondson) and TFC.1 (ISO) ticket formats as defined in BS EN753-2.
TFC.1 format tickets are supported by the MF0ICU10 chip which features a 17 pF on-chip resonance capacitor.
The smaller TFC.0 format tickets are supported by the MF0ICU11 chip which features a 50 pF on-chip resonance capacitor.
Anticollision
An intelligent anticollision function enables simultaneous multicard operation. The anticollision algorithm individually selects each card and ensures correct execution of a transaction with the selected card without data corruption from other cards in the field.
Cascaded Unique IDentification (UID)
The anticollision function is based on an IC individual serial number called Unique Identification (UID) for each IC. The UID of the MF0ICU1 comprises 7 bytes and supports ISO/IEC 14443-3 cascade level 2.
Security
• 7-byte UID in accordance with ISO/IEC 14443-3 for each device
• 32-bit user definable One-Time Programmable (OTP) area
• Field programmable read-only locking function per page
Delivery options
MF0ICU1 can be delivered in packaged or wafer form. Refer to delivery type description for more information.
Features and benefits
MIFARE RF interface ISO/IEC 14443 A
Contactless transmission of data and supply energy (no battery needed)
Operating distance up to 100 mm depending on antenna geometry
Operating frequency of 13.56 MHz
Data transfer of 106 kBs
Data integrity of 16-bit CRC, parity, bit coding, bit counting
Anticollision
7-byte serial number in accordance with ISO/IEC 14443-3 cascade level 2
Typical ticketing transaction time of < 35 ms
Fast counter transaction time of < 10 ms
EEPROM
512-bit, organized in 16 pages with 4 bytes per page
Field programmable read-only locking function per page
32-bit user definable One-Time Programmable (OTP) area
384-bit user Read/Write area (12 pages)
Data retention time of 5 years
Write endurance 10000 cycles
Functional description
Block description
The MF0ICU1 chip consists of a 512-bit EEPROM, RF interface and Digital Control Unit (DCU). Energy and data are transferred via an antenna consisting of a coil with a small number of turns which is directly connected to the MF0ICU1. No further external components are necessary. Refer to the document Ref. 6 “MIFARE (Card) Coil Design Guide” for details on antenna design.
• RF interface:
– Modulator/demodulator
– Rectifier
– Clock regenerator
– Power-On Reset (POR)
– Voltage regulator
• Anticollision: Multiple cards may be selected and managed in sequence
• Command interpreter: Processes commands supported by the MF0ICU1 to access the memory
• EEPROM interface
• EEPROM: 512 bits, organized in 16 pages of 4 bytes per page.
– 80 bits reserved for manufacturer data
– 16 bits used for the read-only locking mechanism
– 32 bits available as OTP area
– 384 bits user programmable Read/Write memory
Communication overview
Commands are initiated by the PCD and controlled by the MF0ICU1’s command interpreter. This processes the internal states and generates the appropriate response.
Idle state
After a Power-On Reset (POR), the MF0ICU1 switches directly to the idle state. It only exits this state when a REQA or a WUPA command is received from the PCD. Any other data received while in the idle state is interpreted as an error and the MF0ICU1 remains Idle.
After a correctly executed HALT command, the halt state changes to the wait state which can be exited with a WUPA command.
Ready 1 state
In this state, the MF0ICU1 supports the PCD when resolving the first part of its UID (3 bytes) with the ANTICOLLISION or SELECT command from cascade level 1. This state is exited correctly after execution of either of the following commands:
• SELECT command from cascade level 1: the PCD switches the MF0ICU1 into Ready 2 state where the second part of the UID is resolved.
• READ command (from address 0): all anticollision mechanisms are bypassed and the MF0ICU1 switches directly to the active state.
Remark: If more than one MF0ICU1 is in the PCD field, a READ command from address 0 causes a collision due to the different serial numbers and all MF0ICU1 devices are selected. Any other data received in the Ready 1 state is interpreted as an error and depending on its previous state the MF0ICU1 returns to the wait, idle or halt state.
Ready 2 state
In this state, the MF0ICU1 supports the PCD when resolving the second part of its UID
(4 bytes) with the cascade level 2 ANTICOLLISION command. This state is usually exited
using the cascade level 2 SELECT command.
Alternatively, state Ready 2 may be skipped using a READ command (from address 0) as described in state Ready 1.
Remark: If more than one MF0ICU1 is in the PCD field, a READ command from address 0 causes a collision due to the different serial numbers and all MF0ICU1 devices are selected. The response of the MF0ICU1 to the cascade level 2 SELECT command is the Select Acknowledge (SAK) byte. In accordance with ISO/IEC 14443 this byte indicates if the anticollision cascade procedure has finished. It also defines the type of device selected for the MIFARE architecture platform. The MF0ICU1 is now uniquely selected and only this device will communicate with the PCD even when other contactless devices are present in the PCD field. Any other data received when the device is in this state is interpreted as an error and depending on its previous state the MF0ICU1 returns to the wait, idle or halt state.
Active state
In the active state either a 16-byte READ or 4-byte WRITE command can be performed.
The HALT command exits either the READ or WRITE commands in their active state. Any other data received when the device is in this state is interpreted as an error and depending on its previous state the MF0ICU1 returns to the wait, idle or halt state.
