SPSXM002
www.onsemi.com
4
Tag Memory
Memory Configuration
Memory is organized according to the EPCglobal
Generation−2 UHF RFID specification. There are two
possible configurations for the EPC ID:
• 8−word EPC code and 9 free words in the USER
memory bank, as shown in the Memory Map
• 17−word EPC code and no free USER memory (EPC
lengths above 11 words may not be supported on all
readers.)
The 8−word configuration is the default. To change to the
17−word configuration, write 0001
h
to the EPC Bank, word
address 14
h
. The memory can be reset to the default 8−word
EPC configuration by writing 0000
h
to the same location.
This EPC configuration can be configured and reconfigured
repeatedly as long as the EPC memory bank is not
permanently locked by a LOCK command. Once the EPC
memory bank is permanently locked, it cannot be
reconfigured.
Reserved Memory − Passwords
Reserved Memory contains the ACCESS and KILL
passwords. There is a 32−bit Access Password and a 32−bit
Kill Password. The default for both Kill and Access
Passwords is 0000
h
.
Access Password
The Access Password is a 32−bit value stored in Reserved
Memory 20
h
to 3F
h
MSB first. The default value is all
zeroes. Tags with a non−zero Access Password will require
a reader to issue this password before transitioning to the
secured state.
Kill Password
The Kill Password is a 32−bit value stored in Reserve
Memory 00
h
to 1F
h
, MSB first. The default value is all
zeroes. A reader shall use a tag’s kill password once to kill
the tag and render it silent thereafter. A tag will not execute
a kill operation if its Kill Password is all zeroes.
EPC Memory − EPC data, Protocol Control Bits, and
CRC16
As required by the Gen−2 specification, EPC memory
contains a 16−bit cyclic−redundancy check word
(StoredCRC) at memory addresses 00
h
to 0F
h
, the 16
protocol−control bits (StoredPC) at memory addresses 10
h
to 1F
h
, and an EPC value beginning at address 20
h
.
The protocol control fields include a five−bit EPC length,
a one−bit user−memory indicator (UMI), a one−bit extended
protocol control indicator, and a nine−bit numbering system
identifier (NSI).
On power−up, the IC calculates the StoredCRC over the
stored PC bits and the EPC specified by the EPC length field
in the StoredPC. For more details about the StoredPC field
or the StoredCRC, please see the Gen 2 specification.
The StoredCRC, StoredPC, and EPC are stored MSB first
(i.e. the EPC’s MSB is stored in location 20h).
Tag Identification (TID) Memory
The read−only Tag Identification memory contains the
manufacturer−specific data. The manufacturer Mask
Designer ID (MDID) is 824
h
(bits 08
h
to 13
h
). The logic 1
in the most significant bit of the MDID indicates the
presence of an extended TID consisting of a 16−bit header
and a 48−bit serialization. The Magnus−S2 model number is
in bits 10
h
to 1F
h
and the EPCglobal
®
Class ID (E2
h
) is in
00
h
to 07
h
.
Sensor Functions
Accessing the Sensor Code
The Magnus−S2 Chameleon engine stores tuning
information in a user−accessible memory register. The
“Sensor Code” register (B0
h
−BF
h
in the Reserved memory
bank) contains the current setting and controls the tuning
capacitors that are used to adjust the input impedance.
To get the results of the self−tuning operation, a READ
command may be issued for the Sensor Code (B0
h
−BF
h
in
the Reserved memory bank). Because the tuning network
offers 32 different levels of impedance, only the 5 least
significant bits (BB
h
−BF
h
) in the register are actually
implemented and used. (The 32 levels represent increasing
amounts of capacitance added to the input impedance, with
the lowest capacitance applied at level 0.) Returned results
will be in the form 0000 0000 000x xxxx, where the 5 LSBs
define the current tuning.
For use in sensing applications, the Sensor Code register
can be monitored for changes over time or at different
locations, or it can be checked for changes to a baseline
reading that is taken when the tag is placed into service.
Depending on the needs of the application, the reference or
baseline value(s) may be written back into regular user
memory or may be stored elsewhere on the user’s network.
The SPSXM002 may require more than its minimum
sensitivity power in order to sense values near the ends of the
code range (0−5 and 27−31). The minimum required power
tends to increase gradually as the Sensor Code moves from
5 to 0 or from 27 to 31.
Overriding Default Chameleon Behavior
By default, the Chameleon engine will self−tune when
Magnus−S2 powers up, and the tuning capacitance chosen
will be held constant until the chip powers down. There are
also two additional modes: Chameleon can tune
continuously – not just at power up – and Chameleon can be
forced to a user−chosen setting.
To cause Chameleon to adjust continuously while
Magnus−S2 is powered up, write 0800
h
to the Analog
