I'm just testing it (with WindowsXP SP3), and it's amazing, very smooth display, very promising.
1st Bug found: I use extreme case ;-) I have a Serial Baud configured to 5.25MegaBauds (on channel 10) and even without any cursor when i set manually to 5250000 and I click on Analyze the plugin tell me 5263157 (exact: 5263157) and Decoded bytes 0, Detected bus errors 0 and no data when in fact there's lot of data which work fine when I read them with my PC and FT2232H. 2nd Bug: If I set cursor 1 and cursor 2 on Channel 10 to check the Frequency and I choose "2: Measure" display Cursor A is 0 or 1 but display tell me it's 1 and 2 and Frequency us NaNmHz ... except time with is 2.67us.
Things I would like: * Refresh bug to fix for example when scrolling Cursor it disappear (but it is a beta). * Add the possibility to click on Left Mouse Button and move mouse left or right to scroll the signals to left or right like before. * Coloured channels like before. * Options to Enable/Disable Scope/Summary
See by attachment my ols file [attachment=0] Best Regards Benjamin
It is planned to release the source code but it take time to clean up and fix the last bugs and I need to document the whole stuff which imply multiple hardware connections. About project progress: Now the sniffer output sniffed data in formated ASCII at 1.7Megabauds on an other USART with DMA (it still respect hard real-time of 8us between 2 received frame).
See an extract of Mifare One(Credit Card format) communication sniffed: This example just read sector 0 (Block 0 to 3) and start to read sector 1 (Block 0). This extract contains following ISO14443A & Mifare communication details: Mifare Card UID for this test: cd 81 5f 76 ISO/IEC FCD 14443-3 TypeA:
Wakeup(52)
ATQA (04 00)
Selection (93 70 ...)
SAK (08 ...)
MIFARE Classic 1K(MF1S50yyX):
Mifare Authenticate block 0x00 using key A (60 00 ...)
I have ported the TRF7970AEVM Firmware to STM32F4 Discovery board and it work fine (I have not tested the peer to peer mode it is in todo list) to read/write ISO/IEC 15693 Vicinity Tags, or to read Mifare Card ISO14443A, I have not tested ISO14443B or Felica because I have not such TAG (but it is planned).
The big news is I have also developed a NFC ISO14443A sniffer (with both side PICC and PCD) and tested it with success on Mifare One/Classic Card reading a whole sector by sniffing a Mifare One communicating with a PN532+PIC32 UBW32(An other project I have wrote from scratch including PN532 C driver). I plan to do a video soon.
About Proxmark3 it is just an amazing hardware and the software is also very good even if it is now a bit limited by hardware resource, to have features like Proxmark3 it is tons of work and research and the major problem is the price of such hardware about 300US$.
About ISO14443 I plan to support ISO14443A which is the most common (with billions of cards like Mifare One ...) and maybe B later (both can be sniffed easily). About ISO15693 sniffer I do not know if it is possible to sniff it, It needs more research/test with TRF7970A. About CortexA15 support I think it's too complex and expensive for such hardware (requires BGA ...), I do not want to do an Android Phone ;-) the idea is to do real time embedded stuff with something like Dual Core M4 with maybe even an FPGA all in one, which is not too expensive (less than 50US$). But this project cannot be done alone some other developers shall participate because the huge work is on firmware like you can see on other project with fantastic hardware like Pandaboard it is nothing if you do not have good software (example even today my Pandaboard cannot play Full HD movie at 24fps, but the hardware can ...).
[quote author="carpas"]Hi Benjamin, where can I find the file sch and brd of your board?
Thank you[/quote]
Hi carpas,
The sch and brd are not pusblished, but it is planned in fact you are the first one to ask for it. Maybe it will be great to publish them on Dangerous Prototypes SVN. Anyway to solder QFN that requires hot air and good practice because it's very hard to test if all is good and you can have really weird behaviour if it's badly soldered.
