ST25DV04K ST25DV16K ST25DV64K

Datasheet

Dynamic NFC/RFID tag IC with 4-, 16-, or 64-Kbit EEPROM, and fast transfer
mode capability

Features
I2C interface

SO8 TSSOP8 • Two-wire I2C serial interface supports 1 MHz protocol

• Single supply voltage: 1.8 to 5.5 V
• Multiple byte programming (up to 256 bytes)

Contactless interface

UFDFPN8 WLCSP10 • Based on ISO/IEC 15693

• NFC Forum Type 5 tag, certified by the NFC Forum
• Supports all ISO/IEC 15693 modulations, coding, sub-carrier modes and data
rates
• Custom fast read access up to 53 Kbit/s
• Single and multiple blocks read (same for extended commands)
Wafer UFDFPN12
• Single and multiple (up to 4) blocks write (same for extended commands)
• Internal tuning capacitance: 28.5 pF

Memory
• Up to 64 kbits of EEPROM (depending on version)
• I2C interface accesses bytes
• RF interface accesses blocks of 4 bytes
• Write time:
– From I2C: typical 5 ms for 1 byte
– From RF: typical 5 ms for 1 block
• Data retention: 40 years
Product status link
• Write cycles endurance:
ST25DV04K – 1 million at 25 °C
ST25DV16K – 600 k at 85 °C
ST25DV64K – 500 k at 105 °C
– 400 k at 125 °C

Fast transfer mode

• Fast data transfer between I2C and RF interfaces

• Half-duplex 256-byte dedicated buffer

Energy harvesting
• Analog output pin to power external components

Data protection
• User memory: one to four configurable areas, protectable in read and/or write
by three 64-bit passwords in RF, and one 64-bit password in I2C
• System configuration: protected in write by one 64-bit password in RF, and one
64-bit password in I2C

DS10925 - Rev 11 - January 2023 www.st.com

For further information contact your local STMicroelectronics sales office.
 ST25DV04K ST25DV16K ST25DV64K

GPO
• Interruption pin configurable on multiple RF events (field change, memory write, activity, Fast Transfer end,
user set/reset/pulse)
• Open drain or CMOS output (depending on version)

Low power mode (10-ball and 12-pin packages only)

• Input pin to trigger low power mode

RF management

• RF command interpreter enabled/disabled from I2C host controller

Temperature range
• Range 6:
– From -40 to 85 °C
• Range 8:
– From -40 to 105 °C (UDFPN8 and UDFPN12 only)
– From -40 to 125 °C (SO8N and TSSOP8 only, 105 °C max on RF interface)

Package
• 8-pin, 10-ball and 12-pin packages
• ECOPACK2 (RoHS compliant)

DS10925 - Rev 11 page 2/197

 ST25DV04K ST25DV16K ST25DV64K
Description

1 Description

The ST25DV04K, ST25DV16K and ST25DV64K devices (hereinafter referred collectively to as ST25DVxxx)
are NFC RFID tags offering, respectively 4, 16, and 64 Kbit of electrically erasable programmable memory
(EEPROM). These devices feature two interfaces: the first one is an I2C serial link that can be operated from a
DC power supply, the second one is an RF link activated when the device acts as a contactless memory powered
by the received carrier electromagnetic wave.
In I2C mode, the user memory contains up to 512, 2048, or 8192 bytes, which can be split in four flexible and
protectable areas.
In RF mode, following ISO/IEC 15693 or NFC Forum Type 5 recommendations, the user memory contains up to
128, 512, or 2048 blocks of 4 bytes, which can be split in four flexible and protectable areas.
The ST25DVxxx devices offer a fast transfer mode between the RF and contact worlds, thanks to a 256 bytes
volatile buffer (also called Mailbox). In addition, the GPO pin provides data about incoming events, like RF field
detection, RF activity in progress, or mailbox message availability. An energy harvesting feature is also available,
when external conditions make it possible.

1.1 ST25DVxxx block diagram

Figure 1. ST25DVxxx block diagram

1.8V VOLTAGE DIGITAL UNIT CONTROL

LPD1 VDCG1
REGULATOR
ENERGY
FAST TRANSFER
HARVESTING
CONTROL GPO
ANALOG FRONT END CONTROL
256 Bytes
V_EH ENERGY BUFFER
HARVESTING MEMORY
CONTROL Vcc
ISO/IEC 15693
AC0 PROTOCOL
RF INTERFACE
AND CONTROL
28.5pF tuning Dynamic Vss
capacitance I2C CONTROL
AC1 registers

EEPROM SDA

I2C
System INTERFACE
Up to 64Kbits User memory SCL
registers

1. VDCG and LPD are included only in 10-ball and 12-pin packages.

DS10925 - Rev 11 page 3/197

 ST25DV04K ST25DV16K ST25DV64K
ST25DVxxx packaging

1.2 ST25DVxxx packaging

The ST25DVxxx devices are provided in different packages:
• 8 pins (S08N or TSSPOP8 or UFDFPN8) for the open drain version of Interrupt output
• 10 balls (WLCSP) and 12 pins (UFDFPN12) for a CMOS interrupt output. These packages include an
additional LPD pin, to minimize standby consumption.

Table 1. Signal names

Signal name Function Direction

V_EH Energy harvesting Power output

GPO Interrupt output Output
SDA Serial data I/O
SCL Serial clock Input
AC0, AC1 Antenna coils -
VCC Supply voltage Power

VSS Ground -

LPD (1) Low power down mode Input

VDCG (1) Supply voltage for GPO driver Power

NC Not connected Must be left floating

EP (2) Exposed pad Must be left floating

1. Available only on 10-ball and 12-pin packages.

2. Available only on UFDPN8 and UFDFPN12 packages.

Figure 2. 8-pin packages: connections with open drain Interrupt output

V_EH 1 8 VCC

AC0 2 7 GPO (OD)

EP1
AC1 3 6 SCL

VSS 4 5 SDA

1. Exposed pad available only on UFDFPN8 package.

DS10925 - Rev 11 page 4/197

 ST25DV04K ST25DV16K ST25DV64K
ST25DVxxx packaging

Figure 3. 12-pin package: connections with CMOS Interrupt output (GPO)

LPD 1 12 VCC

NC 2 11 GPO (CMOS)

V_EH 3 10 VDCG
EP1
AC0 4 9 NC

AC1 5 8 SCL

VSS 6 7 SDA

1. Exposed pad available only on UFDFPN12 package.

Figure 4. 10-ball WLCSP package: connections with CMOS Interrupt output (GPO)

1 2 3 4 4 3 2 1

A VCC V_EH V_EH VCC A

B GPO AC0 AC0 GPO B

C VDCG LPD LPD VDCG C

D SCL AC1 AC1 SCL D

E SDA VSS VSS SDA E

Marking side Bump side

(top view) (bottom view)

DS10925 - Rev 11 page 5/197

 ST25DV04K ST25DV16K ST25DV64K
Signal descriptions

2 Signal descriptions

2.1 Serial link (SCL, SDA)

2.1.1 Serial clock (SCL)

This input signal is used to strobe data in and out of the device. In applications where this signal is used by slave
devices to synchronize the bus to a slower clock, the bus master must have an open drain output, and a pull-up
resistor must be connected from Serial clock (SCL) to VCC. See Section 9.2 I2C parameters to know how to
calculate the value of this pull-up resistor

2.1.2 Serial data (SDA)

This bidirectional signal is used to transfer data in or out of the device. It is an open drain output that may be
wire-ORed with other open drain or open collector signals on the bus. A pull-up resistor must be connected from
Serial data (SDA) to VCC (Figure 76 indicates how to calculate the value of the pull-up resistor).

2.2 Power control (VCC, LPD, VSS)

2.2.1 Supply voltage (VCC)

This pin can be connected to an external DC supply voltage.
Note: An internal voltage regulator allows the external voltage applied on VCC to supply the ST25DVxxx, while
preventing the internal power supply (rectified RF waveforms) to output a DC voltage on the VCC pin.

2.2.2 Low power down (LPD)

This input signal is used to control an internal 1.8 V regulator delivering the internal supply. When LPD is high, the
regulator is shut off and its consumption is reduced below 1 µA. The regulator has a turn on time in the 100 µs
range, to be added to the boot duration, before the device becomes fully operational. The impedance on LDP pin,
when set high, must not exceed 5 kΩ.
This feature is available only on the 10-ball and 12-pin packages. The LPD pin is internally pulled-down.

2.2.3 Ground (VSS)

VSS is the reference for the VCC and VDCG supply voltages and V_EH analog output voltage.

DS10925 - Rev 11 page 6/197

 ST25DV04K ST25DV16K ST25DV64K
RF link (AC0 AC1)

2.3 RF link (AC0 AC1)

2.3.1 Antenna coil (AC0, AC1)

These inputs are used to connect the ST25DVxxx device exclusively to an external coil. Do not connect any other
DC or AC path to AC0 or AC1.
When correctly tuned, the coil is used to power and access the device using the ISO/IEC 15693 and ISO 18000-3
mode 1 protocols.

2.4 Process control (VDCG, GPO)

2.4.1 Driver supply voltage (VDCG)

This pin, available only with ST25DVxx-JF version, can be connected to an external DC supply voltage. It
supplies only the GPO driver block, not the whole device. If VDCG is left floating, no information is available on the
GPO pin.

2.4.2 General purpose output (GPO)

The ST25DVxxx feature a configurable output GPO pin used to provide RF activity information to an external
device. ST25DVxx-IE offers a GPO open drain. This GPO pin must be connected to an external pull-up resistor
(> 4.7 kΩ) to operate.
The interrupt consists in pulling the state to a low level, or outputting a low level pulse on the GPO pin.
ST25DVxx-JF offers a GPO CMOS output, which requires to connect VDCG pin to an external power supply. The
interrupt consists in setting the state to a high level or outputting a positive pulse on the GPO pin.
GPO pin is a configurable output signal, and can mix several Interruption modes. By default, the GPO register
sets the interruption mode as an RF field change detector. It is able to raise various events like RF activity,
memory write completion, or fast transfer actions. It can authorize the RF side to directly drive GPO pin using the
Manage GPO command to set the output state or emit a single pulse (for example, to wake up an application.).
See Section 5.2 GPO for details.

2.5 Energy harvesting analog output (V_EH)

This analog output pin is used to deliver the analog voltage V_EH available when the Energy harvesting mode
is enabled, if the RF field strength is sufficient. When the Energy harvesting mode is disabled, or the RF field
strength is not sufficient, V_EH pin is in high-Z state (see Section 5.3 Energy harvesting (EH) for details).
Energy harvesting voltage output is not regulated.

DS10925 - Rev 11 page 7/197

 ST25DV04K ST25DV16K ST25DV64K
Power management

3 Power management

3.1 Wired interface

Operating supply voltage VCC

In contact mode, before selecting the memory and issuing instructions to it, a valid and stable VCC voltage within
the specified [VCC(min), VCC(max)] range (see Table 243. I2C operating conditions) must be applied. To maintain
a stable DC supply voltage, it is recommended to decouple the VCC line with a suitable capacitor (10 to 100 nF),
close to the VCC/VSS package pins.
This voltage must remain stable and valid until the end of the transmission of the instruction and, for a Write
instruction, until the completion of the internal I²C write cycle (tW). Instructions are not taken into account until
completion of the boot sequence (see Figure 5).

Figure 5. Power-up sequence (no RF field, LPD pin tied to VSS or package without LPD pin)

I2C interface ready

VCC pin

Power-up by VCC
(no VCC; VDCG) Internal supply

No access
allowed
RF or I2C I2C start I2C stop
RF access not allowed

tboot*
I2C

DT37969V4
* When RF field is present before VCC set up, boot is already done and tboot = 0.
* If the LPD pin follows VCC before going low, tboot = tboot_LPD, and starts only when LPD reaches the the low level.

Power-up conditions
When the power supply is turned on, VCC rises from VSS to VCC. The rise time must not be faster than 1 V/µs.

Device reset in I²C mode

To prevent unwanted write operations during power-up, a power-on reset (POR) circuit is included. At power-up
(continuous rise of VCC), the device does not respond to any I²C instruction until VCC has reached the power-on
reset threshold voltage (lower than the minimum VCC operating voltage defined in Table 243. I2C operating
conditions). When VCC passes over the POR threshold, the device is reset and enters the Standby power mode.
The device must not be accessed until VCC has reached a valid and stable VCC voltage within the specified
[VCC(min), VCC(max)] range, and the time necessary by the device to set-up (tBootDC) has passed. In the version
supporting LPD pin, the boot takes place only when LPD goes low.
In a similar way, during power-down (continuous decrease in VCC), as soon as VCC drops below the power-on
reset threshold voltage, the device stops responding to any instruction sent to it, and the I2C address counter is
reset.

Power-down mode
During power-down (VCC decreasing continuously) the device must be in Standby power mode (mode reached
after decoding a Stop condition, assuming that there is no internal write cycle in progress).

DS10925 - Rev 11 page 8/197

 ST25DV04K ST25DV16K ST25DV64K
Contactless interface

3.2 Contactless interface

Device set in RF mode
To ensure a proper boot of the RF circuitry, the RF field must be turned on without any modulation for a minimum
period of time tBootRF. Before this time, the device ignores all received RF commands (see Figure 6).

Device reset in RF mode

To ensure a proper reset of the RF circuitry, the RF field must be turned off (100% modulation) for a minimum
period of time (tRF_OFF).
The RF access can be temporarily or indefinitely disabled by setting the appropriate value in the RF_MNGT or
RF_MNGT_Dyn registers.

Figure 6. RF power-up sequence (no DC supply)

RF interface ready

RF field No access
allowed RF REQUEST RF ANSWER
RF or I2C

tBootRF
Power-up by RF Vint_supply
(no VCC ; VDCG)
GPO CMOS version tminCD

GPO = RF_ACTIVITY ANS

REQ
EOF EOF

GPO = FIELD CHANGE

IT duration

GPO = FIELD CHANGE AND RF_ACTIVITY

DT37968V2
No answer to RF
request, if any

DS10925 - Rev 11 page 9/197

 ST25DV04K ST25DV16K ST25DV64K
Memory management

4 Memory management

4.1 Memory organization overview

The ST25DVxxx memory is divided in four main memory areas:
• User memory
• Dynamic registers
• Fast transfer mode buffer
• System configuration area
The user memory can be divided into four flexible areas. Each area can be individually read- and/or write-
protected with one out of three specific 64-bit password.
The ST25DVxxx dynamic registers are accessible by RF or I2C host and provide dynamic activity status or allow
temporary activation or deactivation of some features.
The ST25DVxxx also provides a 256-byte fast transfer mode buffer, acting as a mailbox between RF and I2C
interface, allowing fast data transfer between contact and contactless worlds.
Finally, the ST25DVxxx system configuration area contains static registers to configure the device features, which
can be tuned by user. Its access is protected by a 64-bit configuration password.
This system configuration area also includes read only device information, such as IC reference, memory size or
IC revision, as well as a 64-bit block used to store the 64-bit unique identifier (UID), and the AFI (default 00h) and
DSFID (default 00h) registers. The UID is compliant with the ISO 15693 description, and its value is used during
the anticollision sequence (Inventory). The UID value is written by ST on the production line. The AFI register
stores the application family identifier. The DSFID register stores the data storage family identifier used in the
anticollision algorithm.
The system configuration area includes five additional 64-bit blocks that store an I2C password plus three RF user
area access passwords, and an RF configuration password.

DS10925 - Rev 11 page 10/197

 ST25DV04K ST25DV16K ST25DV64K
User memory

Figure 7. Memory organization

CC File

Area 1

Always readable
User memory
(EEPROM up to 64-Kbits) Area 2
Password protected
Area 3

Area 4

Dynamic configuration Dynamic registers

and activity status

Fast Transfer Mode

Fast Transfer Mode mailbox
256 Bytes buffer

Static configuration registers

System configuration
Device information
(EEPROM)
UID, AFI, DSFID
Password protected
Passwords

4.2 User memory

This memory is accessible from both RF contactless and I2C wired interfaces.
From RF interface, the user memory is addressed as blocks of 4 bytes, starting at address 0. RF extended read
and write commands can be used to address all memory blocks. Other read and write commands can address
only up to block FFh.
From I2C interface, user memory is addressed as bytes, starting at address 0. Device select must be set with E2
= 0.
The user memory can be read in continuity. Unlike the RF interface, there is no roll-over when the requested
address reaches the end of the memory capacity.
Table 2 shows how memory is seen from RF and I2C interfaces.

DS10925 - Rev 11 page 11/197

 ST25DV04K ST25DV16K ST25DV64K
User memory

Table 2. User memory as seen by RF and by I2C

RF command I2C command

User memory
(block addressing) (byte addressing)

RF block (00)00h

I2C byte I2C byte I2C byte I2C byte

0003h 0002h 0001h 0000h
Read Single Block RF block (00)01h
Read Multiple Blocks I2C byte I2C byte I2C byte I2C byte
Fast Read Single Block 0007h 0006h 0005h 0004h
Fast Read Multiple Blocks RF block (00)02h
Write Single Block
I2C byte I2C byte I2C byte I2C byte
Write Multiple Blocks
000Bh 000Ah 0009h 0008h
Ext Read Single Block
....
Ext Read Multiple Blocks
RF block (00)7Fh (1)
Fast Ext Read Single Block
Fast Ext Read Multi Blocks I2C byte I2C byte I2C byte I2C byte

Ext Write Single Block 01FFh 01FEh 01FDh 01FCh

I2C Read command
Ext Write Multiple Blocks ....
I2C Write command
RF block (00)FFh (2)
Device select E2 = 0
I2C byte I2C byte I2C byte I2C byte
03FFh 03FEh 03FDh 03FCh
RF block 0100h

I2C byte I2C byte I2C byte I2C byte

0403h 0402h 0401h 0400h
Ext Read Single Block ....
Ext Read Multiple Blocks
RF block 01FFh (3)
Fast Ext Read Single Block
I2C byte I2C byte I2C byte I2C byte
Fast Ext Read Multi Blocks
07FFh 07FEh 07FDh 07FCh
Ext Write Single Block
....
Ext Write Multiple Blocks
RF block 07FFh (4)

I2C byte I2C byte I2C byte I2C byte

1FFFh 1FFEh 1FFDh 1FFCh

1. Last block of user memory in ST25DV04K‑XX..

2. Last block accessible with Read Single Block, Read Multiple Blocks, Fast Read Single Block, Fast Read Multiple Blocks, Write Single Block
and Write Multiple Blocks RF commands.
3. Last block of user memory in ST25DV16K‑XX.
4. Last block of user memory in ST25DV64K‑XX.

Note: In the factory all blocks of user memory are initialized to 00h.

DS10925 - Rev 11 page 12/197

 ST25DV04K ST25DV16K ST25DV64K
User memory

4.2.1 User memory areas

The user memory can be split into different areas, each one with a distinct access privilege.
RF and I2C read and write commands are legal only within the same zone:
• In RF, a multiple read or a multiple write command is not executed and returns the error code 0Fh if
addresses cross the area borders.
• In I2C, a read data always return FFh after crossing an area border. A write command is not acknowledged
and not executed if the command crosses the area border.
Each user memory area is defined by its ending block address ENDAi. The starting block address is defined by
the end of the preceding area.
There are three ENDAi registers in the configuration system memory, used to define the end block addresses of
Area 1, Area 2 and Area 3. The end of Area 4 is always the last block of memory, and is not configurable.

Figure 8. ST25DVxxx user memory areas

ST25DV user memory

Areas limit Block/Byte 0000h

registers Area1
(8 Blocks/32 Bytes minimum)
ENDA1
Area2
ENDA2
Area3
ENDA3
Area4
Last Block/Byte
of user memory

On factory delivery all ENDAi are set to their maximum value, only Area1 exists and includes the full user
memory.
A granularity of 8 blocks (32 bytes) is offered to code area ending points.
An area end limit is coded as follows in ENDAi registers:
• Last RF block address of area = 8 * ENDAi + 7 → ENDAi = int(Last Areai RF block address / 8)
• Last I2C byte address of area = 32 * ENDAi + 31 → ENDAi = int(Last Areai I2C byte address / 32)
• As a consequence, ENDA1 = 0 minimum size of Area 1 is 8 blocks (32 bytes).

Table 3. Maximum user memory block and byte addresses and ENDAi value

Last user memory block address Last user memory byte address seen
Device Maximum ENDAi value
seen by RF by I2C

ST25DV04K-xx 007Fh 01FFh 0Fh

ST25DV16K-xx 01FFh 07FFh 3Fh
ST25DV64K-xx 07FFh 1FFFh FFh

DS10925 - Rev 11 page 13/197

 ST25DV04K ST25DV16K ST25DV64K
User memory

Table 4. Areas and limit calculation from ENDAi registers

Area Seen from RF interface Seen from I2C interface

Block 0000h Byte 0000h

Area 1 … …
Block (ENDA1 * 8) + 7 Byte (ENDA1 * 32) + 31
Block (ENDA1 + 1) * 8 Byte (ENDA1 + 1) * 32
Area 2 … …
Block (ENDA2 * 8) + 7 Byte (ENDA2 * 32) + 31
Block (ENDA2 + 1) * 8 Byte (ENDA2 + 1) * 32
Area 3 … …
Block (ENDA3 * 8) + 7 Byte (ENDA3 * 32) + 31
Block (ENDA3 + 1) * 8 Byte (ENDA3 + 1) * 32
Area 4 … …
Last memory block Last memory byte

The organization of user memory in areas has the following characteristics:

• At least one area exists (Area1), starting at block/byte address 0000h and finishing at ENDA1, with ENDA1
= ENDA2 = ENDA3 = End of user memory (factory setting).
• Two areas can be defined by setting ENDA1 < ENDA2 = ENDA3 = End of user memory.
• Three areas can be defined by setting ENDA1 < ENDA2 < ENDA3 = End of user memory.
• A maximum of four areas can be defined by setting ENDA1 < ENDA2 < ENDA3 < End of user memory.
• Area 1 specificities:
– Start is always block/byte address 0000h
– Minimum size is 8 blocks (32 bytes) when ENDA1 = 00h
– Always readable
• The last area always finishes on the last user memory block/byte address (ENDA4 does not exist).
• All areas are contiguous: end of Area(n) + one block/byte address is always start of Area(n+1).

Area size programming

RF user must first open the RF configuration security session to write ENDAi registers.
I2C host must first open I2C security session to write ENDAi registers.
When programming an ENDAi register, the following rule must be respected:
• ENDAi-1 < ENDAi ≤ ENDAi + 1 = End of memory.
This means that prior to programming any ENDAi register, its successor (ENDAi + 1) must first be programmed to
the last block/byte of memory:
• Successful ENDA3 programming condition: ENDA2 < ENDA3 ≤ End of user memory
• Successful ENDA2 programming condition: ENDA1 < ENDA2 ≤ ENDA3 = End of user memory
• Successful ENDA1 programming condition: ENDA1 ≤ ENDA2 = ENDA 3 = End of user memory
If this rule is not respected, an error 0Fh is returned in RF, NoAck is returned in I2C, and programming is not
done. To respect this rule, the following procedure is recommended when programming areas size (even for
changing only one):

DS10925 - Rev 11 page 14/197

 ST25DV04K ST25DV16K ST25DV64K
User memory

1. Ends of Areas 3 and 2 must first be set to the end of memory respecting the following order:
a. If ENDA3 ≠ end of user memory, then set ENDA3 = end of memory; else, do not write ENDA3.
b. If ENDA2 ≠ end of user memory, then set ENDA2 = end of memory; else, do not write ENDA2.
2. Then, desired area limits can be set respecting the following order:
a. Set new ENDA1 value.
b. Set new ENDA2 value, with ENDA2 > ENDA1
c. Set new ENDA3 value, with ENDA3 > ENDA2
Example of successive user memory area setting (for a ST25DV64K-xx):
1. Initial state, two areas are defined:
a. ENDA1 = 10h (last block of Area 1: (10h * 8) + 7 = 0087h)
b. ENDA2 = FFh (last block of Area 2: (FFh * 8) + 7 = 07FFh)
c. ENDA3 = FFh (no Area 3)
◦ Area 1 from block 0000h to 0087h (136 blocks)
◦ Area 2 from block 0088h to 07FFh (1912 blocks)
◦ There is no Area 3
◦ There is no Area 4
2. Split of user memory in four areas:
a. ENDA3 is not updated as it is already set to end of memory
b. ENDA2 is not updated as it is already set to end of memory
c. Set ENDA1 = 3Fh (last block of Area 1: (3Fh * 8) + 7 = 01FFh)
d. Set ENDA2 = 5Fh (last block of Area 1: (5Fh * 8) + 7 = 02FFh)
e. Set ENDA3 = BFh (last block of Area 1: (BFh * 8) + 7 = 05FFh)
◦ Area1 from block 0000h to 01FFh (512 blocks)
◦ Area2 from block 0200h to 02FFh (256 blocks)
◦ Area3 from block 0300h to 05FFh (768 blocks)
◦ Area4 from block 0600h to 07FFh (512 blocks).
3. Return to a split in two equal areas:
a. Set ENDA3 = FFh
b. Set ENDA2 = FFh
c. Set ENDA1 = 7Fh (last block of Area 1: (7Fh * 8) + 7 = 03FFh)
◦ Area1 from block 0000h to 03FFh (1024 blocks)
◦ Area2 from block 0400h to 07FFh (1024 blocks)
◦ There is no Area3
◦ There is no Area 4
Programming ENDA3 to FFh in step 2.a results in an error, since rule ENDAi - 1 < ENDAi is not respected
(ENDA2 = ENDA3 in that case).

Registers for user memory area configuration

Table 5. ENDA1 access

RF I2C

Command Type Address Type

Read Configuration (code A0h) @05h R always, W if RF configuration security session is R always, W if I2C security
E2 = 1, 0005h
Write Configuration (code A1h) @05h open and configuration not locked session is open

DS10925 - Rev 11 page 15/197

 ST25DV04K ST25DV16K ST25DV64K
User memory

Table 6. ENDA1

Bit Name Function Factory value

ST25DV04K-xx: 0Fh
End Area 1 = 8 * ENDA1 + 7 when expressed in blocks (RF)
b7-b0 ENDA1 ST25DV16K-xx: 3Fh
End Area 1 = 32 * ENDA1 + 31 when expressed in bytes (I2C)
ST25DV64K-xx: FFh

Note: Refer to Table 11. System configuration memory map for ENDA1 register.

Table 7. ENDA2 access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @07h R always, W if RF configuration security R always, W if I2C security
E2 = 1, 0007h
Write Configuration (cmd code A1h) @07h session is open and configuration not locked session is open

Table 8. ENDA2

Bit Name Function Factory value

ST25DV04K-xx: 0Fh
End Area 2 = 8 * ENDA2 + 7 when expressed in blocks (RF)
b7-b0 ENDA2 ST25DV16K-xx: 3Fh
End Area 2 = 32 * ENDA2 + 31 when expressed in bytes (I2C)
ST25DV64K-xx: FFh

Note: Refer to Table 11. System configuration memory map for ENDA2 register.

Table 9. ENDA3 access

RF I2C

Command Type Address Type

Read Configuration (code A0h) @09h R always, W if RF configuration security session is R always, W if I2C security
E2 = 1, 0009h
Write Configuration (code A1h) @09h open and configuration not locked session is open

Table 10. ENDA3

Bit Name Function Factory value

ST25DV04K-xx: 0Fh
End Area 3 = 8 x ENDA3 + 7 when expressed in blocks (RF)
b7-b0 ENDA3 ST25DV16K-xx: 3Fh
End Area 3 = 32 x ENDA3 + 31 when expressed in bytes (I2C)
ST25DV64K-xx: FFh

Note: Refer to Table 11. System configuration memory map for ENDA3 register.

DS10925 - Rev 11 page 16/197

 ST25DV04K ST25DV16K ST25DV64K
System configuration area

4.3 System configuration area

In addition to EEPROM user memory, ST25DVxxx includes a set of static registers located in the system
configuration area memory (EEPROM nonvolatile registers). Those registers are set during device configuration
(i.e.: area extension), or by the application (i.e.: area protection). Static registers content is read during the boot
sequence and define basic ST25DVxxx behavior.
In RF, the static registers located in the system configuration area can be accessed via dedicated Read
Configuration and Write Configuration commands, with a pointer acting as the register address.
The RF configuration security session must first be open, by presenting a valid RF configuration password, to
grant write access to system configuration registers.
The system configuration area write access by RF can also be deactivated by I2C host.
In I2C static registers located in the system configuration area can be accessed with I2C read and write
commands with device select E2=1. Readable system areas could be read in continuity.
I2C security session must first be open, by presenting a valid I2C password, to grant write access to system
configuration registers.
Table 11. System configuration memory map shows the complete map of the system configuration area, as seen
by RF and I2C interface.

Table 11. System configuration memory map

RF access Static Register I2C access

Address Type Name Function Device select Address Type

00h RW (1) GPO Enable/disable ITs on GPO E2=1 0000h RW (2)

01h RW(1) IT_TIME Interruption pulse duration E2=1 0001h RW(2)

02h RW(1) EH_MODE Energy Harvesting default strategy after Power ON E2=1 0002h RW(2)

03h RW(1) RF_MNGT RF interface state after Power ON E2=1 0003h RW(2)

04h RW(1) RFA1SS Area1 RF access protection E2=1 0004h RW(2)

05h RW(1) ENDA1 Area 1 ending point E2=1 0005h RW(2)

06h RW(1) RFA2SS Area2 RF access protection E2=1 0006h RW(2)

07h RW(1) ENDA2 Area 2 ending point E2=1 0007h RW(2)

08h RW(1) RFA3SS Area3 RF access protection E2=1 0008h RW(2)

09h RW(1) ENDA3 Area 3 ending point E2=1 0009h RW(2)

0Ah RW(1) RFA4SS Area4 RF access protection E2=1 000Ah RW(2)

No access I2CSS Area 1 to 4 I2C access protection E2=1 000Bh RW(2)

N/A RW (3) (4) LOCK_CCFILE Blocks 0 and 1 RF Write protection E2=1 000Ch RW(2)

0Dh RW(1) MB_MODE Fast transfer mode state after power ON E2=1 000Dh RW(2)
Maximum time before the message is automatically
0Eh RW(1) MB_WDG E2=1 000Eh RW(2)
released

0Fh RW(1) LOCK_CFG Protect RF Write to system configuration registers E2=1 000Fh RW(2)

N/A WO (5) LOCK_DSFID DSFID lock status E2=1 0010h RO

NA WO (6) LOCK_AFI AFI lock status E2=1 0011h RO

N/A RW(5) DSFID DSFID value E2=1 0012h RO

N/A RW(6) AFI AFI value E2=1 0013h RO

RO MEM_SIZE Memory size value in blocks, 2 bytes E2=1 0014h to 0015h RO

N/A
RO BLK_SIZE Block size value in bytes E2=1 0016h RO
N/A RO IC_REF IC reference value E2=1 0017h RO
NA RO UID Unique identifier, 8 bytes E2=1 0018h to 001Fh RO

DS10925 - Rev 11 page 17/197

 ST25DV04K ST25DV16K ST25DV64K
System configuration area

RF access Static Register I2C access

Address Type Name Function Device select Address Type

IC_REV IC revision E2 = 1 0020h RO

- ST reserved E2 = 1 0021h RO

No access - ST reserved E2=1 0022h RO

- ST reserved E2 = 1 0023h RO

I2C_PWD I2C security session password, 8 bytes E2=1 0900h to 0907h R/W (7) (8)

N/A WO (9) RF_PWD_0 RF configuration security session password, 8 bytes

N/A WO(9) RF_PWD_1 RF user security session password 1, 8 bytes

No access
N/A WO(9) RF_PWD_2 RF user security session password 2, 8 bytes

N/A WO(9) RF_PWD_3 RF user security session password 3, 8 bytes

1. Write access is granted if RF configuration security session is open and configuration is not locked (LOCK_CFG register equals to 0).
2. Write access if I2C security session is open.
3. Write access to bit 0 if Block 00h is not already locked and to bit 1 if Block 01h is not already locked.
4. LOCK_CCFILE content is only readable through reading the Block Security Status of blocks 00h and 001h (see Section 5.6.3 User memory
protection)
5. Write access if DSFID is not locked
6. Write access if AFI is not locked.
7. Write access with I2C Write Password command, only after presenting a correct I2C password.
8. Read access is granted if I2C security session is open.
9. Write access only if corresponding RF security session is open.

DS10925 - Rev 11 page 18/197

 ST25DV04K ST25DV16K ST25DV64K
Dynamic configuration

4.4 Dynamic configuration

ST25DV has a set of dynamic registers that allow temporary modification of its behavior or report on its activity.
Dynamic registers are volatile and not restored to their previous values after POR.
Some static registers have an image in dynamic registers: dynamic register value is initialized with the static
register value and may be updated by the application to modify the device behavior temporarily (i.e.: set reset
of Energy Harvesting). When a valid change occurs in a static register, in RF or I2C, the corresponding dynamic
register is automatically updated.
Other, dynamic registers, automatically updated, contain indication on ST25DV activity. (i.e.: IT_STS_Dyn gives
the interruption’s status or MB_CTRL_Dyn gives the fast transfer mode mailbox control).
In RF, dynamic registers can be accessed via dedicated (Fast) Read Dynamic Configuration and (Fast) Write
Dynamic Configuration commands, with a pointer acting as the register address. No password is needed to
access dynamic registers.
In I2C, dynamic registers can be accessed with I2C read and write commands with device select E2=0. Dynamic
registers can be read in continuity. Dynamic registers and fast transfer mode mailbox can be read in continuity,
but not written in continuity. No password is needed to access dynamic registers.
Table 12. Dynamic registers memory map shows the complete map of dynamic registers, as seen by RF interface
and by I2C interface.

Table 12. Dynamic registers memory map

RF access Dynamic Registers I2C access

Device
Address Type Name Function Address Type
select

00h RO GPO_CTRL_Dyn GPO control E2 = 0 2000h R/W

No access - ST Reserved E2 = 0 2001h RO
02h R/W EH_CTRL_Dyn Energy Harvesting management & usage status E2 = 0 2002h R/W
RF_MNGT_Dyn RF interface usage management E2 = 0 2003h R/W

No access I2C_SSO_Dyn I2C security session status E2 = 0 2004h RO

IT_STS_Dyn Interruptions Status E2 = 0 2005h RO

0Dh R/W MB_CTRL_Dyn Fast transfer mode control and status E2 = 0 2006h R/W
NA RO MB_LEN_Dyn length of fast transfer mode message E2 = 0 2007h RO

DS10925 - Rev 11 page 19/197

 ST25DV04K ST25DV16K ST25DV64K
Fast transfer mode mailbox

4.5 Fast transfer mode mailbox

ST25DVxxx fast transfer mode uses a dedicated mailbox buffer for transferring messages between RF and I2C
worlds. This mailbox contains up to 256 Bytes of data which are filled from the first byte.
Fast transfer mode mailbox is accessed in bytes from both RF and I2C.
In RF, mailbox is read via a dedicated (Fast) Read Message command. Read can start from any address value
inside the mailbox, between 00h and FFh. Writing in the mailbox is done via the (Fast) Write Message command
in one shot, always starting at mailbox address 00h. No password is needed to access mailbox from RF, but fast
transfer mode must be enabled.
In I2C, mailbox read can start from any address value between 2008h and 2107h. Write mailbox MUST start from
address 2008h to a max of 2107h. No password is needed to access mailbox from I2C, but fast transfer mode
must be enabled.
Table 13. Fast transfer mode mailbox memory map shows the map of fast transfer mode mailbox, as seen by RF
interface and by I2C interface.

Table 13. Fast transfer mode mailbox memory map

RF access Fast transfer mode buffer I2C access

Device
Address Type Name Function Address Type
select

00h R/W MB_Dyn Byte 0 E2 = 0 2008h R/W

01h R/W MB_Dyn Byte 1 E2 = 0 2009h R/W
… … … Fast transfer mode buffer (256-Bytes) E2 = 0 ... ...
FEh R/W MB_Dyn Byte 254 E2 = 0 2106h R/W
FFh R/W MB_Dyn Byte 255 E2 = 0 2107h R/W

DS10925 - Rev 11 page 20/197

 ST25DV04K ST25DV16K ST25DV64K
ST25DVxxx specific features

5 ST25DVxxx specific features

ST25DVxxx offers the following features:

• A fast transfer mode (FTM), to achieve a fast link between RF and contact worlds, via a 256 byte buffer
called Mailbox. This mailbox dynamic buffer of 256 byte can be filled or emptied via either RF or I2C.
• A GPO pin, which indicates incoming event to the contact side, like RF Field changes, RF activity in
progress, RF writing completion or Mailbox message availability.
• An Energy Harvesting element to deliver µW of power when external conditions make it possible.
• RF management, which allows ST25DVxxx to ignore RF requests.
All these features can be programmed by setting static and/or dynamic registers of the ST25DVxxx. ST25DVxxx
can be partially customized using configuration registers located in the E2 system area.
These registers are:
• dedicated to Data Memory organization and protection ENDAi, I2CSS, RFAiSS, LOCK_CCFILE.
• dedicated to fast transfer mode MB_WDG, MB_MODE
• dedicated to observation, GPO, IT_TIME
• dedicated to RF , RF_MNGT, EH_MODE
• dedicated the device’s structure LOCK_CFG
A set of additional registers allows to identify and customize the product (DSFID, AFI, IC_REF, etc.).

In I²C,
Read accesses to the static configuration register is always allowed, except for passwords. For dedicated
registers, write access is granted after prior successful presentation of the I2C password. Configuration register
are located from @00h to 0Fh in the system area (device code 111)

In RF
Dedicated commands Read Configuration and Write Configuration must be used to access the static
configuration registers. Update is only possible when the access right was granted by presenting the RF
configuration password (RF_PWD_0), and if the system configuration was not previously locked by the I2C host
(LOCK_CFG=1), which acts as security master.
After any valid write access to the static configuration registers, the new configuration is immediately applied.
Some of the static registers have a dynamic image (notice _Dyn) preset with the static register value:
GPO_CTRL_Dyn, EH_CTRL_Dyn, RF_MNGT_Dyn and MB_CTRL_Dyn.
When it exists, ST25DVxxx uses the dynamic configuration register to manage its processes. A dynamic
configuration register updated by the application will recover its default static value after a Power On Reset
(POR).
Other dynamic registers are dedicated to process monitoring:
• I2C_SSO_Dyn is dedicated to data memory protection
• MB_LEN_Dyn, MB_CTRL_Dyn are dedicated to fast transfer mode
• IT_STS_Dyn is dedicated to interrupt
In I2C, read and write of the Dynamic registers is done using usual I2C read & write command at dedicated
address. (E2 =0 in device select).
In RF read or write accesses to the Dynamic registers are associated to the dedicated commands, Read Dynamic
Configuration, Write Dynamic Configuration and Read Message Length.

DS10925 - Rev 11 page 21/197

 ST25DV04K ST25DV16K ST25DV64K
Fast transfer mode (FTM)

5.1 Fast transfer mode (FTM)

5.1.1 Fast transfer mode registers

Static Registers

Table 14. MB_MODE access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @0Dh R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2=1, 000Dh
Write Configuration (cmd code A1h) @0Dh session is open
locked

Table 15. MB_MODE

Bit Name Function Factory Value

0: Enabling fast transfer mode is forbidden.

b0 MB_MODE 0b
1: Enabling fast transfer mode is authorized.
b7-b1 RFU - 0000000b

Note: Refer to Table 11. System configuration memory map for the MB_MODE register.

Table 16. MB_WDG access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @0Eh R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2=1, 000Eh
Write Configuration (cmd code A1h) @0Eh session is open
locked

Table 17. MB_WDG

Bit Name Function Factory Value

Watch dog duration = 2(MB_WDG-1)x30ms±6

b2-b0 MB_WDG 111b
If MD_WDG = 0, then watchdog duration is infinite
b7-b3 RFU - 00000b

Note: Refer to Table 11. System configuration memory map for the MB_WDG register.

Dynamic Registers

Table 18. MB_CTRL_Dyn access

RF I2C

Command Type Address Type

Read Dynamic Configuration (cmd code ADh) @0Dh

Fast Read Dynamic Configuration (cmd code CDh) @0Dh b0: R always, W always b0: R always, W always
E2 = 0, 2006h
Write Dynamic Configuration (cmd code AEh) @0Dh b7-b1: RO b7-b1: RO
Fast Write Dynamic Configuration (cmd code CEh) @0Dh

DS10925 - Rev 11 page 22/197

 ST25DV04K ST25DV16K ST25DV64K
Fast transfer mode (FTM)

Table 19. MB_CTRL_Dyn

Bit Name Function Factory Value

0: Disable FTM, FTM mailbox is empty

b0 MB_EN (1) 0b
1: Enable FTM

0: No I2C message in FTM mailbox

b1 HOST_PUT_MSG 0b
1: I2C has Put a message in FTM mailbox
0: No RF message in FTM mailbox
b2 RF_PUT_MSG 0b
1: RF has Put message in FTM mailbox
b3 RFU - 0b

0: No message missed by I2C

b4 HOST_MISS_MSG 0b
1: I2C did not read RF message before watchdog time out
0: No message missed by RF
b5 RF_MISS_MSG 0b
1: RF did not read message before watchdog time out

0: No message or message not coming from I2C

b6 HOST_CURRENT_MSG 0b
1: Current Message in FTM mailbox comes from I2C
0: No message or message not coming from RF
b7 RF_CURRENT_MSG 0b
1: Current Message in FTM mailbox comes from RF

1. MB_EN bit is automatically reset to 0 if MB_MODE register is reset to 0.

Note: Refer to Table 12. Dynamic registers memory map for the MB_CTRL_Dyn register.

Table 20. MB_LEN_Dyn access

RF I2C

Command Type Address Type

Read Message Length (cmd code ABh)

RO E2 = 0, 2007h RO
Fast Read Message Length (cmd code CBh)

Table 21. MB_LEN_Dyn

Bit Name Function Factory Value

Size in byte, minus 1 byte, of message contained in FTM

b7-b0 MB_LEN 0h
mailbox (automatically set by ST25DVxxx)

Note: Refer to Table 12. Dynamic registers memory map for the MB_LEN_Dyn register.

5.1.2 Fast transfer mode usage

ST25DV acts as mailbox between RF (reader, smartphone, ...) and an I2C host (microcontroller...). Each interface
can send a message containing up to 256 bytes of data to the other interface through that mailbox.
To send data from RF reader to I2C host, fast transfer mode must be enabled, the mailbox must be free, VCC
power must be present, and the RF user must first writes the message containing data in the mailbox.
I2C host is then informed (by interruption on GPO output or polling on MB_CTRL_Dyn register) that a message
from RF is present in the mailbox.
Once the complete message has been read by I2C, mailbox is considered free again and is available for receiving
a new message (data is not cleared).
The RF user is informed that the message has been read by the I2C host by polling on MB_CTRL_Dyn register.

DS10925 - Rev 11 page 23/197

 ST25DV04K ST25DV16K ST25DV64K
Fast transfer mode (FTM)

Figure 9. RF to I2C fast transfer mode operation

ST25DV

Dynamic registers
MB_LEN_Dyn
MB_CRTL_Dyn

1Mb/s 26.5kb/s
RF message

Fast Transfer Mode mailbox ISO/IEC

I2C host I2C (256 Bytes) 15693 reader

Static registers
GPO/RF_PUT_MSG MB_MODE
MB_WDG

To send data from the I2C host to the RF reader, fast transfer mode must be enabled, the mailbox must be free,
VCC power must be present, and the I2C host must first write the message containing data in the mailbox.
The RF user must poll on MB_CTRL_Dyn register to check for the presence of a message from I2C in the
mailbox.
Once the complete message has been read by RF user, mailbox is considered free again and is available for
receiving a new message (data is not cleared).
The I2C host is informed that message has been read by RF user through a GPO interruption or by polling on the
MB_CTRL_Dyn register.

Figure 10. I2C to RF fast transfer mode operation

ST25DV

Dynamic registers
MB_LEN_Dyn
MB_CRTL_Dyn

Fast Transfer Mode mailbox ISO/IEC

I2C host I2C (256 Bytes) 15693 reader

Host message
1Mb/s
Up to
Static registers 53kb/s
GPO/RF_GET_MSG MB_MODE
MB_WDG

VCC supply source is mandatory to activate this feature.

No precedence rule is applied: the first request is served first.

DS10925 - Rev 11 page 24/197

 ST25DV04K ST25DV16K ST25DV64K
Fast transfer mode (FTM)

Adding a message is only possible when fast transfer mode is enabled (MB_EN=1) and mailbox is free
(HOST_PUT_MSG and RF_PUT_MSG cleared, which is the case after POR or after complete reading of I2C
message by RF, and complete reading of RF message by I2C).
A watchdog limits the message availability in time: when a time-out occurs, the mailbox is considered free, and
the HOST_MISS_MSG or RF_MISS_MSG bits is set into MB_CTRL_Dyn register. The data contained in the
mailbox is not cleared after a read or after the watchdog has been triggered: message data is still available
for read and until fast transfer mode is disabled. HOST_CURRENT_MSG and RF_CURRENT_MSG bits are
indicating the source of the current data.
The message is stored in a buffer (256 Bytes), and the write operation is done immediately. .
Caution: The data written in user or system memory (EEPROM), either from I2C or from RF, transits via the 256-Bytes
fast transfer mode's buffer. Consequently fast transfer mode must be deactivated (MB_EN=0) before starting
any write operation in user or system memory, otherwise command will be NotACK for I2C or get an answer 0Fh
for RF and programming is not done.

I2C access to mailbox

The access by I2C can be done by dedicated address mapping to mailbox (2008h to 2107h) with device identifier
E2 = 0.
I2C reading operation does not support rollover. Therefore data out is set to FFh when the counter reaches the
message end.
The RF_PUT_MSG is cleared after reaching the STOP consecutive to reading the last message byte, and the
mailbox is considered free (but the message is not cleared and it is still present in the mailbox).
A I2C reading operation will never clear HOST_PUT_MSG, and the message remains available for RF.
An I2C read can start at any address inside the mailbox (between address 2008h and 2107h).
A I2C write operation must start from the first mailbox location, at address 2008h. After reaching the Mailbox
border at address 2107h all bytes are NACK and the command is not executed (rollover feature not supported).
At the end of a successful I2C message write, the message length is automatically set into MB_LEN_Dyn register,
and HOST_PUT_MSG bit is set into MB_CTRL_Dyn register, and the write access to the mailbox is not possible
until the mailbox has been released again. MB_LEN_Dyn contains the size of the message in byte, minus 1.

RF access to mailbox
The RF Control & Access to mailbox is possible using dedicated custom commands:
• Read Dynamic Configuration and Fast Read Dynamic Configuration to check availability of mailbox.
• Write Dynamic Configuration and Fast Write Dynamic configuration to enable or disable fast transfer mode.
• Read Message Length and Fast Read Message Length to get the length of the contained message,
• Read Message and Fast Read Message to download the content of the mailbox,
• Write Message and Fast Write Message to put a new message in mailbox. (New length is automatically
updated after completion of a successful Write Message or Fast Write Message command).
HOST_PUT_MSG is cleared following a valid reading of the last message byte, and mailbox is considered free
(but message is not cleared and is still present in the mailbox).
A RF read can start at any address of inside the message, but return an error 0Fh if trying to read after the last
byte of the message.
A RF reading operation will never clear RF_PUT_MSG , the message will remain available for I2C.
At the end of a successful RF message write, the message length is automatically set in MB_LEN_Dyn register,
and RF_PUT_MSG bit is set in MB_CTRL_Dyn register. and write access to the mailbox is not possible until
mailbox has been freed again.
The presence of a DC supply is mandatory to get RF access to the mailbox. VCC_ON can be checked reading
the dynamic register EH_CTRL_Dyn.
To get more details about sequences to prepare and initiate a Fast Transfer, to detect progress of a fast transfer
or to control and execute a fast transfer, please refer to AN4910. How to exchange data between wired (I2C) and
wireless world (RF ISO15693) using fast transfer mode supported by ST25DVxxx).

DS10925 - Rev 11 page 25/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

Figure 11. Fast transfer mode mailbox access management.

MB_EN=00h or MB_EN=00h or
VCC OFF FTM disabled VCC OFF
MB_CTRL_Dyn=00h
No access

MB_EN=00h or VCC ON and

I2C read msg VCC OFF MB_EN=01h RF read msg

I2C write msg FTM enabled

FTM enabled RF write msg FTM enabled
Mailbox empty
I2C Message RF Message
MB_CTRL_Dyn=01h
MB_CTRL_Dyn=43h MB_CTRL_Dyn=85h
R/W access
Read access Read access

RF Mailbox free
rea sg
df ullm
ull df
ms r ea
g FTM enabled I2C
Mailbox free
MB_CTRL_Dyn=41/81h
R/W access

RF read I2C read

MB_CTRL_Dyn MB_CTRL_Dyn

FTM enabled
Mailbox free
MB_CTRL_Dyn=61/91h
Watchdog trig Watchdog trig
R/W access

Note: Assuming MB_MODE=01h

Assuming no error occurred

5.2 GPO
GPO signal is used to alert the I2C host of external RF events or ST25DVxxx processes activity. Several causes
could be used to request a host interruption. RF user can also directly drive GPO pin level using a dedicated RF
command.

5.2.1 Interrupt capabilities on RF events

The ST25DVxxx devices support multi interruption mode, and can report several events occurring through RF
interface.
In this chapter, all drawings refer to the open drain version of GPO output (ST25DVxxK-IE).
The reader can retrieve the behaviour of CMOS version (ST25DVxxK-JF) by inverting the GPO curve polarity, and
replacing text “released” or “high-Z” by “pull to ground”.
Supported RF events are listed hereafter:

DS10925 - Rev 11 page 26/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

RF_USER:
• GPO output level is controlled by Manage GPO command (set or reset)
• When RF_USER is activated, GPO level is changed after EOF of ST25DV response to a Manage GPO set
or reset command (see Section 7.6.30 Manage GPO).
• RF_USER is prevalent over all other GPO events when set by Manage GPO command (other interrupts
are still visible in IT_STS_Dyn status register, but do not change GPO output level).

Figure 12. RF_USER sequence

1) VCD sends a ManageGPO command with value 00h (set GPO) and ST25DV replies.
GPO/RF_USER is tied low after ST25DV response.

S ManageGPO E t1 S ST25DV E
O 00h O O O
command reply
F F F F

GPO/RF_USER (OD)

2) VCD sends a ManageGPO command with value 01h (reset GPO) and ST25DV replies.
GPO/RF_USER is set high-Z low after ST25DV response.

S ManageGPO E t1 S ST25DV E
O 01h O O O
command reply
F F F F

GPO/RF_USER (OD)

3) VCD sends a ManageGPO command (any value) and ST25DV replies with error.
GPO/RF_USER remains high-Z.

S ManageGPO
E t1 S ST25DV E
O command O O O
reply
F F F F

GPO/RF_USER (OD)

4) VCD sends a ManageGPO command (any value) and ST25DV stays quiet (command not for this
VICC, or quiet state). GPO/RF_USER remains high-Z.

S ManageGPO E
O command O
F F

GPO/RF_USER (OD)

5) VCD sends any command other than ManageGPO command and ST25DV replies.
GPO/RF_USER remains high-Z.

S Any other E t1/Wt S ST25DV E

O O O O
command reply
F F F F

GPO/RF_USER (OD)

DS10925 - Rev 11 page 27/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

RF_ACTIVITY:
• GPO output level reflects the RF activity.
• When RF_ACTIVITY is activated, a GPO output level change from RF command EOF to ST25DV
response EOF.

Figure 13. RF_ACTIVITY sequence

1) VCD sends a command and ST25DV replies. GPO/RF_ACTIVITY is released after ST25DV
response.
S VCD E t1 S ST25DV E
O O O O
command reply
F F F F

GPO/RF_ACTIVITY (OD)

2) VCD sends a write command and ST25DV replies after write completed. GPO/RF_ACTIVITY is
released after ST25DV response.

S Write E (m*)Wt S ST25DV E

O O O O
command reply
F F F F

GPO/RF_ACTIVITY (OD)

3) VCD sends a write command with option flag set to 1, and ST25DV replies after receiving EOF.
GPO/RF_ACTIVITY is released after ST25DV response.

S Write E >(m*)Wt E t1 S ST25DV E

O O O O O
command reply
F F F F F

GPO/RF_ACTIVITY (OD)

4) VCD sends an Inventory 16 slots command, and ST25DV replies in its slot. GPO/RF_ACTIVITY is
released after ST25DV response.

S Inventory E E E t1 S ST25DV E
O O O O O O
command reply
F F F F F F
Slot 1 Slot n
GPO/RF_ACTIVITY (OD)

5) VCD sends a command and ST25DV stays quiet (Stay Quiet command, command not for this
VICC, or quiet state). GPO/RF_ACTIVITY remains high-Z.

S VCD E
O Command O
F F

GPO/RF_ACTIVITY (OD)

DS10925 - Rev 11 page 28/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

RF_INTERRUPT:
• A pulse is emitted on GPO by Manage GPO command (interrupt).
• When RF_INTERRUPT is activated, a pulse of duration IT_TIME is emitted after EOF of ST25DV response
to a Manage GPO interrupt command (see Section 7.6.30 Manage GPO).

Figure 14. RF_INTERRUPT sequence

1) VCD sends a ManageGPO command with value 80h (GPO emit pulse) and ST25DV replies.
GPO/RF_INTERRUPT generates a pulse of duration IT_TIME after ST25DV response.

S ManageGPO E t1 S ST25DV E
O 80h O O O
command reply
F F F F

GPO/RF_INTERRUPT (OD)

2) VCD sends a ManageGPO command (any value) and ST25DV replies with error.
GPO/RF_INTERRUPT remains high-Z.

S ManageGPO
E t1 S ST25DV E
O command O O O
reply
F F F F

GPO/RF_INTERRUPT (OD)

3) VCD sends a ManageGPO command (any value) and ST25DV stays quiet (command not for this
VICC, or quiet state). GPO/RF_INTERRUPT remains high-Z.

S ManageGPO E
O command O
F F

GPO/RF_INTERRUPT (OD)

4) VCD sends any command other than ManageGPO command and ST25DV replies.
GPO/RF_INTERRUPT remains high-Z.

S Any other E t1/Wt S ST25DV E

O O O O
command reply
F F F F

GPO/RF_INTERRUPT (OD)

DS10925 - Rev 11 page 29/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

FIELD_CHANGE:
• A pulse is emitted on GPO to signal a change in RF field state.
• When FIELD_CHANGE is activated, and when RF field appear or disappear, GPO emits a pulse of
duration IT_TIME.
• If RF field disappears, the pulse is emitted only if VCC power supply is present.
• If RF is configured in RF_SLEEP mode, field change are not reported on GPO, even if FIELD_CHANGE
event is activated, as shown in Table 22.

Table 22. FIELD_CHANGE when RF is disabled or in sleep mode

RF_DISABLE RF_SLEEP GPO behaviour when FIELD_CHANGE is enabled

0 0
A pulse is emitted on GPO if RF field appears or disappears (1)
1 0
X 1 GPO remains high-Z (OD) or tied low (CMOS)
X 1 IT_STS_Dyn register is not updated.

1. assuming that GPO output is enabled (GPO_EN = 1).

Figure 15. FIELD_CHANGE sequence

1) RF field appears. GPO/FIELD_CHANGE generates a pulse during IT_TIME.

RF field

S First VCD E t1 S ST25DV E

O O O O
command reply
F F F F

GPO/FIELD_CHANGE (OD)

2) RF field disappears and ST25DV is powered through VCC. GPO/FIELD_CHANGE generates a

pulse during IT_TIME.

RF field

S VCD E t1 S ST25DV E
O O O reply O
command
F F F F

GPO/FIELD_CHANGE (OD)

3) RF field disappears and ST25DV is not powered through VCC. GPO/FIELD_CHANGE doesn’t
generates any pulse.

RF field

S VCD E t1 S ST25DV E
O O O reply O
command
F F F F

GPO/FIELD_CHANGE (OD)

DS10925 - Rev 11 page 30/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

RF_PUT_MSG:
• A pulse is emitted on GPO when a message is successfully written by RF in fast transfer mode mailbox.
• When RF_PUT_MSG is activated, a pulse of duration IT_TIME is emitted on GPO at completion of valid
Write Message or Fast Write Message commands (after EOF of ST25DV response).

Figure 16. RF_PUT_MSG sequence

1) VCD sends a Write Message or Fast Write Message command and ST25DV replies with no error.
GPO/RF_PUT_MSG generates a pulse during IT_TIME after ST25DV response.

S Write Msg E t1 S ST25DV E

O O O reply O
command
F F F F

GPO/RF_PUT_MSG (OD)

2) VCD sends a Write Message or Fast Write Message command and ST25DV replies with error.
GPO/RF_PUT_MSG remains high-Z.

S Write Msg E t1 S ST25DV E

O O O reply O
command
F F F F

GPO/RF_PUT_MSG (OD)

3) VCD sends Write Message or Fast Write Message command and ST25DV stays quiet (command
not for this VICC, or quiet state). GPO/RF_PUT_MSG stays high-Z.

S Write Msg E
O Command O
F F

GPO/RF_PUT_MSG (OD)

4) VCD sends a any other command than Write Message or Fast Write Message commands and
ST25DV replies. GPO/RF_PUT_MSG remains high-Z.

S Any other E t1 S ST25DV E

O O O O
command reply
F F F F

GPO/RF_PUT_MSG (OD)

DS10925 - Rev 11 page 31/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

RF_GET_MSG:
• A pulse is emitted on GPO when RF has successfully read a message, up to its last byte, in fast transfer
mode mailbox.
• When RF_GET_MSG is activated, a pulse of duration IT_TIME is emitted on GPO at completion of valid
Read Message or Fast Read Message commands (after EOF of ST25DV response), and end of message
has been reached.

Figure 17. RF_GET_MSG sequence

1) VCD sends a Read Message or Fast Read Message command and ST25DV replies with no error.
GPO/RF_GET_MSG generates a pulse during IT_TIME after ST25DV response.

S Read Msg E t1 S ST25DV E

O O O O
command reply
F F F F

GPO/RF_GET_MSG (OD)

2) VCD sends a Read Message or Fast Read Message command and ST25DV replies with error.
GPO/RF_GET_MSG remains high-Z.

S Read Msg E t1 S ST25DV E

O O O O
command reply
F F F F

GPO/RF_GET_MSG (OD)

3) VCD sends Read Message or Fast Read Message command and ST25DV stays quiet (command
not for this VICC, or quiet state). GPO/RF_GET_MSG stays high-Z.

S Read Msg E
O Command O
F F

GPO/RF_GET_MSG (OD)

4) VCD sends any other command than Read Message or Fast Read Message commands and
ST25DV replies. GPO/RF_GET_MSG remains high-Z.

S Any other E t1 S ST25DV E

O O O reply O
command
F F F F

GPO/RF_GET_MSG (OD)

DS10925 - Rev 11 page 32/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

RF_WRITE:
• When RF_WRITE is activated, a pulse of duration IT_TIME is emitted at completion of a valid RF write
operation in EEPROM (after EOF of ST25DV response).
• Following commands trigger the RF_WRITE interrupt after a valid write operation in EEPROM:
– Write Single Block
– Extended Write Single Block
– Write Multiple Block
– Extended Write Multiple Block
– Lock Block
– Extended Lock Block
– Write AFI
– Lock AFI
– Write DSFID
– Lock DSFID
– Write Configuration
– Write Password
• Note that writing in dynamic registers or fast transfer mode mailbox does not trigger RF_WRITE interrupt
(no write operation in EEPROM).

Figure 18. RF_WRITE sequence

1) VCD sends a write command and ST25DV replies after write completed. GPO/RF_WRITE
generates a pulse during IT_TIME after ST25DV response.

S Write E (m*)Wt S ST25DV E

O O O reply O
command
F F F F

GPO/RF_WRITE (OD)

2) VCD sends a write command with option flag set to 1, and ST25DV replies after receiving EOF.
GPO/RF_WRITE generates a pulse during IT_TIME after ST25DV response.

S Write E >(m*)Wt E t1 S ST25DV E

O O O O reply O
command
F F F F F

GPO/RF_WRITE (OD)

3) VCD sends a write command and ST25DV replies with error. GPO/RF_WRITE remains high-Z.

S Write E t1 S ST25DV E
O O O O
command reply
F F F F

GPO/RF_WRITE (OD)

4) VCD sends any other command than a write command. GPO/RF_WRITE remains high-Z.

S Any other E t1 S ST25DV E

O O O reply O
command
F F F F

GPO/RF_WRITE (OD)

5) VCD sends any command and ST25DV stays quiet (command not for this VICC, or quiet state).
RF_ACTIVITY remains high-Z.

S VCD E
O Command O
F F

GPO/RF_WRITE (OD)

DS10925 - Rev 11 page 33/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

5.2.2 GPO and power supply

When at the same time RF field is present and VCC is ON, GPO is acting as configured in GPO, GPO_CTRL_Dyn
and IT_TIME registers.
When the RF field disappears, the GPO state is reset and the output level is set to high-Z (open drain) or tied low
(CMOS). Interruption status in IT_STS_Dyn register is maintained until next I2C read or VCC power off.

Table 23. GPO interrupt capabilities in function of RF field

RF field on RF field off

GPO state is function of RF events (1) GPO remains High-Z (OD) or tied low (CMOS)

1. If pull-up resistor is powered (Open Drain-IE version), and VDCG is powered (CMOS –JF version).

When VCC is not present, or ST25DVxxx is in low power mode, all events are available on GPO pin, assuming
pull-up resistor is supplied with correct voltage (Open Drain-IE version) or VDCG is powered (CMOS-JF version).
The host can be waken up using GPO interrupt in any power condition.
The exception is FIELD_CHANGE when RF field is falling, which can’t be reported on GPO output if VCC is off or
in low power mode (no power supply on ST25DVxxx).

Table 24. GPO interrupt capabilities in function of VCC power supply

VCC ON and LPD high (1)

GPO events VCC OFF VCC ON and LPD low(1)
(low power mode)

FIELD_CHANGE if RF field GPO remains High-Z (OD) GPO remains High-Z (OD) or tied
Pulse emitted on GPO
disappears or tied low (CMOS) low (CMOS) (2)

GPO state is function of RF GPO state is function of

Any other activated RF event GPO state is function of RF events(2)
events(2) RF events(2)

1. For STM25DVxxK-JF only.

2. If pull-up resistor is powered (Open Drain-IE version) and VDCG is powered (CMOS-JF version).

DS10925 - Rev 11 page 34/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

5.2.3 GPO registers

Four registers are dedicated to this feature: two (static) in system configuration, and two dynamic.

Table 25. GPO access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @00h R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2 = 1, 0000h
Write Configuration (cmd code A1h) @00h session is open
locked

Table 26. GPO

Bit Name Function Factory value

0: disabled
b0 RF_USER_EN 0b
1: GPO output level is controlled by Manage GPO Command (set/reset)
0: disabled
b1 RF_ACTIVITY_EN 0b
1: GPO output level changes from RF command EOF to response EOF.
0: disabled
b2 RF_INTERRUPT_EN 0b
1: GPO output level is controlled by Manage GPO Command (pulse).
0: disabled
b3 FIELD_CHANGE_EN 1b
1: A pulse is emitted on GPO, when RF field appears or disappears.
0: disabled
b4 RF_PUT_MSG_EN 1: A pulse is emitted on GPO at completion of valid RF Write Message 0b
command.
0: disabled
b5 RF_GET_MSG_EN 1: A pulse is emitted on GPO at completion of valid RF Read Message 0b
command if end of message has been reached.
0: disabled
b6 RF_WRITE_EN 1: A pulse is emitted on GPO at completion of valid RF write operation in 0b
EEPROM.
0: GPO output is disabled. GPO is High-Z (open drain) or 0 (CMOS)
b7 GPO_EN 1b
1: GPO output is enabled. GPO outputs enabled interrupts.

Note: Refer to Table 11. System configuration memory map for the GPO register.
• Enables the interruption source, and enable GPO output.
• Several interruption sources can be enabled simultaneously.
• The updated value is valid for the next command (except for the RF_WRITE interrupt, which is valid right
after EOF of the Write Configuration command if enabled through RF).
• The GPO_EN bit (b7) allows to disable GPO output (High-Z for open drain version, driven low for CMOS
version). Interruptions are still reported in IT_STS_Dyn register.
• RF configuration security session (present RF password 0) or I2C security session (present I2C password)
must be open in order to write the GPO register.

DS10925 - Rev 11 page 35/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

Table 27. IT_TIME access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @01h R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2=1, 0001h
Write Configuration (cmd code A1h) @01h session is open
locked

Table 28. IT_TIME

Bit Name Function Factory Value

b2-b0 IT_TIME Pulse duration = 301 us - IT_TIME x 37.65 us ± 2 us 011b

b7-b3 RFU - 00000b

Note: Refer to Table 11. System configuration memory map for the IT_TIME register.
• Defines interrupt pulse duration on GPO pin for the flowing events: RF_INTERRUPT, FIELD_CHANGE,
RF_PUT_MSG, RF_GET_MSG and RF_WRITE.
• See Eq. (1) for interrupt duration calculation.
• RF configuration security session (present RF password 0) or I2C security session (present I2C password)
must be open in order to write IT_TIME register.

Table 29. GPO_CTRL_Dyn access

RF I2C

Command Type Address Type

Read Dynamic Configuration (cmd code ADh) @00h b0-b6: RO

RO E2 = 0, 2000h
Fast Read Dynamic Configuration (cmd code CDh) @00h b7 : R always, W always

Table 30. GPO_CTRL_Dyn

Bit Name Function Factory Value

0: disabled
b0 RF_USER_EN 0b
1: GPO output level is controlled by Manage GPO Command (set/reset)
0: disabled
b1 RF_ACTIVITY_EN 0b
1: GPO output level changes from RF command EOF to response EOF.
0: disabled
b2 RF_INTERRUPT_EN 0b
1: GPO output level is controlled by Manage GPO Command (pulse).
0: disabled
b3 FIELD_CHANGE_EN 1b
1: A pulse is emitted on GPO, when RF field appears or disappears.
0: disabled
b4 RF_PUT_MSG_EN 0b
1: A pulse is emitted on GPO at completion of valid RF Write Message command.
0: disabled
b5 RF_GET_MSG_EN 1: A pulse is emitted on GPO at completion of valid RF Read Message command if 0b
end of message has been reached.
0: disabled
b6 RF_WRITE_EN 1: A pulse is emitted on GPO at completion of valid RF write operation in 0b
EEPROM.
0: GPO output is disabled. GPO is High-Z (open drain) or 0 (CMOS)
b7 GPO_EN 1b
1: GPO output is enabled. GPO outputs enabled interrupts.

DS10925 - Rev 11 page 36/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

Note: Refer to Table 12. Dynamic registers memory map for the GPO_CTRL_Dyn register.
• Allows I2C host to dynamically enable or disable GPO output by writing in GPO_EN bit (b7).
• GPO_EN bit of GPO_CTRL_Dyn register is prevalent over GPO_EN bit of GPO register.
• At power up, and each time GPO register is updated, GPO_CTRL_Dyn content is copied from GPO
register.
• GPO_CTRL_Dyn is a volatile register. Value is maintained only if at least one of the two power sources is
present (RF field or VCC).
• GPO_CTRL_Dyn bit 7 (GPO_EN) can be written even if I2C security session is closed (I2C password not
presented) but is read only for RF user.
• Modifying GPO_CTRL_Dyn, the bit 7 GPO_EN does not affect the value of GPO register bit 7 GPO_EN

Table 31. IT_STS_Dyn access

RF I2C

Command Type Address Type

No access E2 = 0, 2005h RO

Table 32. IT_STS_Dyn

Bit Name Function Factory Value

0: Manage GPO reset GPO

b0 RF_USER 0b
1: Manage GPO set GPO
0: No RF access
b1 RF_ACTIVITY 0b
1: RF access
0: No Manage GPO interrupt request
b2 RF_INTERRUPT 0b
1: Manage GPO interrupt request
0: No RF field falling
b3 FIELD_FALLING 0b
1: RF Field falling
0: No RF field rising
b4 FIELD_RISING 0b
1: RF field rising
0: No message put by RF in FTM mailbox
b5 RF_PUT_MSG 0b
1: Message put by RF in FTM mailbox
0: No message read by RF from FTM mailbox
b6 RF_GET_MSG 1: Message read by RF from FTM mailbox, and end of 0b
message has been reached.
0: No write in EEPROM
b7 RF_WRITE 0b
1: Write in EEPROM

Note: Refer to Table 12. Dynamic registers memory map for the IT_STS_Dyn register.
• Cumulates all events which generate interruptions. It should be checked by I2C host to know which event
triggered an interrupt on GPO pin.
• When enabled, RF events are reported in IT_STS_Dyn register even if GPO output is disabled though the
GPO_EN bit.
• Once read the ITSTS_Dyn register is cleared (set to 00h).
• At power up, IT_STS_Dyn content is cleared (set to 00h).
• IT_STS_Dyn is a volatile register. Value is maintained only if at least one of the two power sources is
present (RF field or VCC).

DS10925 - Rev 11 page 37/197

 ST25DV04K ST25DV16K ST25DV64K
GPO

5.2.4 Configuring GPO

GPO and interruption pulse duration can be configured by RF user or by I2C host. One or more interrupts can be
enabled at same time.
RF user can use Read Configuration and Write Configuration commands to set accordingly the GPO and
IT_TIME registers, after presenting a valid RF configuration password to open RF configuration security session.
I2C host can write GPO and IT_TIME registers, after presenting a valid I2C password to open I2C security
session.
Enabling or disabling GPO output:
• RF user and I2C host can disable or enable GPO output at power up time by writing in GPO_EN bit 7 of
GPO register (if write access is granted).
• I2C host can temporarily enable or disable GPO output at any time by toggling GPO_EN bit 7 of
GPO_CTRL_Dyn register. No password is required to write into GPO_CTRL_Dyn register.
• Disabling GPO output by writing in GPO_EN bit (either in GPO or in GPO_CTRL_Dyn registers) does not
disable interruption report in IT_STS_Dyn status register.

Table 33. Enabling or disabling GPO interruptions

GPO bit 7: GPO_CTRL_Dyn bit 7:

GPO output
GPO_EN GPO_EN

0 0 GPO remains High-Z (OD) or tied low (CMOS)

1 0 GPO remains High-Z (OD) or tied low (CMOS)

0 1 Activated RF events are reported on GPO output (1)

1 1 Activated RF events are reported on GPO output(1)

1. If pull-up resistor is powered (Open Drain -IE version), and VDCG is powered (CMOS –JF version).

Interruption pulse duration configuration:

• Interrupt pulse duration is configured by writing pulse duration value in IT_TIME register.
• Pulse duration is calculated with the following equation
IT pulse duration equation:
ITpulse duration = 301μs − IT_TIME × 37.65μs ± 2μs (1)

DS10925 - Rev 11 page 38/197

 ST25DV04K ST25DV16K ST25DV64K
Energy harvesting (EH)

5.3 Energy harvesting (EH)

5.3.1 Energy harvesting registers

Table 34. EH_MODE access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @02h R always, W if RF configuration security E2 = 1, R always, W if I2C security
Write Configuration (cmd code A1h) @02h session is open and configuration not locked 0002h session is open

Table 35. EH_MODE

Bit Name Function Factory Value

0: EH forced after boot

b0 EH_MODE 1b
1: EH on demand only
b7-b1 RFU - 0000000b

Note: Refer to Table 11. System configuration memory map for the EH_MODE register.

Table 36. EH_CTRL_Dyn access

RF I2C

Command Type Address Type

Read Dynamic Configuration (cmd code ADh) @02h

Fast Read Dynamic Configuration (cmd code CDh) @02h b0: R always, W always b0: R always, W always
E2=0, 2002h
Write Dynamic Configuration (cmd code AEh) @02h b1 - b7: RO b1-b7 : RO
Fast Write Dynamic Configuration (cmd code CEh) @02h

Table 37. EH_CTRL_Dyn

Bit Name Function Factory Value

0: Disable EH feature
b0 EH_EN 0b
1: Enable EH feature
0: EH feature is disabled
b1 EH_ON 0b
1: EH feature is enabled
0: RF field is not detected
b2 FIELD_ON Depending of power source
1: RF field is present and ST25DVxxx may communicate in RF
0: No DC supply detected on VCC pin or Low Power Down mode is forced (LPD is high)
b3 VCC_ON Depending of power source
1: VCC supply is present and Low Power Down mode is not forced (LPD is low)

b7-b4 RFU - 0b

Note: Refer to Table 12. Dynamic registers memory map for the EH_CTRL_Dyn register.

5.3.2 Energy harvesting feature description

The usage of Energy Harvesting element can be defined in configuration register EH_MODE. When the Energy
harvesting mode is disabled or the RF field strength is not sufficient, the energy harvesting analog voltage output
V_EH is in High-Z state.
EH_MODE Static Register is used to define the Energy Harvesting default strategy after boot.

DS10925 - Rev 11 page 39/197

 ST25DV04K ST25DV16K ST25DV64K
Energy harvesting (EH)

At boot EH_EN (in EH_CTRL_Dyn register) is set depending EH_MODE value as shown in table below:

Table 38. Energy harvesting at power-up

EH_MODE EH_EN (at boot) Energy harvesting at power-up

0 1 EH enabled after boot (when possible)

EH disabled initially,
1 0
EH delivered on demand (when possible)

Writing 0 in EH_MODE at any time after boot will automatically set EH_EN bit to 1, and thus activate energy
harvesting.
Writing 1 in EH_MODE at any time after boot will not modify EH_EN bit (until next reboot) and thus will not modify
energy harvesting current state.
EH_CTRL_Dyn allows to activate or deactivate on the fly the Energy harvesting (EH_EN) and bring information
on actual state of EH and state of power supplies :
• EH_ON set reflects the EH_EN bit value
• FIELD_ON is set in presence of a RF field
• VCC_ON is set when Host power supply is on, and low power-down mode is not forced.
During boot, EH is not delivered to avoid alteration in device configuration.
Caution: Communication is not guaranteed during EH delivery. Refer to the application note AN4913 (Energy harvesting
delivery impact on ST25DVxxx behaviour during RF communication).
Energy harvesting can be set even if ST25DVxxx is in RF disabled or RF Sleep mode, or in Low power mode.
In all these cases, ST25DVxxx will deliver power on V_EH pin if RF field is present. Energy harvesting voltage
output is not regulated.

