I'm looking for info on demodulating both sides of an ISO14443 communication using a cheap SDR, preferably an RTL-SDR (R820T2+RTL2832U). The application is passively monitoring an NFC exchange for debugging purposes (like this or this specialized tools allow), using a pickup coil next to the devices. I'm restricting to ISO/IEC 14443-2:2010 (which covers some of the most-used NFC modes).
Operation uses magnetic induction at fc=13.56MHz (an ISM band). The field is generated by the reader (aka PCD), with a TRP often up to 1W. It is picked-up by a card (aka PICC) at like up to 100mm. The PICC's antenna is typically a coil (like 60mm diameter, 3 turns), connected to an (integrated) capacitor forming an L(R)C tuned slightly above fc, followed by a rectifier for power extraction. The PICC transmits by load modulation of a sub-carrier at fs=fc/16=847.5kHz. That creates sidebands (e.g. at fc±fs).
PCD transmission is ASK ≈10% NRZ-L (or [*] ASK ≈100% modified Miller). PICC transmission is BPSK NRZ-L (or [*] OOK Manchester). Bit rates are fs/8, fs/4, fs/2, sometime fs (≈106, 212, 424, sometime 848 kbit/s), negotiated independently in each direction.
[*] These modes are for the so-called "type A" at fs/8 bit rate.
Issues designing a circuit between the pickup coil and SDR:
- the 13.56MHz field can be strong (>4V RMS for each turn of an unloaded 60mm diameter pickup coil) and should not fry the SDR
- that 13.56MHz field varies enormously (?-25dB) depending PCD, PICC, and position of a pickup coil (and to a lesser degree according to internal activity in the PICC, which varies between communication bursts).
- the 847.5kHz sub-carrier is comparatively very weak (?-40dB), and also very variable depending on devices and placement of a pickup coil.
Info, links, ideas (even half-baked) welcome.