4
$\begingroup$

I'm looking for info on demodulating both sides of an ISO14443 communication using a cheap SDR, preferably an RTL-SDR (R820T2+RTL2832U). The application is passively monitoring an NFC exchange for debugging purposes (like this or this specialized tools allow), using a pickup coil next to the devices. I'm restricting to ISO/IEC 14443-2:2010 (which covers some of the most-used NFC modes).

Operation uses magnetic induction at fc=13.56MHz (an ISM band). The field is generated by the reader (aka PCD), with a TRP often up to 1W. It is picked-up by a card (aka PICC) at like up to 100mm. The PICC's antenna is typically a coil (like 60mm diameter, 3 turns), connected to an (integrated) capacitor forming an L(R)C tuned slightly above fc, followed by a rectifier for power extraction. The PICC transmits by load modulation of a sub-carrier at fs=fc/16=847.5kHz. That creates sidebands (e.g. at fc±fs).

PCD transmission is ASK ≈10% NRZ-L (or [*] ASK ≈100% modified Miller). PICC transmission is BPSK NRZ-L (or [*] OOK Manchester). Bit rates are fs/8, fs/4, fs/2, sometime fs (≈106, 212, 424, sometime 848 kbit/s), negotiated independently in each direction.
[*] These modes are for the so-called "type A" at fs/8 bit rate.

Issues designing a circuit between the pickup coil and SDR:

  • the 13.56MHz field can be strong (>4V RMS for each turn of an unloaded 60mm diameter pickup coil) and should not fry the SDR
  • that 13.56MHz field varies enormously (?-25dB) depending PCD, PICC, and position of a pickup coil (and to a lesser degree according to internal activity in the PICC, which varies between communication bursts).
  • the 847.5kHz sub-carrier is comparatively very weak (?-40dB), and also very variable depending on devices and placement of a pickup coil.

Info, links, ideas (even half-baked) welcome.

Improve this question
$\endgroup$

2 Answers 2

Reset to default
4
$\begingroup$

This isn’t a solution to your problem, but I had similar challenges with UHF RFID at 865 MHz. In UHF RFID the tags are electrically short dipoles modulated by the chip impedance. I thought it would be impossible to measure the two way traffic due to the huge difference in the TX and RX signal amplitudes.

I solved this by making a tiny hole through the tag antenna matching loop near the chip. I then looped a single wire through the hole and connected this loop to the coax going to the RTL-SDR. The loop acts as a transformer or current sensing probe. Because I measure the current through the tag chip and both RX and TX are binary AM (almost CW), both signals have almost the same amplitude.

I never did the actual demodulation, but I used the SDR# to save the signal and then Python to plot the amplitude in time domain.

Improve this answer
$\endgroup$
2
$\begingroup$

Check my project at https://github.com/josevcm/nfc-laboratory

Regards Jv

Improve this answer
$\endgroup$
2
  • $\begingroup$ Hello Jose Vicente, and welcome to ham.stackexchange.com! $\endgroup$
    – rclocher3
    Commented Oct 18, 2021 at 22:37
  • $\begingroup$ Ordinarily we frown upon one-line answers that are just links, but since your link goes to a GitHub code repository with code that does exactly what the question is asking for, or something close to it, I think in this case a one-line answer with a link is entirely appropriate. Thanks Jose Vicente! $\endgroup$
    – rclocher3
    Commented Oct 19, 2021 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .