WM710xx – Secure F-RAM with Gen-2 RFID

Rev. 1.4

May 2011

Page 6 of 24

INTERROGATOR

TAG

MaxArias Write Cycle

QURY

(240u)

SELECT

(385u)

ACK

(175u)

REQRN

(345u)

EPC

(228u)

WRITE

(495u)

RN

(53u)

HANDLE

(78u)

WR_OK

(80u)

REQRN

(345u)

RN16

(78u)

EE

PR

OM

writ

e d

ela

y!

Ch

arg

e p

um

p &

EE

soa

k tim

e

EEPROM-based Write Cycle

4ms

Figure 3. Gen2 Memory Write Cycle Comparison: F-RAM vs. EEPROM Memories

RESERVED: KILL Password:

The kill password provides a mechanism to permanently disable the WM710xx RFID from responding to any

and all Gen2 interrogator commands. The mandatory KILL command can be issued by a RFID interrogator in

either the OPEN or SECURED states.

The WM710xx is permanently killed through a four-instruction

sequence of REQRN and KILL commands as detailed in the Gen2 standard. The KILL password is a 32-bit

value stored as 2 16-bit data words in reserved memory. The most significant KILL password is stored in

reserved memory bank address 0x00 with the least significant word stored in reserved memory bank address

0x01. The kill function can be permanently disabled by setting both KILL password words to 0x0000, and

permanently locking the KILL password in the reserved memory bank. Once the kill password has been set, it

should be permanently locked using the LOCK command. The WM710xx is shipped from the factory with the

kill password memory unlocked.

RESERVED: ACCESS Password:

The access password provides a security mechanism to prevent unauthorized RFID interrogators from writing

to WM710xx memory. Non-zero access passwords require the WM710xx be placed in the SECURED state

prior to writing to it. This is accomplished through four consecutive REQRN and ACCESS commands as

described in the Gen2 standard. An access password with a value of zero requires no authentication prior to

writing to WM710xx memory. The ACCESS password is a 32-bit value stored as 2 16-bit data words in

reserved memory. The most significant ACCESS password is stored in reserved memory bank address 0x02

with the least significant word stored in reserved memory bank address 0x03. Once the access password has

been set, it should be permanently locked using the LOCK command. The WM710xx is shipped from the

factory with the access password memory unlocked.

EPC Memory Bank:

The EPC memory bank accommodates 8 words: 1 protocol control (PC) word, a 6-word (96-bit) memory space

for an EPC identifier, and a 1-word CRC. The CRC word is calculated as part of the WM710xx power-on

initialization routine and written into the EPC memory bank address 0x00. The PC and 6-word EPC identifier

are completely programmable. The Protocol Control field is shown in Figure 4.