NFC TI TRF7970A Breakout Board V1.0 for BusPirate or any Hardware

Just a news about a new Hardware PCB I have designed with Eagle, it is an NFC Breakout board using latest Texas Instrument NFC chipset the TRF7970A and including 13.56MHz antenna with an option to connect an external SMA NFC antenna (SMA-142-0701-801/806) .
It is also compatible with Input Voltage from 2.7VDC to 5.5VDC and I/O Voltage level programmable from 1.8VDC to 5.5VDC.
It supports Near Field Communication (NFC) Standards NFCIP-1 (ISO/IEC 18092), NFCIP-2 (ISO/IEC 21481) and protocol ISO15693, ISO18000-3, ISO14443A/B, and FeliCa.

Advantage against PN532 chipset/breakout board are:

• TRF7970A is cheaper and available.
• Documentations including datasheet are public/full and available directly without any registration or NDA.
• Support Direct Mode 0 "Raw RF Sub-CarrierData Stream" to encode/decode all 13.56MHz subcarrier data stream.

The final board with all components soldered (using a AOYUE Int 968 Hot Air and Iron Solder):

If anyone is interested by this Breakout board tell it as comment.

If lot of people are interested (at least 100). I could buy a batch of 100 PCBs + Components at SeeedStudio and the price could be less than 30US$ for a Full Board assembled and tested.
For Interested guys I have a batch of 8 PCBs and I can sell 3 PCBs with all components soldered and fully tested.

The next step in progress is TRF7970A Breakout Board connected to a STM32F4 Discovery board (using chibios as RTOS).

Test of TRF7970A Breakout Board V1 with BusPirateV3

Hardware requirement:
BusPirate V3 or V4 (shortcut BP).
TRF7970A BreakOut Board V1 (shortcut TRF).

Hardware Configuration for SPI mode with ChipSelect
Warning Never connect 2 different power Input on both +VCC/3V3.
Only one power supply shall be connected to +VCC or to 3V3. (+VCC and 3V3 are linked together on the same line).
Nota1: 3V3 can be connected to +5V or +3V on BusPirate.
Nota2: 3V3 or +VCC accept input voltage from +2.7V to +5.5V.

TRF7970A BreakOut Board V1 connections:
Connect TRF "IO0_GND" signal to TRF "GND".
Connect TRF "EN", "IO1_NCS_GND" and "IO2_VDD_IO_X" signals to TRF "+VCC".
Connect TRF "MOSI" signal to BP "MOSI".
Connect TRF "CLK" signal to BP "CLK".
Connect TRF "MISO" signal to BP "MISO".
Connect TRF "CS" signal to BP "CS".
Connect TRF "3V3" signal to BP "3V3" or "5V".
Connect TRF "GND" signal to BP "GND".
With this configuration, other signals shall not be connected (except optional TRF "MOD", "IRQ" or "ASK_OOK" signals).

SPI Configuration:
CPOL=0 (Clock is Low when inactive)
CPHA=1(Data is Valid on Clock Trailing Edge)
CS Active Low
BusPirate V3 configuration

HiZ>m 5 3 1 1 1 2 2
SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 )
Ready
SPI>W
Power supplies ON
SPI>i
SPI>i
Bus Pirate v3b
Firmware v5.10 (r559) Bootloader v4.4
DEVID:0x0447 REVID:0x3043 (24FJ64GA002 B5)
http://dangerousprototypes.com
CFG1:0xFFDF CFG2:0xFF7F
*----------*
Pinstates:
1.(BR) 2.(RD) 3.(OR) 4.(YW) 5.(GN) 6.(BL) 7.(PU) 8.(GR) 9.(WT) 0.(Blk)
GND 3.3V 5.0V ADC VPU AUX CLK MOSI CS MISO
P P P I I I O O O I
GND 2.21V 0.00V 0.00V 0.00V L L L H L
Power supplies OFF, Pull-up resistors OFF, Normal outputs (H=3.3v, L=GND)
MSB set: MOST sig bit first, Number of bits read/write: 8
a/A/@ controls AUX pin
SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 )
*----------*

TRF7970A command (Table 5-10. Address/Command Word Bit Distribution):
Bit Description Bit Function Address Command
B7 Command control bit 0 = address 0 1 1 = command
B6 Read/Write 0 = write R/W 0 1 = read
B5 Continuous address mode 1 = Continuous mode R/W 0
B4 Address/Command bit 4 Adr 4 Cmd 4
B3 Address/Command bit 3 Adr 3 Cmd 3
B2 Address/Command bit 2 Adr 2 Cmd 2
B1 Address/Command bit 1 Adr 1 Cmd 1
B0 Address/Command bit 0 Adr 0 Cmd 0

Example commands:
SpiDirectCommand:
1stByte = ((0x80 | CommandCode)) & 0x9f
Software Initialization (0x03):
1stByte = 0x83
[0x83]
Reset 0x09 (Reset FIFO):
[0x89]

SpiReadSingle (Read Register Addr):
RegisterAddr=0x1A (TestRegister R/W)
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A

SpiWriteSingle (Write Register Addr):
RegisterAddr=0x1A (TestRegister R/W)
1stByte = AddressCommand (0x1F&RegisterAddr) = 0x1A

Read Register 0x1A:
[0x5A r]
Write Register 0x1A with value 0x12:
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A
[0x1A 0x12]

Read Register 0x1B:
[0x5B r]
Write Register 0x1B with value 0x13:
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A
[0x1B 0x13]

