INTEGRATED CIRCUITS

DATA SHEET

HITAG S
HTS IC H32/HTS IC H56/HTS IC H48
Transponder IC
Product Specification 2003 November 12
Revision 3.0 079230
PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

CONTENTS 9.3 Reset Time . . . . . . . . . . . . . . . . . . . . . . . . 26

9.4 HITAG S Transponder waiting time before
1 FEATURES . . . . . . . . . . . . . . . . . . . . . . . . . 3 transmitting a response after receiving
1.1 Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 an EOF . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.2 Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 9.5 HITAG S Transponder programming time . 28
1.3 Supported Standards . . . . . . . . . . . . . . . . . 3 9.6 HITAG S Transponder waiting time before
1.4 Security Features . . . . . . . . . . . . . . . . . . . . 3 transmitting data in TTF Mode . . . . . . . . . . 29
1.5 Delivery Types . . . . . . . . . . . . . . . . . . . . . . 3 9.7 HITAG S Transponder Mode
2 GENERAL DESCRIPTION . . . . . . . . . . . . . 4 switching time . . . . . . . . . . . . . . . . . . . . . . 30

2.1 Target Markets . . . . . . . . . . . . . . . . . . . . . . 4 10 STATE DIAGRAM . . . . . . . . . . . . . . . . . . . 31

2.1.1 Animal Identification . . . . . . . . . . . . . . . . . . 4 10.1 General Description of States . . . . . . . . . . 31
2.1.2 Laundry Automation . . . . . . . . . . . . . . . . . . 4 10.2 HITAG S 32 . . . . . . . . . . . . . . . . . . . . . . . . 32
2.1.3 Beer Keg and Gas Cylinder Logistic . . . . . . 4 10.3 HITAG S 256 and HITAG S 2048 . . . . . . . 33
2.1.4 Pigeon Race Sports . . . . . . . . . . . . . . . . . . 4 11 COMMAND SET . . . . . . . . . . . . . . . . . . . . 34
2.1.5 Security Applications . . . . . . . . . . . . . . . . . 4
11.1 General Comments . . . . . . . . . . . . . . . . . . 34
2.1.6 Access Control, Company Cards,
11.2 UID REQUEST xx . . . . . . . . . . . . . . . . . . . 34
Amusement Parks. . . . . . . . . . . . . . . . . . . . 4
11.3 AC SEQUENCE. . . . . . . . . . . . . . . . . . . . . 35
2.2 Customer Application Support and
11.4 SELECT (UID) . . . . . . . . . . . . . . . . . . . . . 36
Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
11.5 CHALLENGE . . . . . . . . . . . . . . . . . . . . . . . 37
3 ORDERING INFORMATION . . . . . . . . . . . 5 11.6 SELECT_QUIET (UID) . . . . . . . . . . . . . . . 38
4 BLOCKDIAGRAM . . . . . . . . . . . . . . . . . . . . 6 11.7 READ PAGE . . . . . . . . . . . . . . . . . . . . . . . 38
5 REFERENCE DOCUMENTS . . . . . . . . . . . 6 11.8 READ BLOCK . . . . . . . . . . . . . . . . . . . . . . 39
11.9 WRITE PAGE . . . . . . . . . . . . . . . . . . . . . . 40
6 MEMORY ORGANISATION . . . . . . . . . . . . 7 11.10 WRITE BLOCK . . . . . . . . . . . . . . . . . . . . . 41
6.1 Unique Identifier (UID) . . . . . . . . . . . . . . . . 8 11.11 QUIET . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
6.1.1 Product identifier (PID) . . . . . . . . . . . . . . . . 8 12 TRANSPONDER TALKS FIRST (TTF)
6.2 HITAG S Plain Mode. . . . . . . . . . . . . . . . . . 8 MODE . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
6.3 HITAG S Authentication Mode . . . . . . . . . . 9
12.1 32 Bit TTF Mode . . . . . . . . . . . . . . . . . . . . 43
7 FUNCTIONAL DESCRIPTION . . . . . . . . . 10 12.2 64 Bit TTF Mode . . . . . . . . . . . . . . . . . . . . 43
7.1 Basic System Configuration . . . . . . . . . . . 10 12.3 128 Bit TTF Mode . . . . . . . . . . . . . . . . . . . 44
7.2 Energy Transmission . . . . . . . . . . . . . . . . 11 13 DATA INTEGRITY / CALCULATION
7.3 Data Transmission: Transponder → OF CRC . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Read/Write Device . . . . . . . . . . . . . . . . . . 12
7.3.1 Coding. . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 13.1 Data Transmission: Read/Write Device to
7.3.2 Data Rate . . . . . . . . . . . . . . . . . . . . . . . . . 14 HITAG S Transponder . . . . . . . . . . . . . . . . 45
13.2 Data Transmission: HITAG S Transponder to
7.4 Data Transmission: Read/Write Device →
Transponder (Physical Layer) . . . . . . . . . . 15 Read/Write Device . . . . . . . . . . . . . . . . . . . 45
7.4.1 Coding. . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 13.2.1 Standard Response Protocol Mode . . . . . . 45
13.2.2 Advanced/Fast Advanced Response
7.4.2 Modulation details . . . . . . . . . . . . . . . . . . . 17
Protocol Mode . . . . . . . . . . . . . . . . . . . . . . 45
8 CONFIGURATION . . . . . . . . . . . . . . . . . . 18 13.3 Source Code for CRC-Checksum . . . . . . . 46
8.1 Configuration Page . . . . . . . . . . . . . . . . . . 18 14 ABBREVIATIONS . . . . . . . . . . . . . . . . . . . 47
8.2 Delivery Configuration. . . . . . . . . . . . . . . . 21
8.2.1 HITAG S32 . . . . . . . . . . . . . . . . . . . . . . . . 21 15 DATA SHEET STATUS . . . . . . . . . . . . . . . 48
8.2.2 HITAG S256 . . . . . . . . . . . . . . . . . . . . . . . 22 16 DEFINITIONS . . . . . . . . . . . . . . . . . . . . . . 48
8.2.3 HITAG S2048 . . . . . . . . . . . . . . . . . . . . . . 23 17 DISCLAIMERS . . . . . . . . . . . . . . . . . . . . . 48
9 PROTOCOL TIMING . . . . . . . . . . . . . . . . 24 18 REVISION HISTORY. . . . . . . . . . . . . . . . . 49
9.1 Read/Write Device waiting time before sending
the first command . . . . . . . . . . . . . . . . . . . 24
9.2 Read/Write Device waiting time before sending
a subsequent command . . . . . . . . . . . . . . 25

2 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

1 FEATURES 1.4 Security Features

• Integrated Circuit for Contactless Identification • 32 Bit Unique Identification Number (UID)
Transponders and Cards • 48 Bit secret key based encrypted authentication
• Integrated resonance capacitor of 210 pF with ± 5 %
tolerance over full production 1.5 Delivery Types
• Frequency range 100..150 kHz. • Sawn, gold - bumped 8” Wafer
• Contactless Chip Card Module MOA2
1.1 Protocol
• I – Connect (Low Cost Flip Chip Package)
• Modulation Read/Write Device → Transponder:
100 % ASK and Binary Pulse Length Coding
• Modulation Transponder → Read/Write Device: Strong
ASK modulation with Anticollision, Manchester and
Biphase Coding
• Fast Anticollision Protocol for inventory tracking:
100 Tags in 3.2 seconds
• Data integrity check (CRC)
• Optional Transponder Talks First Modes with user
defined data length
• Temporary switch from Transponder Talks First into
Reader Talks First Mode
• Data Rate Read/Write Device to Transponder: 5.2 kBit/s
• Data Rates Transponder to Read/Write Device: 2 kBit/s,
4 kBit/s, 8 kBit/s

1.2 Memory
• Three memory options (32 Bit UID, 256 Bit, 2048 Bit)
• More than 100000 erase/write cycles
• 10 years non - volatile data retention
• Secure Memory Lock functionality

