View PCF7936AS_7778559.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

product specification 2010 may 04 confidential PCF7936AS security transponder (hitag2) free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 2 confidential content 1 featur es ...................................................................................................................... ......................................................... 4 2 general d escript ion............................................................................................................ ............................................ 4 3 ordering in formation .......................................................................................................... ........................................... 4 4 block di agram ................................................................................................................. ................................................... 5 5 typical appl ication ........................................................................................................... ............................................... 5 6 quick refere nce da ta .......................................................................................................... ........................................... 6 7 functional description security tr ansponde r ................................................................................... ............... 7 7.1 memory organiza tion, eepr om ................................................................................................... ................................ 7 7.1.1 identifier, ide ............................................................................................................... .......................................... 8 7.1.2 password basestation, psw b .............................................................................................................................. 8 7.1.3 secret ke y, sk ................................................................................................................ ...................................... 9 7.1.4 transponder and memory conf iguration, tmcf .................................................................................... ............... 9 secret key lock, skl .............................................................................................................................. 9 page 3 lock, pg 3l ............................................................................................................. .................... 9 protect write user page 4 and 5, pwp1 ......................................................................................... ........ 9 protect write user page 6 and 7, pwp0 ......................................................................................... ........ 9 enable cipher mode, enc ....................................................................................................... ............... 9 mode selec t, ms ............................................................................................................... .................... 10 data coding se lect, dcs ....................................................................................................... ............... 10 7.1.5 password transponder, psw t ........................................................................................................................... 10 7.1.6 user pages, u ser 0 to 3 ....................................................................................................... ............................. 10 7.2 transponder stat e diagr am ..................................................................................................... .................................... 11 7.2.1 wait st ate .................................................................................................................... ...................................... 11 7.2.2 authorized state .............................................................................................................. .............................. 12 7.2.3 halt st ate .................................................................................................................... ...................................... 12 7.2.4 read only state ............................................................................................................... ............................... 12 7.3 command set ................................................................................................................... ........................................... 13 7.3.1 command descr ipti on ........................................................................................................... .............................. 14 halt .......................................................................................................................... ........................... 15 read_ page ..................................................................................................................... ................... 15 read_pag e_inv.................................................................................................................. ............... 16 start_auth (pa ssword m ode) .................................................................................................... ...... 17 start_auth ( cipher m ode) ...................................................................................................... ......... 18 write_ page .................................................................................................................... ................... 19 7.4 calculati on unit .............................................................................................................. .............................................. 20 7.5 read only modes ............................................................................................................... ......................................... 21 7.5.1 iso 11784/5 (ms1 = 0, ms0 = 0) ................................................................................................ ........................ 21 7.5.2 miro mode (ms1 = 0, ms0 = 1) .................................................................................................. ....................... 21 7.5.3 pcf7931/30/35 (ms1 = 1, ms0 = 0) .............................................................................................. ..................... 21 7.6 transponder data tr ansmission format .......................................................................................... ........................... 22 7.6.1 read direc tion ................................................................................................................ ..................................... 22 7.6.2 write dir ecti on ............................................................................................................... ...................................... 23 7.7 lf field powe r on re set ....................................................................................................... ...................................... 24 8 eeprom content at deli very .................................................................................................... .................................. 25 9 limiting valu es ............................................................................................................... .................................................. 26 10 device charact eristics ........................................................................................................ ........................................ 27 10.1 electrical char acterist ics .................................................................................................... .......................................... 27 10.2 timing charac terist ics ........................................................................................................ ......................................... 