DS10925 - Rev 11 page 40/197

 ST25DV04K ST25DV16K ST25DV64K
Energy harvesting (EH)

5.3.3 EH delivery state diagram

Figure 19. EH delivery state diagram

No EH
requested

RF Field ON
FF Vcc ON Vc
l dO c OF
Fie F
RF N Vc
O cO
F ield N
RF
No EH No EH
requested requested

RF Field OFF RF Field ON

Vcc ON Vc F Vcc OFF
cO OF
FF ld
F Fie
R
EH Vcc ON
Write EH_CTRL_Dyn=1

Write EH_CTRL_Dyn=0
RF Write EH_MODE=0
I2C Write EH_MODE=0

_M ON eld =1
Write EH_MODE=0

i
DE

EH_CTRL_Dyn=1
EH_CTRL_Dyn=0

EH_CTRL_Dyn=0
F
EH_CTRL_Dyn=1

OD RF _MO
E=
1 EH
I2C Write

RF Write
RF Write
I2C Write

Power OFF
or

or
or

RF Field OFF
N Vcc OFF RF
c O =0 EH Fie
Vc ODE _M ld O
_M OD N
EH E=
RF 0
FF Fie
cO
EH Vc ld
OF
F EH
requested delivered
not delivered
RF Field OFF RF Field ON
Vcc ON Vcc OFF
RF
Fie c ON
ld
OF Vc
RF F
Fie F
ld c OF
OF
F Vc
EH
delivered

RF Field ON
Vcc ON

Note: Power is delivered on V_EH only if harvested energy is sufficient to supply ST25DV and leave over power.
Grey color indicates the states where power is delivered on V_EH pin.

DS10925 - Rev 11 page 41/197

 ST25DV04K ST25DV16K ST25DV64K
Energy harvesting (EH)

5.3.4 EH delivery sequence

Figure 20. ST25DVxxx Energy Harvesting Delivery Sequence

No
Boot Boot

Vcc
No No
Boot Boot Boot
RF
Field(1)

With EH_MODE=0 :
Reset Set Reset Set Reset
EH_EN EH_EN EH_EN EH_EN EH_EN EH_EN
EH_ON

V_EH(2)

With EH_MODE=1 :
Set Reset Set Reset Set Set
EH_EN EH_EN EH_EN EH_EN EH_EN EH_EN
EH_EN
EH_ON

V_EH(2)

1. We suppose that the captured RF power is sufficient to trig EH delivery.

2. V_EH = 1 means some µW are available on V_EH pin.
V_EH = 0 means V_EH pin is in high-Z.

DS10925 - Rev 11 page 42/197

 ST25DV04K ST25DV16K ST25DV64K
RF management feature

5.4 RF management feature

5.4.1 RF management registers

Table 39. RF_MNGT access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @03h R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2 = 1, 0003h
Write Configuration (cmd code A1h) @03h session is open
locked

Table 40. RF_MNGT

Bit Name Function Factory Value

0: RF commands executed
b0 RF_DISABLE 0b
1: RF commands not executed (error 0Fh returned)
0: RF communication enabled
b1 RF_SLEEP 0b
1: RF communication disabled (ST25DV remains silent)
b7-b2 RFU - 000000b

Note: Refer to Table 11. System configuration memory map for the RF_MNGT register.

Table 41. RF_MNGT_Dyn access

RF I2C

Command Type Address Type

No access E2 = 0, 2003h R always, W always

Table 42. RF_MNGT_Dyn

Bit Name Function Factory Value

0: RF commands executed
b0 RF_DISABLE 0b
1: RF commands not executed (error 0Fh returned)
0: RF communication enabled
b1 RF_SLEEP 0b
1: RF communication disabled (ST25DV remains silent)
b7-b2 RFU - 0000000b

Note: Refer to Table 12. Dynamic registers memory map for the RF_MNGT_Dyn register.

DS10925 - Rev 11 page 43/197

 ST25DV04K ST25DV16K ST25DV64K
RF management feature

5.4.2 RF management feature description

RF_MNGT Register is used to control the RF communication between ST25DVxxx and a RF reader.
At boot time, and each time RF_MNGT register it is updated, content of RF_MNGT_Dyn register is copied
from RF_MNGT register. The content of RF_MNGT_Dyn register is used during application to set ST25DVxxx
behavior.
Content of this dynamic register RF_MNGT_Dyn can be updated on the fly, to temporarily modify the behavior of
ST25DVxxx without affecting the static value of RF_MNGT which will be recovered at next POR.
RF_MNGT register is composed of two bits (see Table 42. RF_MNGT_Dyn): RF_DISABLE and RF_SLEEP
For a normal usage of RF interface, bits RF_SLEEP and RF_DISABLE must be set to 0.
For RF are offered three modes:
• RF sleep mode:
– When RF_SLEEP is set to 1, all RF communications are disabled, RF interface doesn’t interpret
commands, but minimizes consumption of RF interface.
• RF disable mode:
– When RF_SLEEP is set to 0 and RF_DISABLE is set to 1, RF commands are interpreted but not
executed. In case of a valid command, ST25DVxxx will respond after t1 with the error code 0Fh. The
Inventory command is not answered.
• RF normal mode:
– In normal usage, RF_SLEEP and RF_DISABLE are set to 0, ST25DVxxx will process the request
and respond accordingly when I2C is not accessing ST25DVxxx. If I2C is busy, ST25DV will respond
to RF request with the error code 0Fh.

DS10925 - Rev 11 page 44/197

 ST25DV04K ST25DV16K ST25DV64K
Interface arbitration

5.5 Interface arbitration

The device automatically arbitrates the exclusive usage of RF and I2C interfaces. Arbitration scheme obeys to
“first talk first served” principle (see Figure 21).

Figure 21. Arbitration between RF and I2C

Power OFF

VCC ON
or
RF field ON

Boot
RF mute
I2C mute

Boot done

RF request SOF I2C start

I2C busy
RF busy ST25DV standby
(0Fh or no
(I2C commamds RF free
response to RF
are NoAck) I2C free
requests)

RF transaction terminated I2C transition terminated

RF transaction is terminated:
• at response EOF if answered
• at request EOF is not answered
• at RF field OFF.

I2C transaction is terminated:

• at the end of EEPROM programming time after the stop condition of a successful write into EEPROM (user
memory or system configuration). See Section 6.4 I2C write operations for write time calculation
• at stop condition for any other I2C transaction
• at VCC power off
• at any I2C error (terminated before stop condition)
• at I2C timeout if it occurs
When RF is busy, I2C interface answers by NoAck on any I2C command.
When I2C is busy, RF commands receive no response (Inventory, Stay quiet, addressed commands) or error code
0Fh for any other command.

DS10925 - Rev 11 page 45/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

5.6 Data Protection

ST25DVxxx provides a special data protection mechanism based on passwords that unlock security sessions.
User memory can be protected for read and/or write access and system configuration can be protected from write
access, both from RF and I2C assess.

5.6.1 Data protection registers

Table 43. RFA1SS access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @04h R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2 = 1, 0004h
Write Configuration (cmd code A1h) @04h session is open
locked

Table 44. RFA1SS

Bit Name Function Factory Value

00: Area 1 RF user security session can’t be open by password

01: Area 1 RF user security session is open by RF_PWD_1
b1-b0 PWD_CTRL_A1 00b
10: Area 1 RF user security session is open by RF_PWD_2
11: Area 1 RF user security session is open by RF_PWD_3
00: Area 1 RF access: Read always allowed / Write always allowed
01: Area 1 RF access: Read always allowed, Write allowed if RF user security
session is open
b3-b2 RW_PROTECTION_A1 00b
10: Area 1 RF access: Read always allowed, Write allowed if RF user security
session is open
11: Area 1 RF access: Read always allowed, Write always forbidden
b7-b4 RFU - 0000b

Note: Refer to Table 11. System configuration memory map for the RFA1SS register.

Table 45. RFA2SS access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @06h R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2 = 1, 0006h
Write Configuration (cmd code A1h) @06h session is open
locked

DS10925 - Rev 11 page 46/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Table 46. RFA2SS

Bit Name Function Factory Value

00: Area 2 RF user security session can’t be open by password

01: Area 2 RF user security session is open by RF_PWD_1
b1-b0 PWD_CTRL_A2 00b
10: Area 2 RF user security session is open by RF_PWD_2
11: Area 2 RF user security session is open by RF_PWD_3
00: Area 2 RF access: Read always allowed, Write always allowed
01: Area 2 RF access: Read always allowed, Write allowed if RF user security
session is open
b3-b2 RW_PROTECTION_A2 10: Area 2 RF access: Read allowed if RF user security session is open, Write 00b
allowed if RF user security session is open
11: Area 2 RF access: Read allowed if RF user security session is open, Write
always forbidden

Note: Refer to Table 11. System configuration memory map for the RFA2SS register.

Table 47. RFA3SS access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @08h R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2 = 1, 0008h
Write Configuration (cmd code A1h) @08h session is open
locked

Table 48. RFA3SS

Bit Name Function Factory Value

00: Area 3 RF user security session can’t be open by password

01: Area 3 RF user security session is open by RF_PWD_1
b1-b0 PWD_CTRL_A3 00b
10: Area 3 RF user security session is open by RF_PWD_2
11: Area 3 RF user security session is open by RF_PWD_3
00: Area 3 RF access: Read always allowed / Write always allowed
01: Area 3 RF access: Read always allowed, Write allowed if RF user security
session is open
b3-b2 RW_PROTECTION_A3 10: Area 3 RF access: Read allowed if RF user security session is open, Write 00b
allowed if RF user security session is open
11: Area 3 RF access: Read allowed if RF user security session is open, Write
always forbidden
b7-b4 RFU - 0000b

Note: Refer to Table 11. System configuration memory map for the RFA3SS register.

Table 49. RFA4SS access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @0Ah R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2 = 1, 000Ah
Write Configuration (cmd code A1h) @0Ah session is open
locked

DS10925 - Rev 11 page 47/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Table 50. RFA4SS

Bit Name Function Factory Value

00: Area 4RF user security session can’t be open by password

01: Area 4 RF user security session is open by RF_PWD_1
b1-b0 PWD_CTRL_A4 00b
10: Area 4 RF user security session is open by RF_PWD_2
11: Area 4 RF user security session is open by RF_PWD_3
00: Area 4 RF access: Read always allowed, Write always allowed
01: Area 4 RF access: Read always allowed, Write allowed if RF user security
session is open
b3-b2 RW_PROTECTION_A4 10: Area 4 RF access: Read allowed if RF user security session is open, Write 00b
allowed if RF user security session is open
11: Area 4 RF access: Read allowed if RF user security session is open, Write
always forbidden
b7-b4 RFU - 0000b

Note: Refer to Table 11. System configuration memory map for the RFA4SS register.

Table 51. I2CSS access

RF I2C

Command Type Address Type

R always, W if I2C security

No access E2 = 1, 000Bh
session is open

DS10925 - Rev 11 page 48/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Table 52. I2CSS

Bit Name Function Factory Value

00: Area 1 I2C access: Read always allowed, Write always allowed

01: Area 1 I2C

access: Read always allowed, Write allowed if I2C user security
session is open
b1-b0 RW_PROTECTION_A1 00b
10: Area 1 I2C access: Read always allowed, Write always allowed

11: Area 1 I2C access: Read always allowed, Write allowed if I2C user security
session is open

00: Area 2 I2C access: Read always allowed, Write always allowed

01: Area 2 I2C access: Read always allowed, Write allowed if I2C user security
session is open
b3-b2 RW_PROTECTION_A2 10: Area 2 I2C access: Read allowed if I2C user security session is open, Write 00b
always allowed

11: Area 2 I2C access: Read allowed if I2C security session is open, Write
allowed if I2C security session is open

00: Area 3 I2C access: Read always allowed, Write always allowed

01: Area 3 I2C access: Read always allowed, Write allowed if I2C user security
session is open
b5-b4 RW_PROTECTION_A3 10: Area 3 I2C access: Read allowed if I2C user security session is open, Write 00b
always allowed

11: Area 3 I2C access: Read allowed if I2C security session is open, Write
allowed if I2C security session is open

00: Area 4 I2C access: Read always allowed, Write always allowed

01: Area 4 I2C access: Read always allowed, Write allowed if I2C user security
session is open
b7-b6 RW_PROTECTION_A4 10: Area 4 I2C access: Read allowed if I2C user security session is open, Write 00b
always allowed

11: Area 4 I2C access: Read allowed if I2C security session is open, Write
allowed if I2C security session is open

Note: Refer to Table 11. System configuration memory map for the I2CSS register.

DS10925 - Rev 11 page 49/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Table 53. LOCK_CCFILE access

RF I2C

Command Type Address Type

Lock Block (cmd code 22h) @00h/01h

Ext Lock Block (cmd code 32h) @00h/01h
Read Block (cmd code 20h) @00h/01h
Fast Read Block(1) (cmd code C0h) @00h/01h
Ext Read Block(1) (cmd code 30h) @00h/01h
Fast Ext Read Block(1) (cmd code C4h) @00h/01h R always
Read Multi Block(1) (cmd code 23h) @00h/01h R always, W if I2C
b0: W if Block 00h is not already locked, E2 = 1, 000Ch
security session is open
Ext Read Multi Block(1) (cmd code 33h) @00h/01h b1: W if Block 01h is not already locked.
Fast Read Multi Block(1) (cmd code C3h)
@00h/01h
Fast Ext Read Multi Block(1) (cmd code C5h)
@00h/01h
Get Multi Block SS (cmd code 2Ch) @00h/01h
Ext Get Multi Block SS (cmd code 3Ch) @00h/01h

1. With option flag set to 1.

Table 54. LOCK_CCFILE

Bit Name Function Factory Value

0: Block @ 00h is not Write locked

b0 LCKBCK0 0b
1: Block @ 00h is Write locked
0: Block @ 01h is not Write locked
b1 LCKBCK1 0b
1: Block @ 01h is Write locked
b7-b2 RFU - 000000b

Note: Refer to Table 11. System configuration memory map for the LOCK_CCFILE register.

Table 55. LOCK_CFG access

RF I2C

Command Type Address Type

Read Configuration (cmd code A0h) @0Fh R always, W if RF configuration security

R always, W if I2C security
session is open and configuration not E2 = 1, 000Fh
Write Configuration (cmd code A1h) @0Fh session is open
locked

Table 56. LOCK_CFG

Bit Name Function Factory Value

0: Configuration is unlocked
b0 LCK_CFG 0b
1: Configuration is locked
b7-b1 RFU - 0000000b

Note: Refer to Table 11. System configuration memory map for the LOCK_CFG register.

DS10925 - Rev 11 page 50/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Table 57. I2C_PWD access

RF I2C

Command Type Address Type

E2 = 1, 0900h to 0907h, Present/Write password

No access R if I2C security session is open, W if I2C security session is open
command format.

Table 58. I2C_PWD

Factory
I2C address Bit Name Function
Value

0900h b7-b0 Byte 7 (MSB) of password for I2C security session 00h

0901h b7-b0 Byte 6 of password for I2C security session 00h

0902h b7-b0 Byte 5 of password for I2C security session 00h

0903h b7-b0 Byte 4 of password for I2C security session 00h

I2C_PWD
0904h b7-b0 Byte 3 of password for I2C security session 00h

0905h b7-b0 Byte 2 of password for I2C security session 00h

0906h b7-b0 Byte 1 of password for I2C security session 00h

0907h b7-b0 Byte 0 (LSB) of password for I2C security session 00h

Note: Refer to Table 11. System configuration memory map for the I2C_PWD register.

Table 59. RF_PWD_0 access

RF I2C

Command Type Address Type

Present Password (cmd code B3h) WO if RF configuration security session is

No access
Write Password (cmd code B1h) open

Table 60. RF_PWD_0

Bit Name Function Factory Value

Byte 0 (LSB) of password for RF configuration security

00h
session
Byte 1 of password for RF configuration security session 00h
Byte 2 of password for RF configuration security session 00h
Byte 3 of password for RF configuration security session 00h
b7-b0 RF_PWD_0
Byte 4 of password for RF configuration security session 00h
Byte 5 of password for RF configuration security session 00h
Byte 6 of password for RF configuration security session 00h
Byte 7 (MSB) of password for RF configuration security
00h
session

Note: Refer to Table 11. System configuration memory map for the RF_PWD_0 register.

DS10925 - Rev 11 page 51/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Table 61. RF_PWD_1 access

RF I2C

Command Type Address Type

Present Password (cmd code B3h) WO if RF configuration security session

No access
Write Password (cmd code B1h) is open with RF password 1

Table 62. RF_PWD_1

Bit Name Function Factory Value

Byte 0 (LSB) of password 1 for RF user security session 00h

Byte 1 of password 1 for RF user security session 00h
Byte 2 of password 1 for RF user security session 00h
Byte 3 of password 1 for RF user security session 00h
b7-b0 RF_PWD_1
Byte 4 of password 1 for RF user security session 00h
Byte 5 of password 1 for RF user security session 00h
Byte 6 of password 1 for RF user security session 00h
Byte 7 (MSB) of password 1 for RF user security session 00h

Note: Refer to Table 11. System configuration memory map for the RF_PWD_1 register.

Table 63. RF_PWD_2 access

RF I2C

Command Type Address Type

Present Password (cmd code B3h) WO if RF user security session is open

No access
Write Password (cmd code B1h) with RF password 2

Table 64. RF_PWD_2

Bit Name Function Factory Value

Byte 0 (LSB) of password 2 for RF user security session 00h

Byte 1 of password 2 for RF user security session 00h
Byte 2 of password 2 for RF user security session 00h
Byte 3 of password 2 for RF user security session 00h
b7-b0 RF_PWD_2
Byte 4 of password 2 for RF user security session 00h
Byte 5 of password 2 for RF user security session 00h
Byte 6 of password 2 for RF user security session 00h
Byte 7 (MSB) of password 2 for RF user security session 00h

Note: Refer to Table 11. System configuration memory map for the RF_PWD_2 register.

Table 65. RF_PWD_3 access

RF I2C

Command Type Address Type

Present Password (cmd code B3h) WO if RF user security session is open

No access
Write Password (cmd code B1h) with RF password 3

DS10925 - Rev 11 page 52/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Table 66. RF_PWD_3

Bit Name Function Factory Value

Byte 0 (LSB) of password 3for RF user security session 00h

Byte 1 of password 3 for RF user security session 00h
Byte 2 of password 3 for RF user security session 00h
Byte 3 of password 3 for RF user security session 00h
b7-b0 RF_PWD_3
Byte 4 of password 3 for RF user security session 00h
Byte 5 of password 3 for RF user security session 00h
Byte 6 of password 3 for RF user security session 00h
Byte 7 (MSB) of password 3 for RF user security session 00h

Note: Refer to Table 11. System configuration memory map for the RF_PWD_3 register.

Table 67. I2C_SSO_Dyn access

RF I2C

Command Type Address Type

No access E2 = 0, 2004h RO

Table 68. I2C_SSO_Dyn

Bit Name Function Factory Value

b7-b1 RFU - 0b

0: I2C security session close

b0 I2C_SSO 1: I2C security session open 0b

(Set or reset via I2C Present password command)

Note: Refer to Table 12. Dynamic registers memory map for the I2C_SSO_Dyn register.

5.6.2 Passwords and security sessions

ST25DVxxx provides protection of user memory and system configuration static registers. RF user and I2C host
can access those protected data by opening security sessions with the help of passwords. Access rights is more
restricted when security sessions are closed, and less restricted when security sessions are open.
Dynamic registers and fast transfer mode mailbox are not protected by any security session.
There is three type of security sessions, as shown in Table 69. Security session type:

DS10925 - Rev 11 page 53/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Table 69. Security session type

Security session Open by presenting Right granted when security session is open, and until it is closed

RF password 1, 2 or 3 (1)
RF user access to protected user memory as defined in RFAiSS registers
RF user (RF_PWD_1, RF_PWD_2,
RF user write access to RF password 1, 2 or 3 (2)
RF_PWD_3)
RF password 0 RF user write access to configuration static registers
RF configuration
(RF_PWD_0) RF user write access to RF password 0

I2C host access to protected user memory as defined in I2CSS register

I2C password
I2C I2C host write access to configuration static registers
(I2C_PWD)
I2C host write access to I2C password

1. Password number must be the same as the one selected for protection.
2. Write access to the password number corresponding to the password number presented.

All passwords are 64-bits long, and default factory passwords value is 0000000000000000h.
The ST25DVxxx passwords management is organized around RF and I2C dedicated set of commands to access
the dedicated registers in system configuration area where password values are stored.
The dedicated password commands in RF mode are:
• Write Password command (code B1h): see Section 7.6.35 Write Password.
• Present Password command (code B3h): see Section 7.6.36 Present Password.
RF user possible actions for security sessions are:
• Open RF user security session: Present Password command, with password number 1, 2 or 3 and the
valid corresponding password
• Write RF password: Present Password command, with password number (0, 1, 2 or 3) and the current
valid corresponding password. Then Write Password command, with same password number (0, 1, 2 or 3)
and the new corresponding password.
• Close RF user security session: Present Password command, with a different password number than
the one used to open session or any wrong password. Or remove tag from RF field (POR). Presenting a
password with an invalid password number doesn't close the session.
• Open RF configuration security session: Present Password command, with password number 0 and the
valid password 0.
• Close RF configuration security session: Present Password command, with a password number
different than 0, or password number 0 and wrong password 0. Or remove tag from RF field (POR).
Presenting a password with an invalid password number doesn't close the session.
Opening any new RF security session (user or configuration) automatically close the previously open one (even if
it fails).
There is no interaction between I2C and RF security sessions. Both are independent, and can run in parallel.
Caution: If ST25DVxxx is powered through VCC, removing VCC during a RF command can abort the command. As a
consequence, before writing a new password, RF user should check if VCC is ON, by reading EH_CTRL_Dyn
register bit 3 (VCC_ON), and eventually ask host to maintain or to shut down VCC, before issuing the Write
Password command in order to avoid password corruption.
To make the application more robust, it is recommended to use addressed or selected mode during write
password operations to get the traceability of which tags/UID have been programmed.

DS10925 - Rev 11 page 54/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Figure 22. RF security sessions management

ST25DV out
of RF field

RF field ON RF field OFF

All RF
security
Any other sessions
command closed
Present any RF
password not OK(1)
Present
RF_PWD_x OK

RF security
session x
Any other opened
command (y closed)

Present Present
RF_PWD_x OK RF_PWD_y OK

RF security
session y
Any other opened
command (x closed)

1. Presenting a password with an invalid password number doesn't close the session.

The dedicated password commands in I2C mode are:

• I2C Write Password command: see Section 6.6.2 I2C write password command description.
• I2C Present Password command: see Section 6.6.1 I2C present password command description.
I2C host possible actions for security sessions are:
• Open I 2 C security session: I2C Present Password command with valid I2C password.
• Write I 2 C password: I2C Present Password command with valid I2C password. Then I2C Write Password
command with new I2C password.
• Close I 2 C security session: I2C Present Password command with wrong I2C password. Or remove tag
VCC power supply (POR).
• Check if I 2 C security session is open: I2C host can read the current status (open or closed) of I2C
security session by reading the I2C_SSO_Dyn register.
There is no interaction between I2C and RF security sessions. Both are independent and can run in parallel.

DS10925 - Rev 11 page 55/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

Figure 23. I2C security sessions management

VCC OFF

VCC
VCC ON
OFF

Any other
I2C security
command
session closed
I2C_SSO=00h

Present
Present I2C_PWD
I2C_PWD not OK OK

I2C security
Any other session opened
command I2C_SSO=01h

5.6.3 User memory protection

On factory delivery, areas are not protected.
Each area can be individually protected in read and/or write access from RF and I2C.
Area 1 is always readable (from RF and I2C).
Furthermore, RF blocks 0 and 1 (I2C bytes 0000h to 0007h) can be independently write locked.

User memory protection from RF access

In RF mode, each memory area of the ST25DVxxx can be individually protected by one out of three available
passwords (RF password 1, 2 or 3), and each area can also have individual Read/Write access conditions.
For each area, an RFAiSS register is used to:
• Select the RF password that unlock the RF user security session for this area
• Select the protection against read and write operations for this area
(See Table 44. RFA1SS, Table 46. RFA2SS, Table 48. RFA3SS, and Table 50. RFA4SS for details about available
read and write protections).
Note: Setting 00b in PWD_CTRL_Ai field means that RF user security session cannot be open by any password for
the corresponding area.
When updating RFAiSS registers, the new protection value is effective immediately after the register write
completion.

DS10925 - Rev 11 page 56/197

 ST25DV04K ST25DV16K ST25DV64K
Data Protection

• Rf blocks 0 and 1 are exceptions to this protection mechanism:

– RF blocks 0 and 1 can be individually write locked by issuing a (Ext) Lock Single Block RF command.
Once locked, they cannot be unlock through RF. LOCK_CCFILE register is automatically updated
when using (Ext) Lock Single Block command.
– A RF user needs no password to lock blocks 0 and/or 1.
– Locking blocks 0 and/or 1 is possible even if the configuration is locked (LOCK_CFG=1).
– Locking blocks 0 and/or 1 is possible even if the area is write locked.
– Unlocking area1 (through RFA1SS register) does not unlock blocks 0 and 1 if they have been locked
though (Ext) Lock Block command.
– Once locked, the RF user cannot unlock blocks 0 and/or 1 (can be done by I2C host).
Note: When areas size are modified (ENDAi registers), RFAiSS registers are not modified.

User memory protection from I2C access

In I2C mode, each area can also have individual Read/Write access conditions, but only one I2C password is used
to unlock I2C security session for all areas.
The I2CSS register is used to set protection against read and write operation for each area (see Table 52. I2CSS
for details about available read and write protections).
When updating I2CSS registers, the new protection value is effective immediately after the register write
completion.
I2C user memory Bytes 0000h to 0003h (RF Block 0) and 0004h to 0007h (RF Block 1) can be individually locked
and unlocked by writing in the LOCK_CCFILE register (by group of 4 Bytes), independently of Area 1 protection.
Unlocking Area 1 (through I2CSS register) does not unlock those bytes if they have been locked though the
LOCK_CCFILE register.
Note: When areas size are modified (ENDAi registers), I2CSS register is not modified.

Retrieve the security status of a user memory block or byte

RF user can read a block security status by issuing following RF commands:
• (Ext) Get Multiple Blocks Security Status command.
• (Ext) (Fast) Read Single Block with option flag set to 1.
• (Ext) (Fast) Read Multiple Blocks with option flag set to 1.
ST25DV will respond with a Block security status containing a Lock_bit flag as specified in ISO 15693 standard.
This lock_bit flag is set to one if block is locked against write.
Lock_bit flag value may vary if corresponding RF user security session is open or closed.
I2C host can retrieve a block security status by reading the I2CSS register to get security status of the
corresponding area and by reading the I2C_SSO_Dyn register to know if I2C security session is open or closed.
For blocks 0 and 1 (Bytes 0000h to 0007h in I2C user memory), lock status can also be read in the
LOCK_CCFILE register.

5.6.4 System memory protection

By default, system memory (static registers) is write protected, both in RF and I2C.
I2C host must open the I2C security session (by presenting a valid I2C password) to enable write access to
system configuration static registers.
I2C host doesn’t have read or write access to RF passwords.
By default, I2C host can read all system configuration static registers (except RF passwords)
In RF, to enable write access to system configuration static registers, RF user must open the RF configuration
security session (by presenting a valid RF password 0) and system configuration must not be locked
(LOCK_CFG=00h).
RF doesn’t have read or write access to I2C password.
By default, RF user can read all system configuration static registers, except all passwords, LOCK_CCFILE,
LOCK_DSFID and LOCK_AFI.
RF configuration lock:

DS10925 - Rev 11 page 57/197

 ST25DV04K ST25DV16K ST25DV64K
Device parameter registers

• RF write access to system configuration static registers can be locked by writing 01h in the LOCK_CFG
register (by RF or I2C).
• RF user cannot unlock system configuration if LOCK_CFG=01h, even after opening RF configuration
security session (only I2C host can unlock system configuration).
• When system configuration is locked (LOCK_CFG=01h), it is still possible to change RF passwords (0 to
3).
Device identification registers:
• AFI and DFSID registers can be independently locked by RF user, issuing respectively a Lock AFI and a
Lock DSFID command. Lock is definitive: once locked, AFI and DSFID registers cannot be unlocked (either
by RF or I2C). System configuration locking mechanism (LOCK_CFG=01h) does not lock AFI and DSFID
registers.
• Other device identification registers (MEM_SIZE, BLK_SIZE, IC_REF, UID, IC_REV) are read only
registers for both RF and I2C.

5.7 Device parameter registers

Table 70. LOCK_DSFID access

RF I2C

Command Type Address Type

Lock DSFID (command code 2Ah) WO if DSFID not locked E2 = 1, 0010h RO

Table 71. LOCK_DSFID

Bit Name Function Factory value

0: DSFID is not locked

b0 LOCK_DSFID 0b
1: DSFID is locked
b7-b1 RFU - 0000000b

Note: Refer to Table 11. System configuration memory map for the LOCK_DSFID register.

Table 72. LOCK_AFI access

RF I2C

Command Type Address Type

Lock AFI (command code 28h) WO if AFI not locked E2 = 1, 0011h RO

Table 73. LOCK_AFI

Bit Name Function Factory value

0: AFI is not locked

b0 LOCK_AFI 0b
1: AFI is locked
b7-b1 RFU - 0000000b

Note: Refer to Table 11. System configuration memory map for the LOCK_AFI register.

DS10925 - Rev 11 page 58/197

 ST25DV04K ST25DV16K ST25DV64K
Device parameter registers

Table 74. DSFID access

RF I2C

Command Type Address Type

Inventory (command code 01h)

Get System Info (command code 2Bh)
R always, W if DSFID not locked E2 = 1, 0012h RO
Ext Get System Info (command code 3Bh)
Write DSFID (command code 28h)

Table 75. DSFID

Bit Name Function Factory value

b7-b0 DSFID ISO/IEC 15693 Data Storage Format Identifier 00h

Note: Refer to Table 11. System configuration memory map for the DSFID register.

Table 76. AFI access

RF I2C

Command Type Address Type

Inventory (command code 01h)

Get System Info (command code 2Bh)
R always, W if AFI not locked E2 = 1, 0013h RO
Ext Get System Info (command code 3Bh)
Write AFI (command code 27h)

Table 77. AFI

Bit Name Function Factory value

b7-b0 AFI ISO/IEC 15693 application family identifier 00h

Note: Refer to Table 11. System configuration memory map for the AFI register.

Table 78. MEM_SIZE access

RF I2C

Command Type Address Type

Get System Info (command code 2Bh) (1)

RO E2=1, 0014h to 0015h RO
Ext Get System Info (command code 3Bh)

1. Only ST25DV04K-IE and ST25DV04K-JF

DS10925 - Rev 11 page 59/197

 ST25DV04K ST25DV16K ST25DV64K
Device parameter registers

Table 79. MEM_SIZE

I2C
Bit Name Function Factory value
address

ST25DV04K-xx: 7Fh
Address 0014h: LSB byte of the memory size
0014h b7-b0 ST25DV16K-xx: FFh
expressed in RF blocks
ST25DV64K-xx: FFh
MEM_SIZE
ST25DV04K-xx: 00h
Address 0015h: MSB byte of the memory size
0015h b7-b0 ST25DV16K-xx: 01h
expressed in RF blocks
ST25DV64K-xx: 07h

Note: Refer to Table 11. System configuration memory map for the MEM_SIZE register.

Table 80. BLK_SIZE access

RF I2C

Command Type Address Type

Get System Info (command code 2Bh) (1)

RO E2 = 1, 0016h RO
Ext Get System Info (command code 3Bh)

1. Only ST25DV04K-IE and ST25DV04K-JF

Table 81. BLK_SIZE

Bit Name Function Factory value

b7-b0 BLK_SIZE RF user memory block size 03h

Note: Refer to Table 11. System configuration memory map for the BLK_SIZE register.

Table 82. IC_REF access

RF I2C

Command Type Address Type

Get System Info (command code 2Bh)

RO E2 = 1, 0017h RO
Ext Get System Info (command code 3Bh)

Table 83. IC_REF

Bit Name Function Factory value

ST25DV04K-IE: 24h
ST25DV16K-IE: 26h
ST25DV64K-IE: 26h
b7-b0 IC_REF ISO/IEC 15693 IC reference
ST25DV04K-JF: 24h
ST25DV16K-JF: 26h
ST25DV64K-JF: 26h

Note: Refer to Table 11. System configuration memory map for the IC_REF register.

DS10925 - Rev 11 page 60/197

 ST25DV04K ST25DV16K ST25DV64K
Device parameter registers

Table 84. UID access

RF I2C

Command Type Address Type

Inventory (command code 01h)

Get System Info (command code 2Bh) RO E2=1, 0018h to 001Fh RO
Ext Get System Info (command code 3Bh)

Table 85. UID

I2C address Bit Name Function Factory value

0018h ISO/IEC 15693 UID byte 0 (LSB)

0019h ISO/IEC 15693 UID byte 1
001Ah ISO/IEC 15693 UID byte 2 IC manufacturer serial number
001Bh ISO/IEC 15693 UID byte 3
001Ch ISO/IEC 15693 UID byte 4
ST25DV04K-IE: 24h
b7-b0 UID ST25DV16K-IE: 26h
ST25DV64K-IE: 26h
001Dh ISO/IEC 15693 UID byte 5: ST product code
ST25DV04K-JF: 25h
ST25DV16K-JF: 27h
ST25DV64K-JF: 27h
001Eh ISO/IEC 15693 UID byte 6: IC manufacturing code 02h
001Fh ISO/IEC 15693 UID byte 7 (MSB) E0h

Note: Refer to Table 11. System configuration memory map for the UID register.

Table 86. IC_REV access

RF I2C

Command Type Address Type

No access E2 = 1, 0020h RO

Table 87. IC_REV

Bit Name Function Factory value

b7-b0 IC_REV IC revision Depending on revision

Note: Refer to Table 11. System configuration memory map for the IC_REV register.

DS10925 - Rev 11 page 61/197

 ST25DV04K ST25DV16K ST25DV64K
I2C operation

6 I2C operation

6.1 I2C protocol

The device supports the I2C protocol. This is summarized in Figure 24. I2C bus protocol. Any device that sends
data to the bus is defined as a transmitter, and any device that reads data is defined as a receiver. The device
that controls the data transfer is known as the bus master, and the other as the slave device. A data transfer
can only be initiated by the bus master, which also provides the serial clock for synchronization. The ST25DVxxx
device is a slave in all communications.

Figure 24. I2C bus protocol

DT00792BV1

STOP
Condition

6.1.1 Start condition

Start is identified by a falling edge of serial data (SDA) while the serial clock (SCL) is stable in the high state.
A Start condition must precede any data transfer command. The device continuously monitors (except during a
write cycle) the SDA and the SCL for a Start condition, and does not respond unless one is given.

DS10925 - Rev 11 page 62/197

 ST25DV04K ST25DV16K ST25DV64K
I2C timeout

6.1.2 Stop condition

Stop is identified by a rising edge of serial data (SDA) while the serial clock (SCL) is stable and driven high.
A Stop condition terminates communication between the device and the bus master. A Read command that
is followed by NoAck can be followed by a Stop condition to force the device into the Standby mode. A Stop
condition at the end of a Write command triggers the internal write cycle.

6.1.3 Acknowledge bit (ACK)

The acknowledge bit is used to indicate a successful byte transfer. The bus transmitter, whether a bus master or a
slave device, releases the serial data (SDA) after sending eight bits of data. During the 9th clock pulse period, the
receiver pulls the SDA low to acknowledge the receipt of the eight data bits.

6.1.4 Data input

During data input, the device samples serial data (SDA) on the rising edge of the serial clock (SCL). For correct
device operation, the SDA must be stable during the rising edge of the SCL, and the SDA signal must change
only when the SCL is driven low.

6.2 I2C timeout

During the execution of an I²C operation, RF communications are not possible.
To prevent RF communication freezing due to inadvertent indeterminate instructions sent to the I²C bus, the
ST25DVxxx features a timeout mechanism that automatically resets the I²C logic block.

6.2.1 I2C timeout on Start condition

I2C communication with the ST25DVxxx starts with a valid Start condition, followed by a device select code.
If the delay between the Start condition and the following rising edge of the serial clock (SCL) that samples the
most significant of the Device Select exceeds the tSTART_OUT time (see Table 248. I2C AC characteristics (up to
85 °C) and Table 249. I2C AC characteristics (up to 125 °C)), the I²C logic block is reset and further incoming data
transfer is ignored until the next valid Start condition.

Figure 25. I²C timeout on Start condition

SCL

SDA

tSTART_OUT
Start
condition

6.2.2 I2C timeout on clock period

During data transfer on the I²C bus, if the serial clock pulse width high (tCHCL) or serial clock pulse width
low (tCLCH) exceeds the maximum value specified in Table 248. I2C AC characteristics (up to 85 °C) and
Table 249. I2C AC characteristics (up to 125 °C), the I²C logic block is reset and any further incoming data transfer
is ignored until the next valid Start condition.

DS10925 - Rev 11 page 63/197

 ST25DV04K ST25DV16K ST25DV64K
Device addressing

6.3 Device addressing

To start a communication between the bus master and the slave device, the bus master must initiate a Start
condition. Following this, the bus master sends the device select code, shown in Table 88. Device select code (on
Serial Data (SDA), the most significant bit first).
The device select code consists of a 4-bit device type identifier and a 3-bit Chip Enable “Address” (E2,1,1). To
address the memory array, the 4-bit device type identifier is 1010b. Refer to Table 88. Device select code.
The eighth bit is the Read/Write bit (RW). It is set to 1 for Read and to 0 for Write operations.

Table 88. Device select code

Device type identifier (1) Chip Enable address RW

b7 b6 b5 b4 b3 b2 b1 b0

Device select code 1 0 1 0 E2(2) 1 1 RW

1. The most significant bit, b7, is sent first.

2. E2 is not connected to any external pin. It is however used to address the ST25DVxxx as described in Section 4 Memory
management.
• E2 = 0, access to user memory, Dynamic registers or Mailbox.
• E2 =1, access to system area.

If a match occurs on the device select code, the corresponding device gives an acknowledgment on serial data
(SDA) during the ninth bit time. If the device does not match the device select code, it deselects itself from the
bus, and goes into Standby mode.