1.3 Supported Standards

• Full compliant to ISO 11784/85 Animal ID
• Targeted to operated on hardware infrastructure of new
upcoming standards
– ISO14223
(Animal ID with anticollision and read/write
functionality)
– ISO 18000-2
(AIDC Techniques-RFID or Item Management)
• Supports German Waste Management Standard and
Pigeon Race Standard

3 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

2 GENERAL DESCRIPTION 2.1.2 LAUNDRY AUTOMATION

The HITAG™ product line is well known and established in • Identify 200 pcs of garment with one Read/Write Device
the contactless identification market. • Long operation distance with typical small shaped
Due to the open marketing strategy of Philips laundry button transponders
Semiconductors there are various manufacturers well • Insensitive to harsh conditions like pressure, heat and
established for both the transponders / cards as well as the water.
Read/Write Devices. All of them supporting HITAG 1 and
HITAG 2 transponder IC's. With the new HITAG S family, 2.1.3 BEER KEG AND GAS CYLINDER LOGISTIC
this existing infrastructure is extended with the next
generation of IC’s being substantially smaller in • Recognising a complete pallet of gas cylinders at one
time.
mechanical size, lower in cost, offering more operation
distance and speed, but still being operated with the same • Long writing distance.
reader infrastructure and transponder manufacturing • Voluntarily change between TTF Mode with user defined
equipment. data length and Read/Write Modes with out changing the
One Protocol - three memory options. configuration on the transponder.
• Authenticity check at the beer pubs- between beer
The protocol and command structure for HITAG S is based
bumper and supplied beer keg, provides a safe
on HITAG 1, including anticollision algorithm.
protection of the beer brand.
Three different memory sizes are offered and can be
operated using exactly the same protocol. 2.1.4 PIGEON RACE SPORTS
HITAG S 32 32 Bit Unique Identifier Read Only According to European pigeon race standards, offering the
HITAG S 256 256 Bit Total Memory Read/Write additional shadow memory, that is required in some
European companies.
HITAG S 2048 2048 Bit Total Memory Read/Write
2.1.5 SECURITY APPLICATIONS
2.1 Target Markets
Authenticity check for high level brands or for original
2.1.1 ANIMAL IDENTIFICATION
refilling e.g. toner for fax machines.
Basically, the animal id market can be divided into two
different areas: 2.1.6 ACCESS CONTROL, COMPANY CARDS, AMUSEMENT
PARKS
a) Identification of pet animals
The included encrypted authentication feature is well
Some countries require that the your dog/cat is being
suited for applications like access control and vending
microchiped prior to immigration. But it is also of advantage
machines. In particular the combined application with one
in case your pet is getting lost. The microchiped pet gets
company card opening the barrier for the car parking,
easily identified with a handheld reader and thus can be
opening the access to the building and rooms with different
distinguished from stray animals.
security levels, offering drinks and coffee from the vending
The ISO standard 11784/85 is well established in this machines in the socialising area.
markets and HITAG S 256 and HITAG S 2048 are
compliant to this standard, while offering additional 2.2 Customer Application Support and Training
memory for storage of customised off line data, such as
Within the dedicated CAS team within the BU
phone number/address of the pets owner.
Identification.
b) Identification and Tracking of livestock like cattle,
Please Contact:
pork and sheep
[email protected]
Being compatible with the ISO 11784/85 reader
infrastructure, HITAG S can be switched temporarily into Accompanying Data Sheets and Application Notes:
read/write mode, thus enabling additional features, like e.g.
http://www.semiconductors.com/markets/identification/
off line data storage directly on the animals tag
customer/download/index.html#hitag
This concept has already been standardised within
ISO 14223/1.
4 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

3 ORDERING INFORMATION

EXTENDED TYPE MEMORY ORDERING TEMPERATURE

DESCRIPTION PACKAGE
NUMBER SIZE CODE RANGE (°C)
HTS IC H32 01EW/V4 Sawn 8” wafer on foil (FFC), 32 Bit 9352 729 70005 −
HTS IC H56 01EW/V4 150 µm, inked and mapped, 256 Bit 9352 729 71005 − -25 °C to +85 °C
with gold bumps
HTS IC H48 01EW/V4 2048 Bit 9352 729 73005 −

HTS MO H32 01EV MOA2 Package 32 Bit 9352 729 69118

HTS MO H56 01EV 256 Bit 9352 729 72118 SOT500AA1 -25 °C to +85 °C
HTS MO H48 01EV 2048 Bit 9352 729 74118

HTS FC H32 01EV/DH Flip Chip Package, Hot 32 Bit 9352 729 75118
HTS FC H56 01EV/DH Laminated 256 Bit 9352 729 76118 SOT732AA1 -25 °C to +85 °C
HTS FC H48 01EV/DH 2048 Bit 9352 729 77118

5 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

4 BLOCKDIAGRAM
The HITAG S Transponder requires no external power supply. The contactless interface generates the power supply and
the system clock via the resonant circuitry by inductive coupling to the Read/Write Device (RWD). The interface also
demodulates data transmitted from the RWD to the HITAG S Transponder, and modulates the magnetic field for data
transmission from the HITAG S Transponder to the RWD.
Data are stored in a non-volatile memory (EEPROM). The EEPROM has a capacity up to 2048 Bit and is organised in
64 Pages consisting of 4 Bytes each (1 Page = 32 Bits).

Analogue RF Interface Digital Control EEPROM

VREG
PAD
VDD Anticollision 32 Bit
V

RECT DEMOD Read/Write

Control
Data

64 Pages
In
Access
Transponder
Control
Cres MOD

Data R/W
Out EEPROM Interface
Control
CLK
PAD
Clock RF Interface
Control Sequencer
Charge Pump

Fig.1 Block diagram.

5 REFERENCE DOCUMENTS
• General Quality Specification
• General Specification for 8” Wafer
• Bumped Wafer Specification
• Addendum Bumped Wafer Specification HTS IC H32/ HTS IC H56/ HTS IC H48 (electrical values)
• Contactless Chip Card Module Specification
• Addendum Contactless Chip Card Module Specification HTS MO H32/HTS MO H56/HTS MO H48
• Flip Chip Package Specification
• Addendum Flip Chip Package Specification HTS FC H32/HTS FC H56/HTS FC H48
• Application Note HITAG S Coil Design Guide.

6 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

6 MEMORY ORGANISATION

HITAG S Type
Page
Address 32 Bit H32 H56 H48
0x00 Page 0
Block 0

0x01 Page 1
0x02 Page 2
0x03 Page 3
0x04 Page 4
Block 1

0x05 Page 5
0x06 Page 6
0x07 Page 7
0x08 Page 8
Block 2

0x09 Page 9
0x0A Page10
0x0B Page 11
0x0C Page 12
Block 3

0x0D Page 13
0x0E Page 14
0x0F Page 15
0x10 Page 16

0x3B Page 59
0x3C Page 60
Block 15

0x3D Page 61
0x3E Page 62
0x3F Page 63

Fig.2 Memory Organisation.

The EEPROM has a capacity up to 2048 Bit and is organised in 16 Blocks, consisting of 4 Pages each, for commands
with Block access. A Page consists of 4 Bytes each (1 Page = 32 Bits) and is the smallest access unit.
Addressing is done Page by Page (Page 0 up to 63) and access is gained either Page by Page or Block by Block entering
the respective Page start address. In case of Block Read/Write access, the transponder is processed from the start Page
address within one block to the end of the corresponding block.
Three different types of HITAG S IC’s with different memory sizes as shown in the figure above are available.

7 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

6.1 Unique Identifier (UID)

Page 0 contains the 32 Bit Unique Identifier (UID) which is programmed during the manufacturing process.
Page 0 access: Read Only (RO)

MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x00 UID 3 UID 2 UID 1 UID 0

6.1.1 PRODUCT IDENTIFIER (PID)

The Product Identifier (PID) for the HITAG S Transponder IC is coded in the UID 3 Byte of the Unique Identifier (UID).
This enables to distinguish between different ICs of the HITAG family.