28 10.3 mechanical char acterist ics .................................................................................................... ...................................... 29 11 test set up .................................................................................................................... ...................................................... 30 12 development tools ............................................................................................................. ........................................... 31 free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 3 confidential 13 revision histor y .............................................................................................................. ................................................ 31 14 legal info rmation ............................................................................................................. ............................................. 32 14.1 data sheet status ............................................................................................................. ............................................ 32 14.2 definiti ons ................................................................................................................... ................................................. 32 14.3 disclaime rs ................................................................................................................... ............................................... 32 free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 4 confidential 1 features ? security transponder for use in contactless authentication applications ? data transmission and energy supply via lf link ? 32 bit quasi unique device ident ification (serial number) and product type identification. ? fast mutual authentication, 39ms ? 48 bit secret key ? 256 bit eeprom for user data storage (128 bit) and device configuration/per sonalization (128 bit) ? eeprom read/write pr otection features ? 20 years non-volatile data retention ? more than 100 000 eeprom erase/write cycles ? once the memory has been erased by uv, access is denied ? read only emulation modes (h400x, iso 11784/85 and pcf7931) ? excellent sensitivit y in read and write mode ? automotive temperature range: -40c to +85c ? leadless plastic stick package 2 general description the PCF7936AS is a high performanc e automotive proof security transponder for vehicle immobilization applications, where the transponder has to identify itself towards the basestation as an authorized device. the security transponder derives its power supply from the magnetic field (lf field) established by the basestation. no additional battery supply is needed. data is transmitted by modulating the lf field. the security transponder features secure contactless authentication, employing a secret key and a random number in order to cipher any communication between the device and the basestation. the secure contactless authentication is ideally suit ed for vehicle immobilization applications. in addition, the device features a factory programmed quasi unique serial number that also serves as product type identification. if desired, the device may be operated as a read/write transponder with access control by password or as a read only transponder. 3 ordering information extended package temperature type number name description outline version range (c) pcf 7936as/3851 sot3851 leadless plastic st ick package sot385-1 -40c to +85c pcf 7936as/3851/c sot3851 leadless plastic st ick package sot385-1 -40c to +85c free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 5 confidential 4 block diagram the PCF7936AS features a hi gh degree of integration and incorporates the transponder chip, coil and capacitor assembled in a leadless stick package, see figure 1. security transponder ? contactless interface ? eeprom (256 bit) ? control logic ? calculation unit (security algorithm) ? reset logic ? test logic security transponder security transponder chip calculation unit rectifier voltage limiter contactless interface control logic eeprom (256 bit) lf field power on reset modulator demodulator clock recovery in1 in2 test logic resonance/antenna circuit f res = 125 khz (typ) figure 1. block diagram 5 typical application energy write read basestation analog interface serial interface pcf 7991 to micro- controller inductive link f sys = 125 khz (typ) security transponder pcf 7936as security transponder chip calculation unit rectifier voltage limiter contactless interface control logic eeprom (256 bit) lf field power on reset modulator demodulator clock recovery test logic figure 2. typical system configuration free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 6 confidential 6 quick reference data parameter value unit carrier frequency 125 khz data rate - read - write 4.0 5.2 kbit/s kbit/s data coding - read - write manchester or bi-phase binary pulse length modulation (bplm) data transmission mode half-duplex modulation amplitude shift keying (ask) memory size 256 bit identifier (serial number and product type id) 32 bit secret key (cipher mode) 48 bit password (password mode) 32 bit authentication time 39 ms special features ? ciphered mutual authentication ? ciphered data transmission ? 128 bit user eeprom with programmable write protection ? read/write password mode ? read only emulation modes (h400x, iso 11784/85 and pcf7931) free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 7 confidential 7 functional description security transponder the PCF7936AS does not require any additional power supply. it derives its power supply by inductive coupling to the lf field, which is generated by the basestation. reading and writing to the transponder is provided by amplitude modulation of the lf field. the contactless interface generat es the chip power supply, clock and reset and featur es the modulator, and demodulator. the system clock is derived from the lf field generated by the basestation that typically operates with a carrier frequency of 125 khz. the control logic incorporates the data acquisition logic to enable communication with the transponder and the memory access control logic. access to the transponder memory (eeprom) depends on t he device configuration and the authentication state. the memory is split into blocks and pages with independent access rights, as configured by the user and partly predefined by design. device authentication may be performed in password mode or in ciphered mode. in password mode the basestation and transponder in plain exchange a set of passwords, while in cipher mode a mutual authentication based on a security algorithm is performed that employs a secret key and a random number. the security algorithm is determined by the on-chip calcul ation unit that in addition supports ciphered communication and data exchange between the basestation and the transponder. the cipher mode is ideally suited for vehicle immobilization application. transponder operation and authentic ation is controlled by commands send form the basestation, while in read only mode data transmission commences after device reset and a time-out condition. 