Table 89. Operating modes

Mode RW bit Bytes Initial sequence

Current address read 1 1 Start, device select, RW = 1

0 Start, device select, RW = 0, address
Random address read 1
1 reStart, device select, RW = 1
Sequential read 1 ≥1 Similar to current or random address read
Byte write 0 1 Start, device select, RW = 0
Sequential write 0 ≤ 256 byte Start, device select, RW = 0

6.4 I2C write operations

Following a Start condition, the bus master sends a device select code with the Read/Write bit (RW) reset to 0.
The device acknowledges it, and waits for two address bytes. The device responds to each address byte with an
acknowledge bit, and then waits for the data byte.
Each data byte in the memory has a 16-bit (two-byte wide) address. The most significant byte (see Table 90)
is sent first, followed by the least significant byte (see Table 91). Bits b15 to b0 form the address of the byte in
memory.

Table 90. Address most significant byte

b15 b14 b13 b12 b11 b10 b9 b8

Table 91. Address least significant byte

b7 b6 b5 b4 b3 b2 b1 b0

When the bus master generates a Stop condition immediately after the Ack bit (in the tenth-bit time slot), either at
the end of a byte write or a sequential write, the internal write cycle is triggered. A Stop condition at any other time
slot does not trigger the internal write cycle.

DS10925 - Rev 11 page 64/197

 ST25DV04K ST25DV16K ST25DV64K
I2C write operations

After the Stop condition, the delay tW, and the successful completion of a Write operation, the device internal
address counter is incremented automatically, to point to the next byte address after the last one that was
modified.
After an unsuccessful write operation, the device enters in I2C dead state: the internal address counter is not
incremented, and the device waits for a full new I2C instruction (address counter stops to be incremented after
the first NoAck bit).
During the internal write cycle, the serial data (SDA) signal is disabled and the device does not respond to any
request.
Caution: I2C Writing data in user or system memory (EEPROM), transit via the 256-byte fast transfer mode's buffer.
Consequently fast transfer mode must be deactivated before starting any write operation in user or system
memory, otherwise the command is NotACK, programming is not done and device goes in Standby mode.

6.4.1 I2C Byte write

After the device select code and the address bytes, the bus master sends one data byte.
If byte write is not inhibited, the device replies with Ack.
If byte write is inhibited, the device replies with NoAck.
The bus master terminates the transfer by generating a Stop condition (see Figure 26. Write mode sequences
when write is not inhibited).
For byte write in EEPROM (user memory or system configuration), internal programming starts after the Ack, for a
duration of tW (as defined in Table 248. I2C AC characteristics (up to 85 °C) and Table 249. I2C AC characteristics
(up to 125 °C)).
For writes in fast transfer mode buffer or Dynamic registers, internal programming is done at the Ack.
If byte write is inhibited, the device replies with NoAck. The bus master terminates the transfer by generating a
Stop condition and byte location not is modified (see Figure 27. Write mode sequences when write is inhibited).
Byte write is inhibited if byte complies with one of the following conditions:
• Byte is in user memory and is write protected with LOCK_CCFILE register.
• Byte is in user memory and is write protected with I2CSS register, and I2C security session is closed.
• Byte is in user memory and fast transfer mode is activated.
• Byte is in system memory and is a Read Only register.
• Byte is in system memory and I2C security session is closed.
• Byte is in fast transfer mode’s mailbox and is not the first Byte of mailbox.
• Byte is in fast transfer mode’s mailbox and mailbox is busy.
• Byte is in fast transfer mode’s mailbox and fast transfer mode is not activated.
• Byte is in dynamic registers area and is a Read Only register.

6.4.2 I2C Sequential write

The I2C sequential write allows up to 256 bytes to be written in one command, provided they are all located in the
same user memory area or are all located in writable addresses.
After each byte is transferred, the internal byte address counter is incremented.
For each byte sent by the bus master:
• If byte write is not inhibited, the device replies with Ack.
• If byte write is inhibited, the device replies with NoAck.
The transfer is terminated by the bus master generating a Stop condition:
• For writes in EEPROM (user memory or system configuration), if all bytes have been Ack'ed, internal
programming of all bytes starts after the last Ack, for a duration dependent on the number of bytes to write
(see below).
• For writes in fast transfer mode buffer or Dynamic registers, if all bytes have been Ack'ed, internal
programming is done at the Ack.
• If some bytes have been NotAck’ed, no internal programming is done (0 byte written).
Byte write is inhibited if byte complies with conditions described in Section 6.4.1 I2C Byte write, in addition:
• Byte is in user memory but does not belong to same area than previous received byte (area border
crossing is forbidden).

DS10925 - Rev 11 page 65/197

 ST25DV04K ST25DV16K ST25DV64K
I2C write operations

• 256 write occurrence have already been reached in the same sequential write.
EEPROM memory (user memory and system configuration) is internally organized in pages of 4 bytes long. Data
located in a same page all share the same most significant memory address bits b16-b2.
I2C sequential write programming time in the EEPROM memory is dependent on this internal organization: total
programming time is the I2C write time tW (as defined in Table 248. I2C AC characteristics (up to 85 °C) and
Table 249. I2C AC characteristics (up to 125 °C)) multiplied by the number of internal EEPROM pages where the
data must be programmed, including incomplete pages. For example, a 256 Bytes I2C sequential write, starting at
address 0002h will write data over 65 pages. Total write time in this case is tW x 65.

Figure 26. Write mode sequences when write is not inhibited

ACK ACK ACK ACK

Byte
Dev Select Byte address Byte address Data in
Write
Start

Stop
R/W

ACK ACK ACK ACK ACK ACK

Sequential
Dev Select Byte address Byte address Data in 1 Data in 2 Data in N
Write
Start

Stop
R/W

Note: N ≤ 256

Figure 27. Write mode sequences when write is inhibited

ACK ACK ACK NO ACK

Byte
Dev select Byte address Byte address Data in
Write
Start

Stop

R/W

ACK ACK ACK NO ACK

Sequential Dev select Byte address Byte address Data in 1 Data in 2

Write
Start

R/W

NO ACK NO ACK

Sequential
Data in N
Write(cont'd)
Stop

Note: N ≤ 256

DS10925 - Rev 11 page 66/197

 ST25DV04K ST25DV16K ST25DV64K
I2C write operations

6.4.3 Minimizing system delays by polling on ACK

During the internal write cycle, the device disconnects itself from the bus, and writes a copy of the data from
its internal latches to the memory cells. The maximum I²C write time (tw) is shown in Table 248. I2C AC
characteristics (up to 85 °C) and Table 249. I2C AC characteristics (up to 125 °C), but the typical time is shorter.
To make use of this, a polling sequence can be used by the bus master.
The sequence, as shown in Figure 28, is:
• Initial condition: a write cycle is in progress.
• Step 1: the bus master issues a Start condition followed by a device select code (the first byte of the new
instruction).
• Step 2: if the device is busy with the internal write cycle, no Ack is returned and the bus master goes back
to Step 1. If the device has terminated the internal write cycle, it responds with an Ack, indicating that the
device is ready to receive the second part of the instruction (the first byte of this instruction having been
sent during Step 1).
Note: There is no need of polling when writing in dynamic registers or in mailbox, since programming time is null.

Figure 28. Write cycle polling flowchart using ACK

Write cycle
in progress

Start condition

Device select
with RW = 0

NO ACK
returned

First byte of instruction YES

with RW = 0 already
decoded by the device

Next
NO Operation is YES
addressing the
memory
Send Address
and Receive ACK

Stop

NO YES
StartCondition

Data for the Device select

Write operation with RW = 1

Continue the Continue the

Write operation Random Read operation

DS10925 - Rev 11 page 67/197

 ST25DV04K ST25DV16K ST25DV64K
I2C read operations

6.5 I2C read operations

Read operation in user memory is performed successfully only if:
• Area to which the byte belongs is not read protected by I2CSS register.
• Area to which the byte belongs is read protected by I2CSS register, but I2C security session is open.
Read operations in system memory and dynamic registers are done independently of any protection mechanism,
except I2C_PWD register which needs I2C security session to be open first.
Read operation in fast transfer mode’s mailbox is performed successfully only if fast transfer mode is activated.
If read is not successful, ST25DVxxx releases the bus and I2C host reads byte value FFh.
After the successful completion of a read operation, the device’s internal address counter is incremented by one,
to point to the next byte address.
After an unsuccessful read operation, ST25DVxxx enters in I2C dead state: internal address counter is not
incremented, and ST25DVxxx is waiting for a full new I2C instruction.

6.5.1 Random Address Read

A dummy write is first performed to load the address into this address counter (as shown in Figure 29. Read
mode sequences) but without sending a Stop condition. Then, the bus master sends another Start condition, and
repeats the device select code, with the Read/Write bit (RW) set to 1. The device acknowledges this, and outputs
the contents of the addressed byte. The bus master must not acknowledge the byte, and terminates the transfer
with a Stop condition.

6.5.2 Current Address Read

For the Current Address Read operation, following a Start condition, the bus master only sends a device select
code with the Read/Write bit (RW) set to 1. The device acknowledges this, and outputs the byte addressed by
the internal address counter. The counter is then incremented. The bus master terminates the transfer with a Stop
condition, as shown in Figure 29. Read mode sequences, without acknowledging the byte.

DS10925 - Rev 11 page 68/197

 ST25DV04K ST25DV16K ST25DV64K
I2C read operations

Figure 29. Read mode sequences

ACK NO ACK
Current address read
Dev sel Data out

Start

Stop
R/W

ACK ACK ACK ACK NO ACK

Random address read
Dev sel * Byte addr Byte addr Dev sel * Data out
Start

Start

Stop
R/W R/W

ACK ACK ACK NO ACK

Sequential current read
Dev sel Data out 1 Data out N
Start

Stop
R/W

ACK ACK ACK ACK ACK

Sequential random read
Dev sel * Byte addr Byte addr Dev sel * Data out1
Start

Start

R/W R/W

ACK NO ACK

Data out N
Stop

6.5.3 Sequential Read access

This operation can be used after a Current Address Read or a Random Address Read. The bus master does
acknowledge the data byte output, and sends additional clock pulses so that the device continues to output the
next byte in sequence. To terminate the stream of bytes, the bus master must not acknowledge the last byte, and
must generate a Stop condition, as shown in Figure 29. Read mode sequences.
The output data comes from consecutive addresses, with the internal address counter automatically incremented
after each byte output.
Sequential read in user memory:
• Sequential read cannot cross area borders. After reaching area border, device continues to output FFh
• There is no roll over inside area or at the end of user memory (ST25DVxxx returns only FFh after last user
memory byte address).
Sequential read in system memory:
• There is no roll over after reaching end of system memory (ST25DVxxx returns only FFh after last system
memory byte address).
• Sequential read in dynamic registers:
• It is possible to read sequentially dynamic registers and fast transfer mode’s mailbox (contiguous I2C
addresses).

DS10925 - Rev 11 page 69/197

 ST25DV04K ST25DV16K ST25DV64K
I2C password management

Sequential read in dynamic registers:

• There is no roll over at the end of the mailbox (ST25DVxxx returns only FFh after last system memory byte
address).

6.5.4 Acknowledge in Read mode

For all Read commands, the device waits, after each byte read, for an acknowledgement during the ninth bit time.
If the bus master does not drive serial data (SDA) low during this time, the device terminates the data transfer and
switches to its Standby mode.

6.6 I2C password management

The ST25DVxxx controls I2C security session using an I2C 64-bit password. This I2C password is managed with
two I2C dedicated commands: I2C present password and I2C write password.

6.6.1 I2C present password command description

The I2C present password command is used in I2C mode to present the password to the ST25DVxxx. This is
used to open I2C security session or to allow I2C password modification (see Section 5.6 Data Protection for
detailed explanation about password usage).
Following a Start condition, the bus master sends a device select code with the Read/ Write bit (R W ) reset to
0 and the Chip Enable bit E2 at 1. The device acknowledges this, as shown in Figure 30. I2C Present Password
Sequence, and waits for two I2C password address bytes, 09h and 00h. The device responds to each address
byte with an acknowledge bit, and then waits for the eight password data bytes, the validation code, 09h, and a
resend of the eight password data bytes. The most significant byte of the password is sent first, followed by the
least significant bytes.
It is necessary to send the 64-bit password twice to prevent any data corruption during the sequence. If the two
64-bit passwords sent are not exactly the same, the ST25DVxxx does not start the internal comparison.
When the bus master generates a Stop condition immediately after the Ack bit (during the tenth bit time slot). The
ST25DVxxx compares the 64 received data bits with the 64 bits of the stored I2C password. If the values match,
the I2C security session is open, and the I2C_SSO_Dyn register is set to 01h. If the values do not match, the I2C
security session is closed and I2C_SSO_dyn register is set to 00h.
I2C_SSO_Dyn is a Dynamic register, it can be checked via I2C host to know If I2C security session is open.

Figure 30. I2C Present Password Sequence

Ack Ack Ack Ack Ack Ack Ack Ack Ack Ack Ack
Device Password Password Password Password Password Password Password Password Password Password
select code Address 09h Address 00h [63:56] [55:48] [47:40] [39:32] [31:24] [23:16] [15:8] [7:0]
Start

R/W
Ack
Ack Ack Ack Ack Ack Ack Ack Ack
Validation Password Password Password Password Password Password Password Password
code 09h [63:56] [55:48] [47:40] [39:32] [31:24] [23:16] [15:08] [7:0]
Stop

Device select code = 1010111

Ack generated during 9th bit time slot.

6.6.2 I2C write password command description

The I2C write password command is used to update the I2C password value (register I2C_PWD). It cannot be
used to update any of the RF passwords. After the write cycle, the new I2C password value is automatically
activated. The I2C password value can only be modified after issuing a valid I2C present password command.

DS10925 - Rev 11 page 70/197

 ST25DV04K ST25DV16K ST25DV64K
I2C password management

Following a Start condition, the bus master sends a device select code with the Read/ Write bit (R W ) reset to
0 and the Chip Enable bit E2 at 1. The device acknowledges this, as shown in Figure 31. I2C Write Password
Sequence, and waits for the two I2C password address bytes, 09h and 00h. The device responds to each address
byte with an acknowledge bit, and then waits for the four password data bytes, the validation code, 07h, and a
resend of the eight password data bytes. The most significant byte of the password is sent first, followed by the
least significant bytes.
It is necessary to send twice the 64-bit password to prevent any data corruption during the write sequence. If the
two 64-bit passwords sent are not exactly the same, the ST25DVxxx does not modify the I2C password value.
When the bus master generates a Stop condition immediately after the Ack bit (during the tenth bit time slot), the
internal write cycle is triggered. A Stop condition at any other time does not trigger the internal write cycle.
During the internal write cycle, the serial data (SDA) signal is disabled internally, and the device does not respond
to any requests.
Caution: I2C write password command data transits via the 256-Bytes fast transfer mode's buffer. Consequently fast
transfer mode must be deactivated before issuing a write password command, otherwise command is NotACK
(after address LSB), and programming is not done and device goes in standby mode.

Figure 31. I2C Write Password Sequence

Ack Ack Ack Ack Ack Ack Ack Ack Ack Ack Ack
Device Password Password Password Password Password Password Password Password Password Password
select code Address 09h Address 00h [63:56] [55:48] [47:40] [39:32] [31:24] [23:16] [15:08] [7:0]
Start

R/W
Ack Ack Ack Ack Ack Ack Ack Ack Ack
Validation Password Password Password Password Password Password Password Password
code 07h [63:56] [55:48] [47:40] [39:32] [31:24] [23:16] [15:08] [7:0]

Device select code = 1010111 Stop

Ack generated during 9th bit time slot.

DS10925 - Rev 11 page 71/197

 ST25DV04K ST25DV16K ST25DV64K
RF operation

7 RF operation

Contactless exchanges are performed in RF mode as specified by ISO/IEC 15693 or NFC Forum Type 5.
The ST25DVxxx communicate via the 13.56 MHz carrier electromagnetic wave, on which incoming data are
demodulated from the received signal amplitude modulation (ASK: amplitude shift keying). The received ASK
wave is 10% or 100% modulated, with a data rate of 1.6 Kbit/s using the 1/256 pulse coding mode, or a data rate
of 26 Kbit/s using the 1/4 pulse coding mode.
Outgoing data are generated by the ST25DVxxx load variation using Manchester coding with one or two
subcarrier frequencies at 423 and 484 kHz. Data are transferred from the ST25DVxxx at 6.6 Kbit/s in low data
rate mode, at 26 Kbit/s in high data rate mode. The ST25DVxxx supports 53 Kbit/s in high data rate mode in one
subcarrier frequency at 423 kHz.
The ST25DVxxx follows ISO/IEC 15693 or NFC Forum Type 5 recommendations for radio-frequency power and
signal interface and for anticollision and transmission protocol.

7.1 RF communication

7.1.1 Access to an ISO/IEC 15693 device

The dialog between the “RF reader” and the ST25DVxxx takes place as follows:
• device activation by the RF operating field of the reader
• transmission of a command by the reader (the device detects carrier amplitude modulation)
• transmission of a response by the device using load modulation
These operations use the RF power transfer and communication signal interface described below. This technique
is called RTF (Reader talk first).

Operating field
The ST25DVxxx operates continuously between the minimum and maximum values of the electromagnetic field H
defined in Table 253. RF characteristics. The reader must generate a field within these limits.

Power transfer
Power is transferred to the ST25DVxxx by radio frequency at 13.56 MHz via coupling antennas. The RF
operating field of the reader is transformed on the device antenna into an AC voltage, which is rectified,
filtered and internally regulated. During communication, the amplitude modulation (ASK) on this received signal is
demodulated by the ASK demodulator

Frequency
The ISO 15693 standard defines the carrier frequency (fC) of the operating field as 13.56 MHz ±7 kHz.

7.2 RF communication and energy harvesting

As the current consumption can affect the AC signal delivered by the antenna, RF communications with
ST25DVxxx are not guaranteed during voltage delivery on the energy harvesting analog output V_EH.
RF communication can disturb and possibly stop Energy Harvesting mode.

7.3 Fast transfer mode mailbox access in RF

Thanks to dedicated commands, the RF interface has the possibility to check Mailbox availability, and the
capability to access it directly to put or get a message from it (see Section 5.1 Fast transfer mode (FTM) for
specific features).

DS10925 - Rev 11 page 72/197

 ST25DV04K ST25DV16K ST25DV64K
RF protocol description

7.4 RF protocol description

7.4.1 Protocol description

The transmission protocol (or simply “the protocol”) defines the mechanism used to exchange instructions and
data between the VCD (Vicinity Coupling Device) and the ST25DVxxx in both directions. It is based on the
concept of “VCD talks first”.
This means that a ST25DVxxx does not start transmitting unless it has received and properly decoded an
instruction sent by the VCD. The protocol is based on an exchange of:
• a request from the VCD to the ST25DVxxx,
• a response from the ST25DVxxx to the VCD.
Each request and each response are contained in a frame. The frame are delimited by a Start of Frame (SOF)
and End of Frame (EOF).
The protocol is bit-oriented. The number of bits transmitted in a frame is a multiple of eight (8), that is an integer
number of bytes.
A single-byte field is transmitted least significant bit (LSBit) first. A multiple-byte field is transmitted least
significant byte (LSByte) first and each byte is transmitted least significant bit (LSBit) first.

Figure 32. ST25DVxxx protocol timing

Request Request
VCD frame frame

Response Response
ST25DVxxx frame frame

Timing t1 t2 t1 t2

7.4.2 ST25DVxxx states referring to RF protocol

The ST25DVxxx can be in one of four states:
• Power-off
• Ready
• Quiet
• Selected
Transitions between these states are specified in Figure 33. ST25DVxxx state transition diagram and
Table 92. ST25DVxxx response depending on Request_flags.

Power-off state
The ST25DVxxx is in the Power-off state when it does not receive enough energy from the VCD.

Ready state
The ST25DVxxx is in the Ready state when it receives enough energy from the VCD. When in the Ready state,
the ST25DVxxx answers any request where the Select_flag is not set.

Quiet state
When in the Quiet state, the ST25DVxxx answers any request with the Address_flag set, except for Inventory
requests.

DS10925 - Rev 11 page 73/197

 ST25DV04K ST25DV16K ST25DV64K
RF protocol description

Selected state
In the Selected state, the ST25DVxxx answers any request in all modes (see Section 7.4.3 Modes):
• Request in Select mode with the Select_flag set
• Request in Addressed mode if the UID matches
• Request in Non-Addressed mode as it is the mode for general requests

Table 92. ST25DVxxx response depending on Request_flags

Address_flag Select_flag
Flags 1 0 1 0
Addressed Non addressed Selected Non selected

ST25DVxxx in Ready or Selected state

- X - X
(Devices in Quiet state do not answer)
ST25DVxxx in Selected state - X X -
ST25DVxxx in Ready, Quiet or Selected
state (the device which matches the X - - X
UID)
Error (03h) or no response (command
X - X -
dependent)

Figure 33. ST25DVxxx state transition diagram

Power off

Out of field In RF field

after tRF_OFF

Any other command

Inventory Ready
where Select_Flag
is not set
Out of RF field
after tRF_OFF Out of RF field
Se

after tRF_OFF
Re lec t w
y

)
ID

le
ad

Se elec

ct
se t_ ith
(U
re

(U
t t Fla (#
iet
o

ID
tt

qu

re g is UID

)
se

ad s
ay
Re

y et )
St

wh or
er
e

Select (UID)
Quiet
Stay quiet(UID)
Selected

Any other command where the

Address_Flag is set AND where Any other command
DT43017V2

the Inventory_Flag is not set

1. The ST25DVxxx returns to the Power Off state if the tag is out of the RF field for at least tRF_OFF.
The intention of the state transition method is that only one ST25DVxxx should be in the Selected state at a time.
When the Select_flag is set to 1, the request shall NOT contain a unique ID.
When the address_flag is set to 0, the request shall NOT contain a unique ID.

7.4.3 Modes
The term “mode” refers to the mechanism used in a request to specify the set of ST25DVxxx devices that shall
execute the request.

DS10925 - Rev 11 page 74/197

 ST25DV04K ST25DV16K ST25DV64K
RF protocol description

Addressed mode
When the Address_flag is set to 1 (Addressed mode), the request contains the Unique ID (UID) of the addressed
ST25DVxxx.
Any ST25DVxxx that receives a request with the Address_flag set to 1 compares the received Unique ID to its
own. If it matches, then the ST25DVxxx executes the request (if possible) and returns a response to the VCD as
specified in the command description.
If the UID does not match, then it remains silent.

Non-addressed mode (general request)

When the Address_flag is cleared to 0 (Non-Addressed mode), the request does not contain a Unique ID.

Select mode
When the Select_flag is set to 1 (Select mode), the request does not contain a unique ID. The ST25DVxxx in the
Selected state that receives a request with the Select_flag set to 1 executes it and returns a response to the VCD
as specified in the command description.
Only the ST25DVxxx in the Selected state answers a request where the Select_flag is set to 1.
The system design ensures that only one ST25DVxxx can be in the Select state at a time.

7.4.4 Request format

The request consists of:
• an SOF,
• flags,
• a command code,
• parameters and data,
• a CRC,
• an EOF.

Table 93. General request format

SOF Request_flags Command code Parameters Data 2 bytes CRC EOF

7.4.5 Request flags

In a request, the “flags” field specifies the actions to be performed by the ST25DVxxx and whether corresponding
fields are present or not.
The flags field consists of eight bits. Bit 3 (Inventory_flag) of the request flag defines the contents of the four
MSBs (bits 5 to 8). When bit 3 is reset (0), bits 5 to 8 define the ST25DVxxx selection criteria. When bit 3 is set
(1), bits 5 to 8 define the ST25DVxxx Inventory parameters.

DS10925 - Rev 11 page 75/197

 ST25DV04K ST25DV16K ST25DV64K
RF protocol description

Table 94. Definition of request flags 1 to 4

Bit No Flag Level Description

0 A single subcarrier frequency is used by the ST25DVxxx

Bit 1 Subcarrier_flag (1)
1 Two subcarriers are used by the ST25DVxxx
0 Low data rate is used
Bit 2 Data_rate_flag (2)
1 High data rate is used
The meaning of flags 5 to 8 is described in Table 95. Request
0
flags 5 to 8 when inventory_flag, Bit 3 = 0
Bit 3 Inventory_flag
The meaning of flags 5 to 8 is described in Table 96. Request
1
flags 5 to 8 when inventory_flag, Bit 3 = 1

Protocol_extension 0 No Protocol format extension

Bit 4
_flag 1 Protocol format extension. Reserved for future use.

1. Subcarrier_flag refers to the ST25DVxxx-to-VCD communication.

2. Data_rate_flag refers to the ST25DVxxx-to-VCD communication.

Table 95. Request flags 5 to 8 when inventory_flag, Bit 3 = 0

Bit nb Flag Level Description

The request is executed by any ST25DVxxx according to the

0
setting of Address_flag
Bit 5 Select flag (1)
The request is executed only by the ST25DVxxx in Selected
1
state
The request is not addressed. UID field is not present. The
0
request is executed by all ST25DVxxxs.
Bit 6 Address flag The request is addressed. UID field is present. The request
1 is executed only by the ST25DVxxx whose UID matches the
UID specified in the request.
0 Option not activated.
Bit 7 Option flag
1 Option activated.
Bit 8 RFU 0 -

1. If the Select_flag is set to 1, the Address_flag is set to 0 and the UID field is not present in the request.

Table 96. Request flags 5 to 8 when inventory_flag, Bit 3 = 1

Bit nb Flag Level Description

0 AFI field is not present

Bit 5 AFI flag
1 AFI field is present
0 16 slots
Bit 6 Nb_slots flag
1 1 slot
Bit 7 Option flag 0 -
Bit 8 RFU 0 -

DS10925 - Rev 11 page 76/197

 ST25DV04K ST25DV16K ST25DV64K
RF protocol description

7.4.6 Response format

The response consists of:
• an SOF
• flags
• parameters and data
• a CRC
• an EOF

Table 97. General response format

SOF Response_flags Parameters Data 2 byte CRC EOF

7.4.7 Response flags

In a response, the flags indicate how actions have been performed by the ST25DVxxx and whether
corresponding fields are present or not. The response flags consist of eight bits.

Table 98. Definitions of response flags 1 to 8

Bit Nb Flag Level Description

0 No error
Bit 1 Error_flag
1 Error detected. Error code is in the “Error” field.
Bit 2 RFU 0 -
Bit 3 RFU 0 -
Bit 4 Extension flag 0 No extension
Bit 5 RFU 0 -
Bit 6 RFU 0 -
Bit 7 RFU 0 -
Bit 8 RFU 0 -

DS10925 - Rev 11 page 77/197

 ST25DV04K ST25DV16K ST25DV64K
Timing definition

7.4.8 Response and error code

If the Error_flag is set by the ST25DVxxx in the response, the Error code field is present and provides information
about the error that occurred.
Error codes not specified in Table 99 are reserved for future use.

Table 99. Response error code definition

Error code Meaning

01h Command is not supported.

02h Command is not recognized (format error).
03h The option is not supported.
0Fh Error with no information given.
10h The specified block is not available.
11h The specified block is already locked and thus cannot be locked again.
12h The specified block is locked and its contents cannot be changed.
13h The specified block was not successfully programmed.
14h The specified block was not successfully locked.
15h The specified block is protected in read.

7.5 Timing definition

t1: ST25DVxxx response delay

Upon detection of the rising edge of the EOF received from the VCD, the ST25DVxxx waits for a t1nom time before
transmitting its response to a VCD request or switching to the next slot during an inventory process. Values of t1
are given in Table 100. Timing values.

t2: VCD new request delay

t2 is the time after which the VCD may send an EOF to switch to the next slot when one or more ST25DVxxx
responses have been received during an Inventory command. It starts from the reception of the EOF from the
ST25DVxxxs.
The EOF sent by the VCD may be either 10% or 100% modulated regardless of the modulation index used for
transmitting the VCD request to the ST25DVxxx.
t2 is also the time after which the VCD may send a new request to the ST25DVxxx, as described in
Figure 32. ST25DVxxx protocol timing.
Values of t2 are given in Table 100. Timing values.

t3: VCD new request delay when no response is received from the ST25DVxxx

t3 is the time after which the VCD may send an EOF to switch to the next slot when no ST25DVxxx response has
been received.
The EOF sent by the VCD may be either 10% or 100% modulated regardless of the modulation index used for
transmitting the VCD request to the ST25DVxxx.
From the time the VCD has generated the rising edge of an EOF:
• If this EOF is 100% modulated, the VCD waits for a time at least equal to t3min for 100% modulation before
sending a new EOF.
• If this EOF is 10% modulated, the VCD waits for a time at least equal to t3min for 10% modulation before
sending a new EOF.

DS10925 - Rev 11 page 78/197

 ST25DV04K ST25DV16K ST25DV64K
Timing definition

Table 100. Timing values

Minimum (min) values

Nominal (nom) values Maximum (max) values
100% modulation 10% modulation

t1 4320 / fc = 318.6 µs 4352 / fc = 320.9 µs 4384 / fc = 323.3 µs (1)

t2 4192 / fc = 309.2 µs No tnom No tmax

t3 t1max(2) + tSOF (3) t1max(2) + tNRT (4) + t2min No tnom No tmax

1. VCD request will not be interpreted during the first milliseconds following the RF field rising.
2. t1max does not apply for write-alike requests. Timing conditions for write-alike requests are defined in the command
description.
3. tSOF is the time taken by the ST25DVxxx to transmit an SOF to the VCD. tSOF depends on the current data rate: High data
rate or Low data rate.
4. tNRT is the nominal response time of the ST25DVxxx. tNRT depends on VICC to ST25DVxxx data rate and subcarrier
modulation mode.

Note: The tolerance of specific timings is ± 32/fC.

DS10925 - Rev 11 page 79/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6 RF commands

7.6.1 RF command code list

The ST25DVxxx supports the following legacy and extended RF command set:
• Inventory, used to perform the anticollision sequence.
• Stay Quiet, used to put the ST25DVxxx in quiet mode, where it does not respond to any inventory
command.
• Select, used to select the ST25DVxxx. After this command, the ST25DVxxx processes all Read/Write
commands with Select_flag set.
• Reset To Ready, used to put the ST25DVxxx in the ready state.
• Read Single Block and Extended Read Single Block, used to output the 32 bit of the selected block and
its locking status.
• Write Single Block and Extended Write Single Block, used to write and verify the new content for an
update of a 32 bit block, provided that it is not in a locked memory area.
• Read Multiple Blocks and Extended Read Multiple Block, used to read the selected blocks in an unique
area, and send back their value.
• Write Multiple Blocks and Extended Write Multiple Block, used to write and verify the new content for
an update of up to 4 blocks located in the same memory area, which was not previously locked for writing.
• Write AFI, used to write the 8-bit value in the AFI register.
• Lock AFI, used to lock the AFI register.
• Write DSFID, used to write the 8-bit value in the DSFID register.
• Lock DSFID, used to lock the DSFID register.
• Get System information and Extended Get System Information, used to provide the system information
value.
• Get System information, used to provide the standard system information values.
• Extended Get System Information, used to provide the extended system information values.
• Write Password, used to update the 64 bit of the selected areas or configuration password, but only after
presenting the current one.
• Lock Block and Extended Lock block, used to write the CC file blocks security status bits (Protect the
CC File content against writing).
• Present Password, enables the user to present a password to open a security session.
• Fast Read Single Block and Fast Extended Read Single Block, used to output the 32 bits of the
selected block and its locking status at doubled data rate.
• Fast Read Multiple Blocks and Fast Extended Read Multiple Blocks, used to read the selected blocks
in a single area and send back their value at doubled data rate.
• Read Message, used to output up to 256 byte of the Mailbox.
• Read Message Length, used to output the Mailbox message length.
• Fast Read Message, used to output up to 256 byte of the mailbox, at double data rate.
• Write Message, used to write up to 256 byte in the Mailbox.
• Fast Read Message Length, used to ouput the mailbox length, at double data rate.
• Fast Write Message, used to write up to 256 bytes in the mailbox, with answer at double data rate.
• Read Configuration, used to read static configuration registers.
• Write Configuration, used to write static configuration registers.
• Read Dynamic Configuration, used to read dynamic register.
• Write Dynamic Configuration , used to write dynamic register.
• Fast Read Dynamic Configuration, used to read dynamic register, at double data rate.
• Fast Write Dynamic Configuration, used to write dynamic register, with answer at double data rate.
• Manage GPO, used to drive GPO output value when corresponding GPO mode is enabled.

DS10925 - Rev 11 page 80/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.2 Command codes list

The ST25DVxxx supports the commands described in this section. Their codes are given in Table 101. Command
codes.

Table 101. Command codes

Command Command
Function Function
code standard code custom

01h Inventory A0h Read Configuration

02h Stay Quiet A1h Write Configuration
20h Read Single Block A9h Manage GPO
21h Write Single Block AAh Write Message
22h Lock Block ABh Read Message Length
23h Read Multiple Blocks ACh Read Message
24h Write Multiple Blocks ADh Read Dynamic Configuration
25h Select AEh Write Dynamic Configuration
26h Reset to Ready B1h Write Password
27h Write AFI B3h Present Password
28h Lock AFI C0h Fast Read Single Block
29h Write DSFID C3h Fast Read Multiple Blocks
30h Extended Read Single Block C4h Fast Extended Read Single Block
31h Extended Write Single Block C5h Fast Extended Read Multiple Block
32h Extended Lock block CAh Fast Write Message
33h Extended Read Multiple Blocks CBh Fast Read Message Length
34h Extended Write Multiple Blocks CCh Fast Read Message
2Ah Lock DSFID CDh Fast Read Dynamic configuration
2Bh Get System Info CEh Fast Write Dynamic Configuration
2Ch Get Multiple Block Security Status - -
3Bh Extended Get System Info - -
3Ch Extended Get Multiple Block Security Status - -

7.6.3 General command rules

In case of a valid command, the following paragraphs will describe the expected behavior for each command.
But in case of an invalid command, in a general manner, the ST25DVxxx will behave as follows:
1. if flag usage is incorrect, the error code 03h will be issued only if the right UID is used in the command,
otherwise no response will be issued.
2. error 02h will be issued if the custom command is used with the manufacturer code different from the ST
one
Another case is if I2C is busy. In this case, any RF command (except Inventory, Select, Stay quiet and Reset to
ready) will get 0Fh error code as response only:
• if select flag and address flags are not set at the same time (except if ST25DVxxx is in quiet state)
• if select flag is set and ST25DVxxx is in selected state.
For all other commands, if I2C is busy, no response will be issued by ST25DVxxx.

DS10925 - Rev 11 page 81/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.4 Inventory
Upon receiving the Inventory request, the ST25DVxxx runs the anticollision sequence. The Inventory_flag is set to
1. The meaning of flags 5 to 8 is shown in Table 96. Request flags 5 to 8 when inventory_flag, Bit 3 = 1.
The request contains:
• the flags
• the Inventory command code (001)
• the AFI if the AFI flag is set
• the mask length
• the mask value if mask length is different from 0
• the CRC
The ST25DVxxx does not generate any answer in case of error.

Table 102. Inventory request format

Request Request
Request_flags Inventory Optional AFI Mask length Mask value CRC16
SOF EOF

- 8 bits 01h 8 bits 8 bits 0 - 64 bits 16 bits -

The response contains:

• the flags
• the Unique ID

Table 103. Inventory response format

Response SOF Response_flags DSFID UID CRC16 Response EOF

- 8 bits 8 bits 64 bits 16 bits -

During an Inventory process, if the VCD does not receive an RF ST25DVxxx response, it waits for a time t3 before
sending an EOF to switch to the next slot. t3 starts from the rising edge of the request EOF sent by the VCD.
• If the VCD sends a 100% modulated EOF, the minimum value of t3 is:
t3min = 4384/fC (323.3µs) + tSOF
• If the VCD sends a 10% modulated EOF, the minimum value of t3 is:
t3min = 4384/fC (323.3µs) + tNRT + t2min
where:
• tSOF is the time required by the ST25DVxxx to transmit an SOF to the VCD,
• tNRT is the nominal response time of the ST25DVxxx.
tNRT and tSOF are dependent on the ST25DVxxx-to-VCD data rate and subcarrier modulation mode.
Note: In case of error, no response is sent by ST25DVxxx.

7.6.5 Stay Quiet

On receiving the Stay Quiet command, the ST25DVxxx enters the Quiet state if no error occurs, and does NOT
send back a response. There is NO response to the Stay Quiet command even if an error occurs.
The Option_flag is not supported. The Inventory_flag must be set to 0.
When in the Quiet state:
• the ST25DVxxx does not process any request if the Inventory_flag is set,
• the ST25DVxxx processes any Addressed request.
The ST25DVxxx exits the Quiet state when:
• it is reset (power off),
• receiving a Select request. It then goes to the Selected state,
• receiving a Reset to Ready request. It then goes to the Ready state.

DS10925 - Rev 11 page 82/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 104. Stay Quiet request format

Request SOF Request flags Stay Quiet UID CRC16 Request EOF

- 8 bits 02h 64 bits 16 bits -

The Stay Quiet command must always be executed in Addressed mode (Select_flag is reset to 0 and
Address_flag is set to 1).

Figure 34. Stay Quiet frame exchange between VCD and ST25DVxxx

Stay Quiet
VCD SOF EOF
request

ST25DVxxx

7.6.6 Read Single Block

On receiving the Read Single Block command, the ST25DVxxx reads the requested block and sends back its
32-bit value in the response. The Option_flag is supported, when set response include the Block Security Status.
The Inventory_flag must be set to 0.
Block number is coded on 1 byte, and only the first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.