UID3
MSB LSB
PID 1 PID 0

Condition for HITAG S:

PID 1 = 0x7 – 0xF and PID 0 ≠ 0x5 – 0x6

6.2 HITAG S Plain Mode

Page 1
In Plain Mode, Page 1 contains three configuration Bytes CON 0 to CON 2 and a reserved byte.
MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x01 Reserved CON 2 CON 1 CON 0

Page 2 - 63
In Plain Mode, Pages 2 – 63 can be used to store user data.
MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x02 – 0x3F Data 3 Data 2 Data 1 Data 0

Memory Map for HITAG S in Plain Mode:

MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x00 UID 3 UID 2 UID 1 UID 0
0x01 Reserved CON 2 CON 1 CON 0
0x02 Data 3 Data 2 Data 1 Data 0
0x03 Data 3 Data 2 Data 1 Data 0

8 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

6.3 HITAG S Authentication Mode

Page 1
In Authentication Mode, Page 1 contains three configuration Bytes CON 0 to CON 2 and the password high
Byte PWDH 0.

MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x01 PWDH 0 CON 2 CON 1 CON 0

Page 2
In Authentication Mode, Page 2 contains the password low Bytes PWDL 0 and PWDL 1 and the key high Bytes KEYH 0
and KEYH 1.

MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x02 KEYH 1 KEYH 0 PWDL 1 PWDL 0

Page 3
In Authentication Mode, Page 3 contains the key low Bytes KEYL 0 - KEYL 3.

MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x03 KEYL 3 KEYL 2 KEYL 1 KEYL 0

Page 4 - 63
MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x04 – 0x3F Data 3 Data 2 Data 1 Data 0

Memory Map for HITAG S in Authentication Mode:

MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x00 UID 3 UID 2 UID 1 UID 0
0x01 PWDH 0 CON 2 CON 1 CON 0
0x02 KEYH 1 KEYH 0 PWDL 1 PWDL 0
0x03 KEYL 3 KEYL 2 KEYL 1 KEYL 0
0x04 Data 3 Data 2 Data 1 Data 0
0x05 Data 3 Data 2 Data 1 Data 0

9 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

7 FUNCTIONAL DESCRIPTION
7.1 Basic System Configuration
The following block diagram shows in principle the HITAG system configuration

Read / Write Device (RWD)

Oscillator Modulator Driver

RWD
Antenna
Interface Control
Host Signal & Data
Processing

Amplifier Demodulator Filter

HITAG S

Transponder
Antenna

Fig.3 HITAG System configuration.

A control and data processing unit controls the modulation of the carrier signal and processes data coming back from the
demodulator circuit.

10 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

7.2 Energy Transmission

Passive transponders must somehow be supplied with energy to be able to operate. In the HITAG System, this is
achieved by using the principle of a loose coupled transformer:

RWD Transponder
Antenna Antenna
M

Energy

Data

Fig.4 Loose coupled transformer.

The RWD antenna generates a magnetic field. Some of the generated magnetic flux flows through the transponder
antenna and induces a voltage there. The voltage drives a current and the transponder will start operating. As this current
will be very small when the transponder is far away from the antenna, the HITAG S Transponder IC is designed for low
power consumption.
The principle of a loose coupled transformer enables also a bi-directional data transmission.

11 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

7.3 Data Transmission: Transponder → Read/Write Device

For data transmission from the HITAG S Transponder to the RWD, the implemented method is called 'load modulation'.
Here the HITAG S Transponder continuously changes the load on the magnetic field, by in principle turning on/off a
resistor, according to the information to transmit. Alteration of the magnetic field is detected by the receiver of the RWD.

Data 1 1 0
Coded
Data (MC)

Voltage
on
Transponder
Antenna

Voltage
on
RWD
Antenna

Fig.5 Data Transmission Transponder to Read/Write Device.

The modulation ratio of the RWD antenna voltage depends on the coupling factor of the antenna configuration (RWD
antenna size, transponder antenna size, distance between the antennas,...).

12 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

7.3.1 CODING
Three different coding techniques for different States and Modes of the HITAG S Transponder IC are used (see also
Chapters 11 “Command Set” and 12 “Transponder Talks First (TTF) Mode”:
• AC: Anticollision Coding in Init State
• MC: Manchester Coding in Selected State and in Transponder Talks First State
• BC: Biphase Coding in Transponder Talks First State

DATA 1 0 1 1 1 0 0 1

DATA RATE

AC

MC

BC

Fig.6 Coding.

A high level of the above coding signals means the physical state ‘modulator on’ (field loaded), a low level means
‘modulator off’ (field unloaded).

13 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

7.3.2 DATA RATE

The data rate for HITAG S Transponder in Reader Talks First (RTF) Mode depends on the corresponding
UID REQUEST xx command.
For Transponder Talks First (TTF) Mode the data rate can be defined by configuration

Table 1

MODE CODING BIT RATE BIT LENGTH

HITAG S 2 kBit/s 64 T0
AC
4 kBit/s 32 T0
RTF
4 kBit/s 32 T0
Mode MC
8 kBit/s 16 T0
2 kBit/s 64 T0

HITAG S MC 4 kBit/s 32 T0
8 kBit/s 16 T0
TTF
2 kBit/s 64 T0
Mode Biphase 4 kBit/s 32 T0
8 kBit/s 16 T0

Note
T0...Carrier period time (1/125 kHz = 8 µs nominal).

14 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

7.4 Data Transmission: Read/Write Device → Afterwards the field is switched on again.
Transponder (Physical Layer) • ‘0’ and ‘1’ can be distinguished by the duration of T[0]
Data are transmitted to the transponder using Amplitude and T[1].
Shift Keying (ASK) modulation with a modulation index of • The end of the data transmission is characterised by an
100 %. When the field is switched off, the physical state is end of frame condition.
named low field, otherwise high field.
The following figure shows the data transmission from the
7.4.1 CODING Read/Write Device to the transponder.

Binary Pulse Length Coding (BPLC) is used to encode the

data stream.
All coded data Bits and the end of frame (EOF) condition
start with a low field of length Tg.

T[0] T[1] Tg TEOF

Data 0 0 1 1 EOF

Coded
Data

Voltage
on
RWD
Antenna

Voltage
on
Transponder
Antenna

Fig.7 Data Transmission Read/Write Device to Transponder.

15 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

SYMBOL DESCRIPTION DURATION

Tg Gap time 4..10 T0 (1)
T[0] Logic 0 Bit length 18..22 T0 (1)
T[1] Logic 1 Bit length 26..30 T0 (1)
TEOF Duration for end of frame condition > 36 T0

Note
1. This application specific values must be within this frame, but have to be optimized for each application depending
on rise and decay times of the RWD antenna voltage and the transponder antenna quality factor!

T0...Carrier period time (1/125 kHz = 8 µs nominal).

The average Bit rate from the Read/Write Device to the HITAG S Transponder therefore is:

2
Bit rate = ------------------------------- = 5,2kBit/s
T [0] + T[ 1]

Note: The end of each data sequence from the Read/Write Device to the HITAG S Transponder has to be a EOF
condition.

16 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

7.4.2 MODULATION DETAILS

T[0]
Tg

Tf Tr

a y b

Envelope of RWD Antenna Voltage

Fig.8 Modulation details.

x = 0.05 a, y = 0.95 a The following table shows two examples of modulation

timing parameters for typical short- and long range
m = (a - b) / (a + b).....Modulation index
applications.

SYMBOL MIN MAX SHORT RANGE LONG RANGE

SYMBOL
m 95% 100% APPLICATION APPLICATION
Tf 0 0.5 Tg Tg 6 T0 9 T0
Tr (1) 0 1 (T[0] – Tg) T[0] 20 T0 22 T0
T[1] 28 T0 28 T0
Note
Tf 3 T0 4 T0
1. This application specific value must be within this
range, but has to be optimized depending on Tr 4 T0 5 T0
transponder coil quality factor and Read performance
requirements. For high quality factor transponder coils,
a lower rise time Tr should be implemented
(recommended Tr = 0.5 (T[0] – Tg)) to achieve the
maximum possible performance.

