Demo Software User's Guide - Texas Instruments · 2. Download the RFID Demo Software (“Tools & Software”) 3. Extract the ZIP-file contents into a folder and execute the RFID Demo

Copyright © 2013, Texas Instruments Incorporated About this Manual Please submit documentation feedback 1 / 74

Demo Software User’s Guide AES and 80 Bit Product Family

USER’S GUIDE RFID Demo Software

www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated About this Manual Please submit documentation feedback 2 / 74

1 About this Manual

The AES Demo Software can be used to execute the main features of TI’s AES and 80-bit transponders along with a TI Demo Reader, such as the RI-ACC-ADR2. Resonant trimming, transponder communication and passive entry communication can be evaluated – depending on what reader is used. The Demo Software synchronizes settings with the device configuration to achieve valid data communication and response analyzing. Some devices only offer partial functionality (e.g. smaller memory or trimming only). This is not considered in the demo software and needs to be managed by the user. This manual describes the functionality of the AES Demo Software and serves also as manual for the RI-ACC-ADR2 evaluation module, though other readers can be used with this software. Each description presents a specific function in a general sense. Not all features and functions may be supported on all devices. The user should consult the device-specific data sheet for these details.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Table of Contents Please submit documentation feedback 3 / 74

2 Table of Contents

Demo Software User’s Guide AES and 80 Bit Product Family ....................................................................... 1

1 About this Manual .......................................................................................................................................... 2

2 Table of Contents ........................................................................................................................................... 3

3 Table of Figures.............................................................................................................................................. 5

4 Definitions ....................................................................................................................................................... 6

5 Installation ...................................................................................................................................................... 7

5.1 Hardware Installation of RI-ACC-ADR2-10 Demo Reader ......................................................................... 7 5.2 Software Installation .................................................................................................................................... 7

6 RI-ACC-ADR2 Schematics ............................................................................................................................. 8

7 COM Ports ....................................................................................................................................................... 9

7.1 Initial Reader Search .................................................................................................................................. 9 7.2 Repeat Automatic Device Search .............................................................................................................11 7.3 Manual COM Port Connection ..................................................................................................................12

8 General Software Functionality ..................................................................................................................13

8.1 Settings .....................................................................................................................................................13 8.2 Resonant Trimming ...................................................................................................................................14

8.2.1 Resonant Trimming (Reader controlled) ...........................................................................................15 8.3 Passive Entry, Passive Start with a CRAID (TMS37128) .........................................................................16 8.4 Immobilizer Read Page (DST80) ..............................................................................................................18

8.4.1 DST80 Transponder Immobilizer Timing Settings .............................................................................19 8.4.2 Example: Read Page 3 Telegram (DST80) .......................................................................................20 8.4.3 Example: Read Page 8 Response (DST80) ......................................................................................21

8.5 Immobilizer Program Page (DST80) .........................................................................................................22 8.5.1 Example: Program Page 8 Telegram (DST80) .................................................................................22

8.6 Immobilizer Lock Page (DST80) ...............................................................................................................24 8.6.1 Example: Lock Page 8 Telegram (DST80) ........................................................................................25

8.7 Using the TPIC84134 Antenna Extension Board ......................................................................................26 9 Software Functionality Specific to AES Product Family ..........................................................................27

9.1 Synchronization of device configuration with AES Demo Software..........................................................27 9.2 Enhanced Interface ...................................................................................................................................28 9.3 Read the Content of a Transponder Page ................................................................................................29

9.3.1 Example: General Read Page 4 ........................................................................................................30 9.3.2 Example: Mutual Read Page 4 ..........................................................................................................33

9.4 Program the content of a transponder page .............................................................................................34 9.4.1 Example: General Program Page 4...................................................................................................35 9.4.2 Example: Mutual Program Page 4.....................................................................................................37 9.4.3 Calculation of the CRC Byte ..............................................................................................................39

9.5 Page lock ..................................................................................................................................................40 9.5.1 Example: Serial Communication Telegram of Lock Page 6 ..............................................................41

9.6 Authentication Command ..........................................................................................................................42 9.6.1 Example: Serial Communication Protocol of Plain Program AES Key 1...........................................44 9.6.2 Example: Serial Communication Protocol: Encryption with AES Key 1 ............................................45

9.7 Mutual Authentication with Anticollision Command ..................................................................................47 9.8 Packet Error Rate - Mode .........................................................................................................................49 9.9 AES Passive Entry / Passive Start (PEPS) ..............................................................................................50

9.9.1 Example: Send AES PEPS Wake Pattern with additional data ........................................................52 9.9.2 Example: LF Downlink of an AES PEPS telegram ............................................................................54

9.10 AES PEPS Program Wake Pattern ........................................................................................................55 9.10.1 Example: Serial Comm. Protocol of Program AES PEPS Wake Pattern ........................................56 9.10.2 Example: LF Downlink of Program AES Wake Pattern ...................................................................58

9.11 AES Demo: Inventory Process (PC controlled) ......................................................................................59

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Table of Contents Please submit documentation feedback 4 / 74

9.12 AES Demo: Pairing (PC controlled) ........................................................................................................60 9.12.1 Pairing with Inventory Process ........................................................................................................60 9.12.2 Pairing without Inventory Process ...................................................................................................61

9.13 AES Demo: Pairing (Reader controlled) .................................................................................................64 9.13.1 Pairing Data .....................................................................................................................................65 9.13.2 Inventory Pairing ..............................................................................................................................65 9.13.3 Sequential Pairing ...........................................................................................................................65 9.13.4 Mutual Authentication ......................................................................................................................65 9.13.5 Mutual Authentication with Anticollision ..........................................................................................65

9.14 Relay Tag Demo .....................................................................................................................................66 10 Serial Communication Protocol Description .............................................................................................67

EVM Important Notice .......................................................................................................................................68

10.1 EVALUATION BOARD/KIT/MODULE (EVM) ADDITIONAL TERMS.....................................................68 10.2 REGULATORY COMPLIANCE INFORMATION ....................................................................................68 10.3 Important Notice for Users of this Product in Japan ...............................................................................70 10.4 EVALUATION BOARD/KIT/MODULE (EVM)WARNINGS, RESTRICTIONS AND DISCLAIMERS ......71

11 Revision History ...........................................................................................................................................73

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Table of Figures Please submit documentation feedback 5 / 74

3 Table of Figures

Figure 1: Base Station Schematics ................................................................................................................... 8 Figure 2: COM Port Search................................................................................................................................. 9 Figure 3: Connected Hardware Tools .............................................................................................................10 Figure 4: New Automatic Device Search ........................................................................................................11 Figure 5: Toggle Manual Selection / Automatic Search of COM Port ..........................................................12 Figure 6: Access Settings Menu ......................................................................................................................13 Figure 7: Transfer Settings and Finished .......................................................................................................13 Figure 8: Resonant Frequency Trimming .......................................................................................................14 Figure 9: Configure CRAID EEPROM ..............................................................................................................16 Figure 10: Transponder: Read Page (DST80) .................................................................................................18 Figure 11: Coding Configuration (DST80) ......................................................................................................19 Figure 12: Example: Program Page 8 (DST80) ...............................................................................................22 Figure 13: Example: Lock Page 8 (DST80) .....................................................................................................24 Figure 14: TPIC connection ..............................................................................................................................26 Figure 15: Antenna Extension Configuration .................................................................................................26 Figure 16: Burst Read of Configuration Bank ................................................................................................27 Figure 17: Display Bank 7 via Enhanced Interface ........................................................................................28 Figure 18: Read page content ..........................................................................................................................29 Figure 19: General Read Page 4 (Bank 7) .......................................................................................................30 Figure 20: Program page content ....................................................................................................................34 Figure 21: General Program Page 4 (Bank 7) .................................................................................................35 Figure 22: General Lock Page ..........................................................................................................................40 Figure 23: Program AES Key ...........................................................................................................................42 Figure 24: Authentication command ...............................................................................................................43 Figure 25: Configure Bank 7: Page 5 for Anti-Collision Encryption ............................................................47 Figure 26: Anticollision Encryption .................................................................................................................48 Figure 27: Packet Error Rate ............................................................................................................................49 Figure 28: Wake Pattern and Additional Data ................................................................................................50 Figure 29: AES PEPS Timing settings ............................................................................................................51 Figure 30: Results of Inventory Process ........................................................................................................59 Figure 31: Result of Pairing Sequence with Inventory Process ...................................................................60 Figure 32: Result of Pairing Sequence without Inventory Process .............................................................63 Figure 33: Pairing (Reader controlled) ............................................................................................................64 Figure 34: AES Trp Charge Time Settings ......................................................................................................66

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Definitions Please submit documentation feedback 6 / 74

4 Definitions

Base Station

Communication partner able to communicate by the use LF telegrams with a transponder

Immobilizer

Short range LF communication between base station and transponder running without battery support on transponder side

Downlink

LF communication from Base Station to transponder OR USB communication from PC to Base Station

Charge Phase

LF energy transfer from the Base Station to the transponder; energy is stored in the charge capacitor for the uplink phase

Uplink, Response

LF communication from the transponder to the base station OR USB communication from Base Station to PC

RKE

Remote Keyless Entry: UHF communication from the key fob to the vehicle initiated by a push button press

PEPS

Passive Entry/ Passive Start: The Base Station sends a LF telegram which requests a UHF response from the Key Fob

DST80 Wedge-transponder with TI 80-bit-encryption module

DSTAES Wedge- or Block-transponder with 128-bit-encryption module

DST Digital Signature Transponder

RAIDAES Remote Access Identification Device with AES used in PEPS-applications

CRAIDAES RAIDAES with additional embedded microcontroller

CRAID

Remote Access Identification Device with DST80 used in PEPS-applications with additional embedded microcontroller

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Installation Please submit documentation feedback 7 / 74

5 Installation

5.1 Hardware Installation of RI-ACC-ADR2-10 Demo Reader

1. Connect the external USB Interface Board to the two designated sockets on the bottom-left side of the Base Station board. Make sure to connect the device in correct orientation (the Texas Instruments logo of the boards should point in the same direction – see picture below).