7.1 memory organization, eeprom the device incorporates 256 bi t of non-volatile memory (eeprom) that is organized as 8 pages with 32 bit per page, referred to as transponder memory, tm. the transponder memory, tm, is split into areas for transponder configuration/pe rsonalization, tcfg, and user memory, user, see figure 3. page 0 page 7 tcfg page 4 page 3 user transponder memory, tm figure 3. memory organization the tm segment can be accessed only, after successful device authorization. depending on the device configuration, devic e authorization is performed either in password mode or in cipher mode. subsequent memory access is provided only in accordance with the memory protection settings applied. any changes made regarding the transponder configuration, tcfg, respectively page 1 to 3, become effective after a device reset or initialization sequence only. the organization of the transponder memory, tm, depends on the authorization me thod selected (password or cipher mode) by the corre sponding configuration bit (enc) see figure 4. free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 8 confidential msb lsb user 0 page 4 page 5 page 6 page 7 user 1 user 2 user 3 ide bit 31 bit 0 page 0 psw b x psw t page 1 page 2 page 3 b 0 b 31 user 0 page 4 page 5 page 6 page 7 user 1 user 2 user 3 ide page 0 sk (low) x sk (high) tmcf psw t page 1 page 2 page 3 b 0 b 31 b 32 b 47 password mode (enc = 0) cipher mode (enc = 1) msb lsb bit 31 bit 0 b 0 b 23 tmcf b 0 b 23 not used figure 4. transponder memory map note 1. locations marked ?x? are fo r device internal use. they are partly initialized and lo cked against overwriting during device manufacturing and are not available for data storage. any r ead operation yields an undefined bit value. pages 0 to 3 of the eeprom memory are reserved for transponder configuration and personalization, while page 4 to 7 are reserved for user data storage, user. according to the selected aut horization method, page 1 and 2 do hold a password, psw b , (password mode) or the secret key, sk, (cipher mode). 7.1.1 identifier, ide the identifier, ide, is a factory programmed quasi unique 32 bit pattern that serves the function of a device serial number (sn) and product type identification (pi). the identifier is located in page 0 and supports read access only, thus cannot be altered. the product type identification is located in the bits 4 to 7 and factory programmed for all PCF7936AS devices to 1 h , as shown in figure 5. sn 0 msb lsb bit 31 87 43 0 bit 7 4 6 5 pi sn 2 sn 3 sn 1 ide pi 0 0 1 0 figure 5. identifier organization, ide the identifier, ide, is transmitted in plain and incorporated in the process of device authent ication, thus used by the on-chip calculation unit as well as by the interrogating system. 7.1.2 password basestation, psw b the password basestation, psw b , is applicable in password mode only (enc = 0). the password basestation is a 32 bit pattern, which typically is initialized and subsequently locked by the customer during device personalization. the password basestation is located in page 1, see figure 4. during the process to identif y the basestation towards the transponder, the transponder verifies the password received by the basestation with the password stored in psw b . if both match each other, the transponder assumes successful identification of the basestation and the authentication sequence is co ntinued, otherwise it is terminated. for details refer to section 7.3.1, start_auth command. the password basestation may be assigned any value that is considered useful by the application. the psw b can be protected against reading and writing by setting the lock bit skl, see section 7.1.4 nxp initializes the password basestation with a common transport key value as specified (see section 8), in order to enable initial device access. since the corresponding lock bit is not set, the psw b transport key value and device configuration can be read and modified at any time as desired. free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 9 confidential 7.1.3 secret key, sk the secret key, sk is applicable in cipher mode only (enc = 1). the secret key is a 48 bit pattern, which typically is initialized and subsequently locked by the customer during device personaliz ation. the secret key is located in page 1 and 2, see figure 4. the 32 least significant bits of sk (bit 31 to bit 0) are located in page 1 while the 16 most significant bits (bit 47 to bit 32) are located in page 2 at bit address 0 to 15. the immobilizer secret key is incorporated in the process of device authentication and used by the on-chip calculation unit as well as by the interrogating system. however the immobilizer secr et key is never transmitted during the process of device authentication. for details refer to section 7.3.1, start_auth command. the secret key may be assigned any value that is considered useful by the application. the sk can be protected against reading and writ ing by setting the lock bit skl, see section 7.1.4 7.1.4 transponder and memory configuration, tmcf access to the transponder memory, tm, and device configuration is controlled by a set of configuration bits, tmcf, located in page 3, see figure 6. skl pg3l pwp1 pwp0 enc ms1 ms0 dcs msb lsb tmcf bit 31 24 30 29 28 27 26 25 figure 6. transponder memory configuration, tmcf the memory access rights applied by tmcf affect the behavior of read_page and write_page commands only. device operation, e. g. with respect to the authentication process, is not affected at all. secret key lock, skl if set, the password basestation, psw b, (password mode) or the secret key, sk, (cipher mode) is irreversible locked against reading and writing (otp like). if set once, its value can no longer be read or altered. page 3 lock, pg3l if set, page 3 is irreversible locked against writing (otp like). thus if set once, the transponder and memory configuration (tmcf) as well as the password transponder (psw t ) can no longer be altered. however, reading is supported in any case. protect write user page 4 and 5, pwp1 if set, a write protection is assigned for the user pages page 4 and 5 (user0 and user1). as a result its content cannot be altered, however, reading is supported in any case. if cleared, page 4 and page 5 support reading and writing. the content and organization of the user pages is fully determined by the application. protect write user page 6 and 7, pwp0 if set, a write protection is assigned for the user pages page 6 and 7 (user2 and user3). as a result its content cannot be altered, however, reading is supported in any case. if cleared, page 6 and page 7 support reading and writing. the content and organization of the user pages is fully determined by the application. enable cipher mode, enc the device may be configured for to perform authentication in either password mode or cipher mode. if enc is set, cipher mode is selected, otherwise password mode. thus, enc affects operation of the start_auth command and whether plain or ciphered transmission of data and commands is supported, for details refer to section 7.3.1. free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 10 confidential mode select, ms the device may be configured for to support one out of three read only modes, which will cause the device to commence data transmission afte r the specified time-out period, without interrogati on by the basestation, see table 1. table 1. mode select ms1 ms0 read only mode note 0 0 iso 11784/5 0 1 miro 1 1 0 pcf7931/30/35 2 1 1 disabled note 1. emulates miro and h400x like read only transponders 2. features compatibility with nxp? pit family operated in read only mode, except for the pmc timing (program mode check) and available memory size. for details regarding the ti ming and sequence transmitted refer to section 7.5. if ms is set, the device does not support read only operation at all. data coding select, dcs in password or cipher mode data transmitted from the transponder to the basestation may be encoded in manchester or cdp fashion, according to the setting of dcs. if dcs is cleared, manchester encoding is applied, otherwise cdp coding is appli ed, see section 7.6.1 for details. however, if the device operates in one of the read only modes, data transmission and encoding corresponds to the read only mode selected and is not affected by dcs at all, see section 7.5 for details. 7.1.5 password transponder, psw t the password transponder, psw t , is a 24 bit pattern, which typically is initialized and subsequently locked by the customer during device pers onalization. the password transponder is located in page 3, see figure 4. the password transponder serves the function to identify the transponder towards the basestation. after successful device authentication, the tr ansponder returns the content of page 3 to the basestation. in password mode the content is returned in plain, while in cipher mode the content is returned in ciphered fashio n. for details refer to section 7.3.1, start_auth command. thus the password transpon der and tmcf configuration may be evaluated by the bas estation, if desired. the password transponder may hold any value that is considered useful by the application. 