PCF7936AS

Security Transponder (HITAG2)

Product Specification 2010 May 04
CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

CONTENT

1 FEATURES ............................................................................................................................................................................... 4
2 GENERAL DESCRIPTION........................................................................................................................................................ 4
3 ORDERING INFORMATION ..................................................................................................................................................... 4
4 BLOCK DIAGRAM .................................................................................................................................................................... 5
5 TYPICAL APPLICATION .......................................................................................................................................................... 5
6 QUICK REFERENCE DATA ..................................................................................................................................................... 6
7 FUNCTIONAL DESCRIPTION SECURITY TRANSPONDER .................................................................................................. 7
7.1 Memory Organization, EEPROM ................................................................................................................................... 7
7.1.1 Identifier, IDE ......................................................................................................................................................... 8
7.1.2 Password Basestation, PSW B .............................................................................................................................. 8
7.1.3 Secret Key, SK ...................................................................................................................................................... 9
7.1.4 Transponder and Memory Configuration, TMCF ................................................................................................... 9
Secret Key Lock, SKL.............................................................................................................................. 9
Page 3 Lock, PG3L ................................................................................................................................. 9
Protect Write User Page 4 and 5, PWP1 ................................................................................................. 9
Protect Write User Page 6 and 7, PWP0 ................................................................................................. 9
Enable Cipher Mode, ENC ...................................................................................................................... 9
Mode Select, MS ................................................................................................................................... 10
Data Coding Select, DCS ...................................................................................................................... 10
7.1.5 Password Transponder, PSW T ........................................................................................................................... 10
7.1.6 User Pages, USER 0 to 3 .................................................................................................................................... 10
7.2 Transponder State Diagram ......................................................................................................................................... 11
7.2.1 WAIT State .......................................................................................................................................................... 11
7.2.2 AUTHORIZED State ............................................................................................................................................ 12
7.2.3 HALT State .......................................................................................................................................................... 12
7.2.4 READ ONLY State .............................................................................................................................................. 12
7.3 Command Set .............................................................................................................................................................. 13
7.3.1 Command Description ......................................................................................................................................... 14
HALT ..................................................................................................................................................... 15
READ_PAGE ........................................................................................................................................ 15
READ_PAGE_INV................................................................................................................................. 16
START_AUTH (Password Mode) .......................................................................................................... 17
START_AUTH (Cipher Mode) ............................................................................................................... 18
WRITE_PAGE ....................................................................................................................................... 19
7.4 Calculation Unit ............................................................................................................................................................ 20
7.5 Read Only Modes ........................................................................................................................................................ 21
7.5.1 ISO 11784/5 (MS1 = 0, MS0 = 0) ........................................................................................................................ 21
7.5.2 MIRO Mode (MS1 = 0, MS0 = 1) ......................................................................................................................... 21
7.5.3 PCF7931/30/35 (MS1 = 1, MS0 = 0) ................................................................................................................... 21
7.6 Transponder Data Transmission Format ..................................................................................................................... 22
7.6.1 Read Direction ..................................................................................................................................................... 22
7.6.2 Write Direction ..................................................................................................................................................... 23
7.7 LF Field Power On Reset ............................................................................................................................................. 24
8 EEPROM CONTENT AT DELIVERY ...................................................................................................................................... 25
9 LIMITING VALUES ................................................................................................................................................................. 26
10 DEVICE CHARACTERISTICS ................................................................................................................................................ 27
10.1 Electrical Characteristics .............................................................................................................................................. 27
10.2 Timing Characteristics ................................................................................................................................................. 28
10.3 Mechanical Characteristics .......................................................................................................................................... 29
11 TEST SETUP .......................................................................................................................................................................... 30
12 DEVELOPMENT TOOLS ........................................................................................................................................................ 31

2010 May 04 2 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

13 REVISION HISTORY .............................................................................................................................................................. 31
14 LEGAL INFORMATION .......................................................................................................................................................... 32
14.1 Data sheet status ......................................................................................................................................................... 32
14.2 Definitions .................................................................................................................................................................... 32
14.3 Disclaimers .................................................................................................................................................................. 32

2010 May 04 3 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

1 FEATURES 2 GENERAL DESCRIPTION

Security Transponder for use in contactless The PCF7936AS is a high performance automotive proof
authentication applications Security Transponder for vehicle Immobilization
Data transmission and energy supply via LF link applications, where the transponder has to identify itself
32 bit quasi unique device identification (serial number) towards the basestation as an authorized device.
and product type identification.
Fast mutual authentication, 39ms The Security Transponder derives its power supply from
the magnetic field (LF field) established by the basestation.
48 bit Secret Key
No additional battery supply is needed. Data is transmitted
256 bit EEPROM for user data storage (128 bit) and
device configuration/personalization (128 bit) by modulating the LF field.
EEPROM read/write protection features The Security Transponder features secure contactless
20 years non-volatile data retention authentication, employing a Secret Key and a random
More than 100 000 EEPROM erase/write cycles number in order to cipher any communication between the
Once the memory has been erased by UV, access is device and the basestation. The secure contactless
denied authentication is ideally suited for vehicle immobilization
Read Only emulation modes (H400x, ISO 11784/85 and applications. In addition, the device features a factory
PCF7931) programmed quasi unique serial number that also serves
Excellent sensitivity in read and write mode as product type identification.
Automotive temperature range: -40C to +85C
If desired, the device may be operated as a Read/write
Leadless plastic stick package
transponder with access control by password or as a
Read Only transponder.

3 ORDERING INFORMATION

EXTENDED PACKAGE TEMPERATURE

TYPE NUMBER NAME DESCRIPTION OUTLINE VERSION RANGE (C)
PCF 7936AS/3851 SOT3851 leadless plastic stick package SOT385-1 -40C to +85C
PCF 7936AS/3851/C SOT3851 leadless plastic stick package SOT385-1 -40C to +85C

2010 May 04 4 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

Security Transponder
4 BLOCK DIAGRAM
Contactless Interface
The PCF7936AS features a high degree of integration and EEPROM (256 bit)
incorporates the transponder chip, coil and capacitor
Control Logic
assembled in a leadless stick package, see Figure 1.
Calculation Unit (security algorithm)
Reset Logic
Test Logic

Security Transponder
Security Transponder Chip

Contactless Interface EEPROM

Rectifier (256 Bit)

Voltage Limiter

IN1
Modulator

Clock Control Logic

Recovery
IN2
Demodulator
Resonance/antenna circuit
fRES = 125 kHz (typ) LF Field Calculation
Power On Reset Unit

Test Logic

Figure 1. Block Diagram

5 TYPICAL APPLICATION

Inductive Link Security Transponder

fSYS = 125 kHz (typ) PCF 7936AS Security Transponder Chip

Contactless Interface EEPROM

Energy
Rectifier (256 Bit)
Voltage Limiter
Basestation
Modulator

Analog Clock Control Logic

Interface Recovery
To Micro-
controller Demodulator
Serial
Interface LF Field Calculation
Write
Power On Reset Unit

