SL3S5050

SL3S5050
UCODE DNA Track

Rev. 3.0 15 February 2017 Product data sheet
414630 COMPANY PUBLIC
1. General description
UCODE DNA Track is a leading-edge RAIN RFID tag IC that offers long range automated
tracking and secure authentication of any type of objects
In typical RAIN RFID applications, the prime objective is to keep accurate knowledge on
where products are located at any given time point. In any retail environment, its a must
have to know which products are currently on the shelves respectively which are missing
and should be replenished immediately. Customers wont buy what they cant see. And
many customers rather walk out of the store than to wait until an assistant searches the
back-room storage.
The UCODE DNA track perfectly serves this purpose, while adding a second and very
important angle of benefit. Not only will store managers know where the products are.
They will also be able to check the authenticity of these products. In the same operation
cycle as the inventory check is done, they will be able to determine whether the alleged
fancy brand handbag is original or just a low-quality fake that was sneaked-in somewhere
in the supply chain?
Above described use cases apply to goods sold in traditional brick and mortar stores, but
even more to goods sold via the Internet. And it receives a new dimension if those goods
are medications that affect your health status.
Also in the automotive sector, it becomes more and more important to track and
guarantee authenticity for key components mounted on the car at the final assembly line
as owned by the car OEM brand.
The authentication method as integrated in UCODE DNA Track is based on AES

(Advanced Encryption Standard) and uses a 128-bit AES secret key.
It is designed in compliance with the latest relevant standards, namely:
GS1 UHF RFID Gen2 v2.0 (Annex N, Tag Alteration (Authenticate)) as well as
ISO/IEC 29167-10 for proof of origin based on AES (Advanced Encryption Standard).
This tag IC ensures state-of-the-art implementation and world-wide interoperability.
NXP Semiconductors SL3S5050
UCODE DNA Track
2. Features and benefits
2.1 Key features

Read sensitivity 19 dBm
AES authentication sensitivity 18 dBm
Write sensitivity 11 dBm
Encoding speed: 32bits per 1.5 milliseconds
Innovative functionalities
Tag authentication using AES coprocessor and 128-bit AES unique crypto-key
Privacy protection via untraceable command
Standard functionalities
Tag Power Indicator
Pre-serialization for 96-bit EPC
Integrated Product Status Flag (PSF)
Parallel encoding mode: >100 items in 60 ms
GS1 UHF RFID Gen2 v2.0 (Annex N, Tag Alteration (Authenticate))
ISO/IEC 29167-10
Compatible with single-slit antenna
2.1.1 Memory
448 bit of EPC memory
Pre-serialization for 96-bit EPC
96-bit Tag IDentifier (TID) factory locked
48-bit unique serial number factory-encoded into TID
256bit User Memory
32-bit kill password to permanently disable the tag
32-bit access password
Wide operating temperature range: 40 C up to +85 C
Minimum 100,000 write cycle endurance
Data retention 20 years
2.2 Key benefits
2.2.1 End-user benefit

Retailers differentiate themselves from competition as they become
trusted retailers that only sell authentic products.
Brands are provided with a strong method to prevent that low quality fake products get
sold under their name and damage the brand.
Brand value increases as trust of the customers goes up.
Consumers know that they get value for money. Not having to worry if the product at
hand holds what the brand name promises.
SL3S5050 All information provided in this document is subject to legal disclaimers. NXP Semiconductors N.V. 2017. All rights reserved.
Product data sheet Rev. 3.0 15 February 2017

COMPANY PUBLIC 414630 2 of 36
UCODE DNA Track
2.2.2 Antenna design benefits

High sensitivity enables smaller and cost efficient antenna designs
Selected chip impedance enables reuse of antenna designs from UCODE 7xm or
UCODE DNA
2.2.3 Label / module manufacturer benefit

Large RF pad-to-pad distance to ease antenna design
Symmetric RF inputs are less sensitive to process variation
Single-slit antenna for a more mechanically stable antenna connection
Pre-serialization of the 96-bit EPC
Extremely fast encoding of the EPC content
2.3 Supported features

All mandatory commands of GS1 UHF RFID Gen2 v2.0 are implemented
The following optional commands are implemented in conformance with GS1 UHF
RFID Gen2 v2.0 specification:
Access
Authenticate
BlockPermalock (block size = 265 bits)
BlockWrite (max. 32bit, even address only)
ReadBuffer
Untraceable
Product Status Flag bit: enables the UHF RFID tag to be used as EAS
(Electronic Article Surveillance) tag without the need for a back-end database.
Tag Power Indicator: enables the reader to select only ICs/tags that have enough
power to be written to.
Parallel encoding: allows for the ability to bring (multiple) tag(s) quickly to the OPEN
state and hence allowing single tags to be identified simply, without timing restrictions,
or multiple tags to be e.g. written to at the same time, considerably reducing the
encoding process
UCODE DNA Track can be used in combination with readers compliant with EPCglobal
Gen2 v1.2.0 standard as long as GS1 UHF RFID Gen2 v2.0 features (e.g. Authenticate)
are not needed. For access to full UCODE DNA Track functionality firmware upgrade of
the reader may be necessary.

UCODE DNA Track
3. Applications
3.1 Markets
Retail: Online, brick and mortar, omnichannel
Governments: Taxation Control, Import/Export control
Automotive
Pharma and Healthcare
3.2 Applications
High speed, automated secure income inspection
Fast and secure inventory management.
4. Ordering information
Table 1. Ordering information
Type number Package
Name IC type Description Version
SL3S5050N0FUD/00BG1 Wafer UCODE Gold bumped die on sawn 8 120 m wafer with not applicable
DNA Track 7 m Polyimide spacer;

UCODE DNA Track
5. Block diagram
The SL3S5050 IC consists of four major blocks:
- Analog Interface
- Digital Control
- Cryptographic Coprocessor
- EEPROM
The analog part provides stable supply voltage and demodulates data received from the
reader which is then processed by the digital part. Further, the modulation transistor of the
analog part transmits data back to the reader.
The digital control includes the state machines, processes the protocol and handles
communication with the EEPROM, which contains the EPC and the user data.
Cryptographic engine performs AES calculations for cryptographic authentication.
$1$/2*
',*,7$/&21752/ ((3520
5),17(5)$&(
$17,&2//,6,21
95(* 9''
5) 5($':5,7(
&21752/
$&&(66&21752/
GDWD
5(&7 '(02' LQ
((3520,17(5)$&(
&21752/
DQWHQQD 0(025<
5),17(5)$&(
GDWD &21752/
02' RXW 5:
5)
$(6&5<372
&2352&(6625 6(48(1&(5
&+$5*(3803
DDD
Fig 1. Block diagram of UCODE DNA IC

UCODE DNA Track
6. Pinning information
5) 5)
6/6WUDGHPDUN
73 73
DDD
Fig 2. Pinning bare die
6.1 Pin description

Table 2. Pin description bare die
Symbol Description
TP1 test pad 1
RF1 antenna connector 1
TP2 test pad 2
RF2 antenna connector 2

UCODE DNA Track
7. Wafer layout
7.1 Wafer layout
5) 5)
<

;

