MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
for fast and easy solution development
1. General description
NXP Semiconductors has developed the MIFARE Classic MF1S50yyX to be used in a
contactless smart card according to ISO/IEC 14443 Type A.
The MIFARE Classic 1K MF1S50yyX IC is used in applications like public transport
ticketing and can also be used for various other applications.
1.1 Anticollision
An intelligent anticollision function allows to operate more than one card in the field
simultaneously. The anticollision algorithm selects each card individually and ensures that
the execution of a transaction with a selected card is performed correctly without
interference from another card in the field.
1.2 Simple integration and user convenience
The MF1S50yyX is designed for simple integration and user convenience which allows
complete ticketing transactions to be handled in less than 100 ms.
1.3 Security
• Manufacturer programmed 7-byte UID or 4-byte NUID identifier for each device
• Random ID support
• Mutual three pass authentication (ISO/IEC DIS 9798-2)
• Individual set of two keys per sector to support multi-application with key hierarchy
Rev. 3.0 — 2 May 2011
196330
Product data sheet
COMPANY PUBLIC
Fig 1. MIFARE card reader
001aam199
MIFARE
CARD PCD
energy
data
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
1.4 Delivery options
• 7-byte UID, 4-byte NUID
• bumped die on wafer
• MOA4 and MOA8 contactless module
2. Features and benefits
2.1 EEPROM
3. Applications
4. Quick reference data
[1] LCR meter, Tamb = 22 °C, fi = 13.56 MHz, 2 V RMS.
Contactless transmission of data and
supply energy
Operating distance up to 100 mm
depending on antenna geometry and
reader configuration
Operating frequency of 13.56 MHz Data transfer of 106 kbit/s
Data integrity of 16-bit CRC, parity, bit
coding, bit counting
Anticollision
Typical ticketing transaction time of
< 100 ms (including backup
management)
1 kB, organized in 16 sectors of 4 blocks
(one block consists of 16 byte)
User definable access conditions for
each memory block
Data retention time of 10 years Write endurance 100000 cycles
Public transportation Access management
Electronic toll collection Car parking
School and campus cards Employee cards
Internet cafés Loyalty
Table 1. Quick reference data
Symbol Parameter Conditions Min Typ Max Unit
Ci input capacitance [1] 14.9 16.9 19.0 pF
fi input frequency - 13.56 - MHz
EEPROM characteristics
tret retention time Tamb = 22 °C 10 - - year
Nendu(W) write endurance Tamb = 22 °C 100000 200000 - cycle
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 2 of 39
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
5. Ordering information
6. Block diagram
Table 2. Ordering information
Type number Package
Name Description Version
MF1S5001XDUD FFC Bump 8 inch wafer, 120 μm thickness, on film frame carrier, electronic fail die
marking according to SECS-II format), Au bumps, 7-byte UID
-
MF1S5001XDUF FFC Bump 8 inch wafer, 75 μm thickness, on film frame carrier, electronic fail die
marking according to SECS-II format), Au bumps, 7-byte UID
-
MF1S5000XDA4 MOA4 plastic leadless module carrier package; 35 mm wide tape, 7-byte UID SOT500-2
MF1S5000XDA8 MOA8 plastic leadless module carrier package; 35 mm wide tape, 7-byte UID SOT500-4
MF1S5031XDUD FFC Bump 8 inch wafer, 120 μm thickness, on film frame carrier, electronic fail die
marking according to SECS-II format), Au bumps, 4-byte non-unique ID
-
MF1S5031XDUF FFC Bump 8 inch wafer, 75 μm thickness, on film frame carrier, electronic fail die
marking according to SECS-II format), Au bumps, 4-byte non-unique ID
-
MF1S5030XDA4 MOA4 plastic leadless module carrier package; 35 mm wide tape,
4-byte non-unique ID
SOT500-2
MF1S5030XDA8 MOA8 plastic leadless module carrier package; 35 mm wide tape,
4-byte non-unique ID
SOT500-4
Fig 2. Block diagram of MF1S50yyX
001aan006
RF
INTERFACE
UART
ISO/IEC 14443
TYPE A
LOGIC UNIT
RNG
CRC
EEPROM
CRYPTO1
POWER ON
RESET
VOLTAGE
REGULATOR
CLOCK
INPUT FILTER
RESET
GENERATOR
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 3 of 39
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
7. Pinning information
7.1 Pinning
The pinning for the MF1S50yyXDAx is shown as an example in Figure 3 for the MOA4
contactless module. For the contactless module MOA8, the pinning is analogous and not
explicitly shown.
Fig 3. Pin configuration for SOT500-2 (MOA4)
Table 3. Pin allocation table
Pin Symbol
LA LA Antenna coil connection LA
LB LB Antenna coil connection LB
001aan002
LA LBtop view
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 4 of 39
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
8. Functional description
8.1 Block description
The MF1S50yyX chip consists of a 1 kB EEPROM, RF interface and Digital Control Unit.
Energy and data are transferred via an antenna consisting of a coil with a small number of
turns which is directly connected to the MF1S50yyX. No further external components are
necessary. Refer to the document Ref. 1 for details on antenna design.
• RF interface:
– Modulator/demodulator
– Rectifier
– Clock regenerator
– Power-On Reset (POR)
– Voltage regulator
• Anticollision: Multiple cards in the field may be selected and managed in sequence
• Authentication: Preceding any memory operation the authentication procedure
ensures that access to a block is only possible via the two keys specified for each
block
• Control and Arithmetic Logic Unit: Values are stored in a special redundant format and
can be incremented and decremented
• EEPROM interface
• Crypto unit: The CRYPTO1 stream cipher of the MF1S50yyX is used for
authentication and encryption of data exchange.
• EEPROM: 1 kB is organized in 16 sectors of 4 blocks. One block contains 16 bytes.
The last block of each sector is called “trailer”, which contains two secret keys and
programmable access conditions for each block in this sector.
8.2 Communication principle
The commands are initiated by the reader and controlled by the Digital Control Unit of the
MF1S50yyX. The command response is depending on the state of the IC and for memory
operations also on the access conditions valid for the corresponding sector.
8.2.1 Request standard / all
After Power-On Reset (POR) the card answers to a request REQA or wakeup WUPA
command with the answer to request code (see Section 9.4, ATQA according to ISO/IEC
14443A).
8.2.2 Anticollision loop
In the anticollision loop the identifier of a card is read. If there are several cards in the
operating field of the reader, they can be distinguished by their identifier and one can be
selected (select card) for further transactions. The unselected cards return to the idle state
and wait for a new request command. If the 7-byte UID is used for anticollision and
selection, two cascade levels need to be processes as defined in ISO/IEC 14443-3.
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 5 of 39
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
Remark: For the 4-byte non-unique ID product versions, the identifier retrieved from the
card is not defined to be unique. For further information regarding handling of non-unique
identifiers see Ref. 6.
8.2.3 Select card
With the select card command the reader selects one individual card for authentication
and memory related operations. The card returns the Select AcKnowledge (SAK) code
which determines the type of the selected card, see Section 9.4. For further details refer to
the document Ref. 2.
8.2.4 Three pass authentication
After selection of a card the reader specifies the memory location of the following memory
access and uses the corresponding key for the three pass authentication procedure. After
a successful authentication all memory operations are encrypted.
Fig 4. Three pass authentication
Request Standard Request All
Anticollision Loop
Get Identifier
Select Card
3 Pass Authenticationon
specific sector
Read
Block
Write
Block
Decre-
ment
Incre-
ment
Re-
store Halt
Transfer
Identification and Selection
Procedure
~2.5 ms without collision
+ ~1 ms for 7-byte UID
Typical Transaction Time
Authentication Procedure
~2 ms
Transaction SequencePOR
Memory Operations
~2.5 ms read block
~5.5 ms write block
~2.5 ms de-/increment
~4.5 ms transfer
+ ~1 ms for each collision
001aan921
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 6 of 39
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
8.2.5 Memory operations
After authentication any of the following operations may be performed:
• Read block
• Write block
• Decrement: Decrements the contents of a block and stores the result in an internal
data-register
• Increment: Increments the contents of a block and stores the result in an internal
data-register
• Restore: Moves the contents of a block into an internal data-register
• Transfer: Writes the contents of the temporary internal data-register to a value block
8.3 Data integrity
Following mechanisms are implemented in the contactless communication link between
reader and card to ensure very reliable data transmission:
• 16 bits CRC per block
• Parity bits for each byte
• Bit count checking
• Bit coding to distinguish between “1”, “0” and “no information”
• Channel monitoring (protocol sequence and bit stream analysis)
8.4 Three pass authentication sequence
1. The reader specifies the sector to be accessed and chooses key A or B.
2. The card reads the secret key and the access conditions from the sector trailer. Then
the card sends a number as the challenge to the reader (pass one).
3. The reader calculates the response using the secret key and additional input. The
response, together with a random challenge from the reader, is then transmitted to the
card (pass two).
4. The card verifies the response of the reader by comparing it with its own challenge
and then it calculates the response to the challenge and transmits it (pass three).
5. The reader verifies the response of the card by comparing it to its own challenge.
After transmission of the first random challenge the communication between card and
reader is encrypted.
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 7 of 39
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
8.5 RF interface
The RF-interface is according to the standard for contactless smart cards
ISO/IEC 14443A.
For operation, the carrier field from the reader always needs to be present (with short
pauses when transmitting), as it is used for the power supply of the card.
For both directions of data communication there is only one start bit at the beginning of
each frame. Each byte is transmitted with a parity bit (odd parity) at the end. The LSB of
the byte with the lowest address of the selected block is transmitted first. The maximum
frame length is 163 bits (16 data bytes + 2 CRC bytes = 16 × 9 + 2 × 9 + 1 start bit).
8.6 Memory organization
The 1024 × 8 bit EEPROM memory is organized in 16 sectors of 4 blocks. One block
contains 16 bytes.
001aan011
Byte Number within a Block
15141312111098765
Key A Access Bits Key B
43210Block
3
Sector
15
2
1
0
Description
Sector Trailer 15
Data
Data
Data
Sector Trailer 14
Data
Data
Data
Sector Trailer 0
Data
Data
Manufacturer Block
Sector Trailer 1
Data
Data
Data
314
2
1
0
31
2
1
0
30
2
1
0
:
:
:
:
:
:
Key A Access Bits Key B
Key A Access Bits Key B
Key A Access Bits
Manufacturer Data
Key B
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 8 of 39
Fig 5. Memory organization
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
8.6.1 Manufacturer block
This is the first data block (block 0) of the first sector (sector 0). It contains the IC
manufacturer data. This block is programmed and write protected in the production test.
The manufacturer block is shown in Figure 6 and Figure 7 for the 4-byte NUID and 7-byte
UID version respectively.
8.6.2 Data blocks
All sectors contain 3 blocks of 16 bytes for storing data (Sector 0 contains only two data
blocks and the read-only manufacturer block).
The data blocks can be configured by the access bits as
• read/write blocks
• value blocks
Value blocks can be used for e.g. electronic purse applications, where additional
commands like increment and decrement for direct control of the stored value are
provided
A successful authentication has to be performed to allow any memory operation.
Remark: The default content of the data blocks at delivery is not defined.
8.6.2.1 Value blocks
Value blocks allow performing electronic purse functions (valid commands are: read,
write, increment, decrement, restore, transfer). Value blocks have a fixed data format
which permits error detection and correction and a backup management.
A value block can only be generated through a write operation in value block format:
• Value: Signifies a signed 4-byte value. The lowest significant byte of a value is stored
in the lowest address byte. Negative values are stored in standard 2´s complement
format. For reasons of data integrity and security, a value is stored three times, twice
non-inverted and once inverted.
Fig 6. Manufacturer block for MF1S503yX with 4-byte NUID
Fig 7. Manufacturer block for MF1S500yX with 7-byte UID
001aan010
1514131211109876543
NUID Manufacturer Data
Block 0/Sector 0
21Byte 0
001aam204
1514131211109876543
UID Manufacturer Data
Block 0/Sector 0
21Byte 0
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 9 of 39
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
• Adr: Signifies a 1-byte address, which can be used to save the storage address of a
block, when implementing a powerful backup management. The address byte is
stored four times, twice inverted and non-inverted. During increment, decrement,
restore and transfer operations the address remains unchanged. It can only be
altered via a write command.
An example of a valid value block format for the decimal value 1234567d and the block
address 17d is shown in Table 4. First, the decimal value has to be converted to the
hexadecimal representation of 0012D687h. The LSByte of the hexadecimal value is
stored in Byte 0, the MSByte in Byte 3. The bit inverted hexadecimal representation of the
value is FFED2978h where the LSByte is stored in Byte 4 and the MSByte in Byte 7.
