Dangerous Prototypes

Hello,

Just a news about a new Hardware PCB i have designed with Eagle, it is an NFC Breakout board using latest Texas Instrument NFC chipset the TRF7970A and including 13.56MHz antenna with an option to connect an external SMA NFC antenna (SMA-142-0701-801/806) .
It is also compatible with Input Voltage from 2.VDC7 to 5.5VDC and I/O Voltage level programmable from 1.8VDC to 5.5VDC.
It supports Near Field Communication (NFC) Standards NFCIP-1 (ISO/IEC 18092), NFCIP-2 (ISO/IEC 21481) and protocol ISO15693, ISO18000-3, ISO14443A/B, and FeliCa.

Advantage against PN532 chipset/breakout board are:

• TRF7970A is cheaper and available.
• Documentations including datasheet are public/full and available directly without any registration or NDA.
• Support Direct Mode 0 "Raw RF Sub-CarrierData Stream" to encode/decode all 13.56MHz subcarrier data stream.

For more details see in attachement the picture of the Eagle PCB in 3D exported/converted to Sketchup using the fantastic eagleUp plugin.
[attachment=1]
[attachment=0]

I plan to send the Gerbers at Seeed Studio this weekend with "Dangerous Prototypes" Logo like on the picture, but i need more information about that to know If i can obtain Red PCB for Green PCB price to test my design (I need you help Ian for that ;-).

If anyone is interested by this Breakout board tell it as comment.

Just a last word thanks to Sjaak for verification and hints on my design.

Best Regards
Benjamin

---

Hi,

ITeadStudio currently offers 8 color pcbs at 30$. I tried it and they sent me not only 8, but 10 nice blue pcbs :-)

iteadstudio(dot)com/service/color-your-pcbs

RF design looks great. Couple of days back I was looking into TIs RF ICs. I backed out seeing the RF design needed for the PCB. yea this is definitely cool. May I ask, with what device are you trying to communicate using this board and bus pirate??

Nice job. I am interested in testing/assembling some of these pcbs. Also, will the pcbs be available soon for purchase or other design documents released?

Thanks.

[quote author="kiranjose"]RF design looks great. Couple of days back I was looking into TIs RF ICs. I backed out seeing the RF design needed for the PCB. yea this is definitely cool. May I ask, with what device are you trying to communicate using this board and bus pirate??[/quote]

I will use UBW32 / PIC32 to communicate with the IC, but in fact any microcontroller can do the trick for standard mode, except for the direct raw access which require to drive I/O with min speed of at least 13.56Mhz and requires also the CPU horse power behind in addition for computation of CRC and cryptography behind (like on Mifare cards).
I plan to do a portage of TI source code which is 100% C on PIC32 and derivate using HAL (it's what I have already done for PIC32 with NFC532 chipset where i have developped from scratch the full driver for Mifare cards).

Best regards
Benjamin

[quote author="wfrisby"]Nice job. I am interested in testing/assembling some of these pcbs. Also, will the pcbs be available soon for purchase or other design documents released?

Thanks.[/quote]

In fact first I need to test/debug this first beta version to be sure all is ok and work like expected and after if there is enough feedback and people interested in it (at least 100 pre order is required) you could buy it for a very good price at Seeed Studio.
Anyway I think I will publish Eagle schematics, BOM and all required stuff to build it yourself as soon as possible (I have just finished the BOM and component price to build one breakout board is 19.65Euros at DigiKey).

For information the final board is estimated to be less than 30US$.

For enthusiast guys who want to help me to test/debug it (hw and firmware) it will be required at first time to have a PIC32+debugger (like UBW32 board+PICKit3) for test/debug purpose and I could send a blank PCB for practically nothing (like 10US$ including shipping cost).

Best Regards
Benjamin

Just for fun see the latest design with a huge Dangerous prototypes logo, i have also fixed Inductor size/pad and other routing optimizations/cleanup.