7.1.6 user pages, user 0 to 3 page 4 to 7 provide space for user data storage. data access is supported according to the device configuration selected. the user pages may hold any data that is considered useful by the application. free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 11 confidential read_page read_page_inv write_page lf field power on reset authorized start_auth error halt read only wait halt time-out (t wait,sa ) & read only = enabled figure 7. transponder state diagram 7.2 transponder state diagram device operation is controll ed by commands issued from the basestation, see figure 7. after a lf field power-on reset condition the circuitry is reset and the transponder is init ialized, which causes the device to enter the wait state. if one of the read only modes is enabled, the device will enter read only state afte r the specified time-out (t wait,sa ), if no command is being issued. to authenticate the trans ponder and to access the transponder memory for read and write the authorized state has to be entered, by means of a start_auth command and successful comple tion of the authentication sequence. subsequent memory read and write operations may be executed. operation of the trans ponder commands depend on the device configuration (pa ssword or cipher mode). if the device is forced into ha lt state, by means of the halt command, the transponder circuitry is muted. a violation of the command sequence coding or command timing in any state causes an error condition, which causes the device to enter wait stat e and to reset the time-out (t wait,sa ). 7.2.1 wait state in wait state general memory access is denied. commands may be issued to star t device authentication, in order to enter the authorized state, see table 2. table 2. command set in wait state name command, cmd cm4 cm3 cm2 cm1 cm0 reserved 1) 0 x x x x reserved 1) x 0 x x x reserved 1) x x 1 x x reserved 1) x x x 1 x reserved 1) x x x x 1 start_auth 1 1 0 0 0 note 1. this command is reserved for future use and subject to change without notice. the actual implementation causes the device to generate an error condition and to enter the wait state, if this command is being issued. upon entering the wait state the time-out (t wait,sa ) is reset. in case t wait,sa is allowed to time-out, the device enters read only state, if on e of the read only modes is enabled. in case a start_auth command is issued, device authentication is tr iggered and the read only state is not entered. at l east the first two bits of start_auth need to be recognized by the device within the time-out period specified by t wait,sa . free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 12 confidential 7.2.2 authorized state the authorized state is entered only after successful device authenticati on, see start_auth command. in authorized state the transponder memory, tm, can be accessed by means of subsequent read and write commands, see table 3. communication with the device employs plain (password mode) respectively ciphered (c ipher mode) transmission of commands and data. the transponder memory is accessed page wise in accordance with the memory protection configuration. table 3. command set in authorized state name command, cmd cm4 cm3 cm2 cm1 cm0 read_page 1 1 pg2 pg1 pg0 read_page_inv 0 1 pg2 pg1 pg0 write_page 1 0 pg2 pg1 pg0 halt 1) 0 0 x (0) x (0) x (1) note 1. any coding of the bits cm [2:0] will force halt state, however, for future compatibility the values in brackets should be applied. any read respectively write attempt to a page that is read respectively write protected by the corresponding bit in the configuration page, would cause the device to terminate the authorized state and to enter wait state. 7.2.3 halt state the halt state may be enter ed from authorized state only. in halt state the devi ce is muted and any further commands are ignored. to exit the halt state a transponder lf field power-on reset condition must be generated, by means of muting the lf field for the specified time. 7.2.4 read only state the read only state is entered without command interrogation, after termin ation of the time-out, t wait,sa , see also section 7.7. in read only mode command decoding is disabled and the device repeatedly transmits user data, according to the selected read only mode, see section 7.5. the read only state may be te rminated as a result of a transponder lf field power-on reset condition only, by means of muting the lf field for the specified time. free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 13 confidential 7.3 command set device operation is controll ed by commands issued from the basestation. table 4 gives a comprehensive summary of the applicable commands in alphabetic order. command operation and acceptance depend on the actual device state in which the command is being issued as well as on the device configuration (pa ssword/cipher mode), see also section 7.2. a command being i ssued in a different state may cause an error condition. table 4. command set summary name description applicable device state halt forces the device to enter the halt state authorized read_page reads 32 bit from the designated memory page, if not restricted by the corresponding memory protection flags or by specification authorized read_page_inv reads 32 bit from the designat ed memory page, if not restricted by the corresponding memory protection flags or by specification. t he content of the page is returned in inverse polarity. authorized start_auth starts the devic e authentication sequence wait write_page writes 32 bit to the designated memory page, if not restricted by the corresponding memory protection flags or by specification authorized free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 14 confidential 7.3.1 command description the general form of a contro l sequence consists of the command sequence send to the transponder and an equalizer pattern (eq) and response received from the transponder. the general control sequence timing is shown in figure 8. when switching from send to receive and vice versa, the basestation and control softw are have to consider the indicated delays (t wait,tr and t wait,bs ), during which the basestation must not transmit any data or commands. depending on the command, the command sequence consists of a minimum of 5 bit respectively 10 bit. for data integrity reasons memory read and write commands have to be transmitted in normal coding and in inverted coding before being accepted by the device, which yields a minimum command sequence of 10 bit. the equalizer, eq, consist of a 5 bit pattern (all ones) for basestation settling and software synchronization purposes. the device response consists of a command acknowledgment and/or the requested data. some operations require additional parameter to be send to and/or to be received from the device, e.g. write_page or start_auth. for proper operation, command execution by the device must not be suspended for more than the specified idle time (t idle ), see figure 9. otherwise the device may stop command decoding, disabling any communication with the device. in this case, a lf field power-on reset has to be applied, in order to reset and initialize the circuitry, see section 7.7. consequently, the device resumes wait state. as indicated, the idle time is specified as the time interval between the last bit received from the transponder and the last bit of the command sequence send to the transponder. some commands allow repeating the command several times for data integrity reasons, however, in any case the lim itations imposed by the idle time have to be considered. the idle time applies also fo r the very first command send to the device after a device lf field power-on reset condition, see also section 7.7. send to transponder received from transponder command sequence response parameter t wait , tr eq parameter t wait , tr t wait , bs eq figure 8. general control sequence timing t idle send to transponder received from transponder response / parameter t wait , tr command sequence figure 9. command idle time free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 15 confidential halt the command halt may be issued in authorized state and forces the device to enter the halt state. for data integrity reasons the 5 bi t command and its complement have to be send, before the device will accept it, see figure 10. if accepted, the command response consist of the command itself and its complement. the 10 bit command sequence may be repeated several times, if desired, to increase t he data integrity level. in the case that one of the 5 bit commands and its complement do not match, an error conditi on occurs that causes the device to terminate the command, to initialize the device and to enter the wait stat e. no command response will be send by the device in this case. if the device is configured for password mode (enc = 0) the command sequence is transmitted in plain, while in cipher mode (enc = 1) the whole command sequence is transmitted ciphered. read_page the command read_page retu rns the content of the designated page. the page designated for reading is specified by the command bits pg2 to pg0. for data integrity reasons the 5 bi t command and its complement have to be send, before the device will accept it, see figure 11. if accepted, the co mmand response consists of the 32 bit content of the desi gnated page. the msb is send first. the 10 bit command sequence may be repeated several times, if desired, to increase t he data integrity level. in the case that one of the 5 bit commands and its complement do not match, an error condition occurs that causes the device to terminate the comm and, to initialize the device and to enter the wait stat e. no command response will be send by the device in this case. subsequent commands may be issued after termination of t wait,bs . any attempt to read a page t hat is protected against reading, will be detected and cause an error condition, upon which the device terminates the command during t wait,tr and enters the wait state. no response will be send in this case. if the device is configured for password mode (enc = 0) the command sequence is transmi tted in plain, while in cipher mode (enc = 1) the whole command sequence is transmitted ciphered. send to transponder received from transponder 0 0 0 0 1 1 1 1 1 1 t wait,tr 0 0 0 0 1 cm[4:0] eq halt 1 1 1 1 0 cm[4:0] cm[4:0] 1 1 1 1 0 cm[4:0] figure 10. halt timing send to transponder received from transponder 1 1, pg2, pg1, pg0 1 1 1 1 1 t wait,tr cm[4:0] eq t wait,bs read_page bit 31 ..................... bit 0 0 0, pg2, pg1, pg0 cm[4:0] data figure 11. read_page timing free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 16 confidential read_page_inv the command read_page_inv returns the complement of the content of t he designated page. the page designated for reading is specified by the command bits pg2 to pg0. for data integrit y reasons the 5 bit command and its complement have to be send, before the device will accept it, see figure 12. if accepted, the command response consists of the comple ment of the 32 bit content. the msb is send first. the 10 bit command sequence may be repeated several times, if desired, to increase t he data integrity level. in the case that one of the 5 bit commands and its complement do not match, an error conditi on occurs that causes the device to terminate the comm and, to initialize the device and to enter the wait stat e. no command response will be send by the device in this case. subsequent commands may be issued after termination of t wait,bs . any attempt to read a page t hat is protected against reading, will be detected and cause an error condition, upon which the device termi nates the command during t wait,tr and enters the wait stat e. no response will be send in this case. if the device is configured for password mode (enc = 0) the command sequence is transmitted in plain, while in cipher mode (enc = 1) the whole command sequence is transmitted ciphered. send to transponder received from transponder 0 1, pg2, pg1, pg0 1 1 1 1 1 t wait,tr cm[4:0] eq t wait,bs read_page_inv bit 31 ..................... bit 0 1 0, pg2, pg1, pg0 cm[4:0] data figure 12. read_page_inv timing free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 17 confidential start_auth (password mode) if configured for password mode, start_auth triggers the mutual device authenticat ion sequence. if completed successfully, the device enters authorized state and subsequently supports plain r ead and write access of the transponder memory, tm. device authentication employs the password basestation, psw b , and password transponder, psw t , see figure 13. after acceptance of the 5 bit command sequence, the initial device response consist of the 32 bit identifier (ide) that is stored in the transponder memory. subsequently, the interrogating system (e.g. basesta tion) has to identify itself towards the device, by issuing the matching 32 bit password basestation, psw b . the device verifies the password received with the one stores in the page 1. if identical, the final device res ponse consist of the content of page 3 that contains the transponder and memory configuration (tmcf) and device password transponder (psw t ). the msb is send first. in case the authentication pr ocess fails, an error condition occurs that causes the dev ice to terminate the command and to enter wait state. the device will send no further response in this case. subsequent commands may be issued after termination of the final t wait,bs . for proper command execution, the interrogating system has to identify itself towards t he device within the specified idle time, otherwise the device may generate a power-on reset condition, upon which the circuitry would be reset and the transponder initialized, caus ing the device to enter the wait state. send to transponder received from transponder 1 1 1 1 1 t wait,tr eq ide t wait,bs 1 1 0 0 0 cm[4:0] start_auth bit 31 ..............bit 0 t wait,bs bit 31 ..............bit 0 page 1 bit 31 ..............bit 0 t wait,tr page 3 1 1 1 1 1 eq t idle send to transponder received from transponder figure 13. start_auth timing free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 18 confidential start_auth (cipher mode) if configured for cipher mode, start_auth triggers the mutual device authenticati on sequence. if completed successfully, the device enters authorized state and subsequently supports ciphered read and write access of the transponder memory, tm. device authentication employs the identifier, a random number, a ciphered signature and a ciphered device response, see figure 13. after acceptance of the 5 bit command sequence, the initial device response consist of the 32 bit identifier (ide) that is stored in the transponder memory. subsequently, the interrogating system (e.g. basesta tion) has to identify itself towards the device, by issuing a 32 bit random number and a matching 32 bit ciphered signature. the device verifies the authenticity of the ciphered signature received, by means of the calculation un it, involving the secret key (sk). if successful, the final device response consists of the ciphered content of page 3 that contains the transponder and memory configuration (tmcf) and device password transponder (psw t ). the msb is send first. in case the authentication pr ocess fails, an error condition occurs that causes the dev ice to terminate the command and to enter wait state. the device will send no further response in this case. subsequent commands may be issued after termination of the final t wait,bs . for proper command execution, the interrogating system has to identify itself towards t he device within the specified idle time, otherwise the device may generate a power-on reset condition, upon which the circuitry would be reset and the transponder initialized, caus ing the device to enter the wait state. the security algorithm details, involved in the process of mutual device authentic ation, are specif ied in a separate application note. please contact your nxp representative for more information. send to transponder received from transponder 1 1 1 