The hexadecimal value of the address in the example is 11h, the bit inverted hexadecimal
value is EEh.
8.6.3 Sector trailer
The sector trailer is the last block (block 3) in one sector. Each sector has a sector trailer
containing the
• secret keys A (mandatory) and B (optional), which return logical “0”s when read and
• the access conditions for the blocks of that sector, which are stored in bytes 6...9. The
access bits also specify the type (data or value) of the data blocks.
If key B is not needed, the last 6 bytes of the sector trailer can be used as data bytes. The
access bits for the sector trailer have to be configured accordingly, see Section 8.7.2.
Byte 9 of the sector trailer is available for user data. For this byte the same access rights
as for byte 6, 7 and 8 apply.
When the sector trailer is read, the key bytes are blanked out by returning logical zeros. If
key B is configured to be readable, the data stored in bytes 10 to 15 is returned, see
Section 8.7.2.
All keys are set to FFFF FFFF FFFFh at chip delivery.
Fig 8. Value blocks
Table 4. Value block format example
Byte Number 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Description value value value adr adr adr adr
Values [hex] 84 D6 12 00 78 29 ED FF 84 D6 12 00 11 EE 11 EE
001aan018
151413121110987654321Byte Number 0
adradradradrvalue valuevalueDescription
001aan013
151413121110987654321Byte Number 0
Key A Key B (optional)Access BitsDescription
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 10 of 39
Fig 9. Sector trailer
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
8.7 Memory access
Before any memory operation can be done, the card has to be selected and authenticated
as described in Section 8.2. The possible memory operations for an addressed block
depend on the key used during authentication and the access conditions stored in the
associated sector trailer.
Table 5. Memory operations
Operation Description Valid for Block Type
Read reads one memory block read/write, value and sector trailer
Write writes one memory block read/write, value and sector trailer
Increment increments the contents of a block and
stores the result in the internal data
register
value
Decrement decrements the contents of a block and
stores the result in the internal data
register
value
Transfer writes the contents of the internal data
register to a block
value
Restore reads the contents of a block into the
internal data register
value
MF1S50YYX All information provided in this document is subject to legal disclaimers. © NXP B.V. 2011. All rights reserved.
Product data sheet
COMPANY PUBLIC
Rev. 3.0 — 2 May 2011
196330 11 of 39
NXP Semiconductors MF1S50yyX
MIFARE Classic 1K - Mainstream contactless smart card IC
8.7.1 Access conditions
The access conditions for every data block and sector trailer are defined by 3 bits, which
are stored non-inverted and inverted in the sector trailer of the specified sector.
The access bits control the rights of memory access using the secret keys A and B. The
access conditions may be altered, provided one knows the relevant key and the current
access condition allows this operation.
Remark: With each memory access the internal logic verifies the format of the access
conditions. If it detects a format violation the whole sector is irreversibly blocked.
Remark: In the following description the access bits are mentioned in the non-inverted
mode only.
The internal logic of the MF1S50yyX ensures that the commands are executed only after
a successful authentication.
Table 6. Access conditions
Access Bits Valid Commands Block Description
C13, C23, C33 read, write → 3 sector trailer
C12, C22, C32 read, write, increment, decrement,
transfer, restore
→ 2 data block
C11, C21, C31 read, write, increment, decrement,
transfer, restore
→ 1 data block
C10 ,C20, C30 read, write, increment, decrement,
transfer, restore
→
本文档为【MF1S50YYX】,请使用软件OFFICE或WPS软件打开。作品中的文字与图均可以修改和编辑,
图片更改请在作品中右键图片并更换,文字修改请直接点击文字进行修改,也可以新增和删除文档中的内容。
该文档来自用户分享,如有侵权行为请发邮件ishare@vip.sina.com联系网站客服,我们会及时删除。
[版权声明] 本站所有资料为用户分享产生,若发现您的权利被侵害,请联系客服邮件isharekefu@iask.cn,我们尽快处理。
本作品所展示的图片、画像、字体、音乐的版权可能需版权方额外授权,请谨慎使用。
网站提供的党政主题相关内容(国旗、国徽、党徽..)目的在于配合国家政策宣传,仅限个人学习分享使用,禁止用于任何广告和商用目的。