[attachment=0]

Nota: You can vote for this Breakout board on Seeed studio http://http://www.seeedstudio.com/wish/?p=948

Best Regards

---

Just some very good news !!

I have received the 10 PCB from Seeed Studio (and they seems to be all tested with a blue mark thanks Seeed for that amazing PCB).
I have build the first PCB and all seems to work fine Power (Blue Led) is OK, no shortcut and Output Frequency (SYS_CLK) is also OK 3.88MHz (with my Extech EX330 Multimeter) (expected 3.90MHz).
I have also Tested 5V, 3.3V and 3V with STM4F Discovery and all work fine.

Next step will be to port TR7970A TI source code on PIC32/STM4F Discovery board to check if NFC really works.

TRF7970A BreakoutBoard V1.0 PCB:
[attachment=2]
TRF7970A BreakoutBoard V1.0 with all components soldered:
[attachment=1]
TRF7970A BreakoutBoard V1.0 first test with STMF4 Discovery:
[attachment=0]

---

Nice looking QFN build :)

I know this is not exactly on topic with this thread, but what was your process for designing the antenna and the RF circuitry?

I personally greatly would like to learn how to make RF enabled devices using RF enabled ic's such as some pic's, but it seems like dark magic to me still.

I see in the datasheet that it lists the components for the RF part of the circuit, is it a good idea to stick with the exact same component values as shown in the datasheet, or do they require changing for each circuit? How did you get the antenna design for it, did you fetch it from a evaluation board or did you design it all your self?

Awesome build by the way! Very clean and organized looking board.

Just an other news about the board,

After some tests on the board (with a BPv3) and especially on antenna with ISO15693 / ISO14443A(Mifare ...), all work fine and results are even better than expected, on ISO15693 and ISO14443A(Mifare One) Card (type credit card) the UID is read at 10cm of the reader !! so the theoretic maximum is reached, of course I use maximum power 200mW by default, but I will try later with half power to check.

Next Time I will write a tutorial on how to init TRF7970A and read UID for ISO15693 and ISO14443A NFC cards with a Bus Pirate and TRF7970A next time.

Best Regards
Benjamin

[quote author="hak8or"]I know this is not exactly on topic with this thread, but what was your process for designing the antenna and the RF circuitry?

I personally greatly would like to learn how to make RF enabled devices using RF enabled ic's such as some pic's, but it seems like dark magic to me still.

I see in the datasheet that it lists the components for the RF part of the circuit, is it a good idea to stick with the exact same component values as shown in the datasheet, or do they require changing for each circuit? How did you get the antenna design for it, did you fetch it from a evaluation board or did you design it all your self?

Awesome build by the way! Very clean and organized looking board.[/quote]

I have designed the antenna using Reference design and datasheet based on TRF7970A and TRF7960.

About how to make RF enabled devices the easy way is to use reference design, else you can also build your own antenna design but you will need tuning with oscilloscope and other tools to check impedance matching for 13.56MHz NFC antenna (around 40 to 50 Ohm) to obtain the best power and the hard part will be to calculate each components depending on the antenna length
I will advise you such documents:
TF796x HF-RFID Reader Layout Design Guide - Ref Texas Instrument SLOA139–April 2009
NFC Design Antenna - Ref Texas Instrument AN144411
Tool for NFC Antenna Design from http://fritz.dellsperger.net/downloads.htm (http://fritz.dellsperger.net/downloads.htm)

Best Regards
Benjamin

[quote author="TitanMKD"]
I have designed the antenna using Reference design and datasheet based on TRF7970A and TRF7960.

About how to make RF enabled devices the easy way is to use reference design, else you can also build your own antenna design but you will need tuning with oscilloscope and other tools to check impedance matching for 13.56MHz NFC antenna (around 40 to 50 Ohm) to obtain the best power and the hard part will be to calculate each components depending on the antenna length
I will advise you such documents:
TF796x HF-RFID Reader Layout Design Guide - Ref Texas Instrument SLOA139–April 2009
NFC Design Antenna - Ref Texas Instrument AN144411
Tool for NFC Antenna Design from http://fritz.dellsperger.net/downloads.htm (http://fritz.dellsperger.net/downloads.htm)

Best Regards
Benjamin[/quote]

Alright, thanks for all the information! I have always wanted to dabble in RF things, but it constantly seemed like black magic to me. Hopefully now I can get a better start knowing that I can generally use the reference design.

Happy holidays too! :P

Test of TRF7970A Breakout Board V1 with BusPirateV3

Hardware requirement:
BusPirate V3 or V4 (shortcut BP).
TRF7970A BreakOut Board V1 (shortcut TRF).

Hardware Configuration for SPI mode with ChipSelect
Warning Never connect 2 different power Input on both +VCC/3V3.
Only one power supply shall be connected to +VCC or to 3V3. (+VCC and 3V3 are linked together on the same line).
Nota1: 3V3 can be connected to +5V or +3V on BusPirate.
Nota2: 3V3 or +VCC accept input voltage from +2.7V to +5.5V.

TRF7970A BreakOut Board V1 connections:
Connect TRF "IO0_GND" signal to TRF "GND".
Connect TRF "EN", "IO1_NCS_GND" and "IO2_VDD_IO_X" signals to TRF "+VCC".
Connect TRF "MOSI" signal to BP "MOSI".
Connect TRF "CLK" signal to BP "CLK".
Connect TRF "MISO" signal to BP "MISO".
Connect TRF "CS" signal to BP "CS".
Connect TRF "3V3" signal to BP "3V3" or "5V".
Connect TRF "GND" signal to BP "GND".
With this configuration, other signals shall not be connected (except optional TRF "MOD", "IRQ" or "ASK_OOK" signals).

SPI Configuration:
CPOL=0 (Clock is Low when inactive)
CPHA=1(Data is Valid on Clock Trailing Edge)
CS Active Low
BusPirate V3 configuration

HiZ>m 5 3 1 1 1 2 2
SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 )
Ready
SPI>W
Power supplies ON
SPI>i
SPI>i
Bus Pirate v3b
Firmware v5.10 (r559)  Bootloader v4.4
DEVID:0x0447 REVID:0x3043 (24FJ64GA002 B5)
http://dangerousprototypes.com (http://dangerousprototypes.com)
CFG1:0xFFDF CFG2:0xFF7F
*----------*
Pinstates:
1.(BR)  2.(RD)  3.(OR)  4.(YW)  5.(GN)  6.(BL)  7.(PU)  8.(GR)  9.(WT)  0.(Blk)
GND    3.3V    5.0V    ADC    VPU    AUX    CLK    MOSI    CS      MISO
P      P      P      I      I      I      O      O      O      I
GND    2.21V  0.00V  0.00V  0.00V  L      L      L      H      L
Power supplies OFF, Pull-up resistors OFF, Normal outputs (H=3.3v, L=GND)
MSB set: MOST sig bit first, Number of bits read/write: 8
a/A/@ controls AUX pin
SPI (spd ckp ske smp csl hiz)=( 3 0 0 0 1 0 )
*----------*

TRF7970A command (Table 5-10. Address/Command Word Bit Distribution):
Bit Description Bit Function Address Command
B7 Command control bit 0 = address 0 1 1 = command
B6 Read/Write 0 = write R/W 0 1 = read
B5 Continuous address mode 1 = Continuous mode R/W 0
B4 Address/Command bit 4 Adr 4 Cmd 4
B3 Address/Command bit 3 Adr 3 Cmd 3
B2 Address/Command bit 2 Adr 2 Cmd 2
B1 Address/Command bit 1 Adr 1 Cmd 1
B0 Address/Command bit 0 Adr 0 Cmd 0

Example commands:
SpiDirectCommand:
1stByte = ((0x80 | CommandCode)) & 0x9f
Software Initialization (0x03):
1stByte = 0x83
[0x83]
Reset 0x09 (Reset FIFO):
[0x89]

