WM72016-6 – Secure F-RAM with Gen-2 RFID and Serial Port

Document Number: 001-86227 Rev. **

Page 7 of 33

GEN2 WM72016-6 MEMORY BANKS

The RFID memory banks reside in Ramtron‟s non-volatile F-RAM memory. F-RAM brings many benefits to

the WM72016-6. The first benefit is the size of the memory itself – 16Kbit, most of which is available in the

USER memory bank.

F-RAM‟s impact on the Gen2 protocol is most dramatically seen when writing to

WM72016-6 memory. Unlike EEPROM memory, no charge pump or memory soak time is required to write

to the WM72016-6 memory resulting in zero time and zero power penalties. The write cycle is completed

immediately, allowing an interrogator to continue writing additional data to memory with no time penalty

incurred due to the memory itself. A comparison between F-RAM and EEPROM memories is shown in Figure

3. The figure shows the minimum number of Gen2 instructions required to perform a SELECT, INVENTORY,

and ACCESS sequence of commands to write a data word to memory. The same interrogator command

sequence is transmitted to the WM72016-6 and an EEPROM-based RFID. The effect of the EEPROM time

penalty is shown within the context of the protocol.

INTERROGATOR

TAG

MaxArias Write Cycle

QURY

(240u)

SELECT

(385u)

ACK

(175u)

REQRN

(345u)

EPC

(228u)

WRITE

(495u)

RN

(53u)

HANDLE

(78u)

WR_OK

(80u)

REQRN

(345u)

RN16

(78u)

EE

PR

OM

writ

e d

ela

y!

Ch

arg

e p

um

p &

EE

soa

k tim

e

EEPROM-based Write Cycle

4ms

Figure 3. Gen2 Memory Write Cycle Comparison: F-RAM vs. EEPROM Memories

RESERVED: KILL Password:

The kill password provides a mechanism to permanently disable the WM72016-6 from responding to any and

all Gen2 interrogator commands. The mandatory KILL command can be issued by a RFID interrogator in

either the OPEN or SECURED states. The WM72016-6 is permanently killed through a four-instruction

sequence of REQRN and KILL commands as detailed in the Gen2 standard. The KILL password is a 32-bit

value stored as 2 16-bit data words in reserved memory. The most significant KILL password is stored in

reserved memory bank address 0x00 with the least significant word stored in reserved memory bank address

0x01. The kill function can be permanently disabled by setting both KILL password words to 0x0000, and

permanently locking the KILL password in the reserved memory bank. Once the kill password has been set, it

should be permanently locked using the LOCK command. The WM72016-6 is shipped from the factory with

the kill password memory unlocked. The kill state of the device only affects the Gen2 RFID processor – the

DSPI serial port will continue to function normally.

RESERVED: ACCESS Password:

The access password provides a security mechanism to prevent unauthorized RFID interrogators from writing

to WM72016-6 memory. Non-zero access passwords require the WM72016-6 be placed in the SECURED

state prior to writing to it. This is accomplished through a four-instruction sequence of REQRN and ACCESS

commands as described in the Gen2 standard.

An access password with a value of zero requires no

authentication prior to writing to WM72016-6 memory. The ACCESS password is a 32-bit value stored as two