17 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

8 CONFIGURATION
8.1 Configuration Page
Memory Page 1 contains the three configuration Bytes CON 0, CON 1 and CON 2 (see Chapter “Memory Organisation”).
Changes on the Configuration Bytes are effective after a power on reset of the HITAG S Transponder.

CON0: Memory Type Information

CON0
MSB LSB
RES 5 RES 4 RES 3 RES 2 RES 1 RES 0 MEMT 1 MEMT 0

The following table describes the Memory Type Bits MEMT 0 and MEMT 1 of configuration byte CON 0.

Table 2 Memory Type Bits MEMT 0 and MEMT 1

MEMT 1 MEMT 0 MEMORY TYPE
0 0 32 Bit
0 1 256 Bit
1 0 2048 Bit
1 1 Reserved

Bits RES 0 to RES 5 are reserved for future use. Only Read access to configuration byte CON 0 is possible.

CON 1: Mode and Lock Bits

CON1
MSB LSB
AUT TTFC TTFDR 1 TTFDR 0 TTFM 1 TTFM 0 LCON LKP

If the Authentication Bit AUT = ‘0’ the HITAG S Transponder IC is configured in Plain Mode and can be selected directly
by the SELECT (UID) command and the corresponding UID. For Bit AUT = ‘1’ the HITAG S Transponder IC is configured
in Authentication Mode and can only be Selected with the SELECT (UID) command and a following secure CHALLENGE
sequence (see also Chapters 10 “State Diagram” and 11 “Command Set”).

Table 3 Authentication Bit AUT

AUT HITAG S MODE
0 Plain
1 Authentication

18 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

The Transponder Talks First Coding Bit TTFC defines the used coding during transmitting data to the RWD. This effects
the TTF State only.

Table 4 Transponder Talks First Coding Bit TTFC

TTFC CODING IN TTF STATE
0 Manchester
1 Biphase

The Transponder Talks First Data Rate Bits TTFDR 0 and TTFDR 1 select the data rate used during transmission of data
to the RWD. This effects the TTF State only.

Table 5 Transponder Talks First Data Rate Bits TTFDR 0 and TTFDR 1
TTFDR 1 TTFDR 0 DATA RATE IN TTF STATE
0 0 4 kBit
0 1 8 kBit
1 0 2 kBit
1 1 2 kBit and Pigeon Race Standard

The Transponder Talks First Mode Bits TTFM 0 and TTFM 1 defines the number of Pages continuously transmitted to
the RWD. This effects the TTF State only.

Table 6 Transponder Talks First Mode Bits TTFM 0 and TTFM 1

TTFM 1 TTFM 0 PAGES TRANSMITTED IN TTF STATE

0 0 TTF Mode disabled (= RTF Mode)
0 1 Page 4, Page 5
1 0 Page 4, Page 5, Page 6, Page 7
1 1 Page 4

The Lock Configuration Bit LCON defines the access rights on the configuration Bytes CON 1 and CON 2. This Bit is one
time programmable (OTP).

Table 7 Lock Configuration Bit LCON

LCON ACCESS RIGHT CON 1 AND CON 2
0 Read / Write
1 CON 1: Read Only.
CON 2: OTP

19 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

The Lock Key and Password Bit LKP defines the access rights of the PWDH 0 Byte of Page 1, password low Bytes and
key high Bytes of Page 2 and key low Bytes of Page 3 when configured in Authentication Mode. In Plain Mode this Bit
can be used to lock the user data of Page 2 and Page 3.

Table 8 Lock Key and Password Bit LKP

LKP ACCESS RIGHT KEY AND PASSWORD/PAGE 2 AND PAGE 3

0 Read / Write
1 Read Only in Plain Mode
No Access in Authentication Mode

Attention: In order to prevent further access to key and password, the following procedure must take place: After setting
Bit LKP to ‘1’ the Lock Configuration Bit LCON must be set to ‘1’, because the Bit LKP has no OTP functionality!

CON 2: Memory Lock Bits

CON2
MSB LSB
LCK 7 LCK 6 LCK 5 LCK 4 LCK 3 LCK 2 LCK 1 LCK 0

Table 9 Description of Memory Lock Bits

BIT SYMBOL FUNCTION ACCESS RIGHTS COMMENT

7 LCK 7 Lock Page 4 and Page 5 0...Read / Write OTP if LCON = ‘1’
1...Read Only If Pigeon Race Standard is enabled
(TTFDR 0 = TTFDR 1 = ‘1’) 16 Bits (Data 3
u. Data 2) of Page 5 remain still
Read/Write accessible for LCK 7 = ‘1’
6 LCK 6 Lock Page 6 and Page 7 0...Read / Write OTP if LCON = ‘1’
1...Read Only
5 LCK 5 Lock Page 8 – Page 11 0...Read / Write OTP if LCON = ‘1’
1...Read Only
4 LCK 4 Lock Page 12 – Page 15 0...Read / Write OTP if LCON = ‘1’
1...Read Only
3 LCK 3 Lock Page 16 – Page 23 0...Read / Write OTP if LCON = ‘1’
1...Read Only
2 LCK 2 Lock Page 24 – Page 31 0...Read / Write OTP if LCON = ‘1’
1...Read Only
1 LCK 1 Lock Page 32 – Page 47 0...Read / Write OTP if LCON = ‘1’
1...Read Only
0 LCK 0 Lock Page 48 – Page 63 0...Read / Write OTP if LCON = ‘1’
1...Read Only

20 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

8.2 Delivery Configuration

8.2.1 HITAG S32
This delivery configuration is valid for the following HITAG S 32 types:
• HTS IC H32 01EW/V4
• HTS MO H32 01EV
• HTS FC H32 01EV/DH

MSByte LSByte
MSB LSB MSB LSB MSB LSB MSB LSB
UID 3 UID 2 UID 1 UID 0

The 32 Bit Unique Identifier (UID) is programmed during the manufacturing process. Access rights: Read Only (RO).
On a Select (UID) command the HITAG S 32 Transponder IC sends back three Reserved Bytes and the Byte CON 0
containing the Memory Type Information.

MSByte LSByte
MSB LSB MSB LSB MSB LSB MSB LSB
X X X CON0

CON 0
MSB LSB
X X X X X X 0 0

The content of Bits and Bytes marked with ‘X’ are not defined at delivery!

21 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

8.2.2 HITAG S256

This delivery configuration is valid for the following HITAG S 256 types:
• HTS IC H56 01EW/V4
• HTS MO H56 01EV
• HTS FC H56 01EV/DH

MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x00 UID 3 UID 2 UID 1 UID 0
0x01 0xAA 0x00 0x00 CON 0
0x02 0x4E 0x4F 0x54 0x48
0x03 0x52 0x4B 0x49 0x4D
0x04 X X X X
0x05 X X X X
0x06 X X X X
0x07 X X X X

CON 0
MSB LSB
X X X X X X 0 1

The content of Bits and Bytes marked with ‘X’ are not defined at delivery!
• The 32 Bit Unique Identifier (UID) is programmed during the manufacturing process.
• Modes: Reader Talks First (RTF), Plain
• Access Rights:
– UID: Read Only
– Page 1: Read/Write with exception of byte CON 0 (Read Only)
– Page 2 – Page 7: Read/Write

22 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

8.2.3 HITAG S2048

This delivery configuration is valid for the following HITAG S 2048 types:
• HTS IC H48 01EW/V4
• HTS MO H48 01EV
• HTS FC H48 01EV/DH

MSByte LSByte
Page Address MSB LSB MSB LSB MSB LSB MSB LSB
0x00 UID 3 UID 2 UID 1 UID 0
0x01 0xAA 0x00 0x00 CON 0
0x02 0x4E 0x4F 0x54 0x48
0x03 0x52 0x4B 0x49 0x4D
0x04 X X X X
0x05 X X X X

0x3E X X X X
0x3F X X X X

CON 0
MSB LSB
X X X X X X 1 0

The content of Bits and Bytes marked with ‘X’ are not defined at delivery!
• The 32 Bit Unique Identifier (UID) is programmed during the manufacturing process.
• Modes: Reader Talks First (RTF), Plain
• Access Rights:
– UID: Read Only
– Page 1: Read/Write with exception of byte CON 0 (Read Only)
– Page 2 – Page 63: Read/Write

23 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

9 PROTOCOL TIMING
9.1 Read/Write Device waiting time before sending the first command

Coded
Data
RWD
twfc

Voltage y a
on
RWD
Antenna

y = 0.95 a

Fig.9 Read/Write Device waiting time before sending the first command.