2. Connect the Loop Antenna to the corresponding connectors in the top-right corner of the Base Station Board, labelled 1 to 6.

3. Connect the USB Interface Board to a PC using the Mini-USB Cable.

4. (Optional) Apply an additional power source to the power-connector of the Base Station (9V DC) to achieve an increased transmission range and/or drive a bigger antenna.

5.2 Software Installation

1. Go to the product page of the ADR2 Demo Reader: http://www.ti.com/tool/ri-acc-adr2-10

2. Download the RFID Demo Software (“Tools & Software”)

3. Extract the ZIP-file contents into a folder and execute the RFID Demo Software executable – no installation required.

4. To use DST80 functionality, no activation code is required. Just leave the textbox blank and click OK. To enable AES related functionality a corresponding activation key is needed – please ask your RFID related TI contact person.

5. After connecting the reader the first time, installation of the COM port driver may be required. This can be done by clicking on the corresponding button on the Com Port setting tab page

http://www.ti.com/

http://www.ti.com/tool/ri-acc-adr2-10


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated RI-ACC-ADR2 Schematics Please submit documentation feedback 8 / 74

6 RI-ACC-ADR2 Schematics

Figure 1: Base Station Schematics

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated COM Ports Please submit documentation feedback 9 / 74

7 COM Ports

7.1 Initial Reader Search

Figure 2: COM Port Search

After start-up of the AES Demo Software an automatic search for attached demo readers and probe test boxes is initiated. The tool supports the simultaneous use of up to two Demo readers and one Probe Test box.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


After completion of the COM port search up to three found devices are displayed in the status line:

Figure 3: Connected Hardware Tools

The highlighted button indicates the currently used COM port for communication. Each attached device is automatically initialized with the communication parameters valid for the currently used tab. A click on the desired reader in the status bar will select this reader and timings are transferred to this reader immediately. The software will only communicate with the selected reader.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


7.2 Repeat Automatic Device Search

In some cases it might be desirable to repeat the Automatic Device Search. For example when a device is connected which supports no auto-detection (e.g. Probe Test Box) while the software is already running. In that case, a click on the COM Port Search button in the status bar will induce another COM Port search.

Figure 4: New Automatic Device Search

Note:

If the Automatic COM Port Search is deactivated (see section Manual COM-Port Connection) it will get reactivated by executing an Automatic COM Port Search.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


7.3 Manual COM Port Connection

If problems with the Automatic COM Port Search are experienced, or for other reasons a manual selection of the COM Port is desired, the Automatic COM Port Search can be deactivated and the desired COM port can be chosen manually. To do so following steps are required:

1. Activate the Settings tabs by clicking on Settings 2. Select the COM Port tab page 3. Uncheck Automatic Search checkbox 4. Select the COM Port which the device is connected to 5. To deactivate the Settings tabs and return to the last used tab click Finished

Figure 5: Toggle Manual Selection / Automatic Search of COM Port

1

2

3, 4

5

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated General Software Functionality Please submit documentation feedback 13 / 74

8 General Software Functionality

8.1 Settings

To configure bit timings, burst durations, COM port connections and more the Settings tab page can be used. To access this tab page click on Settings as shown below:

Figure 6: Access Settings Menu

On Settings tab pages there are usually two buttons Transfer Settings and Finished.

Figure 7: Transfer Settings and Finished

Transfer Settings transfers the currently displayed settings to the selected reader or the selected COM port but stays on the Settings tab page. Finished transfers the settings exactly like the Transfer Settings button but additionally switches to the (non-settings) tab page previously used.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.2 Resonant Trimming

The AES Demo Software supports Resonant Trimming for DST and AES transponders through the Test Interface. Requirements:

- Probe Test Box OR

- TBA-B300 To execute the resonant trimming procedure, following steps are required:

1. Ensure a Demo Reader is correctly recognized by the software (see bottom left corner) 2. Select tab “Resonant Trimming” 3. Select the device type to be trimmed in the Device Selection combo box 4. Click on Automatic Trim All

This executes a PC controlled Automatic Trimming action. This is actually a sequence of Direct Trimming and Get Frequency actions. For details on the used protocol and telegram examples, please refer to section Error! Reference source not found..

Figure 8: Resonant Frequency Trimming

The Demo Software will show the trimmed frequency in the field “Measured Frequency”. In case the resonant frequency cannot get trimmed to the target frequency a notice will be displayed providing further instructions.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.2.1 Resonant Trimming (Reader controlled)

It’s also possible to perform a reader controlled automatic trimming of all channels. Requirements:

- TBA-B300

1. Select tab “Resonant Trimming” 2. Select the device to be trimmed in the Device Selection combo box 3. Click on Advanced Automatic Trimming button 4. Wait until results are shown in the table above. The orange LED3 on the Base Station indicates

trimming activity.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.3 Passive Entry, Passive Start with a CRAID (TMS37128)

For a unidirectional PEPS communication, which means the Base Station will send a LF Wake Pattern without expecting a response, following requirements apply: Requirements (unidirectional PEPS):

- ADR2 demo reader OR TBA-B300 - CRAID demo key fob

For a complete (bidirectional) PEPS communication, which means the Base Station will send a LF Wake Pattern and can receive the UHF response of the responding key fob, following requirements apply: Requirements (bidirectional PEPS):

- TBA-B300 with connected UHF- Module - CRAID demo key fob

To perform a PEPS command some preparation is required if the CRAID EEPROM is not yet configured:

1. Connect the CRAID and the Base Station via the Test Interface 2. Activate the CRAID PEPS tab 3. Check the Configure CRAID EEPROM checkbox 4. Choose a configuration or just load the default values (by clicking on Get AFE Defaults) 5. Transmit settings by clicking on Set AFE Configuration. On success, the background of the button

will become green. The Configure CRAID EEPROM checkbox may be unchecked again to view the RSSI measurement diagram.

6. Disconnect the device from Test Interface

Figure 9: Configure CRAID EEPROM

3

5, 6

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


With the configured EEPROM of the CRAID device it is now possible to execute the PEPS command.

1. Power up the CRAID (e.g. insert 3V Coin Cell) 2. Place the CRAID demo board somewhere in range of the stick antennas LF field but not too close

to the UHF Module of the Base Station to prevent oversaturation. 3. Select the PEPS tab in the software. 4. Ensure the correct reader is selected – preferably with UHF Module to receive a response 5. Adjust Wake Pattern Length and Wake Pattern according to the configuration on the CRAID

EEPROM (by configuring the EEPROM the correct values were already entered in the corresponding boxes)

6. Eventually add an Additional Data string. Sending “C2” will cause the demo key fob to measure the LF RSSI.

7. To execute the action click on Send Wake Pattern String 8. If a UHF response is obtained the content will be displayed 9. Optional: If a diagram of the RSSI result of the last 20 received responses is desired, uncheck the

Configure CRAID EEPROM checkbox.

If problems with the LF RSSI measurement occur though “C2” is sent as Additional Data, consider configuration of RSSI Burst Time in the PEPS Settings tab page (Settings menu). During this power burst at the end of the LF transmission the RSSI value is measured.

3

4

5, 6

7 8

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.4 Immobilizer Read Page (DST80)

To read a page of a DST80 transponder or related devices, like the RAID / CRAID, follow those instructions:

1. If not done yet, power up the board, connect it to the PC, start the software and place the Transponder / LF- Antenna in the LF field of the readers Immobilizer Loop Antenna.

2. Activate the DST80 Transponder tab 3. Choose the page which should be read 4. Click on Read Page 5. After a successful read CRC correct should be displayed along with green highlighting 6. The data read out from the page will be displayed in the Received Bytes section

Figure 10: Transponder: Read Page (DST80)

2

3

4

5

6

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.4.1 DST80 Transponder Immobilizer Timing Settings

When in doubt, use default timing settings and pulse width modulation bit coding (PWM).

Figure 11: Coding Configuration (DST80)

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.4.2 Example: Read Page 3 Telegram (DST80)

By clicking on Read Page 3 the software sends via Serial Communication following telegram based on the protocol described in Error! Reference source not found.: ” 01060432080C000AAC”. This data is assembled as follows: Serial Communication Protocol

Start Length Cmd PB1 No. TX bits TX bits PB2 No. RX bytes

BCC

01 06 04 32 08 0C 00 0A AC

Byte Abbreviation Content Example Value

Explanation

1 Start Start Mark 01

2 Length Length 06

6 Byte transmission are following, excluding BCC

3 Cmd Command 04

Cf. section Error! Reference source not found.