PCF 7991
Read
Test Logic

Figure 2. Typical System Configuration

2010 May 04 5 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

6 QUICK REFERENCE DATA

PARAMETER VALUE UNIT

Carrier frequency 125 kHz
Data rate
- read 4.0 kbit/s
- write 5.2 kbit/s
Data coding
- read Manchester or Bi-Phase
- write Binary Pulse Length Modulation (BPLM)
Data transmission mode Half-Duplex
Modulation Amplitude Shift Keying (ASK)
Memory size 256 bit
Identifier (serial number and product type ID) 32 bit
Secret Key (Cipher Mode) 48 bit
Password (Password Mode) 32 bit
Authentication time 39 ms
Special Features Ciphered mutual authentication
Ciphered data transmission
128 bit user EEPROM with programmable write protection
Read/Write Password mode
Read Only emulation modes (H400x, ISO 11784/85 and PCF7931)

2010 May 04 6 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

7.1 Memory Organization, EEPROM

7 FUNCTIONAL DESCRIPTION SECURITY The device incorporates 256 bit of non-volatile memory
TRANSPONDER
(EEPROM) that is organized as 8 pages with 32 bit per
The PCF7936AS does not require any additional power page, referred to as Transponder Memory, TM. The
supply. It derives its power supply by inductive coupling to Transponder Memory, TM, is split into areas for
the LF Field, which is generated by the basestation. Transponder Configuration/Personalization, TCFG, and
Reading and writing to the transponder is provided by User Memory, USER, see Figure 3.
amplitude modulation of the LF field.

The Contactless Interface generates the chip power supply, Transponder Memory, TM
clock and reset and features the modulator, and
demodulator. The system clock is derived from the LF field Page 0
generated by the basestation that typically operates with a
carrier frequency of 125 kHz. TCFG
Page 3
The Control Logic incorporates the data acquisition logic to
enable communication with the transponder and the Page 4
memory access control logic. Access to the transponder USER
memory (EEPROM) depends on the device configuration
Page 7
and the authentication state. The memory is split into
blocks and pages with independent access rights, as Figure 3. Memory Organization
configured by the user and partly predefined by design.

Device authentication may be performed in Password

mode or in Ciphered mode. In Password mode the The TM segment can be accessed only, after successful
basestation and transponder in plain exchange a set of device authorization. Depending on the device
passwords, while in Cipher mode a mutual authentication configuration, device authorization is performed either in
based on a security algorithm is performed that employs a Password mode or in Cipher mode. Subsequent memory
Secret Key and a random number. The security algorithm is access is provided only in accordance with the memory
determined by the on-chip Calculation Unit that in addition protection settings applied.
supports ciphered communication and data exchange Any changes made regarding the Transponder
between the basestation and the transponder. Configuration, TCFG, respectively Page 1 to 3, become
The Cipher mode is ideally suited for vehicle immobilization effective after a device reset or initialization sequence only.
application. The organization of the Transponder Memory, TM,
Transponder operation and authentication is controlled by depends on the authorization method selected (Password
commands send form the basestation, while in Read Only or Cipher mode) by the corresponding configuration bit
mode data transmission commences after device reset and (ENC) see Figure 4.
a time-out condition.

2010 May 04 7 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

Password Mode (ENC = 0) IDE

bit 31 8 7 4 3 0
bit 31 bit 0
SN 3 SN 2 SN 1 PI SN 0
IDE Page 0 MSB LSB
b31 PSW B b0 Page 1
X not used Page 2 bit 7 6 5 4
TMCF b23 PSW T b0 Page 3
0 0 0 1 PI
USER 0 Page 4
USER 1 Page 5 Figure 5. Identifier Organization, IDE
USER 2 Page 6
USER 3 Page 7
MSB LSB
The Identifier, IDE, is transmitted in plain and incorporated
in the process of device authentication, thus used by the
Cipher Mode (ENC = 1)
on-chip Calculation Unit as well as by the interrogating
bit 31 bit 0
system.
IDE Page 0
b31 SK (low) b0 Page 1 7.1.2 Password Basestation, PSW B
X b47 SK (high) b32 Page 2
The Password Basestation, PSW B, is applicable in
TMCF b23 PSW T b0 Page 3
Password mode only (ENC = 0). The Password
USER 0 Page 4 Basestation is a 32 bit pattern, which typically is initialized
USER 1 Page 5 and subsequently locked by the customer during device
USER 2 Page 6 personalization. The Password Basestation is located in
USER 3 Page 7 page 1, see Figure 4.
MSB LSB During the process to identify the basestation towards the
Figure 4. Transponder Memory Map transponder, the transponder verifies the password
received by the basestation with the password stored in
PSW B. If both match each other, the transponder assumes
Note
successful identification of the basestation and the
1. Locations marked X are for device internal use. They authentication sequence is continued, otherwise it is
are partly initialized and locked against overwriting terminated. For details refer to section 7.3.1,
during device manufacturing and are not available for START_AUTH command.
data storage. Any read operation yields an undefined bit
value. The Password Basestation may be assigned any value that
is considered useful by the application. The PSW B can be
Pages 0 to 3 of the EEPROM memory are reserved for protected against reading and writing by setting the lock bit
transponder configuration and personalization, while SKL, see section 7.1.4
Page 4 to 7 are reserved for user data storage, USER.
NXP initializes the Password Basestation with a common
According to the selected authorization method, page 1 and Transport Key value as specified (see section 8), in order
2 do hold a Password, PSW B, (Password mode) or the to enable initial device access. Since the corresponding
Secret Key, SK, (Cipher mode). lock bit is not set, the PSW B Transport Key value and
device configuration can be read and modified at any time
7.1.1 Identifier, IDE as desired.
The Identifier, IDE, is a factory programmed quasi unique
32 bit pattern that serves the function of a device serial
number (SN) and product type identification (PI). The
Identifier is located in page 0 and supports read access
only, thus cannot be altered.

The product type identification is located in the bits 4 to 7

and factory programmed for all PCF7936AS devices to
1H, as shown in Figure 5.

2010 May 04 8 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

Page 3 Lock, PG3L

7.1.3 Secret Key, SK
If set, page 3 is irreversible locked against writing (OTP
The Secret Key, SK is applicable in Cipher mode only like). Thus if set once, the Transponder and Memory
(ENC = 1). The Secret Key is a 48 bit pattern, which Configuration (TMCF) as well as the Password
typically is initialized and subsequently locked by the Transponder (PSW T) can no longer be altered. However,
customer during device personalization. The Secret Key is reading is supported in any case.
located in page 1 and 2, see Figure 4.

