Training

NTAG I2C plus – your entryway to NFC

Public

MobileKnowledge
March 2016
Agenda

Session 9th March: NTAG I2C plus introduction

► Introduction, use cases, target markets and benefits
► Positioning and NTAG portfolio
► Memory map
► Key functionalities
 Field detection
 SRAM & SRAM mirroring
 Pass-through mode
 Energy harvesting
 Silence mode
 Memory access management

► Demokit and PSP quick overview

► Ordering details and wrap up

Session 16th March: NTAG I2C plus product support package Register here

Training
4
NTAG I2C plus is the simplest, most cost-effective NFC solution

The simplest, most cost-effective NFC solution

• Easy access to data from both RF (Type 2 tag) and from I²C
• Field detection to wake up connected devices
• Energy Harvesting capabilities
• EEPROM for offline data access
• Maximum interoperability with NFC devices
• Flexible memory management
• Originality signature for protection against cloning
• Fast & convenient data exchange via a 64 bytes SRAM buffer
• Small footprint package (1,6*1,6*0,5mm)

Training
6
NTAG I2C plus offers a unique combination

Low bill of material

$
 Simple antenna design
 Re-use any reference design such as NTAG21x(F) or NTAG I 2C
 Very limited set of extra components (e.g. extra cap for antenna tuning 1-2 resistors max)
 Small footprint package (1.6*1.6*0.5mm)

Easy to use / integrate

 Easy access to data from both RF (Type 2 tag) and from I2C, simple commands
 I2C: use generic MCU code
 RF: Use Android library for app development
 Fast & convenient data exchange via 64 bytes SRAM buffer
 8 pin chip

Ideal for low power operations

 Energy harvesting capabilities
 EEPROM for offline data access

Maximum interoperability with NFC devices

 NFC Forum Type 2 tag compliant

Training
7
NTAG I2C plus is the ideal NFC solution
for embedded applications

Wireless pairing
and network commissioning

BT pairing
WiFi pairing
Home automation commissioning

Easy pairing: e.g.: Connect a Bluetooth headphone to your phone

1. Tap your phone to your headphones on the NFC logo to pair them
2. Network credentials are exchanged, without any manual setting.
3. Bluetooth connection is established

Training
8
NTAG I2C plus is the ideal NFC solution
for embedded applications

Zero Power configuration

Product validation
Product personalization
Return logistics
Multiple product variants from a single platform

Zero power configuration: e.g. : Return logistics

1. Tap your phone to your consumer electronic device packaging
2. The phone retrieves the stored information such as the
product owner, warranty registration, service history records,
etc.
3. Return and repair centers can virtually peek inside boxed or
sealed products.

Training
9
NTAG I2C plus is the ideal NFC solution
for embedded applications

Enhanced user experience with NFC

Administrative access to electronic devices

Self-serve maintenance
FW update
Warranty registration

Enhanced user experience : e.g.: Self-serve maintenance

1. Tap your phone to your device on the NFC logo
2. The phone reads the error code, connects to manufacturer servers to
get a full diagnostic.
3. Depending on the outcome, phone can indicate simple actions to fix the
issue, download new firmware, provide a detailed error description or
report to the customer

Training
10
NTAG I2C plus applications and benefits

INDUSTRIAL CALIBRATION SMART METERS

Benefits Benefits
- NFC Forum-compliancy allows interaction with - Password protection secures
mobile phones metering data Access
- I²C connected EEPROM can be used to store - I²C connected EEPROM can be used to collect data
manufacturing history without expensive display
- Energy harvesting allows operation without - NFC Forum-compliancy allows interaction with mobile
power supply/Battery phones

LOGISTICS HEALTHCARE

Benefits
Benefits
- NFC Forum-compliancy allows interaction with
- Zero Power configuration allows in-the-box
mobile phones for online diagnostics & automatic
configuration at the end of the supply chain
ordering of consumables
- Password protection introduces administrator rights
- I²C connected EEPROM can be used to collect data
- Unique ID optimizes inventory
without expensive display

IoT CONSUMER ELECTRONICS

Benefits Benefits
- I²C connected EEPROM can be used to store - NFC Forum-compliancy allows interaction with mobile phones
network credentials offline & load data once supplied for smooth online registration & troubleshooting
-Password authentication allows secure data - I²C connected EEPROM allows smooth and secure dynamic
handling pairing