After switching on the powering field, the Read/Write Device has to wait at least the minimum time twfc = 280 T0 before
sending the first command. The first command must not be sent later than the maximum time twfc = 5000 T0.

Table 10

MIN TYP MAX UNIT

twfc 280 5000 T0

24 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

9.2 Read/Write Device waiting time before sending a subsequent command

Data twsc
RWD 0 1

Coded
Data
RWD

Voltage
on
RWD
Antenna

Voltage
on
Transponder
Antenna

Coded
Data(MC)
Transponder

Data 1 0
Transponder

Fig.10 Read/Write Device waiting time before sending a subsequent command.

When the Read/Write Device has received the response from the HITAG S Transponder to a previous command, the
RWD has to wait at least the minimum time twsc = 90 T0 before sending a subsequent command or Write data after a
Write command. The subsequent command or Write data must not be sent later than the maximum time twsc = 5000 T0.

Table 11

MIN TYP MAX UNIT

twsc 90 5000 T0

25 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

9.3 Reset Time

The powering field must be switched off for at least treset = 4.8 ms to generate a reset of the HITAG S IC and to enter it
into Power Off State.

treset
Voltage x a
on
RWD
Antenna

x = 0.05 a

Fig.11 Reset Time.

Table 12

MIN TYP MAX UNIT

treset 4.8 ms

26 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

9.4 HITAG S Transponder waiting time before transmitting a response after receiving an EOF

twresp

Data
1 EOF
RWD
Coded
Data
RWD

Voltage
on
RWD
Antenna

Voltage
on
Transponder
Antenna

Coded
Data(MC)
Transponder

Data
SOF 1
Transponder

Fig.12 HITAG S Transponder waiting time before transmitting a response after receiving an EOF.

When receiving a End of Frame (EOF) condition from the Read/Write Device, the transponder waits twresp before
transmitting data. The values given below are specific to transmission system parameters e.g. coil quality factor, RWD
antenna quality factor.

Table 13

MIN TYP MAX UNIT

twresp (1) 204 208 212 T0

Note
1. Valid for coil quality factors Qcoil < 30.

27 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

9.5 HITAG S Transponder programming time

tprog

Write Data EOF

RWD

Transponder

SOF ACK

Fig.13 HITAG S Transponder programming time.

When receiving the EOF of the write data from the Read/Write Device, the transponder waits tprog before transmitting the
SOF and acknowledge to confirm correct programming.

Table 14

MIN TYP MAX UNIT

tprog 716 721 726 T0

28 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

9.6 HITAG S Transponder waiting time before transmitting data in TTF Mode

Coded
Data
RWD t TTF

Voltage y aa
on
RWD
Antenna

Voltage
on
Transponder
Antenna

Coded
Data
(MC)
Data 1 1

y = 0.95 a

Fig.14 HITAG S Transponder waiting time before transmitting data in TTF Mode.

After switching on the powering field, the HITAG S Transponder waits a time tTTF before transmitting data if it is
configured in TTF Mode.

Table 15

MIN TYP MAX UNIT

tTTF 565 585 625 T0

29 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

9.7 HITAG S Transponder Mode switching time

UID REQUEST xx
Coded
Data
RWD
t switch

Voltage a
y
on
RWD
Antenna

y = 0.95 a

Fig.15 HITAG S Transponder Mode switching time.

With an UID REQUEST xx command starting with the first bit after tswitch, a HITAG S Transponder configured in TTF
Mode can be switched into RTF Mode. The Read/Write Device has to wait at least the minimum time tswitch = 280 T0 and
must not wait longer than the maximum time tswitch = 520 T0. The HITAG S Transponder responds to this command with
the UID and changes into Init State.

Table 16

MIN TYP MAX UNIT

tswitch 280 400 520 T0

30 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

10 STATE DIAGRAM Transponder Talks First (TTF)

10.1 General Description of States The HITAG S Transponder enters this State when
configured in TTF Mode if no UID REQUEST xx command
Power Off
is received within the Mode switch window. Once entered
The powering magnetic field is switched off or the this State, the HITAG S Transponder continuously
HITAG S Transponder is out of field. transmits data with configurable data coding, data rate and
data length.
Ready
After start up phase, the HITAG S Transponder is ready to
receive the first command.
Init
The HITAG S Transponder enters this State after the first
UID REQUEST xx command. In this State the Response
Protocol Mode (see Chapter11 “Command Set”) may be
changed by further UID REQUEST xx commands. If there
are several HITAG S Transponders in the field of the RWD
antenna at the same time, the AC SEQUENCE can be
started to determine the UID of every HITAG S
Transponder.

Authenticate
The HITAG S Transponder enters this State after a valid
SELECT (UID) command when configured in
Authentication Mode. After an encrypted CHALLENGE
Authentication the HITAG S Transponder changes into the
Selected State.

Selected
The HITAG S Transponder enters this State after a valid
SELECT (UID) command when configured in Plain Mode
or a SELECT (UID) and CHALLENGE sequence when
configured in Authentication Mode. Only one HITAG S
Transponder in the field of the RWD antenna can be
Selected at the same time. In this State, Read and Write
operations are possible. Data Transmission is not
encrypted even if configured in Authentication Mode.

Quiet
The HITAG S Transponder enters this State after a
SELECT_QUIET command in Init State or a QUIET
command in Selected State. In this State, the HITAG S
Transponder will not answer to any command. Switching
off the powering magnetic field or moving the HITAG S
Transponder out of field enters it into the Power Off State.

31 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

10.2 HITAG S 32

Power Off

In Field

Ready

UID REQUEST xx
Transmission
error
UID REQUEST xx
Any other command AC SEQUENCE
or Init SELECT (UID) command with wrong UID
transmission error SELECT_QUIET (UID) command with wrong UID
Any other command

SELECT (UID)

Selected SELECT_QUIET (UID)

QUIET

Quiet Any command

Fig.16 State diagram HITAG S 32.

Note:
Switching off the powering magnetic field or moving the HITAG S Transponder out of the RWD antenna field, enters the
HITAG S Transponder into the Power Off State, independently of its actual State.

32 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

10.3 HITAG S 256 and HITAG S 2048

Power Off A : TTF Mode enabled and UID REQUESTxx

command not sent within switch window

B : TTF Mode enabled : UID REQUESTxx

In Field command sent within switch window
or
Transponder TTF Mode disabled : UID REQUESTxx
Talks
A Ready
First Bit AUT: See chapter ’Configuration’

Any command Transmission

B
error
UID REQUEST xx
AC SEQUENCE
lnit SELECT (UID) command with wrong UID
Any other command, SELECT_QUIET (UID) command with wrong UID
transmission error or Any other command
wrong keys

SELECT (UID)
&
AUT=1 SELECT (UID)
Authenticate
&
AUT = 0

CHALLENGE

READ PAGE
Any other command
READ BLOCK SELECT_QUIET (UID)
or transmission error Selected
WRITE PAGE
WRITE BLOCK

QUIET

Quiet Any command

Fig.17 State diagram HITAG S 256 and HITAG S 2048.