4 PB1 Data – Power Burst 1 32 50 ms Power Burst

5 No. TX bits Data – Number of Transmit Bits

08 8 Bit to transmit to transponder

6 TX bits Data – Transmit Bits 0C see following table

7 PB2 Data – Power Burst 2 00 No second Power Burst

8 No. RX bytes Data – Number of Receive Bytes

0A

10 Byte response expected from transponder

9 BCC Block Check Character AC


LF Transmit Bits hex 0C

1. Page 2. Command

hex 0C 0000 1100

Page 0000 11 Page 3

Command 00 Read

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.4.3 Example: Read Page 8 Response (DST80)

As response following telegram is received based on the protocol described in Error! Reference source not found.: “010B007E00123456789020 EE2407” Serial Communication Protocol

Start Length Cmd TX bits BCC

01 0B 007E 00123456789020 EE24 07

Byte Abbreviation Content Example Value Explanation


2 Length Length 0B 11 Byte are following, excluding BCC

3,4 Cmd Command 007E Transponder response

5 to 13 TX bits LF transponder response 00123456789020 EE24

See following table

14 BCC Block Check Character 07


LF Uplink Data hex 00123456789020 EE24

3. Page 2 hex 00

4. Page 8 content hex 1234567890 (Byte 0, Byte 1, Byte 2, Byte 3)

5. Read Address 6. Read Address Extension

hex 20 0010 0000

Page 0010 00 Page 8

Page locked 0 General access

Programming 0 No Programming

7. CRC check sum hex EE24

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.5 Immobilizer Program Page (DST80)

To program a page of a DST80 transponder or a RAID / CRAID device, follow these instructions: 1. If not done yet, power up the board, connect it to the PC, start the software and place the

transponders LF- Antenna in the LF field of the readers Immobilizer Loop Antenna. 2. Activate the DST80 Transponder tab 3. Hint: Read the page which shall be programmed first. This will help to find out if the page is maybe

locked for write access. The lock-status will be displayed after a successful Read page command 4. Choose the page which shall be programmed 5. Enter the data which shall be programmed

Programming configuration pages may differ from programming pages containing user defined data. Examples: Page 3 can’t be programmed; Page 2 has partial write access; Page 30 has a configuration mask

6. Click on Program Page 7. The transponder answers with a Read Page command of the programmed page.

Figure 12: Example: Program Page 8 (DST80)

8.5.1 Example: Program Page 8 Telegram (DST80)

2

4

6

5

76

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


By clicking on Program Page (Page 8 selected) the software sends via Serial Communication following telegram based on the protocol described in Error! Reference source not found.: ” 010D0432402112345678901E450F0A9C”. This data is assembled as follows: Serial Communication Protocol

Start Length Cmd PB1 No. TX bits

TX bits PB2 No. RX bytes

BCC

01 0D 04 32 40 21 1234567890 1E45

0F 0A 9C


Explanation


2 Length Length 0D


3 Cmd Command 04




40 8 Byte to transmit to transponder

6 - 13 TX bits Data – Transmit Bits

21 12345 67890 1E45

see following table

14 PB2 Data – Power Burst 2 0F No second Power Burst


0A


16 BCC Block Check Character 9C


LF Transmit Bits hex 2112345678901E45

8. Page 9. Command

hex 21 0010 0001

Page 0010 00 Page 8

Command 01 Program

10. Page Content hex 1234567890

11. CRC check sum hex 1E45

Response will be similar to a Read Page response (cf. 8.4.3)

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.6 Immobilizer Lock Page (DST80)

To lock a page of a DST80 transponder, follow these instructions:

1. Activate the DST80 Transponder tab 2. Choose the page to lock 3. Click on Lock Page 4. The transponder answers with a Read Page answer of the locked page viewable in the RX – Data from

Reader textbox (5a). Additionally the new Page Lock Status which is Paged Locked after a successful lock command is executed will be displayed in the top right corner (5b).

Figure 13: Example: Lock Page 8 (DST80)

2

3

4

5a6

5b6

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.6.1 Example: Lock Page 8 Telegram (DST80)

By clicking on Lock Page the software sends via Serial Communication following telegram based on the protocol described in Error! Reference source not found.: ” 01080432182227870F0AA1”. This data is assembled as follows: Serial Communication Protocol

Start Length Cmd PB1 No. TX bits

TX bits PB2 No. RX bytes

BCC

01 08 04 32 18 222787 0F 0A A1


Explanation


2 Length Length 08


3 Cmd Command 04




18 3 Byte to transmit to transponder

6, 7, 8 TX bits Data – Transmit Bits 222787 see following table

9 PB2 Data – Power Burst 2 0F No second Power Burst


0A


11 BCC Block Check Character A1


LF Transmit Bits hex 222787

12. Page 13. Command

hex 22 0010 0010

Page 0010 00 Page 8

Command 10 Lock

14. CRC check sum hex 2787

Response will be similar to a Read Page response (cf. 8.4.3)

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


8.7 Using the TPIC84134 Antenna Extension Board

Requirements: - TBA-B300 Base Station - TPIC84134 Antenna Extension Board

To use the antenna extension board following steps are required:

1. Ensure the TPIC84134 is detected correctly by the reader and that both are detected by the Demo Software. This is indicated by the “+TPIC” addition after the reader name in the status bar.

Figure 14: TPIC connection

2. Activate the PEPS or AES PEPS tab dependant on which device should be used for PEPS communication (for details of PEPS communication refer to 8.3 for DST80 devices or to 9.9 for AES devices)

3. Choose the output on which the antenna is connected which should be used. J1, J2 and J3 are the three standard TBA-B300 antenna outputs. Usually connected to J1 is the Immobilizer Antenna, to J2 the Stick Antenna while J3 remains unused. The TPIC outputs in the dropdown box are numbered accordingly to the output numbering on the board. By picking a single TPIC Output Half Bridge Mode will be activated, which is normal operation. If two TPIC outputs are selected Full Bridge Mode is activated. This means the outputs are sending the LF- transmission with a 180 degree phase shift on the second output. Wired correctly to an antenna this means twice the peak-to-peak voltage. By picking Default Antenna the Base Station is configured for behaviour as though the TPIC would not have been connected. This means J2 is used for PEPS and J1 is used for Immobilizer.

4. Choose the desired peak-to-peak voltage (Vpp) on a single output

Figure 15: Antenna Extension Configuration

5. Execute a PEPS command as described in corresponding sections.

1

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Software Functionality Specific to AES Product Family Please submit documentation feedback 27 / 74

9 Software Functionality Specific to AES Product Family

This section presents the major AES-specific functions of the AES Demo software

9.1 Synchronization of device configuration with AES Demo Software

The AES device family offers many configuration options which should be synchronized to achieve proper operation of the AES Demo software. The fastest and easiest way is to run a burst read of all pages in bank 7. Requirements: - General Read Access to bank 7 is required - ADR2 Demo Reader Software revision 2.02 or higher required OR TBA-B300 - Immobilizer discharge need to be disabled (Page 5) Following steps are required:

1. Press tab ‘AES Transponder’ 2. Select ‘Bank 7’ 3. Select ‘Page 0’ (determines the first page to read) 4. Enter ‘16’ as Number of Pages to read 5. Click on ‘Burst Read Page 0’ to read out pages 0 to 15

Figure 16: Burst Read of Configuration Bank

1

2

4, 5

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


Note:

Encryption Keys are not synchronized with the burst read command and therefore Mutual commands might be not functional until an encryption key is programmed or entered into the AES Key field (at the configuration frame)

9.2 Enhanced Interface

By double clicking into the memory table the configuration details of pages 2 - 15 can be displayed in an Enhanced Interface:

Figure 17: Display Bank 7 via Enhanced Interface

Note:

The enhanced interface only supports the configuration pages 2 to 15 on bank 7. User- defined data has to be interpreted from the Page Content (hexadecimal values) by the user.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.3 Read the Content of a Transponder Page

The AES demo tool provides the memory structure within an overview table showing the available pages for each bank, the description of the page and its content. After startup initial values are set (either 0 or 1) which are not synchronized with any default settings. The table does not offer direct data input access but by double clicking into the table of bank 7 an enhanced configuration interface will appear. To execute a read command, following steps are recommended:

1. Select the wanted page by clicking into the table 2. Select odd or even page number (only for bank 7) 3. Press button ‘General Read Page x’ 4. After a valid response the communication box is highlighted in green showing the content of the page 5. The page content is also entered in the table with a description of the page access status 6. The page content frame also shows the content and status but also provides a field to enter new page

content

Figure 18: Read page content

1

2

3

4

5

6

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.3.1 Example: General Read Page 4

To read out Page 4 of Bank 7 of an AES device following steps are required:

1. Activate the AES Transponder tab 2. Ensure Bank 7 is selected 3. To select page 4 click on the cell “5 / 4” in the Page column of the data table and ensure Even Pages is

selected 4. Click on General Read Page 4 5. The content of the successfully read page is displayed in the Communication Content section 6. Alternatively, the Enhanced Interface can be used by double- clicking into the data table. Once the

page is read, the contents are interpreted and displayed in the Enhanced Interface.

Figure 19: General Read Page 4 (Bank 7)

1 2

3a

3b

4 5

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.3.1.1 Corresponding Serial Communication Telegram

By clicking on General Read Page 4 the software sends via Serial Communication (see (*) in Figure 19) following telegram based on the protocol described in Error! Reference source not found.:” 010884029610F004000AF6”. This data is assembled as follows: Serial Communication Protocol


BCC

01 08 8402 96 10 F004 00 0A F6


Explanation


2 Length Length 08


3,4 Cmd Command 8402

BLC Mode Cf. section Error! Reference source not found.




7, 8 TX bits Data – Transmit Bits F004 see following table

9 PB2 Data – Power Burst 2 00 No second Power Burst


0A


11 BCC Block Check Character F6


LF Transmit Bits hex F004

15. Write Address 16. Write Address Extension

hex F004 1111 0000 0000 0100

Extension bit 1

Bank 111 Bank 7

Command Flags 00 General

Command 00 Read

Extension bit 0

Page 000 0100 Page 4

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


As response following telegram is received based on the protocol described in Error! Reference source not found.: “010B007E1FFF1F0000F1045FDBFB” Serial Communication Protocol

Start Length Cmd TX bits BCC

01 0B 007E 1FFF1F0000F1045FDB FB



2 Length Length 0B 11 Byte are following, excluding BCC

3,4 Cmd Command 007E Transponder response

5 to 13 TX bits LF transponder response 1FFF1F0000 F1045FDB

See following table

14 BCC Block Check Character F6


LF Uplink Data hex 1FFF1F0000F1045FDB

17. Key number hex 1F

18. Page content hex FF1F0000 (Byte 0, Byte 1, Byte 2, Byte 3)

19. Read Address 20. Read Address Extension

hex F104 1111 0001 0000 0100

Extension bit 1

Bank 111 Bank 7

Page mutual 0 General access

LF off 0 General access

Program lock 0 General access

Command executed 1 Executed

Extension bit 0


21. CRC check sum hex 5FDB (for calculation see section 9.4.3)

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.3.2 Example: Mutual Read Page 4

For this action it’s recommended to execute the same steps as described in section 9.3.1, but instead of clicking on “General Read Page 4” “Mutual Read Page 4” must be clicked. Make sure an AES Key has already been programmed to the transponder and is entered in the corresponding box of the software.