73 73

QRWWRVFDOH DDD
(1) Die to Die distance (metal sealring - metal sealring) 21.4 m, (X-scribe line width: 15 m)
(2) Die to Die distance (metal sealring - metal sealring) 21.4 m, (Y-scribe line width: 15 m)
(3) Chip step, x-length: 585m
(4) Chip step, y-length: 645 m
(5) Bump to bump distance X (RF1 - RF2): 480 m
(6) Bump to bump distance Y (TP1 - RF2): 540 m
(7) Distance bump to metal sealring X: 41.8m (outer edge - top metal)
(8) Distance bump to metal sealring Y: 41.8 m
Bump size X x Y: 60 m x 60 m
Remark: TP1 and TP2 are electrically disconnected after dicing
Fig 3. UCODE DNA Track wafer layout

UCODE DNA Track
8. Mechanical specification
The UCODE DNA Track wafers are available in 120 m thickness. The 120 m thick
wafer is enhanced with 7m Polyimide spacer resulting in less coupling between the
antenna and the active circuit, leaving more room for process control (like pressure).
8.1 Wafer specification

See Ref. 18 Data sheet - Delivery type description General specification for 8 wafer on
UV-tape with electronic fail die marking, BU-ID document number: 1093**.
8.1.1 Wafer
Table 3. Specifications
Wafer
Designation each wafer is scribed with batch number and
wafer number
Diameter 200 mm (8) unsawn - 205 mm typical sawn
on foil
Thickness
SL3S5050N0FUD/00BG1 120 m 15 m
Number of pads 4
Pad location non-diagonal / placed in chip corners
Distance pad to pad RF1-RF2 480.0 m
Distance pad to pad TP1-RF2 540.0 m
Process CMOS 0.14 m
Batch size 25 wafers
Potential good dies per wafer 77.773
Wafer backside
Material Si
Treatment ground and stress release
Roughness Ra max. 0.5 m, Rt max. 5 m
Chip dimensions
Die size including scribe 0.585 mm 0.645 mm = 0.377 mm2
Scribe line width: x-dimension = 15 m
y-dimension = 15 m
Passivation on front
Type Sandwich structure
Material PE-Nitride (on top)
Thickness 1.75 m total thickness of passivation
Polyimide spacer 7 m 1 m
Gold bump
Bump material > 99.9 % pure gold
Bump hardness 35 80 HV 0.005
Bump shear strength > 70 MPa

UCODE DNA Track
Table 3. Specifications
Bump height
SL3S5050N0FUD/00BG1 25 m[1]
Bump height uniformity
within a die 2 m
within a wafer 3 m
wafer to wafer 4 m
Bump flatness 1.5 m
Bump size
RF1, RF2 60 60 m
TP1, TP2 60 60 m
Bump size variation 5 m
[1] Because of the 7 m spacer, the bump measures 18 m relative height protruding the spacer.
8.1.2 Fail die identification

No inkdots are applied to the wafer.
Electronic wafer mapping (SECS II format) covers the electrical test results and
additionally the results of mechanical/visual inspection.
UV-tape with electronic fail die marking, BU-ID document number: 1093**
8.1.3 Map file distribution


UCODE DNA Track
9. Functional description
9.1 Air interface standards

The UCODE DNA Track fully supports all mandatory parts of the GS1 UHF RFID Gen2
v2.0 (Annex N, Tag Alteration (Authenticate)) as well as ISO 18000-63 and ISO/IEC
29167-10 specification.
9.2 Power transfer

The interrogator provides an RF field that powers the tag, equipped with a UCODE DNA
Track. The antenna transforms the impedance of free space to the chip input impedance
in order to get the maximum possible power for the UCODE DNA Track on the tag.
The RF field, which is oscillating on the operating frequency provided by the interrogator,
is rectified to provide a rectified DC voltage to the analog and digital modules of the IC.
The antenna that is attached to the chip may use a DC connection between the two
antenna pads. Therefore the UCODE DNA Track also enables loop antenna design.
9.3 Data transfer
9.3.1 Interrogator to tag Link

An interrogator transmits information to the UCODE DNA Track by modulating a UHF RF
signal. The UCODE DNA Track receives both information and operating energy from this
RF signal. Tags are passive, meaning that they have no battery and receive all of their
operating energy from the interrogator's RF waveform.
An interrogator is using a fixed modulation and data rate for the duration of at least one
inventory round. It communicates to the UCODE DNA Track by modulating an RF carrier.
For further details, refer to Ref. 1. Interrogator-to-tag (R=>T) communications.
9.3.2 Tag to interrogator Link

Upon transmitting a valid command, an interrogator receives information from a UCODE
DNA Track tag by transmitting an unmodulated RF carrier and listening for a
backscattered reply. The UCODE DNA Track backscatters by switching the reflection
coefficient of its antenna between two states in accordance with the data being sent. For
further details, refer to Ref. 1.

UCODE DNA Track
9.4 Supported commands

The UCODE DNA Track supports all mandatory GS1 UHF RFID Gen2 v2.0
commands.
In addition the UCODE DNA Track supports the following optional commands:
Access
Access command allows to transition the from the open to the secured state
Authenticate
Authenticate command is used to pass on data to the cryptographic processor
on the Tag
BlockPermalock (block size = 256 bits)
BlockWrite (32 bits on even addresses only)
BlockWrite command allows to write 2 words (16bit) into the memory
ReadBuffer
The ReadBuffer command is used to read stored data from the ResponseBuffer
of the Tag.
Untraceable
The Untraceable command can be used to truncate the visible part of the EPC, TID
and/or User Memory to prevent that a Tag can be recognize that was observed
previously.
The "untraceable indicator" (U) is not been implemented (hardwired to "0").
Besides supporting all mandatory parts of ISO/IEC 29167-10, UCODE DNA Track also
supports the following:
TAM1 for Tag Authentication

Security timeout
9.5 List of error codes

Table 4. Error codes
Error Code Description
01h Not supported error
03h memory overrun
0Bh Insufficient power error

UCODE DNA Track
9.6 Tag Authentication using AES

Advanced Encryption Standard (AES) is an open, royalty-free, symmetric block cipher
based on so-called substitution-permutation networks. AES is highly suitable for efficient
implementation in both software and hardware, including extremely constrained
environments such as RFID Tags. The AES cipher is standardized as ISO/IEC 18033-3.
The UCODE DNA Track can be used for proof of origin. In principle, the Tag proves its
origin by demonstrating that it knows the value of the secret key. That proof can be
delivered by executing a challenge-response authentication protocol whereby the
Interrogator first sends a challenge (random number) to the Tag. The Tag encrypts this
challenge and returns the result to the Interrogator. The Interrogator, who should know the
secret key, decrypts the returned result using the same key and verifies whether the
challenge is identical to the challenge that has been sent to the Tag.
NOTE:
Free AES source code examples can be found on various websites. Some convenient
tools for checking an implementation are the AES online calculators that can be found at
http://testprotect.com/appendix/AEScalc and http://aes.online-domain-tools.com/.
9.6.1 AES Authentication examples for TAM1

Parameter values used for example
Table 5. Parameter and values for Tag Authentication example

Parameter Bits Value
Key0 [127:0] 0123456789ABCDEF0123456789ABCDEFh
IChallenge_TAM1 [79:0] FD5D8048F48DD09AAD22h
C_TAM1 [15:0] 96C5h
TRnd_TAM1 [31:0] 4FA81D3Ch
NOTE:
The value of TRnd_TAM1 is generated by the Tag and therefore cannot be controlled.
This theoretical example uses a randomly chosen value.
TAM 1 Message
The next table shows the composition of the TAM1 message with:
KeyID=00 b for Key0
Table 6. TAM1 Message

AuthMethod CustomData TAM1_RFU KeyID IChallenge_TAM1
# of bits 2 1 5 8 80
value 00b 0b 00000b 00h FD5D8048F48DD09AAD22h
The TAM1 Message derived from this format is: 0000FDFD8048F48DD09AAD22h and has a
length of 96 (or 60h) bits.