Note:
Switching off the powering magnetic field or moving the HITAG S Transponder out of the RWD antenna field, enters the
HITAG S Transponder into the Power Off State, independently of its actual State.

33 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11 COMMAND SET
11.1 General Comments
For HITAG S 32 only the commands described in the corresponding State diagram are valid commands.

11.2 UID REQUEST xx

MSB LSB
RWD: UID REQUEST xx EOF

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB
Transponder twresp SOF UID 0 UID 1 UID 2 UID 3
N= 1.............8 9....k...16 17.......24 25.......32

N...physical Bit position during air transmission. N=25 is the bit with the highest valence 231.
k...Any collision position (see command AC SEQUENCE)
After the RWD transmits this command, all HITAG S Transponders located in the field of the RWD antenna respond with
a start of frame pattern followed by the corresponding 32 Bit UID. The complete response of the HITAG S Transponder
is transmitted in Anticollision Coding (AC, see Section 7.3.1 “Coding”).

Table 17 Coding

MSB LSB RESPONSE PROTOCOL MODE

UID REQUEST Std 00110 Standard
UID REQUEST Adv 1100x Advanced
UID REQUEST FAdv 11010 Fast Advanced

Note
1. x... can be ‘0’ or ‘1’

The Response Protocol Mode defined by the corresponding UID Request command determines the coding, data rate
and the SOF pattern of the HITAG S Transponder response.

Table 18

RESPONSE PROTOCOL MODE SOF CODING DATA RATE

Standard ‘1’ AC 2 kBit/s
Advanced ‘111’ AC 2 kBit/s
Fast Advanced ‘111’ AC 4 kBit/s

A HITAG S Transponder in Ready State changes into Init State after receiving a correct UID REQUEST xx command.
A HITAG S Transponder being already in Init State remains in Init State after receiving a further correct
UID REQUEST xx command.
Always the latest UID REQUEST xx command defines the Response Protocol Mode for the following commands.

34 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11.3 AC SEQUENCE
If more than one HITAG S Transponder is in the field of the antenna a special designed RWD detects the first collision
at the Bit position N = k of the UID response. As a result the RWD starts an Anticollision Sequence (AC SEQUENCE).
This command consists of a 5 Bit number (k4 to k0) describing the physical Bit position k where the collision occurred
followed by (k - 1) Bits of the detected UID and a Bit (one or zero) at the collision position. An 8 Bit CRC (cyclic
redundancy check) of this sequence is also sent to the transponders.

MSB LSB 1................k MSB LSB

RWD: k4 k3 k2 k1 k0 k Bits of UID CRC 8 EOF

Transponder twresp SOF (32 – k) Bits of UID

N= k+1.............................32

After transmitting this command, all HITAG S Transponders which first k Bits of the own UID match with the k received
UID Bits, answer with the SOF and the rest of their own UID.
If a collision occurs again the described cycle has to be repeated until one valid UID of the transponders in the field is
determined.
The complete response of the HITAG S Transponder is transmitted in Anticollision Coding (AC).

Table 19

RESPONSE PROTOCOL MODE SOF CODING DATA RATE

Standard ‘1’ AC 2 kBit/s
Advanced ‘111’ AC 2 kBit/s
Fast Advanced ‘111’ AC 4 kBit/s

During the AC SEQUENCE commands the HITAG S Transponder stays in Init State. Even those HITAG S
Transponders where the k received Bits of the UID do not match remain in Init State.

35 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11.4 SELECT (UID)

The SELECT (UID) command consists of 5 Zero-Bits followed by the determined 32 Bit UID and an 8 Bit Cyclic
Redundancy Check (CRC). The selected transponder then responds with a start of frame pattern (SOF) followed by the
content of the Configuration Page and depending on the Response Protocol Mode with an 8 Bit CRC.

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB

RWD: 00000 UID 0 UID 1 UID 2 UID 3 CRC 8 EOF

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB

Transponder twresp SOF CON 0 CON 1 CON 2 Reserved CRC 8

The complete response of the HITAG S Transponder is transmitted in Manchester Coding (MC).
In Plain Mode the MSByte of Page 1 is a Reserved Byte, in Authentication Mode this Byte contains the password high
Byte PWDH 0. At the response on a SELECT (UID) command of a HITAG S Transponder configured in Authentication
Mode (Bit AUT = 1, keys and password locked), this PWDH 0 Byte is dissolved by ‘1’ Bits.

Table 20

RESPONSE PROTOCOL MODE SOF CRC8 CODING DATA RATE

Standard ‘1’ no MC 4 kBit/s
Advanced ‘111111’ yes MC 4 kBit/s
Fast Advanced ‘111111’ yes MC 8 kBit/s

In Plain Mode (Bit AUT = 0) the HITAG S Transponder changes into Selected State after receiving a correct
SELECT (UID) command.
In Authentication Mode (Bit AUT = 1) the HITAG S Transponder changes into Authenticate State after receiving a correct
SELECT (UID) command and waits for the CHALLENGE command.

36 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11.5 CHALLENGE
By means of the response of the SELECT (UID) command the RWD detects that the HITAG S Transponder is configured
in Authentication Mode (Bit AUT = 1) and starts the encrypted Challenge sequence.

MSB LSB MSB LSB

RWD: 32 Bit RND 32 Bit Secret Data EOF

MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB
Transponder twresp SOF CON 2 PWDH 0 PWDL 0 PWDL 1 CRC 8
32 Bit Secret Response

The Read/Write Device sends a 32 Bit Random Number (RND) and a 32 Bit secret data stream to the transponder. In
order to perform the secret data stream, a security co-processor is required on the read/write Device. For more
information please contact us at - [email protected].
If the received secret data stream corresponds with the secret data stream calculated by the HITAG S Transponder, a
32 Bit Secret Response (secret data stream encrypting the configuration byte CON 2, password high byte PWDH 0 and
password low Bytes PWDL 0 and PWDL 1) is transmitted after the SOF.
The response of the HITAG S Transponder is transmitted in Manchester Coding (MC).

Table 21

RESPONSE PROTOCOL MODE SOF CRC8 CODING DATA RATE

Standard ‘1’ no MC 4 kBit/s
Advanced ‘111111’ yes MC 4 kBit/s
Fast Advanced ‘111111’ yes MC 8 kBit/s

A HITAG S Transponder configured in Authentication Mode changes from Authenticate State into Selected State only
after a correct CHALLENGE Sequence.
Note: Even with AUT=1 further data transmission for read and write commands is done in plain mode.

37 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11.6 SELECT_QUIET (UID)

With this command a HITAG S Transponder in Init State can be directly entered into the Quiet State.

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB
RWD: 00000 UID 0 UID 1 UID 2 UID 3 0 CRC 8 EOF

ACK
Transponder twresp SOF 01

The ‘start of frame’ (SOF) pattern and the acknowledge (ACK) is transmitted in Manchester Coding.

Table 22

RESPONSE PROTOCOL MODE SOF CODING DATA RATE

Standard ‘1’ MC 4 kBit/s
Advanced ‘111111’ MC 4 kBit/s
Fast Advanced ‘111111’ MC 8 kBit/s

A HITAG S Transponder, once entered the Quiet State can only be enabled by switching off the powering magnetic field
for at least a time treset or the HITAG S Transponder must be moved out of the antenna field (Power Off State).

11.7 READ PAGE

After a HITAG S Transponder was selected by the corresponding SELECT (UID) command (or SELECT (UID) and
CHALLENGE for Authentication Mode) a read operation of data stored on the EEPROM can be performed. After
transmitting the READ PAGE command, the Page address PADR (8 Bits) and the 8 Bit Cyclic Redundancy Check
CRC 8, the HITAG S Transponder responds with the SOF and 32 Bits data of the corresponding Page.

MSB LSB MSB LSB

RWD: 1100 PADR CRC 8 EOF

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB
Transponder twresp SOF Data 0 Data 1 Data 2 Data3 CRC 8

The highest Page address (PADR) is 0x 3F, therefore the two highest Bits must be ‘0’.
Table 23

RESPONSE PROTOCOL MODE SOF CRC8 CODING DATA RATE

Standard ‘1’ no MC 4 kBit/s
Advanced ‘111111’ yes MC 4 kBit/s
Fast Advanced ‘111111’ yes MC 8 kBit/s

38 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11.8 READ BLOCK

After transmitting the READ BLOCK command, the Page address PADR (8 Bits) within a block and the 8 Bit Cyclic
Redundancy Check CRC 8, the HITAG S Transponder responds with the SOF and 32 up to 128 Bits of data beginning
with the addressed Page within a Block to the last Page of the corresponding Block.

MSB LSB MSB LSB

RWD: 1 1 0 1 PADR CRC 8 EOF

LSByte MSByte LSByte MSByte

MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB

Transponder twresp SOF Data 0 Data 1 Data 2 Data3 Data 0 Data 3 CRC 8

Table 24

RESPONSE PROTOCOL MODE SOF CRC8 CODING DATA RATE

Standard ‘1’ no MC 4 kBit/s
Advanced ‘111111’ yes MC 4 kBit/s
Fast Advanced ‘111111’ yes MC 8 kBit/s

39 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11.9 WRITE PAGE

After a HITAG S Transponder was selected by the corresponding SELECT (UID) command (or SELECT (UID) and
CHALLENGE for Authentication Mode) a write operation of data onto the memory can be carried out. Least significant
Byte is always transmitted first. E.g. in order to change the configuration page the byte Con0 would have to be transmitted
first.
After transmitting the WRITE PAGE command, the Page address PADR (8 Bits) and the 8 Bit Cyclic Redundancy Check
(CRC 8), the HITAG S Transponder responds with the SOF and an acknowledge (ACK) to confirm the reception of a
correct WRITE PAGE command. After the waiting time twsc the RWD transmits the write data with CRC 8. After the
programming time tprog the HITAG S Transponder responds with a SOF and an acknowledge to confirm correct
programming.

MSB LSB MSB LSB

RWD: 1000 PADR CRC 8 EOF twsc
ACK
Transponder: twresp SOF 01

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB
RWD: Data 0 Data 1 Data 2 Data3 CRC 8 EOF

ACK
Transponder: twresp SOF 01

Table 25

RESPONSE PROTOCOL MODE SOF CODING DATA RATE

Standard ‘1’ MC 4 kBit/s
Advanced ‘111111’ MC 4 kBit/s
Fast Advanced ‘111111’ MC 8 kBit/s

40 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11.10 WRITE BLOCK

After transmitting the WRITE BLOCK command, the Page address PADR (8 Bits) within a Block and the 8 Bit Cyclic
Redundancy Check (CRC 8), the HITAG S Transponder responds with the SOF and an acknowledge (ACK) to confirm
the reception of a correct WRITE BLOCK command. After the waiting time twsc the RWD transmits the write data with
CRC 8 Page by Page (1 to 4 Pages depending on the Page address PADR within the corresponding block). After the
programming time tprog the HITAG S Transponder responds with a SOF and an acknowledge to confirm correct
programming of each Page.

MSB LSB MSB LSB

RWD: 1001 PADR CRC 8 EOF twsc
ACK
Transponder: twresp SOF 01

Write Data for Page with Page address: PADR

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB
RWD: Data 0 Data 1 Data 2 Data3 CRC 8 EOF twsc
ACK
Transponder: tprog SOF 01

Write Data for Page with Page address: PADR + 1

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB
RWD: Data 0 Data 1 Data 2 Data3 CRC 8 EOF twsc
ACK
Transponder: tprog SOF 01

Write Data for Page with Page address: PADR + 2

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB
RWD: Data 0 Data 1 Data 2 Data3 CRC 8 EOF twsc
ACK
Transponder: tprog SOF 01

Write Data for Page with Page address: PADR + 3

LSByte MSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB
RWD: Data 0 Data 1 Data 2 Data3 CRC 8 EOF twsc
ACK
Transponder: tprog SOF 01

Table 26
RESPONSE PROTOCOL MODE SOF CODING DATA RATE
Standard ‘1’ MC 4 kBit/s
Advanced ‘111111’ MC 4 kBit/s
Fast Advanced ‘111111’ MC 8 kBit/s

41 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

11.11 QUIET
With this command a Selected HITAG S Transponder can be entered into the Quiet State.
A valid Page address PADR (8 Bits) and Cyclic Redundancy Check (CRC 8) must be sent for command structure
reasons only.

MSB LSB MSB LSB

RWD: 0111 PADR CRC 8 EOF
ACK
Transponder: twresp SOF 01

After the response wait time twresp the HITAG S Transponder responds with a SOF and an acknowledge to confirm
entering the Quiet State.

Table 27

RESPONSE PROTOCOL MODE SOF CODING DATA RATE

Standard ‘1’ MC 4 kBit/s
Advanced ‘111111’ MC 4 kBit/s
Fast Advanced ‘111111’ MC 8 kBit/s

A HITAG S Transponder, once entered the Quiet State can only be reactivated after switching off the powering magnetic
field for at least a time treset or the HITAG S Transponder must be moved out of the antenna field (Power Off State).

42 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

12 TRANSPONDER TALKS FIRST (TTF) MODE

This special mode of the HITAG S Transponder enables data transmission to a Read/Write Device without sending any
command. The TTF Mode can be enabled/disabled and configured by setting the corresponding Bits of the Configuration
byte CON 1 (see Chapter 8 “Configuration”).
A HITAG S Transponder configured in TTF Mode can be switched temporarily into Reader Talks First (RTF) Mode by
sending a UID REQUEST xx command within a defined window after turning on the powering field. The HITAG S
Transponder will leave this temporarily RTF Mode after switching off the powering field or moving it out of the RWD
antenna field.
If the HITAG S Transponder is configured in TTF Mode and no Mode switch command is sent by the RWD within the
defined switch window it enters the TTF State. Depending on the configuration, the HITAG S Transponder transmits the
data with different coding, data rate and data length. It is recommended to use some of the data bits as a well defined
start sequence.

12.1 32 Bit TTF Mode

Configuration:

TTFM 1 TTFM 0
1 1

In this Mode, the HITAG S Transponder continuously transmits the data content of Page 4.

Page 4 Page 4
LSByte MSByte LSByte LSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB

Transponder: tTTF Data 0 Data 1 Data 2 Data3 Data 0 Data 1 Data 2 Data3 Data 0

The data rate and the data coding can be chosen independently by configuration Bits TTFC, TTFDR 0 and TTFDR 1.

12.2 64 Bit TTF Mode

Configuration:

TTFM 1 TTFM 0
0 1

In this Mode, the HITAG S Transponder continuously transmits the data content of Page 4 and Page 5.

Page 4 Page 5 Page 4

LSByte MSByte LSByte LSByte
MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB MSB LSB

Transponder: tTTF Data 0 Data 1 Data 2 Data3 Data 0 Data 1 Data 2 Data3 Data 0

The data rate and the data coding can be chosen independently by configuration Bits TTFC, TTFDR 0 and TTFDR 1.
Note: This Mode may be used for Pigeon race standards.

43 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

12.3 128 Bit TTF Mode

Configuration:

TTFM 1 TTFM 0
1 0

In this Mode, the HITAG S Transponder continuously transmits the data content of Page 4, Page 5, Page 6 and Page 7.

Page 4 Page 5 Page 6 Page 7 Page 4

LSByte MSByte LSByte MSByte LSByte MSByte LSByte MSByte LSByte MSByte
Transponder: tTTF

The data rate and the data coding can be chosen independently by configuration Bits TTFC, TTFDR 0 and TTFDR 1.
Note: This Mode may be used for ISO 11784/85 Animal ID standard and German Waste Management standard (BDE)
respectively.