I also maybe plan to do a new project 100% open source on Kickstarter to include NFC support and a powerful µC (multi core ARM based) to build a Hacker/Developer/Tester tools like BusPirate including NFC analyzer(with features like Proxmark3) and other cool high speed protocol analyzer/debugger ... like BusPirate and why not some possible extension for BlueTooth, Zigbee, Wifi ...
Maybe I can help you if you send me Eagle schematics.
Just be-careful on my own board TRF7970A breakout board I need following connection to have a working TRF7970A (in SPI mode with SS): Connect TRF "EN", "IO1_NCS_GND" and "IO2_VDD_IO_X" signals to +VCC. Else maybe you have other problem like TRF7970A not soldered correctly or a problem on the PCB.
I have also a very interesting news, I have finished to port TI TRF7970A EVM Firmware to my STM32F4 Discovery board with chibios and that work like a charm, I use the standard TRF7970A_EVM_GUI.exe GUI and I can read UID and read/write memory of ISO15693 tag, I can read UID of Mifare Card or select the card, I can do lot of other stuff but next step is to test Peer to Peer with 2 TRF7970A board one with STM32F4 and the other with PIC32MX but I need to port the TI TRF7970A EVM Firmware to PIC32 before.
I'm also testing Card Emulator mode with the TRF7970A and the bad things is it seems not possible to emulate card as ISO14443A like Mifare card (tested with my Nexus S as read and I receive only Interrupt with IRQ Status flag = 0x4 (RF field change) and SDD completed never happen) and only ISO14443B Card Emulation seems supported like in the example of EVM source code(but I have not tested it). Maybe I will need to use direct mode 0 because ASK 100% modulation seems to be not managed (only OOK, ASK 7%, 8.5%,10%, 13%, 16%, 22% and 30% are managed in Modulator and SYS_CLK Control Register (0x09)) Because in 14443A standards it's wrote: PCD -> PICC – Communication Type A => Use Miller Modified => ASK 100% (in my case in Card Emulation TRF7970A act as PICC so I receive ASK 100% and I shall receive WUPA/REQA) and PICC-> PCD - Communication Type A => Use Manchester => OOK (in my case in Card Emulation TRF7970A act as PICC so I send reply using OOK)
im confused though, why did you put the DangerousPrototypes logo on it? Its not a dangerous prototypes product.
Also you put 'fulfillment by SEEEDSTUDIO' when it was not. You just ordered a couple PCBs to be designed from a factory near them so they could charge you a few bucks to middle man it. They didnt 'fulfill' anything except your personal PCB order.
It just seems weird to me; like you assumed this design was so kick-ass that you wanted to show people 'this is what it could look like if it was YOUR product, not mine'.
Thats like me putting a 'SparkFun' logo on my design? Doesn't seem right does it? I dont even like sparkfun (makrup is crazy)[/quote]
Hi BrentBXR,
Yes it's not Dangerous Prototypes but it's mine, but it's planned to be a dangerous prototypes, such stuff are wrote because I used the DP logo/cartridge in Eagle (and it's also to promote DangerousPrototypes stuff which are really cool) sorry for the confusion it's just a first batch of what could be the final DP/SeeedStudio breakout board. Now all work fine, the question is how to convert it to DP hardware and produce it by Seeed ...
Hardware Configuration for SPI mode with ChipSelect Warning Never connect 2 different power Input on both +VCC/3V3. Only one power supply shall be connected to +VCC or to 3V3. (+VCC and 3V3 are linked together on the same line). Nota1: 3V3 can be connected to +5V or +3V on BusPirate. Nota2: 3V3 or +VCC accept input voltage from +2.7V to +5.5V.
TRF7970A BreakOut Board V1 connections: Connect TRF "IO0_GND" signal to TRF "GND". Connect TRF "EN", "IO1_NCS_GND" and "IO2_VDD_IO_X" signals to TRF "+VCC". Connect TRF "MOSI" signal to BP "MOSI". Connect TRF "CLK" signal to BP "CLK". Connect TRF "MISO" signal to BP "MISO". Connect TRF "CS" signal to BP "CS". Connect TRF "3V3" signal to BP "3V3" or "5V". Connect TRF "GND" signal to BP "GND". With this configuration, other signals shall not be connected (except optional TRF "MOD", "IRQ" or "ASK_OOK" signals).