The 32 least significant bits of SK (bit 31 to bit 0) are Protect Write User Page 4 and 5, PWP1
located in page 1 while the 16 most significant bits (bit 47 to If set, a write protection is assigned for the user pages
bit 32) are located in page 2 at bit address 0 to 15. page 4 and 5 (USER0 and USER1). As a result its content
cannot be altered, however, reading is supported in any
The Immobilizer Secret Key is incorporated in the process case.
of device authentication and used by the on-chip
calculation unit as well as by the interrogating system. If cleared, page 4 and page 5 support reading and writing.
However the Immobilizer Secret Key is never transmitted The content and organization of the user pages is fully
during the process of device authentication. For details determined by the application.
refer to section 7.3.1, START_AUTH command.

The Secret Key may be assigned any value that is Protect Write User Page 6 and 7, PWP0
considered useful by the application. The SK can be If set, a write protection is assigned for the user pages
protected against reading and writing by setting the lock bit page 6 and 7 (USER2 and USER3). As a result its content
SKL, see section 7.1.4 cannot be altered, however, reading is supported in any
case.
7.1.4 Transponder and Memory Configuration, TMCF If cleared, page 6 and page 7 support reading and writing.
Access to the Transponder Memory, TM, and device
The content and organization of the user pages is fully
configuration is controlled by a set of configuration bits,
determined by the application.
TMCF, located in page 3, see Figure 6.

Enable Cipher Mode, ENC

bit 31 30 29 28 27 26 25 24 The device may be configured for to perform authentication
in either Password mode or Cipher mode.
PWP1

PWP0
PG3L

ENC

DCS
MS1
MS0
SKL

TMCF
If ENC is set, Cipher mode is selected, otherwise Password
mode.
MSB LSB
Thus, ENC affects operation of the START_AUTH
Figure 6. Transponder Memory Configuration, TMCF
command and whether plain or ciphered transmission of
data and commands is supported, for details refer to
section 7.3.1.
The memory access rights applied by TMCF affect the
behavior of READ_PAGE and WRITE_PAGE commands
only. Device operation, e.g. with respect to the
authentication process, is not affected at all.

Secret Key Lock, SKL

If set, the Password Basestation, PSW B, (Password
mode) or the Secret Key, SK, (Cipher mode) is irreversible
locked against reading and writing (OTP like). If set once,
its value can no longer be read or altered.

2010 May 04 9 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

7.1.5 Password Transponder, PSW T

Mode Select, MS
The device may be configured for to support one out of The Password Transponder, PSW T, is a 24 bit pattern,
three Read Only modes, which will cause the device to which typically is initialized and subsequently locked by the
commence data transmission after the specified time-out customer during device personalization. The Password
period, without interrogation by the basestation, see Transponder is located in page 3, see Figure 4.
Table 1. The Password Transponder serves the function to identify
Table 1. Mode Select the transponder towards the basestation. After successful
device authentication, the transponder returns the content
MS1 MS0 Read Only Mode Note of page 3 to the basestation. In Password mode the content
0 0 ISO 11784/5 is returned in plain, while in Cipher mode the content is
0 1 MIRO 1 returned in ciphered fashion. For details refer to
section 7.3.1, START_AUTH command.
1 0 PCF7931/30/35 2
1 1 Disabled Thus the Password Transponder and TMCF configuration
may be evaluated by the basestation, if desired. The
Note
Password Transponder may hold any value that is
1. Emulates MIRO and H400x like Read Only considered useful by the application.
transponders
2. Features compatibility with NXP PIT family operated in 7.1.6 User Pages, USER 0 to 3
Read Only mode, except for the PMC timing (Program
Page 4 to 7 provide space for user data storage. Data
Mode Check) and available memory size.
access is supported according to the device configuration
For details regarding the timing and sequence transmitted selected.
refer to section 7.5.
The user pages may hold any data that is considered
If MS is set, the device does not support Read Only useful by the application.
operation at all.

Data Coding Select, DCS

In Password or Cipher mode data transmitted from the
transponder to the basestation may be encoded in
Manchester or CDP fashion, according to the setting of
DCS.

If DCS is cleared, Manchester encoding is applied,

otherwise CDP coding is applied, see section 7.6.1 for
details.

However, if the device operates in one of the Read Only

modes, data transmission and encoding corresponds to the
Read Only mode selected and is not affected by DCS at all,
see section 7.5 for details.

2010 May 04 10 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

LF Field
Error Power On Reset

READ ONLY WAIT

time-out (tWAIT,SA)
&
Read Only = enabled

START_AUTH

READ_PAGE
HALT
READ_PAGE_INV AUTHORIZED HALT
WRITE_PAGE

Figure 7. Transponder State Diagram

7.2 Transponder State Diagram 7.2.1 WAIT State

Device operation is controlled by commands issued from In WAIT state general memory access is denied.
the basestation, see Figure 7. Commands may be issued to start device authentication, in
order to enter the AUTHORIZED state, see Table 2.
After a LF Field Power-On Reset condition the circuitry is
reset and the transponder is initialized, which causes the Table 2. Command Set in WAIT State
device to enter the WAIT state.
NAME COMMAND, CMD
If one of the Read Only modes is enabled, the device will
enter READ ONLY state after the specified time-out CM4 CM3 CM2 CM1 CM0
1)
(tWAIT,SA), if no command is being issued. Reserved 0 X X X X
1)
To authenticate the transponder and to access the Reserved X 0 X X X
Transponder Memory for read and write the AUTHORIZED Reserved 1) X X 1 X X
state has to be entered, by means of a START_AUTH
1)
command and successful completion of the authentication Reserved X X X 1 X
1)
sequence. Subsequent memory read and write operations Reserved X X X X 1
may be executed.
START_AUTH 1 1 0 0 0
Operation of the transponder commands depend on the
Note
device configuration (Password or Cipher Mode).
1. This command is reserved for future use and subject to
If the device is forced into HALT state, by means of the
change without notice. The actual implementation
HALT command, the transponder circuitry is muted.
causes the device to generate an error condition and to
A violation of the command sequence coding or command enter the WAIT state, if this command is being issued.
timing in any state causes an error condition, which causes
Upon entering the WAIT state the time-out (tWAIT,SA) is
the device to enter WAIT state and to reset the time-out
reset. In case tWAIT,SA is allowed to time-out, the device
(tWAIT,SA).
enters READ ONLY state, if one of the Read Only modes is
enabled. In case a START_AUTH command is issued,
device authentication is triggered and the READ ONLY
state is not entered. At least the first two bits of
START_AUTH need to be recognized by the device within
the time-out period specified by tWAIT,SA.

