ACG HF Mifare Easy Module Document No.: 1503-USM-01-0-01 Firmware: Version 1.0 User Manual ACG Identification Technologies GmbH Am Klingenweg 6A 65396 Walluf Germany Phone +49 (0) 6123 791 0 Fax +49 (0) 6123 791 199 www.acg.de rfid@acg.de Document Nr.: QSI-040902-OM-1-a-UserManual Dual ISO Module, V2.
HF Mifare Easy Module V1.0 Edition One - April 2005 ACG Identification Technologies GmbH (ACG) reserves the right to make changes to its products or services or to discontinue any product or service at any time without notice. ACG provides customer assistance in various technical areas, but does not have full access to data concerning the use and applications of customer's products.
HF Mifare Easy Module V1.0 Safety Instructions / Warning - Read before start-up! • The device may only be used for the intended purpose designed by for the manufacturer. The operation manual should be conveniently kept available at all times for each user. • Unauthorized changes and the use of spare parts and additional devices that have not been sold or recommended by the manufacturer may cause fire, electric shocks or injuries.
HF Mifare Easy Module V1.0 Preface Read This First About This Guide This manual describes the HF Mifare Easy Read/Write Module. Its goal is to describe the reader, how it works, how to integrate it and how to use it. If You Need Assistance Our application center is located in Europe to provide direct support. For more information, please contact your nearest ACG Sales Center. The contact addresses can be found on our home page: http://www.acg.
HF Mifare Easy Module V1.0 Table of contents 1 Scope ...............................................................................................8 2 Extended Documentation...............................................................8 3 Definitions and abbreviations ........................................................8 3.1 Definitions .................................................................................................... 8 3.1.1 Anticollision loop .................................
HF Mifare Easy Module V1.0 7.2 Binary Protocol ........................................................................................... 24 7.2.1 STX ..................................................................................................... 24 7.2.2 Station ID ............................................................................................ 24 7.2.3 Length ................................................................................................. 24 7.2.4 Data .................
HF Mifare Easy Module V1.0 7.4.3.3.5 Unable to read after write 'X'..................................................... 36 7.4.3.4 Continuous Read ......................................................................... 37 7.4.3.4.1 Multitag continuous read mode................................................. 37 7.4.3.4.2 Auto start .................................................................................. 37 7.4.3.4.3 Binary mode...................................................................
HF Mifare Easy Module V1.0 7.4.3.15.1 Write failure 'F' ........................................................................ 51 7.4.3.15.2 No tag error 'N'........................................................................ 51 7.4.3.15.3 Operation mode failure 'O' ...................................................... 52 7.4.3.16 Write EEPROM ............................................................................ 52 7.4.3.17 Write master key .....................................................
HF Mifare Easy Module V1.0 1 Scope The MIFARE® Application Oriented Protocol is a reader Interface to communicate with MIFARE® transponders. The major applications to be supported are: 2 • Access control, Identification: Reading the serial numbers of all cards in the field. • Data Storage: Performing encrypted read and write operations. • Ticketing: Performing read, write, increment and decrement operations in an encrypted environment.
HF Mifare Easy Module V1.0 3.
Read bock Mifare Standard Philips √ √ √ √ Mifare 4k Philips √ √ √ √ Mifare Ultralight Philips √ √ √ √ Mifare ProX Philips √ √ √ √ DESFire Philips √ - - √ Smart MX Philips √ - - √ SLE44R35S Infineon √ √ √ √ SLE55R04/08/16 Infineon √ - - √ SLE66R35 Infineon √ √ √ √ Comments encryption not included encryption not included Supported tags Serial number HF Mifare Easy Module V1.
HF Mifare Easy Module V1.0 5 The Mifare transponder family The Mifare transponder family consists of various 13.56 MHz transponders IC, all according to ISO 14443. 5.1 State Diagram All Mifare cards use following state diagram.