Training
11
Positioning and NTAG portfolio
NTAG portfolio

F
NTAG for smart inlays, NTAG F with field NTAG I2C for contact and RF interface
labels and tags detection pin
Memory

Value
NTAG NTAG NTAG NTAG NTAG NTAG NTAG NTAG I2C NTAG I2C NTAG I2C NTAG I2C
210 212 213 215 216 213F 216F 1k 2k plus 1k plus 2k

Training
13
NTAG I2C vs NTAG I2C plus
Feature NTAG I2C NTAG I2C plus Comments

ISO/IEC14443 2/3 ISO/IEC14443 2/3

RF interface
NFC Forum Type 2 Tag compliant NFC Forum Type 2 Tag compliant

Contact interface I2C (100 & 400 Khz) I2C (100 & 400 Khz)

Memory 888 / 1904 bytes 888 / 1912 bytes

Energy harvesting Yes Yes

Field detection pin Yes Yes

All new features are on top of NTAG I2C and

Backward compatibility No Yes backward compatible to NTAG 21x family

Interoperability with NFC enabled

devices
+ +++ All features are accessible / useable via sector 0

Memory access protection via RF

interface
+ +++ 32 bit password for R/W access

Memory access protection via I2C Restrict access to protected area to read-only or
interface
No Yes no access at all

ECC based originality signature No Yes Genuine and simple authentication scheme

Four times higher performance due to the

Pass-through performance + +++ introduced FAST_WRITE command

Delivery form XQFN8 / TSSOP8 XQFN8 / TSSOP8 / SO8 New SO8 package

Temperature range -40 ºC to 95 ºC -40 ºC to 105 ºC For industrial applications

Training
14
Memory structure and commands
 Byte number within a page
RF sector
Memory map from NFC perspective 0 1 2 3

UID ( 7 byte)

Internal

Internal Static lock bytes

Organization from NFC perspective
Capability container
► 4 byte per page
► 256 pages per sector User Memory (888 bytes)
New (Optional PWD protected user memory)
 NTAG I2C plus 1k: 1 sector of data (888 bytes of user memory)
 NTAG I2C plus 2k: 2 sectors of data (1912 bytes of user memory)
Dynamic lock bytes 00h
0
SRAM New Memory access configuration registers

► 64 bytes memory with unlimited endurance for data exchange or

Configuration registers (8 bytes)
frequently changing data.

Special memory blocks New Session registers (8 bytes)

► Static and dynamic lock bits provide read-only locking mechanism.

► Memory access bytes can configure write or read/write password SRAM (64 bytes)
(in pass through mode only)
protected memory areas.
► Configuration registers bytes define power-up behavior
► Session registers bytes contain current configuration and status of User memory (1024 bytes)
1
(only NTAG I2C plus 2k version)
the tag

Training
3 Session registers (mirrored, to be deprecated)
16
 Byte number within a block

Memory map from I2C interface I2Cblock

address
0

4
1

5
2

6
3

8 9 10 11

Hex 12 13 14 15

Organization from I2C perspective I2C addr * Serial number

Internal
► 16 byte per block page 0h
Internal Static lock bytes
► No sectors
Capability container
► I2C addr is write-only; it is always read as 0x04
User Memory (888 bytes)
01h-37h New
(Optional protected user memory)
SRAM
► 64 bytes memory with unlimited endurance for data exchange or Dynamic lock bytes 00h
frequently changing data. 38h-39h
New Memory access configuration registers

Special memory blocks Configuration registers (8 bytes)

3Ah

► Static and dynamic lock bits provide read-only locking mechanism.