2010 May 04 11 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

7.2.2 AUTHORIZED State 7.2.3 HALT State

The AUTHORIZED state is entered only after successful The HALT state may be entered from AUTHORIZED state
device authentication, see START_AUTH command. In only. In HALT state the device is muted and any further
AUTHORIZED state the Transponder Memory, TM, can be commands are ignored.
accessed by means of subsequent read and write
To exit the HALT state a transponder LF Field Power-On
commands, see Table 3.
Reset condition must be generated, by means of muting
Communication with the device employs plain (Password the LF field for the specified time.
Mode) respectively ciphered (Cipher Mode) transmission of
commands and data. 7.2.4 READ ONLY State

The Transponder Memory is accessed page wise in The READ ONLY state is entered without command
accordance with the memory protection configuration. interrogation, after termination of the time-out, tWAIT,SA, see
also section 7.7.
Table 3. Command Set in AUTHORIZED State
In READ ONLY mode command decoding is disabled and
NAME COMMAND, CMD the device repeatedly transmits user data, according to the
selected Read Only mode, see section 7.5.
CM4 CM3 CM2 CM1 CM0
READ_PAGE 1 1 pg2 pg1 pg0 The READ ONLY state may be terminated as a result of a
transponder LF Field Power-On Reset condition only, by
READ_PAGE_INV 0 1 pg2 pg1 pg0 means of muting the LF field for the specified time.
WRITE_PAGE 1 0 pg2 pg1 pg0
1)
HALT 0 0 X (0) X (0) X (1)

Note
1. Any coding of the bits CM[2:0] will force HALT state,
however, for future compatibility the values in brackets
should be applied.

Any read respectively write attempt to a page that is read

respectively write protected by the corresponding bit in the
configuration page, would cause the device to terminate the
AUTHORIZED state and to enter WAIT state.

2010 May 04 12 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

operation and acceptance depend on the actual device

7.3 Command Set
state in which the command is being issued as well as on
Device operation is controlled by commands issued from the device configuration (Password/Cipher Mode), see also
the basestation. Table 4 gives a comprehensive summary section 7.2. A command being issued in a different state
of the applicable commands in alphabetic order. Command may cause an error condition.

Table 4. Command Set Summary

NAME DESCRIPTION APPLICABLE

DEVICE STATE
HALT Forces the device to enter the HALT state AUTHORIZED
READ_PAGE Reads 32 bit from the designated memory page, if not restricted by the AUTHORIZED
corresponding memory protection flags or by specification
READ_PAGE_INV Reads 32 bit from the designated memory page, if not restricted by the AUTHORIZED
corresponding memory protection flags or by specification. The content of the page
is returned in inverse polarity.
START_AUTH Starts the device authentication sequence WAIT
WRITE_PAGE Writes 32 bit to the designated memory page, if not restricted by the corresponding AUTHORIZED
memory protection flags or by specification

2010 May 04 13 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

Some operations require additional parameter to be send to

7.3.1 Command Description
and/or to be received from the device, e.g. WRITE_PAGE
The general form of a control sequence consists of the or START_AUTH.
command sequence send to the transponder and an
Equalizer pattern (EQ) and Response received from the For proper operation, command execution by the device
transponder. The general control sequence timing is shown must not be suspended for more than the specified Idle
in Figure 8. time (tIDLE), see Figure 9. Otherwise the device may stop
command decoding, disabling any communication with the
When switching from SEND to RECEIVE and vice versa, device. In this case, a LF Field Power-On Reset has to be
the basestation and control software have to consider the applied, in order to reset and initialize the circuitry, see
indicated delays (tWAIT,Tr and tWAIT,Bs), during which the section 7.7. Consequently, the device resumes WAIT state.
basestation must not transmit any data or commands. As indicated, the Idle time is specified as the time interval
Depending on the command, the Command Sequence between the last bit received from the transponder and the
consists of a minimum of 5 bit respectively 10 bit. For data last bit of the Command Sequence send to the
integrity reasons memory read and write commands have transponder. Some commands allow repeating the
to be transmitted in normal coding and in inverted coding command several times for data integrity reasons,
before being accepted by the device, which yields a however, in any case the limitations imposed by the Idle
minimum Command Sequence of 10 bit. time have to be considered.

The Equalizer, EQ, consist of a 5 bit pattern (all ones) for The Idle time applies also for the very first command send
basestation settling and software synchronization to the device after a device LF Field Power-On Reset
purposes. The device response consists of a command condition, see also section 7.7.
acknowledgment and/or the requested data.

SEND to Command Sequence Parameter

Transponder

RECEIVED from EQ Response EQ Parameter

Transponder

tWAIT,Tr tWAIT,Bs tWAIT,Tr

Figure 8. General control sequence timing

SEND to Command Sequence

Transponder

RECEIVED from Response / Parameter

Transponder
tIDLE
tWAIT,Tr

Figure 9. Command Idle Time

2010 May 04 14 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

HALT READ_PAGE
The command HALT may be issued in AUTHORIZED state The command READ_PAGE returns the content of the
and forces the device to enter the HALT state. For data designated page. The page designated for reading is
integrity reasons the 5 bit command and its complement specified by the command bits pg2 to pg0. For data
have to be send, before the device will accept it, see integrity reasons the 5 bit command and its complement
Figure 10. If accepted, the command Response consist of have to be send, before the device will accept it, see
the command itself and its complement. Figure 11. If accepted, the command Response consists of
the 32 bit content of the designated page. The MSB is send
The 10 bit command sequence may be repeated several
first.
times, if desired, to increase the data integrity level. In the
case that one of the 5 bit commands and its complement The 10 bit command sequence may be repeated several
do not match, an error condition occurs that causes the times, if desired, to increase the data integrity level. In the
device to terminate the command, to initialize the device case that one of the 5 bit commands and its complement
and to enter the WAIT state. No command Response will do not match, an error condition occurs that causes the
be send by the device in this case. device to terminate the command, to initialize the device
and to enter the WAIT state. No command Response will
If the device is configured for Password mode (ENC = 0)
be send by the device in this case.
the command sequence is transmitted in plain, while in
Cipher mode (ENC = 1) the whole command sequence is Subsequent commands may be issued after termination of
transmitted ciphered. tWAIT,Bs.

Any attempt to read a page that is protected against

reading, will be detected and cause an error condition,
upon which the device terminates the command during
tWAIT,Tr and enters the WAIT state. No Response will be
send in this case.

If the device is configured for Password mode (ENC = 0)

the command sequence is transmitted in plain, while in
Cipher mode (ENC = 1) the whole command sequence is
transmitted ciphered.

HALT

SEND to 00001 11110

Transponder CM[4:0] CM[4:0]
EQ CM[4:0] CM[4:0]
RECEIVED from
11111 00001 11110
Transponder

tWAIT,Tr

Figure 10. HALT timing

READ_PAGE

SEND to 1 1, pg2, pg1, pg0 0 0, pg2, pg1, pg0

Transponder CM[4:0] CM[4:0]
EQ Data
RECEIVED from
11111 bit 31 ..................... bit 0
Transponder

tWAIT,Tr tWAIT,Bs

Figure 11. READ_PAGE timing

2010 May 04 15 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

READ_PAGE_INV
The command READ_PAGE_INV returns the complement
of the content of the designated page. The page
designated for reading is specified by the command bits
pg2 to pg0. For data integrity reasons the 5 bit command
and its complement have to be send, before the device will
accept it, see Figure 12. If accepted, the command
Response consists of the complement of the 32 bit content.
The MSB is send first.