HF Mifare Easy Module V1.0 5.2 Mifare Standard The Mifare Standard card consists of 16 sectors. A sector includes four blocks 16 bytes each. MIFARE® Standard Sector 2 Sector 0 (Block: 0...3) Block 8: Data or value (16 bytes) Sector 1 (Block: 4...7) Block 9: Data or value (16 bytes) Sector 2 (Block 8...11) Block 10: Data or value (16 bytes) ... Block 11: Access Conditions (4 bytes), Key A, bytes) Sector 15 (Block 60...63) Key B (16 Figure 5-2: MIFARE® Standard: sector diagram 5.2.
HF Mifare Easy Module V1.0 5.2.2 Sector 0 / Block 0 Block 0 is read only. Serial Number (4 byte) Check byte (1 byte) Manufacturer data (11 byte) Figure 5-3: MIFARE Standard: sector 0 / block 0 5.2.
HF Mifare Easy Module V1.0 5.4 Mifare 4k Mifare 4k cards have an increased memory. Beginning from sector 32 (20h) a sector has 16 blocks. Due to compatibility reasons the sector indices has changed according following figure. The login sector has to be used to access the according sector on the card.
HF Mifare Easy Module V1.0 5.6 Mifare DESFire This tag supports additional security algorithms (DES, Triple-DES, MAC) for security sensitive applications. DESFire tags are addressed using a specific command set (see DESFire command set). 5.6.1 Memory organization The memory of a DESFire card can be personalized to own requirements. The card can be seen as data storage like a hard disk in a PC. The memory is divided in up to 28 different applications (directories) and with 16 files each.
HF Mifare Easy Module V1.0 5.6.2 State diagram of DESFire Activate DESFire card Select application with ID Login to application Select file Change file Commit / Abort transaction Figure 5-7: DESFire State diagram 5.6.2.1 Activate PICC Prior to any access to a DESFire card the card must be selected. A DESFire card has 7 bytes UID. After activation the card is powered up and ready to accept a DESFire command. Application 0 is selected automatically. 5.6.2.
HF Mifare Easy Module V1.0 5.6.2.4 Select file with ID Prior to any access to a file a file must be selected 5.6.2.5 Change file A selected file can be changed according its access rights. If a file is secured a login is needed before. 5.6.2.6 Commit/ Abort transaction Value files, backup files, linear record files and cyclic record files only adapt its value after the commit transaction command. Several files can be changed within an application at the same time.
HF Mifare Easy Module V1.0 6 Hardware 6.1 Pin out of OEM Module (Top View) All dimensions are listed in mm.
HF Mifare Easy Module V1.0 6.1.1 Pin out PIN PIN Nr Description ARX 1 Antenna RX ATX1 2 Antenna TX1 VDD 3 +5 V DC (4.5VDC to 5.
HF Mifare Easy Module V1.0 6.1.
HF Mifare Easy Module V1.0 6.1.3 External Connections 6.1.3.1 Power Supply If the supply voltage and any noise modulated on the supply voltage remains within the specified limits, no further filtering is required. In some cases it is recommended to use additional filtering for the power supply line. Insuficcient power line filtering could cause unexpected or irregular performance drops. Option 1 +5V DC OEM Board 20 19 uC Option 2 +5V DC OEM Board 3 4 The board can be connected as shown above.
HF Mifare Easy Module V1.0 6.1.3.2 Antenna The antenna tuning and matching network is shown below. Please refer also to the antenna design guide and to the specific application notes for the reader IC. R1 1 2 OEM Board C1 L ANT C3 5 6 C6 C5 C4 C8 C2 R2 6.1.3.3 Serial Interface The OEM Board can be connected directly with a micro controller. Alternatively the OEM Board also can be connected to most serial interface types by using the right interface converter circuit.
HF Mifare Easy Module V1.0 6.1.3.4 Function Control LEDs Two external LEDs can be connected to the OEM Board. There are two alternatives possible. Option 1 OEM Board 18 17 uC 330 Ohm Option 2 OEM Board 18 17 uC 330 Ohm 330 Ohm In both cases the LED supply voltage levels are TTL levels.