UCODE DNA Track
Authenticate Command
The next table shows the Authentication command for TAM1, using the variables:
SenRep = 1 (send reply)

IncRepLen = 1 (include length)
CSI = 00h (for ISO/IEC 29167-10 (AES-128) crypto-suite)
Length = 96 (or 60h) bits
Message = 0000FDFD8048F48DD09AAD22h
Table 7. Authentication command for TAM1 example

Command RFU SenRep IncRep CSI Length Message RN CRC-16
Len
# of bits 8 2 1 1 8 12 Variable 16 16
value D5h 00b 1 1 00h 60h 0000FD5D8048F48DD09AAD22h handle CRC-16
The TAM1 Message derived from this format is: 0000FD5D8048F48DD09AAD22h and has a
length of 96 (or 60h) bits.
Authenticate TAM1 execution

According to ISO/IEC29167-10 the formula for Tag Authentication is:
AES-ECB-ENC(Key0, C_TAM1 II TRnd_TAM1 II IChallange_TAM1 )
Using the variables:
Key0 = 0123456789ABCDEF0123456789ABCDEFh
C_TAM1 = 96C5h
TRnd_TAM1 = 4FA81D3Ch
IChallenge_TAM1 = FD5D8048F48DD09AAD22h
Filling the variables leads to:
AES-ECB-ENC(123456789ABCDEF0123456789ABCDEFh, 96C5h II 4FA81D3Ch II

FD5D8048F48DD09AAD22h)
Using the online AES calculator at: http://testprotect.com/appendix/AEScalc,

the result of the AES-ECB encryption is: 3C6410EF3498A29D6C0F30F4F17A56E5h

UCODE DNA Track
Authenticate TAM1 reply

The next table shows the Authentication TAM1 reply:
Table 8. Authenticate TAM1 reply

Barker Code Done Header Length Response RN CRC-16
# of bits 7 1 1 16 Variable 16 16
value 1110010b 1b 0b 0101h 3C6410EF3498A29D6C0F30F4F17A56E5h handle CRC-16
Done = 1 computation done)

Header = 0 (no error)
Length = 0101h (128 or 080h in 15bits plus even parity bit)
Response = 3C6410EF3498A29D6C0F30F4F17A56E5h
Verification on Host Side

The host needs to decrypt the result with the same value for Key0:
Key0 = 0123456789ABCDEF0123456789ABCDEFh
Response = 3C6410EF3498A29D6C0F30F4F17A56E5h
Using the online AES calculator at: http://testprotect.com/appendix/AEScalc,
the AES-ECB decryption results into: 96C54FA81D3CFD5D8048F48DD09AAD22h
That can be split into:
C_TAM1 = 96C5h
TRnd_TAM1 = 4FA81D3Ch
IChallenge_TAM1 = FD5D8048F48DD09AAD22h
So the Tag can be considered as authentic.

UCODE DNA Track
9.7 Insertion and activation of secret key-Key0

This section describes how Key0 can be inserted, verified and activated.
9.7.1 Key insertion and activation

Key0 can be inserted via the standard Write or BlockWrite command. They can be
activated by writing the Header content E200h into the Key header and executing a new
power up sequence.
The Tags BlockWrite command only supports writing a maximum block size of 32 bits, so
4 BlockWrite commands will be necessary to insert all 128 bits of the keys.
After a key has been activated, it cannot be accessed by the Read command anymore.
Note:
The keys can be verified and modified as long as they are not activated. It is
recommended to verify the keys before activation.
The following table shows the start word addresses in User Memory for Key0 and the
header:
Table 9. Start address for Key0

User Memory word address Size in bits
Key0 C0h 128
Key0 header C8h 16
Note:
The UCODE DNA Tack does not support a Read with WordCount=0 within this special key address
range.
9.7.2 Example of key insertion, verification and activation

This section describes how the key "0123456789ABCDEF0123456789ABCDEFh" can be
inserted, verified and activated as value for Key0.
Note:
Since the value of the key is transmitted without confidentially protection, the process of
inserting and activating a key must take place in a secure environment where intruders
have no chance to observe the communication over the air interface.
The next table shows how to use 4 consecutive BlockWrite commands to insert the value
for Key0.
Table 10. BlockWrite command to write value for Key0

Command MemBank WordPtr WordCount Data RN CRC-16
# of bits 8 2 8 8 32 16 16
value C7h 11b C0h 02h 01234567h handle CRC-16

# of bits 8 2 8 8 32 16 16
value C7h 11b C2h 02h 89ABCDEFh handle CRC-16

UCODE DNA Track

# of bits 8 2 8 8 32 16 16
value C7h 11b C4h 02h 01234567h handle CRC-16

# of bits 8 2 8 8 32 16 16
value C7h 11b C6h 02h 89ABCDEFh handle CRC-16
Note: According to Gen2V2, unlike a Write, the data in a BlockWrite are not cover-coded,
and an Interrogator need not issue a Req_RN before issuing a BlockWrite.
The next table shows how to use the Read command to verify the value of Key0:
Table 11. Read command to verify the value for Key0

Command MemBank WordPtr WordCount RN CRC-16
# of bits 8 2 8 8 16 16
value C2h 11b C0h 08h handle CRC-16
The next table shows the reply if the Read command is successful
Table 12. Tag reply to successful Read command

Command Data RN CRC-16
# of bits 8 32 16 16
value C7h 0123456789ABCDEF0123456789ABCDEFh handle CRC-16
If the received value is correct, the value can be locked and read protected and Key0 can
be activated. The next table shows how to use the BlockWrite command to do that with:
Command code for BlockWrite is according to the standard fixed to C7h.

MemBank = 11b (for User Memory)
WordPtr = C8h to specify the 16-bit memory word for the Key0 header
WordCount = 01h to specify 1 16-bit memory words
Table 13. BlockWrite command to write value for Key0

# of bits 8 2 8 8 16 16 16
value C7h 11b C8h 01h E200h handle CRC-16
After a successful execution of this BlockWrite command together with a new power up
sequence, Key0 has been activated and cannot be accessed by the Read command
anymore.