Table 105. Read Single Block request format

Request SOF Request_flags Read Single Block UID (1) Block number CRC16 Request EOF

- 8 bits 20h 64 bits 8 bits 16 bits -

1. This the field is optional.

Request parameters:
• Request flags
• UID (optional)
• Block number

Table 106. Read Single Block response format when Error_flag is NOT set

Response SOF Response_flags Block security status (1) Data CRC16 Response EOF

- 8 bits 8 bits 32 bits 16 bits -

1. This field is optional.

Response parameters:
• Block security status if Option_flag is set (see Table 107. Block security status)
• Four bytes of block data

Table 107. Block security status

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use. 0: Current block not locked

All at 0. 1: Current block locked

DS10925 - Rev 11 page 83/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 108. Read Single Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set
– 03h: command option not supported
– 0Fh: error with no information
– 10h: the specified block is not available
– 15h: the specified block is read-protected

Figure 35. Read Single Block frame exchange between VCD and ST25DVxxx

Read Single Block

VCD SOF EOF
request

Read Single Block

ST25DVxxx t1 SOF EOF
response

7.6.7 Extended Read Single Block

On receiving the Extended Read Single Block command, the ST25DVxxx reads the requested block and sends
back its 32-bit value in the response.
When the Option_flag is set, the response includes the Block Security Status.
Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and
ST25DV64K-xx can be addressed using this command.

Table 109. Extended Read Single Block request format

Request SOF Request_flags Extended Read Single Block UID (1) Block number CRC16 Request EOF

- 8 bits 30h 64 bits 16 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flags
• UID (optional)
• Block number (from LSB byte to MSB byte)

Table 110. Extended Read Single Block response format when Error_flag is NOT set

Response SOF Response_flags Block security status (1) Data CRC16 Response EOF

- 8 bits 8 bits 32 bits 16 bits -

1. This field is optional.

Response parameters:
• Block security status if Option_flag is set (see Table 107. Block security status)
• Four bytes of block data

DS10925 - Rev 11 page 84/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 111. Block security status

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use. 0: Current block not locked

All at 0. 1: Current block locked

Table 112. Extended Read Single Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set
– 03h: command option not supported or no response
– 0Fh: error with no information
– 10h: the specified block is not available
– 15h: the specified block is read-protected

Figure 36. Extended Read Single Block frame exchange between VCD and ST25DVxxx

Extended Read
VCD SOF Single Block EOF
request

Extended Read
ST25DVxxx t1 SOF Single Block EOF
response

7.6.8 Write Single Block

On receiving the Write Single Block command, the ST25DVxxx writes the data contained in the request to the
targeted block and reports whether the write operation was successful in the response. When the Option_flag is
set, wait for EOF to respond. The Inventory_flag must be set to 0.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not program correctly the data into the memory. The Wt time is equal to t1nom + N × 302 µs (N is an integer).
Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.

Table 113. Write Single Block request format

Request SOF Request_flags Write Single Block UID (1) Block number Data CRC16 Request EOF

- 8 bits 21h 64 bits 8 bits 32 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flags
• UID (optional)
• Block number
• Data

DS10925 - Rev 11 page 85/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 114. Write Single Block response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter. The response is sent back after the writing cycle.

Table 115. Write Single Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set
– 03h: command option not supported
– 0Fh: error with no information given
– 10h: the specified block is not available
– 12h: the specified block is locked or protected and its contents cannot be changed
– 13h: the specified block was not successfully programmed
Note: For more details, see Figure 7. Memory organization.

Figure 37. Write Single Block frame exchange between VCD and ST25DVxxx

Write Single
VCD SOF EOF
Block request

Write Single Write sequence

ST25DVxxx t1 SOF EOF
Block response when error

Write Single
ST25DVxxx Wt SOF EOF
Block response

DS10925 - Rev 11 page 86/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.9 Extended Write Single Block

On receiving the Extended Write Single command, the ST25DVxxx writes the data contained in the request to the
targeted block and reports whether the write operation was successful in the response. When the Option_flag is
set, wait for EOF to respond.
The Inventory_flag must be set to 0.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not program correctly the data into the memory. The Wt time is equal to t1nom + N × 302 µs (N is an integer).
Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.

Table 116. Extended Write Single request format

Request SOF Request_flags Extended Write Single Block UID (1) Block number Data CRC16 Request EOF

- 8 bits 31h 64 bits 16 bits 32 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flags
• UID (optional)
• Block number (from LSB byte to MSB byte)
• Data (from LSB byte to MSB byte)

Table 117. Extended Write Single response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter. The response is sent back after the writing cycle.

Table 118. Extended Write Single response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: command option not supported
– 0Fh: error with no information given
– 10h: the specified block is not available
– 12h: the specified block is locked and its contents cannot be changed
– 13h: the specified block was not successfully programmed

DS10925 - Rev 11 page 87/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 38. Extended Write Single frame exchange between VCD and ST25DVxxx

Extended Write
VCD SOF EOF
Single request

Extended Write Write sequence

ST25DVxxx t1 SOF EOF
Single response when error

Extended Write
ST25DVxxx Wt SOF EOF
Single response

7.6.10 Lock Block

On receiving the Lock block request, the ST25DVxxx locks the single block value permanently and protects its
content against new writing.
This command is only applicable for the blocks 0 and 1 which may include a CC file.
For a global protection of a area, update accordingly the RFAiSS bits in the system area. The Option_flag is
supported, when set wait for EOF to respond.
The Inventory_flag must be set to 0.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not lock correctly the single block value in memory. The Wt time is equal to t1nom + N × 302 µs (N is an
integer).

Table 119. Lock block request format

Request SOF Request_flags Lock block UID (1) block number CR7C16 Request EOF

- 8 bits 22h 64 bits 8 bits 16 bits -

1. This field is optional.

Request parameter:
• Request Flags
• UID (optional)
• Only block numbers 0 and 1 are allowed to protect the CCFile in case of NDEF (from LSB byte to MSB
byte)

Table 120. Lock block response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter

Table 121. Lock block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

DS10925 - Rev 11 page 88/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Response parameter:
• Error code as Error_flag is set
– 03h: command option not supported
– 10h: block not available
– 11h: the specified block is already locked and thus cannot be locked again
– 14h: the specified block was not successfully locked

Figure 39. Lock Block frame exchange between VCD and ST25DVxxx

Lock Block
VCD SOF EOF
request

Lock Block Lock sequence

ST25DVxxx t1 SOF EOF
response when error

Lock Block
ST25DVxxx Wt SOF EOF
response

7.6.11 Extended Lock block

On receiving the extended Lock block request, the ST25DVxxx locks the single block value permanently and
protects its content against new writing.
This command is only applicable for the blocks 0 and 1 which may include a CC file.
For a global protection of a area, update accordingly the AiSS bits in the system area. When the Option_flag is
set, wait for EOF to respond.
The Inventory_flag must be set to 0.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not lock correctly the single block value in memory. The Wt time is equal to t1nom + N × 302 µs (N is an
integer).

Table 122. Extended Lock block request format

Request SOF Request_flags Extended Lock block UID (1) block number CRC16 Request EOF

- 8 bits 32h 64 bits 16 bits 16 bits -

1. The field is optional.

Request parameter:
• Request Flags
• UID (optional)
• Only block numbers 0 and 1 are allowed to protect the CCFile in case of NDEF (from LSB byte to MSB
byte)

Table 123. Extended Lock block response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

DS10925 - Rev 11 page 89/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Response parameter:
• No parameter

Table 124. Extended Lock block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set
– 03h: command option not supported
– 10h: block not available
– 11h: the specified block is already locked and thus cannot be locked again
– 14h: the specified block was not successfully locked

Figure 40. Extended Lock block frame exchange between VCD and ST25DVxxx

Extended
VCD SOF Lock block EOF
request

Extended
Lock sequence
ST25DVxxx t1 SOF Lock block EOF
when error
response

Extended
ST25DVxxx Wt SOF Lock block EOF
response

7.6.12 Read Multiple Blocks

When receiving the Read Multiple Block command, the ST25DVxxx reads the selected blocks and sends back
their value in multiples of 32 bits in the response. The blocks are numbered from 00h to FFh in the request and
the value is minus one (–1) in the field. For example, if the “Number of blocks” field contains the value 06h, seven
blocks are read. The maximum number of blocks is fixed at 256 assuming that they are all located in the same
area. If the number of blocks overlaps areas or overlaps the end of user memory, the ST25DVxxx returns an error
code. When the Option_flag is set, the response returns the Block Security Status.
The Inventory_flag must be set to 0.
Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.

Table 125. Read Multiple Block request format

Read Multiple First block

Request SOF Request_flags UID (1) Number of blocks CRC16 Request EOF
Block number

- 8 bits 23h 64 bits 8 bits 8 bits 16 bits -

1. The field is optional.

Request parameters:
• Request flags
• UID (optional)

DS10925 - Rev 11 page 90/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

• First block number

• Number of blocks

Table 126. Read Multiple Block response format when Error_flag is NOT set

Response_ Block security

Response SOF Data CRC16 Response EOF
flags status (1)

- 8 bits 8 bits (2) 32 bits(2) 16 bits -

1. The field is optional.

2. Repeated as needed.

Response parameters:
• Block security status if Option_flag is set (see Table 127. Block security status)
• N blocks of data

Table 127. Block security status

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use. 0: Current block not locked

All at 0. 1: Current block locked

Table 128. Read Multiple Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: command option is not supported
– 0Fh: error with no information given
– 10h: the specified block is not available
– 15h: the specified block is read-protected

Figure 41. Read Multiple Block frame exchange between VCD and ST25DVxxx

Read Multiple
VCD SOF EOF
Block request

Read Multiple
ST25DVxxx t1 SOF EOF
Block response

DS10925 - Rev 11 page 91/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.13 Extended Read Multiple Blocks

When receiving the Extended Read multiple block command, the ST25DVxxx reads the selected blocks and
sends back their value in multiples of 32 bits in the response. The blocks are numbered from 00h to last block
of memory in the request and the value is minus one (-1) in the field. For example, if the “Number of blocks”
field contains the value 06h, seven blocks are read. The maximum number of blocks is fixed at 2047 assuming
that they are all located in the same area. If the number of blocks overlaps areas or overlaps the end of user
memory, the ST25DVxxx returns an error code. When the Option_flag is set, the response returns the Block
Security Status.
The Inventory_flag must be set to 0.
Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed
using this command.

Table 129. Extended Read Multiple Block request format

Extended
Request Read First block Number of Request
Request_flags UID (1) CRC16
SOF Multiple number blocks EOF
Block

- 8 bits 33h 64 bits 16 bits 16 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flags
• UID (optional)
• First block number (from LSB byte to MSB byte)
• Number of blocks (from LSB byte to MSB byte)

Table 130. Extended Read Multiple Block response format when Error_flag is NOT set

Response_ Block security

Response SOF Data CRC16 Response EOF
flags status (1)

- 8 bits 8 bits (2) 32 bits (2) 16 bits -

1. This field is optional.

2. Repeated as needed.

Response parameters:
• Block security status if Option_flag is set (see Table 131. Block security status)
• N blocks of data

Table 131. Block security status

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use. 0: Current block not locked

All at 0 1: Current block locked

Table 132. Extended Read Multiple Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:

DS10925 - Rev 11 page 92/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

• Error code as Error_flag is set:

– 03h: command option is not supported
– 0Fh: error with no information given
– 10h: the specified block is not available
– 15h: the specified block is read-protected

Figure 42. Extended Read Multiple Block frame exchange between VCD and ST25DVxxx

Extended
VCD SOF Read Multiple EOF
Block request

Extended
ST25DVxxx t1 SOF Read Multiple EOF
Block response

7.6.14 Write Multiple Blocks

On receiving the Write Multiple Block command, the ST25DVxxx writes the data contained in the request to the
requested blocks, and reports whether the write operation were successful in the response. ST25DVxxx supports
up to 4 blocks, data field must be coherent with the number of blocks to program.
If some blocks overlaps areas, or overlap end of user memory, the ST25DVxxx returns an error code and none of
the blocks are programmed. When the Option_flag is set, wait for EOF to respond. During the RF write cycle Wt,
there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not program correctly the
data into the memory. The Wt time is equal to t1nom + m × 302 μs < 20 ms. (m is an integer, it is function of Nb
number of blocks to be programmed).
The Inventory_flag must be set to 0.
Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.

Table 133. Write Multiple Block request format

Write
Request First Block Number of Request
Request_flags Multiple UID (1) Data CRC16
SOF number block (2) EOF
Block

Block length
- 8 bits 24h 64 bits 8 bits 8 bits (3) 16 bits -

1. This field is optional.

2. The number of blocks in the request is one less than the number of blocks that the VICC shall write.
3. Repeated as needed

Request parameters:
• Request flags
• UID (optional)
• First Block number
• Number of blocks
• Data

DS10925 - Rev 11 page 93/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 134. Write Multiple Block response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter. The response is sent back after the writing cycle.

Table 135. Write Multiple Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: command option is not supported
– 0Fh: error with no information given
– 10h: the specified block is not available
– 12h: the specified block is locked and its contents cannot be changed
– 13h: the specified block was not successfully programmed

Figure 43. Write Multiple Block frame exchange between VCD and ST25DVxxx

Write Multiple
VCD SOF EOF
block request

Write Multiple Write sequence

ST25DVxxx t1 SOF EOF
block response when error

Write Multiple
ST25DVxxx Wt SOF EOF
block response

7.6.15 Extended Write Multiple Blocks

On receiving this command, the device writes the data contained in the request to the targeted blocks and reports
whether the write operation was successful in the response. ST25DVxxx supports up to four blocks, data field
must be coherent with number of blocks to program.
If some blocks overlap, or overlap end of user memory, the device returns an error code, and none of the blocks
are programmed.
When the Option_flag is set, wait for EOF to respond. During the RF write cycle Wt, there should be no
modulation (neither 100% nor 10%), otherwise the ST25DVxxx may not program correctly the data into the
memory. The Wt time is equal to t1nom + m × 302 μs < 20 ms (m is an integer function of Nb number of blocks to
be programmed).
The inventory_flag must be set to 0.
Block number is coded on 2 bytes, so all memory blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.

DS10925 - Rev 11 page 94/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 136. Extended Write Multiple Block request format

Extended
Request First block Number of Request
Request_flags Write multiple UID (1) Data CRC16
SOF number block (2) EOF
block

Block
- 8 bits 34h 64 bits 16 bits 16 bits 16 bits -
length (3)

1. This field is optional.

2. The number of blocks in the request is one less than the number of blocks that the VICC must write.
3. Repeated as needed

Request parameters:
• Request flags
• UID (optional)
• First block number (from LSB byte to MSB byte)
• Number of block (from LSB byte to MSB byte)
• Data (from first to last blocks, from LSB bytes to MSB bytes)

Table 137. Extended Write Multiple Block response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter. The response is sent back after the writing cycle.

Table 138. Extended Write Multiple Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: command option is not supported
– 0Fh: error with no information given
– 10h: the specified block is not available
– 12h: the specified block is locked and its contents cannot be changed
– 13h: the specified block was not successfully programmed

DS10925 - Rev 11 page 95/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 44. Extended Write Multiple Block frame exchange between VCD and ST25DVxxx

Extended Write
VCD SOF Multiple Block EOF
request

Extended Write
Write sequence
ST25DVxxx t1 SOF Multiple Block EOF
when error
response

Extended Write
ST25DVxxx Wt SOF Multiple Block EOF
response

7.6.16 Select
When receiving the Select command:
• If the UID is equal to its own UID, the ST25DVxxx enters or stays in the Selected state and sends a
response.
• If the UID does not match its own UID, the selected ST25DVxxx returns to the Ready state and does not
send a response.
The ST25DVxxx answers an error code only if the UID is equal to its own UID. If not, no response is generated. If
an error occurs, the ST25DVxxx remains in its current state.
The Option_flag is not supported, and the Inventory_flag must be set to 0.

Table 139. Select request format

Request SOF Request_flags Select UID CRC16 Request EOF

- 8 bits 25h 64 bits 16 bits -

Request parameter:
• UID

Table 140. Select Block response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter

Table 141. Select response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: the option is not supported
– 0Fh: error with no information given

DS10925 - Rev 11 page 96/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 45. Select frame exchange between VCD and ST25DVxxx

VCD SOF Select request EOF

ST25DVxxx t1 SOF Select response EOF

DS10925 - Rev 11 page 97/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.17 Reset to Ready

On receiving a Reset to Ready command, the ST25DVxxx returns to the Ready state if no error occurs. In the
Addressed mode, the ST25DVxxx answers an error code only if the UID is equal to its own UID. If not, no
response is generated.
The Option_flag is not supported, and the Inventory_flag must be set to 0.

Table 142. Reset to Ready request format

Request SOF Request_flags Reset to Ready UID (1) CRC16 Request EOF

- 8 bits 26h 64 bits 16 bits -

1. This field is optional.

Request parameter:
• UID (optional)

Table 143. Reset to Ready response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter

Table 144. Reset to ready response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: the option is not supported
– 0Fh: error with no information given

Figure 46. Reset to Ready frame exchange between VCD and ST25DVxxx

Reset to Ready
VCD SOF EOF
request

Reset to Ready
ST25DVxxx t1 SOF EOF
response

DS10925 - Rev 11 page 98/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.18 Write AFI

On receiving the Write AFI request, the ST25DVxxx programs the 8-bit AFI value to its memory. When the
Option_flag is set, wait for EOF to respond.
The Inventory_flag must be set to 0.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not write correctly the AFI value into the memory. The Wt time is equal to t1nom + N × 302 µs (N is an
integer).

Table 145. Write AFI request format

Request SOF Request_flags Write AFI UID (1) AFI CRC16 Request EOF

- 8 bits 27h 64 bits 8 bits 16 bits -

1. This field is optional.

Request parameter:
• Request flags
• UID (optional)
• AFI

Table 146. Write AFI response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter

Table 147. Write AFI response format when Error_flag is set

Response_
Response SOF Error code CRC16 Response EOF
flags

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set
– 03h: command option is not supported
– 0Fh: error with no information given
– 12h: the specified block is locked and its contents cannot be changed
– 13h: the specified block was not successfully programmed

DS10925 - Rev 11 page 99/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 47. Write AFI frame exchange between VCD and ST25DVxxx

Write AFI
VCD SOF EOF
request

Write AFI Write sequence

ST25DVxxx t1 SOF EOF
response when error

Write AFI
ST25DVxxx Wt SOF EOF
response

7.6.19 Lock AFI

On receiving the Lock AFI request, the ST25DVxxx locks the AFI value permanently. When the Option_flag is set,
wait for EOF to respond.
The Inventory_flag must be set to 0.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not lock correctly the AFI value in memory. The Wt time is equal to t1nom + N × 302 µs (N is an integer).

Table 148. Lock AFI request format

Request SOF Request_flags Lock AFI UID (1) CRC16 Request EOF

- 8 bits 28h 64 bits 16 bits -

1. This field is optional.

Request parameter:
• Request Flags
• UID (optional)

Table 149. Lock AFI response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter

Table 150. Lock AFI response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:

DS10925 - Rev 11 page 100/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

• Error code as Error_flag is set

– 03h: command option is not supported
– 0Fh: error with no information given
– 11h: the specified block is already locked and thus cannot be locked again
– 14h: the specified block was not successfully locked

Figure 48. Lock AFI frame exchange between VCD and ST25DVxxx

Lock AFI
VCD SOF EOF
request

Lock AFI Lock sequence

ST25DVxxx t1 SOF EOF
response when error

Lock AFI
ST25DVxxx Wt SOF EOF
response

7.6.20 Write DSFID

On receiving the Write DSFID request, the ST25DVxxx programs the 8-bit DSFID value to its memory. When the
Option_flag is set, wait for EOF to respond.
The Inventory_flag must be set to 0.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not write correctly the DSFID value in memory. The Wt time is equal to t1nom + N × 302 µs (N is an integer).

Table 151. Write DSFID request format

Request SOF Request_flags Write DSFID UID (1) DSFID CRC16 Request EOF

- 8 bits 29h 64 bits 8 bits 16 bits -

1. This field is optional.

Request parameter:
• Request flags
• UID (optional)
• DSFID

Table 152. Write DSFID response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter

DS10925 - Rev 11 page 101/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 153. Write DSFID response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set
– 03h: command option is not supported
– 0Fh: error with no information given
– 12h: the specified block is locked and its contents cannot be changed
– 13h: the specified block was not successfully programmed

Figure 49. Write DSFID frame exchange between VCD and ST25DVxxx

Write DSFID
VCD SOF EOF
request

Write DSFID Write sequence

ST25DVxxx t1 SOF EOF
response when error

Write DSFID
ST25DVxxx Wt SOF EOF
response

7.6.21 Lock DSFID

On receiving the Lock DSFID request, the ST25DVxxx locks the DSFID value permanently. When the Option_flag
is set, wait for EOF to respond.
The Inventory_flag must be set to 0.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not lock correctly the DSFID value in memory. The Wt time is equal to t1nom + N × 302 µs (N is an integer).

Table 154. Lock DSFID request format

Request SOF Request_flags Lock DSFID UID (1) CRC16 Request EOF

- 8 bits 2Ah 64 bits 16 bits -

1. This field is optional.

Request parameter:
• Request flags
• UID (optional)

Table 155. Lock DSFID response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

DS10925 - Rev 11 page 102/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Response parameter:
• No parameter.

Table 156. Lock DSFID response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: command option is not supported
– 0Fh: error with no information given
– 11h: the specified block is already locked and thus cannot be locked again
– 14h: the specified block was not successfully locked

Figure 50. Lock DSFID frame exchange between VCD and ST25DVxxx

Lock DSFID
VCD SOF EOF
request

Lock DSFID Lock sequence

ST25DVxxx t1 SOF EOF
response when error

Lock DSFID
ST25DVxxx Wt SOF EOF
response

DS10925 - Rev 11 page 103/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.22 Get System Info

When receiving this command, the device sends back its information data in the response.
The Option_flag is not supported. The Inventory_flag must be set to 0. The command can be issued in both
Addressed and Non Addressed modes.

Table 157. Get System Info request format

Request SOF Request_flags Get System Info UID (1) CRC16 Request EOF

- 8 bits 2Bh 64 bits 16 bits -

1. This field is optional.

Request parameter:
• Request flags
• UID (optional)

Table 158. Get System Info response format Error_flag is NOT set

Response Response Information Memory Response

Device UID DSFID AFI IC ref CRC16
SOF flags flags size EOF

ST25DV64K-xx
0Bh 64 NA (1) 26h 16
ST25DV16K-xx - 00h 8 bits 8 bits -
bits bits
ST25DV04K-xx 0Fh 037Fh 24h

1. Field not present in this configuration

Response parameters:
• Information flags set to 0Bh/0Fh. DSFID, AFI and IC reference fields are present
• UID code on 64 bits
• DSFID value
• AFI value
• MemSize: Block size in bytes and memory size in number of blocks (only present for ST25DV04K-xx
configurations)

Table 159. Memory size

MSB LSB

16 14 13 9 8 1

RFU Block size in byte Number of blocks

0h 03h 7Fh

• ST25DVxxx IC reference: the 8 bits are significant.

Table 160. Get System Info response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 01h 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: Option not supported
– 0Fh: Error with no information given

DS10925 - Rev 11 page 104/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 51. Get System Info frame exchange between VCD and ST25DVxxx

Get System info

VCD SOF EOF
request

Get System info

ST25DVxxx t1 SOF EOF
response

7.6.23 Extended Get System Info

When receiving this command, the device sends back its information data in the response.
The Option_flag is not supported. The Inventory_flag must be set to 0. The command can be issued in both
Addressed and Non Addressed modes.

Table 161. Extended Get System Info request format

Request SOF Request_flags Extended Get System Info Parameter request field UID (1) CRC16 Request EOF

- 8 bits 3Bh 8 bits (0xx1xxxxb) 64 bits 16 bits -

1. This field is optional.

• Request flags
• Request parameters
• UID (optional)

Table 162. Parameter request list

Bit Flag name Value Description

0 No request of DSFID
b1 DSFID
1 Request of DSFID
0 No request of AFI
b2 AFI
1 Request of AFI

0 No request of data field on VICC memory size

b3 VICC memory size
1 Request of data field on VICC memory size

0 No request of information on IC reference

b4 IC reference
1 Request of information on IC reference
b5 MOI 1 Information on MOI always returned in response flag
0 No request of Data field of all supported commands
b6 VICC command list
1 Request of Data field of all supported commands
0 No request of CSI list
b7 CSI Information
1 Request of CSI list
Extended Get System One byte length of Extended Get System
b8 0
Info parameter Field Info parameter field

DS10925 - Rev 11 page 105/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 163. Extended Get System Info response format when Error_flag is NOT set

Response Information Response

Response_flags UID DSFID (1) (2) AFI(2) (1) Other field(2) (1) CRC16
SOF flags EOF

- 00h 8 bits(1) 64 bits 8 bits 8 bits Up to 64 bits (3) 16 bits -

1. See Table 164. Response Information Flag.

2. This field is optional.
3. The number of bytes is a function of the selected parameter list.

Response parameters:
• Information flag defining which fields are present
• UID code on 64 bits
• DSFID value (if requested in Parameters request field)
• AFI value (if requested in Parameters request field)
• Other fields:
– VICC memory size (if requested in Parameters request field)
– ICRef (if requested in Parameters request field)
– VICC Command list (if requested in Parameters request field)

Table 164. Response Information Flag

Bit Meaning if bit is set Comment

0 DSFID field is not present

b1 DSFID
1 DSFID field is present
0 AFI field is not present
b2 AFI
1 AFI field is present
0 Data field on VICC memory size is not present.
b3 VICC memory size
1 Data field on VICC memory size is present.
0 Information on IC reference field is not present.
b4 IC reference
1 Information on IC reference field is present
0 1-byte addressing
b5 MOI
1 2-byte addressing
0 Data field of all supported commands is not present
b6 VICC Command list
1 Data field of all supported commands is present
b7 CSI Information 0 CSI list is not present
b8 Info flag filed 0 One byte length of Info flag field

Table 165. Response other field: ST25DVxxx VICC memory size

MSB LSB

24 22 21 17 16 01

RFU Block size in byte Number of blocks

07FFh (ST25DV64K-xx)
0h 03h 01FFh (ST25DV16K-xx)
007Fh (ST25DV04K-xx)

DS10925 - Rev 11 page 106/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 166. Response other field: ST25DVxxx IC Ref

1 byte

ICRef

24h (ST25DV04K-xx) or 26h (ST25DV16K-xx and ST25DV64K-xx)

Table 167. Response other field: ST25DVxxx VICC command list

MSB LSB

32 25 24 17 16 09 08 01

Byte 4 Byte3 Byte 2 Byte 1

00h 3Fh 3Fh FFh

Table 168. Response other field: ST25DVxxx VICC command list Byte 1

Bit Meaning if bit is set Comment

b1 Read single block is supported -

b2 Write single block is supported -
b3 Lock single block is supported -
b4 Read multiple block is supported -
b5 Write multiple block is supported -
b6 Select is supported Including Select state
b7 Reset to Ready is supported -
b8 Get multiple block security status is supported -

Table 169. Response other field: ST25DVxxx VICC command list Byte 2

Bit Meaning if bit is set Comment

b1 Write AFI is supported -

b2 Lock AFI is supported -
b3 Write DSFID is supported -
b4 Lock DSFID is supported -
b5 Get System Information is supported -
b6 Custom commands are supported -
b7 RFU 0 shall be returned
b8 RFU 0 shall be returned

DS10925 - Rev 11 page 107/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 170. Response other field: ST25DVxxx VICC command list Byte 3

Bit Meaning if bit is set Comment

b1 Extended read single block is supported -

b2 Extended write single block is supported -
b3 Extended lock single block is supported -
b4 Extended read multiple block is supported -
b5 Extended write multiple block is supported -
b6 Extended Get Multiple Security Status is supported -
b7 RFU 0 shall be returned
b8 RFU 0 shall be returned

Table 171. Response other field: ST25DVxxx VICC command list Byte 4

Bit Meaning if bit is set Comment

b1 Read Buffer is supported Means Response Buffer is supported

b2 Select Secure State is supported Means VCD or Mutual authentication are supported
b3 Final Response always includes crypto result Means that flag b3 will be set in the Final response
b4 AuthComm crypto format is supported -
b5 SecureComm crypto format is supported -
b6 KeyUpdate is supported -
b7 Challenge is supported -
b8 If set to 1 a further Byte is transmitted 0 shall be returned

Table 172. Extended Get System Info response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 01h 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: option not supported
– 0Fh: error with no information given

Figure 52. Extended Get System Info frame exchange between VCD and ST25DVxxx

Extended Get
VCD SOF System Info EOF
request

Extended Get
ST25DVxxx t1 SOF System Info EOF
response

DS10925 - Rev 11 page 108/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.24 Get Multiple Block Security Status

When receiving the Get Multiple Block Security Status command, the ST25DVxxx sends back its security status
for each address block: 0 when block is writable else 1 when block is locked for writing. The blocks security
status are defined by the area security status (and by LCK_CCFILE register for blocks 0 and 1). The blocks are
numbered from 00h up to the maximum memory block number in the request, and the value is minus one (–1)
in the field. For example, a value of “06” in the “Number of blocks” field requests will return the security status of
seven blocks. This command does not respond an error if number of blocks overlap areas or overlap the end of
the user memory.
The number of blocks is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.
The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 173. Get Multiple Block Security Status request format

Get Multiple Block First block Number of

Request SOF Request_flags UID (1) CRC16 Request EOF
Security Status number blocks

- 8 bits 2Ch 64 bits 8 bits 8 bits 16 bits -

1. This field is optional.

Request parameter:
• Request flags
• UID (optional)
• First block number
• Number of blocks

Table 174. Get Multiple Block Security Status response format when Error_flag is NOT set

Response SOF Response_flags Block security status CRC16 Response EOF

- 8 bits 8 bits (1) 16 bits -

1. Repeated as needed.

Response parameters:
• Block security status

Table 175. Block security status

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use 0: Current block not locked

All at 0 1: Current block locked

Table 176. Get Multiple Block Security Status response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: the option is not supported
– 0Fh: error with no information given
– 10h: the specified block is not available

DS10925 - Rev 11 page 109/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 53. Get Multiple Block Security Status frame exchange between VCD and ST25DVxxx

Get Multiple Block

VCD SOF Security request EOF
status

Get Multiple Block

ST25DVxxx t1 SOF Security response EOF
status

7.6.25 Extended Get Multiple Block Security Status

When receiving this command, the device sends back the security status for each address block: 0 when the
block is writable, 1 when block is locked for writing. The block security statuses are defined by the area security
status. The blocks are numbered from 00h up to the maximum memory block number in the request, and the
value is minus one (–1) in the field. For example, a value '06' in the “Number of blocks” field requests to return the
security status of seven blocks.
This command does not return an error if number of blocks overlap areas or overlap the end of the user memory.
The number of blocks is coded on two bytes, so all memory blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.
The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 177. Extended Get Multiple Block Security Status request format

Extended Get
Request Multiple Block First block Number of Request
Request_flags UID (1) CRC16
SOF Security number blocks EOF
Status

- 8 bits 3Ch 64 bits 16 bits 16 bits 16 bits -

1. This field is optional.

Request parameter:
• Request flags
• UID (optional)
• First block number (from LSB to MSB)
• Number of blocks (from LSB to MSB)

Table 178. Extended Get Multiple Block Security Status response format when Error_flags NOT set

Response SOF Response_flags Block security status CRC16 Response EOF

- 8 bits 8 bits (1) 16 bits -

1. Repeated as needed.

Response parameters:
• Block security status

Table 179. Block security status

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use 0: Current block not locked

All at 0 1: Current block locked

DS10925 - Rev 11 page 110/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 180. Extended Get Multiple Block Security Status response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 03h: the option is not supported
– 0Fh: error with no information given
– 10h: the specified block is not available

Figure 54. Extended Get Multiple Block Security Status frame exchange

Extended Get
Multiple Block
VCD SOF EOF
Security request
status

Extended Get
Multiple Block
ST25DVxxx t1 SOF EOF
Security response
status

DS10925 - Rev 11 page 111/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.26 Read Configuration

On receiving the Read Configuration command, the ST25DVxxx reads the static system configuration register at
the Pointer address and sends back its 8-bit value in the response.
The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 181. Read Configuration request format

Request SOF Request_flags Read Configuration IC Mfg code UID (1) Pointer CRC16 Request EOF

- 8 bits A0h 02h 64 bits 8 bits 16 bits -

1. This field is optional.

Note: Please refer to Table 11. System configuration memory map for details on register addresses.
Request parameters:
• System configuration register pointer
• UID (optional)

Table 182. Read Configuration response format when Error_flag is NOT set

Response SOF Response_flags Register value CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameters:
• One byte of data: system configuration register

Table 183. Read Configuration response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set
– 02h: command not recognized
– 03h: the option is not supported
– 10h: block not available
– 0Fh: error with no information given

Figure 55. Read Configuration frame exchange between VCD and ST25DVxxx

Read
VCD SOF Configuration EOF
request

Read
ST25DVxxx t1 SOF Configuration EOF
response

DS10925 - Rev 11 page 112/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.27 Write Configuration

The Write Configuration command is used to write static system configuration register. The Write Configuration
must be preceded by a valid presentation of the RF configuration password (00) to open the RF configuration
security session.
On receiving the Write Configuration command, the ST25DVxxx writes the data contained in the request to the
system configuration register at the Pointer address and reports whether the write operation was successful in the
response or not.
When the Option_flag is set, wait for EOF to respond. The Inventory_flag is not supported.
During the RF write cycle Wt, there should be no modulation (neither 100% nor 10%), otherwise the ST25DVxxx
may not program correctly the data into the Configuration byte. The Wt time is equal to t1nom + N × 302 µs (N is
an integer).

Table 184. Write Configuration request format

Request Write IC Mfg Register Request

Request_flags UID (1) Pointer CRC16
SOF Configuration code value(2) EOF

- 8 bits A1h 02h 64 bits 8 bits 8 bits 16 bits -

1. This field is optional.

2. Before updating the register value, check the meaning of each bit in previous sections.

Request parameters:
• Request flags
• Register pointer
• Register value
• UID (optional)

Table 185. Write Configuration response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Note: Please refer to Table 11. System configuration memory map for details on register addresses.
Response parameter:
• No parameter. The response is sent back after the writing cycle.

Table 186. Write configuration response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option is not supported
– 0Fh: error with no information given
– 10h: block not available
– 12h: block already locked, content can't change
– 13h: the specified block was not successfully programmed

DS10925 - Rev 11 page 113/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 56. Write Configuration exchange between VCD and ST25DVxxx

Write
VCD SOF Configuration EOF
request

Write
Write Configuration
ST25DVxxx t1 SOF Configuration EOF
sequence when error
response

Write
ST25DVxxx Wt SOF Configuration EOF
response

7.6.28 Read Dynamic Configuration

On receiving the Read Dynamic Configuration command, the ST25DVxxx reads the Dynamic register address
indicated by the pointer and sends back its 8-bit value in the response.
The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 187. Read Dynamic Configuration request format

Read Dynamic
Request SOF Request_flags IC Mfg code UID (1) Pointer address CRC16 Request EOF
Configuration

- 8 bits ADh 02h 64 bits 8 bits 16 bits -

1. This field is optional.

Request parameters:
• UID (Optional)

Table 188. Read Dynamic Configuration response format when Error_flag is NOT set

Response SOF Response_flags Data CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameters:
• One byte of data
Note: Please refer to Table 11. System configuration memory mapfor details on register addresses.

Table 189. Read Dynamic Configuration response format when Error_flag is set

Response SOF Response_flags error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error given with no information
– 10h: block not available

DS10925 - Rev 11 page 114/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 57. Read Dynamic Configuration frame exchange between VCD and ST25DVxxx

Read Dynamic
VCD SOF Configuration EOF
request

Read Dynamic
ST25DVxxx t1 SOF Configuration EOF
response

7.6.29 Write Dynamic Configuration

On receiving the Write Dynamic Configuration command, the ST25DVxxx updates the Dynamic register
addressed by the pointer.
The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 190. Write Dynamic Configuration request format

Request Write Dynamic IC Mfg Pointer Register Request

Request_flags UID (1) CRC16
SOF Configuration code address value EOF

- 8 bits AEh 02h 64 bits 8 bits 8 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flags
• UID (Optional)
• Pointer address
• Register value

Table 191. Write Dynamic Configuration response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameters:
• No parameter. The response is sent back after t1.

Table 192. Write Dynamic Configuration response format when Error_flag is set

Response SOF Response_flags error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given
– 10h: block not available

DS10925 - Rev 11 page 115/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 58. Write Dynamic Configuration frame exchange between VCD and ST25DVxxx

Write Dynamic
VCD SOF Configuration EOF
request

Write Dynamic Write Dynamic

ST25DVxxx t1 SOF Configuration EOF Configuration sequence
response when no error

Write Dynamic Write Dynamic

ST25DVxxx t1 SOF Configuration EOF Configuration sequence
response when error

7.6.30 Manage GPO

On receiving the Manage GPO command. Depending on the command argument, the ST25DV force the GPO
output level if RF_USER interrupt is enabled, or send a pulse on GPO output if RF_INTERRUPT is enabled. If
neither RF_USER nor RF_INTERRUPT was enabled, the command is not executed and ST25DVxxx responds
an Error code “0F”.
The IT duration is defined by IT_TIME register and occurs just after the command response.
For the ST25DVxx-JF (CMOS output), a set means that the GPO pin is driven to a High level (VDCG) and a Reset
pulls the GPO pin to a low level (VSS).
The IT corresponds to a transmission of a positive pulse on the GPO pin.
For the ST25DVxx-IE (open drain output), a Set means that the GPO pin is driven to a low level (VSS) and a
Reset releases the GPO (High impedance).
IT corresponds to the GPO pin driven to ground during the IT duration, then pin is released. Thanks to an external
pull up, the high level will be recovered.
Option_flag is not supported. The Inventory_flag must be set to 0.