HF Mifare Easy Module V1.0 7 Software As default data is transmitted at 9600,n, 8,1, no handshaking. Two protocol modes are supported. The protocol mode is configured in the reader EEPROM. As factory default, the ASCII protocol is used. 7.1 ASCII Protocol This protocol is designed for easy handling. The commands are issued using a terminal program. Data is transmitted as ASCII hexadecimal that can be displayed on any terminal program (i.e. HyperTerminal).
HF Mifare Easy Module V1.0 7.2.4 Data This part contains the command and data. The command values are the same as in ASCII protocol mode (‘x’, ‘s’, …) whereas data is transmitted binary. The length of the command block depends on the instruction. 7.2.5 Block Check Character (BCC) The BCC is used to detect transmission errors. The BCC is calculated XOR-ing each byte of the transmission frame excluding the STX/BCC and ETX character. BCC = ( StatID) XOR ( Length) XOR ( Data 0 ) XOR ... XOR ( Data N ) 7.2.
HF Mifare Easy Module V1.0 7.2.8 Examples 02h 64h 01h 78h 1Dh 03h STX Station ID Length ‘x’ BCC ETX This instruction frame will reset the reader module with the station ID 64h. 7.3 Register Set The reader has several system flags to customize its behaviour. The flags are stored non-volatile in its EEPROM. The reader accepts changes of the setting only during the start up phase. It is recommended to clear all RFU bits to guarantee further compatibility.
HF Mifare Easy Module V1.0 7.3.3 StationID (04h) The station ID is used in binary mode to address a device in party line set up. The station ID has the range of 01h to FEh and can be set freely. The value 00h is reserved for the bus master. All readers send their response to this device. The broadcast message (FFh) forces all readers to response to the command. Default value is 01h. 7.3.
HF Mifare Easy Module V1.0 7.3.4.3 Extended ID (default 0) This setting does only affect the commands continuos reading (‘c’), select (‘s’) and multi tag select (‘m’). If set a the unique serial number of the transponder is extended by a single prefix byte.
HF Mifare Easy Module V1.0 7.3.5 BAUD, Baud rate control register (06h) The baud rate register defines the communication speed of the reader device. Default value is 00h. Baud rate register Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 RFU RFU RFU RFU RFU RFU BS1 BS0 Figure 7-5: Baud rate register This register defines the baud rate of the device.
HF Mifare Easy Module V1.0 7.3.7 Reset Recovery Time (08h) The Reset Recovery Time register represents the recovery time in ms after the field is turned on. This register is used for the select, continuous read and multi tag commands. Default value is 10h. 7.3.8 User data (10h - 13h) These registers are for free use.
HF Mifare Easy Module V1.0 7.4 Instruction Set Following table describes all commands of the reader device. Each command returns an answer to the host. Exceptions are mentioned explicitly. The green LED is acknowledging a successfully executed command. The red LED indicates an error. 7.4.
HF Mifare Easy Module V1.0 7.4.2 Error Codes Following figure shows an overview of all error messages of the reader device.
HF Mifare Easy Module V1.0 7.4.3 Common commands 7.4.3.1 Increment value block (credit) Increments a value block with a defined value. A read after write is done automatically to verify data integrity. The command fails if the source block is not in value block format. A previous log in is needed to access a block.
HF Mifare Easy Module V1.0 7.4.3.1.4 Unable to read after write 'X' The tag was removed from field immediately after increment instruction. Data was decremented but the tag did not respond to the read after increment instruction, which is done automatically by the reader module. 7.4.3.2 Decrement value block (debit) Decrements a value block with a defined value. A read after write is done automatically to verify data integrity. The command fails if the source block is not in value block format.
HF Mifare Easy Module V1.0 7.4.3.2.3 No tag error 'N' The reader does not detect a response of the tag. There is either no tag present or the tag does not respond the request. 7.4.3.2.4 Unable to read after write 'X' The tag was removed from field immediately after decrement instruction. Data was decremented but the tag did not respond to the read after decrement instruction, which is done automatically by the reader module. 7.4.3.