Read Chip Status Control Register (0x00)(Default Value 0x01):
[0x40 r]

Read ISO Control Register (0x01)(Default Value 0x02):
[0x41 r]

Read Modulator and SYS_CLK Control Register (0x09):
[0x49 r]

Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz)):
[0x09 0x31]

Read Regulator and I/O Control Register (0x0B):
[0x4B r]

Write Regulator and I/O Control Register (0x0B):
[0x0B 0x00]

Read FIFO Status Register (0x1C)
[0x5C r]

RSSI levels and oscillator status (0x0F)
[0x4F r]

Continuous Read and Clear IRQ Status (0x0C) (required a dummy read)
[0x6C r:2]

Continuous Read from Addr 0x00 to addr 0x05:
[0x60 r:6]

Continuous Read from Fifo Addr 0x1F:
[0x7F r:9]

Send Data in Fifo:
[0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00]
0x8F = Reset FIFO
0x91 = Send With CRC
0x3D = Write Continuous (Start at 0x1D => TX Length Byte1 & Byte2)
0x00 0x30 = Number of Bytes to be sent (0x30 = 3bytes @0x1D & 0x1E)
0x26 = Request Flags (FIFO TX 1st Data @0x1F)
0x01 = Inventory Command (FIFO TX 2nd Data @0x20)
0x00 = Mask (FIFO TX 3rd Data @0x21)

For more details on TRF7970A chipset see datasheet http://www.ti.com/lit/gpn/trf7970a

Before to initialize chipset to ISO15693 or ISO14443A, you should launch BusPirate V3 configuration "m 5 3 1 1 1 2 2" then "W" then put the NFC card(depending on example ISO15693 or ISO14443A card) on the antenna and execute step 1) to 5) of the chosen example.

Initialize the chipset ISO15693 and read UID:
1) Reset
[0x83]
2) Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz))
[0x09 0x31]
3) Configure Mode ISO Control Register (0x01) to 0x02 (ISO15693 high bit rate, one subcarrier, 1 out of 4)
[0x01 0x02]
4) Turn RF ON (Chip Status Control Register (0x00))
[0x40 r] [0x00 0x20] [0x40 r]
5) Inventory Command (see Figure 5-20. Inventory Command Sent From MCU to TRF7970A)
5-1) Send Inventory(8B), Wait 2ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x0A(0x1F/0x7F), Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F)
[0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00] %:2 [0x6C r:2] [0x5C r] [0x7F r:10] %:10 [0x6C r:2] [0x5C r] [0x8F] [0x4F r]

Result example:
/CS ENABLED
WRITE: 0x8F
WRITE: 0x91
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x30
WRITE: 0x26
WRITE: 0x01
WRITE: 0x00
/CS DISABLED
DELAY 2ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x0A
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0x00 0x00 0x88 0x77 0x66 0x55 0x44 0x01 0x04 0xE0
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x00
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED

In this example UID is: 0xE0 0x04 0x01 0x44 0x55 0x66 0x77 0x88 (the first 2 bytes shall be always 0x00 0x00)
The last data READ: 0x7F correspond to RSSI levels.
For more details on ISO15693 (especially Inventory, Read/Write block ...) see document ISO/IEC FCD 15693-3

Initialize the chipset ISO14443A (Mifare One) and read UID:
1) Reset
[0x83]
2) Write&Read Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz))
[0x09 0x31] [0x49 r]
3) Configure&Read Mode ISO Control Register (0x01) to 0x88 (ISO14443A RX bit rate, 106 kbps) and no RX CRC (CRC is not present in the response))
[0x01 0x88] [0x41 r]
4) Turn RF ON (Chip Status Control Register (0x00)) and Read It
[0x00 0x20] [0x40 r]
5) REQA & WUPA command (Anticollision)
5-1) Disable CRC Calc(0x01), Send Raw REQA no CRC(1B), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+1(0x1F/0x7F) Read ATQA, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F), wait 20ms, Send Raw AntiColl(2B), wait 5ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x05(0x1F/0x7F), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F)
[0x01 0x88] [0x8F 0x90 0x3D 0x00 0x0F 0x26] %:10 [0x6C r:2] [0x5C r] [0x7F r:2] [0x8F] [0x4F r] %:20 [0x8F 0x90 0x3D 0x00 0x20 0x93 0x20] %:5 [0x6C r:2] [0x5C r] [0x7F r:5] %:10 [0x6C r:2] [0x8F] [0x4F r]

Result example:
/CS ENABLED
WRITE: 0x01
WRITE: 0x88
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
WRITE: 0x90
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x0F
WRITE: 0x26
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0xC0 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x02
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0x04 0x00
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED
DELAY 20ms
/CS ENABLED
WRITE: 0x8F
WRITE: 0x90
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x20
WRITE: 0x93
WRITE: 0x20
/CS DISABLED
DELAY 5ms
/CS ENABLED
WRITE: 0x6C
READ: 0xC0 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x05
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0xCD 0x88 0x77 0x66 0x00
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED

In this example UID is: 0xCD 0x88 0x77 0x66 (The last Byte "0x00" (intentionally wrong in is example) is BCC calculated as exclusive-or over the 4 previous bytes which is wrong this example)
The last data READ: 0x7F correspond to RSSI levels.

Nota: This example is very basic and for basic test purpose and do not respect the anticollision mechanism which requires additional data after UID is received.

For more details on ISO14443 (especially Initialization and anticollision) see document ISO/IEC FCD 14443-3.