By clicking on Mutual Read Page 4 the software sends via Serial Communication (see (*) in Figure 19) following telegram based on the protocol described in Error! Reference source not found.:” 010C84029660F8045DAA265F040A50”. This data is assembled as follows: Serial Communication Protocol


BCC

01 0C 8402 96 60 F8045DAA265F 04 0A 50

Byte Abbreviation Content Example Value Explanation 1 Start Start Mark 01

2 Length Length 0C




5 PB1 Data - Power Burst 1 96 150 ms Power Burst

6 No. TX bits Data - Number of Transmit Bits


7, 8 TX bits header Data - Transmit Bits Command

F804 See following table

9 to 12 TX bits Signature Data – Signature of Reader 5DAA265F

13 PB2 Data - Power Burst 2 04 4ms Power Burst after downlink

14 No. RX bytes Data - Number of Receive Bytes

0A 10 Byte response expected from transponder

15 BCC Block Check Character 50 Cf. section Error! Reference source not found.

LF Transmit Bits hex F8045DAA265F


hex F804 1111 1000 0000 0100

Extension bit 1

Bank 111 Bank 7

Command Flags 10 Mutual

Command 01 Read

Extension bit 0


24. Reader Signature hex 5DAA265F (calculated from Write Address, Write Address Extension and Padding. Encrypted with AES Key1)

25. CRC hex 917D (for calculation see section 9.4.3)

The reader will respond with a similar telegram as the response to a General Read Page command (see 9.3.1.1).

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.4 Program the content of a transponder page

To execute a program command, following steps are recommended:

1. Select the wanted page by clicking into the table 2. Enter the data which should be programmed to the page content field 3. Press button ‘General Program Page x’ 4. After a valid response the communication box is highlighted in green showing the content of the page 5. The page content is also entered in the table with a description of the page access status

Figure 20: Program page content

1

2

3

4

5

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.4.1 Example: General Program Page 4

To program the contents of Bank 7, Page 4 following steps are required:

1. If not done yet, power up the board, connect it to the PC, start the software and place the Transponder in the LF field of the readers Immobilizer Loop Antenna.

2. Activate the AES Transponder tab 3. Ensure Bank 7 is selected 4. To select page 4 click on the cell ‘5 / 4’ in the Page column of the data table and ensure Even Pages is

selected 5. If only part of the page content shall be programmed, it’s required to first read page 4 as described in

9.3 and then alter the page content. For Bank 7 the Enhanced Interface may be used for improved data readability. Remember, the Enhanced Interface is only available for Bank 7, pages 2 to 15.

6. Click on General Program Page 4 7. The transponder will echo the newly written Page Content to the PC and the software will display it in

the Communication Content section

Figure 21: General Program Page 4 (Bank 7)

2

3

4a

4b

6

7

5

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.4.1.1 Corresponding Serial Communication Telegram

By clicking on General Program Page 4 the software sends via Serial Communication following telegram based on the protocol described in Error! Reference source not found.:” 010E84029640F104FF1A0000917D080AA0”. This data is assembled as follows): Serial Communication Protocol


BCC

01 0E 8402 96 40 F104FF1A0000917D 08 0A A0


Explanation


2 Length Length 0E








F104

See following table 9 to 12 TX bits payload

Data – Transmit Bits to write to page

FF1A0000

13, 14 TX bits CRC CRC of Transmit Bits Data 917D

15 PB2 Data - Power Burst 2 08 8ms Power Burst after downlink



17 BCC Block Check Character A0 Cf. section Error! Reference source not found.

LF Transmit Bits hex F104FF1A0000917D


hex F104 1111 0001 0000 0100

Extension bit 1

Bank 111 Bank 7


Command 01 Program

Extension bit 0


28. Page content hex FF1A0000 (LSB first)

29. CRC hex 917D (for calculation see section 9.4.3)

The reader will respond with a similar telegram as the response to a General Read Page command (see 9.3.1.1), but with the newly programmed page content in it.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.4.2 Example: Mutual Program Page 4

For this action it’s recommended to execute the same steps as described in section 9.4.1, but instead of clicking on “General Program Page 4” “Mutual Program Page 4” must be clicked. Make sure an AES Key has already been programmed to the transponder and is entered in the corresponding box of the software.

By clicking on Mutual Program Page 4 the software sends via Serial Communication following telegram: ”011284029660F904FF1A0000F0EA2E3F5D990C0AB3”. This data is assembled as follows based on the protocol described in Error! Reference source not found.: Serial Communication Protocol


BCC

01 12 8402 96 60 F904FF1A0000 F0EA2E3F5D99

0C 0A B3



2 Length Length 12








F904

See following table 9 to 12 TX bits payload Data – Transmit Bits to write to page

FF1A0000

13 to 16 TX bits Signature Data – Signature of Reader F0EA2E3F

17,18 TX bits CRC CRC of Transmit Bits Data 5D99

19 PB2 Data - Power Burst 2 0C 12 ms Power Burst after downlink



21 BCC Block Check Character B3 Cf. section Error! Reference source not found.

LF Transmit Bits hex F904FF1A0000F0EA2E3F5D99


hex F904 1111 1001 0000 0100

Extension bit 1

Bank 111 Bank 7

Command Flags 01 Mutual

Command 01 Program

Extension bit 0


http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


32. Page content hex FF1A0000 (LSB first)

33. Reader Signature hex F0EA2E3F (calculated from Write Address, Write Address Extension, Page Content and Padding. Encrypted with AES Key1)

34. CRC hex 5D99 (for calculation see section 9.4.3)

The reader will respond with a similar telegram as the response to a General Read Page command (see 9.3.1.1), but with the newly programmed page content in it.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.4.3 Calculation of the CRC Byte

A two-byte checksum is calculated and sent along with the command (write address + extension) and the page content to ensure that the transmission was sent without errors. Technically the CRC Byte is a Block Check Character (BCC). For simplicity it’s referenced to only as CRC Byte(s). This redundancy check is calculated as follows: (all values are taken from example above)

1. Create a byte array, assembled as shown below:

i Content of Array[i] Example

0 Write Address F1

1 Write Address Extension 04

2 to 5 New page content (LS-Byte first)

FF 1A 00 00

2. For CRC calculation this algorithm is used (C example):

#define POLYNOM 0x8408 #define PRESET_VALUE 0x3791 unsigned int CRC16_Check(unsigned char *Buffer, unsigned char size) {

unsigned int uiCRC_Value; unsigned char i,j;

uiCRC_Value = PRESET_VALUE; for(i = 0x00; i < size; i++) { uiCRC_Value ^= *Buffer++;

for(j = 0x00; j < 8; j++) { if(uiCRC_Value & 0x0001) uiCRC_Value = (uiCRC_Value >> 1) ^ POLYNOM; else uiCRC_Value = (uiCRC_Value >> 1); } } return uiCRC_Value; }

3. With chosen example values a function call will look like this:

crc = CRC16_Check(buffer, 6);

//param1: buffer pointer; param2: length of buffer

buffer is the byte array created at step 1: buffer = {0xF1, 0x04, 0xFF, 0x1A, 0x00, 0x00};

4. The two bytes provided as response of the checksum function have to be byte-swapped, converted into ASCII and appended to the LF transmission.

Example: crc = 0x7D91 (return value of CRC16_Check(…))

= > CRC Bytes to attach: 917D (cf. 9.4.1.1)

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.5 Page lock

To lock a transponder page for write address or to make it unreadable it’s required to write a configured lock byte to the transponder page. Attention: Setting the page to locked status will also lock the write access to the lock byte! Therefore this step is irreversible! To lock a page, following steps are recommended:

1. Select the page by clicking into the table and eventually adjust the Even Page / Odd Page setting 2. Click on General Lock Page x (Selective Lock and/or Mutual Lock accordingly) 3. A window will pop up which allows configuration of the lock byte.

To lock for write access, select Prog. lock 4. By clicking on OK the software starts sending the telegram and the page will be locked afterwards. 5. Reading this page will now lead to a “Programming locked” message in Page Status (Enhanced

Interface: 5a; Normal Interface: 5b)

Figure 22: General Lock Page

1a

1bb

2

3

4

5a

5b

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.5.1 Example: Serial Communication Telegram of Lock Page 6

By clicking on General Lock Page 6 the software sends via Serial Communication following telegram: ”010B84029628F20601DA54080A4A”. This data is assembled as follows (cf. Error! Reference source not found.): Serial Communication Protocol


BCC

01 0B 8402 96 28 F20601DA54 08 0A 4A


Explanation


2 Length Length 0B








F206


Data – Transmit Bits Lock Byte

01

13, 14 TX bits CRC CRC of Transmit Bits Data DA54

15 PB2 Data - Power Burst 2 08 8 ms Power Burst after downlink



17 BCC Block Check Character 4A Cf. section Error! Reference source not found.

LF Transmit Bits hex F206 01 DA54


hex F206 1111 0010 0000 0110

Extension bit 1

Bank 111 Bank 7


Command 10 Lock

Extension bit 0


37. Lock Byte hex 01 (see Lock Byte definition)

38. CRC hex DA54 (for calculation see section 9.4.3)

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.6 Authentication Command

To execute an authentication/encryption command, following steps are recommended: Following steps are required:

0. Synchronization should be done (see section 9.1) 1. Press button ‘Actions (TAA)’ 2. Select ’Plain Program AES-128 Key 1’ in Action table 3. Enter new encryption key in the content fields 4. Press button ‘General Action Plain Program AES-128 Key 1’ 5. The tool automatically adapts the new AES Key 1 if the command is executed correctly 6. Select ‘Encryption with AES Key 1’ in Action table (Figure 24) 7. The AES configuration (challenge/response, AES rounds) is taken by the tool from the Synchronization 8. Press button ‘General Action Encryption with AES Key 1’ 9. If the recalculated signature from the AES Demo tool matches to the transponder response the

Communication Content table is marked green

Figure 23: Program AES Key

1

2

3

4

5

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


Figure 24: Authentication command

6

7

8

9a

9b

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.6.1 Example: Serial Communication Protocol of Plain Program AES Key 1