SpiReadSingle (Read Register Addr):
RegisterAddr=0x1A (TestRegister R/W)
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A

SpiWriteSingle (Write Register Addr):
RegisterAddr=0x1A (TestRegister R/W)
1stByte = AddressCommand (0x1F&RegisterAddr) = 0x1A

Read Register 0x1A:
[0x5A r]
Write Register 0x1A with value 0x12:
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A
[0x1A 0x12]

Read Register 0x1B:
[0x5B r]
Write Register 0x1B with value 0x13:
1stByte = AddressCommand (0x40|RegisterAddr) | (0x5F&RegisterAddr) = 0x5A
[0x1B 0x13]

Read Chip Status Control Register (0x00)(Default Value 0x01):
[0x40 r]

Read ISO Control Register (0x01)(Default Value 0x02):
[0x41 r]

Read Modulator and SYS_CLK Control Register (0x09):
[0x49 r]

Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz)):
[0x09 0x31]

Read Regulator and I/O Control Register (0x0B):
[0x4B r]

Write Regulator and I/O Control Register (0x0B):
[0x0B 0x00]

Read FIFO Status Register (0x1C)
[0x5C r]

RSSI levels and oscillator status (0x0F)
[0x4F r]

Continuous Read and Clear  IRQ Status (0x0C) (required a dummy read)
[0x6C r:2]

Continuous Read from Addr 0x00 to addr 0x05:
[0x60 r:6]

Continuous Read from Fifo Addr 0x1F:
[0x7F r:9]

Send Data in Fifo:
[0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00]
0x8F = Reset FIFO
0x91 = Send With CRC
0x3D = Write Continuous (Start at 0x1D => TX Length Byte1 & Byte2)
0x00 0x30 = Number of Bytes to be sent (0x30 = 3bytes @0x1D & 0x1E)
0x26 = Request Flags (FIFO TX 1st Data @0x1F)
0x01 = Inventory Command (FIFO TX 2nd Data @0x20)
0x00 = Mask (FIFO TX 3rd Data @0x21)

For more details on TRF7970A chipset see datasheet http://http://www.ti.com/litv/pdf/slos743

Before to initialize chipset to ISO15693 or ISO14443A, you should launch BusPirate V3 configuration "m 5 3 1 1 1 2 2" then "W" then put the NFC card(depending on example ISO15693 or ISO14443A card) on the antenna and execute step 1) to 5) of the chosen example.

Initialize the chipset ISO15693 and read UID:
1) Reset
[0x83]
2) Write Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz))
[0x09 0x31]
3) Configure Mode ISO Control Register (0x01) to 0x02 (ISO15693 high bit rate, one subcarrier, 1 out of 4)
[0x01 0x02]
4) Turn RF ON (Chip Status Control Register (0x00))
[0x40 r] [0x00 0x20] [0x40 r]
5) Inventory Command (see Figure 5-20. Inventory Command Sent From MCU to TRF7970A)
5-1) Send Inventory(8B), Wait 2ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C),  Read Continuous FIFO from 0x1F to 0x1F+0x0A(0x1F/0x7F), Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F)
[0x8F 0x91 0x3D 0x00 0x30 0x26 0x01 0x00] %:2 [0x6C r:2] [0x5C r] [0x7F r:10] %:10 [0x6C r:2] [0x5C r] [0x8F] [0x4F r]

Result example:
/CS ENABLED
WRITE: 0x8F
WRITE: 0x91
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x30
WRITE: 0x26
WRITE: 0x01
WRITE: 0x00
/CS DISABLED
DELAY 2ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x0A
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0x00 0x00 0x88 0x77 0x66 0x55 0x44 0x01 0x04 0xE0
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x00
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED

In this example UID is: 0xE0 0x04 0x01 0x44 0x55 0x66 0x77 0x88 (the first 2 bytes shall be always 0x00 0x00)
The last data READ: 0x7F correspond to RSSI levels.
For more details on ISO15693 (especially Inventory, Read/Write block ...) see document ISO/IEC FCD 15693-3