1 1 t wait,tr eq ide t wait,bs 1 1 0 0 0 cm[4:0] start_auth bit 31 ..............bit 0 t wait,bs bit 31 ..............bit 0 random number bit 31 ..............bit 0 [signature] cipher bit 31 ..............bit 0 t wait,tr [page 3 block 0] cipher 1 1 1 1 1 eq t idle send to transponder received from transponder figure 14. start_auth timing free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 19 confidential write_page the command write_page writes the data supplied with this command into the designated page. the page designated for writing is spec ified by the command bits pg2 to pg0. for data integrity reasons the 5 bit command and its complement have to be send, before the device will accept it, see figure 15. if accepted, the command response consist of the command itself, and the corresponding complement. the 10 bit command sequence may be repeated several times, if desired, to increase t he data integrity level. in the case that one of the 5 bit commands and its complement do not match, an error conditi on occurs that causes the device to terminate the comm and, to initialize the device and to enter the wait stat e. no command response will be send by the device in this case nor does the designated page being overwritten. after termination of t prog the device checks, if the eeprom write operation completed successfully, if not, an error condition occurs that c auses the device to enter the wait state. in the case the write oper ation did not complete successfully, the designated eeprom page may hold an undefined content or may suffer from a weak programming. in order to unambiguously verify, whether programming of the designated page complete d properly, the basestation has to identify, if the devic e still resides in authorized state or entered wait stat e. thus, a read_page or read_page_inv command should be issued subsequently and monitored, if this command executes properly. if the device still resides in authorized state, command execution would complete succe ssfully and after verifying the data that has been read , proper operation of the corresponding write_page command can be assumed. subsequent commands may be issued after termination of the final t wait,bs . any attempt to write a page that is protected against overwriting will be detected and cause an error condition, upon which the device terminates the command during t wait,tr and enters the wait state. no response will be send in this case. if the device is configured for password mode (enc = 0) the command sequence is transmi tted in plain, while in cipher mode (enc = 1) the whole command sequence is transmitted ciphered. send to transponder received from transponder 1 1 1 1 1 t wait,tr eq t wait,bs 1 0, pg2, pg1, pg0 cm[4:0] bit 31 ..............bit 0 t wait,bs t prog 1 0, pg2, pg1, pg0 cm[4:0] write_page 0 1, pg2, pg1, pg0 cm[4:0] 0 1, pg2, pg1, pg0 cm[4:0] t idle data send to transponder received from transponder figure 15. write_page timing free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 20 confidential 7.4 calculation unit the PCF7936AS incorporates a calculation unit for use during mutual device authent ication, command operation and eeprom data exchange, if the device is configured for cipher mode. the security algorithm involves a quasi unique 32 bit identifier, a 48 bit secret key and a 32 bit random number. the identifier and the secret key are stored in the transponder memory, tm. the identifier (ide) is a factory programmed quasi unique pattern, while the secret key is initialized and subsequently lock ed by the customer during device personalization. mutual authentication of the security transponder in cipher mode is triggered by means of the start_auth command, see also section 7.3. as a result, the device reveals its identifier to the interrogating system (basestation) and subsequently the interrogating system has to send a 32 bit random number and a ciphered signature to the device. both are processed by the calculation unit, involving the secret key (sk) and identifier (ide), in order to authenticate the interrogating system. if successful, the devi ce replies with a ciphered response for validation by the interrogating system. details concerning the security algorithm implementation are specified in a separate a pplication note. please contact your local nxp representativ e for more information. free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 21 confidential 7.5 read only modes if the device is configured for one of three read only modes, it will cyclically transmit data while operating in read only state. the corresponding read only mode is selected by the configuration bit ms1 and ms0, located in the eeprom, see section 7.1.4. in read only mode, the data rate and coding is fixed as specified and cannot be altered for the corresponding mode. data is transmitted until an lf field power-on reset terminates the read only state. 7.5.1 iso 11784/5 (ms1 = 0, ms0 = 0) if the read only mode iso 11784/85 is selected, the device cyclically transmits us er page 4 to 7, see figure 16. the rate is fixed to 32 t o per bit (t bit = 32 t o ) and cdp encoding is applied. 7.5.2 miro mode (ms1 = 0, ms0 = 1) if the read only mode miro is selected, the device cyclically transmits user page 4 to 5, see figure 17. the rate is fixed to 64 t o per bit (t bit = 64 t o ) and manchester encoding is applied. 7.5.3 pcf7931/30/35 (ms1 = 1, ms0 = 0) if the read only mode pcf7931/30/35 is selected, the device cyclically transmits user page 4 to 7, while inserting a pmc pattern, as known from the pit transponder family (pcf7931/30), see figure 18. however, the modified pmc pattern implemented for the PCF7936AS does not fully comply with the one used for the pit family. the rate is fixed to 64 t o per bit (t bit = 64 t o ) and cdp encoding is applied. send to transponder received from transponder t wait,ro bit 31 ............ bit 0 page 4 page 5 page 6 bit 31 ............ bit 0 bit 31 ............ bit 0 page 4 bit 31 ............ bit 0 bit 31 ............ bit 0 page 7 figure 16. sequence for iso 11784/85 read only mode send to transponder received from transponder t wait,ro page 4 page 5 page 4 bit 31 ............ bit 0 bit 31 ............ bit 0 bit 31 ............ bit 0 figure 17. sequence for miro read only mode send to transponder received from transponder t wait,ro bit 31 ............ bit 0 page 4 page 5 page 6 bit 31 ............ bit 0 page 4 bit 31 ............ bit 0 bit 31 ............ bit 0 page 7 192 t o 64 t o 128 t o modified pmc bit 31 ..... figure 18. sequence for pcf7931/30/35 read only mode free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 22 confidential 7.6 transponder data transmission format reading from and writing to the device is accomplished by modulating the lf field in amplit ude. since the lf field also provides the device power supply, the modulation characteristics have to be verified carefully, in order to avoid a device reset due to a power low condition. 