SPI Configuration: CPOL=0 (Clock is Low when inactive) CPHA=1(Data is Valid on Clock Trailing Edge) CS Active Low BusPirate V3 configuration
Quote
HiZ>m 5 3 1 1 1 2 2 SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 ) Ready SPI>W Power supplies ON SPI>i SPI>i Bus Pirate v3b Firmware v5.10 (r559) Bootloader v4.4 DEVID:0x0447 REVID:0x3043 (24FJ64GA002 B5) http://dangerousprototypes.com CFG1:0xFFDF CFG2:0xFF7F *----------* Pinstates: 1.(BR) 2.(RD) 3.(OR) 4.(YW) 5.(GN) 6.(BL) 7.(PU) 8.(GR) 9.(WT) 0.(Blk) GND 3.3V 5.0V ADC VPU AUX CLK MOSI CS MISO P P P I I I O O O I GND 2.21V 0.00V 0.00V 0.00V L L L H L Power supplies OFF, Pull-up resistors OFF, Normal outputs (H=3.3v, L=GND) MSB set: MOST sig bit first, Number of bits read/write: 8 a/A/@ controls AUX pin SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 ) *----------*
TRF7970A command (Table 5-10. Address/Command Word Bit Distribution): Bit Description Bit Function Address Command B7 Command control bit 0 = address 0 1 1 = command B6 Read/Write 0 = write R/W 0 1 = read B5 Continuous address mode 1 = Continuous mode R/W 0 B4 Address/Command bit 4 Adr 4 Cmd 4 B3 Address/Command bit 3 Adr 3 Cmd 3 B2 Address/Command bit 2 Adr 2 Cmd 2 B1 Address/Command bit 1 Adr 1 Cmd 1 B0 Address/Command bit 0 Adr 0 Cmd 0
Before to initialize chipset to ISO15693 or ISO14443A, you should launch BusPirate V3 configuration "m 5 3 1 1 1 2 2" then "W" then put the NFC card(depending on example ISO15693 or ISO14443A card) on the antenna and execute step 1) to 5) of the chosen example.
Initialize the chipset ISO15693 and read UID: 1) Reset [0x83] 2) Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz)) [0x09 0x31] 3) Configure Mode ISO Control Register (0x01) to 0x02 (ISO15693 high bit rate, one subcarrier, 1 out of 4) [0x01 0x02] 4) Turn RF ON (Chip Status Control Register (0x00)) [0x40 r] [0x00 0x20] [0x40 r] 5) Inventory Command (see Figure 5-20. Inventory Command Sent From MCU to TRF7970A) 5-1) Send Inventory(8B), Wait 2ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x0A(0x1F/0x7F), Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F) [0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00] %:2 [0x6C r:2] [0x5C r] [0x7F r:10] %:10 [0x6C r:2] [0x5C r] [0x8F] [0x4F r]
In this example UID is: 0xE0 0x04 0x01 0x44 0x55 0x66 0x77 0x88 (the first 2 bytes shall be always 0x00 0x00) The last data READ: 0x7F correspond to RSSI levels. For more details on ISO15693 (especially Inventory, Read/Write block ...) see document ISO/IEC FCD 15693-3
Initialize the chipset ISO14443A (Mifare One) and read UID: 1) Reset [0x83] 2) Write&Read Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz)) [0x09 0x31] [0x49 r] 3) Configure&Read Mode ISO Control Register (0x01) to 0x88 (ISO14443A RX bit rate, 106 kbps) and no RX CRC (CRC is not present in the response)) [0x01 0x88] [0x41 r] 4) Turn RF ON (Chip Status Control Register (0x00)) and Read It [0x00 0x20] [0x40 r] 5) REQA & WUPA command (Anticollision) 5-1) Disable CRC Calc(0x01), Send Raw REQA no CRC(1B), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+1(0x1F/0x7F) Read ATQA, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F), wait 20ms, Send Raw AntiColl(2B), wait 5ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x05(0x1F/0x7F), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F) [0x01 0x88] [0x8F 0x90 0x3D 0x00 0x0F 0x26] %:10 [0x6C r:2] [0x5C r] [0x7F r:2] [0x8F] [0x4F r] %:20 [0x8F 0x90 0x3D 0x00 0x20 0x93 0x20] %:5 [0x6C r:2] [0x5C r] [0x7F r:5] %:10 [0x6C r:2] [0x8F] [0x4F r]
In this example UID is: 0xCD 0x88 0x77 0x66 (The last Byte "0x00" (intentionally wrong in is example) is BCC calculated as exclusive-or over the 4 previous bytes which is wrong this example) The last data READ: 0x7F correspond to RSSI levels.
