SPSXM002PET

Smart Passive Sensort for

Direct Moisture Sensing
Description
The SPSXM002PET is a battery−free wireless sensor for moisture
level detection on non−metal surfaces. Smart Passive Sensors use the
Magnus−S2® Sensor IC from RF Micron, a UHF RFID chip that is www.onsemi.com
powered by RF energy harvesting from the UHF reader. The
Magnus−S2 utilizes the patented self−tuning Chameleont engine that
adapts the RF front−end to optimize performance in various
environmental conditions. Changes in antenna detuning due to
moisture contact are digitized by the sensor which can then be read by
a standard EPC Gen 2 compliant reader. These sensor tags function in
either the FCC defined UHF band or the ETSI UHF band.
The small form factor and battery−free capabilities of Smart Passive
Sensors allow them to be designed into applications where size and
accessibility are at a premium. RF TAG 101.60x31.75MM
CASE 888AD/AE
Features
• Single IC, Smart Passive Sensing
• Small Form Factor Packages ORDERING INFORMATION
See detailed ordering and shipping information on page 5 of
• Direct Moisture Contact Sensing this data sheet.
• On−chip RSSI Sensor
• 64 bit TID and 128 bit EPC + 144 Bit User Defined Memory
• EPC Class 1 Gen 2 v.2.0.0 ISO 18 000−6C Compliant
• These Devices are Pb−Free, Halogen Free/BFR Free and are RoHS
Compliant

Applications
• Medical
• Industrial
• Facilities Management

MAXIMUM RATINGS (TA = 25°C unless otherwise noted)

Rating Symbol Max Unit
Human Body Model (Note 1) ESD ±1 kV
Stresses exceeding those listed in the Maximum Ratings table may damage the
device. If any of these limits are exceeded, device functionality should not be
assumed, damage may occur and reliability may be affected.
1. Non−repetitive current pulse at TA = 25°C, per JS−001 waveform.

THERMAL CHARACTERISTICS
Characteristic Symbol Max Unit
Operating and Storage Temperature TOP, Tstg −20 to +85 °C
Range (Note 2)
2. Shelf Life − minimum 2 years from date of manufacturing.

© Semiconductor Components Industries, LLC, 2017 1 Publication Order Number:

March, 2019 − Rev. 1 SPSXM002/D
 SPSXM002PET

Table 1. ELECTRICAL CHARACTERISTICS (TA = 25°C unless otherwise noted)

Parameter Min Typ Max Units
Operating Frequency (Note 3) FCC 902 928 MHz
ETSI 866 868 MHz
Read Sensitivity (Note 4) −16 dBm
Sensor Code 0 31 codes
RSSI Code 0 31 codes
TID 64 bits
EPC (Note 5) 128 bits
User Memory 144 bits
Product parametric performance is indicated in the Electrical Characteristics for the listed test conditions, unless otherwise noted. Product
performance may not be indicated by the Electrical Characteristics if operated under different conditions.
3. Band specific part numbers can be found in the ordering information table
4. Measured in free space, anechoic chamber with a linearly polarized antenna at 50 cm read distance
5. User Memory can be configured to be an EPC extension, effectively making a 272 bit EPC code

Figure 1. Moisture Contact Test Area

Moisture Sensing

The SPSXM002 generates sensor codes from 0 to 31, with capability, the sensor code does shift over frequency as it
a free space sensor code average of 18. Figure 1 shows the tunes itself to maximize reflected power to the reader. This
moisture sensitive portion of the tag used to collect the data makes it important to account for the frequency at which the
in Figure 2. The SPSXM002 with a damp cloth over the sensor was read. This factor must be accounted for in the
sensor yields a sensor value 5 codes lower than the dry test. reader software in order to ensure reliable wet vs. dry reads.
For the moisture test seen in Figure 1, the sensor value shifts For more information on how Smart Passive Sensors
approximately 5 codes when water is detected on the surface generate sensor codes, please refer to Application Note
of the tag. Due to the Smart Passive Sensors’ self−tuning AND9209/D.

DRY

WET

Figure 2. Sensor Code for Wet and Dry Conditions

www.onsemi.com
2
 SPSXM002PET

Table 2. MEMORY MAP

Bank # Bank Name R/W Bit Address Description LSB MSB Default Value
N/A A0−AF On−chip RSSI Threshold N/A
80−8F User Memory 0
70−7F User Memory 0
60−6F User Memory 0
50−5F User Memory 0
11 USER
READ/WRITE 40−4F User Memory 0
30−3F User Memory 0
20−2F User Memory 0
10−1F User Memory 0
00−0F User Memory 0
50−5F TID[15:0]
40−4F TID[31:16]
30−3F TID[47:32]

10 TID READ ONLY 20−2F Extended TID Header

10−1F Tag Model Number
08−13 Manufacturer ID
00−07 Class ID
WRITE ONLY 140−14F EPC Configure 0
90−9F EPC#[15:0] 0
80−8F EPC#[31:16] 0
70−7F EPC#[47:32] 0
60−6F EPC#[63:48] 0

01 EPC READ/WRITE 50−5F EPC#[79:64] 0

40−4F EPC#[95:80] 0
30−3F EPC#[111:96] 0
20−2F EPC#[127:112] 0
10−1F StoredPC[15:0] 0
READ ONLY 00−0F StoredCRC[15:0] 0
READ/WRITE F0−FF Sensor Overwrite 0
D0−DF On−chip RSSI Code N/A
READ ONLY
B0−BF Sensor Code N/A
50−5F Analog Overwrite 0
00 RESERVED
30−3F Access Password[15:0] 0

READ/WRITE 20−2F Access Password[31:16] 0

10−1F Kill Password[15:0] 0
00−0F Kill Password[31:16] 0

www.onsemi.com
3
 SPSXM002PET

Tag Memory

Memory Configuration Kill Password

Memory is organized according to the EPCglobal The Kill Password is a 32−bit value stored in Reserve
Generation−2 UHF RFID specification. There are two Memory 00h to 1Fh, MSB first. The default value is all
possible configurations for the EPC ID: zeroes. A reader shall use a tag’s kill password once to kill
• 8−word EPC code and 9 free words in the USER the tag and render it silent thereafter. A tag will not execute
memory bank, as shown in the Memory Map a kill operation if its Kill Password is all zeroes.
• 17−word EPC code and no free USER memory (EPC EPC Memory − EPC data, Protocol Control Bits, and
lengths above 11 words may not be supported on all CRC16
readers.) As required by the Gen−2 specification, EPC memory
The 8−word configuration is the default. To change to the contains a 16−bit cyclic−redundancy check word
17−word configuration, write 0001h to the EPC Bank, word (StoredCRC) at memory addresses 00h to 0Fh, the 16
address 14h. The memory can be reset to the default 8−word protocol−control bits (StoredPC) at memory addresses 10h
EPC configuration by writing 0000h to the same location. to 1Fh, and an EPC value beginning at address 20h.
This EPC configuration can be configured and reconfigured The protocol control fields include a five−bit EPC length,
repeatedly as long as the EPC memory bank is not a one−bit user−memory indicator (UMI), a one−bit extended
permanently locked by a LOCK command. Once the EPC protocol control indicator, and a nine−bit numbering system
memory bank is permanently locked, it cannot be identifier (NSI).
reconfigured. On power−up, the IC calculates the StoredCRC over the
stored PC bits and the EPC specified by the EPC length field
Reserved Memory − Passwords in the StoredPC. For more details about the StoredPC field
Reserved Memory contains the ACCESS and KILL or the StoredCRC, please see the Gen 2 specification.
passwords. There is a 32−bit Access Password and a 32−bit The StoredCRC, StoredPC, and EPC are stored MSB first
Kill Password. The default for both Kill and Access (i.e. the EPC’s MSB is stored in location 20h).
Passwords is 0000h.
Tag Identification (TID) Memory
Access Password The read−only Tag Identification memory contains the
The Access Password is a 32−bit value stored in Reserved manufacturer−specific data. The manufacturer Mask
Memory 20h to 3Fh MSB first. The default value is all Designer ID (MDID) is 824h (bits 08h to 13h). The logic 1
zeroes. Tags with a non−zero Access Password will require in the most significant bit of the MDID indicates the
a reader to issue this password before transitioning to the presence of an extended TID consisting of a 16−bit header
secured state. and a 48−bit serialization. The Magnus−S2 model number is
in bits 10h to 1Fh and the EPCglobal® Class ID (E2h) is in
00h to 07h.