7.6.1 read direction transmission of data from the transponder to the basestation is accomplished by absorption modulation applied to the lf field. according to the data designated for transmission, the transponder interface activates an additional load that modulates the current drawn from the transponder resonant circuit. due to the inductive coupling of the transponder resonant circ uit and the basestation coil, the current in the basestation coil is modulated accordingly, resulting in a corresponding two-level amplitude modulation, see figure 19. in read direction the device em ploys either manchester or cdp encoding of data, see fi gure 20, according to the setting of the immobilizer conf iguration bit dcs, which is part of the transponder and me mory configuration bits, tmcf, see also section 7.1.4. in case of manchester encoding, a logic ?1? is modulated by loading the lf field during the first half of the bit frame, while no load is applied during the second half. a logic ?0? is modulated in the opposite manner. in case of cdp encoding, a logic ?1? corresponds to a state change at the end of the bit frame. a logic ?0? corresponds to a state change after the first half and at the end of the bit frame. in any case, the device starts with a ?load on? condition, when data transmission commences. the bit duration is a fixed multiple of the system clock recovered from the lf field carrier. after reception of the last bit, the basestation and control software have to consider the indicated delay, t wait,bs , before any command or data is transmitted to the device, see also section 7.3.1. v lf-low load on v lf-high load off figure 19. lf field absorption modulation t bit 0.5 x t bit internal data manchester encoding cdp encoding '1' '0' '0' lf field: load off load on load off load on '0' last bit start of transmission '1' '1' '0' '1' end of transmission t wait,bs ... figure 20. data transmission in read direction free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 23 confidential 7.6.2 write direction transmission of data from the basestation to the transponder is accomplished by amplitude shift keying (ask) of the lf field with a modulation index as specified. according to the data designated for transmission, the basestation coil driver is simply switched on and off (tri- state) typically. due to t he inductive coupling of the transponder resonant circuit and the basestation coil, the voltage of the transponder reso nant circuit is modulated accordingly. resulting in a two-level amplitude modulation that is detected by the tr ansponder interface demodulator circuitry, see figure 21. the PCF7936AS transponder demodulator circuitry has been optimized for basestations with antenna coil drivers that perform the lf field modul ation by tri-state switching of the driver stage. in write direction binary puls e length modulation (bplm) is applied for data encoding, see figure 22. sending data or commands to the device commences with an initial write pulse that ma rks transmission start. a logic ?0? or ?1? is signaled to the transponder by the corresponding repetition time (t log_0 respectively t log_1 ) of the write pulse sequence. the end of the transmitted bit st ring is marked by a stop condition. a stop condition is detected by the transponder, if no write pulse is detect ed for the specified time (t stop ). in the case the bit string transmitted causes the device to respond with data, modulation of the lf field by the device does commence after the specified time out (t wait,tr ), see also section 7.3.1. violation of the specified timi ng causes an error condition, upon which the device enters the wait state, see also section 7.2. v lf-low coil v lf-high coil figure 21. ask modulation of lf field by the basestation internal data bplm encoding lf field: high low stop condition start of transmission '1' '1' '0' t wait,tr end of transmission last bit t log_0 t log_1 t wrp t stop ... figure 22. data transmission in write direction free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 24 confidential 7.7 lf field power on reset when the transponder enters a lf field a rectifier circuitry becomes operational and the in ternal transponder supply voltage (v dd ) develops. as soon as the supply voltage exceeds the lf field power-on reset threshold voltage (v thr ) the device performs a chip reset and starts its initialization sequenc e, see figure 23. subsequently, the transponder is muted and does not respond to any command prior to termination of the initialization sequence, t init . the startup time, t start , depends on the basestation confi guration, the resonance circuit properties and the system coupling factor, however, is small compared with the initialization time typically. for proper device operation, after a lf filed power-on reset condition, command execution must commence within the specified idle time, t idle , see figure 23. otherwise the device ma y stop command decoding, disabling any communication with the device. in this case a lf field power-on reset has to be applied, in order to reset and initialize the circuitry. consequently, the device would resume wait state. as indicated, the idle time is specified as the time interval following the initialization sequence until the last bit of the command sequence that is send to the transponder. in case one of the read on ly modes is enabled, the device enters read only state, if the first two bits of the start_auth command are not being recognized within the time-out period t wait,sa . in this case, read only operation commences t wait,ro after termination of the initialization sequence, t init , see figure 23. for details refer to section 7.5. in order to force a lf field power-on reset and proper device initialization at any ti me, the lf field off condition must be applied for at least t reset,setup , in order to ensure that the internal dev ice supply voltage, v dd , drops below the threshold voltage (v thr ), see figure 24. lf field applied v thr t init v dd t start lf field power on reset (por) threshold voltage t t idle command sequence read only mode t wait,ro t wait,sa t figure 23. lf field power on reset timing lf field off v thr t v dd t reset_setup lf field power on reset (por) threshold voltage figure 24. lf field power on reset setup timing free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 25 confidential 8 eeprom content at delivery the PCF7936AS eeprom content is initialized during device manufacturing, according to table 5. however the eeprom content may be modified as desired by the application, except for the page 0 block 0 which holds the identifier (ide) and serv es the function of a serial number and product type id. table 5. eeprom content upon delivery bit 31 bit 0 content [hex] page note xx xx xx 1x 0 1 4d 49 4b 52 1 xx xx xx xx 2 06 aa 48 54 3 2 xx xx xx xx 4 xx xx xx xx 5 xx xx xx xx 6 xx xx xx xx 7 note 1. bit 7 to 4 of the this page (identifier) serve the function of a product type (application) identifier and are set to ?0001? for the PCF7936AS. 2. initially the device is c onfigured for password mode with the transport key (password basestation, psw b , as specified (page1). the cust omer as desired for the application may change the configuration. 3. locations marked ?x? are undefined and may hold any pattern. free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 26 confidential 9 limiting values all values are in accordance with abso lute maximum rating system (iec 134) parameter min max unit operating temperatur e range -40 +85 c storage temperature range -55 +125 c magnetic flux density (resistance a gainst magnetic pulses) 0.2 t vibration - 10 - 2000hz - 3.axis - iec 68-2-6, test fc 10 g shock - 3.axis - iec 68-2-27, test ea 1500 g mechanical stress (f max ), note 1 10 n note 1. f max is specified as indicated in test setup, section 11. free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 27 confidential 10 device characteristics 10.1 electrical characteristics tamb = -40 to +85c, f sys = 125khz, t o = 1/f sys . unless otherwise specified symbol parameter condition min typ max unit operating conditions f res resonance frequency 121 129 khz bw bandwidth 2.3 khz b thr magnetic flux density, read direction 35 400 t pp b prg magnetic flux density, note 1 for eeprom programming m = 0,95, t wrp = 8 t o 35 400 t pp b aut magnetic flux density, note 1 for device authentication m = 0,95, t wrp = 8 t o 35 400 t pp b read lf field absorption in read direction, note 1 b field = 35 t pp 8 t pp mi prg minimum modulation index (m), note 1 write direction, device programming and authentication b field = 35 t pp , t wrp = 8 t o 95 % eeprom t ret data retention time tamb = 50c 20 years n wr-cyl write endurance, page 1 to 7 100 k cycle note 1. modulation index (m) and lf field absorption (b read ) are defined according to figure 25. 