UCODE DNA Track
9.8 UCODE DNA Track memory

The UCODE DNA Track memory is implemented according to GS1 UHF RFID Gen2
v2.0 and organized in four banks:
Table 14. UCODE DNA Track memory sections

Name Size Bank
Reserved memory (32-bit ACCESS and 32-bit KILL password) 64 bit 00b
EPC (excl. CRC, PC, XPC) 448 bit 01b
TID (including permalocked unique 48-bit serial number) 96 bit 10b
User Memory 256bit 11b
The logical address of all memory banks begins at zero (0000h).
As part of the EPC bank 01, one configuration word to handle the UCODE DNA Track
specific features is available at address 200h. The configuration word is described in
detail in Section 9.9.1 UCODE DNA Track features control mechanism.
Also available is specially designed virtual user memory which is used for storing
authentication keys. Namely, UCODE DNA Track supports one128-bit AES authentication
keys: Key0. They are stored in the internal memory of the tag IC and can either be
pre-programmed and locked by NXP or can be inserted by the user. When not
pre-programmed by NXP, the keys can be temporarily accessed (up until they are
locked/confirmed) by addressing virtual user memory addresses:
C00h C7Fh for the 128 bits of Key0

C80h C8Fh for the 16 bits of the Key0 confirmation/lock address
Note: The virtual memory addresses for Key0 can only be addressed until the key become
activated (i.e. locked). After activation, the keys can only be used (but not accessed) for
the purpose of performing tag IC authentication.
Also note that a Read command with WordCount=0 is not supported within this special
key address range.
UCODE DNA Track also supports a ResponseBuffer of 256 bits that is stored in the
internal memory of IC and can only be accessed by the ReadBuffer command.
The TID complies to the extended tag Identification scheme according to GS1 EPC Tag
Data Standard 1.9.

UCODE DNA Track
9.8.1 UCODE DNA Track overall memory map

Table 15. UCODE DNA Track overall memory map
Bank Memory Type Content Initial Remark
address address
Bank 00 00h to 1Fh reserved kill password all 00h if no TP unlocked memory[6]
20h to 3Fh reserved access password all 00h if no TP unlocked memory[6]
Bank 01 00h to 0Fh EPC CRC-16: refer to Ref. 14 memory mapped
EPC calculated CRC
10h to 14h EPC EPC length 00110b unlocked memory
15h EPC UMI (0b for no UM) 1b locked memory
16h EPC XPC indicator - computed over 210h-217h
in the case when T=0
17h to 1Fh EPC numbering system indicator 00h unlocked memory
20h to 1DFh EPC EPC [1] unlocked memory
Bank 01 200h EPC RFU 0b locked memory
ConfigWord 201h EPC RFU 0b locked memory
202h EPC Parallel encoding 0b Action bit[4]
203h EPC RFU 0b locked memory
204h EPC Tag Power Indicator 0b Action bit[4]
209h EPC max. backscatter strength 1b permanent bit[5]
20Ah EPC RFU 0b locked memory
20Bh EPC RFU 0b locked memory
20Ch EPC RFU 0b locked memory
20Dh EPC RFU 0b locked memory
20Eh EPC RFU 0b locked memory
20Fh EPC PSF alarm flag 0b Permanent bit[5]
210h EPC XPC - XEB 0b locked memory
211h to 217h EPC XPC - RFU 0b unlocked memory
218h EPC XPC - B 0b locked memory
219h EPC XPC - C 0b computed via Authenticate
21Ah EPC XPC - SLI 0b computed
21Bh EPC XPC - TN 0b locked memory
21Ch EPC XPC - U 0b locked memory
21Dh EPC XPC - K 1b computed
21Eh EPC XPC - NR 0b unlocked memory
21Fh EPC XPC - H 0b unlocked memory

UCODE DNA Track
Table 15. UCODE DNA Track overall memory map

Bank Memory Type Content Initial Remark
address address
Bank 10 00h to 07h TID allocation class identifier 1110 0010b locked memory
TID 08h to 13h TID tag mask designer identifier C06h locked memory
14h TID config word indicator 1b[2] locked memory
14h to 1Fh TID tag model number TMNR[3] locked memory
20h to 2Fh TID XTID header 2000h locked memory
30h to 5Fh TID serial number SNR locked memory
[1] HEX E2C0 6C12 0000 nnnn nnnn nnnn where n are the nibbles of the SNR from the TID
[2] Indicates the existence of a Configuration Word at the end of the EPC number
[3] See Figure 4
[4] Action bits: meant to trigger a feature upon a SELECT command on the related bit ref feature control
mechanism, seeSection 9.9.1 UCODE DNA Track features control mechanism
[5] Permanent bit: permanently stored bits in the memory; Read/Writeable according to EPC bank lock status,
see Section 9.9.1 UCODE DNA Track features control mechanism
[6] Can also be delivered pre-programmed and diversified.

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x
xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx
COMPANY PUBLIC xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx
Product data sheet
SL3S5050
NXP Semiconductors
9.8.2 UCODE DNA Track TID memory details
Model Number
Mask
First 48 bit of TID Config
Class ID Designer Sub Version XTID
memory Word
ID Version Nr. (Silicon) Nr. Header
Indicator
UCODE
E2C06C122000 E2h C06h 1b 1000b 0010010b 2000h
DNA
Addresses 00h 5Fh
TID
All information provided in this document is subject to legal disclaimers.
MS Byte LS Byte
Rev. 3.0 15 February 2017
MSBit LSBit MSBit LSBit
Bit
Address 00h 07h 08h 13h 14h 1Fh 20h 2Fh 30h 5Fh
414630
Class Identifier Mask-Designer Identifier Model Number XTID Serial Number
Bits 7 0 11 0 11 0 15 0 47 0
E2h C06h C12h 2000h
(EAN.UCC) (NXP; with XTID) (UCODE DNA Track) (indication of 48bit 000000000000h to FFFFFFFFFFFFh
unique SNR)
Address 14h 18h 19h 1Fh

S.
I. Sub Version Number Model Number
B.
Bits 0 3 0 6 0
1b 1000b 0010010b
(UCODE DNA Track) aaa-026600
Fig 4. UCODE DNA Track TID memory structure

NXP Semiconductors N.V. 2017. All rights reserved.
SL3S5050
UCODE DNA Track
20 of 36
UCODE DNA Track
9.9 Supported features

The UCODE DNA Track is equipped with a number of features similar to previous
UCODE generation. These include:
- Backscatter strength reduction
- Pre-serialization of the 96-bit EPC
- Parallel encoding
- Tag Power Indicator
- Product Status Flag (PSF)
- Single-slit antenna solution
These features are implemented in such a way that standard GS1 Gen2 v2.0 READ /
WRITE / ACCESS / SELECT commands can be used to operate these features.
The Configuration Word, as mentioned in the memory map, describes the additional
features located at address 200h of the EPC memory.
Bit 14h of the TID indicates the existence of a Configuration Word. This flag will enable the
selection of configuration word enhanced transponders in mixed tag populations.
9.9.1 UCODE DNA Track features control mechanism

The different features of the UCODE DNA Track can be activated / de-activated by
addressing or changing the content of the corresponding bit in the configuration word
located at address 200h in the EPC memory bank (see Table 16). The de-activation of the
action bit features will only happen after chip reset.
Table 16. Configuration word UCODE DNA Track

Locked memory Action bit Locked memory Action bit Locked memory
RFU RFU Parallel RFU Tag Power RFU RFU RFU
encoding Indicator
0 1 2 3 4 5 6 7
Table 17. Configuration word UCODE DNA Track

Locked Permanent Locked memory Permanent
memory bit bit
RFU max. RFU RFU RFU RFU RFU PSF Alarm bit
backscatter
strength
8 9 10 11 12 13 14 15
The configuration word contains 2 different type of bits:

Action bits: meant to trigger a feature upon a SELECT command on the related bit:
Parallel encoding
Tag Power indicator

UCODE DNA Track
Permanent bits: permanently stored bits in the memory

Max. Backscatter Strength
PSF Alarm bit
The activation or the de-activation of the feature behind the permanent bits happens only
when attempting to write a 1 value to the related bit (value toggling) - writing 0 value
will have no effect.
If the feature is activated, the related bit will be read with a 1 value and, if de-activated,
with a 0 value.
The permanent bits can only be toggled by using standard EPC WRITE (not a BlockWrite)
if the EPC bank is unlocked or within the SECURED state if the EPC is locked. If the EPC
is permalocked, they cannot be changed.
Action bits will trigger a certain action only if the pointer of the SELECT command exactly
matches the action-bit address (i.e. 202h or 204h), if the length=1 and if mask=1b
(no multiple trigger of actions possible within one single SELECT command).
After issuing a SELECT to any action bits, an interrogator shall transmit CW for
RTCal + 80 s before sending the next command.
If the truncate bit in the SELECT command is set to "1" the SELECT will be ignored.
A SELECT on action bits will not change the digital state of the chip.
The action bits can be triggered regardless if the EPC memory is unlocked, locked or
permalocked.
9.9.2 Backscatter strength reduction

The UCODE DNA Track features two levels of backscatter strengths. Per default,
maximum backscatter is enabled in order to enable maximum read rates. When clearing
the flag, the strength can be reduced if needed.
9.9.3 Pre-serialization of the 96-bit EPC

Description
The 96-bit EPC, which is the initial EPC length settings of UCODE DNA Track, will be
delivered pre-serialized with the 48-bit serial number from the TID.
Use cases and benefits

With a pre-serialized EPC, the encoding process of the tags with UCODE DNA Track gets
simpler and faster as it only needs to encode the SKU (58-bit header of the EPC).

UCODE DNA Track
9.9.4 Parallel encoding

Description
This feature of the UCODE DNA Track can be activated by the Parallel encoding bit in
the Configuration-Word located at (202h).
Upon issuing an EPC SELECT command on the Parallel encoding bit, in a population of
UCODE DNA Track tags, a subsequent QUERY brings all tags go the OPEN state with a
specific handle (AAAAh).
Once in the OPEN state, for example a WRITE command will apply to all tags in the
OPEN state (see Figure 6). This parallel encoding is considerably lowering the encoding
time compared to a standard implementation (see Figure 5).
The number of tags that can be encoded at the same time depends on the strength of the
reader signal. Since all tags will backscatter their ACKNOWLEDGE (ACK) response at
the same time, the reader will observe collision in the signal from the tags.

xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxx x x x xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xx xx xxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxx xxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxx x x
xxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxx
COMPANY PUBLIC xxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxx xxx
Product data sheet
SL3S5050
NXP Semiconductors
QUERY/Adjust/Rep QUERY/Adjust/Rep
READER
(16-bit) (16-bit)
Req_RN
Req_RN
Req_RN
Req_RN
WRITE
WRITE
ACK
ACK
TAG 1
PC + EPC
handle
handle
RN16
RN16
All information provided in this document is subject to legal disclaimers.
Rev. 3.0 15 February 2017
Tags
414630
TAG 2
PC + EPC
handle
handle
handle
RN16
Only TAG 1 is being addressed
Only TAG 2 is being addressed

aaa-006843
Fig 5. Example of 16-bit Write command with standard EPC Gen 2 commands
SL3S5050
UCODE DNA Track
24 of 36
UCODE DNA Track
6(/(&7RQ
3DUDOOHO
HQFRGLQJELW 48(5<4
ELW
5($'(5
5HTB51
:5,7(
7$*
$$$$K
$$$$K
$$$$K 7$*
$$$$K
$$$$K
7DJV $$$$K
7$*Q
$$$$K
$$$$K
$$$$K
$OO8&2'('1$7UDFNWDJVUHFHLYHWKH&RPPDQG
DDD
Fig 6. Illustration of Parallel encoding for 16-bit Write command
Parallel encoding feature of UCODE DNA Track can enable ultra fast bulk encoding.
Taking in addition advantage of the pre-serialization scheme of UCODE DNA Track, the
same SKU can be encoded in multiple tags as the EPC will be delivered pre-serialized
already.
In the case of only one tag answering (like in printer encoding), this feature could be used
to save some overhead in commands to do direct EPC encoding after the handle reply.
Since this is a custom-specific feature of UCODE DNA Track (taken over from our
previous UHF tag IC UCODE 7), the use of this feature requires the same support on the
reader side as for previous UCODE products.

UCODE DNA Track
9.9.5 Tag Power Indicator

Description
Upon a SELECT command on the Tag Power Indicator, located in the config word 204h,
an internal power check on the chip is performed to see if the power level is sufficient to
perform a WRITE command. The decision level is defined as nominal WRITE sensitivity
minus 1dB. In the case, there is enough power, the SELECT command is matching and
non-matching if not enough power. The tag can then be singulated by the standard
inventory procedure.
This feature gives the possibility to select only the tag(s) that receive enough power to be
written during e.g. printer encoding in a dense environment of tags even though the
reader may read more than one tag (see Figure 7 for illustration). The power level still
needs to be adjusted to transmit enough writing power to one tag only to do one tag
singulation.
Power level for READ/WRITE
too low/too low
OK/too low
OK/too low
OK/OK Only this tag will select itself
OK/too low
OK/too low
too low/too low aaa-005662
Fig 7. Selection of tags with Tag Power Indicator feature

UCODE DNA Track
9.9.6 Product Status Flag (PSF)

Description
The PSF is a general-purpose bit located in the Configuration word at address 20Fh with
a value that can be freely changed.
The PSF bit can be used as an EAS (Electronic Article Surveillance) flag, quality checked
flag or similar.
In order to detect the tag with the PSF activated, an EPC SELECT command selecting the
PSF flag of the Configuration word can be used. In the following inventory round only PSF
enabled chips will reply their EPC number.
9.9.7 Single-slit antenna solution

Description
In UCODE DNA Track the test pads TP1 and TP2 are electrically disconnected meaning
they are not electrically active and can be safely short-circuited to the RF pads RF1 and
RF2 (see Figure 8).
Standard assembly Single-slit assembly
Supporting pads
aaa-005857
Fig 8. Standard antenna design versus single-slit antenna
Uses cases and benefits
Using single-slit antenna enables easier assembly and antenna design. Inlay
manufacturer will only have to take care about one slit of the antenna instead of two in
case all pads need to be disconnected from each other.
Additionally single-slit antenna assembly and the related increased input capacitance (see
Table 19) can be used advantageously over the standard antenna design as additional
room for optimization to different antenna design.

UCODE DNA Track
10. Limiting values

Table 18. Limiting values[1][2]
In accordance with the Absolute Maximum Rating System (IEC 60134).
Voltages are referenced to RFN
Symbol Parameter Conditions Min Max Unit
Bare die limitations
Tstg storage temperature 55 +125 C
Tamb ambient temperature 40 +85 C
VESD electrostatic discharge Human body model [3] - 2 kV
voltage
Pad limitations
Pi input power maximum power - 100 mW
dissipation, RFP pad
[1] Stresses above those listed under Absolute Maximum Ratings may cause permanent damage to the
device. This is a stress rating only and functional operation of the device at these or any conditions other
than those described in the Operating Conditions and Electrical Characteristics section of this specification
is not implied.
[2] This product includes circuitry specifically designed for the protection of its internal devices from the
damaging effects of excessive static charge. Nonetheless, it is suggested that conventional precautions be
taken to avoid applying greater than the rated maxima.
[3] For ESD measurement, the die chip has been mounted into a CDIP20 package.

UCODE DNA Track
11. Characteristics
11.1 UCODE DNA Track bare die characteristics

Table 19. UCODE DNA Track RF interface characteristics (RF1, RF2)
Symbol Parameter Conditions Min Typ Max Unit
fi input frequency 840 - 960 MHz
Pmin minimum operating power READ sensitivity [1][3][7] - 18.5 - dBm
WRITE sensitivity [2] - 11 - dBm
AES sensitivity [2] - 18 - dBm
reduced operating [2] - +7 - dBm
range
t encoding speed 16 bit or 32 bit, when - 1.5 - ms
memory content is
zero
16 bit or 32 bit, any - 2.6 - ms
memory content
t authentication speed TAM1 - slow - 5.8 - ms
TAM1 - fast - 1.8 - ms
Ci chip input capacitance parallel [3][4] - 0.63 - pF
Z input impedance 866 MHz [3][4] - 19 j284 -
915 MHz [3][4] - 17 j274 -
953 MHz [3][4] - 17 j265 -
Z Typical assembled impedance [8] 915 MHz [5] - 26 j235
Z Typical assembled impedance in 915 MHz [8] [5][6] - 16 j181 -
case of single-slit antenna assembly
Tag Power Indicator mode
Pi(min) minimum input power level to be [2] - 10 - dBm
able to select the tag
[1] Power to process a QUERY command

[2] Tag sensitivity on a 2 dBi gain antenna
[3] Measured with a 50 source impedance directly on the chip
[4] At minimum operating power
[5] The antenna shall be matched to this impedance
[6] Depending on the specific assembly process, sensitivity losses of few tenths of dB might occur
[7] Results in approximately -19 dBm tag sensitivity with a 2 dBi gain antenna
[8] Assuming a 100 fF additional input capacitance, 320 fF in case of single slit antenna
Table 20. UCODE DNA Track memory characteristics

Symbol Parameter Conditions Min Typ Max Unit
EEPROM characteristics
tret retention time Tamb 55 C 20 - - year
Nendu(W) write endurance 100k - - cycle

UCODE DNA Track
12. Package outline

This section is not applicable for this kind of device.
13. Packing information
13.1 Wafer
14. Abbreviations
Table 21. Abbreviations
Acronym Description
CRC Cyclic Redundancy Check
CW Continuous Wave
DSB-ASK Double Side Band-Amplitude Shift Keying
DC Direct Current
EAS Electronic Article Surveillance
EEPROM Electrically Erasable Programmable Read Only Memory
EPC Electronic Product Code (containing Header, Domain Manager, Object Class
and Serial Number)
FM0 Bi phase space modulation
G2 Generation 2
IC Integrated Circuit
PIE Pulse Interval Encoding
PSF Product Status Flag
RF Radio Frequency
UHF Ultra High Frequency
SECS Semi Equipment Communication Standard
TID Tag IDentifier

UCODE DNA Track
15. References
[1] EPC Radio-Frequency Identity Protocols Generation-2 UHF RFID, Specification
for RFID Air Interface Protocol for Communications at 860 MHz 960 MHz, Version
2.2.0 (November 2013)
[2] EPCglobal: EPC Tag Data Standard Version 1.9, ratified Nov-2014
[3] European Telecommunications Standards Institute (ETSI), EN 302 208:
Electromagnetic compatibility and radio spectrum matters (ERM) Radio-frequency
identification equipment operating in the band 865 MHz to 868 MHz with power
levels up to 2 W, Part 1 Technical characteristics and test methods
[4] European Telecommunications Standards Institute (ETSI), EN 302 208:
Electromagnetic compatibility and radio spectrum matters (ERM) Radio-frequency
identification equipment operating in the band 865 MHz to 868 MHz with power
levels up to 2 W, Part 2 Harmonized EN under article 3.2 of the R&TTE directive
[5] [CEPT1]: CEPT REC 70-03 Annex 1
[6] [ETSI1]: ETSI EN 330 220-1, 2
[7] [ETSI3]: ETSI EN 302 208-1, 2 V<1.1.1> (2004-09-Electromagnetic compatibility
And Radio spectrum Matters (ERM) Radio Frequency Identification Equipment
operating in the band 865 - MHz to 868 MHz with power levels up to 2 W Part 1:
Technical characteristics and test methods.
[8] [FCC1]: FCC 47 Part 15 Section 247
[9] ISO/IEC Directives, Part 2: Rules for the structure and drafting of International
Standards
[10] ISO/IEC 3309: Information technology Telecommunications and information
exchange between systems High-level data link control (HDLC) procedures
Frame structure
[11] ISO/IEC 15961: Information technology, Automatic identification and data capture
Radio frequency identification (RFID) for item management Data protocol:
application interface
[12] ISO/IEC 15962: Information technology, Automatic identification and data capture
techniques Radio frequency identification (RFID) for item management Data
protocol: data encoding rules and logical memory functions
[13] ISO/IEC 15963: Information technology Radio frequency identification for item
management Unique identification for RF tags
[14] ISO/IEC 18000-1: Information technology Radio frequency identification for item
management Part 1: Reference architecture and definition of parameters to be
standardized
[15] ISO/IEC DIS 18000-63: Information technology Radio frequency identification for
item management Part 63: Parameters for air interface communications at 860
MHz to 960 MHz Type C (2013-01-15)
[16] ISO/IEC 19762: Information technology AIDC techniques Harmonized vocabulary
Part 3: radio-frequency identification (RFID)
[17] U.S. Code of Federal Regulations (CFR), Title 47, Chapter I, Part 15:
Radio-frequency devices, U.S. Federal Communications Commission.
[18] Data sheet - Delivery type description General specification for 8 wafer on
UV-tape with electronic fail die marking, BU-ID document number: 1093**1

UCODE DNA Track
[19] ISO 29167-10:2015: Information technology Automatic identification and data

capture techniques Part 10: Crypto suite AES-128 security services for air
interface communications
1. ** ... document version number

UCODE DNA Track
16. Revision history

Table 22. Revision history
Document ID Release date Data sheet status Change notice Supersedes
SL3S5050 v. 3.0 20170215 Product data sheet - -

UCODE DNA Track
17. Legal information
17.1 Data sheet status

Document status[1][2] Product status[3] Definition
Objective [short] data sheet Development This document contains data from the objective specification for product development.
Preliminary [short] data sheet Qualification This document contains data from the preliminary specification.
Product [short] data sheet Production This document contains the product specification.
[1] Please consult the most recently issued document before initiating or completing a design.
[2] The term short data sheet is explained in section Definitions.
[3] The product status of device(s) described in this document may have changed since this document was published and may differ in case of multiple devices. The latest product status
information is available on the Internet at URL http://www.nxp.com.
17.2 Definitions Suitability for use NXP Semiconductors products are not designed,
authorized or warranted to be suitable for use in life support, life-critical or
safety-critical systems or equipment, nor in applications where failure or
Draft The document is a draft version only. The content is still under
malfunction of an NXP Semiconductors product can reasonably be expected
internal review and subject to formal approval, which may result in
to result in personal injury, death or severe property or environmental
modifications or additions. NXP Semiconductors does not give any
damage. NXP Semiconductors and its suppliers accept no liability for
representations or warranties as to the accuracy or completeness of
inclusion and/or use of NXP Semiconductors products in such equipment or
information included herein and shall have no liability for the consequences of
applications and therefore such inclusion and/or use is at the customers own
use of such information.
risk.
Short data sheet A short data sheet is an extract from a full data sheet
Applications Applications that are described herein for any of these
with the same product type number(s) and title. A short data sheet is intended
products are for illustrative purposes only. NXP Semiconductors makes no
for quick reference only and should not be relied upon to contain detailed and
representation or warranty that such applications will be suitable for the
full information. For detailed and full information see the relevant full data
specified use without further testing or modification.
sheet, which is available on request via the local NXP Semiconductors sales
office. In case of any inconsistency or conflict with the short data sheet, the Customers are responsible for the design and operation of their applications
full data sheet shall prevail. and products using NXP Semiconductors products, and NXP Semiconductors
accepts no liability for any assistance with applications or customer product
Product specification The information and data provided in a Product design. It is customers sole responsibility to determine whether the NXP
data sheet shall define the specification of the product as agreed between Semiconductors product is suitable and fit for the customers applications and
NXP Semiconductors and its customer, unless NXP Semiconductors and products planned, as well as for the planned application and use of
customer have explicitly agreed otherwise in writing. In no event however, customers third party customer(s). Customers should provide appropriate
shall an agreement be valid in which the NXP Semiconductors product is design and operating safeguards to minimize the risks associated with their
deemed to offer functions and qualities beyond those described in the applications and products.
Product data sheet.
NXP Semiconductors does not accept any liability related to any default,
damage, costs or problem which is based on any weakness or default in the
17.3 Disclaimers customers applications or products, or the application or use by customers
third party customer(s). Customer is responsible for doing all necessary
testing for the customers applications and products using NXP
Limited warranty and liability Information in this document is believed to
Semiconductors products in order to avoid a default of the applications and
be accurate and reliable. However, NXP Semiconductors does not give any
the products or of the application or use by customers third party
representations or warranties, expressed or implied, as to the accuracy or
customer(s). NXP does not accept any liability in this respect.
completeness of such information and shall have no liability for the
consequences of use of such information. NXP Semiconductors takes no Limiting values Stress above one or more limiting values (as defined in
responsibility for the content in this document if provided by an information the Absolute Maximum Ratings System of IEC 60134) will cause permanent
source outside of NXP Semiconductors. damage to the device. Limiting values are stress ratings only and (proper)
operation of the device at these or any other conditions above those given in
In no event shall NXP Semiconductors be liable for any indirect, incidental,
the Recommended operating conditions section (if present) or the
punitive, special or consequential damages (including - without limitation - lost
Characteristics sections of this document is not warranted. Constant or
profits, lost savings, business interruption, costs related to the removal or
repeated exposure to limiting values will permanently and irreversibly affect
replacement of any products or rework charges) whether or not such
the quality and reliability of the device.
damages are based on tort (including negligence), warranty, breach of
contract or any other legal theory. Terms and conditions of commercial sale NXP Semiconductors
Notwithstanding any damages that customer might incur for any reason products are sold subject to the general terms and conditions of commercial
whatsoever, NXP Semiconductors aggregate and cumulative liability towards sale, as published at http://www.nxp.com/profile/terms, unless otherwise
customer for the products described herein shall be limited in accordance agreed in a valid written individual agreement. In case an individual
with the Terms and conditions of commercial sale of NXP Semiconductors. agreement is concluded only the terms and conditions of the respective
agreement shall apply. NXP Semiconductors hereby expressly objects to
Right to make changes NXP Semiconductors reserves the right to make applying the customers general terms and conditions with regard to the
changes to information published in this document, including without purchase of NXP Semiconductors products by customer.
limitation specifications and product descriptions, at any time and without
notice. This document supersedes and replaces all information supplied prior No offer to sell or license Nothing in this document may be interpreted or
to the publication hereof. construed as an offer to sell products that is open for acceptance or the grant,
conveyance or implication of any license under any copyrights, patents or
other industrial or intellectual property rights.

UCODE DNA Track
Export control This document as well as the item(s) described herein in accordance with automotive testing or application requirements. NXP
may be subject to export control regulations. Export might require a prior Semiconductors accepts no liability for inclusion and/or use of
authorization from competent authorities. non-automotive qualified products in automotive equipment or applications.
Quick reference data The Quick reference data is an extract of the In the event that customer uses the product for design-in and use in
product data given in the Limiting values and Characteristics sections of this automotive applications to automotive specifications and standards, customer
document, and as such is not complete, exhaustive or legally binding. (a) shall use the product without NXP Semiconductors warranty of the
product for such automotive applications, use and specifications, and (b)
Bare die All die are tested on compliance with their related technical
whenever customer uses the product for automotive applications beyond
specifications as stated in this data sheet up to the point of wafer sawing and
NXP Semiconductors specifications such use shall be solely at customers
are handled in accordance with the NXP Semiconductors storage and
own risk, and (c) customer fully indemnifies NXP Semiconductors for any
transportation conditions. If there are data sheet limits not guaranteed, these
liability, damages or failed product claims resulting from customer design and
will be separately indicated in the data sheet. There are no post-packing tests
use of the product for automotive applications beyond NXP Semiconductors
performed on individual die or wafers.
standard warranty and NXP Semiconductors product specifications.
NXP Semiconductors has no control of third party procedures in the sawing,
Translations A non-English (translated) version of a document is for
handling, packing or assembly of the die. Accordingly, NXP Semiconductors
reference only. The English version shall prevail in case of any discrepancy
assumes no liability for device functionality or performance of the die or
between the translated and English versions.
systems after third party sawing, handling, packing or assembly of the die. It
is the responsibility of the customer to test and qualify their application in
which the die is used.
17.4 Trademarks
All die sales are conditioned upon and subject to the customer entering into a
written die sale agreement with NXP Semiconductors through its legal Notice: All referenced brands, product names, service names and trademarks
department. are the property of their respective owners.
Non-automotive qualified products Unless this data sheet expressly UCODE is a trademark of NXP Semiconductors N.V.
states that this specific NXP Semiconductors product is automotive qualified,
the product is not suitable for automotive use. It is neither qualified nor tested
18. Contact information

For more information, please visit: http://www.nxp.com
For sales office addresses, please send an email to: salesaddresses@nxp.com

UCODE DNA Track
19. Contents
1 General description . . . . . . . . . . . . . . . . . . . . . . 1 9.8.2 UCODE DNA Track TID memory details . . . . 20
2 Features and benefits . . . . . . . . . . . . . . . . . . . . 2 9.9 Supported features . . . . . . . . . . . . . . . . . . . . 21
2.1 Key features . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 9.9.1 UCODE DNA Track features control mechanism
2.1.1 Memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 21
2.2 Key benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 9.9.2 Backscatter strength reduction . . . . . . . . . . . 22
2.2.1 End-user benefit . . . . . . . . . . . . . . . . . . . . . . . . 2 9.9.3 Pre-serialization of the 96-bit EPC. . . . . . . . . 22
2.2.2 Antenna design benefits . . . . . . . . . . . . . . . . . . 3 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.2.3 Label / module manufacturer benefit . . . . . . . . 3 Use cases and benefits . . . . . . . . . . . . . . . . . . 22
2.3 Supported features . . . . . . . . . . . . . . . . . . . . . . 3 9.9.4 Parallel encoding . . . . . . . . . . . . . . . . . . . . . . 23
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Use cases and benefits . . . . . . . . . . . . . . . . . . 25
3.1 Markets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
9.9.5 Tag Power Indicator . . . . . . . . . . . . . . . . . . . . 26
3.2 Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4 Ordering information . . . . . . . . . . . . . . . . . . . . . 4 Use cases and benefits . . . . . . . . . . . . . . . . . . 26
5 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 5 9.9.6 Product Status Flag (PSF) . . . . . . . . . . . . . . 27
6 Pinning information . . . . . . . . . . . . . . . . . . . . . . 6 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
6.1 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . 6 Use cases and benefits . . . . . . . . . . . . . . . . . . 27
7 Wafer layout . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 9.9.7 Single-slit antenna solution . . . . . . . . . . . . . . 27
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
7.1 Wafer layout . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Uses cases and benefits . . . . . . . . . . . . . . . . . 27
8 Mechanical specification . . . . . . . . . . . . . . . . . 8
10 Limiting values . . . . . . . . . . . . . . . . . . . . . . . . 28
8.1 Wafer specification . . . . . . . . . . . . . . . . . . . . . . 8
8.1.1 Wafer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 11 Characteristics . . . . . . . . . . . . . . . . . . . . . . . . 29
8.1.2 Fail die identification . . . . . . . . . . . . . . . . . . . . 9 11.1 UCODE DNA Track bare die characteristics . 29
8.1.3 Map file distribution. . . . . . . . . . . . . . . . . . . . . . 9 12 Package outline. . . . . . . . . . . . . . . . . . . . . . . . 30
9 Functional description . . . . . . . . . . . . . . . . . . 10 13 Packing information . . . . . . . . . . . . . . . . . . . . 30
9.1 Air interface standards . . . . . . . . . . . . . . . . . . 10 13.1 Wafer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
9.2 Power transfer . . . . . . . . . . . . . . . . . . . . . . . . 10 14 Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . 30
9.3 Data transfer . . . . . . . . . . . . . . . . . . . . . . . . . . 10 15 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
9.3.1 Interrogator to tag Link . . . . . . . . . . . . . . . . . . 10
16 Revision history . . . . . . . . . . . . . . . . . . . . . . . 33
9.3.2 Tag to interrogator Link . . . . . . . . . . . . . . . . . . 10
9.4 Supported commands . . . . . . . . . . . . . . . . . . 11 17 Legal information . . . . . . . . . . . . . . . . . . . . . . 34
9.5 List of error codes . . . . . . . . . . . . . . . . . . . . . . 11 17.1 Data sheet status . . . . . . . . . . . . . . . . . . . . . . 34
9.6 Tag Authentication using AES . . . . . . . . . . . . 12 17.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
9.6.1 AES Authentication examples for TAM1. . . . . 12 17.3 Disclaimers . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Parameter values used for example . . . . . . . . .12 17.4 Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . 35
TAM 1 Message . . . . . . . . . . . . . . . . . . . . . . . .12 18 Contact information . . . . . . . . . . . . . . . . . . . . 35
Authenticate Command . . . . . . . . . . . . . . . . . .13 19 Contents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Authenticate TAM1 execution. . . . . . . . . . . . . .13
Authenticate TAM1 reply . . . . . . . . . . . . . . . . .14
Verification on Host Side . . . . . . . . . . . . . . . . .14

9.7 Insertion and activation of secret key-Key0 . . 15
9.7.1 Key insertion and activation . . . . . . . . . . . . . . 15
9.7.2 Example of key insertion, verification and
activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
9.8 UCODE DNA Track memory . . . . . . . . . . . . . 17
9.8.1 UCODE DNA Track overall memory map. . . . 18
Please be aware that important notices concerning this document and the product(s)
described herein, have been included in section Legal information.

For more information, please visit: http://www.nxp.com
For sales office addresses, please send an email to: salesaddresses@nxp.com
Date of release: 15 February 2017
414630

SL3S5050

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

SL3S5050

Încărcat de

Drepturi de autor:

Formate disponibile

SL3S5050

UCODE DNA Track

The authentication method as integrated in UCODE DNA Track is based on AES

It is designed in compliance with the latest relevant standards, namely:

2. Features and benefits

2.1 Key features

2.2 Key benefits

2.2.1 End-user benefit

Product data sheet Rev. 3.0 15 February 2017

2.2.2 Antenna design benefits

2.2.3 Label / module manufacturer benefit

2.3 Supported features

Product data sheet Rev. 3.0 15 February 2017

Product data sheet Rev. 3.0 15 February 2017

Cryptographic engine performs AES calculations for cryptographic authentication.

Fig 1. Block diagram of UCODE DNA IC

Product data sheet Rev. 3.0 15 February 2017

Fig 2. Pinning bare die

6.1 Pin description

Product data sheet Rev. 3.0 15 February 2017

7.1 Wafer layout

Product data sheet Rev. 3.0 15 February 2017

8.1 Wafer specification

Product data sheet Rev. 3.0 15 February 2017

8.1.2 Fail die identification

8.1.3 Map file distribution

Product data sheet Rev. 3.0 15 February 2017

9.1 Air interface standards

9.2 Power transfer

9.3 Data transfer

9.3.1 Interrogator to tag Link

For further details, refer to Ref. 1. Interrogator-to-tag (R=>T) communications.

9.3.2 Tag to interrogator Link

Product data sheet Rev. 3.0 15 February 2017

9.4 Supported commands

TAM1 for Tag Authentication

9.5 List of error codes

Product data sheet Rev. 3.0 15 February 2017

9.6 Tag Authentication using AES

9.6.1 AES Authentication examples for TAM1

Table 5. Parameter and values for Tag Authentication example

Table 6. TAM1 Message

Product data sheet Rev. 3.0 15 February 2017

SenRep = 1 (send reply)

Table 7. Authentication command for TAM1 example

Authenticate TAM1 execution

Using the variables:

Filling the variables leads to:

AES-ECB-ENC(123456789ABCDEF0123456789ABCDEFh, 96C5h II 4FA81D3Ch II

Using the online AES calculator at: http://testprotect.com/appendix/AEScalc,

Product data sheet Rev. 3.0 15 February 2017

Authenticate TAM1 reply

Table 8. Authenticate TAM1 reply

Done = 1 computation done)

Verification on Host Side

That can be split into:

Product data sheet Rev. 3.0 15 February 2017

9.7 Insertion and activation of secret key-Key0

9.7.1 Key insertion and activation

Table 9. Start address for Key0

9.7.2 Example of key insertion, verification and activation

Table 10. BlockWrite command to write value for Key0

Command MemBank WordPtr WordCount Data RN CRC-16

Product data sheet Rev. 3.0 15 February 2017