► Memory access bytes can configure write or read/write password User Memory (1024 bytes)
40h-7Fh
protected memory areas. (only NTAG I2C plus 2k version)

► Configuration registers bytes define power-up behavior

► Session registers bytes contain current configuration and status of F8h-FBh SRAM (64 bytes)
the tag

Session registers (8 bytes)

FEh
Training
17
NTAG I2C plus - RF commands

► The RF-interface is based on the ISO/IEC 14443 Type A standard for contactless smart cards. All memory functions are
operated in the ACTIVE state.
NTAG I2C plus Function
NFC Forum command
Read Read 16 bytes
Write Writes 4 bytes
SECTOR SELECT Select the memory sector
Propietary (Need app)
GET VERSION Identify the IC (Product type, memory size,etc)
FAST READ Read 16 bytes up to one complete memory sector

New FAST_WRITE Writes 64 bytes to SRAM (only pass through mode)

READ_SIG Returns IC specific 32-byte ECC signature (NXP)
New
Access to protected area (AUTH0, NFC_PROT- defines
New PWD_AUTH
protection, AUTHLIM- unsuccessful attempts)

Training
18
NTAG I2C plus - I2C interface commands

► NTAG I2C plus supports the I2C protocol for the contact interface communication.
► For accessing memory and registers there are two different commands
► Read / Write I2C memory operation
 Access the EEPROM and SRAM

► Read / Write register operation

 Access the session registers

NTAG I2C plus Function

READ Reads a EEPROM or SRAM block of 16 bytes
WRITE Writes a EEPROM or SRAM block of 16 bytes
READ register Reads a selected byte of session register data
WRITE register Writes new register data

Training
19
NTAG I2C plus key features
NTAG I2C plus key features

Field detection Pass through mode

 Configurable field-detection output signal for data  For fast data exchange of large files via the
transfer synchronization and device wake up SRAM buffer

Energy harvesting Originality signature

 Energy harvesting from the NFC field to power  Originality signature based on ECC for simple
external devices genuine authentication

SRAM memory NFC silence mode

 64 bytes SRAM volatile memory without write  NFC silence to disable NFC interface
endurance limitation

SRAM mirroring Memory access management

 Mapping the SRAM memory into the user  Memory access configuration from both the
memory NFC and I2C interfaces.

Training
21
Field detection - Wake up connected devices

► The field detection provides the capability to trigger an

external device or switch on the connected circuitry
depending on activities on the NFC interface

► The conditions for the activation of the field detection

signal can be:
 The presence of the NFC field
 The detection of a valid command (SoC)
 The selection of the IC
Field
► The conditions for the de-activation of the field detection detection
signal can be:
 The absence of the NFC field
 The detection of the HALT state
 The NFC interface has read the last part of the NDEF message

► The field detection can also be used as a handshake

mechanism in the pass through mode to signal new data Field detection is open drain requires pullup resistor
written in the SRAM.

Training
22
Energy harvesting from the RF field – Power a connected microcontroller

► Generate current and voltage at the Vout pin to

power external devices like a MCU from the
energy harvested out of the RF field
► The voltage and current harvested depend on
various parameters such as:
 Field strenght generated by the reader
 The tag antena size
 The distance from the NFC device
► Power up can be controlled by Field detection
for further power management optimization

NTAG I2C plus typically provides 5mA at 2V

on the Vout pin with an NFC phone

Class 5 antenna with NFC reader

NFC phone vs NFC reader, also large spread [2-3]V @ [1-7]mA
from NFC phones to NFC phones

Training
23
SRAM memory - for frequently changing data

► SRAM is a 64 bytes volatile memory with unlimited endurance

► The SRAM is only available if the tag is powered via the VCC pin
 Otherwise, tag operates as a normal Type 2 tag with EEPROM memory

From the NFC interface

► SRAM is accessible only in:
 Pass-through mode: Mirrored to the fixed address F0h to FFh in the
first memory sector
 SRAM mirroring onto the EEPROM memory space: pages 01h to 74h

From the I2C interface

► SRAM is always accesible
► Located at addresses F8h to FBh

Training
24
 Byte number within a page
RF sector
SRAM mirroring 0 1 2 3

UID ( 7 byte)
for dynamic data update Internal

Internal Static lock bytes

► The SRAM can be mirrored into the user memory Capability container
 Behaves like an overlay, each read and write from RF to those
addresses is not executed on the underlying EEPROM, but on the SRAM mirrored
SRAM
User Memory (888 bytes)
 EEPROM content is not influenced (Optional PWD protected user memory)