The 10 bit command sequence may be repeated several

times, if desired, to increase the data integrity level. In the
case that one of the 5 bit commands and its complement
do not match, an error condition occurs that causes the
device to terminate the command, to initialize the device
and to enter the WAIT state. No command Response will
be send by the device in this case.

Subsequent commands may be issued after termination of

tWAIT,Bs.

Any attempt to read a page that is protected against

reading, will be detected and cause an error condition,
upon which the device terminates the command during
tWAIT,Tr and enters the WAIT state. No Response will be
send in this case.

If the device is configured for Password mode (ENC = 0)

the command sequence is transmitted in plain, while in
Cipher mode (ENC = 1) the whole command sequence is
transmitted ciphered.

READ_PAGE_INV

SEND to 0 1, pg2, pg1, pg0 1 0, pg2, pg1, pg0

Transponder CM[4:0] CM[4:0]
EQ Data
RECEIVED from
11111 bit 31 ..................... bit 0
Transponder

tWAIT,Tr tWAIT,Bs

Figure 12. READ_PAGE_INV timing

2010 May 04 16 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

START_AUTH (Password Mode) In case the authentication process fails, an error condition
If configured for Password mode, START_AUTH triggers occurs that causes the device to terminate the command
the mutual device authentication sequence. If completed and to enter WAIT state. The device will send no further
successfully, the device enters AUTHORIZED state and Response in this case.
subsequently supports plain read and write access of the
Subsequent commands may be issued after termination of
Transponder Memory, TM. Device authentication employs
the final tWAIT,Bs.
the Password Basestation, PSW B, and Password
Transponder, PSW T, see Figure 13. For proper command execution, the interrogating system
has to identify itself towards the device within the specified
After acceptance of the 5 bit command sequence, the initial
IDLE time, otherwise the device may generate a power-on
device Response consist of the 32 bit Identifier (IDE) that is
reset condition, upon which the circuitry would be reset and
stored in the Transponder Memory. Subsequently, the
the transponder initialized, causing the device to enter the
interrogating system (e.g. basestation) has to identify itself
WAIT state.
towards the device, by issuing the matching 32 bit
Password Basestation, PSW B. The device verifies the
Password received with the one stores in the page 1. If
identical, the final device Response consist of the content
of page 3 that contains the Transponder and Memory
configuration (TMCF) and device Password Transponder
(PSW T). The MSB is send first.

START_AUTH Page 1

SEND to 11000 bit 31 ..............bit 0

Transponder CM[4:0]
EQ IDE
RECEIVED from
11111 bit 31 ..............bit 0
Transponder

tWAIT,Tr tWAIT,Bs
tIDLE

SEND to
Transponder

RECEIVED from EQ Page 3

Transponder 11111 bit 31 ..............bit 0

tWAIT,Tr tWAIT,Bs

Figure 13. START_AUTH timing

2010 May 04 17 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

START_AUTH (Cipher Mode) In case the authentication process fails, an error condition
If configured for Cipher mode, START_AUTH triggers the occurs that causes the device to terminate the command
mutual device authentication sequence. If completed and to enter WAIT state. The device will send no further
successfully, the device enters AUTHORIZED state and Response in this case.
subsequently supports ciphered read and write access of
Subsequent commands may be issued after termination of
the Transponder Memory, TM. Device authentication
the final tWAIT,Bs.
employs the Identifier, a Random Number, a ciphered
Signature and a ciphered device Response, see Figure 13. For proper command execution, the interrogating system
has to identify itself towards the device within the specified
After acceptance of the 5 bit command sequence, the initial
IDLE time, otherwise the device may generate a power-on
device Response consist of the 32 bit Identifier (IDE) that is
reset condition, upon which the circuitry would be reset and
stored in the Transponder Memory. Subsequently, the
the transponder initialized, causing the device to enter the
interrogating system (e.g. basestation) has to identify itself
WAIT state.
towards the device, by issuing a 32 bit Random Number
and a matching 32 bit ciphered Signature. The device The Security Algorithm details, involved in the process of
verifies the authenticity of the ciphered Signature received, mutual device authentication, are specified in a separate
by means of the Calculation Unit, involving the Secret Key Application Note. Please contact your NXP representative
(SK). If successful, the final device Response consists of for more information.
the ciphered content of page 3 that contains the
Transponder and Memory configuration (TMCF) and device
Password Transponder (PSW T). The MSB is send first.

START_AUTH Random Number [Signature]CIPHER

SEND to 11000 bit 31 ..............bit 0 bit 31 ..............bit 0

Transponder CM[4:0]
EQ IDE
RECEIVED from
11111 bit 31 ..............bit 0
Transponder

tWAIT,Tr tWAIT,Bs
tIDLE

SEND to
Transponder

RECEIVED from EQ [Page 3 Block 0]CIPHER

Transponder 11111 bit 31 ..............bit 0

tWAIT,Tr tWAIT,Bs

Figure 14. START_AUTH timing

2010 May 04 18 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

WRITE_PAGE In order to unambiguously verify, whether programming of

The command WRITE_PAGE writes the data supplied with the designated page completed properly, the basestation
this command into the designated page. The page has to identify, if the device still resides in AUTHORIZED
designated for writing is specified by the command bits pg2 state or entered WAIT state. Thus, a READ_PAGE or
to pg0. For data integrity reasons the 5 bit command and READ_PAGE_INV command should be issued
its complement have to be send, before the device will subsequently and monitored, if this command executes
accept it, see Figure 15. If accepted, the command properly.
Response consist of the command itself, and the
If the device still resides in AUTHORIZED state, command
corresponding complement.
execution would complete successfully and after verifying
The 10 bit command sequence may be repeated several the data that has been read, proper operation of the
times, if desired, to increase the data integrity level. In the corresponding WRITE_PAGE command can be assumed.
case that one of the 5 bit commands and its complement
Subsequent commands may be issued after termination of
do not match, an error condition occurs that causes the
the final tWAIT,Bs.
device to terminate the command, to initialize the device
and to enter the WAIT state. No command Response will Any attempt to write a page that is protected against
be send by the device in this case nor does the designated overwriting will be detected and cause an error condition,
page being overwritten. upon which the device terminates the command during
tWAIT,Tr and enters the WAIT state. No Response will be
After termination of tPROG the device checks, if the
send in this case.
EEPROM write operation completed successfully, if not, an
error condition occurs that causes the device to enter the If the device is configured for Password mode (ENC = 0)
WAIT state. the command sequence is transmitted in plain, while in
Cipher mode (ENC = 1) the whole command sequence is
In the case the write operation did not complete
transmitted ciphered.
successfully, the designated EEPROM page may hold an
undefined content or may suffer from a weak programming.