Halt state
The halt and idle states constitute the second wait state implemented in the MF0ICU1. An already processed MF0ICU1 can be set into the halt state using the HALT command. In the anticollision phase, this state helps the PCD to distinguish between processed cards and cards yet to be selected. The MF0ICU1 can only exit this state on execution of the WUPA command. Any other data received when the device is in this state is interpreted as an error and the MF0ICU1 state is unchanged. Refer to the document MIFARE collection of currently available application notes for correct implementation of an anticollision procedure based on the idle and halt states and the REQA and WUPA commands.
Data integrity
Reliable data transmission is ensured over the contactless communication link between PCD and MF0ICU1 as follows:
• 16-bit CRC for each block
• Parity bits for each byte
• Bit count checking
• Bit coding to distinguish between logic 1, logic 0 and no information
• Channel monitoring (protocol sequence and bit stream analysis)
RF interface
The RF interface is base on the ISO/IEC 14443 A standard for contactless smart cards.
The RF field from the PCD is always present as it is used for the card power supply.
However, it is sequentially interrupted during data transmission to allow the data to be sent. There is only one start bit at the beginning of each frame for data communication irrespective of direction. Each byte is transmitted with an odd parity bit at the end of the byte. The LSB of the byte with the lowest selected block address is transmitted first. The maximum frame length is 163-bit:
(16 data bytes + 2 CRC bytes = 16 * 9 + 2 * 9 + 1 start bit = 163).
Memory organization
The 512-bit EEPROM memory is organized in 16 pages with 4 bytes per page. In the erased state the EEPROM cells are read as logic 0, in the written state as logic 1.
UID/serial number
The unique 7-byte serial number (UID) and its two check bytes are programmed into the first 9 bytes of memory covering page addresses 00h, 01h and the first byte of page 02h.
The second byte of page address 02h is reserved for internal data. These bytes are programmed by the IC manufacturer and because of the security requirements are write protected.
In accordance with ISO/IEC 14443-3 Check Byte0 (BCC0) is defined as CT ⊕ SN0 ⊕ SN1 ⊕ SN2 and Check Byte 1 (BCC1) is defined as SN3 ⊕ SN4 ⊕ SN5 ⊕ SN6. SN0 holds the Manufacturer ID for NXP Semiconductors (04h) in accordance with ISO/IEC 14443-3 and ISO/IEC 7816-6 AMD.1
Table 4. Memory organization
Page address Byte number
Decimal Hex 0 1 2 3
0 00h serial number
1 01h serial number
2 02h serial number internal lock bytes lock bytes
3 03h OTP OTP OTP OTP
4 to 15 04h to 0Fh user memory
Lock bytes
The bits of byte 02h and 03h of page 02h represent the field programmable read-only locking mechanism. Each page from 03h (OTP) to 0Eh can be individually locked by setting the corresponding locking bit Lx to logic 1 to prevent further write access. After locking, the page becomes read-only memory.
The three least significant bits of lock byte 0 are the block-locking bits. Bit 2 deals with pages 0Eh to 10h, bit 01h deals with pages 09h to 04h and bit 00h deals with page 03h (OTP). Once the block-locking bits are set, the locking configuration for the corresponding memory area is frozen.
OTP bytes
Page 03h is the OTP page and it is preset so that all bits are set to logic 0 after production.
These bytes can be bitwise modified using the WRITE command.
The WRITE command bytes and the current contents of the OTP bytes are bitwise OR’ed.
The result is the new OTP byte contents. This process is irreversible and if a bit is set to logic 1, it cannot be changed back to logic 0.
Data pages
Pages 04h to 15h are the user read/write area.
After production the data pages are initialized to the following values:
• Page 04h is initialized to FFh
• Pages 05h to 15h are initialized to 00h
Acronym Description
ARG Argument
ATQA Answer To Request (type A)
BCC Block Check Character
CMD Command
CRC Cyclic Redundancy Check
CT Cascade Tag
EEPROM Electrically Erasable Programmable Read-Only Memory
IV Initial Value
LSB Least Significant Bit
MSB Most Significant Bit
NAK Negative Acknowledge
OTP One-Time Programmable
Passive ACK Passive (implicit) ACKnowledge without PICC answer
PCD Proximity Coupling Device
PGDW Potential Good Dies per Wafer
PICC Proximity Integrated Circuit Card
POR Power-On Reset
REQA Request Answer (type A)
RF Radio Frequency
SAK Select ACKnowledge (type A)
UID Unique IDentifier/IDentification
WUPA Wake-UP command (type A)
References
[1] ISO/IEC 14443 A — International Organization for Standardization/International Electrotechnical Commission: Identification cards - Contactless integrated circuit(s) cards - Proximity cards, part 1-4, Type A
[2] MIFARE Interface Platform Type Identification Procedure — Application note, BL-ID Document number 0184, Version number **
[3] MIFARE ISO/IEC 14443 PICC Selection — Application note, BL-ID Document number 1308, Version number **
[4] MIFARE Ultralight Features and Hints — Application note, BL-ID Document number 0731, Version number **
[5] MIFARE Ultralight as Type 2 Tag — Application note, BL-ID Document number 1303, Version number **
[6] MIFARE (Card) Coil Design Guide — Application note, BL-ID Document number 0117, Version number **
For more information, please visit: http://www.nxp.com