Dynamic lock bytes 00h

0
► Address is given by SRAM_MIRROR_BLOCK register
Memory access configuration registers
 Only addresses with valid user memory are available
Configuration registers (8 bytes)

► Use case:
 Dynamic update of e.g: pairing information (write a new key every Session registers (8 bytes)
second)

SRAM (64 bytes)

► Hints: (in pass through mode only)
 The mirroring is only effective for the RF side, I2C has to use the fixed
SRAM address (F8h to FBh).
 Not compatible with pass-through mode User memory (1024 bytes)
1
(only NTAG I2C plus 2k version)

Training
3 Session registers (mirrored, to be deprecated)
25
Pass through mode – for fast data exchange of large files

► Pass through mode transfers data from one interface to

the other via the 64 byte SRAM saving EEPROM cycles.

► Can be combined with FAST READ and FAST WRITE

commands to R/W full SRAM buffer at once
 NTAG I2C plus can achieve 4 times higher throughput
compared to NTAG I2C (~8 KBps)

► Data flow synchronization is based on interrupt signal and

register settings

RF to I2C data exchange use cases:

 Phone writes data (e.g. configuration) into µC, µC-Firmware
update

I2C to RF data exchange use cases:

 Download of logging-Data, Service Information, Error
descriptions

AN11579 – How to use the NTAG I2C

plus for bidirectional communication
Training
26
Originality signature – to detect cloned tags

► NTAG I2C plus features a cryptographically supported

originality check using a digital signature based on
Fetch NXP PUk
standard Elliptic Curve Cryptography (ECC).
► Die individual
 Each NTAG I2C plus UID is signed with an NXP private
key and the resulting 32-byte signature is stored in a (one time only) UID
hidden part of the NTAG I2C plus memory during IC
production
READ_SIG
► This signature can be retrieved using the READ_SIG
command and can be verified in the NFC device by
using the corresponding ECC public key provided by Signature
NXP.

Details on how to check the signature VERIFY  f 2 ( SIG, UID, Pu K ) SIG  f1 (UID, PrK )
are provided in AN11350

For large orders, NXP can provide a

customer specific signature

Training
27
NFC silence – to hide the tag presence

► The NFC silence feature disables the demodulator

and disables all tag reactions on RF commands
► Allows the tag to “disappear” event if it is still in the
reader field.
 It cannot be read and cannot be detected by a reader

Usage:
► Hide tag presence if the accessory is not able to be
powered (battery empty), to avoid confusing the user
► “Privacy” mode to control field detection trigger

Training
28
Memory access management
- Static lock bytes
- Dynamic lock bytes
- Memory access protection from NFC and I2C interfaces
 Byte number within a page
RF sector
Static lock bytes 0 1 2 3

UID ( 7 byte)

Internal

Internal Static lock bytes

► According to NFC Forum Type 2 Tag specification, the bits of Capability container
byte 2 and byte 3 of page 02h (via NFC) represent the field Lock Pages
03h - 0Fh)
programmable read-only locking mechanism for pages 03h to
User Memory (888 bytes)
0Fh. (Optional PWD protected user memory)

Dynamic lock bytes 00h

0
Memory access configuration registers

Configuration registers (8 bytes)

Lock bit: to locks corresponding page(s) to read-only

Block lock bit: to lock corresponding lock bits.
Session registers (8 bytes)

I2C interface keeps read / write access.

SRAM (64 bytes)
(in pass through mode only)

User memory (1024 bytes)

1
(only NTAG I2C plus 2k version)

Training
3 Session registers (mirrored, to be deprecated)
30
 Byte number within a page
RF sector
Dynamic lock bytes 0 1 2 3

UID ( 7 byte)

Internal

Internal Static lock bytes

► Dynamic lock bytes are the read-only mechanism from page Capability container
address 16 and onwards
► Granularity of 16 pages for NTAG I2C plus 1k and 32 pages for User Memory (888 bytes)
(Optional PWD protected user memory)
NTAG I2C plus 2K.