2. parameters are measured with the scemtech test equipment stm-1 in a helmholtz arrangement according to section 11. transponder lf field b min b max - b min m = b max + b min b max b read = b max - b min figure 25. definition of modulation index (m) and lf field absorption (b read ) free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 28 confidential 10.2 timing characteristics tamb = -40 to +85c, f sys = 125khz, t o = 1/f sys . unless otherwise specified symbol parameter condition min typ max unit command handling t wait,tr transponder response delay 199 206 t o t wait,bs basestation response delay 90 t o t prog eeprom erase/write time 615 t o t idle idle time 80 ms data transmission t bit bit duration 32 t o t wrp write pulse width note 1 4 10 t o t log_0 write pulse repetition time, logic 0 18 22 t o t log_1 write pulse repetition time, logic 1 26 32 t o t stop write pulse length, stop condition 36 t o lf field power on reset , note 2 t start transponder initialization time b field = 35 t 80 s t init transponder initialization time 225 t o t reset,setup lf field power on reset setup time b field = 100 t 5 ms read only mode t wait,sa timeout for start_auth command 320 t o t wait,ro read only mode startup delay note 3 326 t o notes 1. as detected by the trans ponder interface demodulator. the corresponding lf field write pulse width applied by the basestation depends on the resonance circuit properti es and actual system coupling factor. 2. characterized with the scemtech test equipment stm- 1 in a helmholtz arrangement according to section 11. 3. total delay (tinit + twait,ro) = 551 t0 free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 29 confidential 10.3 mechanical characteristics o t h e r w i s e s p e c i f i e d protruding plastic must not exceed specified dimension by more than 0.2 mm a l l r a d i i , i f n o t a a 1.1-1.2 2.9-3.05 4.9-5.1 1.9-2.1 4.4 - 4.6 11.9-12.1 5.9-6.1 r 0 . 5 m a x . 0 - 7 (5 x ) 0 - 7 ( 5 x ) 4 4 - 4 6 0.165 ( without scale ) cross section a-a r 0 . 9 - 1 . 0 figure 26. package outlines sot 385-1 outline dimensions are nominal value s 1.5 0.25 2.1 -0.1 1.5 0.25 10.4 12.0 0.4 ic c l 2.1 -0.1 1.6 0.2 figure 27.coil position, layout sot 385ba4 free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 30 confidential 11 test setup device characteristics are measured according to the test setups given below. electrical characteristics are measured in a helmholtz arrangement that generates an almost homogenous magnetic field at the positi on of the device under test (transponder), see figure 29. the sense coils detect the absorption modulation induced by the transponder, whereas t he reference coils sense the magnetic flux generated by t he field generating coils only. the voltage difference measur ed between the sense coils and reference coils is proportional to the magnetic field absorption induced by the transponder. dut f max figure 28. mechanical stress v dif signal generator ~ reference coils (serial connected, in phase) field generating coils (serial connected, in phase) sense coils (serial connected, in phase) reference coils (serial connected, in phase) dut figure 29. helmholtz setup for electrical characteristics free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS 2010 may 04 31 confidential 12 development tools reference name description om6705 ted-kit transponder evaluation and development kit 13 revision history revision page description 2000 apr 04 9, 10 14 revised and updated revision pwp2 renamed pg3l and cselect renamed dcs specification of t idle extended and updated 2003 may 15 7 editorial changes and correction changes regarding the transponder configuration become effective after a device reset or initialization sequence only. 2007 nov 28 4 change to nxp ?unique ide? is replaced with ?quasi unique ide?. ide coderange is depleted and numbe ring is restarted (at 00h) 2007 nov 30 28 corrected read only mode startup delay t wait,ro to 326 t o 2009 feb 25 5 fixed missing figure 1. block diagram 2010 may 04 4 added type pcf 7936as/3851/c with new manufacturing site icn free datasheet http:///
nxp semiconductors product specification security transponder (hitag2) PCF7936AS please be aware that important notices concerning this document and the product(s) described herein, have been included in the section 'legal information'. ? nxp b.v. all rights reserved. for more information, please visit: http://www.nxp.com for sales office addresses, email to: sales.addresses@ www.nxp.com 14 legal information 14.1 data sheet status document status product status definition objective [short] data sheet deve lopment this document c ontains data from the objective s pecification or product development preliminary [short] data sheet qualific ation this document cont ains data from the pre liminary specification product [short] data sheet produc tion this document contains the product s pecification 14.2 definitions draft the document is a draft version only. the content is still under internal review and s ubject to formal approval, which may resu lt in modifications or additions. nxp semiconductors does not give any representations or warranties as to the accuracy or complet eness of information included herei n and shall have no liability for the consequences of use of such information. short data sheet a short data sheet is an extract from a fu ll data sheet with the same product type num ber(s) and title. a s hort data sheet is i ntended for quick reference only and should not be relied upon to contain detail ed and full information. for detailed and fu ll information see the relevant full dat a sheet, which is available on request via the local nxp semiconductors sales office. in case of any inconsist ency or conflict with the s hort data sheet, the full data sh eet shall prevail. 14.3 disclaimers general information in this document is believed to be accurate and reliable. however, nxp semiconductors does not give any representat ions or warranties, expressed or implied, as to the accuracy or comple teness of such information and shall have no liability for the consequenc es of use of such information. right to make changes nxp semiconductors reserves the right to make changes to information published in this document, including without limitation s pecifications and product descriptions, at any time and without notice. this document super sedes and replaces all informat ion supplied prior to the publi cation hereof. suitability for use nxp semiconductors products are not designed, authorized or warrant ed to be suitable for use in medical, military, aircraft, sp ace or life support equipment, nor in applications where failure or malfunction of a nxp semiconductors produc t can reasonably be expected to result in personal inju ry, death or severe property or environmental damage. nxp semiconductors acc epts no liability for inclusion and/or use of nxp semiconductors products in such e quipment or applications and therefore such inclusion and/or us e is at the customer?s own risk. applications applications that are described herein for any of these products are for illustrative purposes only. nxp semiconductors makes n o representation or warranty that such applications will be suitable for the specified use without further testing or modification. limiting values stress above one or more limiting values (as defined in the absolu te maximum ratings system of iec 60134) may cause permanent d amage to the device. limiting values are stress ratings only and operation of the device at these or any other conditions above thos e given in the characteri stics sections of this document is not implied. exposure to limiting values for extended periods may affect device reliability. terms and conditions of sale nxp semiconductors products are sold s ubject to the general terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms , including those pertaining to warranty, intellectual property rights infr ingement and limitation of liabilit y, unless explicitly otherwis e agreed to in writing by nxp semiconductors. in case of any inconsist ency or conflict between information in th is document and such terms and conditions, th e latter will prevail. no offer to sell or license nothing in this document may be interpret ed or construed as an offer to sell products that is open for acc eptance or the grant, conveyance or implication of any license under any copyrights, pat ents or other industrial or intellectual property rights. free datasheet http:///

▲Up To Search▲

Price & Availability of PCF7936AS

	To Download PCF7936AS Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .