PN512 Full NFC Forum-compliant frontend Rev. 5.2 — 16 June 2016 Product data sheet 111352 COMPANY PUBLIC 1. General description PN512 is the most broadly adopted NFC frontend - powering more than 10 billion NFC transactions per year. It is a highly integrated NFC frontend for contactless communication at 13.56MHz. This NFC frontendutilizes an outstanding modulation and demodulation concept completely integrated for different kinds of contactless communication methods and protocols at 13.56MHz. The PN512 NFC frontend supports 4 different operating modes • Reader/Writer mode supporting ISO/IEC14443A/MIFARE and FeliCa scheme • Reader/Writer mode supporting ISO/IEC14443B • Card Operation mode supporting ISO/IEC14443A/MIFARE and FeliCa scheme • NFCIP-1 mode Enabled in Reader/Writer mode for ISO/IEC14443A/MIFARE, the PN512’s internal transmitter part is able to drive a reader/writer antenna designed to communicate with ISO/IEC14443A/ MIFARE cards and transponders without additional active circuitry. The receiver part provides a robust and efficient implementation of a demodulation and decoding circuitry for signals from ISO/IEC14443A/MIFARE compatible cards and transponders. The digital part handles the complete ISO/IEC14443A framing and error detection (Parity and CRC). Enabled in Reader/Writer mode for FeliCa, the PN512 NFC frontendsupports the FeliCa communication scheme. The receiver part provides a robust and efficient implementation of the demodulation and decoding circuitry for FeliCa coded signals. The digital part handles the FeliCa framing and error detection like CRC. The PN512 supports contactless communication using FeliCa Higher transfer speeds up to 424kbit/s in both directions. The PN512 supports all layers of the ISO/IEC14443B reader/writer communication scheme, given correct implementation of additional components, like oscillator, power supply, coil etc. and provided that standardized protocols, e.g. like ISO/IEC14443-4 and/or ISO/IEC14443B anticollision are correctly implemented. In Card Operation mode, the PN512 NFC frontend is able to answer to a reader/writer command either according to the FeliCa or ISO/IEC14443A/MIFARE card interface scheme. The PN512 generates the digital load modulated signals and in addition with an external circuit the answer can be sent back to the reader/writer. A complete card functionality is only possible in combination with a secure IC using the S2C interface.

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Additionally, the PN512 NFC frontendoffers the possibility to communicate directly to an NFCIP-1 device in the NFCIP-1 mode. The NFCIP-1 mode offers different communication mode and transfer speeds up to 424kbit/s according to the Ecma 340 and ISO/IEC18092 NFCIP-1 Standard. The digital part handles the complete NFCIP-1 framing and error detection. Various host controller interfaces are implemented: • 8-bit parallel interface1 • SPI interface • serial UART (similar to RS232 with voltage levels according pad voltage supply) • I2C interface. 1.1 Different available versions The PN512 is available in three versions: • PN5120A0HN1/C2 (HVQFN32), PN5120A0HN/C2 (HVQFN40) and PN5120A0ET/C2 (TFBGA64), hereafter named as version 2.0 • PN512AA0HN1/C2 (HVQFN32) and PN512AA0HN1/C2BI (HVQFN32 with Burn In), hereafter named as industrial version, fulfilling the automotive qualification stated in AEC-Q100 grade 3 from the Automotive Electronics Council, defining the critical stress test qualification for automotive integrated circuits (ICs). The customer recognizes that: – since the product was not originally designed for automotive use, it will not be possible to achieve the levels of quality and failure analysis that are normally associated with products explicitly designed for automotive use. – the product qualification conforms to AEC-Q100. – all product production locations are certified according to TS16949. • PN5120A0HN1/C1(HVQFN32) and PN5120A0HN/C1 (HVQFN40), hereafter named as version 1.0 The data sheet describes the functionality for the industrial version and version 2.0. The differences of the version 1.0 to the version 2.0 are summarized in Section20. The industrial version has only differences within the outlined characteristics and limitations. 1. 8-bit parallel Interface only available in HVQFN40 package. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 2 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 2. Features and benefits  Includes NXP ISO/IEC14443-A, Innovatron ISO/IEC14443-B and NXP MIFARE Crypto 1 intellectual property licensing rights  Fast and cost-efficient NFC design startup  Highly integrated analog circuitry to demodulate and decode responses  Buffered output drivers for connecting an antenna with the minimum number of external components  Integrated RF Level detector  Integrated data mode detector  Supports ISO/IEC14443A/MIFARE  Supports ISO/IEC 14443 B Read/Write modes  Typical operating distance in Read/Write mode up to 50mm depending on the antenna size and tuning  Typical operating distance in NFCIP-1 mode up to 50mm depending on the antenna size and tuning and power supply  Typical operating distance in ISO/IEC14443A/MIFARE card or FeliCa Card Operation mode of about 100mm depending on the antenna size and tuning and the external field strength  Supports MIFARE Classic encryption in Reader/Writer mode  ISO/IEC14443A higher transfer speed communication at 212kbit/s and 424kbit/s  Contactless communication according to the FeliCa scheme at 212kbit/s and 424kbit/s  Integrated RF interface for NFCIP-1 up to 424kbit/s  S2C interface  Additional power supply to directly supply the smart card IC connected via S2C  Supported host interfaces SPI up to 10Mbit/s I2C-bus interface up to 400kBd in Fast mode, up to 3400kBd in High-speed mode RS232 Serial UART up to 1228.8kBd, with voltage levels dependant on pin voltage supply 8-bit parallel interface with and without Address Latch Enable  FIFO buffer handles 64byte send and receive  Flexible interrupt modes  Hard reset with low power function  Power-down mode per software  Programmable timer  Internal oscillator for connection to 27.12MHz quartz crystal  2.5 V to 3.6V power supply  CRC coprocessor  Programmable I/O pins  Internal self-test PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 3 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 3. Quick reference data Table 1. Quick refere nce data Symbol Parameter Conditions Min Typ Max Unit V analog supply voltage V V = V = V ; [1][2] 2.5 - 3.6 V DDA DD(PVDD) DDA DDD DD(TVDD) V =V =V =V =0V V digital supply voltage SSA SSD SS(PVSS) SS(TVSS) DDD V TVDD supply voltage DD(TVDD) V PVDD supply voltage [3] 1.6 - 3.6 V DD(PVDD) V SVDD supply voltage V =V =V =V =0V 1.6 - 3.6 V DD(SVDD) SSA SSD SS(PVSS) SS(TVSS) I power-down current V =V = V =V =3V pd DDA DDD DD(TVDD) DD(PVDD) hard power-down; pin NRSTPD setLOW [4] - - 5 A soft power-down; RF level detector on [4] - - 10 A I digital supply current pin DVDD; V =3V - 6.5 9 mA DDD DDD I analog supply current pin AVDD; V =3V, CommandReg register’s - 7 10 mA DDA DDA RcvOffbit =0 pin AVDD; receiver switched off; V =3V, - 3 5 mA DDA CommandReg register’s RcvOff bit=1 I PVDD supply current pin PVDD [5] - - 40 mA DD(PVDD) I TVDD supply current pin TVDD; continuous wave [6][7][8] - 60 100 mA DD(TVDD) T ambient temperature HVQFN32, HVQFN40, TFBGA64 30 +85 C amb lndustrial version PN512AA0HN1: I power-down current V =V = V =V =3V pd DDA DDD DD(TVDD) DD(PVDD) hard power-down; pin NRSTPD setLOW [4] - - 15 A soft power-down; RF level detector on [4] - - 30 A T ambient temperature HVQFN32 40 - +90 C amb [1] Supply voltages below 3V reduce the performance in, for example, the achievable operating distance. [2] V , V and V must always be the same voltage. DDA DDD DD(TVDD) [3] V must always be the same or lower voltage than V . DD(PVDD) DDD [4] I is the total current for all supplies. pd [5] I depends on the overall load at the digital pins. DD(PVDD) [6] I depends on V and the external circuit connected to pins TX1 and TX2. DD(TVDD) DD(TVDD) [7] During typical circuit operation, the overall current is below 100mA. [8] Typical value using a complementary driver configuration and an antenna matched to 40  between pins TX1 and TX2 at 13.56MHz. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 4 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 4. Ordering information Table 2. Ordering info rmation Type number Package Name Description Version PN5120A0HN1/C2 HVQFN32 plastic thermal enhanced very thin quad flat package; no leads; SOT617-1 32terminal; body 5  5  0.85 mm PN5120A0HN/C2 HVQFN40 plastic thermal enhanced very thin quad flat package; no leads; SOT618-1 40terminals; body 6  6  0.85 mm PN512AA0HN1/C2 HVQFN32 plastic thermal enhanced very thin quad flat package; no leads; SOT617-1 32terminal; body 5  5  0.85 mm PN512AA0HN1/C2BI HVQFN32 plastic thermal enhanced very thin quad flat package; no leads; SOT617-1 32terminal; body 5  5  0.85 mm PN5120A0HN1/C1 HVQFN32 plastic thermal enhanced very thin quad flat package; no leads; SOT617-1 32terminal; body 5  5  0.85 mm PN5120A0HN/C1 HVQFN40 plastic thermal enhanced very thin quad flat package; no leads; SOT618-1 40terminals; body 6  6  0.85 mm PN5120A0ET/C2 TFBGA64 plastic thin fine-pitch ball grid array package; 64 balls SOT1336-1 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 5 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 5. Block diagram The analog interface handles the modulation and demodulation of the analog signals according to the Card Receiving mode, Reader/Writer mode and NFCIP-1 mode communication scheme. The RF level detector detects the presence of an external RF-field delivered by the antenna to the RX pin. The Data mode detector detects a MIFARE, FeliCa or NFCIP-1 mode in order to prepare the internal receiver to demodulate signals, which are sent to the PN512. The communication (S2C) interface provides digital signals to support communication for transfer speeds above 424kbit/s and digital signals to communicate to a secure IC. The contactless UART manages the protocol requirements for the communication protocols in cooperation with the host. The FIFO buffer ensures fast and convenient data transfer to and from the host and the contactless UART and vice versa. Various host interfaces are implemented to meet different customer requirements. REGISTER BANK ANTENNA ANALOG CONTACTLESS INTERFACE UART FIFO SERIAL UART BUFFER SPI HOST I2C-BUS 001aaj627 Fig 1. Simplified block diagram of the PN512 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 6 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend D6/ADR_0/ D2/ADR_4 D4/ADR_2 MOSI/MX D5/ADR_1/ D7/SCL/ SDA/NSS/RX EA I2C D1/ADR_5 D3/ADR_3 SCK/DTRQ MISO/TX PVDD PVSS 24 32 1 25 26 27 28 29 30 31 2 5 3 DVDD VOLTAGE 4 MONITOR DVSS SPI, UART, I2C-BUS INTERFACE CONTROL AND 15 POWER ON AVDD DETECT 18 AVSS FIFO CONTROL STATE MACHINE 64-BYTE FIFO RESET COMMAND REGISTER BUFFER CONTROL PROGRAMABLE TIMER POWER-DOWN 6 NRSTPD CONTROL REGISTER CONTROL BANK 23 INTERRUPT CONTROL IRQ CRC16 MIFARE CLASSIC UNIT GENERATION AND CHECK RANDOM NUMBER PARALLEL/SERIAL GENERATOR CONVERTER BIT COUNTER PARITY GENERATION AND CHECK FRAME GENERATION AND CHECK BIT DECODING BIT ENCODING 7 MFIN 8 SERIAL DATA SWITCH MFOUT 9 SVDD 21 CLOCK OSCIN AMPLITUDE GENERATION, OSCILLATOR RATING ANALOG TO DIGITAL FILTERING AND 22 DISTRIBUTION OSCOUT CONVERTER REFERENCE VOLTAGE Q-CLOCK TEMPERATURE GENERATION SENSOR ANALOG TEST MULTIPLEXOR I-CHANNEL Q-CHANNEL AND AMPLIFIER AMPLIFIER TRANSMITTER CONTROL DIGITAL TO I-CHANNEL Q-CHANNEL ANALOG DEMODULATOR DEMODULATOR CONVERTER 16 19 20 17 10, 14 11 13 12 VMID AUX1 AUX2 RX TVSS TX1 TX2 TVDD 001aak602 Fig 2. Detailed block diagram of the PN512 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 7 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 6. Pinning information 6.1 Pinning terminal 1 0 7 6 5 4 3 2 1 index area A D D D D D D D 2 1 0 9 8 7 6 5 3 3 3 2 2 2 2 2 A1 1 24 ALE PVDD 2 23 IRQ DVDD 3 22 OSCOUT DVSS 4 21 OSCIN PN512 PVSS 5 20 AUX2 NRSTPD 6 19 AUX1 SIGIN 7 18 AVSS SIGOUT 8 17 RX 9 10 11 12 13 14 15 16 D S 1 D 2 S D D SVD TVS TX TVD TX TVS AVD VMI 001aan212 Transparent top view Fig 3. Pinning configuration HVQFN32 (SOT617-1) terminal 1 1 0 7 6 5 4 3 2 1 0 A A D D D D D D D D index area 0 9 8 7 6 5 4 3 2 1 4 3 3 3 3 3 3 3 3 3 A2 1 30 NCS A3 2 29 ALE A4 3 28 NRD A5 4 27 NWR PVDD 5 26 IRQ PN512 DVDD 6 25 OSCOUT DVSS 7 24 OSCIN PVSS 8 23 AUX2 NRSTPD 9 22 AUX1 SIGIN 10 21 AVSS 1 2 3 4 5 6 7 8 9 0 1 1 1 1 1 1 1 1 1 2 T D S 1 D 2 S D D X GOU SVD TVS TX TVD TX TVS AVD VMI R 001aan213 SI Transparent top view Fig 4. Pinning configuration HVQFN40 (SOT618-1) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 8 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend ball A1 TFBGA64 index area 1 2 3 4 5 6 7 8 A B C D E F G H aaa-005873 Transparent top view Fig 5. Pin configuration TFBGA64 (SOT1336-1) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 9 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 6.2 Pin description Table 3. Pin descripti on HVQFN32 Pin Symbol Type Description 1 A1 I Address Line 2 PVDD PWR Pad power supply 3 DVDD PWR Digital Power Supply 4 DVSS PWR Digital Ground 5 PVSS PWR Pad power supply ground 6 NRSTPD I Not Reset and Power Down: When LOW, internal current sinks are switched off, the oscillator is inhibited, and the input pads are disconnected from the outside world. With a positive edge on this pin the internal reset phase starts. 7 SIGIN I Communication Interface Input: accepts a digital, serial data stream 8 SIGOUT O Communication Interface Output: delivers a serial data stream 9 SVDD PWR S2C Pad Power Supply: provides power to the S2C pads 10 TVSS PWR Transmitter Ground: supplies the output stage of TX1 and TX2 11 TX1 O Transmitter 1: delivers the modulated 13.56MHz energy carrier 12 TVDD PWR Transmitter Power Supply: supplies the output stage of TX1 and TX2 13 TX2 O Transmitter 2: delivers the modulated 13.56MHz energy carrier 14 TVSS PWR Transmitter Ground: supplies the output stage of TX1 and TX2 15 AVDD PWR Analog Power Supply 16 VMID PWR Internal Reference Voltage: This pin delivers the internal reference voltage. 17 RX I Receiver Input 18 AVSS PWR Analog Ground 19 AUX1 O Auxiliary Outputs: These pins are used for testing. 20 AUX2 O 21 OSCIN I Crystal Oscillator Input: input to the inverting amplifier of the oscillator. This pin is also the input for an externally generated clock (f =27.12MHz). osc 22 OSCOUT O Crystal Oscillator Output: Output of the inverting amplifier of the oscillator. 23 IRQ O Interrupt Request: output to signal an interrupt event 24 ALE I Address Latch Enable: signal to latch AD0 to AD5 into the internal address latch when HIGH. 25 to 31 D1 to D7 I/O 8-bit Bi-directional Data Bus. Remark: An 8-bit parallel interface is not available. Remark: If the host controller selects I2C as digital host controller interface, these pins can be used to define the I2C address. Remark: For serial interfaces this pins can be used for test signals or I/Os. 32 A0 I Address Line PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 10 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 4. Pin descripti on HVQFN40 Pin Symbol Type Description 1 to 4 A2 to A5 I Address Line 5 PVDD PWR Pad power supply 6 DVDD PWR Digital Power Supply 7 DVSS PWR Digital Ground 8 PVSS PWR Pad power supply ground 9 NRSTPD I Not Reset and Power Down: When LOW, internal current sinks are switched off, the oscillator is inhibited, and the input pads are disconnected from the outside world. With a positive edge on this pin the internal reset phase starts. 10 SIGIN I Communication Interface Input: accepts a digital, serial data stream 11 SIGOUT O Communication Interface Output: delivers a serial data stream 12 SVDD PWR S2C Pad Power Supply: provides power to the S2C pads 13 TVSS PWR Transmitter Ground: supplies the output stage of TX1 and TX2 14 TX1 O Transmitter 1: delivers the modulated 13.56MHz energy carrier 15 TVDD PWR Transmitter Power Supply: supplies the output stage of TX1 and TX2 16 TX2 O Transmitter 2: delivers the modulated 13.56MHz energy carrier 17 TVSS PWR Transmitter Ground: supplies the output stage of TX1 and TX2 18 AVDD PWR Analog Power Supply 19 VMID PWR Internal Reference Voltage: This pin delivers the internal reference voltage. 20 RX I Receiver Input 21 AVSS PWR Analog Ground 22 AUX1 O Auxiliary Outputs: These pins are used for testing. 23 AUX2 O 24 OSCIN I Crystal Oscillator Input: input to the inverting amplifier of the oscillator. This pin is also the input for an externally generated clock (f =27.12MHz). osc 25 OSCOUT O Crystal Oscillator Output: Output of the inverting amplifier of the oscillator. 26 IRQ O Interrupt Request: output to signal an interrupt event 27 NWR I Not Write: strobe to write data (applied on D0 to D7) into the PN512 register 28 NRD I Not Read: strobe to read data from the PN512 register (applied on D0 to D7) 29 ALE I Address Latch Enable: signal to latch AD0 to AD5 into the internal address latch when HIGH. 30 NCS I Not Chip Select: selects and activates the host controller interface of the PN512 31 to 38 D0 to D7 I/O 8-bit Bi-directional Data Bus. Remark: For serial interfaces this pins can be used for test signals or I/Os. Remark: If the host controller selects I2C as digital host controller interface, these pins can be used to define the I2C address. 39 to 40 A0 to A1 I Address Line PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 11 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 5. Pin descripti on TFBGA64 Pin Symbol Type Description A1 to A5, A8, PVSS PWR Pad power supply ground B3, B4, B8, E1 A6 D4 I/O 8-bit Bi-directional Data Bus. A7 D2 I/O Remark: For serial interfaces this pins can be used for test signals or I/Os. Remark: If the host controller selects I2C as digital host controller interface, these pins can be used to define the I2C address. B1 PVDD PWR Pad power supply B2 A0 I Address Line B5 D5 I/O 8-bit Bi-directional Data Bus. B6 D3 I/O Remark: For serial interfaces this pins can be used for test signals or I/Os. B7 D1 I/O Remark: If the host controller selects I2C as digital host controller interface, these pins can be used to define the I2C address. C1 DVDD PWR Digital Power Supply C2 A1 I Address Line C3 D7 I/O 8-bit Bi-directional Data Bus. C4 D6 I/O Remark: For serial interfaces this pins can be used for test signals or I/Os. Remark: If the host controller selects I2C as digital host controller interface, these pins can be used to define the I2C address. C5 IRQ O Interrupt Request: output to signal an interrupt event C6 ALE I Address Latch Enable: signal to latch AD0 to AD5 into the internal address latch when HIGH. C7, C8, D6, D8, AVSS PWR Analog Ground E6, E8, F7, G8, H8 D1 DVSS PWR Digital Ground D2 NRSTPD I Not Reset and Power Down: When LOW, internal current sinks are switched off, the oscillator is inhibited, and the input pads are disconnected from the outside world. With a positive edge on this pin the internal reset phase starts. D3 to D5, E3 to TVSS PWR Transmitter Ground: supplies the output stage of TX1 and TX2 E5, F3, F4, G1 to G6, H1, H2, H6 D7 OSCOUT O Crystal Oscillator Output: Output of the inverting amplifier of the oscillator. E2 SIGIN I Communication Interface Input: accepts a digital, serial data stream E7 OSCIN I Crystal Oscillator Input: input to the inverting amplifier of the oscillator. This pin is also the input for an externally generated clock (f =27.12MHz). osc F1 SVDD PWR S2C Pad Power Supply: provides power to the S2C pads F2 SIGOUT O Communication Interface Output: delivers a serial data stream F5 AUX1 O Auxiliary Outputs: These pins are used for testing. F6 AUX2 O F8 RX I Receiver Input G7 VMID PWR Internal Reference Voltage: This pin delivers the internal reference voltage. H3 TX1 O Transmitter 1: delivers the modulated 13.56MHz energy carrier PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 12 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 5. Pin description TFBGA64 Pin Symbol Type Description H4 TVDD PWR Transmitter Power Supply: supplies the output stage of TX1 and TX2 H5 TX2 O Transmitter 2: delivers the modulated 13.56MHz energy carrier H7 AVDD PWR Analog Power Supply PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 13 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 7. Functional description The PN512 transmission module supports the Read/Write mode for ISO/IEC14443A/MIFARE and ISO/IEC 14443B using various transfer speeds and modulation protocols. PN512 NFC frontendsupports the following operating modes: • Reader/Writer mode supporting ISO/IEC14443A/MIFARE and FeliCa scheme • Card Operation mode supporting ISO/IEC14443A/MIFARE and FeliCa scheme • NFCIP-1 mode The modes support different transfer speeds and modulation schemes. The following chapters will explain the different modes in detail. Note: All indicated modulation indices and modes in this chapter are system parameters. This means that beside the IC settings a suitable antenna tuning is required to achieve the optimum performance. BATTERY PN512 ISO/IEC 14443 A CARD MICROCONTROLLER contactless card reader/writer 001aan218 Fig 6. PN512 Read/Write mode 7.1 ISO/IEC 14443 A/MIFARE functionality The physical level communication is shown in Figure7. (1) ISO/IEC 14443 A READER ISO/IEC 14443 A CARD PN512 (2) 001aan219 Fig 7. ISO/IEC14443A/MIFARE Read/Write mode communication diagram The physical parameters are described in Table4. Table 6. Communication overview for ISO/IEC14443A/MIFARE reader/writer Communication Signal type Transfer speed direction 106kBd 212 kBd 424kBd Reader to card (send reader side 100 % ASK 100 % ASK 100 % ASK data from the PN512 modulation to a card) bit encoding modified Miller modified Miller modified Miller encoding encoding encoding bit length 128 (13.56 s) 64 (13.56 s) 32 (13.56s) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 14 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 6. Communication overview for ISO/IEC14443A/MIFARE reader/writer …continued Communication Signal type Transfer speed direction 106kBd 212 kBd 424kBd Cardto reader card side subcarrier load subcarrier load subcarrier load (PN512 receives data modulation modulation modulation modulation from a card) subcarrier 13.56 MHz/16 13.56 MHz/16 13.56 MHz/16 frequency bit encoding Manchester BPSK BPSK encoding The PN512’s contactless UART and dedicated external host must manage the complete ISO/IEC14443A/MIFARE protocol. Figure8 shows the data coding and framing according to ISO/IEC 14443A/MIFARE. ISO/IEC 14443 A framing at 106 kBd start 8-bit data 8-bit data 8-bit data odd odd odd start bit is 1 parity parity parity ISO/IEC 14443 A framing at 212 kBd, 424 kBd and 848 kBd even start parity 8-bit data 8-bit data 8-bit data odd odd start bit is 0 parity parity burst of 32 even parity at the subcarrier clocks end of the frame 001aak585 Fig 8. Data coding and framing according to ISO/IEC14443A The internal CRC coprocessor calculates the CRC value based on ISO/IEC14443A part3 and handles parity generation internally according to the transfer speed. Automatic parity generation can be switched off using the ManualRCVReg register’s ParityDisable bit. 7.2 ISO/IEC 14443 B functionality The PN512 reader IC fully supports international standard ISO14443 which includes communication schemes ISO14443A and ISO14443B. Refer to the ISO14443 reference documents Identification cards - Contactless integrated circuit cards - Proximity cards (parts 1 to 4). PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 15 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 7.3 FeliCa reader/writer functionality The FeliCa mode is the general reader/writer to card communication scheme according to the FeliCa specification. The following diagram describes the communication on a physical level, the communication overview describes the physical parameters. 1. PCD to PICC, 8-30 % ASK Felica READER Manchester coded, baudrate 212 to 424 kbaud FeliCa CARD (PCD) (PICC) PN512 2. PICC to PCD, > 12 % ASK loadmodulation Manchester coded, baudrate 212 to 424 kbaud 001aan214 Fig 9. FeliCa reader/writer communication diagram T able 7. Communication overview for FeliCa reader/writer Communication FeliCa FeliCa Higher direction transfer speeds Transfer speed 212 kbit/s 424 kbit/s PN512  card Modulation on reader side 8-30 % ASK 8-30 % ASK bit coding Manchester Coding Manchester Coding Bitlength (64/13.56) s (32/13.56)s cardPN512 Loadmodulation on card side > 12 % ASK > 12 % ASK bit coding Manchester coding Manchester coding The contactless UART of PN512 and a dedicated external host controller are required to handle the complete FeliCa protocol. 7.3.1 FeliCa framing and coding Table 8. FeliCa framing and coding Preamble Sync Len n-Data CRC 00h 00h 00h 00h 00h 00h B2h 4Dh To enable the FeliCa communication a 6 byte preamble (00h, 00h, 00h, 00h, 00h, 00h) and 2 bytes Sync bytes (B2h, 4Dh) are sent to synchronize the receiver. The following Len byte indicates the length of the sent data bytes plus the LEN byte itself. The CRC calculation is done according to the FeliCa definitions with the MSB first. To transmit data on the RF interface, the host controller has to send the Len- and data- bytes to the PN512's FIFO-buffer. The preamble and the sync bytes are generated by the PN512 automatically and must not be written to the FIFO by the host controller. The PN512 performs internally the CRC calculation and adds the result to the data frame. Example for FeliCa CRC Calculation: Table 9. Start value for the CRC Polynomial: (00h), (00h) Preamble Sync Len 2 Data Bytes CRC 00h 00h 00h 00h 00h 00h B2h 4Dh 03h ABh CDh 90h 35h PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 16 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 7.4 NFCIP-1 mode The NFCIP-1 communication differentiates between an active and a Passive Communication mode. • Active Communication mode means both the initiator and the target are using their own RF field to transmit data. • Passive Communication mode means that the target answers to an initiator command in a load modulation scheme. The initiator is active in terms of generating the RF field. • Initiator: generates RF field at 13.56MHz and starts the NFCIP-1 communication • Target: responds to initiator command either in a load modulation scheme in Passive Communication mode or using a self generated and self modulated RF field for Active Communication mode. In order to fully support the NFCIP-1 standard the PN512 supports the Active and Passive Communication mode at the transfer speeds 106kbit/s, 212kbit/s and 424kbit/s as defined in the NFCIP-1 standard. BATTERY MICROCONTROLLER PN512 PN512 MICROCONTROLLER BATTERY initiator: active target: 001aan215 passive or active Fig 10. NFCIP-1 mode PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 17 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 7.4.1 Active communication mode Active communication mode means both the initiator and the target are using their own RF field to transmit data. Initial command host host NFC INITIATOR NFC TARGET 1. initiator starts communication at selected transfer speed powered to powered for generate RF field digital processing response host NFC INITIATOR NFC TARGET host 2. target answers at the same transfer speed powered for digital powered to processing generate RF field 001aan216 Fig 11. Active communication mode T able 10. Communication overview for Active communication mode Communication 106kbit/s 212kbit/s 424kbit/s 848kbit/s 1.69Mbit/s, direction 3.39Mbit/s InitiatorTarget According to According to FeliCa, 8-30 % digital capability to handle ISO/IEC14443A ASK Manchester Coded this communication TargetInitiator 100 %ASK, Modified MillerCoded The contactless UART of PN512 and a dedicated host controller are required to handle the NFCIP-1 protocol. Note: Transfer Speeds above 424kbit/s are not defined in the NFCIP-1 standard. The PN512 supports these transfer speeds only with dedicated external circuits. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 18 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 7.4.2 Passive communication mode Passive Communication mode means that the target answers to an initiator command in a load modulation scheme. The initiator is active meaning generating the RF field. 1. initiator starts communication at selected transfer speed host host NFC INITIATOR NFC TARGET 2. targets answers using load modulated data powered to at the same transfer speed powered for generate RF field digital processing 001aan217 Fig 12. Passive communication mode T able 11. Communication overview for Passive communication mode Communication 106kbit/s 212kbit/s 424kbit/s 848kbit/s 1.69Mbit/s, direction 3.39Mbit/s InitiatorTarget According to According to FeliCa, 8-30 digital capability to handle ISO/IEC14443A % ASK Manchester Coded this communication 100 %ASK, Modified MillerCoded TargetInitiator According to According to FeliCa, > 12 % ISO/IEC14443A ASK Manchester Coded subcarrier load modulation, Manchester Coded The contactless UART of PN512 and a dedicated host controller are required to handle the NFCIP-1 protocol. Note: Transfer Speeds above 424kbit/s are not defined in the NFCIP-1 standard. The PN512 supports these transfer speeds only with dedicated external circuits. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 19 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 7.4.3 NFCIP-1 framing and coding The NFCIP-1 framing and coding in Active and Passive Communication mode is defined in the NFCIP-1 standard. Table 12. Framing and coding overview Transfer speed Framing and Coding 106kbit/s According to the ISO/IEC14443A/MIFARE scheme 212kbit/s According to the FeliCa scheme 424kbit/s According to the FeliCa scheme 7.4.4 NFCIP-1 protocol support The NFCIP-1 protocol is not completely described in this document. For detailed explanation of the protocol refer to the NFCIP-1 standard. However the datalink layer is according to the following policy: • Speed shall not be changed while continuum data exchange in a transaction. • Transaction includes initialization and anticollision methods and data exchange (in continuous way, meaning no interruption by another transaction). In order not to disturb current infrastructure based on 13.56MHz general rules to start NFCIP-1 communication are defined in the following way. 1. Per default NFCIP-1 device is in Target mode meaning its RF field is switched off. 2. The RF level detector is active. 3. Only if application requires the NFCIP-1 device shall switch to Initiator mode. 4. Initiator shall only switch on its RF field if no external RF field is detected by RF Level detector during a time of TIDT. 5. The initiator performs initialization according to the selected mode. 7.4.5 MIFARE Card operation mode Table 13. MIFARE Card operation mode Communication ISO/IEC14443A/ MIFARE Higher transfer speeds direction MIFARE transfer speed 106kbit/s 212kbit/s 424kbit/s reader/writer  Modulation on 100 % ASK 100 % ASK 100 % ASK PN512 reader side bit coding Modified Miller Modified Miller Modified Miller Bitlength (128/13.56) s (64/13.56) s (32/13.56)s PN512reader/ Modulation on subcarrier load subcarrier load subcarrier load writer PN512 side modulation modulation modulation subcarrier 13.56MHz/16 13.56MHz/16 13.56MHz/16 frequency bit coding Manchester coding BPSK BPSK PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 20 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 7.4.6 FeliCa Card operation mode Table 14. FeliCa Card operation mode Communication FeliCa FeliCa Higher direction transfer speeds Transfer speed 212kbit/s 424kbit/s reader/writer  Modulation on reader side 8-30 % ASK 8-30 % ASK PN512 bit coding Manchester Coding Manchester Coding Bitlength (64/13.56) s (32/13.56)s PN512reader/ Load modulation on PN512 > 12 % ASK load > 12 % ASK load writer side modulation modulation bit coding Manchester coding Manchester coding 8. PN512 register SET 8.1 PN512 registers overview Table 15. PN512 registers overview Addr Register Name Function (hex) Page 0: Command and Status 0 PageReg Selects the register page 1 CommandReg Starts and stops command execution 2 ComlEnReg Controls bits to enable and disable the passing of Interrupt Requests 3 DivlEnReg Controls bits to enable and disable the passing of Interrupt Requests 4 ComIrqReg Contains Interrupt Request bits 5 DivIrqReg Contains Interrupt Request bits 6 ErrorReg Error bits showing the error status of the last command executed 7 Status1Reg Contains status bits for communication 8 Status2Reg Contains status bits of the receiver and transmitter 9 FIFODataReg In- and output of 64byte FIFO-buffer A FIFOLevelReg Indicates the number of bytes stored in the FIFO B WaterLevelReg Defines the level for FIFO under- and overflow warning C ControlReg Contains miscellaneous Control Registers D BitFramingReg Adjustments for bit oriented frames E CollReg Bit position of the first bit collision detected on the RF-interface F RFU Reserved for future use Page 1: Command 0 PageReg Selects the register page 1 ModeReg Defines general modes for transmitting and receiving 2 TxModeReg Defines the data rate and framing during transmission 3 RxModeReg Defines the data rate and framing during receiving 4 TxControlReg Controls the logical behavior of the antenna driver pins TX1 and TX2 5 TxAutoReg Controls the setting of the antenna drivers PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 21 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 15. PN512 registers overview …continued Addr Register Name Function (hex) 6 TxSelReg Selects the internal sources for the antenna driver 7 RxSelReg Selects internal receiver settings 8 RxThresholdReg Selects thresholds for the bit decoder 9 DemodReg Defines demodulator settings A FelNFC1Reg Defines the length of the valid range for the receive package B FelNFC2Reg Defines the length of the valid range for the receive package C MifNFCReg Controls the communication in ISO/IEC14443/MIFARE and NFC target mode at 106kbit D ManualRCVReg Allows manual fine tuning of the internal receiver E TypeBReg Configure the ISO/IEC14443 type B F SerialSpeedReg Selects the speed of the serial UART interface Page 2: CFG 0 PageReg Selects the register page 1 CRCResultReg Shows the actual MSB and LSB values of the CRC calculation 2 3 GsNOffReg Selects the conductance of the antenna driver pins TX1 and TX2 for modulation, when the driver is switched off 4 ModWidthReg Controls the setting of the ModWidth 5 TxBitPhaseReg Adjust the TX bit phase at 106 kbit 6 RFCfgReg Configures the receiver gain and RF level 7 GsNOnReg Selects the conductance of the antenna driver pins TX1 and TX2 for modulation when the drivers are switched on 8 CWGsPReg Selects the conductance of the antenna driver pins TX1 and TX2 for modulation during times of no modulation 9 ModGsPReg Selects the conductance of the antenna driver pins TX1 and TX2 for modulation during modulation A TModeReg Defines settings for the internal timer TPrescalerReg B C TReloadReg Describes the 16-bit timer reload value D E TCounterValReg Shows the 16-bit actual timer value F Page 3: TestRegister 0 PageReg selects the register page 1 TestSel1Reg General test signal configuration 2 TestSel2Reg General test signal configuration and PRBS control 3 TestPinEnReg Enables pin output driver on 8-bit parallel bus (Note: For serial interfaces only) 4 TestPin Defines the values for the 8-bit parallel bus when it is used as I/O bus ValueReg 5 TestBusReg Shows the status of the internal testbus 6 AutoTestReg Controls the digital selftest PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 22 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 15. PN512 registers overview …continued Addr Register Name Function (hex) 7 VersionReg Shows the version 8 AnalogTestReg Controls the pins AUX1 and AUX2 9 TestDAC1Reg Defines the test value for the TestDAC1 A TestDAC2Reg Defines the test value for the TestDAC2 B TestADCReg Shows the actual value of ADC I and Q C-F RFT Reserved for production tests 8.1.1 Register bit behavior Depending on the functionality of a register, the access conditions to the register can vary. In principle bits with same behavior are grouped in common registers. In Table16 the access conditions are described. Table 16. Behavior of register bits and its designation Abbreviation Behavior Description r/w read and write These bits can be written and read by the -Controller. Since they are used only for control means, there content is not influenced by internal state machines, e.g. the PageSelect-Register may be written and read by the -Controller. It will also be read by internal state machines, but never changed by them. dy dynamic These bits can be written and read by the -Controller. Nevertheless, they may also be written automatically by internal state machines, e.g. the Command-Register changes its value automatically after the execution of the actual command. r read only These registers hold bits, which value is determined by internal states only, e.g. the CRCReady bit can not be written from external but shows internal states. w write only Reading these registers returns always ZERO. RFU - These registers are reserved for future use. In case of a PN512 Version version 2.0 (VersionReg = 82h) a read access to these registers returns always the value “0”. Nevertheless this is not guaranteed for future chips versions where the value is undefined. In case of a write access, it is recommended to write always the value “0”. RFT - These registers are reserved for production tests and shall not be changed. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 23 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2 Register description 8.2.1 Page 0: Command and status 8.2.1.1 PageReg Selects the register page. Table 17. PageReg register (address 00h); reset value: 00h, 0000000b 7 6 5 4 3 2 1 0 UsePage Select 0 0 0 0 0 PageSelect Access r/w RFU RFU RFU RFU RFU r/w r/w Rights Table 18. Description of PageReg bits Bit Symbol Description 7 UsePageSelect Set to logic1, the value of PageSelect is used as register address A5 and A4. The LSB-bits of the register address are defined by the address pins or the internal address latch, respectively. Set to logic0, the whole content of the internal address latch defines the register address. The address pins are used as described in Section 9.1 “Automatic microcontroller interface detection”. 6 to 2 - Reserved for future use. 1 to 0 PageSelect The value of PageSelect is used only if UsePageSelect is set to logic1. In this case it specifies the register page (which is A5 and A4 of the register address). 8.2.1.2 CommandReg Starts and stops command execution. Table 19. CommandReg register (address 01h); reset value: 20h, 00100000b 7 6 5 4 3 2 1 0 0 0 RcvOff Power Down Command Access RFU RFU r/w dy dy dy dy dy Rights Table 20. Description of CommandReg bits Bit Symbol Description 7 to 6 - Reserved for future use. 5 RcvOff Set to logic1, the analog part of the receiver is switched off. 4 PowerDown Set to logic1, Soft Power-down mode is entered. Set to logic0, the PN512 starts the wake up procedure. During this procedure this bit still shows a 1. A 0 indicates that the PN512 is ready for operations; see Section 15.2 “Soft power-down mode”. Note: The bit Power Down cannot be set, when the command SoftReset has been activated. 3 to 0 Command Activates a command according to the Command Code. Reading this register shows, which command is actually executed (see Section 18.3 “PN512 command overview”). PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 24 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.3 CommIEnReg Control bits to enable and disable the passing of interrupt requests. Table 21. CommIEnReg register (address 02h); reset value: 80h, 10000000b 7 6 5 4 3 2 1 0 IRqInv TxIEn RxIEn IdleIEn HiAlertIEn LoAlertIEn ErrIEn TimerIEn Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 22. Description of CommIEnReg bits Bit Symbol Description 7 IRqInv Set to logic1, the signal on pin IRQ is inverted with respect to bit IRq in the register Status1Reg. Set to logic0, the signal on pin IRQ is equal to bit IRq. In combination with bit IRqPushPull in register DivIEnReg, the default value of 1 ensures, that the output level on pin IRQ is 3-state. 6 TxIEn Allows the transmitter interrupt request (indicated by bit TxIRq) to be propagated to pin IRQ. 5 RxIEn Allows the receiver interrupt request (indicated by bit RxIRq) to be propagated to pin IRQ. 4 IdleIEn Allows the idle interrupt request (indicated by bit IdleIRq) to be propagated to pin IRQ. 3 HiAlertIEn Allows the high alert interrupt request (indicated by bit HiAlertIRq) to be propagated to pin IRQ. 2 LoAlertIEn Allows the low alert interrupt request (indicated by bit LoAlertIRq) to be propagated to pin IRQ. 1 ErrIEn Allows the error interrupt request (indicated by bit ErrIRq) to be propagated to pin IRQ. 0 TimerIEn Allows the timer interrupt request (indicated by bit TimerIRq) to be propagated to pin IRQ. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 25 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.4 DivIEnReg Control bits to enable and disable the passing of interrupt requests. Table 23. DivIEnReg register (address 03h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 IRQPushPull 0 0 SiginActIEn ModeIEn CRCIEn RFOnIEn RFOffIEn Access r/w RFU RFU r/w r/w r/w r/w r/w Rights T able 24. Description of DivIEnReg bits Bit Symbol Description 7 IRQPushPull Set to logic1, the pin IRQ works as standard CMOS output pad. Set to logic0, the pin IRQ works as open drain output pad. 6 to 5 - Reserved for future use. 4 SiginActIEn Allows the SIGIN active interrupt request to be propagated to pin IRQ. 3 ModeIEn Allows the mode interrupt request (indicated by bit ModeIRq) to be propagated to pin IRQ. 2 CRCIEn Allows the CRC interrupt request (indicated by bit CRCIRq) to be propagated to pin IRQ. 1 RfOnIEn Allows the RF field on interrupt request (indicated by bit RfOnIRq) to be propagated to pin IRQ. 0 RfOffIEn Allows the RF field off interrupt request (indicated by bit RfOffIRq) to be propagated to pin IRQ. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 26 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.5 CommIRqReg Contains Interrupt Request bits. Table 25. CommIRqReg register (address 04h); reset value: 14h, 00010100b 7 6 5 4 3 2 1 0 Set1 TxIRq RxIRq IdleIRq HiAlertIRq LoAlertIRq ErrIRq TimerIRq Access w dy dy dy dy dy dy dy Rights T able 26. Description of CommIRqReg bits All bits in the register CommIRqReg shall be cleared by software. Bit Symbol Description 7 Set1 Set to logic1, Set1 defines that the marked bits in the register CommIRqReg are set. Set to logic0, Set1 defines, that the marked bits in the register CommIRqReg are cleared. 6 TxIRq Set to logic1 immediately after the last bit of the transmitted data was sent out. 5 RxIRq Set to logic1 when the receiver detects the end of a valid datastream. If the bit RxNoErr in register RxModeReg is set to logic1, bit RxIRq is only set to logic1 when data bytes are available in the FIFO. 4 IdleIRq Set to logic1, when a command terminates by itself e.g. when the CommandReg changes its value from any command to the Idle Command. If an unknown command is started, the CommandReg changes its content to the idle state and the bit IdleIRq is set. Starting the Idle Command by the -Controller does not set bit IdleIRq. 3 HiAlertIRq Set to logic1, when bit HiAlert in register Status1Reg is set. In opposition to HiAlert, HiAlertIRq stores this event and can only be reset as indicated by bit Set1. 2 LoAlertIRq Set to logic1, when bit LoAlert in register Status1Reg is set. In opposition to LoAlert, LoAlertIRq stores this event and can only be reset as indicated by bit Set1. 1 ErrIRq Set to logic1 if any error bit in the Error Register is set. 0 TimerIRq Set to logic1 when the timer decrements the TimerValue Register to zero. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 27 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.6 DivIRqReg Contains Interrupt Request bits Table 27. DivIRqReg register (address 05h); reset value: XXh, 000X00XXb 7 6 5 4 3 2 1 0 Set2 0 0 SiginActIRq ModeIRq CRCIRq RFOnIRq RFOffIRq Access w RFU RFU dy dy dy dy dy Rights T able 28. Description of DivIRqReg bits All bits in the register DivIRqReg shall be cleared by software. Bit Symbol Description 7 Set2 Set to logic1, Set2 defines that the marked bits in the register DivIRqReg are set. Set to logic0, Set2 defines, that the marked bits in the register DivIRqReg are cleared 6 to 5 - Reserved for future use. 4 SiginActIRq Set to logic1, when SIGIN is active. See Section 11.6 “S2C interface support”. This interrupt is set when either a rising or falling signal edge is detected. 3 ModeIRq Set to logic1, when the mode has been detected by the Data mode detector. Note: The Data mode detector can only be activated by the AutoColl command and is terminated automatically having detected the Communication mode. Note: The Data mode detector is automatically restarted after each RF Reset. 2 CRCIRq Set to logic1, when the CRC command is active and all data are processed. 1 RFOnIRq Set to logic1, when an external RF field is detected. 0 RFOffIRq Set to logic1, when a present external RF field is switched off. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 28 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.7 ErrorReg Error bit register showing the error status of the last command executed. Table 29. ErrorReg register (address 06h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 WrErr TempErr RFErr BufferOvfl CollErr CRCErr ParityErr ProtocolErr Access r r r r r r r r Rights Table 30. Description of ErrorReg bits Bit Symbol Description 7 WrErr Set to logic1, when data is written into FIFO by the host controller during the AutoColl command or MFAuthent command or if data is written into FIFO by the host controller during the time between sending the last bit on the RF interface and receiving the last bit on the RF interface. 6 TempErr[1] Set to logic1, if the internal temperature sensor detects overheating. In this case, the antenna drivers are switched off automatically. 5 RFErr Set to logic1, if in Active Communication mode the counterpart does not switch on the RF field in time as defined in NFCIP-1 standard. Note: RFErr is only used in Active Communication mode. The bits RxFraming or the bits TxFraming has to be set to 01 to enable this functionality. 4 BufferOvfl Set to logic1, if the host controller or a PN512’s internal state machine (e.g. receiver) tries to write data into the FIFO-bufferFIFO-buffer although the FIFO-buffer is already full. 3 CollErr Set to logic1, if a bit-collision is detected. It is cleared automatically at receiver start-up phase. This bit is only valid during the bitwise anticollision at 106kbit. During communication schemes at 212 and 424kbit this bit is always set to logic1. 2 CRCErr Set to logic1, if bit RxCRCEn in register RxModeReg is set and the CRC calculation fails. It is cleared to 0 automatically at receiver start-up phase. 1 ParityErr Set to logic1, if the parity check has failed. It is cleared automatically at receiver start-up phase. Only valid for ISO/IEC14443A/MIFARE or NFCIP-1 communication at 106kbit. 0 ProtocolErr Set to logic1, if one out of the following cases occur: • Set to logic1 if the SOF is incorrect. It is cleared automatically at receiver start-up phase. The bit is only valid for 106kbit in Active and Passive Communication mode. • If bit DetectSync in register ModeReg is set to logic1 during FeliCa communication or active communication with transfer speeds higher than 106kbit, the bit ProtocolErr is set to logic1 in case of a byte length violation. • During the AutoColl command, bit ProtocolErr is set to logic1, if the bit Initiator in register ControlReg is set to logic1. • During the MFAuthent Command, bit ProtocolErr is set to logic1, if the number of bytes received in one data stream is incorrect. • Set to logic1, if the Miller Decoder detects 2pulses below the minimum time according to the ISO/IEC14443A definitions. [1] Command execution will clear all error bits except for bit TempErr. A setting by software is impossible. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 29 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.8 Status1Reg Contains status bits of the CRC, Interrupt and FIFO-buffer. Table 31. Status1Reg register (address 07h); reset value: XXh, X100X01Xb 7 6 5 4 3 2 1 0 RFFreqOK CRCOk CRCReady IRq TRunning RFOn HiAlert LoAlert Access r r r r r r r r Rights T able 32. Description of Status1Reg bits Bit Symbol Description 7 RFFreqOK Indicates if the frequency detected at the RX pin is in the range of 13.56MHz. Set to logic1, if the frequency at the RX pin is in the range 12MHz<RX pin frequency < 15MHz. Note: The value of RFFreqOK is not defined if the external RF frequency is in the range from 9to12MHz or in the range from 15to19MHz. 6 CRCOk Set to logic1, if the CRC Result is zero. For data transmission and reception the bit CRCOk is undefined (use CRCErr in register ErrorReg). CRCOk indicates the status of the CRC co-processor, during calculation the value changes to ZERO, when the calculation is done correctly, the value changes to ONE. 5 CRCReady Set to logic1, when the CRC calculation has finished. This bit is only valid for the CRC co-processor calculation using the command CalcCRC. 4 IRq This bit shows, if any interrupt source requests attention (with respect to the setting of the interrupt enable bits, see register CommIEnReg and DivIEnReg). 3 TRunning Set to logic1, if the PN512’s timer unit is running, e.g. the timer will decrement the TCounterValReg with the next timer clock. Note: In the gated mode the bit TRunning is set to logic1, when the timer is enabled by the register bits. This bit is not influenced by the gated signal. 2 RFOn Set to logic1, if an external RF field is detected. This bit does not store the state of the RF field. 1 HiAlert Set to logic1, when the number of bytes stored in the FIFO-buffer fulfills the following equation: HiAlert = 64–FIFOLengthWaterLevel Example: FIFOLength=60, WaterLevel=4HiAlert=1 FIFOLength=59, WaterLevel=4HiAlert=0 0 LoAlert Set to logic1, when the number of bytes stored in the FIFO-buffer fulfills the following equation: LoAlert = FIFOLengthWaterLevel Example: FIFOLength=4, WaterLevel=4LoAlert=1 FIFOLength=5, WaterLevel=4LoAlert=0 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 30 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.9 Status2Reg Contains status bits of the Receiver, Transmitter and Data mode detector. Table 33. Status2Reg register (address 08h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 TempSensClear I2CForceHS 0 TargetActivated MFCrypto1On Modem State Access r/w r/w RFU dy dy r r r Rights T able 34. Description of Status2Reg bits Bit Symbol Description 7 TempSensClear Set to logic1, this bit clears the temperature error, if the temperature is below the alarm limit of 125C. 6 I2CForceHS I2C input filter settings. Set to logic1, the I2C input filter is set to the High-speed mode independent of the I2C protocol. Set to logic0, the I2C input filter is set to the used I2C protocol. 5 - Reserved for future use. 4 TargetActivated Set to logic1 if the Select command or if the Polling command was answered. Note: This bit can only be set during the AutoColl command in Passive Communication mode. Note: This bit is cleared automatically by switching off the external RF field. 3 MFCrypto1On This bit indicates that the MIFARE Crypto1 unit is switched on and therefore all data communication with the card is encrypted. This bit can only be set to logic1 by a successful execution of the MFAuthent Command. This bit is only valid in Reader/Writer mode for MIFARE cards. This bit shall be cleared by software. 2 to 0 Modem State ModemState shows the state of the transmitter and receiver state machines. Value Description 000 IDLE 001 Wait for StartSend in register BitFramingReg 010 TxWait: Wait until RF field is present, if the bit TxWaitRF is set to logic1. The minimum time for TxWait is defined by the TxWaitReg register. 011 Sending 100 RxWait: Wait until RF field is present, if the bit RxWaitRF is set to logic1. The minimum time for RxWait is defined by the RxWait in the RxSelReg register. 101 Wait for data 110 Receiving PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 31 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.10 FIFODataReg In- and output of 64 byte FIFO-buffer. Table 35. FIFODataReg register (address 09h); reset value: XXh, XXXXXXXXb 7 6 5 4 3 2 1 0 FIFOData Access dy dy dy dy dy dy dy dy Rights T able 36. Description of FIFODataReg bits Bit Symbol Description 7 to 0 FIFOData Data input and output port for the internal 64byte FIFO-buffer. The FIFO-buffer acts as parallel in/parallel out converter for all serial data stream in- and outputs. 8.2.1.11 FIFOLevelReg Indicates the number of bytes stored in the FIFO. Table 37. FIFOLevelReg register (address 0Ah); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 FlushBuffer FIFOLevel Access w r r r r r r r Rights T able 38. Description of FIFOLevelReg bits Bit Symbol Description 7 FlushBuffer Set to logic1, this bit clears the internal FIFO-buffer’s read- and write-pointer and the bit BufferOvfl in the register ErrReg immediately. Reading this bit will always return 0. 6 to 0 FIFOLevel Indicates the number of bytes stored in the FIFO-buffer. Writing to the FIFODataReg increments, reading decrements the FIFOLevel. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 32 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.12 WaterLevelReg Defines the level for FIFO under- and overflow warning. Table 39. WaterLevelReg register (address 0Bh); reset value: 08h, 00001000b 7 6 5 4 3 2 1 0 0 0 WaterLevel Access RFU RFU r/w r/w r/w r/w r/w r/w Rights Table 40. Description of WaterLevelReg bits Bit Symbol Description 7 to 6 - Reserved for future use. 5 to 0 WaterLevel This register defines a warning level to indicate a FIFO-buffer over- or underflow: The bit HiAlert in Status1Reg is set to logic1, if the remaining number of bytes in the FIFO-buffer space is equal or less than the defined number of WaterLevel bytes. The bit LoAlert in Status1Reg is set to logic1, if equal or less than WaterLevel bytes are in the FIFO. Note: For the calculation of HiAlert and LoAlert see Table31 8.2.1.13 ControlReg Miscellaneous control bits. Table 41. ControlReg register (address 0Ch); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 TStopNow TStartNow WrNFCIDtoFIFO Initiator 0 RxLastBits Access w w dy r/w RFU r r r Rights Table 42. Description of ControlReg bits Bit Symbol Description 7 TStopNow Set to logic1, the timer stops immediately. Reading this bit will always return0. 6 TStartNow Set to logic1 starts the timer immediately. Reading this bit will always return0. 5 WrNFCIDtoFIFO Set to logic1, the internal stored NFCID (10bytes) is copied into the FIFO. Afterwards the bit is cleared automatically 4 Initiator Set to logic1, the PN512 acts as initiator, otherwise it acts as target 3 - Reserved for future use. 2 to 0 RxLastBits Shows the number of valid bits in the last received byte. If zero, the whole byte is valid. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 33 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.14 BitFramingReg Adjustments for bit oriented frames. Table 43. BitFramingReg register (address 0Dh); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 StartSend RxAlign 0 TxLastBits Access w r/w r/w r/w RFU r/w r/w r/w Rights T able 44. Description of BitFramingReg bits Bit Symbol Description 7 StartSend Set to logic1, the transmission of data starts. This bit is only valid in combination with the Transceive command. 6 to 4 RxAlign Used for reception of bit oriented frames: RxAlign defines the bit position for the first bit received to be stored in the FIFO. Further received bits are stored at the following bit positions. Example: RxAlign=0: the LSB of the received bit is stored at bit0, the second received bit is stored at bit position1. RxAlign=1: the LSB of the received bit is stored at bit1, the second received bit is stored at bit position2. RxAlign=7: the LSB of the received bit is stored at bit7, the second received bit is stored in the following byte at bit position0. This bit shall only be used for bitwise anticollision at 106kbit/s in Passive Communication mode. In all other modes it shall be set to logic0. 3 - Reserved for future use. 2 to 0 TxLastBits Used for transmission of bit oriented frames: TxLastBits defines the number of bits of the last byte that shall be transmitted. A000 indicates that all bits of the last byte shall be transmitted. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 34 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.1.15 CollReg Defines the first bit collision detected on the RF interface. Table 45. CollReg register (address 0Eh); reset value: XXh, 101XXXXXb 7 6 5 4 3 2 1 0 Values 0 CollPos CollPos AfterColl NotValid Access r/w RFU r r r r r r Rights T able 46. Description of CollReg bits Bit Symbol Description 7 ValuesAfterColl If this bit is set to logic0, all receiving bits will be cleared after a collision. This bit shall only be used during bitwise anticollision at 106kbit, otherwise it shall be set to logic1. 6 - Reserved for future use. 5 CollPosNotValid Set to logic1, if no Collision is detected or the Position of the Collision is out of the range of bits CollPos. This bit shall only be interpreted in Passive Communication mode at 106kbit or ISO/IEC14443A/MIFARE Reader/Writer mode. 4 to 0 CollPos These bits show the bit position of the first detected collision in a received frame, only data bits are interpreted. Example: 00h indicates a bit collision in the 32th bit 01h indicates a bit collision in the 1stbit 08h indicates a bit collision in the 8thbit These bits shall only be interpreted in Passive Communication mode at 106kbit or ISO/IEC14443A/MIFARE Reader/Writer mode if bit CollPosNotValid is set to logic0. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 35 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2 Page 1: Communication 8.2.2.1 PageReg Selects the register page. Table 47. PageReg register (address 10h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 UsePage Select 0 0 0 0 0 PageSelect Access r/w RFU RFU RFU RFU RFU r/w r/w Rights T able 48. Description of PageReg bits Bit Symbol Description 7 UsePage Select Set to logic1, the value of PageSelect is used as register address A5 and A4. The LSB-bits of the register address are defined by the address pins or the internal address latch, respectively. Set to logic0, the whole content of the internal address latch defines the register address. The address pins are used as described in Section 9.1 “Automatic microcontroller interface detection”. 6 to 2 - Reserved for future use. 1 to 0 PageSelect The value of PageSelect is used only, if UsePageSelect is set to logic1. In this case it specifies the register page (which is A5 and A4 of the register address). PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 36 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.2 ModeReg Defines general mode settings for transmitting and receiving. Table 49. ModeReg register (address 11h); reset value: 3Bh, 00111011b 7 6 5 4 3 2 1 0 MSBFirst Detect Sync TxWaitRF RxWaitRF PolSigin ModeDetOff CRCPreset Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 50. Description of ModeReg bits Bit Symbol Description 7 MSBFirst Set to logic1, the CRC co-processor calculates the CRC with MSB first and the CRCResultMSB and the CRCResultLSB in the CRCResultReg register are bit reversed. Note: During RF communication this bit is ignored. 6 Detect Sync If set to logic1, the contactless UART waits for the value F0h before the receiver is activated and F0h is added as a Sync-byte for transmission. This bit is only valid for 106kbit during NFCIP-1 data exchange protocol. In all other modes it shall be set to logic0. 5 TxWaitRF Set to logic1 the transmitter in reader/writer or initiator mode for NFCIP-1 can only be started, if an RF field is generated. 4 RxWaitRF Set to logic1, the counter for RxWait starts only if an external RF field is detected in Target mode for NFCIP-1 or in Card Communication mode. 3 PolSigin PolSigin defines the polarity of the SIGIN pin. Set to logic1, the polarity of SIGIN pin is active high. Set to logic0 the polarity of SIGIN pin is active low. Note: The internal envelope signal is coded active low. Note: Changing this bit will generate a SiginActIRq event. 2 ModeDetOff Set to logic1, the internal mode detector is switched off. Note: The mode detector is only active during the AutoColl command. 1 to 0 CRCPreset Defines the preset value for the CRC co-processor for the command CalCRC. Note: During any communication, the preset values is selected automatically according to the definition in the bits RxMode and TxMode. Value Description 00 0000 01 6363 10 A671 11 FFFF PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 37 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.3 TxModeReg Defines the data rate and framing during transmission. Table 51. TxModeReg register (address 12h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 TxCRCEn TxSpeed InvMod TxMix TxFraming Access r/w dy dy dy r/w r/w dy dy Rights T able 52. Description of TxModeReg bits Bit Symbol Description 7 TxCRCEn Set to logic1, this bit enables the CRC generation during data transmission. Note: This bit shall only be set to logic0 at 106kbit. 6 to 4 TxSpeed Defines the bit rate while data transmission. Value Description 000 106kbit 001 212kbit 010 424kbit 011 848kbit 100 1696kbit 101 3392kbit 110 Reserved 111 Reserved Note: The bit coding for transfer speeds above 424kbit is equivalent to the bit coding of Active Communication mode 424kbit (Ecma340). 3 InvMod Set to logic1, the modulation for transmitting data is inverted. 2 TxMix Set to logic1, the signal at pin SIGIN is mixed with the internal coder (see Section 11.6 “S2C interface support”). 1 to 0 TxFraming Defines the framing used for data transmission. Value Description 00 ISO/IEC14443A/MIFARE and Passive Communication mode 106kbit 01 Active Communication mode 10 FeliCa and Passive communication mode 212 and 424kbit 11 ISO/IEC14443B PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 38 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.4 RxModeReg Defines the data rate and framing during reception. Table 53. RxModeReg register (address 13h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 RxCRCEn RxSpeed RxNoErr RxMultiple RxFraming Access r/w dy dy dy r/w r/w dy dy Rights T able 54. Description of RxModeReg bits Bit Symbol Description 7 RxCRCEn Set to logic1, this bit enables the CRC calculation during reception. Note: This bit shall only be set to logic0 at 106kbit. 6 to 4 RxSpeed Defines the bit rate while data transmission. The PN512’s analog part handles only transfer speeds up to 424kbit internally, the digital UART handles the higher transfer speeds as well. Value Description 000 106kbit 001 212kbit 010 424kbit 011 848kbit 100 1696kbit 101 3392kbit 110 Reserved 111 Reserved Note: The bit coding for transfer speeds above 424kbit is equivalent to the bit coding of Active Communication mode 424kbit (Ecma340). 3 RxNoErr If set to logic1 a not valid received data stream (less than 4bits received) will be ignored. The receiver will remain active. For ISO/IEC14443B also RxSOFReq logic 1 is required to ignore a non valid datastream. 2 RxMultiple Set to logic0, the receiver is deactivated after receiving a data frame. Set to logic1, it is possible to receive more than one data frame. Having set this bit, the receive and transceive commands will not terminate automatically. In this case the multiple receiving can only be deactivated by writing any command (except the Receive command) to the CommandReg register or by clearing the bit by the host controller. At the end of a received data stream an error byte is added to the FIFO. The error byte is a copy of the ErrorReg register. The behaviour for version 1.0 is described in Section 20 “Errata sheet” on page 109. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 39 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 54. Description of RxModeReg bits Bit Symbol Description 1 to 0 RxFraming Defines the expected framing for data reception. Value Description 00 ISO/IEC14443A/MIFARE and Passive Communication mode 106kbit 01 Active Communication mode 10 FeliCa and Passive Communication mode 212 and 424kbit 11 ISO/IEC14443B 8.2.2.5 TxControlReg Controls the logical behavior of the antenna driver pins Tx1 and Tx2. Table 55. TxControlReg register (address 14h); reset value: 80h, 10000000b 7 6 5 4 3 2 1 0 InvTx2RF InvTx1RF InvTx2RF InvTx1RF Tx2CW CheckRF Tx2RF Tx1RF On On Off Off En En Access r/w r/w r/w r/w r/w w r/w r/w Rights Table 56. Description of TxControlReg bits Bit Symbol Description 7 InvTx2RFOn Set to logic1, the output signal at pin TX2 will be inverted, if driver TX2 is enabled. 6 InvTx1RFOn Set to logic1, the output signal at pin TX1 will be inverted, if driver TX1 is enabled. 5 InvTx2RFOff Set to logic1, the output signal at pin TX2 will be inverted, if driver TX2 is disabled. 4 InvTx1RFOff Set to logic1, the output signal at pin TX1 will be inverted, if driver TX1 is disabled. 3 Tx2CW Set to logic1, the output signal on pin TX2 will deliver continuously the un-modulated 13.56MHz energy carrier. Set to logic0, Tx2CW is enabled to modulate the 13.56MHz energy carrier. 2 CheckRF Set to logic1, Tx2RFEn and Tx1RFEn can not be set if an external RF field is detected. Only valid when using in combination with bit Tx2RFEn or Tx1RFEn 1 Tx2RFEn Set to logic1, the output signal on pin TX2 will deliver the 13.56MHz energy carrier modulated by the transmission data. 0 Tx1RFEn Set to logic1, the output signal on pin TX1 will deliver the 13.56MHz energy carrier modulated by the transmission data. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 40 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.6 TxAutoReg Controls the settings of the antenna driver. Table 57. TxAutoReg register (address 15h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 AutoRF Force100 Auto 0 CAOn InitialRF Tx2RFAuto Tx1RFAuto OFF ASK WakeUp On En En Access r/w r/w r/w RFU r/w r/w r/w r/w Rights Table 58. Description of TxAutoReg bits Bit Symbol Description 7 AutoRFOFF Set to logic1, all active antenna drivers are switched off after the last data bit has been transmitted as defined in the NFCIP-1. 6 Force100ASK Set to logic1, Force100ASK forces a 100% ASK modulation independent of the setting in register ModGsPReg. 5 AutoWakeUp Set to logic1, the PN512 in soft Power-down mode will be started by the RF level detector. 4 - Reserved for future use. 3 CAOn Set to logic1, the collision avoidance is activated and internally the value n is set in accordance to the NFCIP-1 Standard. 2 InitialRFOn Set to logic1, the initial RF collision avoidance is performed and the bit InitialRFOn is cleared automatically, if the RF is switched on. Note: The driver, which should be switched on, has to be enabled by bit Tx2RFAutoEn or bit Tx1RFAutoEn. 1 Tx2RFAutoEn Set to logic1, the driver Tx2 is switched on after the external RF field is switched off according to the time TADT. If the bits InitialRFOn and Tx2RFAutoEn are set to logic1, Tx2 is switched on if no external RF field is detected during the time TIDT. Note: The times TADT and TIDT are defined in the NFC IP-1 standard (ISO/IEC18092). 0 Tx1RFAutoEn Set to logic1, the driver Tx1 is switched on after the external RF field is switched off according to the time TADT. If the bit InitialRFOn and Tx1RFAutoEn are set to logic1, Tx1 is switched on if no external RF field is detected during the time TIDT. Note: The times TADT and TIDT are defined in the NFC IP-1 standard (ISO/IEC18092). PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 41 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.7 TxSelReg Selects the sources for the analog part. Table 59. TxSelReg register (address 16h); reset value: 10h, 00010000b 7 6 5 4 3 2 1 0 0 0 DriverSel SigOutSel Access RFU RFU r/w r/w r/w r/w r/w r/w Rights Table 60. Description of TxSelReg bits Bit Symbol Description 7 to 6 - Reserved for future use. 5 to 4 DriverSel Selects the input of driver Tx1 and Tx2. Value Description 00 Tristate Note: In soft power down the drivers are only in Tristate mode if DriverSel is set to Tristate mode. 01 Modulation signal (envelope) from the internal coder 10 Modulation signal (envelope) from SIGIN 11 HIGH Note: The HIGH level depends on the setting of InvTx1RFOn/ InvTx1RFOff and InvTx2RFOn/InvTx2RFOff. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 42 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 60. Description of TxSelReg bits …continued Bit Symbol Description 3 to 0 SigOutSel Selects the input for the SIGOUT Pin. Value Description 0000 Tristate 0001 Low 0010 High 0011 TestBus signal as defined by bit TestBusBitSel in register TestSel1Reg. 0100 Modulation signal (envelope) from the internal coder 0101 Serial data stream to be transmitted 0110 Output signal of the receiver circuit (card modulation signal regenerated and delayed). This signal is used as data output signal for SAM interface connection using 3lines. Note: To have a valid signal the PN512 has to be set to the receiving mode by either the Transceive or Receive command. The bit RxMultiple can be used to keep the PN512 in receiving mode. Note: Do not use this setting in MIFARE mode. Manchester coding as data collisions will not be transmitted on the SIGOUT line. 0111 Serial data stream received. Note: Do not use this setting in MIFARE mode. Miller coding parameters as the bit length can vary. 1000-1011 FeliCa Sam modulation 1000RX* 1001TX 1010Demodulator comparator output 1011RFU Note: * To have a valid signal the PN512 has to be set to the receiving mode by either the Transceive or Receive command. The bit RxMultiple can be used to keep the PN512 in receiving mode. 1100-1111 MIFARE Sam modulation 1100RX* with RF carrier 1101TX with RF carrier 1110RX with RF carrier un-filtered 1111RX envelope un-filtered Note: *To have a valid signal the PN512 has to be set to the receiving mode by either the Transceive or Receive command. The bit RxMultiple can be used to keep the PN512 in receiving mode. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 43 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.8 RxSelReg Selects internal receiver settings. Table 61. RxSelReg register (address 17h); reset value: 84h, 10000100b 7 6 5 4 3 2 1 0 UartSel RxWait Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 62. Description of RxSelReg bits Bit Symbol Description 7 to 6 UartSel Selects the input of the contactless UART Value Description 00 Constant Low 01 Envelope signal at SIGIN 10 Modulation signal from the internal analog part 11 Modulation signal from SIGIN pin. Only valid for transfer speeds above 424kbit 5 to 0 RxWait After data transmission, the activation of the receiver is delayed for RxWait bit-clocks. During this ‘frame guard time’ any signal at pin RX is ignored. This parameter is ignored by the Receive command. All other commands (e.g. Transceive, Autocoll, MFAuthent) use this parameter. Depending on the mode of the PN512, the counter starts different. In Passive Communication mode the counter starts with the last modulation pulse of the transmitted data stream. In Active Communication mode the counter starts immediately after the external RF field is switched on. 8.2.2.9 RxThresholdReg Selects thresholds for the bit decoder. Table 63. RxThresholdReg register (address 18h); reset value: 84h, 10000100b 7 6 5 4 3 2 1 0 MinLevel 0 CollLevel Access r/w r/w r/w r/w RFU r/w r/w r/w Rights Table 64. Description of RxThresholdReg bits Bit Symbol Description 7 to 4 MinLevel Defines the minimum signal strength at the decoder input that shall be accepted. If the signal strength is below this level, it is not evaluated. 3 - Reserved for future use. 2 to 0 CollLevel Defines the minimum signal strength at the decoder input that has to be reached by the weaker half-bit of the Manchester-coded signal to generate a bit-collision relatively to the amplitude of the stronger half-bit. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 44 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.10 DemodReg Defines demodulator settings. Table 65. DemodReg register (address 19h); reset value: 4Dh, 01001101b 7 6 5 4 3 2 1 0 AddIQ FixIQ TPrescal TauRcv TauSync Even Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 66. Description of DemodReg bits Bit Symbol Description 7 to 6 AddIQ Defines the use of I and Q channel during reception Note: FixIQ has to be set to logic0 to enable the following settings. Value Description 00 Select the stronger channel 01 Select the stronger and freeze the selected during communication 10 combines the I and Q channel 11 Reserved 5 FixIQ If set to logic1 and the bits of AddIQ are set to X0, the reception is fixed to Ichannel. If set to logic1 and the bits of AddIQ are set to X1, the reception is fixed to Qchannel. NOTE: If SIGIN/SIGOUT is used as S2C interface FixIQ set to 1 and AddIQ set to X0 is rewired. 4 TPrescalE If set to logic 0 the following formula is used to calculate fTimer of the ven prescaler: f =13.56MHz / (2 * TPreScaler + 1). Timer If set to logic 1 the following formula is used to calculate fTimer of the prescaler: fTimer=13.56MHz / (2 * TPreScaler + 2). (Default TPrescalEven is logic 0) The behaviour for the version 1.0 is described in Section 20 “Errata sheet” on page 109. 3 to 2 TauRcv Changes the time constant of the internal during data reception. Note: If set to 00, the PLL is frozen during data reception. 1 to 0 TauSync Changes the time constant of the internal PLL during burst. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 45 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.11 FelNFC1Reg Defines the length of the FeliCa Sync bytes and the minimum length of the received packet. Table 67. FelNFC1Reg register (address 1Ah); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 FelSyncLen DataLenMin Access r/w r/w r/w r/w r/w r/w r/w r/w Rights T able 68. Description of FelNFC1Reg bits Bit Symbol Description 7 to 6 FelSyncLen Defines the length of the Sync bytes. Value Sync- bytes in hex 00 B24D 01 00B24D 10 0000B24D 11 000000B24D 5 to 0 DataLenMin These bits define the minimum length of the accepted packet length: DataLenMin * 4 data packet length This parameter is ignored at 106kbit if the bit DetectSync in register ModeReg is set to logic0. If a received data packet is shorter than the defined DataLenMin value, the data packet will be ignored. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 46 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.12 FelNFC2Reg Defines the maximum length of the received packet. Table 69. FelNFC2Reg register (address1Bh); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 WaitForSelected ShortTimeSlot DataLenMax Access r/w r/w r/w r/w r/w r/w r/w r/w Rights T able 70. Description of FelNFC2Reg bits Bit Symbol Description 7 WaitForSelected Set to logic1, the AutoColl command is only terminated automatically when: 1. A valid command has been received after performing a valid Select procedure according ISO/IEC14443A. 2. A valid command has been received after performing a valid Polling procedure according to the FeliCa specification. Note: If this bit is set, no active communication is possible. Note: Setting this bit reduces the host controller interaction in case of a communication to another device in the same RF field during Passive Communication mode. 6 ShortTimeSlot Defines the time slot length for Passive Communication mode at 424kbit. Set to logic1 a short time slot is used (half of the timeslot at 212kbit). Set to logic0 a long timeslot is used (equal to the timeslot for 212kbit). 5 to 0 DataLenMax These bits define the maximum length of the accepted packet length: DataLenMax * 4 data packet length Note: If set to logic0 the maximum data length is 256bytes. This parameter is ignored at 106kbit if the bit DetectSync in register ModeReg is set to logic0. If a received packet is larger than the defined DataLenMax value, the packet will be ignored. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 47 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.13 MifNFCReg Defines ISO/IEC14443A/MIFARE/NFC specific settings in target or Card Operating mode. Table 71. MifNFCReg register (address 1Ch); reset value: 62h, 01100010b 7 6 5 4 3 2 1 0 SensMiller TauMiller MFHalted TxWait Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 72. Description of MifNFCReg bits Bit Symbol Description 7 to 5 SensMiller These bits define the sensitivity of the Miller decoder. 4 to 3 TauMiller These bits define the time constant of the Miller decoder. 2 MFHalted Set to logic1, this bit indicates that the PN512 is set to HALT mode in Card Operation mode at 106kbit. This bit is either set by the host controller or by the internal state machine and indicates that only the code 52h is accepted as a request command. This bit is cleared automatically by a RF reset. 1 to 0 TxWait These bits define the minimum response time between receive and transmit in number of data bits + 7 data bits. The shortest possible minimum response time is 7 data bits. (TxWait=0). The minimum response time can be increased by the number of bits defined in TxWait. The longest minimum response time is 10 data bits (TxWait = 3). If a transmission of a frame is started before the minimum response time is over, the PN512 waits before transmitting the data until the minimum response time is over. If a transmission of a frame is started after the minimum response time is over, the frame is started immediately if the data bit synchronization is correct. (adjustable with TxBitPhase). PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 48 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.14 ManualRCVReg Allows manual fine tuning of the internal receiver. Remark: For standard applications it is not recommended to change this register settings. Table 73. ManualRCVReg register (address 1Dh); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 0 FastFilt Delay Parity LargeBW Manual HPFC MF_SO MF_SO Disable PLL HPCF Access RFU r/w r/w r/w r/w r/w r/w r/w Rights T able 74. Description of ManualRCVReg bits Bit Symbol Description 7 - Reserved for future use. 6 FastFilt If this bit is set to logic1, the internal filter for the Miller-Delay Circuit is MF_SO set to Fast mode. Note: This bit should only set to logic1, if Millerpulses of less than 400ns Pulse length are expected. At 106kBaud the typical value is 3us. 5 Delay MF_SO If this bit is set to logic1, the Signal at SIGOUT-pin is delayed, so that in SAM mode the Signal at SIGIN must be 128/fc faster compared to the ISO/IEC14443A, to reach the ISO/IEC14443A restrictions on the RF-Field. Note: This delay shall only be activated for setting bits SigOutSel to (1110b) or (1111b) in register TxSelReg. 4 Parity Disable If this bit is set to logic1, the generation of the Parity bit for transmission and the Parity-Check for receiving is switched off. The received Parity bit is handled like a data bit. 3 LargeBWPLL Set to logic1, the bandwidth of the internal PLL used for clock recovery is extended. 2 ManualHPCF Set to logic0, the HPCF bits are ignored and the HPCF settings are adapted automatically to the receiving mode. Set to logic1, values of HPCF are valid. 1 to 0 HPFC Selects the High Pass Corner Frequency (HPCF) of the filter in the internal receiver chain 00 For signals with frequency spectrum down to 106kHz. 01 For signals with frequency spectrum down to 212kHz. 10 For signals with frequency spectrum down to 424kHz. 11 For signals with frequency spectrum down to 848kHz PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 49 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.2.15 TypeBReg Table 75. TypeBReg register (address 1Eh); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 RxSOF RxEOF 0 EOFSOF NoTxSOF NoTxEOF TxEGT Req Req Width Access r/w r/w RFU r/w r/w r/w r/w r/w Rights T able 76. Description of TypeBReg bits Bit Symbol Description 7 RxSOFReq If this bit is set to logic 1, the SOF is required. A datastream starting without SOF is ignored. If this bit is cleared, a datastream with and without SOF is accepted. The SOF will be removed and not written into the FIFO. 6 RxEOFReq If this bit is set to logic 1, the EOF is required. A datastream ending without EOF will generate a Protocol-Error. If this bit is cleared, a datastream with and without EOF is accepted. The EOF will be removed and not written into the FIFO. For the behaviour in version 1.0, see Section 20 “Errata sheet” on page 109. 5 - Reserved for future use. 4 EOFSOFWidth If this bit is set to logic 1 and EOFSOFAdjust bit is logic 0, the SOF and EOF will have the maximum length defined in ISO/IEC14443B. If this bit is cleared and EOFSOFAdjust bit is logic 0, the SOF and EOF will have the minimum length defined in ISO/IEC14443B. If this bit is set to 1 and the EOFSOFadjust bit is logic 1 will result in SOF low = (11etu  8 cycles)/fc SOF high = (2 etu + 8 cycles)/fc EOF low = (11 etu  8 cycles)/fc If this bit is set to 0 and the EOFSOFAdjust bit is logic 1 will result in an incorrect system behavior in respect to ISO specification. For the behaviour in version 1.0, see Section 20 “Errata sheet” on page 109. 3 NoTxSOF If this bit is set to logic 1, the generation of the SOF is suppressed. 2 NoTxEOF If this bit is set to logic 1, the generation of the EOF is suppressed. 1 to 0 TxEGT These bits define the length of the EGT. Value Description 00 0 bit 01 1 bit 10 2 bits 11 3 bits 8.2.2.16 SerialSpeedReg Selects the speed of the serial UART interface. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 50 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 77. SerialSpeedReg register (address 1Fh); reset value: EBh, 11101011b 7 6 5 4 3 2 1 0 BR_T0 BR_T1 Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 78. Description of SerialSpeedReg bits Bit Symbol Description 7 to 5 BR_T0 Factor BR_T0 to adjust the transfer speed, for description see Section 9.3.2 “Selectable UART transfer speeds”. 3 to 0 BR_T1 Factor BR_T1 to adjust the transfer speed, for description see Section 9.3.2 “Selectable UART transfer speeds”. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 51 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.3 Page 2: Configuration 8.2.3.1 PageReg Selects the register page. Table 79. PageReg register (address 20h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 UsePageSelect 0 0 0 0 0 PageSelect Access Rights r/w RFU RFU RFU RFU RFU r/w r/w Table 80. Description of PageReg bits Bit Symbol Description 7 UsePageSelect Set to logic1, the value of PageSelect is used as register address A5 and A4. The LSB-bits of the register address are defined by the address pins or the internal address latch, respectively. Set to logic0, the whole content of the internal address latch defines the register address. The address pins are used as described in Section 9.1 “Automatic microcontroller interface detection”. 6 to 2 - Reserved for future use. 1 to 0 PageSelect The value of PageSelect is used only if UsePageSelect is set to logic1. In this case, it specifies the register page (which is A5 and A4of the register address). 8.2.3.2 CRCResultReg Shows the actual MSB and LSB values of the CRC calculation. Note: The CRC is split into two 8-bit register. Note: Setting the bit MSBFirst in ModeReg register reverses the bit order, the byte order is not changed. Table 81. CRCResultReg register (address 21h); reset value: FFh, 11111111b 7 6 5 4 3 2 1 0 CRCResultMSB Access Rights r r r r r r r r T able 82. Description of CRCResultReg bits Bit Symbol Description 7 to 0 CRCResultMSB This register shows the actual value of the most significant byte of the CRCResultReg register. It is valid only if bit CRCReady in register Status1Reg is set to logic1. Table 83. CRCResultReg register (address 22h); reset value: FFh, 11111111b 7 6 5 4 3 2 1 0 CRCResultLSB Access Rights r r r r r r r r PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 52 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 84. Description of CRCResultReg bits Bit Symbol Description 7 to 0 CRCResultLSB This register shows the actual value of the least significant byte of the CRCResult register. It is valid only if bit CRCReady in register Status1Reg is set to logic1. 8.2.3.3 GsNOffReg Selects the conductance for the N-driver of the antenna driver pins TX1 and TX2 when the driver is switched off. Table 85. GsNOffReg register (address 23h); reset value: 88h, 10001000b 7 6 5 4 3 2 1 0 CWGsNOff ModGsNOff Access r/w r/w r/w r/w r/w r/w r/w r/w Rights T able 86. Description of GsNOffReg bits Bit Symbol Description 7 to 4 CWGsNOff The value of this register defines the conductance of the output N-driver during times of no modulation. Note: The conductance value is binary weighted. Note: During soft Power-down mode the highest bit is forced to 1. Note: The value of the register is only used if the driver is switched off. Otherwise the bit value CWGsNOn of register GsNOnReg is used. Note: This value is used for LoadModulation. 3 to 0 ModGsNOff The value of this register defines the conductance of the output N-driver for the time of modulation. This may be used to regulate the modulation index. Note: The conductance value is binary weighted. Note: During soft Power-down mode the highest bit is forced to 1. Note: The value of the register is only used if the driver is switched off. Otherwise the bit value ModGsNOn of register GsNOnReg is used Note: This value is used for LoadModulation. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 53 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.3.4 ModWidthReg Controls the modulation width settings. Table 87. ModWidthReg register (address 24h); reset value: 26h, 00100110b 7 6 5 4 3 2 1 0 ModWidth Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 88. Description of ModWidthReg bits Bit Symbol Description 7 to 0 ModWidth These bits define the width of the Miller modulation as initiator in Active and Passive Communication mode as multiples of the carrier frequency (ModWidth + 1/fc). The maximum value is half the bit period. Acting as a target in Passive Communication mode at 106 kbit or in Card Operating mode for ISO/IEC14443A/MIFARE these bits are used to change the duty cycle of the subcarrier frequency. The resulting number of carrier periods are calculated according to the following formulas: LOW value: #clocksLOW = (ModWidth modulo 8) + 1. HIGH value: #clocksHIGH = 16-#clocksLOW. 8.2.3.5 TxBitPhaseReg Adjust the bitphase at 106 kbit during transmission. Table 89. TxBitPhaseReg register (address 25h); reset value: 87h, 10000111b 7 6 5 4 3 2 1 0 RcvClkChange TxBitPhase Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 90. Description of TxBitPhaseReg bits Bit Symbol Description 7 RcvClkChange Set to logic1, the demodulator’s clock is derived by the external RF field. 6 to 0 TxBitPhase These bits are representing the number of carrier frequency clock cycles, which are added to the waiting period before transmitting data in all communication modes. TXBitPhase is used to adjust the TX bit synchronization during passive NFCIP-1 communication mode at 106kbit and in ISO/IEC14443A/MIFARE card mode. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 54 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.3.6 RFCfgReg Configures the receiver gain and RF level detector sensitivity. Table 91. RFCfgReg register (address 26h); reset value: 48h, 01001000b 7 6 5 4 3 2 1 0 RFLevelAmp RxGain RFLevel Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 92. Description of RFCfgReg bits Bit Symbol Description 7 RFLevelAmp Set to logic1, this bit activates the RF level detectors’ amplifier. 6 to 4 RxGain This register defines the receivers signal voltage gain factor: Value Description 000 18dB 001 23dB 010 18dB 011 23dB 100 33dB 101 38dB 110 43 dB 111 48 dB 3 to 0 RFLevel Defines the sensitivity of the RF level detector, for description see Section 11.3 “RF level detector”. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 55 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.3.7 GsNOnReg Selects the conductance for the N-driver of the antenna driver pins TX1 and TX2 when the driver is switched on. Table 93. GsNOnReg register (address 27h); reset value: 88h, 10001000b 7 6 5 4 3 2 1 0 CWGsNOn ModGsNOn Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 94. Description of GsNOnReg bits Bit Symbol Description 7 to 4 CWGsNOn The value of this register defines the conductance of the output N-driver during times of no modulation. This may be used to regulate the output power and subsequently current consumption and operating distance. Note: The conductance value is binary weighted. Note: During soft Power-down mode the highest bit is forced to1. Note: This value is only used if the driver TX1 or TX2 are switched on. Otherwise the value of the bits CWGsNOff of register GsNOffReg is used. 3 to 0 ModGsNOn The value of this register defines the conductance of the output N-driver for the time of modulation. This may be used to regulate the modulation index. Note: The conductance value is binary weighted. Note: During soft Power-down mode the highest bit is forced to1. Note: This value is only used if the driver TX1 or Tx2 are switched on. Otherwise the value of the bits ModsNOff of register GsNOffReg is used. 8.2.3.8 CWGsPReg Defines the conductance of the P-driver during times of no modulation Table 95. CWGsPReg register (address 28h); reset value: 20h, 00100000b 7 6 5 4 3 2 1 0 0 0 CWGsP Access RFU RFU r/w r/w r/w r/w r/w r/w Rights Table 96. Description of CWGsPReg bits Bit Symbol Description 7 to 6 - Reserved for future use. 5 to 0 CWGsP The value of this register defines the conductance of the output P-driver. This may be used to regulate the output power and subsequently current consumption and operating distance. Note: The conductance value is binary weighted. Note: During soft Power-down mode the highest bit is forced to 1. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 56 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.3.9 ModGsPReg Defines the driver P-output conductance during modulation. Table 97. ModGsPReg register (address 29h); reset value: 20h, 00100000b 7 6 5 4 3 2 1 0 0 0 ModGsP Access RFU RFU r/w r/w r/w r/w r/w r/w Rights Table 98. Description of ModGsPReg bits Bit Symbol Description 7 to 6 - Reserved for future use. 5 to 0 ModGsP[1] The value of this register defines the conductance of the output P-driver for the time of modulation. This may be used to regulate the modulation index. Note: The conductance value is binary weighted. Note: During soft Power-down mode the highest bit is forced to1. [1] If Force100ASK is set to logic1, the value of ModGsP has no effect. 8.2.3.10 TMode Register, TPrescaler Register Defines settings for the timer. Note: The Prescaler value is split into two 8-bit registers Table 99. TModeReg register (address 2Ah); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 TAuto TGated TAutoRestart TPrescaler_Hi Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 100. Description of TModeReg bits Bit Symbol Description 7 TAuto Set to logic1, the timer starts automatically at the end of the transmission in all communication modes at all speeds or when bit InitialRFOn is set to logic 1 and the RF field is switched on. In mode MIFARE and ISO14443-B 106kbit/s the timer stops after the 5th bit (1 startbit, 4 databits) if the bit RxMultiple in the register RxModeReg is not set. In all other modes, the timer stops after the 4th bit if the bit RxMultiple the register RxModeReg is not set. If RxMultiple is set to logic1, the timer never stops. In this case the timer can be stopped by setting the bit TStopNow in register ControlReg to 1. Set to logic0 indicates, that the timer is not influenced by the protocol. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 57 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 100. Description of TModeReg bits …continued Bit Symbol Description 6 to 5 TGated The internal timer is running in gated mode. Note: In the gated mode, the bit TRunning is 1 when the timer is enabled by the register bits. This bit does not influence the gating signal. Value Description 00 Non gated mode 01 Gated by SIGIN 10 Gated by AUX1 11 Gated by A3 4 TAutoRestart Set to logic1, the timer automatically restart its count-down from TReloadValue, instead of counting down to zero. Set to logic0 the timer decrements to ZERO and the bit TimerIRq is set to logic1. 3 to 0 TPrescaler_Hi Defines higher 4 bits for TPrescaler. The following formula is used to calculate f if TPrescalEven bit in Timer Demot Reg is set to logic 0: f =13.56MHz/(2*TPreScaler+1). Timer Where TPreScaler = [TPrescaler_Hi:TPrescaler_Lo] (TPrescaler value on 12 bits) (Default TPrescalEven is logic 0) The following formula is used to calculate fTimer if TPrescalEven bit in Demot Reg is set to logic 1: f =13.56MHz/(2*TPreScaler+2). Timer For detailed description see Section 14 “Timer unit”. For the behaviour within version 1.0, see Section 20 “Errata sheet” on page 109. Table 101. TPrescalerReg register (address 2Bh); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 TPrescaler_Lo Access r/w r/w r/w r/w r/w r/w r/w r/w Rights T able 102. Description of TPrescalerReg bits Bit Symbol Description 7 to 0 TPrescaler_Lo Defines lower 8bits for TPrescaler. The following formula is used to calculate f if TPrescalEven bit in Timer Demot Reg is set to logic 0: f =13.56MHz/(2*TPreScaler+1). Timer Where TPreScaler = [TPrescaler_Hi:TPrescaler_Lo] (TPrescaler value on 12 bits) The following formula is used to calculate fTimer if TPrescalEven bit in Demot Reg is set to logic 1: f =13.56MHz/(2*TPreScaler+2). Timer Where TPreScaler = [TPrescaler_Hi:TPrescaler_Lo] (TPrescaler value on 12 bits) For detailed description see Section 14 “Timer unit”. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 58 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.3.11 TReloadReg Describes the 16-bit long timer reload value. Note: The Reload value is split into two 8-bit registers. Table 103. TReloadReg (Higher bits) register (address 2Ch); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 TReloadVal_Hi Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 104. Description of the higher TReloadReg bits Bit Symbol Description 7 to 0 TReloadVal_Hi Defines the higher 8bits for the TReloadReg. With a start event the timer loads the TReloadVal. Changing this register affects the timer only at the next start event. Table 105. TReloadReg (Lower bits) register (address 2Dh); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 TReloadVal_Lo Access r/w r/w r/w r/w r/w r/w r/w r/w Rights T able 106. Description of lower TReloadReg bits Bit Symbol Description 7 to 0 TReloadVal_Lo Defines the lower 8bits for the TReloadReg. With a start event the timer loads the TReloadVal. Changing this register affects the timer only at the next start event. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 59 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.3.12 TCounterValReg Contains the current value of the timer. Note: The Counter value is split into two 8-bit register. Table 107. TCounterValReg (Higher bits) register (address 2Eh); reset value: XXh, XXXXXXXXb 7 6 5 4 3 2 1 0 TCounterVal_Hi Access r r r r r r r r Rights Table 108. Description of the higher TCounterValReg bits Bit Symbol Description 7 to 0 TCounterVal_Hi Current value of the timer, higher 8bits. Table 109. TCounterValReg (Lower bits) register (address 2Fh); reset value: XXh, XXXXXXXXb 7 6 5 4 3 2 1 0 TCounterVal_Lo Access r r r r r r r r Rights Table 110. Description of lower TCounterValReg bits Bit Symbol Description 7 to 0 TCounterVal_Lo Current value of the timer, lower 8bits. 8.2.4 Page 3: Test 8.2.4.1 PageReg Selects the register page. Table 111. PageReg register (address 30h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 UsePageSelect 0 0 0 0 0 PageSelect Access r/w RFU RFU RFU RFU RFU r/w r/w Rights PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 60 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 112. Description of PageReg bits Bit Symbol Description 7 UsePageSelect Set to logic1, the value of PageSelect is used as register address A5 and A4. The LSB-bits of the register address are defined by the address pins or the internal address latch, respectively. Set to logic0, the whole content of the internal address latch defines the register address. The address pins are used as described in Section 9.1 “Automatic microcontroller interface detection”. 6 to 2 - Reserved for future use. 1 to 0 PageSelect The value of PageSelect is used only if UsePageSelect is set to logic1. In this case, it specifies the register page (which is A5 and A4 of the register address). PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 61 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.4.2 TestSel1Reg General test signal configuration. Table 113. TestSel1Reg register (address 31h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 - - SAMClockSel SAMClkD1 TstBusBitSel Access r/w r/w r/w r/w r/w r/w r/w r/w Rights T able 114. Description of TestSel1Reg bits Bit Symbol Description 7 to 6 - Reserved for future use. 5 to 4 SAMClockSel Defines the source for the 13.56MHz SAM clock Value Description 00 GND- Sam Clock switched off 01 clock derived by the internal oscillator 10 internal UART clock 11 clock derived by the RF field 3 SAMClkD1 Set to logic1, the SAM clock is delivered to D1. Note: Only possible if the 8bit parallel interface is not used. 2 to 0 TstBusBitSel Select the TestBus bit from the testbus to be propagated to SIGOUT. 8.2.4.3 TestSel2Reg General test signal configuration and PRBS control Table 115. TestSel2Reg register (address 32h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 TstBusFlip PRBS9 PRBS15 TestBusSel Access r/w r/w r/w r/w r/w r/w r/w r/w Rights T able 116. Description of TestSel2Reg bits Bit Symbol Description 7 TstBusFlip If set to logic1, the testbus is mapped to the parallel port by the following order: D4, D3, D2, D6, D5, D0, D1. See Section 19 “Testsignals”. 6 PRBS9 Starts and enables the PRBS9 sequence according ITU-TO150. Note: All relevant registers to transmit data have to be configured before entering PRBS9 mode. Note: The data transmission of the defined sequence is started by the send command. 5 PRBS15 Starts and enables the PRBS15 sequence according ITU-TO150. Note: All relevant registers to transmit data have to be configured before entering PRBS15 mode. Note: The data transmission of the defined sequence is started by the send command. 4 to 0 TestBusSel Selects the testbus. See Section 19 “Testsignals” PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 62 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.4.4 TestPinEnReg Enables the pin output driver on the 8-bit parallel bus. Table 117. TestPinEnReg register (address 33h); reset value: 80h, 10000000b 7 6 5 4 3 2 1 0 RS232LineEn TestPinEn Access r/w r/w r/w r/w r/w r/w r/w r/w Rights T able 118. Description of TestPinEnReg bits Bit Symbol Description 7 RS232LineEn Set to logic0, the lines MX and DTRQ for the serial UART are disabled. 6 to 0 TestPinEn Enables the pin output driver on the 8-bit parallel interface. Example: Setting bit0 to1 enables D0 Setting bit5 to1 enables D5 Note: Only valid if one of serial interfaces is used. If the SPI interface is used only D0 to D4 can be used. If the serial UART interface is used and RS232LineEn is set to logic1 only D0 to D4 can be used. 8.2.4.5 TestPinValueReg Defines the values for the 7-bit parallel port when it is used as I/O. Table 119. TestPinValueReg register (address 34h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 UseIO TestPinValue Access r/w r/w r/w r/w r/w r/w r/w r/w Rights Table 120. Description of TestPinValueReg bits Bit Symbol Description 7 UseIO Set to logic1, this bit enables the I/O functionality for the 7-bit parallel port in case one of the serial interfaces is used. The input/output behavior is defined by TestPinEn in register TestPinEnReg. The value for the output behavior is defined in the bits TestPinVal. Note: If SAMClkD1 is set to logic1, D1 can not be used as I/O. 6 to 0 TestPinValue Defines the value of the 7-bit parallel port, when it is used as I/O. Each output has to be enabled by the TestPinEn bits in register TestPinEnReg. Note: Reading the register indicates the actual status of the pins D6 - D0 if UseIO is set to logic1. If UseIO is set to logic0, the value of the register TestPinValueReg is read back. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 63 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.4.6 TestBusReg Shows the status of the internal testbus. Table 121. TestBusReg register (address 35h); reset value: XXh, XXXXXXXXb 7 6 5 4 3 2 1 0 TestBus Access Rights r r r r r r r r Table 122. Description of TestBusReg bits Bit Symbol Description 7 to 0 TestBus Shows the status of the internal testbus. The testbus is selected by the register TestSel2Reg. See Section 19 “Testsignals”. 8.2.4.7 AutoTestReg Controls the digital selftest. Table 123. AutoTestReg register (address 36h); reset value: 40h, 01000000b 7 6 5 4 3 2 1 0 0 AmpRcv EOFSO - SelfTest FAdjust Access Rights RFT r/w RFU RFU r/w r/w r/w r/w T able 124. Description of bits Bit Symbol Description 7 - Reserved for production tests. 6 AmpRcv If set to logic1, the internal signal processing in the receiver chain is performed non-linear. This increases the operating distance in communication modes at 106kbit. Note: Due to the non linearity the effect of the bits MinLevel and CollLevel in the register RxThreshholdReg are as well non linear. 5 EOFSOFAdjust If set to logic 0 and the EOFSOFwidth is set to 1 will result in the Maximum length of SOF and EOF according to ISO/IEC14443B If set to logic 0 and the EOFSOFwidth is set to 0 will result in the Minimum length of SOF and EOF according to ISO/IEC14443B If this bit is set to 1 and the EOFSOFwidth bit is logic 1 will result in SOF low = (11 etu  8 cycles)/fc SOF high = (2 etu + 8 cycles)/fc EOF low = (11 etu  8 cycles)/fc For the behaviour in version 1.0, see Section 20 “Errata sheet” on page 109. 4 - Reserved for future use. 3 to 0 SelfTest Enables the digital self test. The selftest can be started by the selftest command in the command register. The selftest is enabled by1001. Note: For default operation the selftest has to be disabled by0000. 8.2.4.8 VersionReg Shows the version. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 64 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 125. VersionReg register (address 37h); reset value: XXh, XXXXXXXXb 7 6 5 4 3 2 1 0 Version Access Rights r r r r r r r r Table 126. Description of VersionReg bits Bit Symbol Description 7 to 0 Version 80h indicates PN512 version 1.0, differences to version 2.0 are described within Section 20 “Errata sheet” on page 109. 82h indicates PN512 version 2.0, which covers also the industrial version. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 65 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.4.9 AnalogTestReg Controls the pins AUX1 and AUX2 Table 127. AnalogTestR eg register (address 38h); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 AnalogSelAux1 AnalogSelAux2 Access Rights r/w r/w r/w r/w r/w r/w r/w r/w Table 128. Description o f AnalogTestReg bits Bit Symbol Description 7 to 4 AnalogSelAux1 Controls the AUX pin. 3to 0 AnalogSelAux2 Note: All test signals are described in Section 19 “Testsignals”. Value Description 0000 Tristate 0001 Output of TestDAC1 (AUX1), output of TESTDAC2 (AUX2) Note: Current output. The use of 1k pull-down resistor on AUX is recommended. 0010 Testsignal Corr1 Note: Current output. The use of 1k pull-down resistor on AUX is recommended. 0011 Testsignal Corr2 Note: Current output. The use of 1k pull-down resistor on AUX is recommended. 0100 Testsignal MinLevel Note: Current output. The use of 1k pull-down resistor on AUX is recommended. 0101 Testsignal ADC channel I Note: Current output. The use of 1k pull-down resistor on AUX is recommended. 0110 Testsignal ADC channel Q Note: Current output. The use of 1k pull-down resistor on AUX is recommended. 0111 Testsignal ADC channel I combined with Q Note: Current output. The use of 1k pull-down resistor on AUX is recommended. 1000 Testsignal for production test Note: Current output. The use of 1k pull-down resistor on AUX is recommended. 1001 SAM clock (13.56MHz) 1010 HIGH 1011 LOW 1100 TxActive At 106kbit: HIGH during Startbit, Data bit, Parity and CRC. At212 and 424kbit: High during Preamble, Sync, Data and CRC. 1101 RxActive At 106kbit: High during databit, Parity and CRC. At 212 and 424kbit: High during data and CRC. 1110 Subcarrier detected 106kbit: not applicable 212 and 424kbit: High during last part of Preamble, Sync data and CRC 1111 TestBus-Bit as defined by the TstBusBitSel in register TestSel1Reg. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 66 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.4.10 TestDAC1Reg Defines the testvalues for TestDAC1. Table 129. TestDAC1Reg register (address 39h); reset value: XXh, 00XXXXXXb 7 6 5 4 3 2 1 0 0 0 TestDAC1 Access RFT RFU r/w r/w r/w r/w r/w r/w Rights Table 130. Description of TestDAC1Reg bits Bit Symbol Description 7 - Reserved for production tests. 6 - Reserved for future use. 5 to 0 TestDAC1 Defines the testvalue for TestDAC1. The output of the DAC1 can be switched to AUX1 by setting AnalogSelAux1 to 0001 in register AnalogTestReg. 8.2.4.11 TestDAC2Reg Defines the testvalue for TestDAC2. Table 131. TestDAC2Reg register (address 3Ah); reset value: XXh, 00XXXXXXb 7 6 5 4 3 2 1 0 0 0 TestDAC2 Access RFU RFU r/w r/w r/w r/w r/w r/w Rights Table 132. Description ofTestDAC2Reg bits Bit Symbol Description 7 to 6 - Reserved for future use. 5 to 0 TestDAC2 Defines the testvalue for TestDAC2. The output of the DAC2 can be switched to AUX2 by setting AnalogSelAux2 to 0001 in register AnalogTestReg. 8.2.4.12 TestADCReg Shows the actual value of ADCI and Qchannel. Table 133. TestADCReg register (address 3Bh); reset value: XXh, XXXXXXXXb 7 6 5 4 3 2 1 0 ADC_I ADC_Q Access Rights Table 134. Description of TestADCReg bits Bit Symbol Description 7 to 4 ADC_I Shows the actual value of ADCI channel. 3 to 0 ADC_Q Shows the actual value of ADCQ channel. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 67 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8.2.4.13 RFTReg Table 135. RFTReg register (address 3Ch); reset value: FFh, 11111111b 7 6 5 4 3 2 1 0 1 1 1 1 1 1 1 1 Access RFT RFT RFT RFT RFT RFT RFT RFT Rights Table 136. Description of RFTReg bits Bit Symbol Description 7 to 0 - Reserved for production tests. Table 137. RFTReg register (address 3Dh, 3Fh); reset value: 00h, 00000000b 7 6 5 4 3 2 1 0 0 0 0 0 0 0 0 0 Access RFT RFT RFT RFT RFT RFT RFT RFT Rights Table 138. Description of RFTReg bits Bit Symbol Description 7 to 0 - Reserved for production tests. Table 139. RFTReg register (address 3Eh); reset value: 03h, 00000011b 7 6 5 4 3 2 1 0 0 0 0 0 0 0 1 1 Access RFT RFT RFT RFT RFT RFT RFT RFT Rights Table 140. Description of RFTReg bits Bit Symbol Description 7 to 0 - Reserved for production tests. 9. Digital interfaces 9.1 Automatic microcontroller interface detection The PN512 supports direct interfacing of hosts using SPI, I2C-bus or serial UART interfaces. The PN512 resets its interface and checks the current host interface type automatically after performing a power-on or hard reset. The PN512 identifies the host interface by sensing the logic levels on the control pins after the reset phase. This is done using a combination of fixed pin connections. Table141 shows the different connection configurations. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 68 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 141. Connection protocol for detecting different interface types Pin Interface type UART (input) SPI (output) I2C-bus (I/O) SDA RX NSS SDA I2C 0 0 1 EA 0 1 EA D7 TX MISO SCL D6 MX MOSI ADR_0 D5 DTRQ SCK ADR_1 D4 - - ADR_2 D3 - - ADR_3 D2 - - ADR_4 D1 - - ADR_5 Table 142. Connection scheme for detecting the different interface types PN512 Parallel Interface Type Serial Interface Types Separated Read/Write Strobe Common Read/Write Strobe Pin Dedicated Multiplexed Dedicated Multiplexed UART SPI I2C Address Bus Address Bus Address Bus Address Bus ALE 1 ALE 1 AS RX NSS SDA A5[1] A5 0 A5 0 0 0 0 A4[1] A4 0 A4 0 0 0 0 A3[1] A3 0 A3 0 0 0 0 A2[1] A2 1 A2 1 0 0 0 A1 A1 1 A1 1 0 0 1 A0 A0 1 A0 0 0 1 EA NRD[1] NRD NRD NDS NDS 1 1 1 NWR[1] NWR NWR RD/NWR RD/NWR 1 1 1 NCS[1] NCS NCS NCS NCS NCS NCS NCS D7 D7 D7 D7 D7 TX MISO SCL D6 D6 D6 D6 D6 MX MOSI ADR_0 D5 D5 AD5 D5 AD5 DTRQ SCK ADR_1 D4 D4 AD4 D4 AD4 - - ADR_2 D3 D3 AD3 D3 AD3 - - ADR_3 D2 D2 AD2 D2 AD2 - - ADR_4 D1 D1 AD1 D1 AD1 - - ADR_5 D0 D0 AD0 D0 AD0 - - ADR_6 Remark: Overview on the pin behavior Pin behavior Input Output In/Out [1] only available in HVQFN40. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 69 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 9.2 Serial Peripheral Interface A serial peripheral interface (SPI compatible) is supported to enable high-speed communication to the host. The interface can handle data speeds up to 10 Mbit/s. When communicating with a host, the PN512 acts as a slave, receiving data from the external host for register settings, sending and receiving data relevant for RF interface communication. An interface compatible with SPI enables high-speed serial communication between the PN512 and a microcontroller. The implemented interface is in accordance with the SPI standard. The timing specification is given in Section25.1 on page117. PN512 SCK SCK MOSI MOSI MISO MISO NSS NSS 001aan220 Fig 13. SPI connection to host The PN512 acts as a slave during SPI communication. The SPI clock signal SCK must be generated by the master. Data communication from the master to the slave uses the MOSI line. The MISO line is used to send data from the PN512 to the master. Data bytes on both MOSI and MISO lines are sent with the MSB first. Data on both MOSI and MISO lines must be stable on the rising edge of the clock and can be changed on the falling edge. Data is provided by the PN512 on the falling clock edge and is stable during the rising clock edge. 9.2.1 SPI read data Reading data using SPI requires the byte order shown in Table143 to be used. It is possible to read out up to n-data bytes. The first byte sent defines both the mode and the address. Table 143. MOSI and MISO byte order Line Byte 0 Byte 1 Byte 2 To Byte n Byte n + 1 MOSI address 0 address 1 address 2 ... address n 00 MISO X[1] data 0 data 1 ... data n  1 data n [1] X = Do not care. Remark: The MSB must be sent first. 9.2.2 SPI write data To write data to the PN512 using SPI requires the byte order shown in Table144. It is possible to write up to n data bytes by only sending one address byte. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 70 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend The first send byte defines both the mode and the address byte. Table 144. MOSI and MISO byte order Line Byte 0 Byte 1 Byte 2 To Byte n Byte n + 1 MOSI address 0 data 0 data 1 ... data n  1 data n MISO X[1] X[1] X[1] ... X[1] X[1] [1] X = Do not care. Remark: The MSB must be sent first. 9.2.3 SPI address byte The address byte has to meet the following format. The MSB of the first byte defines the mode used. To read data from the PN512 the MSB is set to logic1. To write data to the PN512 the MSB must be set to logic0. Bits6 to1 define the address and the LSB is set to logic0. Table 145. Address byte 0 register; address MOSI 7 (MSB) 6 5 4 3 2 1 0 (LSB) 1 = read address 0 0 = write 9.3 UART interface 9.3.1 Connection to a host PN512 RX RX TX TX DTRQ DTRQ MX MX 001aan221 Fig 14. UART connection to microcontrollers Remark: Signals DTRQ and MX can be disabled by clearing TestPinEnReg register’s RS232LineEn bit. 9.3.2 Selectable UART transfer speeds The internal UART interface is compatible with an RS232 serial interface. The default transfer speed is 9.6kBd. To change the transfer speed, the host controller must write a value for the new transfer speed to the SerialSpeedReg register. Bits BR_T0[2:0] and BR_T1[4:0] define the factors for setting the transfer speed in the SerialSpeedReg register. The BR_T0[2:0] and BR_T1[4:0] settings are described in Table10. Examples of different transfer speeds and the relevant register settings are given in Table11. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 71 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 146. BR_T0 and BR_T1 settings BR_Tn Bit 0 Bit 1 Bit 2 Bit 3 Bit 4 Bit 5 Bit 6 Bit 7 BR_T0 factor 1 1 2 4 8 16 32 64 BR_T1 range 1 to 32 33 to 64 33 to 64 33 to 64 33 to 64 33 to 64 33 to 64 33 to 64 T able 147. Selectable UART transfer speeds Transfer speed (kBd) SerialSpeedReg value Transfer speed accuracy(%)[1] Decimal Hexadecimal 7.2 250 FAh 0.25 9.6 235 EBh 0.32 14.4 218 DAh 0.25 19.2 203 CBh 0.32 38.4 171 ABh 0.32 57.6 154 9Ah 0.25 115.2 122 7Ah 0.25 128 116 74h 0.06 230.4 90 5Ah 0.25 460.8 58 3Ah 0.25 921.6 28 1Ch 1.45 1228.8 21 15h 0.32 [1] The resulting transfer speed error is less than 1.5 % for all described transfer speeds. The selectable transfer speeds shown in Table11 are calculated according to the following equations: If BR_T0[2:0] = 0: 6 27.1210 transfer speed = -------------------------------- (1) BR_T0+1 If BR_T0[2:0] > 0:    27.12106  transfer speed = ----------------------------------- (2) ---B----R----_---T----1-----+----3---3-----  BR_T0–1  2 Remark: Transfer speeds above 1228.8kBd are not supported. 9.3.3 UART framing Table 148. UART framing Bit Length Value Start 1-bit 0 Data 8 bits data Stop 1-bit 1 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 72 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Remark: The LSB for data and address bytes must be sent first. No parity bit is used during transmission. Read data: To read data using the UART interface, the flow shown in Table149 must be used. The first byte sent defines both the mode and the address. Table 149. Read data byte order Pin Byte 0 Byte 1 RX (pin 24) address - TX (pin 31) - data 0 ADDRESS RX SA A0 A1 A2 A3 A4 A5 (1) R/W SO DATA TX SA D0 D1 D2 D3 D4 D5 D6 D7 SO MX DTRQ 001aak588 (1) Reserved. Fig 15. UART read data timing diagram Write data: To write data to the PN512 using the UART interface, the structure shown in Table150 must be used. The first byte sent defines both the mode and the address. Table 150. Write data byte order Pin Byte 0 Byte 1 RX (pin 24) address 0 data 0 TX (pin 31) - address 0 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 73 of 137

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx CP P N OMrod N512 X Pu P ANY Pct data RX ADDRESS DATA Sem UBL she SA A0 A1 A2 A3 A4 A5 (1) R/W SO SA D0 D1 D2 D3 D4 D5 D6 D7 SO ic ICet on d u c t o ADDRESS r s TX SA A0 A1 A2 A3 A4 A5 (1) R/W SO A ll inform 1113Rev. 5.2 — 16 ation provided in this docum DTMRQX 001aak589 52 June 2016 ent is subject to legal disclaim Fig 1(61.) UReAsRerTv ewd.rite daRtae mtimarinkg: Tdihaeg rdaamta byte can be sent directly after the address byte on pin RX. ers. Address byte: The address byte has to meet the following format: F u ll N F C F © NXP oru S m 74 of 137 emiconductors N.V. 2016. All rights reserved. -compliant frontend PN512

PN512 NXP Semiconductors Full NFC Forum-compliant frontend The MSB of the first byte sets the mode used. To read data from the PN512, the MSB is set to logic1. To write data to the PN512 the MSB is set to logic0. Bit6 is reserved for future use, and bits5 to0 define the address; see Table151. Table 151. Address byte 0 register; address MOSI 7 (MSB) 6 5 4 3 2 1 0 (LSB) 1 = read reserved address 0 = write 9.4 I2C Bus Interface An I2C-bus (Inter-IC) interface is supported to enable a low-cost, low pin count serial bus interface to the host. The I2C-bus interface is implemented according to NXPSemiconductors’ I2C-bus interface specification, rev. 2.1, January 2000. The interface can only act in Slave mode. Therefore the PN512 does not implement clock generation or access arbitration. PULL-UP PULL-UP PN512 NETWORK NETWORK SDA SCL MICROCONTROLLER I2C CONFIGURATION EA WIRING ADR_[5:0] 001aan222 Fig 17. I2C-bus interface The PN512 can act either as a slave receiver or slave transmitter in Standard mode, Fast mode and High-speed mode. SDA is a bidirectional line connected to a positive supply voltage using a current source or a pull-up resistor. Both SDA and SCL lines are set HIGH when data is not transmitted. The PN512 has a 3-state output stage to perform the wired-AND function. Data on the I2C-bus can be transferred at data rates of up to 100kBd in Standard mode, up to 400kBd in Fast mode or up to 3.4Mbit/s in High-speed mode. If the I2C-bus interface is selected, spike suppression is activated on lines SCL and SDA as defined in the I2C-bus interface specification. See Table171 on page117 for timing requirements. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 75 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 9.4.1 Data validity Data on the SDA line must be stable during the HIGH clock period. The HIGH or LOW state of the data line must only change when the clock signal on SCL is LOW. SDA SCL data line change stable; of data data valid allowed mbc621 Fig 18. Bit transfer on the I2C-bus 9.4.2 START and STOP conditions To manage the data transfer on the I2C-bus, unique START(S) and STOP(P) conditions are defined. • A START condition is defined with a HIGH-to-LOW transition on the SDA line while SCL is HIGH. • A STOP condition is defined with a LOW-to-HIGH transition on the SDA line while SCL is HIGH. The I2C-bus master always generates the START and STOP conditions. The bus is busy after the START condition. The bus is free again a certain time after the STOP condition. The bus stays busy if a repeated START(Sr) is generated instead of a STOP condition. The START(S) and repeated START(Sr) conditions are functionally identical. Therefore, S is used as a generic term to represent both the START (S) and repeated START (Sr) conditions. SDA SDA SCL SCL S P START condition STOP condition mbc622 Fig 19. START and STOP conditions 9.4.3 Byte format Each byte must be followed by an acknowledge bit. Data is transferred with the MSB first; see Figure22. The number of transmitted bytes during one data transfer is unrestricted but must meet the read/write cycle format. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 76 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 9.4.4 Acknowledge An acknowledge must be sent at the end of one data byte. The acknowledge-related clock pulse is generated by the master. The transmitter of data, either master or slave, releases the SDA line (HIGH) during the acknowledge clock pulse. The receiver pulls down the SDA line during the acknowledge clock pulse so that it remains stable LOW during the HIGH period of this clock pulse. The master can then generate either a STOP(P) condition to stop the transfer or a repeated START(Sr) condition to start a new transfer. A master-receiver indicates the end of data to the slave-transmitter by not generating an acknowledge on the last byte that was clocked out by the slave. The slave-transmitter releases the data line to allow the master to generate a STOP (P) or repeated START (Sr) condition. data output by transmitter not acknowledge data output by receiver acknowledge SCL from 1 2 8 9 master S clock pulse for START acknowledgement condition mbc602 Fig 20. Acknowledge on the I2C-bus P SDA MSB acknowledgement acknowledgement Sr signal from slave signal from receiver byte complete, interrupt within slave clock line held LOW while interrupts are serviced SCL S Sr or 1 2 7 8 9 1 2 3 - 8 9 or Sr P ACK ACK START or STOP or repeated START repeated START condition condition msc608 Fig 21. Data transfer on the I2C-bus PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 77 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 9.4.5 7-Bit addressing During the I2C-bus address procedure, the first byte after the START condition is used to determine which slave will be selected by the master. Several address numbers are reserved. During device configuration, the designer must ensure that collisions with these reserved addresses cannot occur. Check the I2C-bus specification for a complete list of reserved addresses. The I2C-bus address specification is dependent on the definition of pin EA. Immediately after releasing pin NRSTPD or after a power-on reset, the device defines the I2C-bus address according to pin EA. If pin EA is set LOW, the upper 4bits of the device bus address are reserved by NXPSemiconductors and set to 0101b for all PN512 devices. The remaining 3bits (ADR_0, ADR_1, ADR_2) of the slave address can be freely configured by the customer to prevent collisions with other I2C-bus devices. If pin EA is set HIGH, ADR_0 to ADR_5 can be completely specified at the external pins according to Table141 on page69. ADR_6 is always set to logic0. In both modes, the external address coding is latched immediately after releasing the reset condition. Further changes at the used pins are not taken into consideration. Depending on the external wiring, the I2C-bus address pins can be used for test signal outputs. MSB LSB bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 R/W slave address 001aak591 Fig 22. First byte following the START procedure 9.4.6 Register write access To write data from the host controller using the I2C-bus to a specific register in the PN512 the following frame format must be used. • The first byte of a frame indicates the device address according to the I2C-bus rules. • The second byte indicates the register address followed by up to n-data bytes. In one frame all data bytes are written to the same register address. This enables fast FIFO buffer access. The Read/Write (R/W) bit is set to logic0. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 78 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 9.4.7 Register read access To read out data from a specific register address in the PN512, the host controller must use the following procedure: • Firstly, a write access to the specific register address must be performed as indicated in the frame that follows • The first byte of a frame indicates the device address according to the I2C-bus rules • The second byte indicates the register address. No data bytes are added • The Read/Write bit is0 After the write access, read access can start. The host sends the device address of the PN512. In response, the PN512 sends the content of the read access register. In one frame all data bytes can be read from the same register address. This enables fast FIFO buffer access or register polling. The Read/Write (R/W) bit is set to logic1. write cycle I2C-BUS 0 S SLAVE ADDRESS (W) A 0 0 JOINER REGISTER A [0:n] DATA A [A7:A0] ADDRESS [A5:A0] [7:0] P read cycle I2C-BUS 0 S SLAVE ADDRESS (W) A 0 0 JOINER REGISTER A P [A7:A0] ADDRESS [A5:A0] optional, if the previous access was on the same register address [0:n] I2C-BUS S SLAVE ADDRESS 1 A [0:n] DATA A [A7:A0] (R) [7:0] DATA A P [7:0] sent by master S start condition A not acknowledge P stop condition W write cycle sent by slave A acknowledge R read cycle 001aak592 Fig 23. Register read and write access PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 79 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 9.4.8 High-speed mode In High-speed mode (HSmode), the device can transfer information at data rates of up to 3.4Mbit/s, while remaining fully downward-compatible with Fast or Standard mode (F/Smode) for bidirectional communication in a mixed-speed bus system. 9.4.9 High-speed transfer To achieve data rates of up to 3.4Mbit/s the following improvements have been made to I2C-bus operation. • The inputs of the device in HSmode incorporate spike suppression, a Schmitttrigger on the SDA and SCL inputs and different timing constants when compared to F/Smode • The output buffers of the device in HSmode incorporate slope control of the falling edges of the SDA and SCL signals with different fall times compared to F/Smode 9.4.10 Serial data transfer format in HS mode The HSmode serial data transfer format meets the Standard mode I2C-bus specification. HSmode can only start after all of the following conditions (all of which are in F/Smode): 1. START condition (S) 2. 8-bit master code (00001XXXb) 3. Not-acknowledge bit (A) When HSmode starts, the active master sends a repeated START condition (Sr) followed by a 7-bit slave address with a R/W bit address and receives an acknowledge bit (A) from the selected PN512. Data transfer continues in HS mode after the next repeated START (Sr), only switching back to F/S mode after a STOP condition (P). To reduce the overhead of the master code, a master links a number of HS mode transfers, separated by repeated START conditions (Sr). F/S mode HS mode (current-source for SCL HIGH enabled) F/S mode S MASTER CODE A Sr SLAVE ADDRESS R/W A DATA A/A P (n-bytes + A) HS mode continues Sr SLAVE ADDRESS 001aak749 Fig 24. I2C-bus HS mode protocol switch PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 80 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 8-bit master code 0000 1xxx A t1 S tH SDA high SCL high 1 2 to 5 6 7 8 9 F/S mode 7-bit SLA R/W A n + (8-bit data + A/A) Sr Sr P SDA high SCL high 1 2 to 5 6 7 8 9 1 2 to 5 6 7 8 9 If P then HS mode F/S mode If Sr (dotted lines) then HS mode tH tFS = Master current source pull-up msc618 = Resistor pull-up Fig 25. I2C-bus HS mode protocol frame PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 81 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 9.4.11 Switching between F/S mode and HS mode After reset and initialization, the PN512 is in Fast mode (which is in effect F/Smode as Fast mode is downward-compatible with Standard mode). The connected PN512 recognizes the “S 00001XXX A” sequence and switches its internal circuitry from the Fast mode setting to the HSmode setting. The following actions are taken: 1. Adapt the SDA and SCL input filters according to the spike suppression requirement in HSmode. 2. Adapt the slope control of the SDA output stages. It is possible for system configurations that do not have other I2C-bus devices involved in the communication to switch to HS mode permanently. This is implemented by setting Status2Reg register’s I2CForceHS bit to logic1. In permanent HS mode, the master code is not required to be sent. This is not defined in the specification and must only be used when no other devices are connected on the bus. In addition, spikes on the I2C-bus lines must be avoided because of the reduced spike suppression. 9.4.12 PN512 at lower speed modes PN512 is fully downward-compatible and can be connected to an F/Smode I2C-bus system. The device stays in F/Smode and communicates at F/Smode speeds because a master code is not transmitted in this configuration. 10. 8-bit parallel interface The PN512 supports two different types of 8-bit parallel interfaces, Intel and Motorola compatible modes. 10.1 Overview of supported host controller interfaces The PN512 supports direct interfacing to various -Controllers. The following table shows the parallel interface types supported by the PN512. Table 152. Supported interface types Supported interface types Bus Separated Address and Multiplexed Address Data Bus and Data Bus Separated Read and Write control NRD, NWR, NCS NRD, NWR, NCS, ALE Strobes (INTEL compatible) address A0 … A3 [..A5*] AD0 … AD7 data D0 … D7 AD0 … AD7 Multiplexed Read and Write control R/NW, NDS, NCS R/NW, NDS, NCS, AS Strobe (Motorola compatible) address A0 … A3 [..A5*] AD0 … AD7 data D0 … D7 AD0 … AD7 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 82 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 10.2 Separated Read/Write strobe non multiplexed address PN512 address bus PN512 ADDRESS ADDRESS NCS NCS DECODER DECODER low A5* low A4* address bus (A0...A3[A5*]) low A0...A3[A5*] A3 high A2 high data bus (D0...D7) A1 D0...D7 high A0 multiplexed address/data AD0...AD7) high D0...D7 ALE address latch enable (ALE) not data strobe (NRD) ALE NRD not read strobe (NRD) NRD not write (NWR) NWR not write (NWR) NWR remark: *depending on the package type. 001aan223 Fig 26. Connection to host controller with separated Read/Write strobes For timing requirements refer to Section 25.2 “8-bit parallel interface timing”. 10.3 Common Read/Write strobe non multiplexed address PN512 address bus PN512 ADDRESS ADDRESS NCS NCS DECODER DECODER low A5* low A4* address bus (A0...A3[A5*]) low A0...A3[A5*] A3 high A2 high Data bus (D0...D7) A1 D0...D7 low A0 multiplexed address/data AD0...AD7) high D0...D7 ALE address strobe (AS) not data strobe (NDS) ALE NRD not data strobe (NDS) NRD read not write (RD/NWR) NWR read not write (RD/NWR) NWR remark: *depending on the package type. 001aan224 Fig 27. Connection to host controller with common Read/Write strobes For timing requirements refer to Section 25.2 “8-bit parallel interface timing” PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 83 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 11. Analog interface and contactless UART 11.1 General The integrated contactless UART supports the external host online with framing and error checking of the protocol requirements up to 848kBd. An external circuit can be connected to the communication interface pins MFIN and MFOUT to modulate and demodulate the data. The contactless UART handles the protocol requirements for the communication protocols in cooperation with the host. Protocol handling generates bit and byte-oriented framing. In addition, it handles error detection such as parity and CRC, based on the various supported contactless communication protocols. Remark: The size and tuning of the antenna and the power supply voltage have an important impact on the achievable operating distance. 11.2 TX driver The signal on pins TX1 and TX2 is the 13.56MHz energy carrier modulated by an envelope signal. It can be used to drive an antenna directly using a few passive components for matching and filtering; see Section14 on page96. The signal on pins TX1 and TX2 can be configured using the TxControlReg register; see Section8.2.2.5 on page40. The modulation index can be set by adjusting the impedance of the drivers. The impedance of the p-driver can be configured using registers CWGsPReg and ModGsPReg. The impedance of the n-driver can be configured using the GsNReg register. The modulation index also depends on the antenna design and tuning. The TxModeReg and TxSelReg registers control the data rate and framing during transmission and the antenna driver setting to support the different requirements at the different modes and transfer speeds. Table 153. Register and bit settings controlling the signal on pin TX1 Bit Bit Bit Bit Envelope Pin GSPMos GSNMos Remarks Tx1RFEn Force InvTx1RFOn InvTx1RFOff TX1 100ASK 0 X[1] X[1] X[1] X[1] X[1] CWGsNOff CWGsNOff not specified if RF is switched off 1 0 0 X[1] 0 RF pMod nMod 100 % ASK: pin TX1 pulled to logic 0, 1 RF pCW nCW independent of the 0 1 X[1] 0 RF pMod nMod InvTx1RFOff bit 1 RF pCW nCW 1 1 X[1] 0 0 pMod nMod 1 RF_n pCW nCW [1] X=Do not care. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 84 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 154. Register and bit settings controlling the signal on pin TX2 Bit Bit Bit Bit Bit En- Pin GSPMos GSNMos Remarks Tx1RFEn Force Tx2CW InvTx2RFOn InvTx2RFOff velope TX2 100ASK 0 X[1] X[1] X[1] X[1] X[1] X[1] CWGsNOff CWGsNOff not specified if RF is switched off 1 0 0 0 X[1] 0 RF pMod nMod - 1 RF pCW nCW 1 X[1] 0 RF_n pMod nMod 1 RF_n pCW nCW 1 0 X[1] X[1] RF pCW nCW conductance always CW for 1 X[1] X[1] RF_n pCW nCW the Tx2CW bit 1 0 0 X[1] 0 0 pMod nMod 100 % ASK: pin TX2 pulled 1 RF pCW nCW tologic0 1 X[1] 0 0 pMod nMod (independent of 1 RF_n pCW nCW the InvTx2RFOn/In 1 0 X[1] X[1] RF pCW nCW vTx2RFOff bits) 1 X[1] X[1] RF_n pCW nCW [1] X=Do not care. The following abbreviations have been used in Table153 and Table154: • RF: 13.56MHz clock derived from 27.12MHz quartz crystal oscillator divided by2 • RF_n: inverted 13.56MHz clock • GSPMos: conductance, configuration of the PMOS array • GSNMos: conductance, configuration of the NMOS array • pCW: PMOS conductance value for continuous wave defined by the CWGsPReg register • pMod: PMOS conductance value for modulation defined by the ModGsPReg register • nCW: NMOS conductance value for continuous wave defined by the GsNReg register’s CWGsN[3:0] bits • nMod: NMOS conductance value for modulation defined by the GsNReg register’s ModGsN[3:0] bits • X = do not care. Remark: If only one driver is switched on, the values for CWGsPReg, ModGsPReg and GsNReg registers are used for both drivers. 11.3 RF level detector The RF level detector is integrated to fulfill NFCIP1 protocol requirements (e.g. RF collision avoidance). Furthermore the RF level detector can be used to wake up the PN512 and to generate an interrupt. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 85 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend The sensitivity of the RF level detector is adjustable in a 4-bit range using the bits RFLevel in register RFCfgReg. The sensitivity itself depends on the antenna configuration and tuning. Possible sensitivity levels at the RX pin are listed in the Table154. Table 155. Setting of the bits RFlevel in register RFCfgReg (RFLevel amplifier deactivated) V~Rx [Vpp] RFLevel ~2 1111 ~1.4 1110 ~0.99 1101 ~0.69 1100 ~0.49 1011 ~0.35 1010 ~0.24 1001 ~0.17 1000 ~0.12 0111 ~0.083 0110 ~0.058 0101 ~0.041 0100 ~0.029 0011 ~0.020 0010 ~0.014 0001 ~0.010 0000 To increase the sensitivity of the RF level detector an amplifier can be activated by setting the bit RFLevelAmp in register RFCfgReg to1. Remark: During soft Power-down mode the RF level detector amplifier is automatically switched off to ensure that the power consumption is less than 10Aat3V. Remark: With typical antennas lower sensitivity levels can provoke misleading results because of intrinsic noise in the environment. Note: It is recommended to use the bit RFLevelAmp only with higher RF level settings. 11.4 Data mode detector The Data mode detector gives the possibility to detect received signals according to the ISO/IEC14443A/MIFARE, FeliCa or NFCIP-1 schemes at the standard transfer speeds for 106kbit, 212kbit and 424kbit in order to prepare the internal receiver in a fast and convenient way for further data processing. The Data mode detector can only be activated by the AutoColl command. The mode detector resets, when no external RF field is detected by the RF level detector. The Data mode detector could be switched off during the AutoColl command by setting bit ModeDetOff in register ModeReg to1. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 86 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend HOST INTERFACES REGISTERS REGISTERSETTING FOR THE DETECTED MODE NFC @ 106 kbit/s NFC @ 212 kbit/s NFC @ 424 kbit/s DATA MODE DETECTOR RECEIVER I/Q DEMODULATOR PN512 RX 001aan225 Fig 28. Data mode detector PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 87 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 11.5 Serial data switch Two main blocks are implemented in the PN512. The digital block comprises the state machines, encoder/decoder logic. The analog block comprises the modulator and antenna drivers, the receiver and amplifiers. The interface between these two blocks can be configured in the way, that the interfacing signals may be routed to the pins SIGIN and SIGOUT. SIGIN is capable of processing digital NFC signals on transfer speeds above 424kbit. The SIGOUT pin can provide a digital signal that can be used with an additional external circuit to generate transfer speeds above 424kbit (including 106, 212 and 424kbit). Furthermore SIGOUT and SIGIN can be used to enable the S2C interface in the card SAM mode to emulate a card functionality with the PN512 and a secure IC. A secure IC can be the SmartMX smart card controller IC. This topology allows the analog block of the PN512 to be connected to the digital block of another device. The serial signal switch is controlled by the TxSelReg and RxSelReg registers. Figure29 shows the serial data switch for TX1 and TX2. DriverSel[1:0] 3-state 00 INTERNAL INVERT IF envelope 01 CODER InvMod = 1 10 to driver TX1 and TX2 0 = impedance = modulated 1 11 1 = impedance = CW INVERT IF MFIN PolMFin = 0 001aak593 Fig 29. Serial data switch for TX1 and TX2 11.6 S2C interface support The S2C provides the possibility to directly connect a secure IC to the PN512 in order act as a contactless smart card IC via the PN512. The interfacing signals can be routed to the pins SIGIN and SIGOUT. SIGIN can receive either a digital FeliCa or digitized ISO/IEC14443A signal sent by the secure IC. The SIGOUT pin can provide a digital signal and a clock to communicate to the secure IC. A secure IC can be the smart card IC provided by NXP Semiconductors. The PN512 has an extra supply pin (SVDD and PVSS as Ground line) for the SIGIN and SIGOUT pads. Figure31 outlines possible ways of communications via the PN512 to the secure IC. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 88 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend HOST CONTROLLER PN512 1. secure access module (SAM) mode SPI, I2C, SERIAL UART FIFO AND STATE MACHINE SIGOUT SERIAL SIGNAL SWITCH SECURE CORE IC SIGIN CONTACTLESS UART 2. contactless card mode 001aan226 Fig 30. Communication flows using the S2C interface Configured in the Secure Access Mode the host controller can directly communicate to the Secure IC via SIGIN/SIGOUT. In this mode the PN512 generates the RF clock and performs the communication on the SIGOUT line. To enable the Secure Access module mode the clock has to be derived by the internal oscillator of the PN512, see bits SAMClockSel in register TestSel1Reg. Configured in Contactless Card mode the secure IC can act as contactless smart card IC via the PN512. In this mode the signal on the SIGOUT line is provided by the external RF field of the external reader/writer. To enable the Contactless Card mode the clock derived by the external RF field has to be used. The configuration of the S2C interface differs for the FeliCa and MIFARE scheme as outlined in the following chapters. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 89 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 11.6.1 Signal shape for Felica S2C interface support The FeliCa secure IC is connected to the PN512 via the pins SIGOUT and SIGIN. The signal at SIGOUT contains the information of the 13.56MHz clock and the digitized demodulated signal. The clock and the demodulated signal is combined by using the logical function exclusive or. To ensure that this signal is free of spikes, the demodulated signal is digitally filtered first. The time delay for that digital filtering is in the range of one bit length. The demodulated signal changes only at a positive edge of the clock. The register TxSelReg controls the setting at SIGOUT. clock signal on SIGIN signal on antenna 001aan227 Fig 31. Signal shape for SIGOUT in FeliCa card SAM mode The answer of the FeliCa SAM is transferred from SIGIN directly to the antenna driver. The modulation is done according to the register settings of the antenna drivers. The clock is switched to AUX1 or AUX2 (see AnalogSelAux). Note: A HIGH signal on AUX1 and AUX2 has the same level as AVDD. A HIGH signal at SIGOUT has the same level as SVDD. Alternatively it is possible to use pin D0 as clock output if a serial interface is used. The HIGH level at D0 is the same as PVDD. clock demodulated signal signal on SIGOUT 001aan228 Fig 32. Signal shape for SIGIN in SAM mode Note: The signal on the antenna is shown in principle only. In reality the waveform is sinusoidal. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 90 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 11.6.2 Waveform shape for ISO/IEC 14443A and MIFARE S2C support The secure IC, e.g. the SmartMX is connected to the PN512 via the pins SIGOUT and SIGIN. The waveform shape at SIGOUT is a digital 13.56MHz Miller coded signal with levels between PVSS and PVDD derived out of the external 13.56MHz carrier signal in case of the Contactless Card mode or internally generated in terms of Secure Access mode. The register TxSelReg controls the setting at SIGOUT. Note: The clock settings for the Secure Access mode and the Contactless Card mode differ, refer to the description of the bits SAMClockSel in register TestSel1Reg. bit 0 1 0 0 1 value RF signal on antenna 1 signal on SIGOUT 0 001aan229 Fig 33. Signal shape for SIGOUT in MIFARE Card SAM mode The signal at SIGIN is a digital Manchester coded signal according to the requirements of the ISO/IEC14443A with the subcarrier frequency of 847.5kHz generated by the secure IC. bit value 0 1 0 0 1 signal on antenna 1 signal on SIGIN 0 001aan230 Fig 34. Signal shape for SIGIN in MIFARE Card SAM mode PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 91 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 11.7 Hardware support for FeliCa and NFC polling 11.7.1 Polling sequence functionality for initiator 1. Timer: The PN512 has a timer, which can be programmed in a way that it generates an interrupt at the end of each timeslot, or if required an interrupt is generated at the end of the last timeslot. 2. The receiver can be configured in a way to receive continuously. In this mode it can receive any number of packets. The receiver is ready to receive the next packet directly after the last packet has been received. This mode is active by setting the bit RxMultiple in register RxModeReg to 1 and has to be stopped by software. 3. The internal UART adds one byte to the end of every received packet, before it is transferred into the FIFO-buffer. This byte indicates if the received byte packet is correct (see register ErrReg). The first byte of each packet contains the length byte of the packet. 4. The length of one packet is 18 or 20bytes (+1byte Error-Info). The FIFO has a length of 64bytes. This means three packets can be stored in the FIFO at the same time. If more than three packets are expected, the host controller has to empty the FIFO, before the FIFO is filled completely. In case of a FIFO-overflow data is lost (See bit BufferOvfl in register ErrorReg). 11.7.2 Polling sequence functionality for target 1. The host controller has to configure the PN512 with the correct polling response parameters for the polling command. 2. To activate the automatic polling in Target mode, the AutoColl Command has to be activated. 3. The PN512 receives the polling command send out by an initiator and answers with the polling response. The timeslot is selected automatically (The timeslot itself is randomly generated, but in the range 0 to TSN, which is defined by the Polling command). The PN512 compares the system code, stored in byte 17 and 18 of the Config Command with the system code received by the polling command of an initiator. If the system code is equal, the PN512 answers according to the configured polling response. The system code FF (hex) acts as a wildcard for the system code bytes, i.e. a target of a system code 1234(hex) answers to the polling command with one of the following system codes 1234(hex), 12FF(hex), FF34(hex) or FFFF(hex). If the system code does not match no answer is sent back by the PN512. If a valid command is received by the PN512, which is not a Polling command, no answer is sent back and the command AutoColl is stopped. The received packet is stored in the FIFO. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 92 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 11.7.3 Additional hardware support for FeliCa and NFC Additionally to the polling sequence support for the Felica mode, the PN512 supports the check of the Len-byte. The received Len-byte in accordance to the registers FelNFC1Reg and FelNFC2Reg: DataLenMin in register FelNFC1Reg defines the minimum length of the accepted packet length. This register is six bit long. Each bit represents a length of four bytes. DataLenMax in register FelNFC2Reg defines the maximum length of the accepted package. This register is six bit long. Each bit represents a length of four bytes. If set to logic1 this limit is ignored. If the length is not in the supposed range, the packet is not transferred to the FIFO and receiving is kept active. Example 1: • DataLenMin=4 – The length shall be greater or equal16. • DataLenMax=5 – The length shall be smaller than 20. Valid area: 16, 17, 18, 19 Example 2: • DataLenMin=9 – The length shall be greater or equal36. • DataLenMax=0 – The length shall be smaller than 256. Valid area: 36to255 11.7.4 CRC coprocessor The following CRC coprocessor parameters can be configured: • The CRC preset value can be either 0000h, 6363h, A671h or FFFFh depending on the ModeReg register’s CRCPreset[1:0] bits setting • The CRC polynomial for the 16-bit CRC is fixed to x16+x12+x5+1 • The CRCResultReg register indicates the result of the CRC calculation. This register is split into two 8-bit registers representing the higher and lower bytes. • The ModeReg register’s MSBFirst bit indicates that data will be loaded with the MSB first. Table 156. CRC coprocessor parameters Parameter Value CRC register length 16-bit CRC CRC algorithm algorithm according to ISO/IEC14443A and ITU-T CRC preset value 0000h, 6363h, A671h or FFFFh depending on the setting of the ModeReg register’s CRCPreset[1:0] bits PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 93 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 12. FIFO buffer An 864 bit FIFO buffer is used in the PN512. It buffers the input and output data stream between the host and the PN512’s internal state machine. This makes it possible to manage data streams up to 64bytes long without the need to take timing constraints into account. 12.1 Accessing the FIFO buffer The FIFO buffer input and output data bus is connected to the FIFODataReg register. Writing to this register stores one byte in the FIFO buffer and increments the internal FIFO buffer write pointer. Reading from this register shows the FIFO buffer contents stored in the FIFO buffer read pointer and decrements the FIFO buffer read pointer. The distance between the write and read pointer can be obtained by reading the FIFOLevelReg register. When the microcontroller starts a command, the PN512 can, while the command is in progress, access the FIFO buffer according to that command. Only one FIFO buffer has been implemented which can be used for input and output. The microcontroller must ensure that there are not any unintentional FIFO buffer accesses. 12.2 Controlling the FIFO buffer The FIFO buffer pointers can be reset by setting FIFOLevelReg register’s FlushBuffer bit to logic1. Consequently, the FIFOLevel[6:0] bits are all set to logic0 and the ErrorReg register’s BufferOvfl bit is cleared. The bytes stored in the FIFO buffer are no longer accessible allowing the FIFO buffer to be filled with another 64 bytes. 12.3 FIFO buffer status information The host can get the following FIFO buffer status information: • Number of bytes stored in the FIFO buffer: FIFOLevelReg register’s FIFOLevel[6:0] • FIFO buffer almost full warning: Status1Reg register’s HiAlert bit • FIFO buffer almost empty warning: Status1Reg register’s LoAlert bit • FIFO buffer overflow warning: ErrorReg register’s BufferOvfl bit. The BufferOvfl bit can only be cleared by setting the FIFOLevelReg register’s FlushBuffer bit. The PN512 can generate an interrupt signal when: • ComIEnReg register’s LoAlertIEn bit is set to logic1. It activates pin IRQ when Status1Reg register’s LoAlert bit changes to logic1. • ComIEnReg register’s HiAlertIEn bit is set to logic1. It activates pin IRQ when Status1Reg register’s HiAlert bit changes to logic1. If the maximum number of WaterLevel bytes (as set in the WaterLevelReg register) or less are stored in the FIFO buffer, the HiAlert bit is set to logic1. It is generated according to Equation3: HiAlert = 64–FIFOLengthWaterLevel (3) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 94 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend If the number of WaterLevel bytes (as set in the WaterLevelReg register) or less are stored in the FIFO buffer, the LoAlert bit is set to logic1. It is generated according to Equation4: LoAlert = FIFOLengthWaterLevel (4) 13. Interrupt request system The PN512 indicates certain events by setting the Status1Reg register’s IRq bit and, if activated, by pin IRQ. The signal on pin IRQ can be used to interrupt the host using its interrupt handling capabilities. This allows the implementation of efficient host software. 13.1 Interrupt sources overview Table157 shows the available interrupt bits, the corresponding source and the condition for its activation. The ComIrqReg register’s TimerIRq interrupt bit indicates an interrupt set by the timer unit which is set when the timer decrements from 1 to 0. The ComIrqReg register’s TxIRq bit indicates that the transmitter has finished. If the state changes from sending data to transmitting the end of the frame pattern, the transmitter unit automatically sets the interrupt bit. The CRC coprocessor sets the DivIrqReg register’s CRCIRq bit after processing all the FIFO buffer data which is indicated by CRCReadybit=1. The ComIrqReg register’s RxIRq bit indicates an interrupt when the end of the received data is detected. The ComIrqReg register’s IdleIRq bit is set if a command finishes and the Command[3:0] value in the CommandReg register changes to idle (see Table158 on page101). The ComIrqReg register’s HiAlertIRq bit is set to logic1 when the Status1Reg register’s HiAlert bit is set to logic1 which means that the FIFO buffer has reached the level indicated by the WaterLevel[5:0] bits. The ComIrqReg register’s LoAlertIRq bit is set to logic1 when the Status1Reg register’s LoAlert bit is set to logic 1 which means that the FIFO buffer has reached the level indicated by the WaterLevel[5:0] bits. The ComIrqReg register’s ErrIRq bit indicates an error detected by the contactless UART during send or receive. This is indicated when any bit is set to logic1 in register ErrorReg. Table 157. Interrupt sources Interrupt flag Interrupt source Trigger action TimerIRq timer unit the timer counts from 1 to 0 TxIRq transmitter a transmitted data stream ends CRCIRq CRC coprocessor all data from the FIFO buffer has been processed RxIRq receiver a received data stream ends IdleIRq ComIrqReg register command execution finishes HiAlertIRq FIFO buffer the FIFO buffer is almost full LoAlertIRq FIFO buffer the FIFO buffer is almost empty ErrIRq contactless UART an error is detected PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 95 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 14. Timer unit A timer unit is implemented in the PN512. The external host controller may use this timer to manage timing relevant tasks. The timer unit may be used in one of the following configurations: • Time-out counter • Watch-dog counter • Stop watch • Programmable one-shot • Periodical trigger The timer unit can be used to measure the time interval between two events or to indicate that a specific event occurred after a specific time. The timer can be triggered by events which will be explained in the following, but the timer itself does not influence any internal event (e.g. A time-out during data reception does not influence the reception process automatically). Furthermore, several timer related bits are set and these bits can be used to generate an interrupt. Timer The timer has an input clock of 13.56MHz (derived from the 27.12MHz quartz). The timer consists of two stages: 1prescaler and 1counter. The prescaler is a 12-bit counter. The reload value for TPrescaler can be defined between 0 and 4095 in register TModeReg and TPrescalerReg. The reload value for the counter is defined by 16bits in a range of 0 to 65535 in the register TReloadReg. The current value of the timer is indicated by the register TCounterValReg. If the counter reaches 0 an interrupt will be generated automatically indicated by setting the TimerIRq bit in the register CommonIRqReg. If enabled, this event can be indicated on the IRQ line. The bit TimerIRq can be set and reset by the host controller. Depending on the configuration the timer will stop at 0 or restart with the value from register TReloadReg. The status of the timer is indicated by bit TRunning in register Status1Reg. The timer can be manually started by TStartNow in register ControlReg or manually stopped by TStopNow in register ControlReg. Furthermore the timer can be activated automatically by setting the bit TAuto in the register TModeReg to fulfill dedicated protocol requirements automatically. The time delay of a timer stage is the reload value +1. The definition of total time is: t = ((TPrescaler*2+1)*TReload+1)/13.56MHz or if TPrescaleEven bit is set: t = ((TPrescaler*2+2)*TReload+1)/13.56MHz Maximum time: TPrescaler=4095,TReloadVal=65535 => (2*4095 +2)*65536/13.56MHz = 39.59s Example: PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 96 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend To indicate 25us it is required to count 339clock cycles. This means the value for TPrescaler has to be set to TPrescaler=169.The timer has now an input clock of 25us. The timer can count up to 65535 timeslots of each 25s. For the behaviour in version 1.0, see Section 20 “Errata sheet” on page 109. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 97 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 15. Power reduction modes 15.1 Hard power-down Hard power-down is enabled when pin NRSTPD is LOW. This turns off all internal current sinks including the oscillator. All digital input buffers are separated from the input pins and clamped internally (except pin NRSTPD). The output pins are frozen at either a HIGH or LOW level. 15.2 Soft power-down mode Soft Power-down mode is entered immediately after the CommandReg register’s PowerDown bit is set to logic1. All internal current sinks are switched off, including the oscillator buffer. However, the digital input buffers are not separated from the input pins and keep their functionality. The digital output pins do not change their state. During soft power-down, all register values, the FIFO buffer content and the configuration keep their current contents. After setting the PowerDown bit to logic0, it takes 1024 clocks until the Soft power-down mode is exited indicated by the PowerDown bit. Setting it to logic0 does not immediately clear it. It is cleared automatically by the PN512 when Soft power-down mode is exited. Remark: If the internal oscillator is used, you must take into account that it is supplied by pin AVDD and it will take a certain time (t ) until the oscillator is stable and the clock osc cycles can be detected by the internal logic. It is recommended for the serial UART, to first send the value 55h to the PN512. The oscillator must be stable for further access to the registers. To ensure this, perform a read access to address 0 until the PN512 answers to the last read command with the register content of address 0. This indicates that the PN512 is ready. 15.3 Transmitter power-down mode The Transmitter Power-down mode switches off the internal antenna drivers thereby, turning off the RF field. Transmitter power-down mode is entered by setting either the TxControlReg register’s Tx1RFEn bit or Tx2RFEn bit to logic0. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 98 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 16. Oscillator circuitry PN512 OSCOUT OSCIN 27.12 MHz 001aan231 Fig 35. Quartz crystal connection The clock applied to the PN512 provides a time basis for the synchronous system’s encoder and decoder. The stability of the clock frequency, therefore, is an important factor for correct operation. To obtain optimum performance, clock jitter must be reduced as much as possible. This is best achieved using the internal oscillator buffer with the recommended circuitry. If an external clock source is used, the clock signal must be applied to pin OSCIN. In this case, special care must be taken with the clock duty cycle and clock jitter and the clock quality must be verified. 17. Reset and oscillator start-up time 17.1 Reset timing requirements The reset signal is filtered by a hysteresis circuit and a spike filter before it enters the digital circuit. The spike filter rejects signals shorter than 10ns. In order to perform a reset, the signal must be LOW for at least 100ns. 17.2 Oscillator start-up time If the PN512 has been set to a Power-down mode or is powered by a V supply, the DDX start-up time for the PN512 depends on the oscillator used and is shown in Figure36. The time (t ) is the start-up time of the crystal oscillator circuit. The crystal oscillator startup start-up time is defined by the crystal. The time (t ) is the internal delay time of the PN512 when the clock signal is stable before d the PN512 can be addressed. The delay time is calculated by: 1024 t = -------------- = 37.74 s (5) d 27 s The time (t ) is the sum of t and t . osc d startup PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 99 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend device activation oscillator clock stable clock ready tstartup td tosc t 001aak596 Fig 36. Oscillator start-up time 18. PN512 command set The PN512 operation is determined by a state machine capable of performing a set of commands. A command is executed by writing a command code (see Table158) to the CommandReg register. Arguments and/or data necessary to process a command are exchanged via the FIFO buffer. 18.1 General description The PN512 operation is determined by a state machine capable of performing a set of commands. A command is executed by writing a command code (see Table158) to the CommandReg register. Arguments and/or data necessary to process a command are exchanged via the FIFO buffer. 18.2 General behavior • Each command that needs a data bit stream (or data byte stream) as an input immediately processes any data in the FIFO buffer. An exception to this rule is the Transceive command. Using this command, transmission is started with the BitFramingReg register’s StartSend bit. • Each command that needs a certain number of arguments, starts processing only when it has received the correct number of arguments from the FIFO buffer. • The FIFO buffer is not automatically cleared when commands start. This makes it possible to write command arguments and/or the data bytes to the FIFO buffer and then start the command. • Each command can be interrupted by the host writing a new command code to the CommandReg register, for example, the Idle command. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 100 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 18.3 PN512 command overview Table 158. Command overview Command Command Action code Idle 0000 no action, cancels current command execution Configure 0001 Configures the PN512 for FeliCa, MIFARE and NFCIP-1 communication Generate RandomID 0010 generates a 10-byte random ID number CalcCRC 0011 activates the CRC coprocessor or performs a self test Transmit 0100 transmits data from the FIFO buffer NoCmdChange 0111 no command change, can be used to modify the CommandReg register bits without affecting the command, for example, the PowerDown bit Receive 1000 activates the receiver circuits Transceive 1100 transmits data from FIFO buffer to antenna and automatically activates the receiver after transmission AutoColl 1101 Handles FeliCa polling (Card Operation mode only) and MIFARE anticollision (Card Operation mode only) MFAuthent 1110 performs the MIFARE standard authentication as a reader SoftReset 1111 resets the PN512 18.3.1 PN512 command descriptions 18.3.1.1 Idle Places the PN512 in Idle mode. The Idle command also terminates itself. 18.3.1.2 Config command To use the automatic MIFARE Anticollision, FeliCa Polling and NFCID3 the data used for these transactions has to be stored internally. All the following data have to be written to the FIFO in this order: SENS_RES (2 bytes); in order byte 0, byte 1 NFCID1 (3 Bytes); in order byte 0, byte 1, byte 2; the first NFCID1 byte is fixed to 08h and the check byte is calculated automatically. SEL_RES (1 Byte) polling response (2 bytes (shall be 01h, FEh) + 6 bytes NFCID2 + 8 bytes Pad + 2 bytes system code) NFCID3 (1 byte) In total 25 bytes are transferred into an internal buffer. The complete NFCID3 is 10 bytes long and consists of the 3 NFCID1 bytes, the 6 NFCID2 bytes and the one NFCID3 byte which are listed above. To read out this configuration the command Config with an empty FIFO-buffer has to be started. In this case the 25 bytes are transferred from the internal buffer to the FIFO. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 101 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend The PN512 has to be configured after each power up, before using the automatic Anticollision/Polling function (AutoColl command). During a hard power down (reset pin) this configuration remains unchanged. This command terminates automatically when finished and the active command is idle. 18.3.1.3 Generate RandomID This command generates a 10-byte random number which is initially stored in the internal buffer. This then overwrites the 10bytes in the internal 25-byte buffer. This command automatically terminates when finished and the PN512 returns to Idle mode. 18.3.1.4 CalcCRC The FIFO buffer content is transferred to the CRC coprocessor and the CRC calculation is started. The calculation result is stored in the CRCResultReg register. The CRC calculation is not limited to a dedicated number of bytes. The calculation is not stopped when the FIFO buffer is empty during the data stream. The next byte written to the FIFO buffer is added to the calculation. The CRC preset value is controlled by the ModeReg register’s CRCPreset[1:0] bits. The value is loaded in to the CRC coprocessor when the command starts. This command must be terminated by writing a command to the CommandReg register, such as, the Idle command. If the AutoTestReg register’s SelfTest[3:0] bits are set correctly, the PN512 enters Self Test mode. Starting the CalcCRC command initiates a digital self test. The result of the self test is written to the FIFO buffer. 18.3.1.5 Transmit The FIFO buffer content is immediately transmitted after starting this command. Before transmitting the FIFO buffer content, all relevant registers must be set for data transmission. This command automatically terminates when the FIFO buffer is empty. It can be terminated by another command written to the CommandReg register. 18.3.1.6 NoCmdChange This command does not influence any running command in the CommandReg register. It can be used to manipulate any bit except the CommandReg register Command[3:0] bits, for example, the RcvOff bit or the PowerDown bit. 18.3.1.7 Receive The PN512 activates the receiver path and waits for a data stream to be received. The correct settings must be chosen before starting this command. This command automatically terminates when the data stream ends. This is indicated either by the end of frame pattern or by the length byte depending on the selected frame type and speed. Remark: If the RxModeReg register’s RxMultiple bit is set to logic1, the Receive command will not automatically terminate. It must be terminated by starting another command in the CommandReg register. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 102 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 18.3.1.8 Transceive This command continuously repeats the transmission of data from the FIFO buffer and the reception of data from the RF field. The first action is transmit and after transmission the command is changed to receive a data stream. Each transmit process must be started by setting the BitFramingReg register’s StartSend bit tologic1. This command must be cleared by writing any command to the CommandReg register. Remark: If the RxModeReg register’s RxMultiple bit is set to logic1, the Transceive command never leaves the receive state because this state cannot be cancelled automatically. 18.3.1.9 AutoColl This command automatically handles the MIFARE activation and the FeliCa polling in the Card Operation mode. The bit Initiator in the register ControlReg has to be set to logic 0 for correct operation. During this command also the mode detector is active if not deactivated by setting the bit ModeDetOff in the ModeReg register. After the mode detector detects a mode, all the mode dependent registers are set according to the received data. In case of no external RF field the command resets the internal state machine and returns to the initial state but it will not be terminated. When the command terminates the transceive command gets active. During protocol processing the IRQ bits are not supported. Only the last received frame will serve the IRQ’s. The treatment of the TxCRCEn and RxCRCEn bits is different to the protocol. During ISO/IEC 14443A activation the enable bits are defined by the command AutoColl. The changes cannot be observed at the register TXModeReg and RXModeReg. After the Transceive command is active, the value of the register bit is relevant. The FIFO will also receive the two CRC check bytes of the last command even if they already checked and correct, if the state machine (Anticollision and Select routine) has to not been executed and 106 kbit is detected. During Felica activation the register bit is always relevant and is not overruled by the command settings. This command can be cleared by software by writing any other command to the CommandReg register, e.g. the idle command. Writing the same content again to the CommandReg register resets the state machine. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 103 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend MODE detection RXF 00 10 raming NFCIP-1 106 kB aud NPCIP-1 > 106 kB aud ISO14443-3 FELICA J MFHalted = 1 N REQA, AC HALT AC, IDLE nAC MODEO polling, nAC, SELECT polling response REQA, SELECT, REQA, nSELECT WUPA, nSELECT, WUPA, HLTA REQA, nAC, WUPA HLTA nAC, REQA, WUPA WUPA, nSELECT, REQA, nSELECT, AC, HLTA, WUPA, HLTA, nAC, error AC, error SELECT, SELECT, nSELECT, READY* nSELECT, READY AC AC error error SELECT SELECT ACTIVE* ACTIVE HLTA next frame next frame next frame received received received TRANSCEIVE wait for transmit aaa-001826 Fig 37. Autocoll Command NFCIP-1 106 kbps Passive Communication mode: The MIFARE anticollision is finished and the command has automatically changed to Transceive. The FIFO contains the ATR_REQ frame including the start byte F0h. The bit TargetActivated in the Status2Reg register is set to logic 1. NFCIP-1 212/424 kbps Passive Communication mode: The FeliCa polling command is finished and the command has automatically changed to Transceive. The FIFO contains the ATR_REQ. The bit TargetActivated in the Status2Reg register is set to logic 1. NFCIP-1 106/212/424 kbps Active Communication mode: This command is changing the automatically to the command Transceive. The FIFO contains the ATR REQ The bit TargetActivated in the Status2Reg register is set to logic 0. For 106 kbps only, the first byte in the FIFO indicates the start byte F0h and the CRC is added to the FIFO. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 104 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend MIFARE (Card Operation mode): The MIFARE anticollision is finished and the command has automatically changed to transceive. The FIFO contains the first command after the Select. The bit TargetActivated in the Status2Reg register is set to logic 1. Felica (Card Operation mode): The FeliCa polling command is finished and the command has automatically changed to transceive. The FIFO contains the first command followed after the Poling by the FeliCa protocol. The bit TargetActivated in the Status2Reg register is set to logic 1. 18.3.1.10 MFAuthent This command manages MIFARE authentication to enable a secure communication to any MIFARE Mini, MIFARE 1K and MIFARE 4K card. The following data is written to the FIFO buffer before the command can be activated: • Authentication command code (60h, 61h) • Block address • Sector key byte0 • Sector key byte1 • Sector key byte2 • Sector key byte3 • Sector key byte4 • Sector key byte5 • Card serial number byte0 • Card serial number byte1 • Card serial number byte2 • Card serial number byte3 In total 12bytes are written to the FIFO. Remark: When the MFAuthent command is active all access to the FIFO buffer is blocked. However, if there is access to the FIFO buffer, the ErrorReg register’s WrErr bit is set. This command automatically terminates when the MIFARE card is authenticated and the Status2Reg register’s MFCrypto1On bit is set to logic1. This command does not terminate automatically if the card does not answer, so the timer must be initialized to automatic mode. In this case, in addition to the IdleIRq bit, the TimerIRq bit can be used as the termination criteria. During authentication processing, the RxIRq bit and TxIRq bit are blocked. The Crypto1On bit is only valid after termination of the MFAuthent command, either after processing the protocol or writing Idle to the CommandReg register. If an error occurs during authentication, the ErrorReg register’s ProtocolErr bit is set to logic1 and the Status2Reg register’s Crypto1On bit is set to logic0. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 105 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 18.3.1.11 SoftReset This command performs a reset of the device. The configuration data of the internal buffer remains unchanged. All registers are set to the reset values. This command automatically terminates when finished. Remark: The SerialSpeedReg register is reset and therefore the serial data rate is set to 9.6kBd. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 106 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 19. Testsignals 19.1 Selftest The PN512 has the capability to perform a digital selftest. To start the selftest the following procedure has to be performed: 1. Perform a soft reset. 2. Clear the internal buffer by writing 25bytes of 00h and perform the Config Command. 3. Enable the Selftest by writing the value 09h to the register AutoTestReg. 4. Write 00h to the FIFO. 5. Start the Selftest with the CalcCRC Command. 6. The Selftest will be performed. 7. When the Selftest is finished, the FIFO contains the following bytes: Version 1.0 has a different Selftest answer, explained in Section20. Correct answer for VersionReg equal to 82h: 00h, EBh, 66h, BAh, 57h, BFh, 23h, 95h, D0h, E3h, 0Dh, 3Dh, 27h, 89h, 5Ch, DEh, 9Dh, 3Bh, A7h, 00h, 21h, 5Bh, 89h, 82h, 51h, 3Ah, EBh, 02h, 0Ch, A5h, 00h, 49h, 7Ch, 84h, 4Dh, B3h, CCh, D2h, 1Bh, 81h, 5Dh, 48h, 76h, D5h, 71h, 61h, 21h, A9h, 86h, 96h, 83h, 38h, CFh, 9Dh, 5Bh, 6Dh, DCh, 15h, BAh, 3Eh, 7Dh, 95h, 3Bh, 2Fh 19.2 Testbus The testbus is implemented for production test purposes. The following configuration can be used to improve the design of a system using the PN512. The testbus allows to route internal signals to the digital interface. The testbus signals are selected by accessing TestBusSel in register TestSel2Reg. Table 159. Testsignal routing (TestSel2Reg = 07h) Pins D6 D5 D4 D3 D2 D1 D0 Testsignal sdata scoll svalid sover RCV_reset RFon, Envelope filtered Table 160. Description of Testsignals Pins Testsignal Description D6 sdata shows the actual received data stream. D5 scoll shows if in the actual bit a collision has been detected (106kbit only) D4 svalid shows if sdata and scoll are valid D3 sover shows that the receiver has detected a stop condition (ISO/IEC14443A/ MIFARE mode only). D2 RCV_reset shows if the receiver is reset D1 RFon, filtered shows the value of the internal RF level detector D0 Envelope shows the output of the internal coder PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 107 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 161. Testsignal routing (TestSel2Reg = 0Dh) Pins D6 D5 D4 D3 D2 D1 D0 Testsignal clkstable clk27/8 clk27rf/8 clkrf13rf/4 clk27 clk27rf clk13rf Table 162. Description of Testsignals Pins Testsignal Description D6 clkstable shows if the oscillator delivers a stable signal. D5 clk27/8 shows the output signal of the oscillator divided by8 D4 clk27rf/8 shows the clk27rf signal divided by8 D3 clkrf13/4 shows the clk13rf divided by4. D2 clk27 shows the output signal of the oscillator D1 clk27rf shows the RF clock multiplied by2. D0 clk13rf shows the RF clock of 13.56MHz Table 163. Testsignal routing (TestSel2Reg = 19h) Pins D6 D5 D4 D3 D2 D1 D0 Testsignal - TRunning - - - - - Table 164. Description of Testsignals Pins Testsignal Description D6 - - D5 TRunning TRunning stops 1 clockcycle after TimerIRQ is raised D4 - - D3 - - D2 - - D1 - - D0 - - 19.3 Testsignals at pin AUX Table 165. Testsignals description SelAux Description for Aux1 / Aux2 0000 Tristate 0001 DAC: register TestDAC 1/2 0010 DAC: testsignal corr1 0011 DAC: testsignal corr2 0100 DAC: testsignal MinLevel 0101 DAC: ADC_I 0110 DAC: ADC_Q 0111 DAC: testsignal ADC_I combined with ADC_Q 1000 Testsignal for production test 1001 SAM clock 1010 High 1011 low 1100 TxActive PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 108 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 165. Testsignals description SelAux Description for Aux1 / Aux2 1101 RxActive 1110 Subcarrier detected 1111 TstBusBit Each signal can be switched to pin AUX1 or AUX2 by setting SelAux1 or SelAux2 in the register AnalogTestReg. Note: The DAC has a current output, it is recommended to use a 1k pull-down resistance at pins AUX1/AUX2. 19.4 PRBS Enables the PRBS9 or PRBS15 sequence according to ITU-TO150. To start the transmission of the defined datastream the command send has to be activated. The preamble/Sync byte/start bit/parity bit are generated automatically depending on the selected mode. Note: All relevant register to transmit data have to be configured before entering PRBS mode according ITU-TO150. 20. Errata sheet This data sheet is describing the functionality for version 2.0 and the industrial version. This chapter lists all differences from version 1.0 to version 2.0: The value of the version in Section8.2.4.8 is set to80h. The behaviour ‘RFU’ for the register is undefined. The answer to the Selftest (see Section19.1) for version 1.0 (VersionReg equal to 80h): 00h, AAh, E3h, 29h, 0Ch, 10h, 29zhh, 6Bh, 76h, 8Dh, AFh, 4Bh, A2h, DAh, 76h, 99h C7h, 5Eh, 24h, 69h, D2h, BAh, FAh, BCh 3Eh, DAh, 96h, B5h, F5h, 94h, B0h, 3Ah 4Eh, C3h, 9Dh, 94h, 76h, 4Ch, EAh, 5Eh 38h, 10h, 8Fh, 2Dh, 21h, 4Bh, 52h, BFh 4Eh, C3h, 9Dh, 94h, 76h, 4Ch, EAh, 5Eh 38h, 10h, 8Fh, 2Dh, 21h, 4Bh, 52h, BFh FBh, F4h, 19h, 94h, 82h, 5Ah, 72h, 9Dh BAh, 0Dh, 1Fh, 17h, 56h, 22h, B9h, 08h Only the default setting for the prescaler (see Section 14 “Timer unit” on page 96): t = ((TPreScaler*2+1)*TReload+1)/13,56 MHz is supported. As such only the formula f = Timer 13,56 MHz/(2*PreScaler+1) is applicable for the TPrescalerHigh in Table 100 “Description of TModeReg bits” on page 57 and TPrescalerLo in Table 101 “TPrescalerReg register (address 2Bh); reset value: 00h, 00000000b” on page 58. As there is no option for the prescaler available, also the TPrescalEven is not available Section8.2.2.10 on page45. This bit is set to ‘RFU’. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 109 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Especially when using time slot protocols, it is needed that the error flag is copied into the status information of the frame. When using the RxMultiple feature (see Section8.2.2.4 on page39) within version 1.0 the protocol error flag is not included in the status information for the frame. In addition the CRCOk is copied instead of the CRCErr. This can be a problem in frames without length information e.g. ISO/IEC 14443-B. The version 1.0 does not accept a Type B EOF if there is no 1 bit after the series of 0 bits, as such the configuration within Section 8.2.2.15 “TypeBReg” on page 50 bit 4 for RxEOFReq does not exist. In addition the IC only has the possibility to select the minimum or maximum timings for SOF/EOF generation defined in ISO/IEC14443B. As such the configuration possible in version 2.0 through the EOFSOFAdjust bit (see Section 8.2.4.7 “AutoTestReg” on page 64) does not exist and the configuration is limited to only setting minimum and maximum length according ISO/IEC 14443-B, see Section 8.2.2.15 “TypeBReg” on page 50, bit 4. 21. Application design-in information The figure below shows a typical circuit diagram, using a complementary antenna connection to the PN512. The antenna tuning and RF part matching is described in the application note “NFC Transmission Module Antenna and RF Design Guide”. supply DVDD AVDD TVDD DVDD RX CRX PVDD R1 SVDD VMID R2 Cvmid NRSTPD PN512 TX1 L0 C1 RQ interface HOST antenna CONTROLLER C0 C2 TVSS Lant IRQ C0 C2 TX2 L0 C1 RQ AVSS DVSS OSCIN OSCOUT 27.12 MHz 001aan232 Fig 38. Typical circuit diagram PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 110 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 22. Limiting values Table 166. Limiting valu es In accordance with the Absolute Maximum Rating System (IEC 60134). Symbol Parameter Conditions Min Max Unit V analog supply voltage 0.5 +4.0 V DDA V digital supply voltage 0.5 +4.0 V DDD V PVDD supply voltage 0.5 +4.0 V DD(PVDD) V TVDD supply voltage 0.5 +4.0 V DD(TVDD) V SVDD supply voltage 0.5 +4.0 V DD(SVDD) V input voltage all input pins except pins SIGIN and V  0.5 V + 0.5 V I SS(PVSS) DD(PVDD) RX pin MFIN V  0.5 V + 0.5 V SS(PVSS) DD(SVDD) P total power dissipation per package; and V in shortcut - 200 mW tot DDD mode T junction temperature - 125 C j V electrostatic discharge HBM; 1500, 100pF; - 2000 V ESD voltage JESD22-A114-B MM; 0.75H, 200pF; - 200 V JESD22-A114-A Charged device model; JESD22-C101-A on all pins - 200 V on all pins except SVDD in - 500 V TFBGA64 package Industrial version PN512AA0HN1: V electrostatic discharge HBM; 1500, 100pF; - 2000 V ESD voltage JESD22-A114-B MM; 0.75H, 200pF; - 200 V JESD22-A114-A Charged device model; AEC-Q100-011 on all pins - 200 V on all pins except SVDD - 500 V 23. Recommended operating conditions Table 167. Operating co nditions Symbol Parameter Conditions Min Typ Max Unit V analog supply voltage V V = V = V ; [1][2] 2.5 - 3.6 V DDA DD(PVDD) DDA DDD DD(TVDD) V =V =V =V =0V SSA SSD SS(PVSS) SS(TVSS) VDDD digital supply voltage VDD(PVDD)VDDA = VDDD = VDD(TVDD); [1][2] 2.5 - 3.6 V V =V =V =V =0V SSA SSD SS(PVSS) SS(TVSS) V TVDD supply voltage V V = V = V ; [1][2] 2.5 - 3.6 V DD(TVDD) DD(PVDD) DDA DDD DD(TVDD) V =V =V =V =0V SSA SSD SS(PVSS) SS(TVSS) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 111 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 167. Operating conditions …continued Symbol Parameter Conditions Min Typ Max Unit V PVDD supply voltage V V = V = V ; [3] 1.6 - 3.6 V DD(PVDD) DD(PVDD) DDA DDD DD(TVDD) V =V =V =V =0V SSA SSD SS(PVSS) SS(TVSS) V SVDD supply voltage V =V =V =V =0V 1.6 - 3.6 V DD(SVDD) SSA SSD SS(PVSS) SS(TVSS) T ambient temperature HVQFN32, HVQFN40, TFBGA64 30 - +85 C amb Industrial version PN512AA0HN1: T ambient temperature HVQFN32 40 - +90 C amb [1] Supply voltages below 3 V reduce the performance (the achievable operating distance). [2] V , V and V must always be the same voltage. DDA DDD DD(TVDD) [3] V must always be the same or lower voltage than V . DD(PVDD) DDD 24. Thermal characteristics Table 168. Thermal cha racteristics Symbol Parameter Conditions Package Typ Unit R Thermal resistance from In still air with exposed pad HVQFN32 40 K/W thj-a junction to ambient soldered on a 4 layer Jedec PCB HVQFN40 35 K/W In still air TFBGA64 46.9 K/W 25. Characteristics Table 169. Characterist ics Symbol Parameter Conditions Min Typ Max Unit Input characteristics Pins A0, A1 and NRSTPD I input leakage current 1 - +1 A LI V HIGH-level input voltage 0.7V - - V IH DD(PVDD) V LOW-level input voltage - - 0.3V V IL DD(PVDD) Pin SIGIN I input leakage current 1 - +1 A LI V HIGH-level input voltage 0.7V - - V IH DD(SVDD) V LOW-level input voltage - - 0.3V V IL DD(SVDD) Pin ALE I input leakage current 1 - +1 A LI V HIGH-level input voltage 0.7V - - V IH DD(PVDD) V LOW-level input voltage - - 0.3V V IL DD(PVDD) Pin RX[1] V input voltage 1 - V +1 V i DDA C input capacitance V = 3V; receiver active; - 10 - pF i DDA V = 1V; 1.5V (DC) RX(p-p) offset PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 112 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 169. Characteristics …continued Symbol Parameter Conditions Min Typ Max Unit R input resistance V =3V; receiver active; - 350 -  i DDA V =1V; 1.5V (DC) RX(p-p) offset Input voltage range; see Figure39 V minimum peak-to-peak input Manchester encoded; - 100 - mV i(p-p)(min) voltage V =3V DDA V maximum peak-to-peak input Manchester encoded; - 4 - V i(p-p)(max) voltage V =3V DDA Input sensitivity; see Figure39 V modulation voltage minimum Manchester - 5 - mV mod encoded; V =3V; DDA RxGain[2:0]=111b (48dB) Pin OSCIN I input leakage current 1 - +1 A LI V HIGH-level input voltage 0.7V - - V IH DDA V LOW-level input voltage - - 0.3V V IL DDA C input capacitance V =2.8V; DC=0.65V; - 2 - pF i DDA AC=1V(p-p) Input/output characteristics pins D1, D2, D3, D4, D5, D6 and D7 I input leakage current 1 - +1 A LI V HIGH-level input voltage 0.7V - - V IH DD(PVDD) V LOW-level input voltage - - 0.3V V IL DD(PVDD) V HIGH-level output voltage V =3V; I =4mA V  - V V OH DD(PVDD) O DD(PVDD) DD(PVDD) 0.4 V LOW-level output voltage V =3V; I =4mA V - V + V OL DD(PVDD) O SS(PVSS) SS(PVSS) 0.4 I HIGH-level output current V =3V - - 4 mA OH DD(PVDD) I LOW-level output current V =3V - - 4 mA OL DD(PVDD) Output characteristics Pin SIGOUT V HIGH-level output voltage V =3V; I =4mA V  - V V OH DD(SVDD) O DD(SVDD) DD(SVDD) 0.4 V LOW-level output voltage V =3V; I =4mA V - V + V OL DD(SVDD) O SS(PVSS) SS(PVSS) 0.4 I LOW-level output current V =3V - - 4 mA OL DD(SVDD) I HIGH-level output current V =3V - - 4 mA OH DD(SVDD) Pin IRQ V HIGH-level output voltage V =3V; I =4mA V  - V V OH DD(PVDD) O DD(PVDD) DD(PVDD) 0.4 V LOW-level output voltage V =3V; I =4mA V - V + V OL DD(PVDD) O SS(PVSS) SS(PVSS) 0.4 I LOW-level output current V =3V - - 4 mA OL DD(PVDD) I HIGH-level output current V =3V - - 4 mA OH DD(PVDD) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 113 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 169. Characteristics …continued Symbol Parameter Conditions Min Typ Max Unit Pins AUX1 and AUX2 V HIGH-level output voltage V =3V; I =4mA V  0.4 - V V OH DDD O DDD DDD V LOW-level output voltage V =3V; I =4mA V - V + V OL DDD O SS(PVSS) SS(PVSS) 0.4 I LOW-level output current V =3V - - 4 mA OL DDD I HIGH-level output current V =3V - - 4 mA OH DDD Pins TX1 and TX2 V LOW-level output voltage V =3V; - - 0.15 V OL DD(TVDD) I =32mA; DD(TVDD) CWGsP[5:0]=0Fh V =3V; - - 0.4 V DD(TVDD) I =80mA; DD(TVDD) CWGsP[5:0]=0Fh V =2.5V; - - 0.24 V DD(TVDD) I =32mA; DD(TVDD) CWGsP[5:0]=0Fh V =2.5V; - - 0.64 V DD(TVDD) I =80mA; DD(TVDD) CWGsP[5:0]=0Fh V HIGH-level output voltage V =3V; V  - - V OH DD(TVDD) DD(TVDD) I =32mA; 0.15 DD(TVDD) CWGsP[5:0]=3Fh V =3V; V  - - V DD(TVDD) DD(TVDD) I =80mA; 0.4 DD(TVDD) CWGsP[5:0]=3Fh V =2.5V; V  - - V DD(TVDD) DD(TVDD) I =32mA; 0.24 DD(TVDD) CWGsP[5:0]=3Fh V =2.5V; V  - - V DD(TVDD) DD(TVDD) I =80mA; 0.64 DD(TVDD) CWGsP[5:0]=3Fh Industrial version: V LOW-level output voltage V =2.5V; - - 0.18 V OL DD(TVDD) I =32mA; DD(TVDD) CWGsP[5:0]=3Fh V =2.5V; - - 0.44 V DD(TVDD) I =80mA; DD(TVDD) CWGsP[5:0]=3Fh V HIGH-level output voltage V =3V; V  - - V OH DD(TVDD) DD(TVDD) I =32mA; 0.18 DD(TVDD) CWGsP[5:0]=3Fh V =3V; V  - - V DD(TVDD) DD(TVDD) I =80mA; 0.44 DD(TVDD) CWGsP[5:0]=3Fh Output resistance for TX1/TX2, Industrial Version: R High level output resistance TV = 3 V, V = TV - 123 180 261  OP,01H DD TX DD 100 mV, CWGsP = 01h PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 114 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 169. Characteristics …continued Symbol Parameter Conditions Min Typ Max Unit R High level output resistance TV = 3 V, V = TV - 61 90 131  OP,02H DD TX DD 100 mV, CWGsP = 02h R High level output resistance TV = 3 V, V = TV - 30 46 68  OP,04H DD TX DD 100 mV, CWGsP = 04h R High level output resistance TV = 3 V, V = TV - 15 23 35  OP,08H DD TX DD 100 mV, CWGsP = 08h R High level output resistance TV = 3 V, V = TV - 7.5 12 19  OP,10H DD TX DD 100 mV, CWGsP = 10h R High level output resistance TV = 3 V, V = TV - 4.2 6 9  OP,20H DD TX DD 100 mV, CWGsP = 20h R High level output resistance TV = 3 V, V = TV - 2 3 5  OP,3FH DD TX DD 100 mV, CWGsP = 3Fh R Low level output resistance TV = 3 V, V = TV - 30 46 68  ON,10H DD TX DD 100 mV, CWGsN = 10h R Low level output resistance TV = 3 V, V = TV - 15 23 35  ON,20H DD TX DD 100 mV, CWGsN = 20h R Low level output resistance TV = 3 V, V = TV - 7.5 12 19  ON,40H DD TX DD 100 mV, CWGsN = 40h R Low level output resistance TV = 3 V, V = TV - 4.2 6 9  ON,80H DD TX DD 100 mV, CWGsN = 80h R Low level output resistance TV = 3 V, V = TV - 2 3 5  ON,F0H DD TX DD 100 mV, CWGsN = F0h Current consumption I power-down current V =V = V = pd DDA DDD DD(TVDD) V =3V DD(PVDD) hard power-down; pin [2] - - 5 A NRSTPD setLOW soft power-down; RF [2] - - 10 A level detector on I PVDD supply current pin PVDD [3] - - 40 mA DD(PVDD) I TVDD supply current pin TVDD; continuous wave [4][5][6] - 60 100 mA DD(TVDD) I SVDD supply current pin SVDD [7] - - 4 mA DD(SVDD) I digital supply current pin DVDD; V =3V - 6.5 9 mA DDD DDD I analog supply current pin AVDD; V =3V, - 7 10 mA DDA DDA CommandReg register’s RcvOffbit =0 pin AVDD; receiver - 3 5 mA switched off; V =3V, DDA CommandReg register’s RcvOff bit=1 Industrial version: I digital supply current pin DVDD; V =3V - 6.5 9,5 mA DDD DDD PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 115 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 169. Characteristics …continued Symbol Parameter Conditions Min Typ Max Unit I power-down current V =V = V = pd DDA DDD DD(TVDD) V =3V DD(PVDD) hard power-down; pin [2] - - 15 A NRSTPD setLOW soft power-down; RF [2] - - 30 A level detector on Clock frequency f clock frequency - 27.12 - MHz clk  clock duty cycle 40 50 60 % clk t jitter time RMS - - 10 ps jit Crystal oscillator V HIGH-level output voltage pin OSCOUT - 1.1 - V OH V LOW-level output voltage pin OSCOUT - 0.2 - V OL C input capacitance pin OSCOUT - 2 - pF i pin OSCIN - 2 - pF Typical input requirements f crystal frequency - 27.12 - MHz xtal ESR equivalent series resistance - - 100  C load capacitance - 10 - pF L P crystal power dissipation - 50 100 W xtal [1] The voltage on pin RX is clamped by internal diodes to pins AVSS and AVDD. [2] I is the total current for all supplies. pd [3] I depends on the overall load at the digital pins. DD(PVDD) [4] I depends on V and the external circuit connected to pins TX1 and TX2. DD(TVDD) DD(TVDD) [5] During typical circuit operation, the overall current is below 100mA. [6] Typical value using a complementary driver configuration and an antenna matched to 40  between pins TX1 and TX2 at 13.56MHz. [7] I depends on the load at pin MFOUT. DD(SVDD) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 116 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Vmod Vi(p-p)(max) Vi(p-p)(min) VMID 13.56 MHz carrier 0 V 001aak012 Fig 39. Pin RX input voltage range 25.1 Timing characteristics Table 170. SPI timing characteristics Symbol Parameter Conditions Min Typ Max Unit t pulse width LOW line SCK 50 - - ns WL t pulse width HIGH line SCK 50 - - ns WH t SCK HIGH to data input SCK to changing 25 - - ns h(SCKH-D) hold time MOSI t data input to SCK HIGH changing MOSI to 25 - - ns su(D-SCKH) set-up time SCK t SCK LOW to data output SCK to changing - - 25 ns h(SCKL-Q) hold time MISO t SCK LOW to NSS HIGH 0 - - ns (SCKL-NSSH) time Table 171. I2C-bus timing in Fast mode Symbol Parameter Conditions Fast mode High-speed Unit mode Min Max Min Max f SCL clock frequency 0 400 0 3400 kHz SCL t hold time (repeated) START after this period, 600 - 160 - ns HD;STA condition the first clock pulse is generated t set-up time for a repeated 600 - 160 - ns SU;STA START condition t set-up time for STOP condition 600 - 160 - ns SU;STO t LOW period of the SCL clock 1300 - 160 - ns LOW t HIGH period of the SCL clock 600 - 60 - ns HIGH t data hold time 0 900 0 70 ns HD;DAT PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 117 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 171. I2C-bus timing in Fast mode …continued Symbol Parameter Conditions Fast mode High-speed Unit mode Min Max Min Max t data set-up time 100 - 10 - ns SU;DAT t rise time SCL signal 20 300 10 40 ns r t fall time SCL signal 20 300 10 40 ns f t rise time SDA and SCL 20 300 10 80 ns r signals t fall time SDA and SCL 20 300 10 80 ns f signals t bus free time between a STOP 1.3 - 1.3 - s BUF and START condition tSCKL tSCKH tSCKL SCK tSLDX tDXSH tSHDX tDXSH MOSI MSB LSB MISO MSB LSB tSLNH NSS 001aaj634 Remark: The signal NSS must be LOW to be able to send several bytes in one data stream. To send more than one data stream NSS must be set HIGH between the data streams. Fig 40. Timing diagram for SPI SDA tf tSU;DAT tSP tr tLOW tf tHD;STA tBUF SCL tr tHIGH tSU;STO tHD;STA tSU;STA S tHD;DAT Sr P S 001aaj635 Fig 41. Timing for Fast and Standardmode devices on the I2C-bus PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 118 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 25.2 8-bit parallel interface timing 25.2.1 AC symbols Each timing symbol has five characters. The first character is always 't' for time. The other characters indicate the name of a signal or the logic state of that signal (depending on position): Table 172. AC symbols Designation Signal Designation Logic Level A address H HIGH D data L LOW W NWR or nWait Z high impedance R NRD or R/NW or nWrite X any level or data L ALE or AS V any valid signal or data C NCS N NSS S NDS or nDStrb and nAStrb, SCK Example: t = time for address valid to ALE low AVLL 25.2.2 AC operating specification 25.2.2.1 Bus timing for separated Read/Write strobe Table 173. Timing specification for separated Read/Write strobe Symbol Parameter Min Max Unit t ALE pulse width 10 - ns LHLL t Multiplexed Address Bus valid to ALE low (Address Set Up Time) 5 - ns AVLL t Multiplexed Address Bus valid after ALE low (Address Hold Time) 5 - ns LLAX t ALE low to NWR, NRD low 10 - ns LLWL t NCS low to NRD, NWR low 0 - ns CLWL t NRD, NWR high to NCS high 0 - ns WHCH t NRD low to DATA valid - 35 ns RLDV t NRD high to DATA high impedance - 10 ns RHDZ t DATA valid to NWR high 5 - ns DVWH t DATA hold after NWR high (Data Hold Time) 5 - ns WHDX t NRD, NWR pulse width 40 - ns WLWH t Separated Address Bus valid to NRD, NWR low (Set Up Time) 30 - ns AVWL t Separated Address Bus valid after NWR high (Hold Time) 5 - ns WHAX t period between sequenced read/write accesses 40 - ns WHWL PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 119 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend tLHLL ALE tWHCH tCLWL NCS tLLWL tWHWL tWLWH tWHWL NWR NRD tAVLL tLLAX tWLDV tWHDX tRLDV tRHDZ D0...D7 D0...D7 multiplexed addressbus tWHAX A0...A3 tAVWL A0...A3 SEPARATED ADDRESSBUS A0...A3 001aan233 Fig 42. Timing diagram for separated Read/Write strobe Remark: For separated address and data bus the signal ALE is not relevant and the multiplexed addresses on the data bus don’t care. For the multiplexed address and data bus the address lines A0 to A3 have to be connected as described in chapter Automatic host controller Interface Type Detection. 25.2.2.2 Bus timing for common Read/Write strobe Table 174. Timing specification for common Read/Write strobe Symbol Parameter Min Max Unit t AS pulse width 10 - ns LHLL t Multiplexed Address Bus valid to AS low (Address Set Up Time) 5 - ns AVLL t Multiplexed Address Bus valid after AS low (Address Hold Time) 5 - ns LLAX t AS low to NDS low 10 - ns LLSL t NCS low to NDS low 0 - ns CLSL t NDS high to NCS high 0 - ns SHCH t NDS low to DATA valid (for read cycle) - 35 ns SLDV,R t NDS low to DATA high impedance (read cycle) - 10 ns SHDZ t DATA valid to NDS high (for write cycle) 5 - ns DVSH t DATA hold after NDS high (write cycle, Hold Time) 5 - ns SHDX t R/NW hold after NDS high 5 - ns SHRX t NDS pulse width 40 - ns SLSH t Separated Address Bus valid to NDS low (Hold Time) 30 - ns AVSL t Separated Address Bus valid after NDS high (Set Up Time) 5 - ns SHAX PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 120 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend tLHLL ALE tSHCH tCLSL NCS tRVSL tSHRX R/NW tLLSL tSHSL tSLSH tSHSL NDS tSLDV, R tAVLL tLLAX tSLDV, W ttSSHHDDXZ D0...D7 D0...D7 multiplexed addressbus tSHAX A0...A3 tAVSL A0...A3 SEPARATED ADDRESSBUS A0...A3 001aan234 Fig 43. Timing diagram for common Read/Write strobe Remark: For separated address and data bus the signal ALE is not relevant and the multiplexed addresses on the data bus don’t care. For the multiplexed address and data bus the address lines A0 to A3 have to be connected as described in Automatic -Controller Interface Type Detection. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 121 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 26. Package information The PN512 can be delivered in 3 different packages. Table 175. Package information Package Remarks HVQFN32 8-bit parallel interface not supported HVQFN40 Supports the 8-bit parallel interface TFBGA64 Ball grid array facilitating development of an PCI compliant device PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 122 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 27. Package outline HVQFN32: plastic thermal enhanced very thin quad flat package; no leads; 32 terminals; body 5 x 5 x 0.85 mm SOT617-1 D B A terminal 1 index area A A1 E c detail X e1 C e 1/2 e b v M C A B y1 C y 9 16 w M C L 17 8 e Eh e2 1/2 e 1 24 terminal 1 index area 32 25 Dh X 0 2.5 5 mm scale DIMENSIONS (mm are the original dimensions) UNIT mAa(1x). A1 b c D(1) Dh E(1) Eh e e1 e2 L v w y y1 0.05 0.30 5.1 3.25 5.1 3.25 0.5 mm 1 0.2 0.5 3.5 3.5 0.1 0.05 0.05 0.1 0.00 0.18 4.9 2.95 4.9 2.95 0.3 Note 1. Plastic or metal protrusions of 0.075 mm maximum per side are not included. OUTLINE REFERENCES EUROPEAN ISSUE DATE VERSION IEC JEDEC JEITA PROJECTION 01-08-08 SOT617-1 - - - MO-220 - - - 02-10-18 Fig 44. Package outline package version (HVQFN32) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 123 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend HVQFN40: plastic thermal enhanced very thin quad flat package; no leads; 40 terminals; body 6 x 6 x 0.85 mm SOT618-1 D B A terminal 1 index area A A1 E c detail X e1 C v C A B e 1/2 e b w C y1C y 11 20 L 21 10 e Eh e2 1/2 e 1 30 terminal 1 index area 40 31 Dh X 0 2.5 5 mm scale Dimensions (mm are the original dimensions) Unit A(1) A1 b c D(1) Dh E(1) Eh e e1 e2 L v w y y1 max 1.00 0.05 0.30 0.2 6.1 4.25 6.1 4.25 0.5 4.5 4.5 0.5 0.1 0.05 0.05 0.1 mm nom 0.85 0.02 0.21 6.0 4.10 6.0 4.10 0.4 min 0.80 0.00 0.18 5.9 3.95 5.9 3.95 0.3 Note 1. Plastic or metal protrusions of 0.075 mm maximum per side are not included. sot618-1_po Outline References European Issue date version IEC JEDEC JEITA projection 02-10-22 SOT618-1 MO-220 13-11-05 Fig 45. Package outline package version (HVQFN40) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 124 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend TFBGA64: plastic thin fine-pitch ball grid array package; 64 balls SOT1336-1 D B A ball A1 index area A A2 E A1 detail X e1 C 1/2 e Ø v C A B e b y1C y Ø w C H G e F E e2 D C 1/2 e B A ball A1 1 2 3 4 5 6 7 8 index area X 0 5 mm scale Dimensions (mm are the original dimensions) Unit A A1 A2 b D E e e1 e2 v w y y1 max 1.15 0.35 0.80 0.45 5.6 5.6 mm nom 1.00 0.30 0.70 0.40 5.5 5.5 0.65 4.55 4.55 0.15 0.08 0.1 0.1 min 0.90 0.25 0.65 0.35 5.4 5.4 sot1336-1_po Outline References European Issue date version IEC JEDEC JEITA projection 12-06-19 SOT1336-1 - - - 12-08-28 Fig 46. Package outline package version (TFBGA64) PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 125 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 28. Abbreviations Table 176. Abbreviations Acronym Description ADC Analog-to-Digital Converter ASK Amplitude Shift keying BPSK Binary Phase Shift Keying CRC Cyclic Redundancy Check CW Continuous Wave DAC Digital-to-Analog Converter EOF End of frame HBM Human Body Model I2C Inter-integrated Circuit LSB Least Significant Bit MISO Master In Slave Out MM Machine Model MOSI Master Out Slave In MSB Most Significant Bit NSS Not Slave Select PCB Printed-Circuit Board PLL Phase-Locked Loop PRBS Pseudo-Random Bit Sequence RX Receiver SOF Start Of Frame SPI Serial Peripheral Interface TX Transmitter UART Universal Asynchronous Receiver Transmitter 29. Glossary Modulation index — Defined as the voltage ratio (V  V ) / (V + V ). max min max min Load modulation index — Defined as the voltage ratio for the card (V V )/(V +V ) measured at the card’s coil. max min max min Initiator — Generates RF field at 13.56MHz and starts the NFCIP-1 communication. Target — Responds to command either using load modulation scheme (RF field generated by Initiator) or using modulation of self generated RF field (no RF field generated by initiator). 30. References [1] Application note — NFC Transmission Module Antenna and RF Design Guide PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 126 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 31. Revision history Table 177. Revision history Document ID Release date Data sheet status Change notice Supersedes PN512 v.5.2 20160616 Product data sheet - PN512 v.5.1 Modifications: • Added in “Industrial version” the type PN512AA0HN1 PN512 v.5.1 20160427 Product data sheet - PN512 v.5.0 Modifications: • Descriptive title updated PN512 v.5.0 20160406 Product data sheet - PN512 v.4.9 Modifications: • Section 1 “General description”: updated PN512 v.4.9 20150909 Product data sheet - PN512 v.4.8 Modifications: • Section 1 “General description”: updated • Table 34 “Description of Status2Reg bits”: Description of value 100 updated • Section 32.4 “Licenses”: License statement “Purchase of NXP ICs with NFC technology” updated. PN512 v.4.8 20150506 Product data sheet - PN512 v.4.7 Modifications: • Figure 38 “Typical circuit diagram”: SVDD symbol corrected PN512 v.4.7 20150331 Product data sheet - PN512 v.4.6 Modifications: • Section 1 “Introduction”: Version description PN512AA updated • Section 1 “General description” and Section 2 “Features and benefits”: MIFARE emulation support clarified PN512 v.4.6 20141202 Product data sheet - PN512 v.4.5 Modifications: • Section 7.2 “ISO/IEC 14443 B functionality”: Remark removed PN512 v.4.5 20131210 Product data sheet - PN512 v.4.4 Modifications: • Typo corrected PN512 v.4.4 20130730 Product data sheet - PN512 v.4.3 Modifications: • Value added in Table 166 “Limiting values” • Change of descriptive title PN512 v.4.3 20130507 Product data sheet - PN512 v.4.2 Modifications: • New type PN5120A0ET/C2 added • Table 72 “Description of MifNFCReg bits”: description of TxWait updated • Table 153 “Register and bit settings controlling the signal on pin TX1” and Table 153 “Register and bit settings controlling the signal on pin TX1”: updated • Table 166 “Limiting values”: V values added ESD PN512 v.4.2 20120828 Product data sheet - PN512 v.4.1 Modifications: • Table 123 “AutoTestReg register (address 36h); reset value: 40h, 01000000b”: description of bits 4 and 5 corrected PN512 v.4.1 20120821 Product data sheet - PN512 v.4.0 Modifications: • Table 124 “Description of bits”: description of bits 4 and 5 corrected PN512 v.4.0 20120712 Product data sheet - PN512 v.3.9 Modifications: • Section 32.4 “Licenses”: updated PN512 v.3.9 20120201 Product data sheet - PN512 v.3.8 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 127 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 177. Revision history …continued Document ID Release date Data sheet status Change notice Supersedes Modifications: • Adding information on the different version in General description. • Adding Section 20 “Errata sheet” on page 109 for explanation of differences between 1.0 and 2.0. • Adding ordering information for version 1.0 and industrial version in Table 2 “Ordering information” on page 5 • Adding the limitations and characteristics for the industrial version, see Table 1 “Quick reference data” on page 4, Table 166 “Limiting values” on page 111, Table 1 “Quick reference data” on page 4 • Referring to the Section 20 “Errata sheet” on page 109 within the following sections: Section 8.2.2.4 “RxModeReg” on page 39, Section 8.2.2.10 “DemodReg” on page 45, Section 8.2.2.15 “TypeBReg” on page 50, Section 8.2.3.10 “TMode Register, TPrescaler Register” on page 57, Section 8.2.4.7 “AutoTestReg” on page 64, Section 8.2.4.8 “VersionReg” on page 64, Section 8.1.1 “Register bit behavior” on page 23, Section 14 “Timer unit” on page 96, Section 19 “Testsignals” on page 107; • Update of command ‘Mem’ to ‘Configure’ and ‘RFU’ to ‘Autocoll’ in Table 158 “Command overview” on page 101. • Change of ‘Mem’ to ‘Configure’ in ‘Mem’ in Section 18.3.1.2 “Config command” on page 101 • Adding Autocoll in Section 18.3.1.9 “AutoColl” on page 103 PN512 v.3.8 20111025 Product data sheet - PN512 v.3.7 Modifications: • Table 168 “Characteristics”: unit of P corrected xtal 111310 June 2005 Objective data sheet - Modifications: • Initial version PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 128 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 32. Legal information 32.1 Data sheet status Document status[1][2] Product status[3] Definition Objective [short] data sheet Development This document contains data from the objective specification for product development. Preliminary [short] data sheet Qualification This document contains data from the preliminary specification. Product [short] data sheet Production This document contains the product specification. [1] Please consult the most recently issued document before initiating or completing a design. [2] The term ‘short data sheet’ is explained in section “Definitions”. [3] The product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple devices. The latest product status information is available on the Internet at URLhttp://www.nxp.com. 32.2 Definitions Suitability for use — NXP Semiconductors products are not designed, authorized or warranted to be suitable for use in life support, life-critical or safety-critical systems or equipment, nor in applications where failure or Draft — The document is a draft version only. The content is still under malfunction of an NXP Semiconductors product can reasonably be expected internal review and subject to formal approval, which may result in to result in personal injury, death or severe property or environmental modifications or additions. NXP Semiconductors does not give any damage. NXP Semiconductors and its suppliers accept no liability for representations or warranties as to the accuracy or completeness of inclusion and/or use of NXP Semiconductors products in such equipment or information included herein and shall have no liability for the consequences of applications and therefore such inclusion and/or use is at the customer’s own use of such information. risk. Short data sheet — A short data sheet is an extract from a full data sheet Applications — Applications that are described herein for any of these with the same product type number(s) and title. A short data sheet is intended products are for illustrative purposes only. NXP Semiconductors makes no for quick reference only and should not be relied upon to contain detailed and representation or warranty that such applications will be suitable for the full information. For detailed and full information see the relevant full data specified use without further testing or modification. sheet, which is available on request via the local NXP Semiconductors sales office. In case of any inconsistency or conflict with the short data sheet, the Customers are responsible for the design and operation of their applications full data sheet shall prevail. and products using NXP Semiconductors products, and NXP Semiconductors accepts no liability for any assistance with applications or customer product Product specification — The information and data provided in a Product design. It is customer’s sole responsibility to determine whether the NXP data sheet shall define the specification of the product as agreed between Semiconductors product is suitable and fit for the customer’s applications and NXP Semiconductors and its customer, unless NXP Semiconductors and products planned, as well as for the planned application and use of customer have explicitly agreed otherwise in writing. In no event however, customer’s third party customer(s). Customers should provide appropriate shall an agreement be valid in which the NXP Semiconductors product is design and operating safeguards to minimize the risks associated with their deemed to offer functions and qualities beyond those described in the applications and products. Product data sheet. NXP Semiconductors does not accept any liability related to any default, damage, costs or problem which is based on any weakness or default in the 32.3 Disclaimers customer’s applications or products, or the application or use by customer’s third party customer(s). Customer is responsible for doing all necessary testing for the customer’s applications and products using NXP Limited warranty and liability — Information in this document is believed to Semiconductors products in order to avoid a default of the applications and be accurate and reliable. However, NXP Semiconductors does not give any the products or of the application or use by customer’s third party representations or warranties, expressed or implied, as to the accuracy or customer(s). NXP does not accept any liability in this respect. completeness of such information and shall have no liability for the consequences of use of such information. NXP Semiconductors takes no Limiting values — Stress above one or more limiting values (as defined in responsibility for the content in this document if provided by an information the Absolute Maximum Ratings System of IEC60134) will cause permanent source outside of NXP Semiconductors. damage to the device. Limiting values are stress ratings only and (proper) operation of the device at these or any other conditions above those given in In no event shall NXP Semiconductors be liable for any indirect, incidental, the Recommended operating conditions section (if present) or the punitive, special or consequential damages (including - without limitation - lost Characteristics sections of this document is not warranted. Constant or profits, lost savings, business interruption, costs related to the removal or repeated exposure to limiting values will permanently and irreversibly affect replacement of any products or rework charges) whether or not such the quality and reliability of the device. damages are based on tort (including negligence), warranty, breach of contract or any other legal theory. Terms and conditions of commercial sale — NXP Semiconductors products are sold subject to the general terms and conditions of commercial Notwithstanding any damages that customer might incur for any reason whatsoever, NXP Semiconductors’ aggregate and cumulative liability towards sale, as published at http://www.nxp.com/profile/terms, unless otherwise customer for the products described herein shall be limited in accordance agreed in a valid written individual agreement. In case an individual with the Terms and conditions of commercial sale of NXP Semiconductors. agreement is concluded only the terms and conditions of the respective agreement shall apply. NXP Semiconductors hereby expressly objects to Right to make changes — NXP Semiconductors reserves the right to make applying the customer’s general terms and conditions with regard to the changes to information published in this document, including without purchase of NXP Semiconductors products by customer. limitation specifications and product descriptions, at any time and without notice. This document supersedes and replaces all information supplied prior No offer to sell or license — Nothing in this document may be interpreted or to the publication hereof. construed as an offer to sell products that is open for acceptance or the grant, conveyance or implication of any license under any copyrights, patents or other industrial or intellectual property rights. PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 129 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Export control — This document as well as the item(s) described herein 32.4 Licenses may be subject to export control regulations. Export might require a prior authorization from competent authorities. Purchase of NXP ICs with ISO/IEC 14443 type B functionality Quick reference data — The Quick reference data is an extract of the product data given in the Limiting values and Characteristics sections of this This NXP Semiconductors IC is ISO/IEC 14443 Type B document, and as such is not complete, exhaustive or legally binding. software enabled and is licensed under Innovatron’s Contactless Card patents license for ISO/IEC 14443 B. Non-automotive qualified products — Unless this data sheet expressly states that this specific NXP Semiconductors product is automotive qualified, The license includes the right to use the IC in systems the product is not suitable for automotive use. It is neither qualified nor tested and/or end-user equipment. in accordance with automotive testing or application requirements. NXP RATP/Innovatron Semiconductors accepts no liability for inclusion and/or use of Technology non-automotive qualified products in automotive equipment or applications. In the event that customer uses the product for design-in and use in automotive applications to automotive specifications and standards, customer Purchase of NXP ICs with NFC technology (a) shall use the product without NXP Semiconductors’ warranty of the Purchase of an NXP Semiconductors IC that complies with one of the Near product for such automotive applications, use and specifications, and (b) Field Communication (NFC) standards ISO/IEC 18092 and ISO/IEC 21481 whenever customer uses the product for automotive applications beyond does not convey an implied license under any patent right infringed by NXP Semiconductors’ specifications such use shall be solely at customer’s implementation of any of those standards. Purchase of NXP own risk, and (c) customer fully indemnifies NXP Semiconductors for any Semiconductors IC does not include a license to any NXP patent (or other liability, damages or failed product claims resulting from customer design and IP right) covering combinations of those products with other products, use of the product for automotive applications beyond NXP Semiconductors’ whether hardware or software. standard warranty and NXP Semiconductors’ product specifications. Translations — A non-English (translated) version of a document is for 32.5 Trademarks reference only. The English version shall prevail in case of any discrepancy between the translated and English versions. Notice: All referenced brands, product names, service names and trademarks are the property of their respective owners. I2C-bus — logo is a trademark of NXP B.V. MIFARE — is a trademark of NXP B.V. 33. Contact information For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: salesaddresses@nxp.com PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 130 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 34. Tables Table 1. Quick reference data . . . . . . . . . . . . . . . . . . . . .4 Table 41. ControlReg register (address 0Ch); reset value: Table 2. Ordering information . . . . . . . . . . . . . . . . . . . . .5 00h, 00000000b. . . . . . . . . . . . . . . . . . . . . . . .33 Table 3. Pin description HVQFN32 . . . . . . . . . . . . . . . .10 Table 42. Description of ControlReg bits . . . . . . . . . . . .33 Table 4. Pin description HVQFN40 . . . . . . . . . . . . . . . .11 Table 43. BitFramingReg register (address 0Dh); reset Table 5. Pin description TFBGA64. . . . . . . . . . . . . . . . .12 value: 00h, 00000000b . . . . . . . . . . . . . . . . . .34 Table 6. Communication overview for Table 44. Description of BitFramingReg bits. . . . . . . . . .34 ISO/IEC14443A/MIFARE reader/writer . . . . .14 Table 45. CollReg register (address 0Eh); reset value: Table 7. Communication overview for FeliCa XXh, 101XXXXXb . . . . . . . . . . . . . . . . . . . . . .35 reader/writer. . . . . . . . . . . . . . . . . . . . . . . . . . .16 Table 46. Description of CollReg bits. . . . . . . . . . . . . . . .35 Table 8. FeliCa framing and coding . . . . . . . . . . . . . . . .16 Table 47. PageReg register (address 10h); reset value: 00h, Table 9. Start value for the CRC Polynomial: (00h), (00h)16 00000000b. . . . . . . . . . . . . . . . . . . . . . . . . . . .36 Table 10. Communication overview for Active Table 48. Description of PageReg bits . . . . . . . . . . . . . .36 communication mode. . . . . . . . . . . . . . . . . . . .18 Table 49. ModeReg register (address 11h); reset value: Table 11. Communication overview for Passive 3Bh, 00111011b. . . . . . . . . . . . . . . . . . . . . . . .37 communication mode. . . . . . . . . . . . . . . . . . . .19 Table 50. Description of ModeReg bits . . . . . . . . . . . . . .37 Table 12. Framing and coding overview. . . . . . . . . . . . . .20 Table 51. TxModeReg register (address 12h); reset value: Table 13. MIFARE Card operation mode. . . . . . . . . . . . .20 00h, 00000000b. . . . . . . . . . . . . . . . . . . . . . . .38 Table 14. FeliCa Card operation mode . . . . . . . . . . . . . .21 Table 52. Description of TxModeReg bits . . . . . . . . . . . .38 Table 15. PN512 registers overview . . . . . . . . . . . . . . . .21 Table 53. RxModeReg register (address 13h); reset value: Table 16. Behavior of register bits and its designation. . .23 00h, 00000000b. . . . . . . . . . . . . . . . . . . . . . . .39 Table 17. PageReg register (address 00h); reset value: 00h, Table 54. Description of RxModeReg bits. . . . . . . . . . . .39 0000000b . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24 Table 55. TxControlReg register (address 14h); reset value: Table 18. Description of PageReg bits. . . . . . . . . . . . . . .24 80h, 10000000b. . . . . . . . . . . . . . . . . . . . . . . .40 Table 19. CommandReg register (address 01h); reset Table 56. Description of TxControlReg bits. . . . . . . . . . .40 value: 20h, 00100000b. . . . . . . . . . . . . . . . . . .24 Table 57. TxAutoReg register (address 15h); reset value: Table 20. Description of CommandReg bits. . . . . . . . . . .24 00h, 00000000b. . . . . . . . . . . . . . . . . . . . . . . .41 Table 21. CommIEnReg register (address 02h); reset value: Table 58. Description of TxAutoReg bits. . . . . . . . . . . . .41 80h, 10000000b . . . . . . . . . . . . . . . . . . . . . . . .25 Table 59. TxSelReg register (address 16h); reset value: Table 22. Description of CommIEnReg bits. . . . . . . . . . .25 10h, 00010000b. . . . . . . . . . . . . . . . . . . . . . . .42 Table 23. DivIEnReg register (address 03h); reset value: Table 60. Description of TxSelReg bits. . . . . . . . . . . . . .42 00h, 00000000b . . . . . . . . . . . . . . . . . . . . . . . .26 Table 61. RxSelReg register (address 17h); reset value: Table 24. Description of DivIEnReg bits. . . . . . . . . . . . . .26 84h, 10000100b. . . . . . . . . . . . . . . . . . . . . . . .44 Table 25. CommIRqReg register (address 04h); reset value: Table 62. Description of RxSelReg bits. . . . . . . . . . . . . .44 14h, 00010100b . . . . . . . . . . . . . . . . . . . . . . . .27 Table 63. RxThresholdReg register (address 18h); reset Table 26. Description of CommIRqReg bits. . . . . . . . . . .27 value: 84h, 10000100b . . . . . . . . . . . . . . . . . .44 Table 27. DivIRqReg register (address 05h); reset value: Table 64. Description of RxThresholdReg bits . . . . . . . .44 XXh, 000X00XXb . . . . . . . . . . . . . . . . . . . . . . .28 Table 65. DemodReg register (address 19h); reset value: Table 28. Description of DivIRqReg bits . . . . . . . . . . . . .28 4Dh, 01001101b. . . . . . . . . . . . . . . . . . . . . . . .45 Table 29. ErrorReg register (address 06h); reset value: 00h, Table 66. Description of DemodReg bits. . . . . . . . . . . . .45 00000000b . . . . . . . . . . . . . . . . . . . . . . . . . . . .29 Table 67. FelNFC1Reg register (address 1Ah); reset value: Table 30. Description of ErrorReg bits. . . . . . . . . . . . . . .29 00h, 00000000b. . . . . . . . . . . . . . . . . . . . . . . .46 Table 31. Status1Reg register (address 07h); reset value: Table 68. Description of FelNFC1Reg bits . . . . . . . . . . .46 XXh, X100X01Xb . . . . . . . . . . . . . . . . . . . . . . .30 Table 69. FelNFC2Reg register (address1Bh); reset value: Table 32. Description of Status1Reg bits. . . . . . . . . . . . .30 00h, 00000000b. . . . . . . . . . . . . . . . . . . . . . . .47 Table 33. Status2Reg register (address 08h); reset value: Table 70. Description of FelNFC2Reg bits . . . . . . . . . . .47 00h, 00000000b . . . . . . . . . . . . . . . . . . . . . . . .31 Table 71. MifNFCReg register (address 1Ch); reset value: Table 34. Description of Status2Reg bits. . . . . . . . . . . . .31 62h, 01100010b. . . . . . . . . . . . . . . . . . . . . . . .48 Table 35. FIFODataReg register (address 09h); reset value: Table 72. Description of MifNFCReg bits. . . . . . . . . . . . .48 XXh, XXXXXXXXb . . . . . . . . . . . . . . . . . . . . . .32 Table 73. ManualRCVReg register (address 1Dh); reset Table 36. Description of FIFODataReg bits . . . . . . . . . . .32 value: 00h, 00000000b . . . . . . . . . . . . . . . . . .49 Table 37. FIFOLevelReg register (address 0Ah); reset Table 74. Description of ManualRCVReg bits. . . . . . . . .49 value: 00h, 00000000b. . . . . . . . . . . . . . . . . . .32 Table 75. TypeBReg register (address 1Eh); reset value: Table 38. Description of FIFOLevelReg bits. . . . . . . . . . .32 00h, 00000000b. . . . . . . . . . . . . . . . . . . . . . . .50 Table 39. WaterLevelReg register (address 0Bh); reset Table 76. Description of TypeBReg bits. . . . . . . . . . . . . .50 value: 08h, 00001000b. . . . . . . . . . . . . . . . . . .33 Table 77. SerialSpeedReg register (address 1Fh); reset Table 40. Description of WaterLevelReg bits. . . . . . . . . .33 value: EBh, 11101011b . . . . . . . . . . . . . . . . . .51 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 131 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 78. Description of SerialSpeedReg bits . . . . . . . . .51 Table 117. TestPinEnReg register (address 33h); reset Table 79. PageReg register (address 20h); reset value: 00h, value: 80h, 10000000b . . . . . . . . . . . . . . . . . .63 00000000b . . . . . . . . . . . . . . . . . . . . . . . . . . . .52 Table 118. Description of TestPinEnReg bits . . . . . . . . . .63 Table 80. Description of PageReg bits. . . . . . . . . . . . . . .52 Table 119. TestPinValueReg register (address 34h); reset Table 81. CRCResultReg register (address 21h); reset value: 00h, 00000000b . . . . . . . . . . . . . . . . . .63 value: FFh, 11111111b. . . . . . . . . . . . . . . . . . . .52 Table 120. Description of TestPinValueReg bits. . . . . . . .63 Table 82. Description of CRCResultReg bits . . . . . . . . . .52 Table 121. TestBusReg register (address 35h); reset value: Table 83. CRCResultReg register (address 22h); reset XXh, XXXXXXXXb. . . . . . . . . . . . . . . . . . . . . .64 value: FFh, 11111111b. . . . . . . . . . . . . . . . . . . .52 Table 122. Description of TestBusReg bits. . . . . . . . . . . .64 Table 84. Description of CRCResultReg bits . . . . . . . . . .53 Table 123. AutoTestReg register (address 36h); reset value: Table 85. GsNOffReg register (address 23h); reset value: 40h, 01000000b. . . . . . . . . . . . . . . . . . . . . . . .64 88h, 10001000b . . . . . . . . . . . . . . . . . . . . . . . .53 Table 124. Description of bits . . . . . . . . . . . . . . . . . . . . . .64 Table 86. Description of GsNOffReg bits . . . . . . . . . . . . .53 Table 125. VersionReg register (address 37h); reset value: Table 87. ModWidthReg register (address 24h); reset value: XXh, XXXXXXXXb. . . . . . . . . . . . . . . . . . . . . .65 26h, 00100110b . . . . . . . . . . . . . . . . . . . . . . . .54 Table 126. Description of VersionReg bits . . . . . . . . . . . .65 Table 88. Description of ModWidthReg bits. . . . . . . . . . .54 Table 127. AnalogTestReg register (address 38h); reset Table 89. TxBitPhaseReg register (address 25h); reset value: 00h, 00000000b . . . . . . . . . . . . . . . . . .66 value: 87h, 10000111b . . . . . . . . . . . . . . . . . . .54 Table 128. Description of AnalogTestReg bits . . . . . . . . .66 Table 90. Description of TxBitPhaseReg bits. . . . . . . . . .54 Table 129. TestDAC1Reg register (address 39h); reset Table 91. RFCfgReg register (address 26h); reset value: value: XXh, 00XXXXXXb. . . . . . . . . . . . . . . . .67 48h, 01001000b . . . . . . . . . . . . . . . . . . . . . . . .55 Table 130. Description of TestDAC1Reg bits . . . . . . . . . .67 Table 92. Description of RFCfgReg bits . . . . . . . . . . . . .55 Table 131. TestDAC2Reg register (address 3Ah); reset Table 93. GsNOnReg register (address 27h); reset value: value: XXh, 00XXXXXXb. . . . . . . . . . . . . . . . .67 88h, 10001000b . . . . . . . . . . . . . . . . . . . . . . . .56 Table 132. Description ofTestDAC2Reg bits. . . . . . . . . . .67 Table 94. Description of GsNOnReg bits . . . . . . . . . . . . .56 Table 133. TestADCReg register (address 3Bh); reset value: Table 95. CWGsPReg register (address 28h); reset value: XXh, XXXXXXXXb. . . . . . . . . . . . . . . . . . . . . .67 20h, 00100000b . . . . . . . . . . . . . . . . . . . . . . . .56 Table 134. Description of TestADCReg bits . . . . . . . . . . .67 Table 96. Description of CWGsPReg bits. . . . . . . . . . . . .56 Table 135. RFTReg register (address 3Ch); reset value: Table 97. ModGsPReg register (address 29h); reset value: FFh, 11111111b . . . . . . . . . . . . . . . . . . . . . . . .68 20h, 00100000b . . . . . . . . . . . . . . . . . . . . . . . .57 Table 136. Description of RFTReg bits. . . . . . . . . . . . . . .68 Table 98. Description of ModGsPReg bits . . . . . . . . . . . .57 Table 137. RFTReg register (address 3Dh, 3Fh); reset value: Table 99. TModeReg register (address 2Ah); reset value: 00h, 00000000b. . . . . . . . . . . . . . . . . . . . . . . .68 00h, 00000000b . . . . . . . . . . . . . . . . . . . . . . . .57 Table 138. Description of RFTReg bits. . . . . . . . . . . . . . .68 Table 100. Description of TModeReg bits. . . . . . . . . . . . .57 Table 139. RFTReg register (address 3Eh); reset value: Table 101. TPrescalerReg register (address 2Bh); reset 03h, 00000011b. . . . . . . . . . . . . . . . . . . . . . . .68 value: 00h, 00000000b. . . . . . . . . . . . . . . . . . .58 Table 140. Description of RFTReg bits. . . . . . . . . . . . . . .68 Table 102. Description of TPrescalerReg bits. . . . . . . . . .58 Table 141. Connection protocol for detecting different Table 103. TReloadReg (Higher bits) register (address 2Ch); interface types. . . . . . . . . . . . . . . . . . . . . . . . .69 reset value: 00h, 00000000b . . . . . . . . . . . . . .59 Table 142. Connection scheme for detecting the different Table 104. Description of the higher TReloadReg bits . . .59 interface types . . . . . . . . . . . . . . . . . . . . . . . . .69 Table 105. TReloadReg (Lower bits) register (address 2Dh); Table 143. MOSI and MISO byte order . . . . . . . . . . . . . .70 reset value: 00h, 00000000b . . . . . . . . . . . . . .59 Table 144. MOSI and MISO byte order . . . . . . . . . . . . . .71 Table 106. Description of lower TReloadReg bits . . . . . . .59 Table 145. Address byte 0 register; address MOSI . . . . .71 Table 107. TCounterValReg (Higher bits) register (address Table 146. BR_T0 and BR_T1 settings . . . . . . . . . . . . . .72 2Eh); reset value: XXh, XXXXXXXXb . . . . . . .60 Table 147. Selectable UART transfer speeds . . . . . . . . .72 Table 108. Description of the higher TCounterValReg bits60 Table 148. UART framing. . . . . . . . . . . . . . . . . . . . . . . . .72 Table 109. TCounterValReg (Lower bits) register (address Table 149. Read data byte order . . . . . . . . . . . . . . . . . . .73 2Fh); reset value: XXh, XXXXXXXXb. . . . . . . .60 Table 150. Write data byte order . . . . . . . . . . . . . . . . . . .73 Table 110. Description of lower TCounterValReg bits . . . .60 Table 151. Address byte 0 register; address MOSI . . . . .75 Table 111. PageReg register (address 30h); reset value: 00h, Table 152. Supported interface types. . . . . . . . . . . . . . . .82 00000000b . . . . . . . . . . . . . . . . . . . . . . . . . . . .60 Table 153. Register and bit settings controlling the signal on Table 112. Description of PageReg bits. . . . . . . . . . . . . . .61 pin TX1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84 Table 113. TestSel1Reg register (address 31h); reset value: Table 154. Register and bit settings controlling the signal on 00h, 00000000b . . . . . . . . . . . . . . . . . . . . . . . .62 pin TX2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .85 Table 114. Description of TestSel1Reg bits. . . . . . . . . . . .62 Table 155. Setting of the bits RFlevel in register RFCfgReg Table 115. TestSel2Reg register (address 32h); reset value: (RFLevel amplifier deactivated). . . . . . . . . . . .86 00h, 00000000b . . . . . . . . . . . . . . . . . . . . . . . .62 Table 156. CRC coprocessor parameters . . . . . . . . . . . .93 Table 116. Description of TestSel2Reg bits. . . . . . . . . . . .62 Table 157. Interrupt sources . . . . . . . . . . . . . . . . . . . . . .95 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 132 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend Table 158. Command overview . . . . . . . . . . . . . . . . . . .101 Table 159. Testsignal routing (TestSel2Reg = 07h). . . . .107 Table 160. Description of Testsignals . . . . . . . . . . . . . . .107 Table 161. Testsignal routing (TestSel2Reg = 0Dh) . . . .108 Table 162. Description of Testsignals . . . . . . . . . . . . . . .108 Table 163. Testsignal routing (TestSel2Reg = 19h). . . . .108 Table 164. Description of Testsignals . . . . . . . . . . . . . . .108 Table 165. Testsignals description. . . . . . . . . . . . . . . . . .108 Table 166. Limiting values . . . . . . . . . . . . . . . . . . . . . . .111 Table 167. Operating conditions . . . . . . . . . . . . . . . . . . .111 Table 168. Thermal characteristics. . . . . . . . . . . . . . . . .112 Table 169. Characteristics . . . . . . . . . . . . . . . . . . . . . . .112 Table 170. SPI timing characteristics . . . . . . . . . . . . . . .117 Table 171. I2C-bus timing in Fast mode . . . . . . . . . . . . .117 Table 172. AC symbols . . . . . . . . . . . . . . . . . . . . . . . . . .119 Table 173. Timing specification for separated Read/Write strobe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119 Table 174. Timing specification for common Read/Write strobe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120 Table 175. Package information . . . . . . . . . . . . . . . . . . .122 Table 176. Abbreviations . . . . . . . . . . . . . . . . . . . . . . . .126 Table 177. Revision history. . . . . . . . . . . . . . . . . . . . . . .127 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 133 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 35. Figures Fig 1. Simplified block diagram of the PN512 . . . . . . . . .6 Fig 2. Detailed block diagram of the PN512 . . . . . . . . . .7 Fig 3. Pinning configuration HVQFN32 (SOT617-1) . . . .8 Fig 4. Pinning configuration HVQFN40 (SOT618-1) . . . .8 Fig 5. Pin configuration TFBGA64 (SOT1336-1). . . . . . .9 Fig 6. PN512 Read/Write mode. . . . . . . . . . . . . . . . . . .14 Fig 7. ISO/IEC14443A/MIFARE Read/Write mode communication diagram. . . . . . . . . . . . . . . . . . . .14 Fig 8. Data coding and framing according to ISO/IEC14443A. . . . . . . . . . . . . . . . . . . . . . . . .15 Fig 9. FeliCa reader/writer communication diagram . . .16 Fig 10. NFCIP-1 mode. . . . . . . . . . . . . . . . . . . . . . . . . . .17 Fig 11. Active communication mode . . . . . . . . . . . . . . . .18 Fig 12. Passive communication mode. . . . . . . . . . . . . . .19 Fig 13. SPI connection to host. . . . . . . . . . . . . . . . . . . . .70 Fig 14. UART connection to microcontrollers . . . . . . . . .71 Fig 15. UART read data timing diagram . . . . . . . . . . . . .73 Fig 16. UART write data timing diagram . . . . . . . . . . . . .74 Fig 17. I2C-bus interface . . . . . . . . . . . . . . . . . . . . . . . . .75 Fig 18. Bit transfer on the I2C-bus. . . . . . . . . . . . . . . . . .76 Fig 19. START and STOP conditions . . . . . . . . . . . . . . .76 Fig 20. Acknowledge on the I2C-bus. . . . . . . . . . . . . . . .77 Fig 21. Data transfer on the I2C-bus . . . . . . . . . . . . . . . .77 Fig 22. First byte following the START procedure. . . . . .78 Fig 23. Register read and write access . . . . . . . . . . . . . .79 Fig 24. I2C-bus HS mode protocol switch . . . . . . . . . . . .80 Fig 25. I2C-bus HS mode protocol frame. . . . . . . . . . . . .81 Fig 26. Connection to host controller with separated Read/Write strobes . . . . . . . . . . . . . . . . . . . . . . .83 Fig 27. Connection to host controller with common Read/Write strobes . . . . . . . . . . . . . . . . . . . . . . .83 Fig 28. Data mode detector. . . . . . . . . . . . . . . . . . . . . . .87 Fig 29. Serial data switch for TX1 and TX2. . . . . . . . . . .88 Fig 30. Communication flows using the S2C interface. . .89 Fig 31. Signal shape for SIGOUT in FeliCa card SAM mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90 Fig 32. Signal shape for SIGIN in SAM mode . . . . . . . . .90 Fig 33. Signal shape for SIGOUT in MIFARE Card SAM mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91 Fig 34. Signal shape for SIGIN in MIFARE Card SAM mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91 Fig 35. Quartz crystal connection . . . . . . . . . . . . . . . . . .99 Fig 36. Oscillator start-up time. . . . . . . . . . . . . . . . . . . .100 Fig 37. Autocoll Command . . . . . . . . . . . . . . . . . . . . . .104 Fig 38. Typical circuit diagram. . . . . . . . . . . . . . . . . . . .110 Fig 39. Pin RX input voltage range . . . . . . . . . . . . . . . .117 Fig 40. Timing diagram for SPI . . . . . . . . . . . . . . . . . . .118 Fig 41. Timing for Fast and Standardmode devices on the I2C-bus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118 Fig 42. Timing diagram for separated Read/Write strobe. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .120 Fig 43. Timing diagram for common Read/Write strobe121 Fig 44. Package outline package version (HVQFN32) .123 Fig 45. Package outline package version (HVQFN40) .124 Fig 46. Package outline package version (TFBGA64). .125 PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 134 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 36. Contents 1 General description. . . . . . . . . . . . . . . . . . . . . . 1 8.2.2.5 TxControlReg. . . . . . . . . . . . . . . . . . . . . . . . . 40 1.1 Different available versions. . . . . . . . . . . . . . . . 2 8.2.2.6 TxAutoReg. . . . . . . . . . . . . . . . . . . . . . . . . . . 41 2 Features and benefits . . . . . . . . . . . . . . . . . . . . 3 8.2.2.7 TxSelReg. . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 8.2.2.8 RxSelReg. . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 3 Quick reference data. . . . . . . . . . . . . . . . . . . . . 4 8.2.2.9 RxThresholdReg . . . . . . . . . . . . . . . . . . . . . . 44 4 Ordering information. . . . . . . . . . . . . . . . . . . . . 5 8.2.2.10 DemodReg. . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 6 8.2.2.11 FelNFC1Reg . . . . . . . . . . . . . . . . . . . . . . . . . 46 6 Pinning information. . . . . . . . . . . . . . . . . . . . . . 8 8.2.2.12 FelNFC2Reg . . . . . . . . . . . . . . . . . . . . . . . . . 47 6.1 Pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8.2.2.13 MifNFCReg . . . . . . . . . . . . . . . . . . . . . . . . . . 48 6.2 Pin description . . . . . . . . . . . . . . . . . . . . . . . . 10 8.2.2.14 ManualRCVReg. . . . . . . . . . . . . . . . . . . . . . . 49 7 Functional description . . . . . . . . . . . . . . . . . . 14 8.2.2.15 TypeBReg . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 8.2.2.16 SerialSpeedReg. . . . . . . . . . . . . . . . . . . . . . . 50 7.1 ISO/IEC 14443 A/MIFARE functionality . . . . . 14 8.2.3 Page 2: Configuration . . . . . . . . . . . . . . . . . . 52 7.2 ISO/IEC 14443 B functionality . . . . . . . . . . . . 15 8.2.3.1 PageReg . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 7.3 FeliCa reader/writer functionality . . . . . . . . . . 16 8.2.3.2 CRCResultReg . . . . . . . . . . . . . . . . . . . . . . . 52 7.3.1 FeliCa framing and coding . . . . . . . . . . . . . . . 16 8.2.3.3 GsNOffReg . . . . . . . . . . . . . . . . . . . . . . . . . . 53 7.4 NFCIP-1 mode . . . . . . . . . . . . . . . . . . . . . . . . 17 8.2.3.4 ModWidthReg . . . . . . . . . . . . . . . . . . . . . . . . 54 7.4.1 Active communication mode . . . . . . . . . . . . . 18 8.2.3.5 TxBitPhaseReg . . . . . . . . . . . . . . . . . . . . . . . 54 7.4.2 Passive communication mode . . . . . . . . . . . . 19 8.2.3.6 RFCfgReg . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 7.4.3 NFCIP-1 framing and coding . . . . . . . . . . . . . 20 8.2.3.7 GsNOnReg . . . . . . . . . . . . . . . . . . . . . . . . . . 56 7.4.4 NFCIP-1 protocol support. . . . . . . . . . . . . . . . 20 8.2.3.8 CWGsPReg. . . . . . . . . . . . . . . . . . . . . . . . . . 56 7.4.5 MIFARE Card operation mode. . . . . . . . . . . . 20 8.2.3.9 ModGsPReg . . . . . . . . . . . . . . . . . . . . . . . . . 57 7.4.6 FeliCa Card operation mode . . . . . . . . . . . . . 21 8.2.3.10 TMode Register, TPrescaler Register . . . . . . 57 8 PN512 register SET . . . . . . . . . . . . . . . . . . . . . 21 8.2.3.11 TReloadReg. . . . . . . . . . . . . . . . . . . . . . . . . . 59 8.1 PN512 registers overview. . . . . . . . . . . . . . . . 21 8.2.3.12 TCounterValReg . . . . . . . . . . . . . . . . . . . . . . 60 8.1.1 Register bit behavior. . . . . . . . . . . . . . . . . . . . 23 8.2.4 Page 3: Test. . . . . . . . . . . . . . . . . . . . . . . . . . 60 8.2 Register description . . . . . . . . . . . . . . . . . . . . 24 8.2.4.1 PageReg . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 8.2.1 Page 0: Command and status . . . . . . . . . . . . 24 8.2.4.2 TestSel1Reg. . . . . . . . . . . . . . . . . . . . . . . . . . 62 8.2.1.1 PageReg. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 8.2.4.3 TestSel2Reg. . . . . . . . . . . . . . . . . . . . . . . . . . 62 8.2.1.2 CommandReg . . . . . . . . . . . . . . . . . . . . . . . . 24 8.2.4.4 TestPinEnReg . . . . . . . . . . . . . . . . . . . . . . . . 63 8.2.1.3 CommIEnReg. . . . . . . . . . . . . . . . . . . . . . . . . 25 8.2.4.5 TestPinValueReg . . . . . . . . . . . . . . . . . . . . . . 63 8.2.1.4 DivIEnReg . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 8.2.4.6 TestBusReg . . . . . . . . . . . . . . . . . . . . . . . . . . 64 8.2.1.5 CommIRqReg. . . . . . . . . . . . . . . . . . . . . . . . . 27 8.2.4.7 AutoTestReg . . . . . . . . . . . . . . . . . . . . . . . . . 64 8.2.1.6 DivIRqReg . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 8.2.4.8 VersionReg . . . . . . . . . . . . . . . . . . . . . . . . . . 64 8.2.1.7 ErrorReg. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 8.2.4.9 AnalogTestReg. . . . . . . . . . . . . . . . . . . . . . . . 66 8.2.1.8 Status1Reg. . . . . . . . . . . . . . . . . . . . . . . . . . . 30 8.2.4.10 TestDAC1Reg . . . . . . . . . . . . . . . . . . . . . . . . 67 8.2.1.9 Status2Reg. . . . . . . . . . . . . . . . . . . . . . . . . . . 31 8.2.4.11 TestDAC2Reg . . . . . . . . . . . . . . . . . . . . . . . . 67 8.2.1.10 FIFODataReg. . . . . . . . . . . . . . . . . . . . . . . . . 32 8.2.4.12 TestADCReg . . . . . . . . . . . . . . . . . . . . . . . . . 67 8.2.1.11 FIFOLevelReg . . . . . . . . . . . . . . . . . . . . . . . . 32 8.2.4.13 RFTReg. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 8.2.1.12 WaterLevelReg. . . . . . . . . . . . . . . . . . . . . . . . 33 9 Digital interfaces. . . . . . . . . . . . . . . . . . . . . . . 68 8.2.1.13 ControlReg. . . . . . . . . . . . . . . . . . . . . . . . . . . 33 9.1 Automatic microcontroller interface detection 68 8.2.1.14 BitFramingReg . . . . . . . . . . . . . . . . . . . . . . . . 34 9.2 Serial Peripheral Interface. . . . . . . . . . . . . . . 70 8.2.1.15 CollReg. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 9.2.1 SPI read data. . . . . . . . . . . . . . . . . . . . . . . . . 70 8.2.2 Page 1: Communication. . . . . . . . . . . . . . . . . 36 9.2.2 SPI write data. . . . . . . . . . . . . . . . . . . . . . . . . 70 8.2.2.1 PageReg. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 9.2.3 SPI address byte . . . . . . . . . . . . . . . . . . . . . . 71 8.2.2.2 ModeReg . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 9.3 UART interface . . . . . . . . . . . . . . . . . . . . . . . 71 8.2.2.3 TxModeReg . . . . . . . . . . . . . . . . . . . . . . . . . . 38 9.3.1 Connection to a host . . . . . . . . . . . . . . . . . . . 71 8.2.2.4 RxModeReg . . . . . . . . . . . . . . . . . . . . . . . . . . 39 9.3.2 Selectable UART transfer speeds . . . . . . . . . 71 continued >> PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 135 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 9.3.3 UART framing. . . . . . . . . . . . . . . . . . . . . . . . . 72 17.2 Oscillator start-up time. . . . . . . . . . . . . . . . . . 99 9.4 I2C Bus Interface . . . . . . . . . . . . . . . . . . . . . . 75 18 PN512 command set. . . . . . . . . . . . . . . . . . . 100 9.4.1 Data validity . . . . . . . . . . . . . . . . . . . . . . . . . . 76 18.1 General description . . . . . . . . . . . . . . . . . . . 100 9.4.2 START and STOP conditions. . . . . . . . . . . . . 76 18.2 General behavior. . . . . . . . . . . . . . . . . . . . . 100 9.4.3 Byte format. . . . . . . . . . . . . . . . . . . . . . . . . . . 76 18.3 PN512 command overview . . . . . . . . . . . . . 101 9.4.4 Acknowledge . . . . . . . . . . . . . . . . . . . . . . . . . 77 18.3.1 PN512 command descriptions. . . . . . . . . . . 101 9.4.5 7-Bit addressing . . . . . . . . . . . . . . . . . . . . . . . 78 18.3.1.1 Idle. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 9.4.6 Register write access. . . . . . . . . . . . . . . . . . . 78 18.3.1.2 Config command . . . . . . . . . . . . . . . . . . . . . 101 9.4.7 Register read access . . . . . . . . . . . . . . . . . . . 79 18.3.1.3 Generate RandomID . . . . . . . . . . . . . . . . . . 102 9.4.8 High-speed mode. . . . . . . . . . . . . . . . . . . . . . 80 18.3.1.4 CalcCRC . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 9.4.9 High-speed transfer . . . . . . . . . . . . . . . . . . . . 80 18.3.1.5 Transmit. . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 9.4.10 Serial data transfer format in HS mode . . . . . 80 18.3.1.6 NoCmdChange . . . . . . . . . . . . . . . . . . . . . . 102 9.4.11 Switching between F/S mode and HS mode . 82 18.3.1.7 Receive . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 9.4.12 PN512 at lower speed modes . . . . . . . . . . . . 82 18.3.1.8 Transceive . . . . . . . . . . . . . . . . . . . . . . . . . . 103 10 8-bit parallel interface . . . . . . . . . . . . . . . . . . . 82 18.3.1.9 AutoColl . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 10.1 Overview of supported host controller interfaces . 18.3.1.10 MFAuthent . . . . . . . . . . . . . . . . . . . . . . . . . . 105 82 18.3.1.11 SoftReset. . . . . . . . . . . . . . . . . . . . . . . . . . . 106 10.2 Separated Read/Write strobe. . . . . . . . . . . . . 83 19 Testsignals. . . . . . . . . . . . . . . . . . . . . . . . . . . 107 10.3 Common Read/Write strobe. . . . . . . . . . . . . . 83 19.1 Selftest. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 11 Analog interface and contactless UART . . . . 84 19.2 Testbus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 11.1 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 19.3 Testsignals at pin AUX. . . . . . . . . . . . . . . . . 108 11.2 TX driver. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 19.4 PRBS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 11.3 RF level detector . . . . . . . . . . . . . . . . . . . . . . 85 20 Errata sheet . . . . . . . . . . . . . . . . . . . . . . . . . . 109 11.4 Data mode detector . . . . . . . . . . . . . . . . . . . . 86 21 Application design-in information. . . . . . . . . 110 11.5 Serial data switch . . . . . . . . . . . . . . . . . . . . . . 88 22 Limiting values . . . . . . . . . . . . . . . . . . . . . . . . 111 11.6 S2C interface support. . . . . . . . . . . . . . . . . . . 88 11.6.1 Signal shape for Felica S2C interface support 90 23 Recommended operating conditions . . . . . . 111 11.6.2 Waveform shape for ISO/IEC14443A and 24 Thermal characteristics . . . . . . . . . . . . . . . . . 112 MIFARE S2C support . . . . . . . . . . . . . . . . . . . 91 25 Characteristics . . . . . . . . . . . . . . . . . . . . . . . . 112 11.7 Hardware support for FeliCa and NFC polling 92 25.1 Timing characteristics . . . . . . . . . . . . . . . . . . 117 11.7.1 Polling sequence functionality for initiator. . . . 92 25.2 8-bit parallel interface timing . . . . . . . . . . . . . 119 11.7.2 Polling sequence functionality for target. . . . . 92 25.2.1 AC symbols . . . . . . . . . . . . . . . . . . . . . . . . . . 119 11.7.3 Additional hardware support for FeliCa and 25.2.2 AC operating specification. . . . . . . . . . . . . . . 119 NFC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 25.2.2.1 Bus timing for separated Read/Write strobe . 119 11.7.4 CRC coprocessor. . . . . . . . . . . . . . . . . . . . . . 93 25.2.2.2 Bus timing for common Read/Write strobe . 120 12 FIFO buffer. . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 26 Package information. . . . . . . . . . . . . . . . . . . 122 12.1 Accessing the FIFO buffer . . . . . . . . . . . . . . . 94 27 Package outline. . . . . . . . . . . . . . . . . . . . . . . 123 12.2 Controlling the FIFO buffer. . . . . . . . . . . . . . . 94 28 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . 126 12.3 FIFO buffer status information . . . . . . . . . . . . 94 29 Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 13 Interrupt request system. . . . . . . . . . . . . . . . . 95 30 References. . . . . . . . . . . . . . . . . . . . . . . . . . . 126 13.1 Interrupt sources overview. . . . . . . . . . . . . . . 95 31 Revision history . . . . . . . . . . . . . . . . . . . . . . 127 14 Timer unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 32 Legal information . . . . . . . . . . . . . . . . . . . . . 129 15 Power reduction modes . . . . . . . . . . . . . . . . . 98 32.1 Data sheet status. . . . . . . . . . . . . . . . . . . . . 129 15.1 Hard power-down. . . . . . . . . . . . . . . . . . . . . . 98 32.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . 129 15.2 Soft power-down mode. . . . . . . . . . . . . . . . . . 98 32.3 Disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . 129 15.3 Transmitter power-down mode. . . . . . . . . . . . 98 32.4 Licenses. . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 16 Oscillator circuitry. . . . . . . . . . . . . . . . . . . . . . 99 32.5 Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . 130 17 Reset and oscillator start-up time . . . . . . . . . 99 33 Contact information . . . . . . . . . . . . . . . . . . . 130 17.1 Reset timing requirements . . . . . . . . . . . . . . . 99 continued >> PN512 All information provided in this document is subject to legal disclaimers. © NXP Semiconductors N.V. 2016. All rights reserved. Product data sheet Rev. 5.2 — 16 June 2016 COMPANY PUBLIC 111352 136 of 137

PN512 NXP Semiconductors Full NFC Forum-compliant frontend 34 Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 35 Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 36 Contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Please be aware that important notices concerning this document and the product(s) described herein, have been included in section ‘Legal information’. © NXP Semiconductors N.V. 2016. All rights reserved. For more information, please visit: http://www.nxp.com For sales office addresses, please send an email to: salesaddresses@nxp.com Date of release: 16 June 2016 111352

Mouser Electronics Authorized Distributor Click to View Pricing, Inventory, Delivery & Lifecycle Information: N XP: PN5120A0HN1/C1,157 PN5120A0HN1/C1,151 PN5120A0HN1/C1,118 PN5120A0HN/C1,518 PN5120A0HN/C1,551 PN5120A0HN/C1,557 PN5120A0HN/C2,518 PN5120A0HN/C2,551 PN5120A0HN/C2,557 PN5120A0HN1/C2,118 PN5120A0HN1/C2,151 PN5120A0HN1/C2,157 PN5120A0ET/C2EL PN5120A0ET/C2QL PN5120A0ET/C2J PN512AA0HN1/C2,518