Dynamic lock bytes 00h

0
Lock Pages Memory access configuration registers
10h - FFh)
Configuration registers (8 bytes)

Session registers (8 bytes)

SRAM (64 bytes)

(in pass through mode only)

User memory (1024 bytes)

1
(only NTAG I2C plus 2k version)

Training
3 Session registers (mirrored, to be deprecated)
31
Memory access configuration– from RF/NFC interface

EEPROM
► 32-bit password
Un-protected
► 16-bit PACK (password auth. acknowledge response) memory access
Read & Write
► Optionally limited number of unsuccessful authentications
 up to 27 negative attempts

► Write or read/write memory access can be restricted to be

allowed only after password authentication
WRITE
► Memory can be split in open and protected segments Protection
 Memory boundary is configurable or
READ & WRITE
Protection
After 32-bit
password
authentication only

RF/NFC protected
memory access

Training
32
Memory access configuration– from I2C interface

EEPROM
► Different settings possible (via configuration bits)
 Entire memory accessible from I²C Unprotected
 R/W to Unprotected user area, R only to protected area memory access
Read & Write
 R/W to unprotected area, NAK to protected area
► Note: I²C has always R/W access to:
 Session registers
 SRAM buffer
 Configuration pages including Password Configuration area WRITE
(but can be locked via one configuration bit) Protection I2C
or
READ & WRITE
Protection

I2C protected
memory acess

Training
33
Memory access configuration
Data protection for both RF and I2C address
EEPROM

Unprotected
memory access
Read & Write

WRITE WRITE
Protection Protection I2C
or or
READ & WRITE READ & WRITE
Protection Protection
After 32-bit
password
authentication only

RF/NFC protected I2C protected

memory access memory access

Protected memory Access rights

can be set independently
Training
between I2C and RF 34
NTAG I2C plus offers a flexible memory access management

RF I2C
Memory area
Read access Write access Read access Write access
Serial Number Yes - Yes I2C Address *

Yes
Lock bytes / CC Yes Yes Yes
(OTP, lockable)

Yes Yes Yes Yes

User Memory
(PWD protection) (Lockable, PWD protection) (I2C_PROT) (I2C_PROT)

Configuration bytes & Yes Yes Yes

Yes
memory access bytes (PWD protection) (Lockable, PWD protection) (REG_LOCK_I2C)

Yes Yes
SRAM Yes Yes
(PWD protection) (PWD protection)

Session registers Yes - Yes Yes

* I2C address on block 0 byte only writable but not readable

Training
35
NTAG I2C plus demo kit and
product support package
NTAG I2C plus Explorer kit demokit and variants
OM5569 / NT322(X)

► NTAG I2C Explorer board

 LPC11U24 MCU
 NTAG I2C plus tag chip interface connector
 JTAG/SWD connector
 RGB LED
 Temperature sensor LM75B
 Micro USB connector
 Five push button controls
 Voltage monitors
 LCD display

► NTAG I2C antenna board:

 Only NTAG I2C plus connected to antenna (Class 5) Demokit name Contents

 Can be connected to demoboard or any I2C interface NTAG I2C plus Explorer kit with Field Detector
OM5569 / NT322E
Board, flex antenna and SO8 samples
NTAG I2C plus Explorer kit with Field Detector
► NFC Reader: OM5569 / NT322ER
Board, flex antenna, NFC reader and SO8 samples
 Identiv uTrust CLOUD 3700F
NTAG I2C plus Flex Antenna kit with 3 different flex
OM5569 / NT322F
antennas only and SO8 samples

Training
37
NTAG I2C plus support tools and SW

PC and Peek and Poke

Android apps
► PC software:
 PC App for Explorer board
 Peek and Poke
 RFIDDiscover

LPCXpresso &
► Android: Firmware
 NTAG I2C demo app
 MIFARE SDK

► NTAG I2C Explorer board firmware

 NTAG I2C Explorer bootloader RFIDDiscover
Android
 NTAG I2C Explorer demo
library
 NTAG I2C Explorer blink

Training
38
NTAG I2C plus support documentation
Material Link

Application notes
NTAG Antenna Design Guide AN11276

NTAG21x Originality Signature Validation AN11350

NTAG I²C Energy Harvesting AN11578

How to use NTAG I²C (plus) for bidirectional communication AN11579

NTAG I²C plus Memory Configuration Options AN11786

User guides
NTAG I²C plus Explorer Kit and Android Demo UM10966

NTAG I²C plus Explorer Kit and Peek & Poke UM10967

Datasheet
NT3H211 / NT3H2211 Download

Source files
Android app (Eclipse project) source Download

PC app (C# Visual Studio) source Download

Peek and Poke sources Download

Firmware for Explorer board sources Download

Training
39
Final remarks
Data exchange possibilities between I2C and NFC

► EEPROM (Passive / static mode)