WRITE_PAGE
SEND to 1 0, pg2, pg1, pg0 0 1, pg2, pg1, pg0
Transponder
CM[4:0] CM[4:0]
EQ
RECEIVED from
Transponder 11111 1 0, pg2, pg1, pg0 0 1, pg2, pg1, pg0

CM[4:0] CM[4:0]
tWAIT,Tr

Data
SEND to bit 31 ..............bit 0
Transponder

RECEIVED from
Transponder

tWAIT,Bs tPROG

tIDLE tWAIT,Bs

Figure 15. WRITE_PAGE timing

2010 May 04 19 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

Mutual authentication of the Security Transponder in Cipher

7.4 Calculation Unit
mode is triggered by means of the START_AUTH
The PCF7936AS incorporates a Calculation Unit for use command, see also section 7.3. As a result, the device
during mutual device authentication, command operation reveals its Identifier to the interrogating system
and EEPROM data exchange, if the device is configured (basestation) and subsequently the interrogating system
for Cipher mode. The security algorithm involves a quasi has to send a 32 bit Random Number and a ciphered
unique 32 bit Identifier, a 48 bit Secret Key and a 32 bit Signature to the device. Both are processed by the
Random Number. Calculation Unit, involving the Secret Key (SK) and
The Identifier and the Secret Key are stored in the Identifier (IDE), in order to authenticate the interrogating
Transponder Memory, TM. The Identifier (IDE) is a factory system. If successful, the device replies with a ciphered
programmed quasi unique pattern, while the Secret Key is response for validation by the interrogating system.
initialized and subsequently locked by the customer during Details concerning the security algorithm implementation
device personalization. are specified in a separate Application Note. Please contact
your local NXP representative for more information.

2010 May 04 20 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

7.5.2 MIRO Mode (MS1 = 0, MS0 = 1)

7.5 Read Only Modes
If the Read Only mode MIRO is selected, the device
If the device is configured for one of three Read Only
cyclically transmits user page 4 to 5, see Figure 17.
modes, it will cyclically transmit data while operating in
READ ONLY state. The corresponding Read Only mode is The rate is fixed to 64 TO per bit (TBIT = 64 TO) and
selected by the configuration bit MS1 and MS0, located in Manchester encoding is applied.
the EEPROM, see section 7.1.4.
7.5.3 PCF7931/30/35 (MS1 = 1, MS0 = 0)
In Read Only mode, the data rate and coding is fixed as
specified and cannot be altered for the corresponding If the Read Only mode PCF7931/30/35 is selected, the
mode. Data is transmitted until an LF Field Power-On device cyclically transmits user page 4 to 7, while inserting
Reset terminates the READ ONLY state. a PMC pattern, as known from the PIT transponder family
(PCF7931/30), see Figure 18.
7.5.1 ISO 11784/5 (MS1 = 0, MS0 = 0) However, the modified PMC pattern implemented for the
If the Read Only mode ISO 11784/85 is selected, the PCF7936AS does not fully comply with the one used for the
device cyclically transmits user page 4 to 7, see Figure 16. PIT family.

The rate is fixed to 32 TO per bit (TBIT = 32 TO) and CDP The rate is fixed to 64 TO per bit (TBIT = 64 TO) and CDP
encoding is applied. encoding is applied.

SEND to
Transponder
page 4 page 5 page 6 page 7 page 4
RECEIVED from
bit 31 ............ bit 0 bit 31 ............ bit 0 bit 31 ............ bit 0 bit 31 ............ bit 0 bit 31 ............ bit 0
Transponder

tWAIT,RO

Figure 16. Sequence for ISO 11784/85 Read Only mode

SEND to
Transponder
page 4 page 5 page 4
RECEIVED from
bit 31 ............ bit 0 bit 31 ............ bit 0 bit 31 ............ bit 0
Transponder

tWAIT,RO

Figure 17. Sequence for MIRO Read Only mode

SEND to
Transponder
page 4 page 5 page 6 page 7 modified PMC page 4
RECEIVED from
bit 31 ............ bit 0 bit 31 ............ bit 0 bit 31 ............ bit 0 bit 31 ............ bit 0 bit 31 .....
Transponder
64 TO
tWAIT,RO

128 TO 192 TO

Figure 18. Sequence for PCF7931/30/35 Read Only mode

2010 May 04 21 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

setting of the Immobilizer Configuration bit DCS, which is

7.6 Transponder Data Transmission Format
part of the Transponder and Memory Configuration bits,
Reading from and writing to the device is accomplished by TMCF, see also section 7.1.4.
modulating the LF field in amplitude. Since the LF field also
provides the device power supply, the modulation In case of Manchester encoding, a logic 1 is modulated by
characteristics have to be verified carefully, in order to loading the LF field during the first half of the bit frame,
avoid a device reset due to a power low condition. while no load is applied during the second half. A logic 0 is
modulated in the opposite manner.
7.6.1 Read Direction In case of CDP encoding, a logic 1 corresponds to a state
Transmission of data from the transponder to the change at the end of the bit frame. A logic 0 corresponds
basestation is accomplished by absorption modulation to a state change after the first half and at the end of the bit
applied to the LF field. According to the data designated for frame.
transmission, the transponder interface activates an In any case, the device starts with a Load ON condition,
additional load that modulates the current drawn from the when data transmission commences.
transponder resonant circuit. Due to the inductive coupling
of the transponder resonant circuit and the basestation coil, The bit duration is a fixed multiple of the system clock
the current in the basestation coil is modulated accordingly, recovered from the LF field carrier.
resulting in a corresponding two-level amplitude After reception of the last bit, the basestation and control
modulation, see Figure 19. software have to consider the indicated delay, tWAIT,Bs,
In read direction the device employs either Manchester or before any command or data is transmitted to the device,
CDP encoding of data, see Figure 20, according to the see also section 7.3.1.

VLF-LOW VLF-HIGH
Load ON Load OFF

Figure 19. LF Field Absorption Modulation

Start of transmission End of transmission tWAIT,Bs

Last
Internal Data '1' '1' ... '0' '1' '0' '0' '1' '0' Bit LF field:
Load OFF
Manchester
Encoding Load ON

Load OFF
CDP
Encoding Load ON

TBIT 0.5 x TBIT

Figure 20. Data Transmission in Read Direction

2010 May 04 22 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

Sending data or commands to the device commences with

7.6.2 Write Direction
an initial write pulse that marks transmission start. A logic
Transmission of data from the basestation to the 0 or 1 is signaled to the transponder by the
transponder is accomplished by Amplitude Shift Keying corresponding repetition time (TLOG_0 respectively TLOG_1) of
(ASK) of the LF field with a modulation index as specified. the write pulse sequence.
According to the data designated for transmission, the
basestation coil driver is simply switched ON and OFF (tri- The end of the transmitted bit string is marked by a stop
state) typically. Due to the inductive coupling of the condition. A stop condition is detected by the transponder,
transponder resonant circuit and the basestation coil, the if no write pulse is detected for the specified time (TSTOP).
voltage of the transponder resonant circuit is modulated In the case the bit string transmitted causes the device to
accordingly. Resulting in a two-level amplitude modulation respond with data, modulation of the LF field by the device
that is detected by the transponder interface demodulator does commence after the specified time out (tWAIT,Tr), see
circuitry, see Figure 21. also section 7.3.1.
The PCF7936AS transponder demodulator circuitry has Violation of the specified timing causes an error condition,
been optimized for basestations with antenna coil drivers upon which the device enters the WAIT state, see also
that perform the LF field modulation by Tri-State switching section 7.2.
of the driver stage.