44 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

13 DATA INTEGRITY / CALCULATION OF CRC

The following explanations show the features of the
HITAG S protocol to protect read and write access to
transponders from undetected errors.

13.1 Data Transmission: Read/Write Device to

HITAG S Transponder
Every data stream transmitted by the Read/Write Device to
the HITAG S Transponder includes an 8 Bit Cyclic
Redundancy Check (CRC 8).
The data stream is first checked for data errors by the
HITAG S Transponder and then executed.
The generator polynomial for the CRC 8 is:
u8 + u4 + u3 + u2 + 1 = 0x1D
The CRC pre set value is: 0xFF

13.2 Data Transmission: HITAG S Transponder to

Read/Write Device
13.2.1 STANDARD RESPONSE PROTOCOL MODE
The HITAG S Transponder response does not include any
check sum because of flexibility reasons. To get the data
integrity required by the application, check sums have to
be calculated by the user software and stored together
with the information in the transponder memory. This
seems uncomfortable, because the check sums use a little
part of the available memory space in the transponder.
The advantage of this solution is the flexibility to choose
large checksums for applications requiring high data
integrity and smaller check sums for applications requiring
short access times which means short protocols.

13.2.2 ADVANCED/FAST ADVANCED RESPONSE

PROTOCOL MODE
In Advanced – and Fast Advanced Response Protocol
Mode the response on a SELECT (UID), CHALLENGE,
READ PAGE, READ BLOCK command, includes a CRC 8
check sum.
The generator polynomial for the CRC 8 is:
u8 + u4 + u3 + u2 + 1 = 0x1D
The CRC pre set value is: 0xFF

45 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

13.3 Source Code for CRC-Checksum

The following lines of C-Code show an example for a CRC-Calculation.

#include <stdio.h>

#define CRC_PRESET 0xFF

#define CRC_POLYNOM 0x1D

void calc_crc(unsigned char * crc,

unsigned char data,
unsigned char Bitcount)
{
*crc ^= data; // crc = crc (exor) data
do
{
if( *crc & 0x80 ) // if (MSB-CRC == 1)
{
*crc<<=1; // CRC = CRC Bit-shift left
*crc ^= CRC_POLYNOM; // CRC = CRC (exor) CRC_POLYNOM
}
else
{
*crc<<=1; // CRC = CRC Bit-shift left
}

printf("CRC: %02X ", *crc); // output result step by step

} while(--Bitcount);
printf("\n");
}

void main(void)
{
const cmd=0x00; /* 5 Bit command, aligned to MSB */
const ident[4]={0x2C, 0x68, 0x0D, 0xB4 };

unsigned char crc;

int i;

crc = CRC_PRESET; /* initialize crc algorithm */

calc_crc(&crc, cmd, 5); /* compute 5 crc Bits only */

for(i=0; i<4; i++)

calc_crc(&crc, ident[i], 8);

/* crc = 0x9E at this point */

printf("%02X\n",crc);

getch();

46 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

14 ABBREVIATIONS

ABBREVIATION DEFINITION
AC Anticollision Code
ASK Amplitude Shift Keying
BC Biphase Code
BPLC Binary Pulse Length Coding
CRC Cyclic Redundancy Check
EEPROM Electrically Erasable Programmable Memory
EOF End of frame
LSB Least Significant Bit
LSByte Least Significant Byte
m Modulation Index
MC Manchester Code
MSB Most Significant Bit
MSByte Most Significant Byte
NA No Access
OTP One Time Programmable
PID Product Identifier
RND Random Number
RO Read Only
RTF Reader Talks First
R/W Read/Write
RWD Read/Write Device
SOF Start of Frame
TTF Transponder Talks First
UID Unique Identifier

47 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

15 DATA SHEET STATUS

DATA SHEET PRODUCT

LEVEL DEFINITION
STATUS(1) STATUS(2)(3)
I Objective data Development This data sheet contains data from the objective specification for product
development. Philips Semiconductors reserves the right to change the
specification in any manner without notice.
II Preliminary data Qualification This data sheet contains data from the preliminary specification.
Supplementary data will be published at a later date. Philips
Semiconductors reserves the right to change the specification without
notice, in order to improve the design and supply the best possible
product.
III Product data Production This data sheet contains data from the product specification. Philips
Semiconductors reserves the right to make changes at any time in order
to improve the design, manufacturing and supply. Relevant changes will
be communicated via a Customer Product/Process Change Notification
(CPCN).

Notes
1. Please consult the most recently issued data sheet before initiating or completing a design.
2. The product status of the device(s) described in this data sheet may have changed since this data sheet was
published. The latest information is available on the Internet at URL http://www.semiconductors.philips.com.
3. For data sheets describing multiple type numbers, the highest-level product status determines the data sheet status.

16 DEFINITIONS
Short-form specification  The data in a short-form specification is extracted from a full data sheet with the same type
number and title. For detailed information see the relevant data sheet or data handbook.
Limiting values definition  Limiting values given are in accordance with the Absolute Maximum Rating System
(IEC 60134). Stress above one or more of the limiting values may cause permanent damage to the device. These are
stress ratings only and operation of the device at these or at any other conditions above those given in the Characteristics
sections of the specification is not implied. Exposure to limiting values for extended periods may affect device reliability.
Application information  Applications that are described herein for any of these products are for illustrative purposes
only. Philips Semiconductors make no representation or warranty that such applications will be suitable for the specified
use without further testing or modification.

17 DISCLAIMERS
Life support applications  These products are not designed for use in life support appliances, devices, or systems
where malfunction of these products can reasonably be expected to result in personal injury. Philips Semiconductors
customers using or selling these products for use in such applications do so at their own risk and agree to fully indemnify
Philips Semiconductors for any damages resulting from such application.
Right to make changes  Philips Semiconductors reserves the right to make changes in the products - including
circuits, standard cells, and/or software - described or contained herein in order to improve design and/or performance.
When the product is in full production (status ‘Production’), relevant changes will be communicated via a Customer
Product/Process Change Notification (CPCN). Philips Semiconductors assumes no responsibility or liability for the use
of any of these products, conveys no licence or title under any patent, copyright, or mask work right to these products,
and makes no representations or warranties that these products are free from patent, copyright, or mask work right
infringement, unless otherwise specified.

48 PUBLIC INFORMATION
Philips Semiconductors Product Specification Revision 3.0 2003 November 12

HITAG S HTS IC H32/HTS IC H56/HTS IC H48

18 REVISION HISTORY
Table 28 HTS IC H32/HTS IC H56/HTS IC H48 Revision History

REVISION DATE CPCN PAGE DESCRIPTION

1.0 2002 August - Initial version.

1.1 2002 October - Contents updated.

Complete Public Mode changed into Plain Mode.
Document
29 to 33 Data Rate corrected for Manchester Coding. Delivery
Configuration added.
1.2 2003 January - Contents updated.
17 Values for modulation details completed.
24 to 30 Chapter 9 “Protocol timing” modified and final timing parameters
added.
2.0 2003 Sept - Contents updated. Status now -> Preliminary specification
8 added new Section 6.1.1 “Product identifier (PID)”
24 to 30 Timing parameter updated.
3.0 2003 Nov - Contents updated. Status now -> Product specification
3 Section 1.1 “Protocol”
- added new bullet: “Fast Anticollision Protocol ...”
3 Section 1.3 “Supported Standards”
- rewording

49 PUBLIC INFORMATION
Philips Semiconductors – a worldwide company

Contact information

For additional information please visit http://www.semiconductors.philips.com. Fax: +31 40 27 24825

For sales offices addresses send e-mail to: [email protected].

© Koninklijke Philips Electronics N.V. 2002 SCA74

All rights are reserved. Reproduction in whole or in part is prohibited without the prior written consent of the copyright owner.
The information presented in this document does not form part of any quotation or contract, is believed to be accurate and reliable and may be changed
without notice. No liability will be accepted by the publisher for any consequence of its use. Publication thereof does not convey nor imply any license
under patent- or other industrial or intellectual property rights.