HF Mifare Easy Module V1.0 7.4.3.3.1 Target block The target block needs not to be a valid value block. If source block is not in value format the command fails. 7.4.3.3.2 No value block 'I' Source value block does not match the value format. The value block is corrupted. A backup block can be used to restore the correct value. 7.4.3.3.3 Copy failure 'F' General failure during copy procedure or unable to read after write. 7.4.3.3.4 No tag error 'N' The reader does not detect a response of the tag.
HF Mifare Easy Module V1.0 7.4.3.4 Continuous Read The reader device reads and displays serial numbers continuously while one or more tags remain in the field. This command stops if any character is sent to the reader module. The reader supports different tag types at the same time. To increase the reading performance switch to a single tag mode. If more than one tag of the same tag type should be detected at the same time the Multitag flag must be activated.
HF Mifare Easy Module V1.0 7.4.3.4.4 Simple access control applications Serial numbers are always sent plain. Data encryption is activated after a successful log in. For simple access control applications it is recommended to use read-only blocks for the identification of the tag. Reading any block (even the manufacturer block) of the transponder will increase your security. 7.4.3.4.5 Extended ID If Extended ID is activated a prefix byte extends the serial number.
HF Mifare Easy Module V1.0 7.4.3.5.1 Time slotted answer In party line mode more than one reader can be used simultaneously. The time slotted answer allows separating all connected devices. The station ID is used to determine the correct time slot. The reader supports up to 254 unique time slots. Following formula calculates the needed time of one time slot. Only one baud rate on the same party line is supported.
HF Mifare Easy Module V1.0 7.4.3.6 Login (authenticate tag) Performs an authentication to access one sector of a Mifare® card. Only one sector can be accessed at the same time. Optionally to transmit the key data to the reader stored keys, in the reader EEPROM, can be used. To store keys in the EEPROM the write master key command is used. It is possible to store up to 32 master keys in the reader EEPROM. The login requires a successful select.
HF Mifare Easy Module V1.
HF Mifare Easy Module V1.0 7.4.3.6.3 Login with keydata from EEPROM Each key stored in the reader EEPROM can be used as keytype A or keytype B. To use a key as type A the value 10h must be added to the key index. 30h must be added to use a key as type B. 7.4.3.6.4 Usage of key A, key B Mifare® cards support two different crypto keys for each sector. Each key is 32 bit long and is stored in the sector trailer (last block of the sector) on a card.
HF Mifare Easy Module V1.0 7.4.3.7.1 Multi tag list Sending a as first parameter the reader returns a list of all present tags in the antenna field. In the end the amount of detected tags are returned. 7.4.3.7.2 Reading distance Each card needs a specific amount of power. The reader always provides the same power. Therefore the reading distance will decrease if more tags are present. Basically, the reading distance depends on the used tag, antenna and its tuning. 7.4.3.7.
HF Mifare Easy Module V1.0 7.4.3.8 Antenna power on/off This command controls the antenna power. It can be used to decrease the power consumption of the reader. Command Command Data 'pon' Switch on reader 'poff' Reader enters the stand by mode Answer Answer Description 'P' Positive acknowledge Example Command Description poff Reader enters stand by mode 7.4.3.8.1 Power off The reader enters the stand by mode. Power consumption is decreased.
HF Mifare Easy Module V1.0 7.4.3.9 Read/Write user port This command sets or reads the state of the user port (pin 14) of the OEM reader device. The port is set either as output or as input. Command Command Data 'pr' none 'pw' State of user port (1 Byte) Answer Answer Description Data State of user port (1 Byte) Example Command Description pr Reads user port pw01 Sets user port state to high 7.4.3.9.1 Read port The port read command returns the current state of the USER port.
HF Mifare Easy Module V1.0 7.4.3.9.2 Write port If user port is used as an output a 1kΩ resistor has to be integrated into the wire. Otherwise the reader device can be damaged. Port state Description 00 Sets USER port to low 01 Sets USER port to high Figure 7-13: Write User port settings 7.4.3.10 Read block This command reads a data block on a card. Size of returned data depends on the used tag. The block address range depends on the present tag.