In write direction Binary Pulse Length Modulation (BPLM) is

applied for data encoding, see Figure 22.

VLF-HIGH
Coil

VLF-LOW
Coil

Figure 21. ASK Modulation of LF Field by the Basestation

Start of transmission End of transmission tWAIT,Tr

Internal Data '1' '1' '0' Last Stop

... LF field:
Bit Condition
High
BPLM
Encoding Low

TWRP

TLOG_1 TLOG_0
TSTOP

Figure 22. Data Transmission in Write Direction

2010 May 04 23 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

LF Field Power-On Reset has to be applied, in order to

7.7 LF Field Power On Reset
reset and initialize the circuitry. Consequently, the device
When the transponder enters a LF field a rectifier circuitry would resume WAIT state. As indicated, the Idle time is
becomes operational and the internal transponder supply specified as the time interval following the initialization
voltage (VDD) develops. As soon as the supply voltage sequence until the last bit of the Command Sequence that
exceeds the LF Field Power-On Reset threshold voltage is send to the transponder.
(VTHR) the device performs a chip reset and starts its
initialization sequence, see Figure 23. In case one of the Read Only modes is enabled, the device
enters READ ONLY state, if the first two bits of the
Subsequently, the transponder is muted and does not START_AUTH command are not being recognized within
respond to any command prior to termination of the the time-out period tWAIT,SA. In this case, Read Only
initialization sequence, tINIT. The startup time, tSTART, operation commences tWAIT,RO after termination of the
depends on the basestation configuration, the resonance initialization sequence, tINIT, see Figure 23. For details refer
circuit properties and the system coupling factor, however, to section 7.5.
is small compared with the initialization time typically.
In order to force a LF Field Power-On Reset and proper
For proper device operation, after a LF Filed Power-On device initialization at any time, the LF field OFF condition
Reset condition, command execution must commence must be applied for at least tRESET,SETUP, in order to ensure
within the specified Idle time, tIDLE, see Figure 23. that the internal device supply voltage, VDD, drops below
Otherwise the device may stop command decoding, the threshold voltage (VTHR), see Figure 24.
disabling any communication with the device. In this case a

VDD

VTHR LF field power on reset (POR)

threshold voltage

tIDLE

LF field applied Command Sequence t

READ ONLY Mode t

tWAIT,SA

tSTART tINIT tWAIT,RO

Figure 23. LF field power on reset timing

VDD

VTHR LF field power on reset (POR)

threshold voltage

LF field OFF

t
tRESET_SETUP

Figure 24. LF field power on reset setup timing

2010 May 04 24 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

Table 5. EEPROM Content Upon Delivery

8 EEPROM CONTENT AT DELIVERY
bit 31 bit 0
The PCF7936AS EEPROM content is initialized during
Content [HEX] Page Note
device manufacturing, according to Table 5.
XX XX XX 1X 0 1
However the EEPROM content may be modified as desired 4D 49 4B 52 1
by the application, except for the page 0 block 0 which
XX XX XX XX 2
holds the Identifier (IDE) and serves the function of a serial
number and product type ID. 06 AA 48 54 3 2
XX XX XX XX 4
XX XX XX XX 5
XX XX XX XX 6
XX XX XX XX 7

Note
1. Bit 7 to 4 of the this page (Identifier) serve the function
of a product type (application) identifier and are set to
0001 for the PCF7936AS.
2. Initially the device is configured for Password mode with
the Transport Key (Password Basestation, PSW B, as
specified (page1). The customer as desired for the
application may change the configuration.
3. Locations marked X are undefined and may hold any
pattern.

2010 May 04 25 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

9 LIMITING VALUES
All values are in accordance with Absolute Maximum Rating System (IEC 134)

PARAMETER MIN MAX UNIT

Operating temperature range -40 +85 C
Storage temperature range -55 +125 C
Magnetic flux density (resistance against magnetic pulses) 0.2 T
Vibration 10 g
- 10 - 2000Hz
- 3.axis
- IEC 68-2-6, Test Fc
Shock 1500 g
- 3.axis
- IEC 68-2-27, Test Ea
Mechanical stress (FMAX), Note 1 10 N

Note
1. FMAX is specified as indicated in Test Setup, section 11.

2010 May 04 26 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

10 DEVICE CHARACTERISTICS

10.1 Electrical Characteristics

Tamb = -40 to +85C, fSYS = 125kHz, TO = 1/fSYS. Unless otherwise specified

SYMBOL PARAMETER CONDITION MIN TYP MAX UNIT
Operating Conditions
fRES Resonance frequency 121 129 kHz
BW Bandwidth 2.3 kHz
BTHR Magnetic flux density, 35 400 TPP
Read direction
BPRG Magnetic flux density, Note 1 m = 0,95, TWRP = 8 TO 35 400 TPP
For EEPROM programming
BAUT Magnetic flux density, Note 1 m = 0,95, TWRP = 8 TO 35 400 TPP
For device authentication
BREAD LF field absorption in read direction, Note 1 BFIELD = 35 TPP 8 TPP
MIPRG Minimum modulation index (m), Note 1 BFIELD = 35 TPP, TWRP = 8 TO 95 %
Write direction, device programming and
authentication
EEPROM
TRET Data retention time Tamb = 50C 20 years
NWR-CYL Write endurance, page 1 to 7 100 k cycle

Note
1. Modulation index (m) and LF Field absorption (BREAD) are defined according to Figure 25.
2. Parameters are measured with the Scemtech test equipment STM-1 in a Helmholtz arrangement according to section 11.