Table 193. ManageGPO request format

Request SOF Request_ flags ManageGPO IC Mfg code UID (1) GPO VAL(2) CRC16 Request EOF

- 8 bits A9h 02h 64 bits 8 bits 16 bits -

1. This field is optional.

2. See Table 194

Table 194. GPOVAL

GPOVAL IT ST25DVxx-IE (OD) ST25DVxx-JF (CMOS)

0xxxxxx0b RF_USER enabled Pin pull to 0 GPO Pin set to logic One (VDCG)

0xxxxxx1b RF_USER enabled Pin released (HZ) GPO Pin reset to logic zero
1xxxxxxxb RF_INTERRUPT enabled GPO pin pulled to 0 during IT Time then released (HZ) GPO Pin drives a positive pulse
Any other conditions GPO released (Hz) GPO pin reset to logic zero

Request parameters:
• Request flag
• UID (optional)
• Data: Define static or dynamic Interrupt

DS10925 - Rev 11 page 116/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 195. ManageGPO response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter. The response is sent back after the write cycle.

Table 196. ManageGPO response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 13h: the specified block was not successfully programmed (this error is generated if the ManageCPO
GPOVAL value is not in line with the GPO interrupts setting as specified in Table 194. GPOVAL)

Figure 59. Manage GPO frame exchange between VCD and ST25DVxxx

ManageGPO
VCD SOF EOF
request

ManageGPO
ST25DVxxx t1 SOF EOF
response

7.6.31 Write Message

On receiving the Write Message command, the ST25DVxxx puts the data contained in the request into the
Mailbox buffer, update the MB_LEN_Dyn register, and set bit RF_PUT_MSG in MB_CTRL_Dyn register. It then
reports if the write operation was successful in the response. The ST25DVxxx Mailbox contains up to 256 data
bytes which are filled from the first location '00'. MSGlength parameter of the command is the number of Data
bytes minus - 1 (00 for 1 byte of data, FFh for 256 bytes of data). Write Message could be executed only when
Mailbox is accessible by RF (fast transfer mode is enabled, previous RF message was read or time-out occurs,
no I2C message to be read). User can check it by reading b1 of MB_CTRL_Dyn “HOST_PUT_MSG” which must
be reset to “0”. The Option_flag is not supported. (refer to Section 5.1 Fast transfer mode (FTM))

Table 197. Write Message request format

Request Request_ Write IC Mfg Message Request

UID (1) MSGLength CRC16
SOF flags Message code Data EOF

(MSGLength + 1)
- 8 bits AAh 02h 64 bits 1 byte 16 bits -
bytes

1. This field is optional.

Request parameters:
• Request flags
• UID (optional)
• Message Length
• Message Data

DS10925 - Rev 11 page 117/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 198. Write Message response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter. The response is sent back after the write cycle.

Table 199. Write Message response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given

Figure 60. Write Message frame exchange between VCD and ST25DVxxx

Write Message
VCD SOF EOF
request

Write Message Write sequence

ST25DVxxx t1 SOF EOF
response when error

Write Message
ST25DVxxx t1 SOF EOF
response

7.6.32 Read Message Length

On receiving the Read Message Length command, the ST25DVxxx reads the MB_LEN_Dyn register which
contains the Mailbox message length and sends back its 8-bit value in the response.
The value of MB_LEN_Dyn returned is the (size of the message length in Bytes - 1).
The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 200. Read Message Length request format

Request SOF Request_flags Read Message Length IC Mfg code UID (1) CRC16 Request EOF

- 8 bits ABh 02h 64 bits 16 bits -

1. The field is optional.

Request parameters:
• UID (Optional)

DS10925 - Rev 11 page 118/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 201. Read Message Length response format when Error_flag is NOT set

Response SOF Response_flags Data CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameters:
• One byte of data: MB_LEN_Dyn register value

Table 202. Read Message Length response format when Error_flag is set

Response SOF Response_flags error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error given with no information

Figure 61. Read Message Length frame exchange between VCD and ST25DVxxx

Read Message
VCD SOF EOF
Length request

Read Message
ST25DVxxx t1 SOF EOF
Length response

7.6.33 Read Message

On receiving the Read Message command, the ST25DVxxx reads up to 256 byte in the Mailbox from the location
specified by MBpointer and sends back their value in the response. First MailBox location is '00’. When Number
of bytes is set to 00h and MBPointer is equals to 00h, the MB_LEN bytes of the full message are returned.
Otherwise, Read Message command returns (Number of Bytes + 1) bytes (i.e. 01h returns 2 bytes, FFh returns
256 bytes).
An error is reported if (Pointer + Nb of bytes + 1) is greater than the message length. RF Reading of the last byte
of the mailbox message automatically clears b1 of MB_CTRL_Dyn “HOST_PUT_MSG”, and allows RF to put a
new message.
The Option_flag is not supported. The Inventory_flag must be set to 0.

Table 203. Read Message request format

Request Read IC Mfg Number of Request

Request_flags UID (1) MBpointer CRC16
SOF Message code Bytes EOF

- 8 bits ACh 02h 64 bits 8 bits 8 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flag
• UID (Optional)

DS10925 - Rev 11 page 119/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

• Pointer (start at 00h)

• Number of bytes is one less then the requested data

Table 204. Read Message response format when Error_flag is NOT set

Response SOF Response_flags Mailbox content CRC16 Response EOF

- 8 bits (Number of bytes + 1) bytes (1) 16 bits -

1. Number of message Bytes when Number of Bytes is set to 00h.

Response parameters:
• (number of data + 1 ) data bytes
Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given

Figure 62. Read Message frame exchange between VCD and ST25DVxxx

Read Message
VCD SOF EOF
request

Read Message
ST25DVxxx t1 SOF EOF
response

7.6.34 Fast Read Message

On receiving the Fast Read Message command, the ST25DVxxx reads up to 256 byte in the Mailbox from the
location specified by MBpointer and sends back their value in the response. First MailBox location is '00’. When
Number of bytes is set to 00h and MBPointer is equals to 00h, the MB_LEN bytes of the full message are
returned. Otherwise, Fast Read Message command returns (Number of Bytes + 1) bytes (i.e. 01h returns 2 bytes,
FFh returns 256 bytes).
An error is reported if (Pointer + Nb of bytes + 1) is greater than the message length..
RF Reading of the last byte of mailbox message automatically clears b1 of MB_CTRL_Dyn “HOST_PUT_MSG”
and allows RF to put a new message.
The data rate of the response is multiplied by 2 compated to Read Message.
The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code. The Option_flag is
not supported, and the Inventory_flag must be set to 0.

Table 205. Fast Read Message request format

Request Fast Read IC Mfg Number of Request

Request_flags UID(1) MBpointer CRC16
SOF Message code Bytes EOF

- 8 bits CCh 02h 64 bits 8 bits 8 bits 16 bits -

1. This field is optional

Request parameters:
• Request flag
• UID (Optional)

DS10925 - Rev 11 page 120/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

• Pointer (start at 00h)

• Number of bytes is one less than the requested data

Table 206. Fast Read Message response format when Error_flag is NOT set

Response SOF Response_flags Mailbox content CRC16 Response EOF

- 8 bits (Number of bytes + 1) bytes(1) 16 bits 64 bits

1. Number of message Bytes when Number of Bytes is set to 00h

Response parameters:
• (number of bytes + 1) data bytes
Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given

Figure 63. Fast Read Message frame exchange between VCD and ST25DVxxx

Fast Read
VCD SOF EOF
Message request

Fast Read
ST25DVxxx t1 SOF EOF
Message response

7.6.35 Write Password

On receiving the Write Password command, the ST25DVxxx uses the data contained in the request to write
the password and reports whether the operation was successful in the response. It is possible to modify a
Password value only after issuing a valid Present password command (of the same password number). When
the Option_flag is set, wait for EOF to respond. Refer to Section 5.6 Data Protection for details on password
Management. The Inventory_flag must be set to 0.
During the RF write cycle time, Wt, there must be no modulation at all (neither 100% nor 10%), otherwise the
ST25DVxxx may not correctly program the data into the memory.
The Wt time is equal to t1nom + N × 302 µs (N is an integer). After a successful write, the new value of the
selected password is automatically activated. It is not required to present the new password value until the
ST25DVxxx power-down.
Caution: If ST25DVxxx is powered through VCC, removing VCC during Write Password command can abort the
command. As a consequence, before writing a new password, RF user should check if VCC is ON, by reading
EH_CTRL_Dyn register bit 3 (VCC_ON), and eventually ask host to maintain or to shut down VCC, during the
Write Password command in order to avoid password corruption.
To make the application more robust, it is recommended to use addressed or selected mode during write
password operations to get the traceability of which tags/UID have been programmed

Table 207. Write Password request format

Request Write Password Request

Request_flags IC Mfg code UID (1) Data CRC16
SOF password number EOF

- 8 bits B1h 02h 64 bits 8 bits 64 bits 16 bits -

DS10925 - Rev 11 page 121/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

1. This field is optional.

Request parameter:
• Request flags
• UID (optional)
• Password number:
– 00h = RF configuration password RF_PWD_0,
– 01h = RF_PWD_1,
– 02h = RF_PWD_2,
– 03h = RF_PWD_3,
– other = Error
• Data

Table 208. Write Password response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• no parameter.

Table 209. Write Password response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 10h: the password number is incorrect
– 12h: update right not granted, Present Password command not previously executed successfully
– 13h: the specified block was not successfully programmed

Figure 64. Write Password frame exchange between VCD and ST25DVxxx

Write
VCD SOF Password EOF
request

Write
Write sequence
ST25DVxxx t1 SOF Password EOF
when error
response

Write
ST25DVxxx Wt SOF Password EOF
response

DS10925 - Rev 11 page 122/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.36 Present Password

On receiving the Present Password command, the ST25DVxxx compares the requested password with the
data contained in the request and reports if the operation has been successful in the response. Refer to
Section 5.6 Data Protection for details on password Management. After a successful command, the security
session associate to the password is open as described in Section 5.6 Data Protection.
The Option_flag is not supported, and the Inventory_flag must be set to 0.

Table 210. Present Password request format

Request Present IC Mfg Password Request

Request_flags UID (1) Password CRC16
SOF Password code number EOF

- 8 bits B3h 02h 64 bits 8 bits 64 bits 16 bits -

1. This field is optional.

Request parameter:
• Request flags
• UID (optional)
• Password Number:
– 00h = RF configuration password RF_PWD_0
– 01h = RF_PWD_1
– 02h = RF_PWD_2
– 03h = RF_PWD_3
– other = Error
• Password

Table 211. Present Password response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameter:
• No parameter. The response is sent back after the write cycle.

Table 212. Present Password response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: the present password is incorrect
– 10h: the password number is incorrect

DS10925 - Rev 11 page 123/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 65. Present Password frame exchange between VCD and ST25DVxxx

Present
VCD SOF Password EOF
request

Present
ST25DVxxx t1 SOF Password EOF
response

7.6.37 Fast Read Single Block

On receiving the Fast Read Single Block command, the ST25DVxxx reads the requested block and sends back
its 32-bit value in the response. When the Option_flag is set, the response includes the Block Security Status. The
data rate of the response is multiplied by 2.
The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.
The Inventory_flag must be set to 0.
Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.

Table 213. Fast Read Single Block request format

Request SOF Request_flags Fast Read Single Block IC Mfg code UID (1) Block number CRC16 Request EOF

- 8 bits C0h 02h 64 bits 8 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flags
• UID (optional)
• Block number

Table 214. Fast Read Single Block response format when Error_flag is NOT set

Response SOF Response_flags Block security status (1) Data CRC16 Response EOF

- 8 bits 8 bits 32 bits 16 bits -

1. This field is optional.

Response parameters:
• Block security status if Option_flag is set (see Table 215. Block security status)
• Four bytes of block data

Table 215. Block security status

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use 0: Current Block not locked

All at 0 1: Current Block locked

DS10925 - Rev 11 page 124/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 216. Fast Read Single Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given
– 10h: the specified block is not available
– 15h: the specified block is read-protected

Figure 66. Fast Read Single Block frame exchange between VCD and ST25DVxxx

Fast Read
VCD SOF Single Block EOF
request

Fast Read
ST25DVxxx t1 SOF Single Block EOF
response

7.6.38 Fast Extended Read Single Block

On receiving the Fast Extended Read Single Block command, the ST25DVxxx reads the requested block and
sends back its 32-bit value in the response. When the Option_flag is set, the response includes the Block Security
Status. The data rate of the response is multiplied by 2.
The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.
The Inventory_flag must be set to 0.
Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and ST25DV64K-xx can be addressed
using this command

Table 217. Fast Extended Read Single Block request format

Fast
Request Extended Block Request
Request_flags IC Mfg code UID (1) CRC16
SOF Read Single number EOF
Block

- 8 bits C4h 02h 64 bits 16 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flags
• UID (optional)
• Block number (from LSB byte to MSB byte)

Table 218. Fast Extended Read Single Block response format when Error_flag is NOT set

Response SOF Response_flags Block security status (1) Data CRC16 Response EOF

- 8 bits 8 bits 32 bits 16 bits -

DS10925 - Rev 11 page 125/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

1. This field is optional.

Response parameters:
• Block security status if Option_flag is set (see Table 219. Block security status)
• Four bytes of block data

Table 219. Block security status

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use 0: Current Block not locked

All at 0 1: Current Block locked

Table 220. Fast Extended Read Single Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given
– 10h: the specified block is not available
– 15h: the specified block is read-protected

Figure 67. Fast Extended Read Single Block frame exchange between VCD and ST25DVxxx

Fast Extended
VCD SOF Read Single Block EOF
request

Fast Extended
ST25DVxxx t1 SOF Read Single Block EOF
response

7.6.39 Fast Read Multiple Blocks

On receiving the Fast Read Multiple Blocks command, the ST25DVxxx reads the selected blocks and sends back
their value in multiples of 32 bits in the response. The blocks are numbered from 00h up to the last block of user
memory in the request, and the value is minus one (–1) in the field. For example, if the “Number of blocks” field
contains the value 06h, seven blocks are read. The maximum number of blocks is fixed to 256 assuming that they
are all located in the same area. If the number of blocks overlaps area or overlaps the end of user memory, the
ST25DVxxx returns an error code.
When the Option_flag is set, the response includes the Block Security Status. The data rate of the response is
multiplied by 2.
The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.
The Inventory_flag must be set to 0.
Block number is coded on 1 Byte and only first 256 blocks of ST25DV16K-xx and ST25DV64K-xx can be
addressed using this command.

DS10925 - Rev 11 page 126/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 221. Fast Read Multiple Block request format

Request Fast Read IC Mfg First block Number of Request

Request_flags UID (1) CRC16
SOF Multiple Block code number blocks EOF

- 8 bits C3h 02h 64 bits 8 bits 8 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flag
• UID (Optional)
• First block number
• Number of blocks

Table 222. Fast Read Multiple Block response format when Error_flag is NOT set

Response SOF Response_flags Block security status (1) Data CRC16 Response EOF

- 8 bits 8 bits (2) 32 bits(2) 16 bits -

1. This field is optional.

2. Repeated as needed.

Response parameters:
• Block security status if Option_flag is set (see Table 223. Block security status if Option_flag is set)
• N block of data

Table 223. Block security status if Option_flag is set

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future use 0: Current not locked

All at 0 1: Current locked

Table 224. Fast Read Multiple Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 0Fh: error with no information given
– 03h: the option is not supported
– 10h: block address not available
– 15h: block read-protected

DS10925 - Rev 11 page 127/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Figure 68. Fast Read Multiple Block frame exchange between VCD and ST25DVxxx

Fast Read
VCD SOF Multiple block EOF
request

Fast Read
ST25DVxxx t1 SOF Multiple block EOF
response

DS10925 - Rev 11 page 128/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

7.6.40 Fast Extended Read Multiple Block

On receiving the Fast Extended Read Multiple Block command, the ST25DVxxx reads the selected blocks and
sends back their value in multiples of 32 bits in the response. The blocks are numbered from 00h to up to the last
block of memory in the request and the value is minus one (–1) in the field. For example, if the “Number of blocks”
field contains the value 06h, seven blocks are read. The maximum number of blocks is fixed to 2047 assuming
that they are all located in the same area. If the number of blocks overlaps several areas or overlaps the end of
user memory, the ST25DVxxx returns an error code.
When the Option_flag is set, the response includes the Block Security Status. The data rate of the response is
multiplied by 2.
The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.
The Inventory_flag must be set to 0.
Block number is coded on 2 Bytes so all memory blocks of ST25DV16K-xx and
ST25DV64K-xx can be addressed using this command.

Table 225. Fast Extended Read Multiple Block request format

Fast Extended
Request IC Mfg First block Block Request
Request_flags Read Multiple UID (1) CRC16
SOF code number Number EOF
Block

- 8 bits C5h 02h 64 bits 16 bits 16 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flag
• UID (Optional)
• First block number (from LSB byte to MSB byte)
• Number of blocks (from LSB byte to MSB byte)

Table 226. Fast Extended Read Multiple Block response format when Error_flag is NOT set

Response SOF Response_flags Block security status (1) Data CRC16 Response EOF

- 8 bits 8 bits (2) 32 bits(2) 16 bits -

1. This field is optional.

2. Repeated as needed.

Response parameters:
• Block security status if Option_flag is set (see Table 223. Block security status if Option_flag is set)
• N block of data

Table 227. Block security status if Option_flag is set

b7 b6 b5 b4 b3 b2 b1 b0

Reserved for future 0: Current not locked

use All at 0 1: Current locked

Table 228. Fast Read Multiple Block response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

DS10925 - Rev 11 page 129/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: the option is not supported
– 0Fh: error with no information given
– 10h: block address not available
– 15h: block read-protected

Figure 69. Fast Extended Read Multiple Block frame exchange between VCD and ST25DVxxx

Fast Extended
VCD SOF Read Multiple EOF
Block request

Fast Extended
ST25DVxxx t1 SOF Read Multiple EOF
Block response

7.6.41 Fast Write Message

On receiving the Fast Write Message command, the ST25DVxxx puts the data contained in the request into the
mailbox buffer, updates the Message Length register MB_LEN_Dyn, and set Mailbox loaded bit RF_PUT_MSG.
It then reports if the write operation was successful in the response. The ST25DVxxx mailbox contains up to 256
data bytes which are filled from the first location '00'. MSGlength parameter of the command is the number of
Data bytes minus - 1 (00 for 1 byte of data, FFh for 256 bytes of data). Fast Write Message can be executed
only when Mailbox is accessible by RF (previous RF message was read or time-out occurs, no I2C message to be
read). User can check it by reading b1 of MB_CTRL_Dyn “HOST_PUT_MSG”, which must be reset to “0”. (refer
to Section 5.1 Fast transfer mode (FTM)).
• The data rate of the response is multiplied by 2 compared to Write Message command.
• The Option_flag is not supported.
• The Inventory_flag must be set to 0.
• The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.

Table 229. Fast Write Message request format

Request Fast Write IC Mfg Request

Request_flags UID (1) MSGLength Message Data CRC16
SOF Message code EOF

(MsgLenght + 1)
- 8 bits CAh 02h 64 bits 1 byte 16 bits -
bytes

1. This field is optional.

Request parameters:
• Request flag
• UID (optional)
• Message Lenght
• Message Data

Table 230. Fast Write Message response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

DS10925 - Rev 11 page 130/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Response parameters:
• No parameter. The response is sent back after the write cycle.

Table 231. Fast Write Message response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given

Figure 70. Fast Write Message frame exchange between VCD and ST25DVxxx

Fast Write
VCD SOF Message EOF
request

Fast Write
Write sequence
ST25DVxxx t1 SOF Message EOF
when error
response

Fast Write
Write sequence
ST25DVxxx t1 SOF Message EOF
when no error
response

7.6.42 Fast Read Message Length

On receiving the Fast Read Message Length command, the ST25DV reads the MB_LEN_dyn register which
contains the mailbox message length and sends back its 8-bit value in the response.
The value of MB_LEN_Dyn returned is the (size of the message length in Bytes - 1).
The Option_flag is not supported. The Inventory_flag must be set to 0.
The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.
The data rate of the response is multiplied by 2 compared to Read Message Length command.

Table 232. Fast Read Message Length request format

Request SOF Request_flags Fast Read Message Length IC Mfg code UID (1) CRC16 Request EOF

- 8 bits CBh 02h 64 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flag
• UID (optional)

DS10925 - Rev 11 page 131/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 233. Fast Read Message Length response format when Error_flag is NOT set

Response SOF Response_flags Data CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameters:
• One byte of data: volatile Control register.

Table 234. Fast Read Message Length response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command option not recognized
– 03h: command not supported
– 0Fh: error with no information given

Figure 71. Fast Read Message Length frame exchange between VCD and ST25DVxxx

Fast Read
VCD SOF Message Length EOF
request

Fast Read
ST25DVxxx t1 SOF Message Length EOF
response

7.6.43 Fast Read Dynamic configuration

On receiving the Fast Read Dynamic configuration command, the ST25DVxxx reads the Dynamic register
address by the pointer and sends back its 8-bit value in the response.
The Option_flag is not supported. The Inventory_flag must be set to 0.
The subcarrier_flag should be set to 0, otherwise the ST25DVxxx answers with an error code.
The data rate of the response is multiplied by 2 compared to Read Dynamic configuration command.

Table 235. Fast Read Dynamic configuration request format

Fast Read Dynamic

Request SOF Request_flags IC Mfg code UID (1) Pointer address CRC16 Request EOF
configuration

- 8 bits CDh 02h 64 bits 8 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flag
• UID (optional)

DS10925 - Rev 11 page 132/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 236. Fast Read Dynamic configuration response format when Error_flag is NOT set

Response SOF Response_flags Data CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameters:
• One byte of data

Table 237. Fast Read Dynamic configuration response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given
– 10h: block not available

Figure 72. Fast Read Dynamic configuration frame exchange between VCD and ST25DVxxx

Fast Read
VCD SOF Dynamic configuration EOF
request

Fast Read
ST25DVxxx t1 SOF Dynamic configuration EOF
request

7.6.44 Fast Write Dynamic Configuration

On receiving the Fast Write Dynamic Configuration command, the ST25DV updates the Dynamic register
addressed by the pointer.
The Option_flag is not supported. The Inventory_flag must be set to 0.
The data rate of the response is multiplied by 2 compared to Write Dynamic Configuration command.

Table 238. Fast Write Dynamic Configuration request format

Fast Write
Request IC Mfg Pointer Register Request
Request_flags Dynamic UID (1) CRC16
SOF code address Value EOF
Configuration

- 8 bits CEh 02h 64 bits 8 bits 8 bits 16 bits -

1. This field is optional.

Request parameters:
• Request flag
• UID (optional)
• Pointer address
• Register value

DS10925 - Rev 11 page 133/197

 ST25DV04K ST25DV16K ST25DV64K
RF commands

Table 239. Fast Write Dynamic Configuration response format when Error_flag is NOT set

Response SOF Response_flags CRC16 Response EOF

- 8 bits 16 bits -

Response parameters:
• No parameter. The response is sent back after t1.

Table 240. Fast Write Dynamic Configuration response format when Error_flag is set

Response SOF Response_flags Error code CRC16 Response EOF

- 8 bits 8 bits 16 bits -

Response parameter:
• Error code as Error_flag is set:
– 02h: command not recognized
– 03h: command option not supported
– 0Fh: error with no information given
– 10h: block not available

Figure 73. Fast Write Dynamic Configuration frame exchange between VCD and ST25DVxxx

Fast Write
VCD SOF Dynamic configuration EOF
request

Fast Write
Write sequence
ST25DVxxx t1 SOF Dynamic configuration EOF
request when error

Fast Write Write sequence

ST25DVxxx t1 SOF Dynamic configuration EOF
request
when no error

DS10925 - Rev 11 page 134/197

 ST25DV04K ST25DV16K ST25DV64K
Unique identifier (UID)

8 Unique identifier (UID)

The ST25DVxxx is uniquely identified by a 64-bit unique identifier (UID). This UID complies with ISO/IEC 15963
and ISO/IEC 7816-6. The UID is a read-only code and comprises:
• eight MSBs with a value of E0h,
• the IC manufacturer code “ST 02h” on 8 bits (ISO/IEC 7816-6/AM1),
• a unique serial number on 48 bits.

Table 241. UID format

MSB LSB

63 56 55 48 47 40 39 0

0xE0 0x02 ST product code (1) Unique serial number

1. See Table 85. UID for ST product code value definition.

With the UID, each ST25DVxxx can be addressed uniquely and individually during the anticollision loop and for
one-to-one exchanges between a VCD and an ST25DVxxx.

DS10925 - Rev 11 page 135/197

 ST25DV04K ST25DV16K ST25DV64K
Device parameters

9 Device parameters

9.1 Maximum ratings

Stressing the device above the ratings listed in Table 242 may cause permanent damage to the device. These
are stress ratings only, and operation of the device, at these or any other conditions above those indicated in
the operating sections of this specification, is not implied. Exposure to absolute maximum rating conditions for
extended periods may affect the device reliability. Device mission profile (application conditions) is compliant with
JEDEC JESD47 qualification standard. Extended mission profiles can be assessed on demand.
Refer also to the STMicroelectronics SURE program and other relevant quality documents.

Table 242. Absolute maximum ratings

Symbol Parameter Min. Max. Unit

RF and
Range 6 All packages -40 85
I2C interfaces
RF and
TA Ambient operating temperature UFDFPN8, UFDFPN12 -40 105 °C
I2C interfaces
Range 8
RF interface -40 105
SO8N, TSSOP
I2C interface -40 125

Sawn wafer on UV tape, kept in its original packing form 15 25

TSTG Storage temperature °C
UFDFPN8 (MLP8),SO8N, TSSOP8, UFDFPN12, WLCSP10 -65 150
tSTG Retain Sawn wafer on UV tape, kept in its original packing form - 9 (1) months

TLEAD Lead temperature during soldering See note (2) °C

VIO I2C input or output range - 0.50 6.5

VDCG Supply GPO CMOS driver - 0.50 6.5 V

VCC I2C supply voltage - 0.50 6.5

IOL_MAX_SDA DC output current on pin SDA (when = equal to 0) - 5

mA
IOL_MAX_GPO_OD DC output current on pin GPO open drain (when equal to 0) - 1.5

VMAX_1 (3) RF input voltage amplitude peak to peak between AC0 and AC1, VSS pin left floating VAC0 - VAC1 - 11

VAC0 - VSS,
VMAX_2 (3) AC voltage between AC0 and VSS, or AC1 and VSS - 0.50 5.5 V
or VAC1 - VSS

VESD Electrostatic discharge voltage (human body model) (4) All pins - 2000

1. Counted from ST production date.

2. Compliant with JEDEC Std J-STD-020C (for small body, Sn-Pb or Pb assembly), the ST ECOPACK® 7191395 specification, and the
European directive on Restrictions on Hazardous Substances (RoHS) 2002/95/EU.
3. Evaluated by characterization, not tested in production.
4. AEC-Q100-002 (compliant with JEDEC Std JESD22-A114, C1 = 100 pF, R1 = 1500 Ω, R2 = 500 Ω)

DS10925 - Rev 11 page 136/197

 ST25DV04K ST25DV16K ST25DV64K
I2C parameters

9.2 I2C parameters

This section summarizes the operating and measurement conditions, and the DC and AC characteristics of
the device in I2C mode. The parameters are derived from tests performed under the measurement conditions
summarized in the relevant tables. Check that the operating conditions in the circuit match the measurement
conditions when relying on the quoted parameters.

Table 243. I2C operating conditions

Symbol Parameter Min. Max. Unit

VCC Supply voltage 1.8 5.5 V

Range 6 All packages -40 85

TA Ambient operating temperature UFDFPN8, UFDFPN12 -40 105 °C
Range 8
SO8N, TSSOP8 -40 125

Table 244. AC test measurement conditions

Symbol Parameter Min. Max. Unit

CL Load capacitance 100 pF

tr, tf Input rise and fall times - 50 ns

Vhi-lo Input levels 0.2 VCC to 0.8 VCC

V
Vref(t) Input and output timing reference levels 0.3 VCC to 0.7 VCC

Figure 74. AC test measurement I/O waveform

Input and Output

Input Levels
Timing Reference Levels

0.8VCC
0.7VCC

0.3VCC
0.2VCC

Table 245. Input parameters

Symbol Parameter Min. Max. Unit

CIN Input capacitance (SDA) - 8

pF
CIN Input capacitance (other pins) - 6

tNS (1) Pulse width ignored (input filter on SCL and SDA) - 80 ns

1. Evaluated by characterization, not tested in production.

Table 246. I2C DC characteristics (up to 85 °C)

Symbol Parameter Test conditions Min. Typ. Max. Unit

Input leakage current (SCL, VIN = VSS or VCC

ILI - 0.03 ± 0.1
SDA) device in Standby mode
μA
VIN = VSS
ILI Input leakage current (LPD) - 0.1 ± 0.5
device in Standby mode

DS10925 - Rev 11 page 137/197

 ST25DV04K ST25DV16K ST25DV64K
I2C parameters

Symbol Parameter Test conditions Min. Typ. Max. Unit

Operating leakage current SDA in Hi-Z, external voltage applied on

ILO - 0.03 ± 0.1 μA
(SDA) SDA: VSS or VCC

VCC = 1.8 V - 116 160

Operating supply current fC = 1 MHz
ICC_E2 (device select E2 address) VCC = 3.3 V - 220 240 μA
Read(1) (rise/fall time < 50 ns)
VCC = 5.5 V - 510 550

VCC = 1.8 V - 116 160

Operating supply current fC = 1 MHz
ICC_MB (device select MB address) VCC = 3.3 V - 220 240 μA
Read(1) (rise/fall time < 50 ns)
VCC = 5.5 V - 510 550

VCC = 1.8 V - 110 300

Operating supply current fC = 1 MHz
ICC0 (device select E2 address) VCC = 3.3 V - 110 330 μA
Write(1) (rise/fall time < 50 ns)
VCC = 5.5 V - 130 430

VCC = 1.8 V - 170 200

Operating supply current fC = 1 MHz
ICC0_MB (device select MB address) VCC = 3.3 V - 280 300 μA
Write(1) (rise/fall time < 50 ns)
VCC = 5.5 V - 520 600

VCC = 1.8 V - 0.84 1.5

ICC1
Low power down supply current VCC = 3.3 V - 1.3 2.0 μA
(LPD = 1)
VCC = 5.5 V - 1.7 3.0

VCC = 1.8 V - 72 100

ICC1_PON Static standby supply current
after power ON, or device select VCC = 3.3 V - 76 100 μA
(LPD = 0) stop, or time out
VCC = 5.5 V - 87 120

VCC = 1.8 V - 0.25 VCC

VIL Input low voltage (SDA, SCL) VCC = 3.3 V -0.45 - 0.30 VCC V

VCC = 5.5 V - 0.30 VCC

VIL_LPD Input low voltage (LPD) VCC = 3.3 V -0.45 - 0.20 VCC V

VCC = 1.8 V -

VIH Input high voltage (SDA, SCL) VCC = 3.3 V 0.75 VCC - VCC + 1 V

VCC = 5.5 V -

VCC = 1.8 V -

VIH Input high voltage (LPD) VCC = 3.3 V 0.85 VCC - VCC + 1 V

VCC = 5.5 V -

VCC = 1.8 V, IOL = 1.0 mA - 50

VOL_SDA Ouput low voltage SDA (1 MHz) VCC = 3.3 V, IOL = 2.1 mA - 75 400 mV

VCC = 5.5 V, IOL = 3.0 mA - 90

VCC_Power_up Device select acknowledge fC = 100 kHz(2) - 1.48 1.7 V

1. SCL, SDA connected to ground or VCC. SDA connected to VCC through a pull-up resistor.
2. Evaluated by characterization, not tested in production.

DS10925 - Rev 11 page 138/197

 ST25DV04K ST25DV16K ST25DV64K
I2C parameters

Table 247. I2C DC characteristics (up to 125 °C)

Symbol Parameter Test conditions Min. Typ. Max. Unit

Input leakage current (SCL, VIN = VSS or VCC

ILI - 0.03 ± 0.1
SDA) device in Standby mode
VIN = VSS
ILI Input leakage current (LPD) - 0.1 ± 0.5 μA
device in Standby mode

Operating leakage current SDA in Hi-Z, external voltage applied on

ILO - 0.03 ± 0.1
(SDA) SDA: VSS or VCC

VCC = 1.8 V - 126 180

Operating supply current fC = 1 MHz
ICC_E2 (device select E2 address) VCC = 3.3 V - 230 260 μA
Read(1) (rise/fall time < 50 ns)
VCC = 5.5 V - 510 550

VCC = 1.8 V - 126 180

Operating supply current fC = 1 MHz
ICC_MB (device select MB address) VCC = 3.3 V - 230 260 μA
Read(1) (rise/fall time < 50 ns)
VCC = 5.5 V - 510 550

VCC = 1.8 V - 120 310

Operating supply current fC = 1 MHz
ICC0 (device select E2 address) VCC = 3.3 V - 120 350 μA
Write(1) (rise/fall time < 50 ns)
VCC = 5.5 V - 140 450

VCC = 1.8 V - 180 220

Operating supply current fC = 1 MHz
ICC0_MB (device select MB address) VCC = 3.3 V - 290 320 μA
Write(1) (rise/fall time < 50 ns)
VCC = 5.5 V - 520 600

VCC = 1.8 V - 2.5 5

ICC1
Low power down supply current VCC = 3.3 V - 3.0 6 μA
(LPD = 1)
VCC = 5.5 V - 4.0 7

VCC = 1.8 V - 78 110

ICC1_PON Static standby supply current
after power ON, or device select VCC = 3.3 V - 82 110 V
(LPD = 0) stop, or time out
VCC = 5.5 V - 95 130

VCC = 1.8 V - 0.25 VCC

VIL Input low voltage ((SDA, SCL) VCC = 3.3 V -0.45 - 0.30 VCC V

VCC = 5.5 V - 0.30 VCC

VIL_LPD Input low voltage (LPD) VCC = 3.3 V -0.45 - 0.20 VCC V

VCC = 1.8 V -

VIH Input high voltage (SDA, SCL) VCC = 3.3 V 0.75 VCC - VCC + 1 V

VCC = 5.5 V -

VCC = 1.8 V -

VIH_LPD Input high voltage (LPD) VCC = 3.3 V 0.85 VCC - VCC + 1 V

VCC = 5.5 V -

VCC = 1.8 V, IOL = 1.0 mA - 50

VOL_SDA Ouput low voltage SDA (1 MHz) VCC = 3.3 V, IOL = 2.1 mA - 80 400 mV

VCC = 5.5 V, IOL = 3.0 mA - 100

VCC_Power_up Device select acknowledge fC = 100 kHz(2) - 1.48 1.7 V

DS10925 - Rev 11 page 139/197

 ST25DV04K ST25DV16K ST25DV64K
I2C parameters

1. SCL, SDA connected to ground or VCC. SDA connected to VCC through a pull-up resistor.
2. Evaluated by characterization, not tested in production.

Table 248. I2C AC characteristics (up to 85 °C)

Test conditions specified in Table 243

Symbol Alt. Parameter Min. Max. Unit

fC fSCL Clock frequency 0.05 1000 kHz

tCHCL tHIGH Clock pulse width high(1) 0.26 25000 (2)

µs
tCLCH tLOW Clock pulse width low(1) 0.5 25000 (3)

tSTART_OUT - I²C timeout on Start condition(1) 35 - ms

tXH1XH2 tR Input signal rise time(1) (4) (4)

tXL1XL2 tF Input signal fall time(1) (4) (4)

tDL1DL2 tF SDA (out) fall time(1) 20 120

tDXCX tSU:DAT Data in set up time(1) 0 -

ns
tCLDX tHD:DAT Data in hold time 0 -

tCLQX(5) tDH Data out hold time 100 -

tCLQV(6) tAA Clock low to next data valid (access time) - 450

tCHDX (7) tSU:STA Start condition set up time 250 -

tDLCL tHD:STA Start condition hold time 0.25 35000 (8) µs

tCHDH tSU:STO Stop condition set up time 250 -

ns
tDHDL tBUF Time between Stop condition and next Start condition 500 -

tW - I²C write time(9) - 5

tbootDC - RF OFF and LPD = 0(1) - 0.6 ms

tbootLPD - RF OFF(1) - 0.6

1. Evaluated by characterization, not tested in production.

2. tCHCL timeout.
3. tCLCH timeout.
4. There are no min. or max. values for the input signal rise and fall times. The I2C specification recommends that they are less than 120 ns
when fC < 1 MHz.
5. To avoid spurious Start and Stop conditions, a minimum delay is put between SCL=1 and the falling or rising edge of SDA.
6. tCLQV is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8 VCC in a compatible way with the I2C specification
(tSU:DAT (min) = 100 ns), assuming that the Rbus × Cbus time constant is less than 150 ns (as specified in Figure 76).
7. For a restart condition, or following a write cycle.
8. tDLCL timeout.
9. I2C write time for 1, 2, 3, or 4 bytes in EEPROM (user memory and system configuration), provided they are all located in the same memory
page, that is, the most significant memory address bits (b16-b2) are the same.

Table 249. I2C AC characteristics (up to 125 °C)

Test conditions specified in Table 243

Symbol Alt. Parameter Min. Max. Unit

fC fSCL Clock frequency 0.05 1000 kHz

tCHCL tHIGH Clock pulse width high(1) 0.26 25000(2)

µs
tCLCH tLOW Clock pulse width low(1) 0.5 25000(3)

DS10925 - Rev 11 page 140/197

 ST25DV04K ST25DV16K ST25DV64K
I2C parameters

Test conditions specified in Table 243

Symbol Alt. Parameter Min. Max. Unit

tSTART_OUT - I²C timeout on Start condition(1) 35 - ms

tXH1XH2 tR Input signal rise time(1) (4) (4)

tXL1XL2 tF Input signal fall time(1) (4) (4)

tDL1DL2 tF SDA (out) fall time(1) 20 120

tDXCX tSU:DAT Data in set up time(1) 0 -

ns
tCLDX tHD:DAT Data in hold time(1) 0 -

tCLQX(5) tDH Data out hold time 100 -

tCLQV (6) tAA Clock low to next data valid (access time) - 450

tCHDX(7) tSU:STA Start condition set up time 250 -

tDLCL tHD:STA Start condition hold time 0.25 35000(8) µs

tCHDH tSU:STO Stop condition set up time 250 -

Time between Stop condition and next Start ns

tDHDL tBUF 500 -
condition
tW - I²C write time (9) - 5.5

tbootDC - RF OFF and LPD = 0(1) - 0.6 ms

tbootLPD - RF OFF(1) - 0.6

1. Evaluated by characterization, not tested in production.

2. tCHCL timeout.
3. tCLCH timeout.
4. There are no min. or max. values for the input signal rise and fall times. The I2C specification recommends that they are less than 120 ns
when fC < 1 MHz.
5. To avoid spurious Start and Stop conditions, a minimum delay is put between SCL = 1 and the falling or rising edge of SDA.
6. tCLQV is the time (from the falling edge of SCL) required by the SDA bus line to reach 0.8 VCC in a compatible way with the I2C specification
(tSU:DAT (min) = 100 ns), assuming that the Rbus × Cbus time constant is less than 150 ns (as specified in Figure 76 ).
7. For a restart condition, or following a write cycle.
8. tDLCL timeout.
9. I2C write time for 1, 2, 3, or 4 bytes in EEPROM (user memory and system configuration), provided they are all located in the same page,
that is, the most significant memory address bits (b16-b2) are the same.

DS10925 - Rev 11 page 141/197

 ST25DV04K ST25DV16K ST25DV64K
I2C parameters

Figure 75. I2C AC waveforms

tXH1XH2 tXL1XL2 tCHCL

tCLCH

SCL

tXL1XL2
tDLCL
SDA in

tCHDX tXH1XH2 tCLDX SDA tDXCX tCHDH tDHDL

SDA change
Start input Stop Start
condition condition condition

SCL

SDA in
tW
tCHDH tCHDX
Stop Write cycle Start
condition condition

tCHCL

SCL
tCLQV tCLQX tDL1DL2

DT56269
SDA out Data valid Data valid

Figure 76 shows how to calculate the value of the pull-up resistor. In applications where this method of
synchronization is not employed, the pull-up resistor is not necessary, provided that the bus master has a
push-pull (rather than open drain) output.

Figure 76. I2C Fast mode (fC = 1 MHz): maximum Rbus value versus bus parasitic capacitance (Cbus)

100 V CC
Bus line pull-up resistor (KW)

R bus
R
bu s × The Rbus x Cbus time constant
C
bu s = must be below 150 ns. SCL
10 150 n I²C bus ST25DV
s The time constant line is master
represented on the left.
SDA
4 Here,
C bus
R bu s × C = 120 ns
bu s

1
10 30 100
Bus line capacitor (pF)

DS10925 - Rev 11 page 142/197

 ST25DV04K ST25DV16K ST25DV64K
GPO characteristics

9.3 GPO characteristics

This section summarizes the operating and measurement conditions of the GPO feature. The parameters in the
DC and AC characteristic tables that follow are derived from tests performed under the measurement conditions
summarized in the relevant tables.

Table 250. GPO DC characteristics up to 85°C

Symbol Parameter Condition Min Typ Max Unit

VDCG = 1.8 V, IOL = 0.5 mA - - 0.4

Output low voltage
VOL_GPO_CMOS VDCG = 3.3 V, IOL = 0.5 mA - - 0.4 V
(GPO CMOS)
VDCG = 5.5 V, IOL = 0.5 mA - - 0.4

VDCG = 1.8 V, IOH = - 0.5 mA VDCG - 0.4 - -

Output high voltage
VOH_GPO_CMOS VDCG = 3.3 V, IOH = - 0.5 mA VDCG - 0.4 - - V
(GPO CMOS)
VDCG = 5.5 V, IOH = - 0.5 mA VDCG - 0.4 - -

IOL = 1 mA, VCC = 1.8 V - 0.28 0.4

Output low voltage
VOL_GPO_OD IOL = 1 mA, VCC = 3.3 V - 0.20 0.4 V
(GPO open drain)
IOL = 1 mA, VCC = 5.5 V - 0.20 0.4
GPO in Hi-Z, external
Output leakage
IL_GPO_OD voltage applied on: - 0.15 0.06 0.15 µA
(GPO open drain)
GPO, VSS or VCC

ILI_VDGC Input leakage (VDGC) VDGC = 5.5 V - - 0.1 µA

Table 251. GPO DC characteristics up to 125°C

Symbol Parameter Condition Min Typ Max Unit

VDCG = 1.8 V, IOL = 0.5 mA - - 0.4

Output low voltage
VOL_GPO_CMOS VDCG = 3.3 V, IOL = 0.5 mA - - 0.4 V
(GPO CMOS)
VDCG = 5.5 V, IOL = 0.5 mA - - 0.4

VDCG = 1.8 V, IOH = - 0.5 mA VDCG - 0.4 - -

Output high voltage
VOH_GPO_CMOS VDCG = 3.3 V, IOH = - 0.5 mA VDCG - 0.4 - - V
(GPO CMOS)
VDCG = 5.5 V, IOH = - 0.5 mA VDCG - 0.4 - -

IOL = 1 mA, VCC = 1.8 V - 0.28 0.4

Output low voltage
VOL_GPO_OD IOL = 1 mA, VCC = 3.3 V - 0.22 0.4 V
(GPO open drain)
IOL = 1 mA, VCC = 5.5 V - 0.21 0.4
Output leakage GPO in Hi-Z, external voltage applied on
IL_GPO_OD - 0.15 0.06 0.15 µA
(GPO open drain) GPO: VSS or VCC

ILI_VDGC Input leakage (VDGC) VDGC = 5.5 V - - 0.1 µA

Table 252. GPO AC characteristics

Symbol Parameter Condition Min Max Unit

tr_GPO_CMOS Output rise time CL = 30 pF, VDCG = 1.8 V to 5.5 V - 50

ns
tf_GPO_CMOS Output fall time CL = 30 pF, VDCG = 1.8 V to 5.5 V - 50

DS10925 - Rev 11 page 143/197

 ST25DV04K ST25DV16K ST25DV64K
RF electrical parameters

9.4 RF electrical parameters

This section summarizes the operating and measurement conditions, and the DC and AC characteristics of the
device in RF mode.
The parameters in the following tables are derived from tests performed under the measurement conditions
summarized in the relevant tables. Check that the operating conditions in the circuit match the measurement
conditions when relying on the quoted parameters.

Table 253. RF characteristics

Symbol Parameter Condition Min Typ Max Unit

fCC External RF signal frequency - 13.553 13.56 13.567 MHz

Range 6 TA = -40 °C to 85 °C
H_ISO Operating field according to ISO(1) 150 - 5000 mA/m
Range 8 TA = -40 °C to 105 °C

10% carrier modulation index

150 mA/m > H_ISO > 1000 mA/m 10 - 30
MICARRIER MI = (A - B) / (A + B) %
100% carrier modulation index(1) MI= (A - B) / (A + B) 95 - 100

Minimum time from carrier generation to

tMINCD From H-field min - - 1 ms
first data(1)
fSH Subcarrier frequency high(1) fCC/32 - 423.75 -
kHz
fSL Subcarrier frequency low(1) fCC/28 - 484.28 -

t1 Time for ST25DVxxx response(1) 4352/fC 318.6 320.9 323.3

t2 Time between commands(1) 4192/fC 309 311.5 314 µs

t3 Time between commands(1) 4384/fC 323.3 - -

RF user memory write time (including 1 block - 5.2 -

Wt_Block ms
internal Verify) (1)(2) 4 blocks - 19.7 -
RF system memory write time including
Wt_Byte 1 byte - 4.9 - ms
internal Verify)(1)(2)
RF mailbox write time (from VCD request
Wt_MB 256 bytes - 80.7 - ms
SOF to ST25DVxxx response EOF)(2)(3)
RF mailbox read time (from VCD request
tRead_MB 256 bytes - 81 - ms
SOF to ST25DVxxx response EOF) (2)(3)
CTUN Internal tuning capacitor(3) f = 13.56 MHz 26.5 28.5 30.5 pF

Backscattered level, as defined by ISO

VBACK - 10 - - mV
test(1)
RF input voltage amplitude between AC0 Inventory and Read operations - 4.8 -
VMIN_1 (1) and AC1, VSS pin left floating, VAC0 - VAC1 V
peak to peak(1) Write operations - 5.25 -

AC voltage between AC0 and VSS, or Inventory and Read operations - 2.25 -
VMIN_2 (1) V
between AC1 and VSS (1) Write operations - 2.7 -
tBootRF Without DC supply (no VCC) Set up time - 0.6 -
ms
tRF_OFF RF OFF time Chip reset 2 - -

1. Evaluated by characterization, not tested in production.

2. For VCD request coded in 1 out of 4 and ST25DVxxx response in high data rate, single sub carrier.
3. Evaluated by characterization at 25 °C. Tested in production at 25 °C, by correlating industrial tester measures with characterization data.

DS10925 - Rev 11 page 144/197

 ST25DV04K ST25DV16K ST25DV64K
RF electrical parameters

Note: TA= -40 to 105°C. Characterized only.

All timing characterization performed on a reference antenna witht the following characteristics:
• ISO antenna class 1
• Tuning frequency = 13.7 MHz.

Table 254. Operating conditions

Symbol Parameter Min. Max. Unit

Range 6 -40 85
TA Ambient operating temperature °C
Range 8 -40 105

Figure 77 shows an ASK modulated signal from the VCD to the ST25DVxxx. The test conditions for the AC/DC
parameters are:
• Close coupling condition with tester antenna (1 mm)
• ST25DVxxx performance measured at the tag antenna
• ST25DVxxx synchronous timing, transmit and receive

Figure 77. ASK modulated signal

A t RFF
B t RFR
f CC

t RFSBL

DT19784V1
t M IN CD

DS10925 - Rev 11 page 145/197

 ST25DV04K ST25DV16K ST25DV64K
Package information

10 Package information

In order to meet environmental requirements, ST offers these devices in different grades of ECOPACK packages,
depending on their level of environmental compliance. ECOPACK specifications, grade definitions and product
status are available at: www.st.com. ECOPACK is an ST trademark.

10.1 SO8N package information

This SO8N is an 8-lead, 4.9 x 6 mm, plastic small outline, 150 mils body width, package.

Figure 78. SO8N – Outline

h x 45˚

A2 A
c
b ccc
e

0.25 mm
D SEATING GAUGE PLANE
PLANE
C k
8

O7_SO8_ME_V2
E1 E
1 L
A1
L1

1. Drawing is not to scale.

DS10925 - Rev 11 page 146/197

 ST25DV04K ST25DV16K ST25DV64K
TSSOP8 package information

Table 255. SO8N – Mechanical data

millimeters inches (1)

Symbol
Min. Typ. Max. Min. Typ. Max.

A - - 1.750 - - 0.0689
A1 0.100 - 0.250 0.0039 - 0.0098
A2 1.250 - - 0.0492 - -
b 0.280 - 0.480 0.0110 - 0.0189
c 0.170 - 0.230 0.0067 - 0.0091

D(2) 4.800 4.900 5.000 0.1890 0.1929 0.1969

E 5.800 6.000 6.200 0.2283 0.2362 0.2441

E1(3) 3.800 3.900 4.000 0.1496 0.1535 0.1575

e - 1.270 - - 0.0500 -
h 0.250 - 0.500 0.0098 - 0.0197
k 0° - 8° 0° - 8°
L 0.400 - 1.270 0.0157 - 0.0500
L1 - 1.040 - - 0.0409 -
ccc - - 0.100 - - 0.0039

1. Values in inches are converted from mm and rounded to four decimal digits.
2. Dimension “D” does not include mold flash, protrusions or gate burrs. Mold flash, protrusions or gate burrs shall not exceed
0.15 mm per side
3. Dimension “E1” does not include interlead flash or protrusions. Interlead flash or protrusions shall not exceed 0.25 mm per
side.

Note: The package top may be smaller than the package bottom. Dimensions D and E1 are determinated at the
outermost extremes of the plastic body exclusive of mold flash, tie bar burrs, gate burrs and interleads flash,
but including any mismatch between the top and bottom of plastic body. Measurement side for mold flash,
protusions or gate burrs is bottom side.

Figure 79. SO8N - Footprint example

0.6 (x8)
3.9
6.7

O7_SO8N_FP_V2

1.27

1. Dimensions are expressed in millimeters.

10.2 TSSOP8 package information

This TSSOP is an 8-lead, 3 x 6.4 mm, 0.65 mm pitch, thin shrink small outline package.

DS10925 - Rev 11 page 147/197

 ST25DV04K ST25DV16K ST25DV64K
TSSOP8 package information

Figure 80. TSSOP8 – Outline

8 5

k
E1 E
A1 L

L1
1 4

6P_TSSOP8_ME_V3
A A2
c
b e

1. Drawing is not to scale.

Table 256. TSSOP8 – Mechanical data

millimeters inches (1)

Symbol
Min. Typ. Max. Min. Typ. Max.

A - - 1.200 - - 0.0472
A1 0.050 - 0.150 0.0020 - 0.0059
A2 0.800 1.000 1.050 0.0315 0.0394 0.0413
b 0.190 - 0.300 0.0075 - 0.0118
c 0.090 - 0.200 0.0035 - 0.0079

D(2) 2.900 3.000 3.100 0.1142 0.1181 0.1220

e - 0.650 - - 0.0256 -
E 6.200 6.400 6.600 0.2441 0.2520 0.2598

E1(3) 4.300 4.400 4.500 0.1693 0.1732 0.1772

L 0.450 0.600 0.750 0.0177 0.0236 0.0295

L1 - 1.000 - - 0.0394 -
k 0° - 8° 0° - 8°
aaa - - 0.100 - - 0.0039

1. Values in inches are converted from mm and rounded to four decimal digits.
2. Dimension “D” does not include mold flash, protrusions or gate burrs. Mold flash, protrusions or gate burrs shall not exceed
0.15 mm per side
3. Dimension “E1” does not include interlead flash or protrusions. Interlead flash or protrusions shall not exceed 0.25 mm per
side.

Note: The package top may be smaller than the package bottom. Dimensions D and E1 are determinated at the
outermost extremes of the plastic body exclusive of mold flash, tie bar burrs, gate burrs and interleads flash,
but including any mismatch between the top and bottom of plastic body. Measurement side for mold flash,
protusions or gate burrs is bottom side.

DS10925 - Rev 11 page 148/197

 ST25DV04K ST25DV16K ST25DV64K
TSSOP8 package information

Figure 81. TSSOP8 – Footprint example

1.55

0.40

0.65

2.35

6P_TSSOP8_FP_V2
5.80
7.35

1. Dimensions are expressed in millimeters.

DS10925 - Rev 11 page 149/197

 ST25DV04K ST25DV16K ST25DV64K
UFDFN8 package information

10.3 UFDFN8 package information

UFDFPN8 is an 8-lead, 2 × 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package.

Figure 82. UFDFN8 - Outline

D A B
N
A
ccc C
A1
Pin #1 C
ID marking
E eee C
Seating plane A3
Side view

1 2 2x aaa C
2x aaa C
Top view

D2 Datum A
e b
1 2
L1
L3 L L3

Pin #1
ID marking E2
e/2 L1
e Terminal tip
K
L Detail “A”
Even terminal
ND-1 x e
Bottom view See Detail “A”

1. Max. package warpage is 0.05 mm.

2. Exposed copper is not systematic and can appear partially or totally according to the cross section.
3. Drawing is not to scale.

DS10925 - Rev 11 page 150/197

 ST25DV04K ST25DV16K ST25DV64K
UFDFPN12 package information

Table 257. UFDFN8 - Mechanical data

millimeters inches (1)

Symbol
Min Typ Max Min Typ Max

A 0.450 0.550 0.600 0.0177 0.0217 0.0236

A1 0.000 0.020 0.050 0.0000 0.0008 0.0020

b(2) 0.200 0.250 0.300 0.0079 0.0098 0.0118

D 1.900 2.000 2.100 0.0748 0.0787 0.0827

D2 1.200 - 1.600 0.0472 - 0.0630
E 2.900 3.000 3.100 0.1142 0.1181 0.1220
E2 1.200 - 1.600 0.0472 - 0.0630
e - 0.500 - 0.0197
K 0.300 - - 0.0118 - -
L 0.300 - 0.500 0.0118 - 0.0197
L1 - - 0.150 - - 0.0059
L3 0.300 - - 0.0118 - -
aaa - - 0.150 - - 0.0059
bbb - - 0.100 - - 0.0039
ccc - - 0.100 - - 0.0039
ddd - - 0.050 - - 0.0020

eee (3) - - 0.080 - - 0.0031

1. Values in inches are converted from mm and rounded to 4 decimal digits.

2. Dimension b applies to plated terminal and is measured between 0.15 and 0.30 mm from the terminal tip.
3. Applied for exposed die paddle and terminals. Exclude embedding part of exposed die paddle from measuring.

10.4 UFDFPN12 package information

UFDFPN12 is an 12-lead, 3 x 3 mm, 0.5 mm pitch ultra thin profile fine pitch dual flat package.

DS10925 - Rev 11 page 151/197

 ST25DV04K ST25DV16K ST25DV64K
UFDFPN12 package information

Figure 83. UFDFPN12 - Outline

Pin #1 ID marking
E2
E e

D D2

k
L

TOP VIEW BOTTOM VIEW

SIDE VIEW

1. Drawing is not to scale.

Table 258. UFDFPN12 - Mechanical data

millimeters inches (1)

Symbol
Min Typ Max Min Typ Max

A(2) 0.45 0.55 0.60 0.0177 0.0217 0.0236

b 0.20 0.25 0.30 0.0079 0.0098 0.0118

D 2.95 3.00 3.10 0.1161 0.1181 0.1220
D2 1.35 1.40 1.45 0.0531 0.0551 0.0571
e 0.50 0.0197
E 2.95 3.00 3.10 0.1161 0.1181 0.1220
E2 2.50 2.55 2.60 0.0984 0.1004 0.1024
L 0.25 0.30 0.35 0.0098 0.0118 0.0138
k 0.40 0.0157

1. Values in inches are converted from mm and rounded to 4 decimal digits.

2. Package total thickness.

DS10925 - Rev 11 page 152/197

 ST25DV04K ST25DV16K ST25DV64K
WLCSP10 package information

10.5 WLCSP10 package information

Figure 84. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale package outline

bbb Z
I Orientation reference
DETAIL A D X Y
H
e J

e1 E

A F aaa
G (4X)
A3
A2
SIDE VIEW BOTTOM VIEW TOP VIEW

BUMP

eee Z
A1

DETAIL A
ROTATED 90
Z
b(10x)
SEATING PLANE
ccc M Z X Y
ddd M Z

1. Drawing is not to scale.

2. Dimension is measured at the maximum bump diameter parallel to primary datum Z.
3. Primary datum Z and seating plane are defined by the spherical crowns of the bump.
4. Bump position designation per JESD 95-1, SPP-010.

Table 259. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale mechanical data

millimeters inches (1)

Symbol
Min Typ Max Min Typ Max

A 0.265 0.295 0.325 0.0104 0.0116 0.0128

A1 - 0.095 - - 0.0037 -
A2 - 0.175 - - 0.0069 -
A3 - 0.025 - - 0.0010 -
b - 0.185 - - 0.0073 -
D - 1.649 1.669 - 0.0649 0.0657
E - 1.483 1.503 - 0.0584 0.0592
e - 0.400 - - 0.0157 -
e1 - 0.800 - - 0.0315 -
H - 0.346 - - 0.0136 -
I - 1.039 - - 0.0409 -
J - 0.200 - - 0.0079 -

DS10925 - Rev 11 page 153/197

 ST25DV04K ST25DV16K ST25DV64K
WLCSP10 package information

millimeters inches (1)

Symbol
Min Typ Max Min Typ Max

F - 0.314 - - 0.0124 -
G - 0.342 - - 0.0135 -
aaa - 0.110 - - 0.0043 -
bbb - 0.110 - - 0.0043 -
ccc - 0.110 - - 0.0043 -
ddd - 0.060 - - 0.0024 -
eee - 0.060 - - 0.0024 -

1. Values in inches are converted from mm and rounded to 4 decimal digits.

Figure 85. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale recommended footprint

Dpad

Dsm

Table 260. WLCSP10 recommended PCB design rules

Dimension Recommended values

Pitch 0.4 mm
Dpad 0,225 mm
Dsm 0.290 mm typ. (depends on soldermask registration tolerance)
Stencil opening 0.250 mm
Stencil thickness 0.100 mm

DS10925 - Rev 11 page 154/197

 ST25DV04K ST25DV16K ST25DV64K
Ordering information

11 Ordering information

Table 261. Ordering information scheme

Example: ST25DV 64K -JF R 6 D 3

Device type
ST25DV = Dynamic NFC/RFID tag based on ISO
15693 and NFC T5T

Memory size
04K = 4 Kbits
16K = 16 Kbits
64K = 64 Kbits
Device features

IE = I2C and GPO open drain, fast transfer mode and energy harvesting

JF = I2C and GPO CMOS, fast transfer mode, energy harvesting and low power mode

Operating voltage
R = VCC = 1.8 to 5.5 V

Device grade
6 = Industrial: device tested with standard test flow over the - 40 to 85 °C range
8 = Industrial: device tested with standard test flow over the -40 to 105 °C range (UFDFPN8 and UFDFPN12), or over
the -40 to 125 °C range (SO8N and TSSOP8 only, 105 °C for the RF interface)

Package
D = UFDFPN12
S = SO8N
T = TSSOP8
C = UFDFPN8 (only for 04K version)
U = 725 µm ± 20 µm unsawn wafer (only for 04K version)
L = WLCSP thin 10 balls (only for 04K version)

Capacitance
3 = 28.5 pF

Note: Parts marked as “ES” or “E” are not yet qualified and therefore not approved for use in production. ST is
not responsible for any consequences resulting from such use. In no event will ST be liable for the customer
using any of these engineering samples in production. ST’s Quality department must be contacted prior to any
decision to use these engineering samples to run a qualification activity.
For a list of available options (speed, package, etc.), or for further information on any aspect of this device,
contact your nearest ST sales office.

DS10925 - Rev 11 page 155/197

 ST25DV04K ST25DV16K ST25DV64K
Bit representation and coding for fast commands

Appendix A Bit representation and coding for fast commands

Data bits are encoded using Manchester coding, according to the following schemes. For the low data rate, same
subcarrier frequency or frequencies is/are used. In this case, the number of pulses is multiplied by 4 and all times
increase by this factor. For the Fast commands using one subcarrier, all pulse numbers and times are divided by
2.

A.1 Bit coding using one subcarrier

A.1.1 High data rate

For the fast commands, a logic 0 starts with four pulses at 423.75 kHz (fC/32) followed by an unmodulated time of
9.44 µs, as shown in Figure 86.

Figure 86. Logic 0, high data rate, fast commands

DT12066bV1
18.88 µs

For the Fast commands, a logic 1 starts with an unmodulated time of 9.44 µs followed by four pulses of 423.75
kHz (fC/32), as shown in Figure 87.

Figure 87. Logic 1, high data rate, fast commands

DT12067bV1
18.88 µs

A.1.2 Low data rate

For the Fast commands, a logic 0 starts with 16 pulses at 423.75 kHz (fC/32) followed by an unmodulated time of
37.76 µs, as shown in Figure 88.

Figure 88. Logic 0, low data rate, fast commands

DT12069bV1

75.52 µs

For the Fast commands, a logic 1 starts with an unmodulated time of 37.76 µs followed by 16 pulses at 423.75
kHz (fC/32), as shown in Figure 89.

DS10925 - Rev 11 page 156/197

 ST25DV04K ST25DV16K ST25DV64K
ST25DVxxx to VCD frames

Figure 89. Logic 1, low data rate, fast commands

DT12071bV1
75.52 µs

Note: For fast commands, bit coding using two subcarriers is not supported.

A.2 ST25DVxxx to VCD frames

Frames are delimited by an SOF and an EOF. They are implemented using code violation. Unused options are
reserved for future use. For the low data rate, the same subcarrier frequency or frequencies is/are used. In this
case, the number of pulses is multiplied by 4. For the Fast commands using one subcarrier, all pulse numbers
and times are divided by 2.

A.3 SOF when using one subcarrier

A.3.1 High data rate

For the Fast commands, the SOF comprises an unmodulated time of 28.32 µs, followed by 12 pulses at 423.75
kHz (fC/32), and a logic 1 that consists of an unmodulated time of 9.44 µs followed by four pulses at 423.75 kHz,
as shown in Figure 90.

Figure 90. Start of frame, high data rate, one subcarrier, fast commands

DT12079bV1
56.64 µs 18.88 µs

A.3.2 Low data rate

For the Fast commands, the SOF comprises an unmodulated time of 113.28 µs, followed by 48 pulses at 423.75
kHz (fC/32), and a logic 1 that includes an unmodulated time of 37.76 µs followed by 16 pulses at 423.75 kHz, as
shown in Figure 91.

Figure 91. Start of frame, low data rate, one subcarrier, fast commands
DT12081bV1

226.56 µs 75.52 µs

DS10925 - Rev 11 page 157/197

 ST25DV04K ST25DV16K ST25DV64K
EOF when using one subcarrier

A.4 EOF when using one subcarrier

A.4.1 High data rate

For the Fast commands, the EOF comprises a logic 0 that includes four pulses at 423.75 kHz and an
unmodulated time of 9.44 µs, followed by 12 pulses at 423.75 kHz (fC/32) and an unmodulated time of 37.76
µs, as shown in Figure 92.

Figure 92. End of frame, high data rate, one subcarrier, fast commands

DT12085bV1
18.88 µs 56.64 µs

A.4.2 Low data rate

For the Fast commands, the EOF comprises a logic 0 that includes 16 pulses at 423.75 kHz and an unmodulated
time of 37.76 µs, followed by 48 pulses at 423.75 kHz (fC/32) and an unmodulated time of 113.28 µs, as shown in
Figure 93.

Figure 93. End of frame, low data rate, one subcarrier, fast commands

DT12087bV1
75.52 µs 226.56 µs

Note: For SOF and EOF in fast commands, bit coding using two subcarriers is not supported.

DS10925 - Rev 11 page 158/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequences

Appendix B I²C sequences

B.1 Device select codes

Table 262. Device select usage

Device select value

Comment
Hexadecimal Binary

Device select generic

- 1010 E211 R/W E2 = 0b User memory, Dynamic registers, FTM mailbox
E2 = 1b System memory
A6h 1010 0110b User memory, Dynamic registers, FTM mailbox writing
A7h 1010 0111b User memory, Dynamic registers, FTM mailbox reading
AEh 1010 1110b System memory writing
AFh 1010 1111b System memory reading

B.2 I²C Byte writing and polling

B.2.1 I2C byte write in user memory

Table 263. Byte Write in user memory when write operation allowed

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
DATA - Send Data (1 Byte)
- ACK 9th bit
Stop - Start of Programming

DS10925 - Rev 11 page 159/197

 ST25DV04K ST25DV16K ST25DV64K
I²C Byte writing and polling

Table 264. Polling during programming after byte writing in user memory

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- NoACK 9th bit Device Busy
Start A6h - Device select for writing
- NoACK 9th bit Device Busy
... ... Device select for writing
... ... ... 9th bit Device Busy
Start A6h - Device select for writing
9th bit Device ready
- ACK
Programing completed
Stop - End of Polling

Table 265. Byte Write in user memory when write operation is not allowed

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
DATA - Send Data
- NoACK 9th bit: Write access not granted or FTM activated.
No Programming
Stop -
Device return in Standby

DS10925 - Rev 11 page 160/197

 ST25DV04K ST25DV16K ST25DV64K
I²C Byte writing and polling

B.2.2 I²C byte writing in dynamic registers and polling

Table 266. Byte Write in Dynamic Register (if not Read Only)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
Send Address LSB (1 Byte)
Dynamic Register ADDRESS_LSB - Dynamic register are located from address
2000h to 2007h , some are only readable
- ACK 9th bit
DATA - Send Data
- ACK 9th bit
Stop - Immediate update of Dynamic register

Table 267. Polling during programming after byte write in Dynamic Register

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

9th bit Device Busy
- ACK
Dynamic register updates is immediate
Stop - End of Polling

Table 268. Byte Write in Dynamic Register if Read Only

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
20h - Send Address MSB (1 Byte)
- NoACK 9th bit
Send Address LSB (1 Byte)
RO Dynamic Register ADDRESS_LSB - Addresses 2001h, 2004h, 2005h and 2007h are Read Only
registers.
- ACK 9th bit
DATA - Send Data
- NoACK 9th bit
No Programming
Stop -
Device return in Standby

DS10925 - Rev 11 page 161/197

 ST25DV04K ST25DV16K ST25DV64K
I²C Byte writing and polling

B.2.3 I2C byte write in mailbox and polling

Table 269. Byte Write in mailbox when mailbox is free from RF message and fast transfer mode is
activated

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
20h - Send mailbox address MSB (1 Byte)
- ACK 9th bit
Send Address LSB (1 Byte)
08h -
Write must be done at first address of mailbox
- ACK 9th bit
DATA - Send Data
- ACK 9th bit
Stop - Immediate update of mailbox

Table 270. Byte Write in mailbox when mailbox is not free from RF message fast transfer mode is not
activated

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
20h - Send mailbox address MSB (1 Byte)
- ACK 9th bit
Send Address LSB (1 Byte)
08h -
Write must be done at first address of mailbox
- ACK 9th bit
DATA - Send Data
9th bit Access
- NoACK
Mailbox busy or FTM not activated
No Programming
Stop -
Device return in Standby

DS10925 - Rev 11 page 162/197

 ST25DV04K ST25DV16K ST25DV64K
I²C Byte writing and polling

B.2.4 I2C byte write and polling in system memory

Table 271. Byte Write in System memory if I2C security session is open and register is not RO

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
DATA - Send Data
- ACK 9th bit
Stop - Start of Programming

Table 272. Polling during programing after byte write in System memory if I2C security session is open
and register is not RO

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- NoACK 9th bit Device Busy
Start AEh - Device select for writing
- NoACK 9th bit Device Busy
Start AEh - Device select for writing
- ... 9th bit
Start AEh - Device select for writing
9th bit Device ready
- ACK
Programing completed
Stop - end of Polling

DS10925 - Rev 11 page 163/197

 ST25DV04K ST25DV16K ST25DV64K
I2C sequential writing and polling

Table 273. Byte Write in System memory if I2C security session is closed or register is RO

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
DATA - Send Data
- NoACK 9th bit
No Programming
Stop -
Device return in Standby

B.3 I2C sequential writing and polling

B.3.1 I2C sequential write in user memory and polling

Table 274. Sequential write User memory when write operation allowed and all bytes belong to same area

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
DATA 0 - Send Data 0
- ACK 9th bit
DATA 1 - Send Data 1
- ACK 9th bit
... - ...
- ... ...
Send Data n
DATA n -
n ≤ 256
- ACK 9th bit
Stop - Start of Programming

DS10925 - Rev 11 page 164/197

 ST25DV04K ST25DV16K ST25DV64K
I2C sequential writing and polling

Table 275. Polling during programing after sequential write in User memory when write operation allowed
and all bytes belong to same area.

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- NoACK 9th bit Device Busy
Start A6h - Device select for writing
- NoACK 9th bit Device Busy
Start A6h - Device select for writing
- ... 9th bit Device Busy
Start A6h - Device select for writing
9th bit Device ready
- ACK
Programing completed
Stop - End of Polling

Table 276. Sequential write in User memory when write operation allowed and crossing over area border

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
DATA 0 - Send Data 0
- ACK 9th bit
DATA 1 - Send Data 1
- ACK 9th bit
... - ...
- ... ...
Send Data n
DATA n -
Address is located in next memory area
- NoACK 9th bit
No programming
Stop -
Device return in Standby

DS10925 - Rev 11 page 165/197

 ST25DV04K ST25DV16K ST25DV64K
I2C sequential writing and polling

Table 277. Polling during programming after sequential write in User memory when write operation
allowed and crossing over area border

Master drives SDA Slave drives SDA

Comment
Request/Response Frame

Start A6h - Device select for writing

9th bit Device ready
- ACK
No programming
Stop - End of Polling

B.3.2 I2C sequential write in mailbox and polling

Table 278. Sequential write in mailbox when mailbox is free from RF message and fast transfer mode is
activated

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send mailbox Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send mailbox Address LSB (1 Byte)
- ACK 9th bit
DATA 0 - Send Data 0
- ACK 9th bit
DATA 1 - Send Data 1
- ACK 9th bit
... - ...
- ... ...
Send Data n
DATA n -
n ≤ 256
- ACK 9th bit
Stop - Immediate mailbox content update

Table 279. Polling during programing after sequential write in mailbox

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

9th bit Device ready
- ACK
Mailbox is immediately updated
Stop - End of Polling

DS10925 - Rev 11 page 166/197

 ST25DV04K ST25DV16K ST25DV64K
I²C Read current address

B.4 I²C Read current address

B.4.1 I2C current address read in User memory

Table 280. Current byte Read in User memory if read operation allowed (depending on area protection and
RF user security session)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A7h - Device select for reading

- ACK 9th bit
Receive Data located on last pointed address+1, or at address 0 after power-up, in
DATA
user memory
NO_ACK - 9th bit
Stop - End of Reading

Table 281. Current Read in User memory if read operation not allowed (depending on area protection and
RF user security session)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A7h - Device select for reading

- ACK 9th bit
Read of data not allowed
FFh
ST25DV release SDA
NO_ACK 9th bit
Stop - End of Reading

DS10925 - Rev 11 page 167/197

 ST25DV04K ST25DV16K ST25DV64K
I²C random address read

B.5 I²C random address read

B.5.1 I2C random address read in user memory

Table 282. Random byte read in User memory if read operation allowed (depending on area protection and
RF user security session)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
- DATA Receive Data
NO_ACK - 9th bit
Stop - End of Reading

Table 283. Random byte read in User memory if operation not allowed (depending on area protection and
RF user security)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
Read of data not allowed
- FFh
release SDA
NO_ACK - 9th bit
Stop - End of Reading

DS10925 - Rev 11 page 168/197

 ST25DV04K ST25DV16K ST25DV64K
I²C random address read

B.5.2 I2C Random address read in system memory

Table 284. Byte Read System memory (Static register or I2C Password after a valid Present I2C Password)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
Start AFh - Device select for reading
- ACK 9th bit
- DATA Receive Data
NO_ACK - 9th bit
Stop - End of reading

B.5.3 I2C Random address read in dynamic registers

Table 285. Random byte read in Dynamic registers

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
20h - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Adress LSB (1 Byte)
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
- DATA Receive Data
NO_ACK - 9th bit
Stop - End of reading

DS10925 - Rev 11 page 169/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

B.6 I²C sequential read

B.6.1 I2C sequential read in user memory

Table 286. Sequential Read User memory if read operation allowed (depending on area protection and RF
user security session) and all bytes belong to the same area

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
Start A7h0 - Device select for reading
- ACK 9th bit
- DATA 0 Receive Data 0
ACK - 9th bit
- DATA 1 Receive Data 1
ACK - 9th bit
- ... ...
... - ...
- DATA n Receive Data n
NO_ACK - 9th bit
Stop - End of Reading

DS10925 - Rev 11 page 170/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

Table 287. Sequential Read User memory if read operation allowed (depending on area protection and RF
user security session) but crossing area border

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
- DATA 0 Receive Data 0
ACK - 9th bit
- DATA 1 Receive Data 1
ACK - 9th bit
- ... ...
... - ...
- DATA n Receive Data last Address available
ACK - 9th bit
Data is located in next memory area
- FFh
ST25DV release SDA
ACK - 9th bit
- ... ...
... - ...
Data is located in next memory area
- FFh
ST25DV release SDA
Stop - End of reading

DS10925 - Rev 11 page 171/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

Table 288. Sequential Read User memory if read operation allowed (depending on area protection and RF
user security session)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
ST25DV release SDA
- FFh
Reading access not granted
ACK - 9th bit
- ... ...
... - ...
ST25DV release SDA
- FFh
Reading access not granted
NO_ACK - 9th bit
Stop - End of reading

DS10925 - Rev 11 page 172/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

B.6.2 I2C sequential read in system memory

Table 289. Sequential in Read System memory (I2C security session open if reading I2C_PWD)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- ACK 9th bit
ADDRESS_MSB - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
Start AF7h - Device select for reading
- ACK 9th bit
- DATA Receive Data 0
ACK - 9th bit
- DATA Receive Data 1
ACK - 9th bit
- ... ...
... - ...
- DATA Receive Data n
NO_ACK - 9th bit
Stop - End of Reading

DS10925 - Rev 11 page 173/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

Table 290. Sequential Read system memory when access is not granted (I2C password I2C_PWD)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- ACK 9th bit
90h - Send Address MSB (1 Byte)
- ACK 9th bit
ADDRESS_LSB - Send Address LSB (1 Byte)
- ACK 9th bit
Start AFh - Device select for reading
- ACK 9th bit
- DATA Receive Data 0
ST25DV release SDA
- FFh
Reading access is not granted
ACK - 9th bit
- ... ...
... - ...
ST25DV release SDA
- FFh
Reading access is not granted
NO_ACK - 9th bit
Stop - End of reading

DS10925 - Rev 11 page 174/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

B.6.3 I2C sequential read in dynamic registers

Table 291. Sequential read in dynamic register

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
20h - Send Address MSB (1 Byte)
- ACK 9th bit
Send Address LSB (1 Byte)
Dynamic register ADDRESS_LSB - Fynamic register are located form address
2000h to 2007
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
- DATA Receive Data 0
ACK - 9th bit
- DATA Receive Data 1
ACK - 9th bit
- ... ...
... - ...
- Data Receive Data n
NO_ACK - 9th bit
Stop - End of reading

DS10925 - Rev 11 page 175/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

Table 292. Sequential read in Dynamic register and mailbox continuously if fast transfer mode is activated

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
20h - Send Address MSB (1 Byte)
- ACK 9th bit
Send Address LSB (1 Byte)
Dynamic Register
- Dynamic register are located from address
ADDRESS_LSB
2000h to 2007h
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
- DATA 0 Receive Data 0
ACK - 9th bit
- DATA 1 Receive Data 1
ACK - 9th bit
- ... ...
... - ...
Receive Data n (n ≤ 8)
- DATA n
Last Dynamic register address 2007h
ACK - 9th bit
- DATA n + 1 Mailbox byte 0
ACK - 9th bit
- DATA n + 2 Mailbox byte 1
ACK - 9th bit
- ... ...
... - ...
- Data n + i Mailbox byte i (i < 256)
NO_ACK - 9th bit
Stop - End of reading

DS10925 - Rev 11 page 176/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

B.6.4 I2C sequential read in mailbox

Table 293. Sequential in mailbox if fast transfer mode is activated

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
Send Address MSB (1 Byte)
20h or 21h -
2007h < @ 2108h
- ACK 9th bit
Send Address LSB (1 Byte)
ADDRESS_LSB -
2007h < @ 2108h
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
- DATA 0 Receive Data 0
ACK - 9th bit
- DATA 1 Receive Data 1
ACK - 9th bit
- ... ...
... - ...
- Data n Receive Data n
NO_ACK - 9th bit
Stop - End of reading

DS10925 - Rev 11 page 177/197

 ST25DV04K ST25DV16K ST25DV64K
I²C sequential read

Table 294. Sequential read in mailbox if fast transfer mode is not activated

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start A6h - Device select for writing

- ACK 9th bit
Send Address MSB (1 Byte)
20h or 21h -
2007h < @ 2108h
- ACK 9th bit
Send Address LSB (1 Byte)
ADDRESS_LSB -
2007h < @ 2108h
- ACK 9th bit
Start A7h - Device select for reading
- ACK 9th bit
- FFh release SDA
ACK - 9th bit
- FFh release SDA
ACK - 9th bit
- ... ...
... - ...
- FFh release SDA
NO_ACK - 9th bit
Stop - End of reading

DS10925 - Rev 11 page 178/197

 ST25DV04K ST25DV16K ST25DV64K
I²C password relative sequences

B.7 I²C password relative sequences

B.7.1 I2C write password

Table 295. Write Password when I2C security session is already open and fast transfer mode is not
activated

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- ACK 9th bit
09h - Send I2C_PWD MSB address
- ACK 9th bit
00h - Send I2C_PWD LSB address
- ACK 9th bit
I2C_PWD_BYTE_7 - Send I2C_PWD MSB
- ACK 9th bit
I2C_PWD_BYTE_6 DATA 0 Send Data
- ACK 9th bit
... - ...
- ... ...
I2C_PWD_BYTE_0 - Send I2C_PWD LSB
- ACK 9th bit
07h - Write password command
- ACK 9th bit
I2C_PWD_BYTE_7 - Send I2C_PWD MSB
- ACK 9th bit
I2C_PWD_BYTE_6 DATA 0 Send Data
- ACK 9th bit
... - ...
- ... ...
I2C_PWD_BYTE_0 - Send I2C_PWD LSB
- ACK 9th bit

Stop - Start of I2C password programming

DS10925 - Rev 11 page 179/197

 ST25DV04K ST25DV16K ST25DV64K
I²C password relative sequences

Table 296. Write Password when I2C security session is not open or fast transfer mode activated

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- ACK 9th bit
09h - Send I2C_PWD MSB address
- ACK 9th bit
00h - Send I2C_PWD LSB address
- NoACK 9th bit
No PWD Programming
Stop -
Device return in Standby

DS10925 - Rev 11 page 180/197

 ST25DV04K ST25DV16K ST25DV64K
I²C password relative sequences

B.7.2 I2C present password

Table 297. Present Password (whatever status of I2C security session or fast transfer mode)

Request/Response Frame
Comment
Master drives SDA Slave drives SDA

Start AEh - Device select for writing

- ACK 9th bit
09h - Send I2C_PWD MSB address
- ACK 9th bit
00h - Send I2C_PWD LSB address
- ACK 9th bit
I2C_PWD_BYTE_7 - Send I2C_PWD MSB
- ACK 9th bit
I2C_PWD_BYTE_6 DATA 0 Send Data
- ACK 9th bit
... - ...
- ... ...
I2C_PWD_BYTE_0 - Send I2C_PWD LSB
- ACK 9th bit
09h - Present password command
- ACK 9th bit
I2C_PWD_BYTE_7 - Send I2C_PWD MSB
- ACK 9th bit
I2C_PWD_BYTE_6 - Send Data
- ACK 9th bit
... - ...
- ... ...
I2C_PWD_BYTE_0 - Send I2C_PWD LSB
- ACK 9th bit
ST25DV with active I2C_PWD.
Stop -
Result is immediate.