By clicking on General Action Plain Program AES-128 Key 1 the software sends via Serial Communication following telegram:” 011A840296A0F310000102030405060708090A0B0C0D0E0F70030F0A3F”. This data is assembled as follows based on the protocol described in Error! Reference source not found.: Serial Communication Protocol


BCC

01 1A 8402 96 A0 F3100001…0E0F7003 0F 0A 3F


Explanation


2 Length Length 1A






A0 160 Bit to transmit to transponder


F310


Data – Transmit Bits to write to page

0001… …0E0F

25, 26 TX bits CRC CRC of Transmit Bits Data 7003

27 PB2 Data - Power Burst 2 0F 15 ms Power Burst after downlink



29 BCC Block Check Character 3F Cf. section Error! Reference source not found.

LF Transmit Bits hex F310000102030405060708090A0B0C0D0E0F7003


hex F104 1111 0001 0000 0100

Extension bit 1

Bank 111 Bank 7


Command 01 Program

Extension bit 0


41. AES Key to program hex 000102030405060708090A0B0C0D0E0F

42. CRC hex 7003 (for calculation see section 9.4.3)

The reader will respond with a similar telegram as the response to a General Read Page command (cf. 9.3.1.1). The AES Key cannot be read out. This also applies to the other encryption keys.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.6.2 Example: Serial Communication Protocol: Encryption with AES Key 1

By clicking on General Action Encryption with AES Key 1 the software sends via Serial Communication following telegram: ”010C84029630F3300B0C0D0E040AE5”. Note that this example uses a 32 bit challenge (pink). This data is assembled as follows based on the protocol described in Error! Reference source not found.: Serial Communication Protocol


BCC

01 0C 8402 96 30 F3300B0C0D0E 04 0A 3F


Explanation

1 Start Start Mark 01 2 Length Length 0C 12 Byte

transmission are following, excluding BCC

3,4 Cmd Command 8402 BLC Mode Cf. section Error! Reference source not found.





F330 See following table 9 to 12 TX bits challenge Data – Transmit challenge

to transponder 0B0C0D0E

13 PB2 Data - Power Burst 2 04 4 ms Power Burst after downlink



15 BCC Block Check Character 3F Cf. section Error! Reference source not found.

LF Transmit Bits hex F3300B0C0D0E


hex F330 1111 0011 0011 0000

Extension bit 1

Bank 111 Bank 7


Command 11 Action

Extension bit 0

Page 011 0000 Action Code 48

45. Challenge hex 0B0C0D0E

The response is described on the following page.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


After calculating the correct signature out of the given challenge, the transponder will respond and subsequently the reader will send following serial communication protocol containing the transponder response: “010B007E1C8A06E8569B97F13096” This data is assembled as follows based on the protocol described in Error! Reference source not found.: Serial Communication Protocol

Start Length Cmd Serial Number Signature TX bits header BCC

01 0B 007E 1C8A06 E8569B97 F130 96


Explanation


2 Length Length 0B


3,4 Cmd Command 007E Transponder Response

5, 6, 7 Serial Number Data – Serial Number of transponder

1C8A06

See following table

8 – 11 Signature Data – Authentication signature

E8569B97


F130

14 BCC Block Check Character 96


LF Transmit Bits hex 1C8A06E8569B97F130

46. Serial Number hex 1C8A06

47. Challenge hex E8569B97


hex F130 1111 0011 0011 0000

Extension bit 1

Bank 111 Bank 7

Page Mutual 0

LF off 0

Program lock 0

Command executed 1

Extension bit 0

Page 011 0000 Action Code 48

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.7 Mutual Authentication with Anticollision Command

As preparation for this action a minimum of two transponders should be programmed the following way: (It’s recommended to synchronize settings and then program the appropriate pages with the enhanced interface; for detailed description see previous sections)

1. Different Key Numbers (Bank 7: Page 4; Key Numbers are used as response slots) Valid range of Key Numbers starts with 1 and ends currently with 63 (software limitation).

2. Identical configuration of Challenge and Signature on all transponders (Bank 7: Page 5) 3. Identical AES Round Adder Value on all transponders

Figure 25: Configure Bank 7: Page 5 for Anti-Collision Encryption

4. An identical Vehicle ID (Bank 7: Page 6; to calculate signature; keys will only respond to “their car”) 5. An identical AES Key 1 (or other available Key if desired) needs to be programmed to all devices as

described in section Authentication Command 6. The corresponding Selective Address (Bank 7: Page 4) if the Selective Action is desired.

2, 3

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


Once the preparations are done, the actual Mutual Authentication Anti-collision Command can be executed: (Instead of AES Key 1, any other available Key can be used, when it’s correctly configured on transponder and software) 0. Place all the previously programmed transponder in the LF field of the Immobilizer Antenna.

1. Select Actions (TAA) in the AES Transponder tab 2. Choose Anticollision Encryption with AES Key 1 3. Make sure that configurations of Round Adder value, Length of Challenge and Signature, Vehicle

ID and AES Key 1 are equivalent to those of the transponder. Synchronization with a correctly programmed transponder will do the trick of setting up the software correctly.

4. Enter the desired Challenge with the chosen Challenge Bit Length (e.g. 32 bit Challenge) 5. Enter the value of the Maximum Key Number Slot. This is the highest Key Number the reader will

search for (starting at 1). That means this value should not be lower than the highest Key Number that has been programmed to a transponder. For example if there are three transponders in the LF field with Key Numbers 1, 4 and 5 this value should at least be 5.

6. Execute Action by clicking on the Mutual Action… button 7. After action is executed all found keys are displayed, sorted by Key Number (= Slot) along with

their Serial Number. If a response contains a wrong signature (e.g. because of interferences in the LF field) the warning Signature mismatch will be shown behind the Serial Number.

Figure 26: Anticollision Encryption

1

2

3a

3b

3c

4

5 4

6

7

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.8 Packet Error Rate - Mode

The AES Demo Software supports packet error rate calculation to demonstrate reliability of the communication link. Requirements: - ADR2 Demo Reader Software revision 2.03 or higher required To execute the packet error rate following steps are required:

1. Enable check box ‘high speed repetition (PER) 2. Press any telegram button 3. The communication content box shows the number of transmitted, valid and lost telegrams together with

a PER rate in %

Figure 27: Packet Error Rate

Note:

Do not use the PER mode together with Burst Read or continuous telegram repetition. To achieve a higher telegram repetition rate the communication telegram is shortened

The TX telegram only sends a repeat command to the demo reader

The RX telegram only sends the CRC checksum from the demo reader

1 2 3

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.9 AES Passive Entry / Passive Start (PEPS)

Requirements: - ADR2 Demo Reader Software revision 2.05 or higher required

OR - TBA-B300

To execute a Passive Entry Wake Pattern transmission following steps are advised:

1. Synchronize device configuration and tool configuration (Cf. section 9.1) 2. Consider to program Bank 7: Page 7

The tool automatically adapts the wake pattern configuration on tab ‘AES PEPS’ (Figure 28) 3. Also configuration of the AES PEPS bit timing can be considered (Bank 7: Page 13)

In doubt, use default timings. There is no automatic adaption of Bank 7: Page 13!

4. Consider configuring the AES passive entry bit timings (Figure 29) Press Settings and then AES PEPS Settings After configuration press Finished to transfer timings and return to previous tab page

5. Select AES PEPS tab and press Send Wake Pattern A

Figure 28: Wake Pattern and Additional Data

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


Figure 29: AES PEPS Timing settings

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.9.1 Example: Send AES PEPS Wake Pattern with additional data

After configuring the wake pattern to “D3” (8 bit) and additional data to “C20A” and clicking on Send Wake Pattern the software sends via Serial Communication following telegram: ”010B90020008CB01105043040A56”. This data is assembled as follows based on the protocol described in Error! Reference source not found.: Serial Communication Protocol

Start Length Cmd PB1 Wake Len

Inv Wake Pattern

PB2 Data Len

Inv Data

PB3 No. RX bytes

BCC

01 0B 9002 00 08 CB 01 10 5043 04 0A 56


Explanation

1 Start Start Mark 01 Start mark

2 Length Length 0B



BLC Timing Cf. section Error! Reference source not found.

5 PB1 Data - Power Burst 1 00

PEPS: PB1 is not used. Instead the Wake Burst is defined in BLC timing

6 Wake Len Length of Wake Pattern in bits

08

7 Inv Wake Pattern Inverted Wake Pattern CB

Wake pattern after MSB- LSB bit order was inversed. “D3” => “CB”

8 PB2 Data - Power Burst 2 [ms] 01

Data delay. Time to let the device wake up before sending data

9 Data Len Length of additional data in bits

10

Only full bytes are accepted as data => Length must be multiple of eight!