Initialize the chipset ISO14443A (Mifare One) and read UID:
1) Reset
[0x83]
2) Write&Read Modulator and SYS_CLK Control Register (0x09) (13.56Mhz SYS_CLK and default Clock 13.56Mhz))
[0x09 0x31] [0x49 r]
3) Configure&Read Mode ISO Control Register (0x01) to 0x88 (ISO14443A RX bit rate, 106 kbps) and no RX CRC (CRC is not present in the response))
[0x01 0x88] [0x41 r]
4) Turn RF ON (Chip Status Control Register (0x00)) and Read It
[0x00 0x20] [0x40 r]
5) REQA & WUPA command (Anticollision)
5-1) Disable CRC Calc(0x01), Send Raw REQA no CRC(1B), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C),  Read Continuous FIFO from 0x1F to 0x1F+1(0x1F/0x7F) Read ATQA, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F), wait 20ms, Send Raw AntiColl(2B), wait 5ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Read FIFO Status Register(0x1C/0x5C), Read Continuous FIFO from 0x1F to 0x1F+0x05(0x1F/0x7F), wait 10ms, Read/Clear IRQ Status(0x0C=>0x6C)+dummy read, Reset FIFO(0x0F/0x8F), Read RSSI levels and oscillator status(0x0F/0x4F)
[0x01 0x88] [0x8F 0x90 0x3D 0x00 0x0F 0x26] %:10 [0x6C r:2] [0x5C r] [0x7F r:2] [0x8F] [0x4F r] %:20 [0x8F 0x90 0x3D 0x00 0x20 0x93 0x20] %:5 [0x6C r:2] [0x5C r] [0x7F r:5] %:10 [0x6C r:2] [0x8F] [0x4F r]

Result example:
/CS ENABLED
WRITE: 0x01
WRITE: 0x88
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
WRITE: 0x90
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x0F
WRITE: 0x26
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0xC0 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x02
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0x04 0x00
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED
DELAY 20ms
/CS ENABLED
WRITE: 0x8F
WRITE: 0x90
WRITE: 0x3D
WRITE: 0x00
WRITE: 0x20
WRITE: 0x93
WRITE: 0x20
/CS DISABLED
DELAY 5ms
/CS ENABLED
WRITE: 0x6C
READ: 0xC0 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x5C
READ: 0x05
/CS DISABLED
/CS ENABLED
WRITE: 0x7F
READ: 0xCD 0x88 0x77 0x66 0x00
/CS DISABLED
DELAY 10ms
/CS ENABLED
WRITE: 0x6C
READ: 0x00 0x3E
/CS DISABLED
/CS ENABLED
WRITE: 0x8F
/CS DISABLED
/CS ENABLED
WRITE: 0x4F
READ: 0x7F
/CS DISABLED

In this example UID is: 0xCD 0x88 0x77 0x66 (The last Byte "0x00" (intentionally wrong in is example) is BCC calculated as exclusive-or over the 4 previous bytes which is wrong this example)
The last data READ: 0x7F correspond to RSSI levels.

Nota: This example is very basic and for basic test purpose and do not respect the anticollision mechanism which requires additional data after UID is received.

For more details on ISO14443 (especially Initialization and anticollision) see document ISO/IEC FCD 14443-3.

yeah, that's pretty sweet stuff...... thats somthing..

im confused though, why did you put the DangerousPrototypes logo on it? Its not a dangerous prototypes product.

Also you put 'fulfillment by SEEEDSTUDIO' when it was not. You just ordered a couple PCBs to be designed from a factory near them so they could charge you a few bucks to middle man it. They didnt 'fulfill' anything except your personal PCB order.

It just seems weird to me; like you assumed this design was so kick-ass that you wanted to show people 'this is what it could look like if it was YOUR product, not mine'.

Thats like me putting a 'SparkFun' logo on my design? Doesn't seem right does it? I dont even like sparkfun (makrup is crazy)

[quote author="BrentBXR"]yeah, that's pretty sweet stuff...... thats somthing..

im confused though, why did you put the DangerousPrototypes logo on it? Its not a dangerous prototypes product.