Nota: This example is very basic and for basic test purpose and do not respect the anticollision mechanism which requires additional data after UID is received.
For more details on ISO14443 (especially Initialization and anticollision) see document ISO/IEC FCD 14443-3.
If you are interested in a cheap very versatile RFID (13.56Mhz) Read/Writer/Emulator you can read the thread about my TRF7970A Breakout board which even work basicly (to read UID) with a BusPirate. The link is here http://http://dangerousprototypes.com/forum/viewtopic.php?f=19&t=3187
[quote author="hak8or"]I know this is not exactly on topic with this thread, but what was your process for designing the antenna and the RF circuitry?
I personally greatly would like to learn how to make RF enabled devices using RF enabled ic's such as some pic's, but it seems like dark magic to me still.
I see in the datasheet that it lists the components for the RF part of the circuit, is it a good idea to stick with the exact same component values as shown in the datasheet, or do they require changing for each circuit? How did you get the antenna design for it, did you fetch it from a evaluation board or did you design it all your self?
Awesome build by the way! Very clean and organized looking board.[/quote]
I have designed the antenna using Reference design and datasheet based on TRF7970A and TRF7960.
About how to make RF enabled devices the easy way is to use reference design, else you can also build your own antenna design but you will need tuning with oscilloscope and other tools to check impedance matching for 13.56MHz NFC antenna (around 40 to 50 Ohm) to obtain the best power and the hard part will be to calculate each components depending on the antenna length I will advise you such documents: TF796x HF-RFID Reader Layout Design Guide - Ref Texas Instrument SLOA139–April 2009 NFC Design Antenna - Ref Texas Instrument AN144411 Tool for NFC Antenna Design from http://fritz.dellsperger.net/downloads.htm
After some tests on the board (with a BPv3) and especially on antenna with ISO15693 / ISO14443A(Mifare ...), all work fine and results are even better than expected, on ISO15693 and ISO14443A(Mifare One) Card (type credit card) the UID is read at 10cm of the reader !! so the theoretic maximum is reached, of course I use maximum power 200mW by default, but I will try later with half power to check.
Next Time I will write a tutorial on how to init TRF7970A and read UID for ISO15693 and ISO14443A NFC cards with a Bus Pirate and TRF7970A next time.
I have received the 10 PCB from Seeed Studio (and they seems to be all tested with a blue mark thanks Seeed for that amazing PCB). I have build the first PCB and all seems to work fine Power (Blue Led) is OK, no shortcut and Output Frequency (SYS_CLK) is also OK 3.88MHz (with my Extech EX330 Multimeter) (expected 3.90MHz). I have also Tested 5V, 3.3V and 3V with STM4F Discovery and all work fine.
Next step will be to port TR7970A TI source code on PIC32/STM4F Discovery board to check if NFC really works.
TRF7970A BreakoutBoard V1.0 PCB: [attachment=2] TRF7970A BreakoutBoard V1.0 with all components soldered: [attachment=1] TRF7970A BreakoutBoard V1.0 first test with STMF4 Discovery: [attachment=0]