10 Inv Data Inverted Additional Data 5043

Data after MSB- LSB bit order was inversed. “C20A” => “5043”

11 PB3 Data – Power Burst 3 [ms] 04

Power burst attached to transmission. May be used for RSSI measurement



13 BCC Block Check Character 56 Cf. section Error! Reference

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


source not found.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.9.2 Example: LF Downlink of an AES PEPS telegram

The telegram in the previous section will result in following LF transmission:

Wake Burst

SOF (S10)

Wake Pattern “D3”

PB2 Data “C20A”

EOF (E)

PB3

Note the different byte order of sent Wake Pattern and Additional Data in the following diagram. Transmission shown in detail: (‘1’ means carrier signal is off for duration of ‘High Bit Off Time’ and then on for duration of ‘High Bit On Time’; ‘0’ means carrier signal is off for duration of ‘Low Bit Off Time’ and then on for duration of ‘Low Bit On Time’) Wake Pattern is sent most significant bit first and most significant byte first:

SOF 1 1 0 1 0 0 1 1 PB2

D 3

t Additional Data is sent most significant bit first and least significant byte first:

PB2 0 0 0 0 1 0 1 0 1 1 0 0 0 0 1 0 EOF

0 A C 2 t When this data is read via SPI it is sent most significant bit first. Also compare this transmissions with the transmission excerpt shown in section 0 on page 58.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.10 AES PEPS Program Wake Pattern

To program a certain Wake Pattern to an AES device, proceed as follows: 1. Place the AES device in range of the readers Immobilizer Antenna. 2. Activate the AES Transponder tab page and select Bank 7. 3. Double-click on pages “7 / 6” to activate Enhanced Interface. 4. Select Odd Pages to view content of page seven. 5. Choose desired Wake Pattern length 6. Enter desired Wake Pattern 7. Consider High Data Rate and Noise Rejection settings 8. Click on General Program Page 7

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.10.1 Example: Serial Comm. Protocol of Program AES PEPS Wake Pattern

By clicking on General Program Page 7 the software sends via Serial Communication following telegram based on the protocol described in Error! Reference source not found.: ”010E84023240F1070AD30000A5EF080A9D”. This data is assembled as follows: Serial Communication Protocol

Start Length Command PB1 TX Bits

TX Data PB2 RX Bits

BCC

01 0E 8402 32 40 F1070AD30000A5EF 08 0A 9D


Explanation

1 Start Start of telegram 01 Start mark

2 Length Length of telegram 0E 14 bytes following, excluding BCC

3,4 Command Reader command 8402


5 PB1 Wake Burst duration in [ms]

32 Start with 50 ms Power Burst

6 TX Bits Number of bits of LF transmission

40 64 bits LF transmission

7 to 15 TX Data Data of LF transmission F1070AD30000A5EF

See following table

16 PB2 End Burst duration in [ms] 08 8 ms Power Burst after data transmission

17 RX Bits Bytes to receive 0A Expect 10 bytes as response from transponder

18 BCC Block Check Character 9D


LF Transmit Bits hex F1070AD30000A5EF

1. Write Address 2. Write Address

Extension

hex F107 1111 0001 0000 0111

Extension bit 1

Bank 111 Bank 7


Command 01 Program

Extension bit 0


3. Page Content hex 0A 0000 1010

0

High Data Rate 0 Disabled

Noise Rejection Filter 00 20 us

Noise Rejection Filter 1 Enabled

Wake Pattern length 010 8 bit WP

D3 00 00 Wake Pattern (byte order inverted) “0000D3”, WP length 8 bit =>

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


WP: “D3”

50. Write Frame BCC hex A5EF

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.10.2 Example: LF Downlink of Program AES Wake Pattern

Sending the telegram described in the previous section will result in the Immobilizer LF transmission shown in this section.

Wake Burst

SOF (S01)

Write Address “F107”

Page Content “0AD30000”

Write Frame BCC “A5EF”

EOF (E)

PB2

Transmission shown in detail: (‘1’ means carrier signal is off for duration of ‘High Bit Off Time’ and then on for duration of ‘High Bit On Time’; ‘0’ means carrier signal is off for duration of ‘Low Bit Off Time’ and then on for duration of ‘Low Bit On Time’) An excerpt of the Page Content transmission which contains the Wake Pattern is shown below:

Write Address

0…0 1 1 0 0 1 0 1 1 0 1 0 1 0 0 0 0 …

0000 D3 0A t Immobilizer Data is sent least significant bit first and least significant byte first: The Write Address transmission looks like this:

Wake Burst

S01 1 0 0 0 1 1 1 1 1 1 1 0 0 0 0 0 …

SOF F1 07 t Compare this transmissions with the transmission excerpt shown on page 54.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.11 AES Demo: Inventory Process (PC controlled)

Note: AES device of chip generation ES4 or newer required

This demonstration mode shows how an Inventory Process is performed. In this process all transponders in range of the Immobilizer antenna are found even if they are not trained at all, just through their Unique ID ( = Serial Number + Manufacturer Code).

Note:

Advanced LF Modes (e.g. Quiet Mode, Selected Mode) have a timeout condition after one second when no communication happens anymore. So using long charge bursts, slow timings or really slow computers running the RFID Demo Software may cause problems.

To execute this demonstration these steps are advised:

1. Take at least one AES device (e.g. an AES wedge transponder) and place them in range of the Immobilizer Antenna. Recommended are two or more devices to make the potential of the Inventory Process visible.

2. Activate the Inventory Process (PC controlled) tab page within the AES Demo tab page. 3. Click the Start Inventory Process button. 4. As result there will be displayed all found devices in the left grid view box. All single steps are logged in

the text list on the right side.

Figure 30: Results of Inventory Process

2

3

4

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.12 AES Demo: Pairing (PC controlled)

9.12.1 Pairing with Inventory Process

If only AES devices of chip generation ES3 or older are available, please skip to 9.12.2. This demonstration searches for all available devices with an Inventory Process (please consider the provided notes in corresponding section above). Then the Selective Addresses and Key Numbers are programmed using Selected Mode. Afterwards the Pairing will proceed by programming the Vehicle ID, Configuration (Bank 7, Page 5) and the AES Key using the new Selective Addresses. The sequence is finished by a Mutual Authentication Anticollision action to validate the result. Only devices which were paired correctly will be able to authenticate themselves.

1. Place the AES devices which shall get paired in the LF field of the Immobilizer antenna 2. Activate the Pairing (PC controlled) tab page within the AES Demo tab page. 3. Check checkbox Inventory Training. 4. Optional: Check Hash Program AES Key if this is desired instead of the Plain Program AES Key action.

Otherwise uncheck it. If checked, enter the Transport Key which is programmed in preparation step 4 (9.12.2.1). If no other Transport Keys were programmed meanwhile the value should already be correct. This value is written directly after programming a Transport Key and is saved in the registry.

5. Choose the Vehicle ID of the vehicle to which the keys get assigned to. For demonstration purpose this is an arbitrary value.

6. Enter the 128 Bit Encryption Key 1 which shall be programmed to the devices. For demonstration purposes this value is arbitrary and a Random button is provided which generates a random valid value.

7. Hit the START Pairing Sequence button. 8. After the sequence is done all found transponders are listed below including their authentication results.

Figure 31: Result of Pairing Sequence with Inventory Process

3,4

5,6

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.12.2 Pairing without Inventory Process

For pairing without an Inventory Process it’s required to program the Selective Addresses of each device and, if action Hash Program AES Key 1 is desired, to program the Transport Key to each device. This is described in the following section. If this has already been done it’s recommended to proceed with section 9.12.2.2.

9.12.2.1 Preparation

For programming pages (9.4) or programming encryption keys (9.6), which are required actions for this demonstration, please refer to earlier sections.

1. Take at least one AES device (e.g. an AES wedge transponder). Recommended are at least two devices for the demonstration. The amount of devices is currently software-limited to 63 devices but hardware limitation would allow up to 254.

2. Place a single device in the LF-field of the Immobilizer Antenna 3. Program an arbitrary but unique Selective Address to Bank 7 Page 4 (Enhanced Interface is

recommended for all following steps). The addresses 00 and FF are forbidden! Important is that every device has its own unique Selective Address! For example, when three devices are to be paired a valid configuration would be: Sel.Addr. Device 1: 03 Sel.Addr. Device 2: 0B Sel.Addr. Device 3: 06 NOT valid would be this configuration: Sel.Addr. Device 1: 01 Sel.Addr. Device 2: 01 Sel.Addr. Device 3: 0F Also its recommended, but not required, to use addresses which are numerically close to each other to shorten the transponder scanning process at the start of the training sequence (e.g. addresses from 01 to 0F).

4. Optional: If AES Key 1 shall be programmed as hash (Hash Program AES Key 1): Go to Actions (TAA) and select action 28: Plain Program Transport Key. Specify and program the Transport Key the same way as described in 9.6. The Transport Key must be identical on all devices.

5. Now remove the current AES device from the LF-field and repeat steps 2 to 5 for each device. To perform the actual demonstration, please refer to next page.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.12.2.2 Perform Demo

After finishing all preparations described in 9.12.2.1 following steps are required to perform the actual demonstration:

1. Place all the previously configured AES devices in the LF-field of the Immobilizer Antenna. When two devices are too close to each other – that means very close, like less than half an inch (~= 1.5 cm) - they may affect each other’s resonant circuit which makes it impossible for them to answer correctly. So try to give them some space in between.

2. Activate the AES Demo tab page and select the Pairing (PC controlled) sub-tab.

3. Uncheck Inventory Training.

4. Choose the range of selective addresses which will be scanned for AES devices. Search Start Address must be equal or lower than the lowest Selective Address which has been assigned to a device in preparation step 3. Search End Address must be equal or higher than the highest Selective Address which has been assigned to a device.

5. Check Hash Program AES Key if this is desired. Otherwise uncheck it. If checked, enter the Transport Key which was programmed in preparation step 4. If no other Transport Keys were programmed meanwhile the value should already be correct. This value is written directly after programming a Transport Key and is saved in the registry.

6. Choose the Vehicle ID of the vehicle the keys get assigned to. For demonstration purpose this is an arbitrary value.

7. Enter the 128 Bit Encryption Key 1 which shall be programmed to the devices. For demonstration purposes this value is arbitrary and a Random button is provided which generates a random valid value.

8. Hit the START Training Sequence button to start the sequence.

9. After sequence is done all found devices are displayed in the table with their individual authentication results, ordered by Serial Number and accordingly new assigned Key Number. A possible result is shown in following figure.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


Figure 32: Result of Pairing Sequence without Inventory Process

3, 4, 5 6, 7

9

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.13 AES Demo: Pairing (Reader controlled)

Note:

This demonstration mode requires a TBA-B300 Base Station with a firmware version 2.00 or newer.

The PC controlled pairing is useful to visualize the single steps which are required in the pairing process. However it’s unrealistically slow, because a lot of time is lost in USB communication. To provide a much faster and much more realistic pairing process the reader controlled pairing demo is introduced and is located on the Pairing (Reader controlled) tab page within the AES Demo tab page. The RFID Demo Software is only used to show the pairing and authentication results and may be used to induce a pairing process, while the pairing process is executed by the Base Station on its own. Similar as described in previous sections, there is a possibility using the Inventory Process and one without it. Details are explained in following sections.

