WM710xx – Secure F-RAM with Gen-2 RFID
GEN2 WM710XX MEMORY BANKS
The RFID memory banks reside in Ramtron’s non-volatile F-RAM memory. F-RAM brings many benefits to
the WM710xx. The first benefit is the size of the memory itself – up to 16k-bit, most of which is available in
the USER memory bank. F-RAM’s impact on the Gen2 protocol is most dramatically seen when writing to
WM710xx memory. Unlike EEPROM memory, no charge pump or memory soak time is required to write to
WM710xx memory, resulting in zero time and zero power penalties. The write cycle is completed
immediately, allowing an interrogator to continue writing additional data to memory with no time penalty
incurred due to the memory itself. A comparison between F-RAM and EEPROM memories is shown in Figure
3. The figure shows the minimum number of Gen2 instructions required to perform a SELECT,
INVENTORY, and ACCESS sequence of commands to write a data word to memory. The same interrogator
command sequence is transmitted to the WM710xx and an EEPROM-based RFID. The effect of the EEPROM
time penalty is shown within the context of the protocol.
Figure 3. Gen2 Memory Write Cycle Comparison: F-RAM vs. EEPROM Memories
RESERVED: KILL Password:
The kill password provides a mechanism to permanently disable the WM710xx RFID from responding to any
and all Gen2 interrogator commands. The mandatory KILL command can be issued by a RFID interrogator in
either the OPEN or SECURED states. The WM710xx is permanently killed through a four-instruction
sequence of REQRN and KILL commands as detailed in the Gen2 standard. The KILL password is a 32-bit
value stored as 2 16-bit data words in reserved memory. The most significant KILL password is stored in
reserved memory bank address 0x00 with the least significant word stored in reserved memory bank address
0x01. The kill function can be permanently disabled by setting both KILL password words to 0x0000, and
permanently locking the KILL password in the reserved memory bank. Once the kill password has been set, it
should be permanently locked using the LOCK command. The WM710xx is shipped from the factory with the
kill password memory unlocked.
RESERVED: ACCESS Password:
The access password provides a security mechanism to prevent unauthorized RFID interrogators from writing
to WM710xx memory. Non-zero access passwords require the WM710xx be placed in the SECURED state
prior to writing to it. This is accomplished through four consecutive REQRN and ACCESS commands as
described in the Gen2 standard. An access password with a value of zero requires no authentication prior to
writing to WM710xx memory. The ACCESS password is a 32-bit value stored as 2 16-bit data words in
reserved memory. The most significant ACCESS password is stored in reserved memory bank address 0x02
with the least significant word stored in reserved memory bank address 0x03. Once the access password has
Rev. 1.2
Sept. 2010
Page 5 of 17
RAMTRON [ RAMTRON INTERNATIONAL CORPORATION ]
