WM72016 – Secure F-RAM with Gen-2 RFID and Serial Port

Rev. 1.4

May 2011

Page 6 of 32

INTERROGATOR

TAG

MaxArias Write Cycle

QURY

(240u)

SELECT

(385u)

ACK

(175u)

REQRN

(345u)

EPC

(228u)

WRITE

(495u)

RN

(53u)

HANDLE

(78u)

WR_OK

(80u)

REQRN

(345u)

RN16

(78u)

EE

PR

OM

writ

e d

ela

y!

Ch

arg

e p

um

p &

EE

soa

k tim

e

EEPROM-based Write Cycle

4ms

Figure 3. Gen2 Memory Write Cycle Comparison: F-RAM vs. EEPROM Memories

RESERVED: KILL Password:

The kill password provides a mechanism to permanently disable the WM72016 RFID from responding to any

and all Gen2 interrogator commands. The mandatory KILL command can be issued by a RFID interrogator in

either the OPEN or SECURED states. The WM72016 is permanently killed through a four-instruction

sequence of REQRN and KILL commands as detailed in the Gen2 standard. The KILL password is a 32-bit

value stored as 2 16-bit data words in reserved memory. The most significant KILL password is stored in

reserved memory bank address 0x00 with the least significant word stored in reserved memory bank address

0x01. The kill function can be permanently disabled by setting both KILL password words to 0x0000, and

permanently locking the KILL password in the reserved memory bank. Once the kill password has been set, it

should be permanently locked using the LOCK command. The WM72016 is shipped from the factory with the

kill password memory unlocked. The kill state of the device only affects the Gen2 RFID processor – the DSPI

serial port will continue to function normally.

RESERVED: ACCESS Password:

The access password provides a security mechanism to prevent unauthorized RFID interrogators from writing

to WM72016 memory. Non-zero access passwords require the WM72016 be placed in the SECURED state

prior to writing to it. This is accomplished through a four-instruction sequence of REQRN and ACCESS

commands as described in the Gen2 standard.

An access password with a value of zero requires no

authentication prior to writing to WM72016 memory. The ACCESS password is a 32-bit value stored as two

16-bit data words in reserved memory. The most significant ACCESS password is stored in reserved memory

bank address 0x02 with the least significant word stored in reserved memory bank address 0x03. Once the

access password has been set, it should be permanently locked using the LOCK command. The WM72016 is

shipped from the factory with the access password memory unlocked. The value of the access password has no

effect on the functionality of the DSPI serial port.

EPC Memory Bank:

The EPC memory bank accommodates 8 words: 1 protocol control (PC) word, a 6-word (96-bit) memory space

for an EPC identifier, and a 1-word CRC. The CRC word is calculated as part of the WM72016 power-on

initialization routine and written into the EPC memory bank address 0x00. The PC and 6-word EPC identifier

are completely programmable. The Protocol Control field is shown in Figure 4.