Figure 33: Pairing (Reader controlled)

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.13.1 Pairing Data

The Paired Key Count, Vehicle ID, Round Adder value, Challenge and Signature length and the AES Key 1 are referred to as Pairing Data since this is the data which determine the values the devices are paired to. The Pairing Data gets randomly created at every board startup. So, after powering down the Base Station, all previously paired devices may be paired again using the new Pairing Data. The current Pairing Data is requested once a new board got connected or the Pairing (Reader controlled) tab page is activated. Additionally it’s updated after every successful Pairing Process or when the data is requested by clicking the Get Pairing Data button.

9.13.2 Inventory Pairing

This action executes a Pairing Process on more transponders at once. First an Inventory Process is executed to find and identify all devices. Then the Selective Addresses and Key Numbers are programmed using Selected Mode. Afterwards the Pairing will proceed by programming the remaining Pairing Data using the new Selective Addresses.

1. Place the AES devices in range of the Immobilizer antennas LF field 2. Activate the Pairing (Reader controlled) tab page within the AES Demo tab page 3. Click on the Inventory Pairing button 4. Now the Base Station activity can be observed as the Inventory and Pairing Process is executed. After

few seconds the result is displayed on the grid view table, similar as in Figure 33.

9.13.3 Sequential Pairing

This action is pairing one device after another. Only one single device may be in the LF field at a given time!

1. Activate the Pairing (Reader controlled) tab page within the AES Demo tab page. 2. Place an unpaired AES device in the Immobilizer antennas LF field.

(Unpaired means here: not paired with the current Pairing Data a device which is not in the list) 3. Click on the Sequential Pairing button 4. After a short delay the single pairing process is done and the result (Paired: OK / FAIL) will get

displayed on the grid view table along with its Pairing Data. 5. Repeat steps 2 to 4 until all desired devices are paired

9.13.4 Mutual Authentication

With this action a single previously paired AES device in the LF field can be authenticated. The device will be highlighted in the grid view table.

1. Activate the Pairing (Reader controlled) tab page within the AES Demo tab page. 2. Place a single paired AES device in the Immobilizer antennas LF field.

(Paired means here: a device listed in the grid view table after it was paired) 3. Click on the Mutual Authentication button 4. The device which authenticated correctly will be highlighted in the grid view table.

9.13.5 Mutual Authentication with Anticollision

With this action multiple previously paired AES devices in the LF field can be used for an authentication.

1. Activate the Pairing (Reader controlled) tab page within the AES Demo tab page. 2. Place at least one paired AES device in the Immobilizer antennas LF field.

(Paired means here: a device listed in the grid view table after it was paired) 3. Click on the Mutual Auth. w. AntiColl. Button 4. The device which authenticated correctly will be highlighted in the grid view table. If more than one

device authenticate at once only the first authentication will be reported (which is the one with the lowest Key Number).

5. Optional: After pairing a manual authentication action can be performed too (see 9.7). No further preparations are required, just select the TAA Action (50) and click the Mutual Action button.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


9.14 Relay Tag Demo

To perform a demonstration of the Relay Tag it’s recommended to use a Charge Time of about 1500 ms to ensure the device has enough power to perform a relay switch. To adjust the Charge Time click on Settings and choose the AES Trp Settings tab. On this tab page the according value can be found in the Timing Settings group box.

Figure 34: AES Trp Charge Time Settings

1. Place the antenna of the Relay Tag close to the Immobilizer Antenna.

2. Now select the Action 1 “MCU Access 8 Bytes” (AES transponder tab page -> Actions (TAA)) similar as

described in previous sections.

3. Click on Relay: SET or Relay: RESET button depending on which command should be executed.

4. Click on General Action MCU Access 8 Bytes

5. On success a gentle clicking sound of the relay tag can be heard. The altered resistance value between two associated pins (e.g. pins 1 and 2 on J2) can be measured too. If resistance value is infinite the relay status is Set - and Reset if the value is very low.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Serial Communication Protocol Description Please submit documentation feedback 67 / 74

10 Serial Communication Protocol Description

The related USB / serial protocols are described in the document Car Access Demo Protocol Description.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated EVM Important Notice Please submit documentation feedback 68 / 74

EVM Important Notice

10.1 EVALUATION BOARD/KIT/MODULE (EVM) ADDITIONAL TERMS

Texas Instruments (TI) provides the enclosed Evaluation Board/Kit/Module (EVM) under the following conditions: The user assumes all responsibility and liability for proper and safe handling of the goods. Further, the user indemnifies TI from all claims arising from the handling or use of the goods. Please read the User's Guide and, specifically, the Warnings and Restrictions notice in the User's Guide prior to handling the product. This notice contains important safety information about temperatures and voltages. For additional information on TI's environmental and/or safety programs, please visit www.ti.com/esh or contact TI. No license is granted under any patent right or other intellectual property right of TI covering or relating to any machine, process, or combination in which such TI products or services might be or are used. TI currently deals with a variety of customers for products, and therefore our arrangement with the user is not exclusive. TI assumes no liability for applications assistance, customer product design, software performance, or infringement of patents or services described herein. Mailing Address: Texas Instruments Post Office Box 655303 Dallas, Texas 75265 Copyright 2011, Texas Instruments Incorporated

10.2 REGULATORY COMPLIANCE INFORMATION

As noted in the EVM User’s Guide and/or EVM itself, this EVM and/or accompanying hardware may or may not be subject to the Federal Communications Commission (FCC) and Industry Canada (IC) rules For EVMs not subject to the above rules, this evaluation board/kit/module is intended for use for ENGINEERING DEVELOPMENT, DEMONSTRATION OR EVALUATION PURPOSES ONLY and is not considered by TI to be a finished end product fit for general consumer use. It generates, uses, and can radiate radio frequency energy and has not been tested for compliance with the limits of computing devices pursuant to part 15 of FCC or ICES-003 rules, which are designed to provide reasonable protection against radio frequency interference. Operation of the equipment may cause interference with radio communications, in which case the user at his own expense will be required to take whatever measures may be required to correct this interference. General Statement for EVMs including a radio User Power/Frequency Use Obligations: This radio is intended for development/professional use only in legally allocated frequency and power limits. Any use of radio frequencies and/or power availability of this EVM and its development application(s) must comply with local laws governing radio spectrum allocation and power limits for this evaluation module. It is the user's sole responsibility to only operate this radio in legally acceptable frequency space and within legally mandated power limitations. Any exceptions to this is strictly prohibited and unauthorized by Texas Instruments unless user has obtained appropriate experimental/development licenses from local regulatory authorities, which is responsibility of user including its acceptable authorization. For EVMs annotated as FCC – FEDERAL COMMUNICATIONS COMMISSION Part 15 Compliant Caution This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


FCC Interference Statement for Class A EVM devices This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense. FCC Interference Statement for Class B EVM devices This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna.

Increase the separation between the equipment and receiver.

Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.

Consult the dealer or an experienced radio/TV technician for help. For EVMs annotated as IC – INDUSTRY CANADA Compliant This Class A or B digital apparatus complies with Canadian ICES-003. Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment. Concerning EVMs including radio transmitters This device complies with Industry Canada licence-exempt RSS standard(s). Operation is subject to the following two conditions: (1) this device may not cause interference, and (2) this device must accept any interference, including interference that may cause undesired operation of the device. Concerning EVMs including detachable antennas Under Industry Canada regulations, this radio transmitter may only operate using an antenna of a type and maximum (or lesser) gain approved for the transmitter by Industry Canada. To reduce potential radio interference to other users, the antenna type and its gain should be so chosen that the equivalent isotropically radiated power (e.i.r.p.) is not more than that necessary for successful communication. This radio transmitter has been approved by Industry Canada to operate with the antenna types listed in the user guide with the maximum permissible gain and required antenna impedance for each antenna type indicated. Antenna types not included in this list, having a gain greater than the maximum gain indicated for that type, are strictly prohibited for use with this device. Cet appareil numérique de la classe A ou B est conforme à la norme NMB-003 du Canada. Les changements ou les modifications pas expressément approuvés par la partie responsable de la conformité ont pu vider l'autorité de l'utilisateur pour actionner l'équipement.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


Concernant les EVMs avec appareils radio Le présent appareil est conforme aux CNR d'Industrie Canada applicables aux appareils radio exempts de licence. L'exploitation est autorisée aux deux conditions suivantes : (1) l'appareil ne doit pas produire de brouillage, et (2) l'utilisateur de l'appareil doit accepter tout brouillage radioélectrique subi, même si le brouillage est susceptible d'en compromettre le fonctionnement. Concernant les EVMs avec antennes détachables Conformément à la réglementation d'Industrie Canada, le présent émetteur radio peut fonctionner avec une antenne d'un type et d'un gain maximal (ou inférieur) approuvé pour l'émetteur par Industrie Canada. Dans le but de réduire les risques de brouillage radioélectrique à l'intention des autres utilisateurs, il faut choisir le type d'antenne et son gain de sorte que la puissance isotrope rayonnée équivalente (p.i.r.e.) ne dépasse pas l'intensité nécessaire à l'établissement d'une communication satisfaisante. Le présent émetteur radio a été approuvé par Industrie Canada pour fonctionner avec les types d'antenne énumérés dans le manuel d'usage et ayant un gain admissible maximal et l'impédance requise pour chaque type d'antenne. Les types d'antenne non inclus dans cette liste, ou dont le gain est supérieur au gain maximal indiqué, sont strictement interdits pour l'exploitation de l'émetteur.