BMAX - BMIN
m =
Transponder BMAX + BMIN
BMIN BMAX
LF Field
BREAD = BMAX - BMIN

Figure 25. Definition of modulation index (m) and LF field absorption (BREAD)

2010 May 04 27 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

10.2 Timing Characteristics

Tamb = -40 to +85C, fSYS = 125kHz, TO = 1/fSYS. Unless otherwise specified

SYMBOL PARAMETER CONDITION MIN TYP MAX UNIT
Command Handling
tWAIT,Tr Transponder response delay 199 206 TO
tWAIT,Bs Basestation response delay 90 TO
tPROG EEPROM erase/write time 615 TO
tIDLE Idle time 80 ms
Data Transmission
TBIT Bit duration 32 TO
TWRP Write pulse width Note 1 4 10 TO
TLOG_0 Write pulse repetition time, logic 0 18 22 TO
TLOG_1 Write pulse repetition time, logic 1 26 32 TO
TSTOP Write pulse length, stop condition 36 TO
LF Field Power On Reset, Note 2
tSTART Transponder initialization time BFIELD = 35T 80 s
tINIT Transponder initialization time 225 TO
tRESET,SETUP LF Field Power On Reset setup time BFIELD = 100T 5 ms

Read Only Mode

tWAIT,SA Timeout for START_AUTH command 320 TO
tWAIT,RO Read Only Mode startup delay Note 3 326 TO

Notes
1. As detected by the transponder interface demodulator. The corresponding LF Field write pulse width applied by the
basestation depends on the resonance circuit properties and actual system coupling factor.
2. Characterized with the Scemtech test equipment STM-1 in a Helmholtz arrangement according to section 11.
3. Total delay (Tinit + Twait,RO) = 551 T0

2010 May 04 28 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

10.3 Mechanical Characteristics

.
11.9-12.1 1.1-1.2 ax
m t ied
. 5 if no ecif
A 0.165 0 , p
R dii s
a ise
lR w
al her
ot

4.4 - 4.6
44
-46
5.9-6.1

A
0-7
(5 x 1.9-2.1
4.9-5.1 )

Cross Section A-A 1 .0

.9-
2.9-3.05

( without Scale ) R0

x)
(5
0-7

Protruding plastic must not exceed

specified dimension by more than 0.2 mm

Figure 26. Package outlines SOT 385-1

12.0

0.4
10.4
1.6 0.2

2.1 -0.1

C
IC
1.5 0.25
1.5 0.25
2.1 -0.1

OUTLINE DIMENSIONS ARE NOMINAL VALUES

Figure 27.Coil position, Layout SOT 385BA4

2010 May 04 29 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

The sense coils detect the absorption modulation induced

11 TEST SETUP by the transponder, whereas the reference coils sense the
Device characteristics are measured according to the test magnetic flux generated by the field generating coils only.
setups given below. The voltage difference measured between the sense coils
and reference coils is proportional to the magnetic field
Electrical characteristics are measured in a Helmholtz absorption induced by the transponder.
arrangement that generates an almost homogenous
magnetic field at the position of the device under test
(transponder), see Figure 29.

FMAX

DUT

Figure 28. Mechanical Stress

Reference Coils
(serial connected, in phase)
Field Generating Coils

(serial connected, in phase)

(serial connected, in phase)

DUT VDIF
Sense Coils

Signal
~
Generator

Reference Coils
(serial connected, in phase)

Figure 29. Helmholtz setup for electrical characteristics

2010 May 04 30 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

12 DEVELOPMENT TOOLS

Reference Name Description

OM6705 TED-Kit Transponder Evaluation and Development Kit

13 REVISION HISTORY

Revision Page Description

2000 Apr 04 Revised and updated revision
9, 10 PWP2 renamed PG3L and CSelect renamed DCS
14 Specification of tIDLE extended and updated
2003 May 15 Editorial changes and correction
7 Changes regarding the Transponder Configuration become effective after a device reset or
initialization sequence only.
2007 Nov 28 Change to NXP
4 unique IDE is replaced with quasi unique IDE.
IDE coderange is depleted and numbering is restarted (at 00h)
2007 Nov 30 28 Corrected Read Only Mode startup delay tWAIT,RO to 326 TO

2009 Feb 25 5 Fixed missing Figure 1. Block Diagram

2010 May 04 4 Added Type PCF 7936AS/3851/C with new manufacturing site ICN

2010 May 04 31 CONFIDENTIAL

Free Datasheet http://www.datasheet4u.com/

NXP Semiconductors Product Specification

Security Transponder (HITAG2) PCF7936AS

14 LEGAL INFORMATION

14.1 Data sheet status

Document status Product status Definition

Objective [short] data sheet Development This document contains data from the objective specification or product development

Preliminary [short] data sheet Qualification This document contains data from the preliminary specification

Product [short] data sheet Production This document contains the product specification

14.2 Definitions
Draft
The document is a draft version only. The content is still under internal review and subject to formal approval, which may result in modifications or additions. NXP
Semiconductors does not give any representations or warranties as to the accuracy or completeness of information included herein and shall have no liability for the
consequences of use of such information.
Short data sheet
A short data sheet is an extract from a full data sheet with the same product type number(s) and title. A short data sheet is intended for quick reference only and
should not be relied upon to contain detailed and full information. For detailed and full information see the relevant full data sheet, which is available on request via
the local NXP Semiconductors sales office. In case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail.
14.3 Disclaimers
General
Information in this document is believed to be accurate and reliable. However, NXP Semiconductors does not give any representations or warranties, expressed or
implied, as to the accuracy or completeness of such information and shall have no liability for the consequences of use of such information.
Right to make changes
NXP Semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product
descriptions, at any time and without notice. This document supersedes and replaces all information supplied prior to the publication hereof.
Suitability for use
NXP Semiconductors products are not designed, authorized or warranted to be suitable for use in medical, military, aircraft, space or life support equipment, nor in
applications where failure or malfunction of a NXP Semiconductors product can reasonably be expected to result in personal injury, death or severe property or
environmental damage. NXP Semiconductors accepts no liability for inclusion and/or use of NXP Semiconductors products in such equipment or applications and
therefore such inclusion and/or use is at the customers own risk.
Applications
Applications that are described herein for any of these products are for illustrative purposes only. NXP Semiconductors makes no representation or warranty that
such applications will be suitable for the specified use without further testing or modification.
Limiting values
Stress above one or more limiting values (as defined in the Absolute Maximum Ratings System of IEC 60134) may cause permanent damage to the device. Limiting
values are stress ratings only and operation of the device at these or any other conditions above those given in the Characteristics sections of this document is not
implied. Exposure to limiting values for extended periods may affect device reliability.
Terms and conditions of sale
NXP Semiconductors products are sold subject to the general terms and conditions of commercial sale, as published at http://www.nxp.com/profile/terms, including
those pertaining to warranty, intellectual property rights infringement and limitation of liability, unless explicitly otherwise agreed to in writing by NXP
Semiconductors. In case of any inconsistency or conflict between information in this document and such terms and conditions, the latter will prevail.
No offer to sell or license
Nothing in this document may be interpreted or construed as an offer to sell products that is open for acceptance or the grant, conveyance or implication of any
license under any copyrights, patents or other industrial or intellectual property rights.

Please be aware that important notices concerning this document and the product(s)
described herein, have been included in the section 'Legal information'.

NXP B.V. All rights reserved.

For more information, please visit: http://www.nxp.com

For sales office addresses, email to: [email protected]

Free Datasheet http://www.datasheet4u.com/