DS10925 - Rev 11 page 181/197

 ST25DV04K ST25DV16K ST25DV64K

Revision history
Table 298. Document revision history

Date Revision Changes

23-Feb-2017 1 Initial release.

Updated:
• Features
• Section 4 Memory management
• Section 5 ST25DVxxx specific features
• Section 5.6.4 System memory protection
• Section 6.4.2 I2C Sequential write
• Section 6 I2C operation
• Section 7 RF operation
• Section 9.1 Maximum ratings
• Table 158. Get System Info response format Error_flag is NOT set
• Table 242. Absolute maximum ratings
• Table 244. AC test measurement conditions
20-Sep-2017 2 • Table 246. I2C DC characteristics (up to 85 °C)
• Table 248. I2C AC characteristics (up to 85 °C)
• Table 250. GPO DC characteristics up to 85°C
• Table 253. RF characteristics
• Table 254. Operating conditions
• Table 256. TSSOP8 – Mechanical data
• Table 261. Ordering information scheme
• Figure 30. I2C Present Password Sequence
• Figure 31. I2C Write Password Sequence
• Figure 80. TSSOP8 – Outline

Added Table 159. Memory size, Table 243. I2C operating conditions, Table 247. I2C DC characteristics (up
to 125 °C), Table 249. I2C AC characteristics (up to 125 °C), and Table 251. GPO DC characteristics up to
125°C.
Updated Features and Section 10 Package information.
04-Oct-2017 3
Added NFC certified logo.
Added:
• Figure 4. 10-ball WLCSP package: connections with CMOS Interrupt output (GPO)
• Section 10.5 WLCSP10 package information
• Table 259. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale mechanical data
• Figure 84. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale package outline
• Figure 85. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale recommended
footprint
19-Dec-2017 4 Updated Features, Section 1 Description, Section 2.5 Energy harvesting analog output (V_EH),
Section 5.3.2 Energy harvesting feature description, Section 6.4.1 I2C Byte write, and Section 6.4.2 I2C
Sequential write.

Updated Figure 21. Arbitration between RF and I2C.

Updated Table 242. Absolute maximum ratings, Table 243. I2C operating conditions, and Table 261. Ordering
information scheme.
Deleted Device summary.
Updated:
• Table 21. MB_LEN_Dyn
• Section 5.1.2 Fast transfer mode usage, Section 5.6.2 Passwords and security sessions,
Section 7.6.2 Command codes list, Section 7.6.35 Write Password, and Section 10.5 WLCSP10
14-Jun-2018 5 package information
• Figure 84. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale package
outline and Figure 85. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale
recommended footprint
Added Table 260. WLCSP10 recommended PCB design rules.

DS10925 - Rev 11 page 182/197

 ST25DV04K ST25DV16K ST25DV64K

Date Revision Changes

Updated:
• Section 2.2.2 Low power down (LPD)
• Section 5.1.2 Fast transfer mode usage
• Section 5.2.3 GPO registers
• Figure 22. RF security sessions management
• Section 7.6.7 Extended Read Single Block
• Section 7.6.9 Extended Write Single Block
01-Aug-2018 6 • Section 7.6.10 Lock Block
• Section 7.6.11 Extended Lock block
• Section 7.6.13 Extended Read Multiple Blocks
• Section 7.6.15 Extended Write Multiple Blocks
• Section 7.6.25 Extended Get Multiple Block Security Status
• Section 7.6.38 Fast Extended Read Single Block
• Section 7.6.40 Fast Extended Read Multiple Block
• Section 9.1 Maximum ratings
Updated Table 205. Fast Read Message request format and Table 206. Fast Read Message response format
08-Nov-2018 7
when Error_flag is NOT set.
Updated:
• Section 2.2.2 Low power down (LPD)
• Section 5.4.2 RF management feature description
04-May-2020 8 • Section 5.6.2 Passwords and security sessions
• Table 79. MEM_SIZE
• Table 161. Extended Get System Info request format
• Table 231. Fast Write Message response format when Error_flag is set
Updated:
• Section 4.2.1 User memory areas
• Section 5.2.2 GPO and power supply
• Section 5.2.3 GPO registers
19-Feb-2021 9
• Section 5.4.2 RF management feature description
• Section 6.4 I2C write operations
• Section 6.6.1 I2C present password command description
• Table 253. RF characteristics
Updated Section 1 Description, Section 1.2 ST25DVxxx packaging, Section 3.2 Contactless interface, and
Section 7.1.1 Access to an ISO/IEC 15693 device.

Updated Table 246. I2C DC characteristics (up to 85 °C), Table 247. I2C DC characteristics (up to 125
°C), Table 248. I2C AC characteristics (up to 85 °C),Table 249. I2C AC characteristics (up to 125 °C),
Table 253. RF characteristics, and their footnotes.
11-Jan-2023 10
Updated Table 255. SO8N – Mechanical data.
Updated Figure 5. Power-up sequence (no RF field, LPD pin tied to VSS or package without LPD pin),
Figure 6. RF power-up sequence (no DC supply), and Figure 75. I2C AC waveforms.
Minor text edits across the whole document.
Updated Table 161. Extended Get System Info request format.
24-Jan-2023 11
Minor text edits across the whole document.

DS10925 - Rev 11 page 183/197

 ST25DV04K ST25DV16K ST25DV64K
Contents

Contents
1 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3
1.1 ST25DVxxx block diagram. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 ST25DVxxx packaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2 Signal descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
2.1 Serial link (SCL, SDA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1.1 Serial clock (SCL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1.2 Serial data (SDA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 Power control (VCC, LPD, VSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2.1 Supply voltage (VCC). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2.2 Low power down (LPD). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2.3 Ground (VSS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.3 RF link (AC0 AC1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3.1 Antenna coil (AC0, AC1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.4 Process control (VDCG, GPO) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.4.1 Driver supply voltage (VDCG). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.4.2 General purpose output (GPO) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.5 Energy harvesting analog output (V_EH). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3 Power management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8
3.1 Wired interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2 Contactless interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4 Memory management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
4.1 Memory organization overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
4.2 User memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4.2.1 User memory areas. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
4.3 System configuration area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.4 Dynamic configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.5 Fast transfer mode mailbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5 ST25DVxxx specific features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
5.1 Fast transfer mode (FTM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
5.1.1 Fast transfer mode registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
5.1.2 Fast transfer mode usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
5.2 GPO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.2.1 Interrupt capabilities on RF events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5.2.2 GPO and power supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

DS10925 - Rev 11 page 184/197

 ST25DV04K ST25DV16K ST25DV64K
Contents

5.2.3 GPO registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

5.2.4 Configuring GPO. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
5.3 Energy harvesting (EH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.3.1 Energy harvesting registers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.3.2 Energy harvesting feature description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
5.3.3 EH delivery state diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
5.3.4 EH delivery sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
5.4 RF management feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
5.4.1 RF management registers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
5.4.2 RF management feature description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
5.5 Interface arbitration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
5.6 Data Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
5.6.1 Data protection registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
5.6.2 Passwords and security sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.6.3 User memory protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
5.6.4 System memory protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
5.7 Device parameter registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
6 I2C operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62
6.1 I2C protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
6.1.1 Start condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
6.1.2 Stop condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
6.1.3 Acknowledge bit (ACK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
6.1.4 Data input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
6.2 I2C timeout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
6.2.1 I2C timeout on Start condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
6.2.2 I2C timeout on clock period. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
6.3 Device addressing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
6.4 I2C write operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
6.4.1 I2C Byte write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
6.4.2 I2C Sequential write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
6.4.3 Minimizing system delays by polling on ACK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
6.5 I2C read operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
6.5.1 Random Address Read. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
6.5.2 Current Address Read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
6.5.3 Sequential Read access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
6.5.4 Acknowledge in Read mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
6.6 I2C password management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

DS10925 - Rev 11 page 185/197

 ST25DV04K ST25DV16K ST25DV64K
Contents

6.6.1 I2C present password command description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

6.6.2 I2C write password command description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
7 RF operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72
7.1 RF communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
7.1.1 Access to an ISO/IEC 15693 device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
7.2 RF communication and energy harvesting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
7.3 Fast transfer mode mailbox access in RF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
7.4 RF protocol description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
7.4.1 Protocol description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
7.4.2 ST25DVxxx states referring to RF protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
7.4.3 Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
7.4.4 Request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
7.4.5 Request flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
7.4.6 Response format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
7.4.7 Response flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
7.4.8 Response and error code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
7.5 Timing definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
7.6 RF commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
7.6.1 RF command code list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
7.6.2 Command codes list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
7.6.3 General command rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
7.6.4 Inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
7.6.5 Stay Quiet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
7.6.6 Read Single Block. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
7.6.7 Extended Read Single Block. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
7.6.8 Write Single Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
7.6.9 Extended Write Single Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
7.6.10 Lock Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
7.6.11 Extended Lock block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
7.6.12 Read Multiple Blocks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
7.6.13 Extended Read Multiple Blocks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
7.6.14 Write Multiple Blocks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
7.6.15 Extended Write Multiple Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
7.6.16 Select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
7.6.17 Reset to Ready . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
7.6.18 Write AFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
7.6.19 Lock AFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
7.6.20 Write DSFID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

DS10925 - Rev 11 page 186/197

 ST25DV04K ST25DV16K ST25DV64K
Contents

7.6.21 Lock DSFID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

7.6.22 Get System Info . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
7.6.23 Extended Get System Info . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
7.6.24 Get Multiple Block Security Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
7.6.25 Extended Get Multiple Block Security Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
7.6.26 Read Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
7.6.27 Write Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
7.6.28 Read Dynamic Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
7.6.29 Write Dynamic Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
7.6.30 Manage GPO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
7.6.31 Write Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
7.6.32 Read Message Length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
7.6.33 Read Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
7.6.34 Fast Read Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
7.6.35 Write Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
7.6.36 Present Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
7.6.37 Fast Read Single Block. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
7.6.38 Fast Extended Read Single Block . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
7.6.39 Fast Read Multiple Blocks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
7.6.40 Fast Extended Read Multiple Block. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
7.6.41 Fast Write Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
7.6.42 Fast Read Message Length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
7.6.43 Fast Read Dynamic configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
7.6.44 Fast Write Dynamic Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
8 Unique identifier (UID) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
9 Device parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
9.1 Maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
9.2 I2C parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
9.3 GPO characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
9.4 RF electrical parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
10 Package information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
10.1 SO8N package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
10.2 TSSOP8 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
10.3 UFDFN8 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
10.4 UFDFPN12 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
10.5 WLCSP10 package information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
11 Ordering information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

DS10925 - Rev 11 page 187/197

 ST25DV04K ST25DV16K ST25DV64K
Contents

Appendix A Bit representation and coding for fast commands . . . . . . . . . . . . . . . . . . . . . . 156

A.1 Bit coding using one subcarrier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
A.1.1 High data rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
A.1.2 Low data rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
A.2 ST25DVxxx to VCD frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
A.3 SOF when using one subcarrier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
A.3.1 High data rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
A.3.2 Low data rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
A.4 EOF when using one subcarrier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
A.4.1 High data rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
A.4.2 Low data rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Appendix B I²C sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
B.1 Device select codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
B.2 I²C Byte writing and polling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
B.2.1 I2C byte write in user memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
B.2.2 I²C byte writing in dynamic registers and polling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
B.2.3 I2C byte write in mailbox and polling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
B.2.4 I2C byte write and polling in system memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
B.3 I2C sequential writing and polling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
B.3.1 I2C sequential write in user memory and polling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
B.3.2 I2C sequential write in mailbox and polling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
B.4 I²C Read current address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
B.4.1 I2C current address read in User memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
B.5 I²C random address read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
B.5.1 I2C random address read in user memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
B.5.2 I2C Random address read in system memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
B.5.3 I2C Random address read in dynamic registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
B.6 I²C sequential read . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
B.6.1 I2C sequential read in user memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
B.6.2 I2C sequential read in system memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
B.6.3 I2C sequential read in dynamic registers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
B.6.4 I2C sequential read in mailbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
B.7 I²C password relative sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
B.7.1 I2C write password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
B.7.2 I2C present password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

DS10925 - Rev 11 page 188/197

 ST25DV04K ST25DV16K ST25DV64K
List of tables

List of tables
Table 1. Signal names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Table 2. User memory as seen by RF and by I2C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Table 3. Maximum user memory block and byte addresses and ENDAi value. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Table 4. Areas and limit calculation from ENDAi registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Table 5. ENDA1 access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Table 6. ENDA1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 7. ENDA2 access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 8. ENDA2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 9. ENDA3 access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 10. ENDA3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Table 11. System configuration memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Table 12. Dynamic registers memory map. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Table 13. Fast transfer mode mailbox memory map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Table 14. MB_MODE access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 15. MB_MODE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 16. MB_WDG access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 17. MB_WDG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 18. MB_CTRL_Dyn access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Table 19. MB_CTRL_Dyn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Table 20. MB_LEN_Dyn access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Table 21. MB_LEN_Dyn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Table 22. FIELD_CHANGE when RF is disabled or in sleep mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Table 23. GPO interrupt capabilities in function of RF field. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Table 24. GPO interrupt capabilities in function of VCC power supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Table 25. GPO access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Table 26. GPO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Table 27. IT_TIME access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 28. IT_TIME . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 29. GPO_CTRL_Dyn access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 30. GPO_CTRL_Dyn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 31. IT_STS_Dyn access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 32. IT_STS_Dyn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Table 33. Enabling or disabling GPO interruptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Table 34. EH_MODE access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Table 35. EH_MODE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Table 36. EH_CTRL_Dyn access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Table 37. EH_CTRL_Dyn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Table 38. Energy harvesting at power-up . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Table 39. RF_MNGT access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Table 40. RF_MNGT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Table 41. RF_MNGT_Dyn access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Table 42. RF_MNGT_Dyn. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Table 43. RFA1SS access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Table 44. RFA1SS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Table 45. RFA2SS access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Table 46. RFA2SS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Table 47. RFA3SS access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Table 48. RFA3SS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Table 49. RFA4SS access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Table 50. RFA4SS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Table 51. I2CSS access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Table 52. I2CSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

DS10925 - Rev 11 page 189/197

 ST25DV04K ST25DV16K ST25DV64K
List of tables

Table 53. LOCK_CCFILE access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Table 54. LOCK_CCFILE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Table 55. LOCK_CFG access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Table 56. LOCK_CFG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Table 57. I2C_PWD access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Table 58. I2C_PWD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Table 59. RF_PWD_0 access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Table 60. RF_PWD_0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Table 61. RF_PWD_1 access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 62. RF_PWD_1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 63. RF_PWD_2 access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 64. RF_PWD_2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 65. RF_PWD_3 access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 66. RF_PWD_3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Table 67. I2C_SSO_Dyn access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Table 68. I2C_SSO_Dyn. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Table 69. Security session type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Table 70. LOCK_DSFID access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Table 71. LOCK_DSFID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Table 72. LOCK_AFI access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Table 73. LOCK_AFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Table 74. DSFID access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Table 75. DSFID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Table 76. AFI access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Table 77. AFI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Table 78. MEM_SIZE access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Table 79. MEM_SIZE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Table 80. BLK_SIZE access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Table 81. BLK_SIZE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Table 82. IC_REF access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Table 83. IC_REF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Table 84. UID access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Table 85. UID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Table 86. IC_REV access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Table 87. IC_REV . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Table 88. Device select code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Table 89. Operating modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Table 90. Address most significant byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Table 91. Address least significant byte . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Table 92. ST25DVxxx response depending on Request_flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Table 93. General request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Table 94. Definition of request flags 1 to 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Table 95. Request flags 5 to 8 when inventory_flag, Bit 3 = 0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Table 96. Request flags 5 to 8 when inventory_flag, Bit 3 = 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Table 97. General response format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Table 98. Definitions of response flags 1 to 8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Table 99. Response error code definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Table 100. Timing values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Table 101. Command codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Table 102. Inventory request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Table 103. Inventory response format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Table 104. Stay Quiet request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Table 105. Read Single Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Table 106. Read Single Block response format when Error_flag is NOT set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Table 107. Block security status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

DS10925 - Rev 11 page 190/197

 ST25DV04K ST25DV16K ST25DV64K
List of tables

Table 108. Read Single Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Table 109. Extended Read Single Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Table 110. Extended Read Single Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Table 111. Block security status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Table 112. Extended Read Single Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Table 113. Write Single Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Table 114. Write Single Block response format when Error_flag is NOT set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Table 115. Write Single Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Table 116. Extended Write Single request format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Table 117. Extended Write Single response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Table 118. Extended Write Single response format when Error_flag is set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Table 119. Lock block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Table 120. Lock block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Table 121. Lock block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Table 122. Extended Lock block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Table 123. Extended Lock block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Table 124. Extended Lock block response format when Error_flag is set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Table 125. Read Multiple Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Table 126. Read Multiple Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Table 127. Block security status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Table 128. Read Multiple Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Table 129. Extended Read Multiple Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Table 130. Extended Read Multiple Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Table 131. Block security status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Table 132. Extended Read Multiple Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Table 133. Write Multiple Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Table 134. Write Multiple Block response format when Error_flag is NOT set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Table 135. Write Multiple Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Table 136. Extended Write Multiple Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Table 137. Extended Write Multiple Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Table 138. Extended Write Multiple Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Table 139. Select request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Table 140. Select Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Table 141. Select response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Table 142. Reset to Ready request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Table 143. Reset to Ready response format when Error_flag is NOT set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Table 144. Reset to ready response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Table 145. Write AFI request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Table 146. Write AFI response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Table 147. Write AFI response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Table 148. Lock AFI request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Table 149. Lock AFI response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Table 150. Lock AFI response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Table 151. Write DSFID request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Table 152. Write DSFID response format when Error_flag is NOT set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Table 153. Write DSFID response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Table 154. Lock DSFID request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Table 155. Lock DSFID response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Table 156. Lock DSFID response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Table 157. Get System Info request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Table 158. Get System Info response format Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Table 159. Memory size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Table 160. Get System Info response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Table 161. Extended Get System Info request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Table 162. Parameter request list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

DS10925 - Rev 11 page 191/197

 ST25DV04K ST25DV16K ST25DV64K
List of tables

Table 163. Extended Get System Info response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Table 164. Response Information Flag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Table 165. Response other field: ST25DVxxx VICC memory size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Table 166. Response other field: ST25DVxxx IC Ref . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Table 167. Response other field: ST25DVxxx VICC command list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Table 168. Response other field: ST25DVxxx VICC command list Byte 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Table 169. Response other field: ST25DVxxx VICC command list Byte 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Table 170. Response other field: ST25DVxxx VICC command list Byte 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Table 171. Response other field: ST25DVxxx VICC command list Byte 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Table 172. Extended Get System Info response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Table 173. Get Multiple Block Security Status request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Table 174. Get Multiple Block Security Status response format when Error_flag is NOT set. . . . . . . . . . . . . . . . . . . . . . . 109
Table 175. Block security status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Table 176. Get Multiple Block Security Status response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Table 177. Extended Get Multiple Block Security Status request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110
Table 178. Extended Get Multiple Block Security Status response format when Error_flags NOT set . . . . . . . . . . . . . . . . .110
Table 179. Block security status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110
Table 180. Extended Get Multiple Block Security Status response format when Error_flag is set . . . . . . . . . . . . . . . . . . . .111
Table 181. Read Configuration request format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Table 182. Read Configuration response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Table 183. Read Configuration response format when Error_flag is set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Table 184. Write Configuration request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113
Table 185. Write Configuration response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113
Table 186. Write configuration response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113
Table 187. Read Dynamic Configuration request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114
Table 188. Read Dynamic Configuration response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . .114
Table 189. Read Dynamic Configuration response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114
Table 190. Write Dynamic Configuration request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Table 191. Write Dynamic Configuration response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Table 192. Write Dynamic Configuration response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
Table 193. ManageGPO request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Table 194. GPOVAL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
Table 195. ManageGPO response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Table 196. ManageGPO response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Table 197. Write Message request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Table 198. Write Message response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
Table 199. Write Message response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
Table 200. Read Message Length request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
Table 201. Read Message Length response format when Error_flag is NOT set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
Table 202. Read Message Length response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
Table 203. Read Message request format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
Table 204. Read Message response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Table 205. Fast Read Message request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Table 206. Fast Read Message response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Table 207. Write Password request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Table 208. Write Password response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Table 209. Write Password response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Table 210. Present Password request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Table 211. Present Password response format when Error_flag is NOT set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Table 212. Present Password response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Table 213. Fast Read Single Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Table 214. Fast Read Single Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Table 215. Block security status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Table 216. Fast Read Single Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Table 217. Fast Extended Read Single Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

DS10925 - Rev 11 page 192/197

 ST25DV04K ST25DV16K ST25DV64K
List of tables

Table 218. Fast Extended Read Single Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . 125
Table 219. Block security status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Table 220. Fast Extended Read Single Block response format when Error_flag is set. . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Table 221. Fast Read Multiple Block request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Table 222. Fast Read Multiple Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Table 223. Block security status if Option_flag is set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Table 224. Fast Read Multiple Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Table 225. Fast Extended Read Multiple Block request format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Table 226. Fast Extended Read Multiple Block response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . 129
Table 227. Block security status if Option_flag is set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Table 228. Fast Read Multiple Block response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Table 229. Fast Write Message request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Table 230. Fast Write Message response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Table 231. Fast Write Message response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Table 232. Fast Read Message Length request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Table 233. Fast Read Message Length response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Table 234. Fast Read Message Length response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Table 235. Fast Read Dynamic configuration request format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Table 236. Fast Read Dynamic configuration response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . 133
Table 237. Fast Read Dynamic configuration response format when Error_flag is set . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Table 238. Fast Write Dynamic Configuration request format. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Table 239. Fast Write Dynamic Configuration response format when Error_flag is NOT set . . . . . . . . . . . . . . . . . . . . . . . 134
Table 240. Fast Write Dynamic Configuration response format when Error_flag is set. . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Table 241. UID format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Table 242. Absolute maximum ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Table 243. I2C operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Table 244. AC test measurement conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Table 245. Input parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Table 246. I2C DC characteristics (up to 85 °C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Table 247. I2C DC characteristics (up to 125 °C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Table 248. I2C AC characteristics (up to 85 °C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Table 249. I2C AC characteristics (up to 125 °C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Table 250. GPO DC characteristics up to 85°C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Table 251. GPO DC characteristics up to 125°C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Table 252. GPO AC characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Table 253. RF characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Table 254. Operating conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Table 255. SO8N – Mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Table 256. TSSOP8 – Mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Table 257. UFDFN8 - Mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Table 258. UFDFPN12 - Mechanical data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Table 259. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale mechanical data . . . . . . . . . . . . . . . 153
Table 260. WLCSP10 recommended PCB design rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Table 261. Ordering information scheme. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Table 262. Device select usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Table 263. Byte Write in user memory when write operation allowed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Table 264. Polling during programming after byte writing in user memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Table 265. Byte Write in user memory when write operation is not allowed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Table 266. Byte Write in Dynamic Register (if not Read Only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Table 267. Polling during programming after byte write in Dynamic Register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Table 268. Byte Write in Dynamic Register if Read Only . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Table 269. Byte Write in mailbox when mailbox is free from RF message and fast transfer mode is activated . . . . . . . . . . 162
Table 270. Byte Write in mailbox when mailbox is not free from RF message fast transfer mode is not activated . . . . . . . . 162
Table 271. Byte Write in System memory if I2C security session is open and register is not RO . . . . . . . . . . . . . . . . . . . . 163

DS10925 - Rev 11 page 193/197

 ST25DV04K ST25DV16K ST25DV64K
List of tables

Table 272. Polling during programing after byte write in System memory if I2C security session is open and register is not RO
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Table 273. Byte Write in System memory if I2C security session is closed or register is RO . . . . . . . . . . . . . . . . . . . . . . . 164
Table 274. Sequential write User memory when write operation allowed and all bytes belong to same area. . . . . . . . . . . . 164
Table 275. Polling during programing after sequential write in User memory when write operation allowed and all bytes belong
to same area. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Table 276. Sequential write in User memory when write operation allowed and crossing over area border. . . . . . . . . . . . . 165
Table 277. Polling during programming after sequential write in User memory when write operation allowed and crossing over
area border . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Table 278. Sequential write in mailbox when mailbox is free from RF message and fast transfer mode is activated . . . . . . 166
Table 279. Polling during programing after sequential write in mailbox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Table 280. Current byte Read in User memory if read operation allowed (depending on area protection and RF user security
session) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Table 281. Current Read in User memory if read operation not allowed (depending on area protection and RF user security
session) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Table 282. Random byte read in User memory if read operation allowed (depending on area protection and RF user security
session) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
Table 283. Random byte read in User memory if operation not allowed (depending on area protection and RF user security)168
Table 284. Byte Read System memory (Static register or I2C Password after a valid Present I2C Password) . . . . . . . . . . . 169
Table 285. Random byte read in Dynamic registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Table 286. Sequential Read User memory if read operation allowed (depending on area protection and RF user security
session) and all bytes belong to the same area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Table 287. Sequential Read User memory if read operation allowed (depending on area protection and RF user security
session) but crossing area border . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Table 288. Sequential Read User memory if read operation allowed (depending on area protection and RF user security
session) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Table 289. Sequential in Read System memory (I2C security session open if reading I2C_PWD) . . . . . . . . . . . . . . . . . . . 173
Table 290. Sequential Read system memory when access is not granted (I2C password I2C_PWD) . . . . . . . . . . . . . . . . 174
Table 291. Sequential read in dynamic register . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Table 292. Sequential read in Dynamic register and mailbox continuously if fast transfer mode is activated . . . . . . . . . . . . 176
Table 293. Sequential in mailbox if fast transfer mode is activated . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Table 294. Sequential read in mailbox if fast transfer mode is not activated . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Table 295. Write Password when I2C security session is already open and fast transfer mode is not activated. . . . . . . . . . 179
Table 296. Write Password when I2C security session is not open or fast transfer mode activated . . . . . . . . . . . . . . . . . . 180
Table 297. Present Password (whatever status of I2C security session or fast transfer mode) . . . . . . . . . . . . . . . . . . . . . 181
Table 298. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

DS10925 - Rev 11 page 194/197

 ST25DV04K ST25DV16K ST25DV64K
List of figures

List of figures
Figure 1. ST25DVxxx block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Figure 2. 8-pin packages: connections with open drain Interrupt output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Figure 3. 12-pin package: connections with CMOS Interrupt output (GPO). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Figure 4. 10-ball WLCSP package: connections with CMOS Interrupt output (GPO) . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Figure 5. Power-up sequence (no RF field, LPD pin tied to VSS or package without LPD pin) . . . . . . . . . . . . . . . . . . . . . 8
Figure 6. RF power-up sequence (no DC supply) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Figure 7. Memory organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Figure 8. ST25DVxxx user memory areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Figure 9. RF to I2C fast transfer mode operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Figure 10. I2C to RF fast transfer mode operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Figure 11. Fast transfer mode mailbox access management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Figure 12. RF_USER sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Figure 13. RF_ACTIVITY sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Figure 14. RF_INTERRUPT sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Figure 15. FIELD_CHANGE sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Figure 16. RF_PUT_MSG sequence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Figure 17. RF_GET_MSG sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Figure 18. RF_WRITE sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Figure 19. EH delivery state diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Figure 20. ST25DVxxx Energy Harvesting Delivery Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Figure 21. Arbitration between RF and I2C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Figure 22. RF security sessions management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Figure 23. I2C security sessions management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Figure 24. I2C bus protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Figure 25. I²C timeout on Start condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Figure 26. Write mode sequences when write is not inhibited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Figure 27. Write mode sequences when write is inhibited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Figure 28. Write cycle polling flowchart using ACK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Figure 29. Read mode sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Figure 30. I2C Present Password Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Figure 31. I2C Write Password Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Figure 32. ST25DVxxx protocol timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Figure 33. ST25DVxxx state transition diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Figure 34. Stay Quiet frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Figure 35. Read Single Block frame exchange between VCD and ST25DVxxx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Figure 36. Extended Read Single Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . 85
Figure 37. Write Single Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Figure 38. Extended Write Single frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Figure 39. Lock Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Figure 40. Extended Lock block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Figure 41. Read Multiple Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Figure 42. Extended Read Multiple Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . 93
Figure 43. Write Multiple Block frame exchange between VCD and ST25DVxxx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Figure 44. Extended Write Multiple Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . 96
Figure 45. Select frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Figure 46. Reset to Ready frame exchange between VCD and ST25DVxxx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Figure 47. Write AFI frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Figure 48. Lock AFI frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Figure 49. Write DSFID frame exchange between VCD and ST25DVxxx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Figure 50. Lock DSFID frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Figure 51. Get System Info frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Figure 52. Extended Get System Info frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . 108

DS10925 - Rev 11 page 195/197

 ST25DV04K ST25DV16K ST25DV64K
List of figures

Figure 53. Get Multiple Block Security Status frame exchange between VCD and ST25DVxxx. . . . . . . . . . . . . . . . . . . .110
Figure 54. Extended Get Multiple Block Security Status frame exchange. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .111
Figure 55. Read Configuration frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
Figure 56. Write Configuration exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114
Figure 57. Read Dynamic Configuration frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . .115
Figure 58. Write Dynamic Configuration frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . .116
Figure 59. Manage GPO frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Figure 60. Write Message frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .118
Figure 61. Read Message Length frame exchange between VCD and ST25DVxxx. . . . . . . . . . . . . . . . . . . . . . . . . . . .119
Figure 62. Read Message frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Figure 63. Fast Read Message frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Figure 64. Write Password frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Figure 65. Present Password frame exchange between VCD and ST25DVxxx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Figure 66. Fast Read Single Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Figure 67. Fast Extended Read Single Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . 126
Figure 68. Fast Read Multiple Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . 128
Figure 69. Fast Extended Read Multiple Block frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . 130
Figure 70. Fast Write Message frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Figure 71. Fast Read Message Length frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . . . . . 132
Figure 72. Fast Read Dynamic configuration frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . 133
Figure 73. Fast Write Dynamic Configuration frame exchange between VCD and ST25DVxxx . . . . . . . . . . . . . . . . . . . 134
Figure 74. AC test measurement I/O waveform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Figure 75. I2C AC waveforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Figure 76. I2C Fast mode (fC = 1 MHz): maximum Rbus value versus bus parasitic capacitance (Cbus) . . . . . . . . . . . . . 142
Figure 77. ASK modulated signal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Figure 78. SO8N – Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Figure 79. SO8N - Footprint example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Figure 80. TSSOP8 – Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Figure 81. TSSOP8 – Footprint example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Figure 82. UFDFN8 - Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Figure 83. UFDFPN12 - Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Figure 84. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale package outline . . . . . . . . . . . . . . 153
Figure 85. WLCSP - 10 balls, 1.649x1.483 mm, 0.4 mm pitch, wafer level chip scale recommended footprint. . . . . . . . . 154
Figure 86. Logic 0, high data rate, fast commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Figure 87. Logic 1, high data rate, fast commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Figure 88. Logic 0, low data rate, fast commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Figure 89. Logic 1, low data rate, fast commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Figure 90. Start of frame, high data rate, one subcarrier, fast commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Figure 91. Start of frame, low data rate, one subcarrier, fast commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Figure 92. End of frame, high data rate, one subcarrier, fast commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Figure 93. End of frame, low data rate, one subcarrier, fast commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

DS10925 - Rev 11 page 196/197

 ST25DV04K ST25DV16K ST25DV64K

IMPORTANT NOTICE – READ CAREFULLY

STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and improvements to ST
products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on ST products before placing orders. ST
products are sold pursuant to ST’s terms and conditions of sale in place at the time of order acknowledgment.
Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or the design of
purchasers’ products.
No license, express or implied, to any intellectual property right is granted by ST herein.
Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.
ST and the ST logo are trademarks of ST. For additional information about ST trademarks, refer to www.st.com/trademarks. All other product or service names
are the property of their respective owners.
Information in this document supersedes and replaces information previously supplied in any prior versions of this document.
© 2023 STMicroelectronics – All rights reserved

DS10925 - Rev 11 page 197/197