 Write NDEF to EEPROM
 Synchronization: None, Timing or NDEF Read bit
 Usage: Near static information which changes infrequently
(e.g. WIFI Pairing info)

► SRAM / Pass-through Mode (Device powered mode)

 Write Data to SRAM (any format)
 Synchronization: Registers, Timing, FD Pin
 Usage: Down/upload of data, data exchange which should
leave no traces in EEPROM (passwords)

► SRAM / Mirror Mode

 Write NDEF to EEPROM, but have SRAM mapped over area
with dynamic content
 Synchronization: None, Timing or NDEF Read bit
 Usage: Often changing data e.g. every second (smart meter
value)

Training
41
NTAG I2C plus in a nutshell
The simplest & lowest BoM NFC solution

Training
42
Ordering information and samples

NTAG I2C plus ordering info

Part number 12NCs Package Delivery form MOQ

NT3H2111W0FTT (1k) 9353 069 32118 TSSOP8 Tape&reel 2.5kpcs
NT3H2211W0FTT (2k) 9353 069 33118 TSSOP8 Tape&reel 2.5kpcs

NT3H2111W0FT1 (1k) 9353 070 09115 SO8 Tape&reel 500pcs

NT3H2211W0FT1 (2k) 9353 070 16115 SO8 Tape&reel 500pcs

NT3H2111W0FHK (1k) 9353 069 39125 XQFN8 Tape&reel 4kpcs

NT3H2211W0FHK (2k) 9353 069 43125 XQFN8 Tape&reel 4kpcs

NTAG I2C plus development kit

Part number 12NCs Description Price

OM5569/NT322E 9353 078 49699 Explorer kit 19,99$

OM5569/NT322ER 9353 078 48699 Explorer kit + USB NFC reader 49,99$

OM5569/NT322F Only available end of April 9,99$

Training
43
Do you need more?
Resources and useful links

► NFC Everywhere
http://www.nxp.com/products/identification-and-security/nfc-and-reader-
ics/nfc-everywhere:NFC-TECHNOLOGY

► NFC Everywhere support page

http://www.nxp.com/techzones/nfc-zone/community.html

► NTAG I2C plus product website

http://www.nxp.com/products/identification-and-security/nfc-and-
reader-ics/connected-tag-solutions/ntag-ic-plus-nfc-forum-type-
2-tag-compliant-ic-with-ic-interface:NT3H2111_2211

► OM5569/NT322 demokit website

http://www.nxp.com/products/identification-and-security/nfc-and-
reader-ics/connected-tag-solutions/ntag-ic-iplus-i-explorer-
kit:OM5569-NT322E

► NXP Tech community

http://nxpcommunity.force.com/community/CommunityOverview

Training
44
MobileKnowledge
Thank you for your attention
www.themobileknowledge.com

► We are a global competence team of hardware and software

technical experts in all areas related to contactless technologies
and applications.

► Our services include:

 Application and system Design Engineering support
 Project Management
 Technological Consulting
 Advanced Technical Training services

► We address all the exploding identification technologies that

include NFC, secure micro-controllers for smart cards and mobile
applications, reader ICs, smart tags and labels, MIFARE family
and authentication devices.
For more information

Eric Leroux
eric.leroux@themobileknowledge.com
+34 629 54 45 52

Training
NTAG I2C plus – Your entryway to NFC
Jordi Jofre (Speaker) / Eric Leroux (Host)

Thank you for your kind attention!

► Please remember to fill out our evaluation survey (pop-up)

► Check your email for material download and on-demand video

addresses

► Please check NXP and MobileKnowledge websites for upcoming

webinars and training sessions
www.nxp.com/support/classroom-training-events/webinars-
archive:WEBINARS-ARCHIVE
www.themobileknowledge.com/content/knowledge-catalog-0

Training