10.3 Important Notice for Users of this Product in Japan

This development kit is NOT certified as Confirming to Technical Regulations of Radio Law of Japan! If you use this product in Japan, you are required by Radio Law of Japan to follow the instructions below with respect to this product: Use this product in a shielded room or any other test facility as defined in the notification \#173 issued by Ministry of Internal Affairs and Communications on March 28, 2006, based on Sub-section 1.1 of Article 6 of the Ministry's Rule for Enforcement of Radio Law of Japan, Use this product only after you obtained the license of Test Radio Station as provided in Radio Law of Japan with respect to this product, or Use of this product only after you obtained the Technical Regulations Conformity Certification as provided in Radio Law of Japan with respect to this product. Also, please do not transfer this product, unless you give the same notice above to the transferee. Please note that if you could not follow the instructions above, you will be subject to penalties of Radio Law of Japan. Texas Instruments Japan Limited (address) 24-1, Nishi-Shinjuku 6 chome, Shinjukku-ku, Tokyo, Japan http://www.tij.co.jp

ご使用にあたっての注意

本開発キットは技術基準適合証明を受けておりません。

本製品のご使用に際しては、電波法遵守のため、以下のいずれかの措置を取っていただく必要がありますので

ご注意ください。

（１）電波法施行規則第6条第1項第1号に基づく平成18年3月28日総務省告示第173号で定められた電波暗室等

の試験設備でご使用いただく。

（２）実験局の免許を取得後ご使用いただく。

（３）技術基準適合証明を取得後ご使用いただく。

なお、本製品は、上記の「ご使用にあたっての注意」を譲渡先、移転先に通知しない限り、譲渡、移転できな

いものとします。

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


上記を遵守頂けない場合は、電波法の罰則が適用される可能性があることをご留意ください。

日本テキサス・インスツルメンツ株式会社

東京都新宿区西新宿６丁目２４番１号

西新宿三井ビル

http://www.tij.co.jp

10.4 EVALUATION BOARD/KIT/MODULE (EVM)WARNINGS, RESTRICTIONS AND DISCLAIMERS

For Feasibility Evaluation Only, in Laboratory/Development Environments. Unless otherwise indicated, this EVM is not a finished electrical equipment and not intended for consumer use. It is intended solely for use for preliminary feasibility evaluation in laboratory/development environments by technically qualified electronics experts who are familiar with the dangers and application risks associated with handling electrical mechanical components, systems and subsystems. It should not be used as all or part of a finished end product. Your Sole Responsibility and Risk. You acknowledge, represent and agree that:

1. You have unique knowledge concerning Federal, State and local regulatory requirements (including but not limited to Food and Drug Administration regulations, if applicable) which relate to your products and which relate to your use (and/or that of your employees, affiliates, contractors or designees) of the EVM for evaluation, testing and other purposes.

2. You have full and exclusive responsibility to assure the safety and compliance of your products with all such laws and other applicable regulatory requirements, and also to assure the safety of any activities to be conducted by you and/or your employees, affiliates, contractors or designees, using the EVM. Further, you are responsible to assure that any interfaces (electronic and/or mechanical) between the EVM and any human body are designed with suitable isolation and means to safely limit accessible leakage currents to minimize the risk of electrical shock hazard.

3. You will employ reasonable safeguards to ensure that your use of the EVM will not result in any property damage, injury or death, even if the EVM should fail to perform as described or expected.

4. You will take care of proper disposal and recycling of the EVM's electronic components and packing materials

Certain Instructions. It is important to operate this EVM within TI’s recommended specifications and environmental considerations per the user guidelines. Exceeding the specified EVM ratings (including but not limited to input and output voltage, current, power, and environmental ranges) may cause property damage, personal injury or death. If there are questions concerning these ratings please contact a TI field representative prior to connecting interface electronics including input power and intended loads. Any loads applied outside of the specified output range may result in unintended and/or inaccurate operation and/or possible permanent damage to the EVM and/or interface electronics. Please consult the EVM User's Guide prior to connecting any load to the EVM output. If there is uncertainty as to the load specification, please contact a TI field representative. During normal operation, some circuit components may have case temperatures greater than 60°C as long as the input and output are maintained at a normal ambient operating temperature. These components include but are not limited to linear regulators, switching transistors, pass transistors, and current sense resistors which can be identified using the EVM schematic located in the EVM User's Guide. When placing measurement probes near these devices during normal operation, please be aware that these devices may be very warm to the touch. As with all electronic evaluation tools, only qualified personnel knowledgeable in electronic measurement and diagnostics normally found in development environments should use these EVMs. Agreement to Defend, Indemnify and Hold Harmless. You agree to defend, indemnify and hold TI, its licensors and their representatives harmless from and against any and all claims, damages, losses, expenses, costs and liabilities (collectively, "Claims") arising out of or in connection with any use of the EVM that is not in

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26


accordance with the terms of the agreement. This obligation shall apply whether Claims arise under law of tort or contract or any other legal theory, and even if the EVM fails to perform as described or expected. Safety-Critical or Life-Critical Applications. If you intend to evaluate the components for possible use in safety critical applications (such as life support) where a failure of the TI product would reasonably be expected to cause severe personal injury or death, such as devices which are classified as FDA Class III or similar classification, then you must specifically notify TI of such intent and enter into a separate Assurance and Indemnity Agreement.

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Revision History Please submit documentation feedback 73 / 74

11 Revision History

NOTE: Page numbers for previous revisions may differ from page numbers in the current version.

Rev. Version SCN Description of Change Date By

0 0 - New Issue 08/01/2011 J. Austen

1 0 - Prepared for certification 6/26/2013 M. Albrecht

http://www.ti.com/


www.ti.com 11-07-21-024 – Rev. 1.0 – 2013-06-26

Copyright © 2013, Texas Instruments Incorporated Revision History Please submit documentation feedback 74 / 74

IMPORTANT NOTICE Texas Instruments Incorporated and its subsidiaries (TI) reserve the right to make corrections, modifications, enhancements, improvements, and other changes to its products and services at any time and to discontinue any product or service without notice. Customers should obtain the latest relevant information before placing orders and should verify that such information is current and complete. All products are sold subject to TI’s terms and conditions of sale supplied at the time of order acknowledgment. TI warrants performance of its hardware products to the specifications applicable at the time of sale in accordance with TI’s standard warranty. Testing and other quality control techniques are used to the extent TI deems necessary to support this warranty. Except where mandated by government requirements, testing of all parameters of each product is not necessarily performed. TI assumes no liability for applications assistance or customer product design. Customers are responsible for their products and applications using TI components. To minimize the risks associated with customer products and applications, customers should provide adequate design and operating safeguards. TI does not warrant or represent that any license, either express or implied, is granted under any TI patent right, copyright, mask work right, or other TI intellectual property right relating to any combination, machine, or process in which TI products or services are used. Information published by TI regarding third-party products or services does not constitute a license from TI to use such products or services or a warranty or endorsement thereof. Use of such information may require a license from a third party under the patents or other intellectual property of the third party, or a license from TI under the patents or other intellectual property of TI. Reproduction of TI information in TI data books or data sheets is permissible only if reproduction is without alteration and is accompanied by all associated warranties, conditions, limitations, and notices. Reproduction of this information with alteration is an unfair and deceptive business practice. TI is not responsible or liable for such altered documentation. Information of third parties may be subject to additional restrictions. Resale of TI products or services with statements different from or beyond the parameters stated by TI for that product or service voids all express and any implied warranties for the associated TI product or service and is an unfair and deceptive business practice. TI is not responsible or liable for any such statements. TI products are not authorized for use in safety-critical applications (such as life support) where a failure of the TI product would reasonably be expected to cause severe personal injury or death, unless officers of the parties have executed an agreement specifically governing such use. Buyers represent that they have all necessary expertise in the safety and regulatory ramifications of their applications, and acknowledge and agree that they are solely responsible for all legal, regulatory and safety-related requirements concerning their products and any use of TI products in such safety-critical applications, notwithstanding any applications-related information or support that may be provided by TI. Further, Buyers must fully indemnify TI and its representatives against any damages arising out of the use of TI products in such safety-critical applications. TI products are neither designed nor intended for use in military/aerospace applications or environments unless the TI products are specifically designated by TI as military-grade or "enhanced plastic." Only products designated by TI as military-grade meet military specifications. Buyers acknowledge and agree that any such use of TI products which TI has not designated as military-grade is solely at the Buyer's risk, and that they are solely responsible for compliance with all legal and regulatory requirements in connection with such use. TI products are neither designed nor intended for use in automotive applications or environments unless the specific TI products are designated by TI as compliant with ISO/TS 16949 requirements. Buyers acknowledge and agree that, if they use any non-designated products in automotive applications, TI will not be responsible for any failure to meet such requirements. Following are URLs where you can obtain information on other Texas Instruments products and application solutions: Products Applications Amplifiers amplifier.ti.com Audio www.ti.com/audio Data Converters dataconverter.ti.com Automotive www.ti.com/automotive DLP® Products www.dlp.com Broadband www.ti.com/broadband DSP dsp.ti.com Digital Control www.ti.com/digitalcontrol Clocks and Timers www.ti.com/clocks Medical www.ti.com/medical Interface interface.ti.com Military www.ti.com/military Logic logic.ti.com Optical Networking www.ti.com/opticalnetwork Power Mgmt power.ti.com Security www.ti.com/security Microcontrollers microcontroller.ti.com Telephony www.ti.com/telephony MCU RF / RFID http://www.ti.com/rfid/ Video & Imaging www.ti.com/video RF/IF and ZigBee® Solutions www.ti.com/lprf Wireless www.ti.com/wireless Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265 Copyright © 2013, Texas Instruments Incorporated

http://www.ti.com/

http://www.ti.com/audio

http://www.ti.com/automotive

http://www.dlp.com/

http://www.ti.com/broadband

http://www.ti.com/digitalcontrol

http://www.ti.com/clocks

http://www.ti.com/medical

http://www.ti.com/military

http://www.ti.com/opticalnetwork

http://www.ti.com/security

http://www.ti.com/telephony

http://www.ti.com/rfid/

http://www.ti.com/video

http://www.ti.com/lprf

http://www.ti.com/wireless

Documents

Demo Software User's Guide - Texas Instruments · 2. Download the RFID Demo Software (“Tools & Software”) 3. Extract the ZIP-file contents into a folder and execute the RFID Demo