4
$\begingroup$

I'm looking for info on demodulating both sides of an ISO14443 communication using a cheap SDR, preferably an RTL-SDR (R820T2+RTL2832U). The application is passively monitoring an NFC exchange for debugging purposes (like this or this specialized tools allow), using a pickup coil next to the devices. I'm restricting to ISO/IEC 14443-2:2010 (which covers some of the most-used NFC modes).

Operation uses magnetic induction at fc=13.56MHz (an ISM band). The field is generated by the reader (aka PCD), with a TRP often up to 1W. It is picked-up by a card (aka PICC) at like up to 100mm. The PICC's antenna is typically a coil (like 60mm diameter, 3 turns), connected to an (integrated) capacitor forming an L(R)C tuned slightly above fc, followed by a rectifier for power extraction. The PICC transmits by load modulation of a sub-carrier at fs=fc/16=847.5kHz. That creates sidebands (e.g. at fc±fs).

PCD transmission is ASK ≈10% NRZ-L (or [*] ASK ≈100% modified Miller). PICC transmission is BPSK NRZ-L (or [*] OOK Manchester). Bit rates are fs/8, fs/4, fs/2, sometime fs (≈106, 212, 424, sometime 848 kbit/s), negotiated independently in each direction.
[*] These modes are for the so-called "type A" at fs/8 bit rate.

Issues designing a circuit between the pickup coil and SDR:

  • the 13.56MHz field can be strong (>4V RMS for each turn of an unloaded 60mm diameter pickup coil) and should not fry the SDR
  • that 13.56MHz field varies enormously (?-25dB) depending PCD, PICC, and position of a pickup coil (and to a lesser degree according to internal activity in the PICC, which varies between communication bursts).
  • the 847.5kHz sub-carrier is comparatively very weak (?-40dB), and also very variable depending on devices and placement of a pickup coil.

Info, links, ideas (even half-baked) welcome.

$\endgroup$
4
$\begingroup$

This isn’t a solution to your problem, but I had similar challenges with UHF RFID at 865 MHz. In UHF RFID the tags are electrically short dipoles modulated by the chip impedance. I thought it would be impossible to measure the two way traffic due to the huge difference in the TX and RX signal amplitudes.

I solved this by making a tiny hole through the tag antenna matching loop near the chip. I then looped a single wire through the hole and connected this loop to the coax going to the RTL-SDR. The loop acts as a transformer or current sensing probe. Because I measure the current through the tag chip and both RX and TX are binary AM (almost CW), both signals have almost the same amplitude.

I never did the actual demodulation, but I used the SDR# to save the signal and then Python to plot the amplitude in time domain.

$\endgroup$
2
$\begingroup$

Check my project at https://github.com/josevcm/nfc-laboratory

Regards Jv

$\endgroup$
2
  • $\begingroup$ Hello Jose Vicente, and welcome to ham.stackexchange.com! $\endgroup$
    – rclocher3
    Oct 18 at 22:37
  • $\begingroup$ Ordinarily we frown upon one-line answers that are just links, but since your link goes to a GitHub code repository with code that does exactly what the question is asking for, or something close to it, I think in this case a one-line answer with a link is entirely appropriate. Thanks Jose Vicente! $\endgroup$
    – rclocher3
    Oct 19 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.