HF Mifare Easy Module V1.0 7.4.3.10.1 Read failure 'F' This error is returned if the reader receives either bad data or the block address exceeds the block address range of the sector. 7.4.3.10.2 No tag in field 'N' The tag does not respond. There is either no tag present or not addressed. 7.4.3.10.3 Operation mode failure 'O' The block address of the 'r' command is higher than 40h.
HF Mifare Easy Module V1.0 7.4.3.12 Read value block Reads a value block. The command checks if data is in value block format. The read value block command needs a successful login. Command Command Data 'rv' Value block (1 byte) Answer Answer Description Data Read value (4 bytes) 'F' Error: General failure 'I' Error: value block failure 'N' Error: No tag in field Example Command Description rv04 Reads value of block 4. 7.4.3.12.
HF Mifare Easy Module V1.0 7.4.3.13 Select This command selects a single card in the antenna field. It can only be used in single tag mode. In the case of success the command returns the UID of the selected card. The reader detects the length of the card automatically. Command Command Data 's' None Answer Answer Description Data serial number 'N' Error: No Tag in the field Example Command Description s 1234567890ABCD Select the card with its UID 1234567890SABCD. 7.4.3.13.
HF Mifare Easy Module V1.0 7.4.3.14 Get Version This command returns the current version of the reader module. Command Command Data 'v' None Answer Answer Description 'Mifare 1.0' + + ASCII Mode 02 00 0A 4D 69 66 61 72 65 20 31 2E 30 31 03 Binary Mode Example Command Description v ‘Mifare 1.
HF Mifare Easy Module V1.0 7.4.3.15 Write block This command writes data to a block. A read after write is done automatically to ensure correct writing.
HF Mifare Easy Module V1.0 7.4.3.15.3 Operation mode failure 'O' The block address of the 'w' command is higher than 40h. The block address of the 'w' command conflicts with other commands, therefore the block address has to be limited to 40h. Use the 'wb' command instead. 7.4.3.16 Write EEPROM Writes to the internal reader EEPROM. It contains all startup parameters and the device ID. Changes of the startup settings will only be taken into effect after a reset of the device.
HF Mifare Easy Module V1.0 7.4.3.17 Write master key This command stores a MIFARE Standard key into the master key memory of the reader. The reader can store up to 32 keys. Command Command Data 'wm' Key number (1 byte) Key (6 bytes) 00h … 1Fh Answer Answer Description data written key (6 bytes) 'F' Error: Write failure Example Command Description wm00112233445566 Store key 112233445566h in EEPROM (key number 0). wm02A0A1A2A3A4A5 Store transport key 1 in EEPROM key 2. 7.4.3.17.
HF Mifare Easy Module V1.0 7.4.3.18 Write value block This command formats a block as a value block containing a 32-bit value. A read after write is performed automatically. Value blocks need a complete 16-byte block due to redundant storage. A successful login is required to run the command.
HF Mifare Easy Module V1.0 7.4.3.18.4 Writing values The write value block command is designed to create blocks, which match the value format. This command requires write access to specified block. It is not recommended to use this instruction for ticketing operations. For ticketing applications special instructions (Increment/Decrement/Copy) are supported. 7.4.3.19 Reset This command executes a power on (software) reset. New configuration settings will be loaded.
HF Mifare Easy Module V1.0 8 Frequently Asked Questions 8.1 Getting Started To test and interface the Mifare Easy Module, you do not need a sophisticated µP development system. All you need is a PC, a connection cable and a power supply for the reader. If you are using Microsoft Windows (95/98/NT/…), take the following steps: • Make sure, that your reader is RS232-interface type • Start HyperTerminal • Create a new connection (FILE/NEW CONNECTION) • Enter name of connection as you like (i.e.
HF Mifare Easy Module V1.0 8.3 What type of Mifare® card should I use? Mifare® Standard is designed for multi application environment. It contains 16 sectors each with 2 individual keys, access conditions, 3 data or value blocks. Some applications use the 1 Kbytes of the Mifare® Standard Card Memory just as storage. Mifare Ultralight has not a crypto unit on chip. It only supports 16 blocks. Mifare Standard 4k cards have the same features as Mifare Standard card but increased memory capacity.
HF Mifare Easy Module V1.0 8.4 How safe is Mifare® Standard for cashless payment? Security is always a property of the overall system, not of the components. It requires careful design. A properly designed system will require ALL barriers to be hacked in order to be broken. For good design start specifying feasible attacks. Then create barriers to block them. Mifare® was specifically designed for cashless payment applications.
HF Mifare Easy Module V1.0 8.5 Mifare® Standard Sector Trailer and Access Conditions The last block of each sector contains configuration data for the sector. This configuration data includes key A, key B and the access conditions. The first six byte (byte 0…5) of the Sector Trailer contain key A data, the last six bytes (byte 10…15) contain key B data. Byte number 6 to byte number 9 contain the access conditions for each block of the sector.
HF Mifare Easy Module V1.0 8.5.1 Examples 8.5.1.1 Ticketing Applications For ticketing applications it is recommended to use both keys of the MIFARE® card. Key A as a field key with rights for read, copy and decrement only. Key B is used as master key with full access rights (including increment and changing the access conditions and keys). 8.5.1.2 Data Handling Applications For data handling Applications it is recommended to disable ticketing operations (increment, decrement, copy).
HF Mifare Easy Module V1.0 9 References [1] ISO/IEC 14443 Part 1-4, Identification Cards – Contactless integrated circuit(s) cards – Proximity cards [2] DESFire Documentation, Philips, http://www.semiconductors.philips.
HF Mifare Easy Module V1.0 10 Appendix A: Antenna According to antenna design, please refer to Philips Application Note (Mifare ® & ICode, Mifare Reader IC family Directly Matched Antenna Design [4]) or to the ACG Antenna Design Guide [3].
HF Mifare Easy Module V1.
9,00 mm HF Mifare Easy Module V1.
HF Mifare Easy Module V1.0 12 Appendix C: Short Range P&P Module All dimensions are listed in mm.
HF Mifare Easy Module V1.
HF Mifare Easy Module V1.0 13 Appendix D: Timings tCMD PC: tEXEC Request → ← Response Reader: Command tRES tEXEC [ms] Comments Common commands cont. read 7 + Reset Off and Recovery Time multiselect 10 + Reset Off and Recovery Time multiselect (no tag) 35.4 + Reset Off and Recovery Time antenna on 0.5 antenna off 0.6 port read 0.3 port write 0.3 read block 4.1 write block 11.6 reset 107 select 8.8 + Reset Off and Recovery Time select (no tag) 35.
HF Mifare Easy Module V1.0 14 Appendix E: Release Notes 14.1 Version History 14.1.1 Mifare 1.0 Initial Release. 14.2 Revision history Date Revision number 04/13/2005 Version 1.0, Rev. 1.0 10/07/2005 Version 1.0, Rev. 1.
HF Mifare Easy Module V1.0 15 Appendix F: CE Declaration The HF Mifare Easy Plug & Play Read/Write Module complies with the European CE requirements specified in the EMC Directive 89/336/EEC. The relevant documents are available. If the HF Mifare Easy Read/Write Module is operated from a mains power supply, all power connections and additional components of the final device must comply with the European EMC directive.
HF Mifare Easy Module V1.0 16 Appendix G: FCC Declaration The HF Mifare Easy Plug & Play Read/Write Module complies with the US FCC Part 15 requirements. The relevant documents are available. If the HF Mifare Easy Read/Write Module is operated from a mains power supply, all power connections and additional components of the final device must also comply with the US FCC Part 15 directive. Customers selling into the USA must themselves make sure that the final device conforms to the US FCC Part 15 directive.