Sensor Functions

Accessing the Sensor Code reading that is taken when the tag is placed into service.
The Magnus−S2 Chameleon engine stores tuning Depending on the needs of the application, the reference or
information in a user−accessible memory register. The baseline value(s) may be written back into regular user
“Sensor Code” register (B0h−BFh in the Reserved memory memory or may be stored elsewhere on the user’s network.
bank) contains the current setting and controls the tuning The SPSXM002 may require more than its minimum
capacitors that are used to adjust the input impedance. sensitivity power in order to sense values near the ends of the
To get the results of the self−tuning operation, a READ code range (0−5 and 27−31). The minimum required power
command may be issued for the Sensor Code (B0h −BFh in tends to increase gradually as the Sensor Code moves from
the Reserved memory bank). Because the tuning network 5 to 0 or from 27 to 31.
offers 32 different levels of impedance, only the 5 least
significant bits (BBh −BFh) in the register are actually Overriding Default Chameleon Behavior
implemented and used. (The 32 levels represent increasing By default, the Chameleon engine will self−tune when
amounts of capacitance added to the input impedance, with Magnus−S2 powers up, and the tuning capacitance chosen
the lowest capacitance applied at level 0.) Returned results will be held constant until the chip powers down. There are
will be in the form 0000 0000 000x xxxx, where the 5 LSBs also two additional modes: Chameleon can tune
define the current tuning. continuously – not just at power up – and Chameleon can be
For use in sensing applications, the Sensor Code register forced to a user−chosen setting.
can be monitored for changes over time or at different To cause Chameleon to adjust continuously while
locations, or it can be checked for changes to a baseline Magnus−S2 is powered up, write 0800h to the Analog

www.onsemi.com
4
 SPSXM002PET

Overwrite word (address 50h−5Fh in the Reserved Bank) On−Chip RSSI Requests
using a standard WRITE command. On−Chip RSSI Request is a tool for a reader to specify that
To force Chameleon to a desired setting, write 4000h to the it wants to hear only from tags that are seeing a desired
Analog Overwrite word, and the tuning value to the Sensor amount of received signal strength. It allows a reader to limit
Overwrite word (address F0h−FFh in the Reserved Bank) its communications only to nearby tags – or conversely, to
with standard WRITE commands. The tuning value format “mute” nearby tags in order to attempt communication with
is 0000 0000 000x xxxx, where x_xxxx represents the tags receiving weak signals.
desired 5−bit tuning. When the above sequence is executed The On−Chip RSSI Threshold “address” (A0h of the User
correctly, the setting x_xxxx will be transferred into the Bank) is used only by Magnus−S2 to interpret a SELECT
Sensor Code register and will be held constant until the next command and is not an actual memory location. It is sent by
power−up or until the user writes a different value into the the reader using a standard Gen 2 SELECT command. The
Sensor Overwrite word. 6−bits of On−Chip RSSI Threshold Value/Control are
The Analog Overwrite word is non−volatile: values communicated as part of the Mask sent to the tags.
written will persist through chip power cycles. The Sensor The list below from the Gen 2 version 2.0.0 spec shows the
Overwrite word is volatile: if a fixed Chameleon setting is format of a SELECT command. To send an On−Chip RSSI
desired, it must be re−written every time Magnus−S2 is Request, the reader issues a SELECT command with:
powered up. • MemBank set to 3h (11b)
On−Chip RSSI Code
• The On−Chip RSSI Threshold address (A0h) in the
Magnus−S2 incorporates circuitry that measures Pointer field
incoming signal strength and converts it to a digital value: • Length set to 00001000b (the On−Chip RSSI request
the On−Chip RSSI (Received Signal Strength Indicator) value consists of the lower 6 bits of an 8−bit Mask)
Code. This can be communicated to a reader and used for • The On−Chip RSSI request in the lower 6 bits of the
control purposes. The On−Chip RSSI Code has a 32−level Mask, consisting of a leading bit for control followed
range, represented by a 5−bit number. by 5 bits for the On−Chip RSSI Code at which the
The On−Chip RSSI Code, in word D0h−DFh in the reader wants to define the tags’ response/no−response
Reserved Bank, will be returned as the 5 LSBs of a response threshold.
to a standard READ command specifying word address Dh. The control bit determines whether the threshold value is
Magnus−S2 must first receive an On−Chip RSSI Request interpreted by Magnus−S2 as a lower or upper threshold.
before the On−Chip RSSI Code becomes available. Specifically, if the control bit is set to 0, it will respond if its
internally generated On−Chip RSSI Code is less than or
equal to the threshold value. If the control bit is 1, it will
respond if its On−Chip RSSI Code is greater than the
threshold.

ORDERING INFORMATION
Device UHF Band Attach Material Package Shipping
SPS1M002PET FCC Non−metal Case 888AD 1000 / Reel
902−928 MHz

SPS2M002PET ETSI Non−metal Case 888AE 1000 / Reel

866−868 MHz

www.onsemi.com
5
 SPSXM002PET

PACKAGE DIMENSIONS

RF TAG 91.5x26.5mm
CASE 888AD
ISSUE O

D1 NOTES:
1. DIMENSIONING AND TOLERANCING PER
ASME Y14.5M, 1994.
2. CONTROLLING DIMENSION: MILLIMETERS.
D 3. ANTENNA SIZE DETERMINED BY DIMENSIONS
D AND E.
4. LABEL SIZE DETERMINED BY DIMENSIONS D1
AND E1.
5. LABEL IS 0.076 THICK PET TAPE. ANTENNA IS
0.009 THICK ALUMINUM.
MILLIMETERS
E E1 DIM MIN MAX
D 88.90 89.10
E 23.90 24.10
D1 90.50 91.50
E1 25.50 26.50

TOP VIEW

RF TAG 101.60x31.75MM
CASE 888AE
ISSUE A

NOTES:
D1 1. DIMENSIONING AND TOLERANCING PER
ASME Y14.5M, 1994.
2. CONTROLLING DIMENSION: MILLIMETERS.
D 3. ANTENNA SIZE DETERMINED BY DIMENSIONS
D AND E.
4. LABEL SIZE DETERMINED BY DIMENSIONS D1
AND E1.
5. LABEL IS 0.076 THICK PET TAPE. ANTENNA IS
0.009 THICK ALUMINUM.
MILLIMETERS
E E1 DIM MIN NOM MAX
D 93.90 94.00 94.10
E 23.90 24.00 24.10
D1 101.10 101.60 102.10
E1 31.25 31.75 32.25

TOP VIEW

Smart Passive Sensor is a trademark of RFMicron, Inc.

Magnus−S2 is a registered trademark of RFMicron, Inc.
Chameleon is a trademark of RFMicron, Inc.

ON Semiconductor and are trademarks of Semiconductor Components Industries, LLC dba ON Semiconductor or its subsidiaries in the United States and/or other countries.
ON Semiconductor owns the rights to a number of patents, trademarks, copyrights, trade secrets, and other intellectual property. A listing of ON Semiconductor’s product/patent
coverage may be accessed at www.onsemi.com/site/pdf/Patent−Marking.pdf. ON Semiconductor reserves the right to make changes without further notice to any products herein.
ON Semiconductor makes no warranty, representation or guarantee regarding the suitability of its products for any particular purpose, nor does ON Semiconductor assume any liability
arising out of the application or use of any product or circuit, and specifically disclaims any and all liability, including without limitation special, consequential or incidental damages.
Buyer is responsible for its products and applications using ON Semiconductor products, including compliance with all laws, regulations and safety requirements or standards,
regardless of any support or applications information provided by ON Semiconductor. “Typical” parameters which may be provided in ON Semiconductor data sheets and/or
specifications can and do vary in different applications and actual performance may vary over time. All operating parameters, including “Typicals” must be validated for each customer
application by customer’s technical experts. ON Semiconductor does not convey any license under its patent rights nor the rights of others. ON Semiconductor products are not
designed, intended, or authorized for use as a critical component in life support systems or any FDA Class 3 medical devices or medical devices with a same or similar classification
in a foreign jurisdiction or any devices intended for implantation in the human body. Should Buyer purchase or use ON Semiconductor products for any such unintended or unauthorized
application, Buyer shall indemnify and hold ON Semiconductor and its officers, employees, subsidiaries, affiliates, and distributors harmless against all claims, costs, damages, and
expenses, and reasonable attorney fees arising out of, directly or indirectly, any claim of personal injury or death associated with such unintended or unauthorized use, even if such
claim alleges that ON Semiconductor was negligent regarding the design or manufacture of the part. ON Semiconductor is an Equal Opportunity/Affirmative Action Employer. This
literature is subject to all applicable copyright laws and is not for resale in any manner.

PUBLICATION ORDERING INFORMATION

LITERATURE FULFILLMENT: N. American Technical Support: 800−282−9855 Toll Free ON Semiconductor Website: www.onsemi.com
Literature Distribution Center for ON Semiconductor USA/Canada
P.O. Box 5163, Denver, Colorado 80217 USA Europe, Middle East and Africa Technical Support: Order Literature: http://www.onsemi.com/orderlit
Phone: 303−675−2175 or 800−344−3860 Toll Free USA/Canada Phone: 421 33 790 2910
Fax: 303−675−2176 or 800−344−3867 Toll Free USA/Canada For additional information, please contact your local
Email: [email protected] Sales Representative

◊ www.onsemi.com SPSXM002/D
6