Wednesday, May 9, 2012

NFC TI TRF7970A Breakout Board V1.1 and STM32F4 Discovery


TRF7970A Breakout Board v1.1:

It is just a little update on the new board TI TRF7970A Breakout Board v1.1 I have built, I have ordered 20 PCB, it is a minor update/clean-up of the board to be easier to use (especially with SPI+SS mode which can be now selected by using simple Short Circuit Block Cap).


STM32F4 Discovery Firmware (for TRF7970A):

I have also news about progress on TRF7970A and STM32F4 Discovery Firmware:


  •    TI EVM GUI is working fine and is ported to STM32F4 (default mode when STM32F4 is powered).
  • Basic UID read for Vicinity/ISO15693 work fine too (through shell command).
  • Basic UID read for Mifare One card work fine (through shell command).
ExampleTerminal output log:
ch> nfm
Test nf ISO14443-A/Mifare read UID(4bytes only) start
Modulator Control Register read=0x31 (shall be 0x31)
ISO Control Register read=0x88 (shall be 0x88)
Test Settings Register(0x1A) read=0x40 (shall be 0x40)
Chip Status Control Register read=0x21
RX data(ATQA): 0x04 0x00
RSSI data: 0x7F (shall be > 0x40)
RX data(UID+BCC): 0xCD 0x81 0x5F 0x76 0x65
RSSI data: 0x7F (shall be > 0x40)
RX data(SAK): 0x08
RSSI data: 0x7F (shall be > 0x40)
Send HALT(No Answer OK)
Chip Status Control Register data: 0x01
nb_irq: 0x09
Test nfm ISO14443-A/Mifare end

  • The Sniffer mode for ISO14443A work fine(this version does not display Parity error or check CRC_A but it is planned).
Example Terminal output log on a Mifare One card read by Nexus S:
...
    52
TAG 04 00
    93 70 cd 81 5f 76 65 d1 86
TAG 08 b6 dd
    60 00 f5 7b
TAG 2a 81 4c 55
    8c cc db f8 cb 98 1a 6e
TAG a0 ed 29 bd
    b2 ee f9 09
TAG 76 e6 ca 66 cc e6 0b df 7d 69 31 70 08 f3 6c dd eb ca
    3e 3b d5 81
TAG 82 0c df 9e e8 b0 e1 4a c5 9c de 45 27 26 79 41 e7 00
    07 c6 2d 8f
TAG fe c0 83 39 40 cb ea d8 0a cf 18 00 6c 78 97 9b 01 95
    f8 86 46 1c
TAG 34 d7 71 20 99 a1 a3 f9 0c e6 90 8b e6 5e 93 c1 53 23
    ae 87 f6 db
TAG c9 82 dd d5
    90 7c 16 4a 00 26 6c b4

...
  • Emulator mode is planned and lot of other modes too.


Just a little challenge for readers, try to decode crypted data contained in "Example Terminal output log on a Mifare One card read by Nexus S", I will give the answer and source code tool to do that on next blog message.


If anyone is interested by this new board you can contact me by Email (PCB are limited to 15 for order), I think I will receive the PCB of the new Board the 21 may 2012.

Best Regards
Benjamin

Wednesday, January 18, 2012

NFC TI TRF7970A Breakout Board V1.0 for BusPirate or any Hardware


Just a news about a new Hardware PCB I have designed with Eagle, it is an NFC Breakout board using latest Texas Instrument NFC chipset the TRF7970A and including 13.56MHz antenna with an option to connect an external SMA NFC antenna (SMA-142-0701-801/806) .
It is also compatible with Input Voltage from 2.7VDC to 5.5VDC and I/O Voltage level programmable from 1.8VDC to 5.5VDC.
It supports Near Field Communication (NFC) Standards NFCIP-1 (ISO/IEC 18092), NFCIP-2 (ISO/IEC 21481) and protocol ISO15693, ISO18000-3, ISO14443A/B, and FeliCa.

Advantage against PN532 chipset/breakout board are:

  • TRF7970A is cheaper and available.
  • Documentations including datasheet are public/full and available directly without any registration or NDA.
  • Support Direct Mode 0 "Raw RF Sub-CarrierData Stream" to encode/decode all 13.56MHz subcarrier data stream.
The final board with all components soldered (using a AOYUE Int 968 Hot Air and Iron Solder):


    If anyone is interested by this Breakout board tell it as comment.

    If lot of people are interested (at least 100). I could buy a batch of 100 PCBs + Components at SeeedStudio and the price could be less than 30US$ for a Full Board assembled and tested.
    For Interested guys I have a batch of 8 PCBs and I can sell 3 PCBs with all components soldered and fully tested.

    The next step in progress is TRF7970A Breakout Board connected to a STM32F4 Discovery board (using chibios as RTOS).




    Test of TRF7970A Breakout Board V1 with BusPirateV3

    Hardware requirement:
    BusPirate V3 or V4 (shortcut BP).
    TRF7970A BreakOut Board V1 (shortcut TRF).

    Hardware Configuration for SPI mode with ChipSelect
    Warning Never connect 2 different power Input on both +VCC/3V3.
    Only one power supply shall be connected to +VCC or to 3V3. (+VCC and 3V3 are linked together on the same line).
    Nota1: 3V3 can be connected to +5V or +3V on BusPirate.
    Nota2: 3V3 or +VCC accept input voltage from +2.7V to +5.5V.

    TRF7970A BreakOut Board V1 connections:
    Connect TRF "IO0_GND" signal to TRF "GND".
    Connect TRF "EN", "IO1_NCS_GND" and "IO2_VDD_IO_X" signals to TRF "+VCC".
    Connect TRF "MOSI" signal to BP "MOSI".
    Connect TRF "CLK" signal to BP "CLK".
    Connect TRF "MISO" signal to BP "MISO".
    Connect TRF "CS" signal to BP "CS".
    Connect TRF "3V3" signal to BP "3V3" or "5V".
    Connect TRF "GND" signal to BP "GND".
    With this configuration, other signals shall not be connected (except optional TRF "MOD", "IRQ" or "ASK_OOK" signals).

    SPI Configuration:
    CPOL=0 (Clock is Low when inactive)
    CPHA=1(Data is Valid on Clock Trailing Edge)
    CS Active Low
    BusPirate V3 configuration
    HiZ>m 5 3 1 1 1 2 2
    SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 )
    Ready
    SPI>W
    Power supplies ON
    SPI>i
    SPI>i
    Bus Pirate v3b
    Firmware v5.10 (r559) Bootloader v4.4
    DEVID:0x0447 REVID:0x3043 (24FJ64GA002 B5)
    http://dangerousprototypes.com
    CFG1:0xFFDF CFG2:0xFF7F
    *----------*
    Pinstates:
    1.(BR) 2.(RD) 3.(OR) 4.(YW) 5.(GN) 6.(BL) 7.(PU) 8.(GR) 9.(WT) 0.(Blk)
    GND 3.3V 5.0V ADC VPU AUX CLK MOSI CS MISO
    P P P I I I O O O I
    GND 2.21V 0.00V 0.00V 0.00V L L L H L
    Power supplies OFF, Pull-up resistors OFF, Normal outputs (H=3.3v, L=GND)
    MSB set: MOST sig bit first, Number of bits read/write: 8
    a/A/@ controls AUX pin
    SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 )
    *----------*

    TRF7970A command (Table 5-10. Address/Command Word Bit Distribution):
    Bit Description Bit Function Address Command
    B7 Command control bit 0 = address 0 1 1 = command
    B6 Read/Write 0 = write R/W 0 1 = read
    B5 Continuous address mode 1 = Continuous mode R/W 0
    B4 Address/Command bit 4 Adr 4 Cmd 4
    B3 Address/Command bit 3 Adr 3 Cmd 3
    B2 Address/Command bit 2 Adr 2 Cmd 2
    B1 Address/Command bit 1 Adr 1 Cmd 1
    B0 Address/Command bit 0 Adr 0 Cmd 0

    Example commands:
    SpiDirectCommand:
    1stByte = ((0x80 | CommandCode)) & 0x9f
    Software Initialization (0x03):
    1stByte = 0x83
    [0x83]
    Reset 0x09 (Reset FIFO):
    [0x89]

    SpiReadSingle (Read Register Addr):

    RegisterAddr=0x1A (TestRegister R/W)
    1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A

    SpiWriteSingle (Write Register Addr):

    RegisterAddr=0x1A (TestRegister R/W)
    1stByte = AddressCommand (0x1F&RegisterAddr) = 0x1A

    Read Register 0x1A:

    [0x5A r]
    Write Register 0x1A with value 0x12:
    1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A
    [0x1A 0x12]

    Read Register 0x1B:
    [0x5B r]
    Write Register 0x1B with value 0x13:
    1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A
    [0x1B 0x13]

    Read Chip Status Control Register (0x00)(Default Value 0x01):
    [0x40 r]

    Read ISO Control Register (0x01)(Default Value 0x02):
    [0x41 r]

    Read Modulator and SYS_CLK Control Register (0x09):
    [0x49 r]

    Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz)):
    [0x09 0x31]

    Read Regulator and I/O Control Register (0x0B):
    [0x4B r]

    Write Regulator and I/O Control Register (0x0B):
    [0x0B 0x00]

    Read FIFO Status Register (0x1C)
    [0x5C r]

    RSSI levels and oscillator status (0x0F)
    [0x4F r]

    Continuous Read and Clear IRQ Status (0x0C) (required a dummy read)
    [0x6C r:2]

    Continuous Read from Addr 0x00 to addr 0x05:
    [0x60 r:6]

    Continuous Read from Fifo Addr 0x1F:
    [0x7F r:9]

    Send Data in Fifo:
    [0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00]
    0x8F = Reset FIFO
    0x91 = Send With CRC
    0x3D = Write Continuous (Start at 0x1D => TX Length Byte1 & Byte2)
    0x00 0x30 = Number of Bytes to be sent (0x30 = 3bytes @0x1D & 0x1E)
    0x26 = Request Flags (FIFO TX 1st Data @0x1F)
    0x01 = Inventory Command (FIFO TX 2nd Data @0x20)
    0x00 = Mask (FIFO TX 3rd Data @0x21)

    For more details on TRF7970A chipset see datasheet http://www.ti.com/lit/gpn/trf7970a

    Before to initialize chipset to ISO15693 or ISO14443A, you should launch BusPirate V3 configuration "m 5 3 1 1 1 2 2" then "W" then put the NFC card(depending on example ISO15693 or ISO14443A card) on the antenna and execute step 1) to 5) of the chosen example.

    Initialize the chipset ISO15693 and read UID:
    1) Reset
    [0x83]
    2) Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz))
    [0x09 0x31]
    3) Configure Mode ISO Control Register (0x01) to 0x02 (ISO15693 high bit rate, one subcarrier, 1 out of 4)
    [0x01 0x02]
    4) Turn RF ON (Chip Status Control Register (0x00))
    [0x40 r] [0x00 0x20] [0x40 r]
    5) Inventory Command (see Figure 5-20. Inventory Command Sent From MCU to TRF7970A)
    5-1) Send Inventory(8B), Wait 2ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x0A(0x1F/0x7F), Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F)
    [0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00] %:2 [0x6C r:2] [0x5C r] [0x7F r:10] %:10 [0x6C r:2] [0x5C r] [0x8F] [0x4F r]

    Result example:
    /CS ENABLED
    WRITE: 0x8F
    WRITE: 0x91
    WRITE: 0x3D
    WRITE: 0x00
    WRITE: 0x30
    WRITE: 0x26
    WRITE: 0x01
    WRITE: 0x00
    /CS DISABLED
    DELAY 2ms
    /CS ENABLED
    WRITE: 0x6C
    READ: 0x00 0x3E
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x5C
    READ: 0x0A
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x7F
    READ: 0x00 0x00 0x88 0x77 0x66 0x55 0x44 0x01 0x04 0xE0
    /CS DISABLED
    DELAY 10ms
    /CS ENABLED
    WRITE: 0x6C
    READ: 0x00 0x3E
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x5C
    READ: 0x00
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x8F
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x4F
    READ: 0x7F
    /CS DISABLED

    In this example UID is: 0xE0 0x04 0x01 0x44 0x55 0x66 0x77 0x88 (the first 2 bytes shall be always 0x00 0x00)
    The last data READ: 0x7F correspond to RSSI levels.
    For more details on ISO15693 (especially Inventory, Read/Write block ...) see document ISO/IEC FCD 15693-3

    Initialize the chipset ISO14443A (Mifare One) and read UID:
    1) Reset
    [0x83]
    2) Write&Read Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz))
    [0x09 0x31] [0x49 r]
    3) Configure&Read Mode ISO Control Register (0x01) to 0x88 (ISO14443A RX bit rate, 106 kbps) and no RX CRC (CRC is not present in the response))
    [0x01 0x88] [0x41 r]
    4) Turn RF ON (Chip Status Control Register (0x00)) and Read It
    [0x00 0x20] [0x40 r]
    5) REQA & WUPA command (Anticollision)
    5-1) Disable CRC Calc(0x01), Send Raw REQA no CRC(1B), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+1(0x1F/0x7F) Read ATQA, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F), wait 20ms, Send Raw AntiColl(2B), wait 5ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x05(0x1F/0x7F), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F)
    [0x01 0x88] [0x8F 0x90 0x3D 0x00 0x0F 0x26] %:10 [0x6C r:2] [0x5C r] [0x7F r:2] [0x8F] [0x4F r] %:20 [0x8F 0x90 0x3D 0x00 0x20 0x93 0x20] %:5 [0x6C r:2] [0x5C r] [0x7F r:5] %:10 [0x6C r:2] [0x8F] [0x4F r]

    Result example:
    /CS ENABLED
    WRITE: 0x01
    WRITE: 0x88
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x8F
    WRITE: 0x90
    WRITE: 0x3D
    WRITE: 0x00
    WRITE: 0x0F
    WRITE: 0x26
    /CS DISABLED
    DELAY 10ms
    /CS ENABLED
    WRITE: 0x6C
    READ: 0xC0 0x3E
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x5C
    READ: 0x02
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x7F
    READ: 0x04 0x00
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x8F
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x4F
    READ: 0x7F
    /CS DISABLED
    DELAY 20ms
    /CS ENABLED
    WRITE: 0x8F
    WRITE: 0x90
    WRITE: 0x3D
    WRITE: 0x00
    WRITE: 0x20
    WRITE: 0x93
    WRITE: 0x20
    /CS DISABLED
    DELAY 5ms
    /CS ENABLED
    WRITE: 0x6C
    READ: 0xC0 0x3E
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x5C
    READ: 0x05
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x7F
    READ: 0xCD 0x88 0x77 0x66 0x00
    /CS DISABLED
    DELAY 10ms
    /CS ENABLED
    WRITE: 0x6C
    READ: 0x00 0x3E
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x8F
    /CS DISABLED
    /CS ENABLED
    WRITE: 0x4F
    READ: 0x7F
    /CS DISABLED

    In this example UID is: 0xCD 0x88 0x77 0x66 (The last Byte "0x00" (intentionally wrong in is example) is BCC calculated as exclusive-or over the 4 previous bytes which is wrong this example)
    The last data READ: 0x7F correspond to RSSI levels.

    Nota: This example is very basic and for basic test purpose and do not respect the anticollision mechanism which requires additional data after UID is received.

    For more details on ISO14443 (especially Initialization and anticollision) see document ISO/IEC FCD 14443-3.