Also you put 'fulfillment by SEEEDSTUDIO' when it was not. You just ordered a couple PCBs to be designed from a factory near them so they could charge you a few bucks to middle man it. They didnt 'fulfill' anything except your personal PCB order.

It just seems weird to me; like you assumed this design was so kick-ass that you wanted to show people 'this is what it could look like if it was YOUR product, not mine'.

Thats like me putting a 'SparkFun' logo on my design? Doesn't seem right does it? I dont even like sparkfun (makrup is crazy)[/quote]

Hi BrentBXR,

Yes it's not Dangerous Prototypes but it's mine, but it's planned to be a dangerous prototypes, such stuff are wrote because I used the DP logo/cartridge in Eagle (and it's also to promote DangerousPrototypes stuff which are really cool) sorry for the confusion it's just a first batch of what could be the final DP/SeeedStudio breakout board.
Now all work fine, the question is how to convert it to DP hardware and produce it by Seeed ...

Sorry for the confusion...

Best Regards,

Benjamin

im confused though, why did you put the DangerousPrototypes logo on it? Its not a dangerous prototypes product.

I said it was cool. It was designed in a forum thread and I don't mind.

Looking back at my post it came out rude which was not the intent. I was just confused as to why you would put the DP logo on it, when its your hard work and design!

but I guess if its something your designing it because DP/Ian asked you too so they can sell, that's a bit different. In that case then of course strap the DP logo on it! :3

Looks great btw! I would like to see a universal MCP23017 IO Expander BP add-on! (example: the centipede for the arduino uno, simple shield that gives your arduino another 32 IOs) :D Like be able to control both output and input of say 16 IO's via the Bus Pirate interface. Then not only could you use it to run protocols (LCDs, parallel, i dont know what else atm) but also just as a general e-switch for your own projects. Just having the ability to control so many switches could be great in alot of projects, and the BP interface just makes it so easy and expandable)

Completely off-topic but i wonder if that would be a good business model? I know Ian explained thats how alot of company's work, if you have a extremely great design (bus pirate for example) you can get adafruit or seeed or sparkfun to start making it and give you royalties but I mean for the not so extremely awesome products (this design no real market besides DP customers, the SID (although im guessing someone would pick that up), the little breakout boards seen here and there, and so on..). The little cool ones being designed by people everyday but dont have the ability or desire to have it mass produced

I guess that would be quite the gamble though (every time)... not to mention revisions and so on.. but on the flip side i bet alot of the people would just be stoked to have there little design being sold to people and be happy with little more then that, perhaps a free assembled one or something! I know I would...

just a ramble...

Hello,

we tried to build a own hardware with the TRF7970A and the MSP430F2370 in Eagle. Until now, we designed three boards, with the circuit of the evaluation board, but all of them don't run, we never get any voltage on VDD_X.

Is there anybody who could help us to develop the board? We will pay for the expenses.

Please contact us via E-mail: info@AFRO-Fluginstrumente.de

Best Regards

Conny

Maybe I can help you if you send me Eagle schematics.

Just be-careful on my own board TRF7970A breakout board I need following connection to have a working TRF7970A (in SPI mode with SS):
Connect TRF "EN", "IO1_NCS_GND" and "IO2_VDD_IO_X" signals to +VCC.
Else maybe you have other problem like TRF7970A not soldered correctly or a problem on the PCB.

I have also a very interesting news, I have finished to port TI TRF7970A EVM Firmware to my STM32F4 Discovery board with chibios and that work like a charm, I use the standard TRF7970A_EVM_GUI.exe GUI and I can read UID and read/write memory of ISO15693 tag, I can read UID of Mifare Card or select the card, I can do lot of other stuff but next step is to test Peer to Peer with 2 TRF7970A board one with STM32F4 and the other with PIC32MX but I need to port the TI TRF7970A EVM Firmware to PIC32 before.

I'm also testing Card Emulator mode with the TRF7970A and the bad things is it seems not possible to emulate card as ISO14443A like Mifare card (tested with my Nexus S as read and I receive only Interrupt with IRQ Status flag = 0x4 (RF field change) and SDD completed never happen) and only ISO14443B Card Emulation seems supported like in the example of EVM source code(but I have not tested it).
Maybe I will need to use direct mode 0 because ASK 100% modulation seems to be not managed (only OOK, ASK 7%, 8.5%,10%, 13%, 16%, 22% and 30% are managed in Modulator and SYS_CLK Control Register (0x09))
Because in 14443A standards it's wrote:
PCD -> PICC – Communication Type A => Use Miller Modified => ASK 100% (in my case in Card Emulation TRF7970A act as PICC so I receive ASK 100% and I shall receive WUPA/REQA)
and
PICC-> PCD - Communication Type A => Use Manchester => OOK (in my case in Card Emulation TRF7970A act as PICC so I send reply using OOK)

Best Regards
Benjamin

Hi Benjamin, where can I find the file sch and brd of your board?

Thank you

Awesome, there will be a DP breakout board?

[quote author="carpas"]Hi Benjamin, where can I find the file sch and brd of your board?

Thank you[/quote]

Hi carpas,

The sch and brd are not pusblished, but it is planned in fact you are the first one to ask for it.
Maybe it will be great to publish them on Dangerous Prototypes SVN.
Anyway to solder QFN that requires hot air and good practice because it's very hard to test if all is good and you can have really weird behaviour if it's badly soldered.

I also maybe plan to do a new project 100% open source on Kickstarter to include NFC support and a powerful µC (multi core ARM based) to build a Hacker/Developer/Tester tools like BusPirate including NFC analyzer(with features like Proxmark3) and other cool high speed protocol analyzer/debugger ... like BusPirate and why not some possible extension for BlueTooth, Zigbee, Wifi ...

Best Regards

Benjamin

[quote author="TitanMKD"]but it is planned in fact you are the first one to ask for it.[/quote]
Very strange. Maybe the people not understand, how many feature has this IC.
So I'm waiting for it.

[quote author="TitanMKD"]I also maybe plan to do a new project 100% open source on Kickstarter to include NFC support and a powerful µC (multi core ARM based) to build a Hacker/Developer/Tester tools like BusPirate including NFC analyzer(with features like Proxmark3) and other cool high speed protocol analyzer/debugger ... like BusPirate and why not some possible extension for BlueTooth, Zigbee, Wifi ...[/quote]
I would like to see a board with TRF7970A and STM32F4 on it, or better ARM CortexA15 (maybe is too much!!!).
Can you sniff also ISO14443* and 15693 with IC TRF7970A?
Proxmark3 for me is a big delusion. Good hardware, but the firmware is bad.

Hi carpas,

About Proxmark3 it is just an amazing hardware and the software is also very good even if it is now a bit limited by hardware resource, to have features like Proxmark3 it is tons of work and research and the major problem is the price of such hardware about 300US$.

About ISO14443 I plan to support ISO14443A which is the most common (with billions of cards like Mifare One ...) and maybe B later (both can be sniffed easily).
About ISO15693 sniffer I do not know if it is possible to sniff it, It needs more research/test with TRF7970A.
About CortexA15 support I think it's too complex and expensive for such hardware (requires BGA ...), I do not want to do an Android Phone ;-) the idea is to do real time embedded stuff with something like Dual Core M4 with maybe even an FPGA all in one, which is not too expensive (less than 50US$).
But this project cannot be done alone some other developers shall participate because the huge work is on firmware like you can see on other project with fantastic hardware like Pandaboard it is nothing if you do not have good software (example even today my Pandaboard cannot play Full HD movie at 24fps, but the hardware can ...).

Best Regards
Benjamin

Hi,

Just a little news about project progress.

I have ported the TRF7970AEVM Firmware to STM32F4 Discovery board and it work fine (I have not tested the peer to peer mode it is in todo list) to read/write ISO/IEC 15693 Vicinity Tags, or to read Mifare Card ISO14443A, I have not tested ISO14443B or Felica because I have not such TAG (but it is planned).

The big news is I have also developed a NFC ISO14443A sniffer (with both side PICC and PCD) and tested it with success on Mifare One/Classic Card reading a whole sector by sniffing a Mifare One communicating with a PN532+PIC32 UBW32(An other project I have wrote from scratch including PN532 C driver).
I plan to do a video soon.

Best Regards
Benjamin

Hi Benjamin. Thank you for the updates. Maybe it's time to release somethings to the public.

Hi Benjamin, what is happen? After my post you stop to talk here.
Why don't you open a project on google code? I think DP will put it easly in it SVN.
Also if source code aren't perfect not matter, the community will improve it.

Hi,

It is planned to release the source code but it take time to clean up and fix the last bugs and I need to document the whole stuff which imply multiple hardware connections.
About project progress:
Now the sniffer output sniffed data in formated ASCII at 1.7Megabauds on an other USART with DMA (it still respect hard real-time of 8us between 2 received frame).

See an extract of Mifare One(Credit Card format) communication sniffed:
This example just read sector 0 (Block 0 to 3) and start to read sector 1 (Block 0).
This extract contains following ISO14443A & Mifare communication details:
Mifare Card UID for this test:  cd 81 5f 76
ISO/IEC FCD 14443-3 TypeA:

• Wakeup(52)
• ATQA (04 00)
• Selection (93 70  ...)
• SAK (08 ...)

MIFARE Classic 1K(MF1S50yyX):

• Mifare Authenticate block 0x00 using key A (60 00 ...)
• Mifare Tag nonce/Tag Challenge (0c 1c 6e 28)
• Mifare Reader nonce/Reader challenge (a6 e1 31 35) & response/Reader Response (f7 0c a7 d4)
• Mifare Tag response (7f a1 58 7c)
• Mifare Read one block (bb f4 57 09 => Crypted)
• Mifare Data for Block 0 (a1 63 ... => Crypted)
  and so on ...

The output format is very basic when it start by:

• 4 "space" characters (it is the PCD) followed by data.
• "TAG " characters (it is the PICC) followed by data.

Extract of Output Trace
...
    52
TAG 04 00
    93 70 cd 81 5f 76 65 d1 86
TAG 08 b6 dd
    60 00 f5 7b
TAG 0c 1c 6e 28
    a6 e1 31 35 f7 0c a7 d4
TAG 7f a1 58 7c
    bb f4 57 09
TAG a1 63 a4 b9 4b 2c ca 2a bc 35 dd 9b c7 12 8e 8a 64 77
    31 9a 88 aa
TAG f5 a8 04 d2 af db 01 b3 55 b6 07 9c 62 da ec 63 b3 eb
    3b 2a 3f f9
TAG ff fa c0 bf 8c e5 64 87 24 59 57 93 d7 b4 26 bb c2 4b
    f9 d7 ad 12
TAG 61 38 0b 23 93 c7 c6 3b 62 8a 62 47 9c e4 13 e5 c2 79
    a1 a5 d5 bc
TAG 14 80 a1 a6
    a8 68 98 fc cd 7c c3 85
TAG bb 5f c6 8b
    ee 72 ba 72
TAG 1d f7 a8 a0 f7 98 bd ee 68 52 34 37 c5 10 cb 65 8a 6c
...

Best Regards
Benjamin

Just some news about TRF7970A v1.1 Board and news about Firmware for it on STM32F4 Discovery, see my blog http://titanmkd.blogspot.fr/ (http://titanmkd.blogspot.fr/) for more informations and a little funny challenge to decrypt my Mifare Card.

Best Regards
Benjamin

Thanks for the update, we'll post it up!

Thanks Ian,

I have an update I just received the PCB from Itead and the quality is really good.
I just soldered one board for test and it's a success it work fine and sensibility seems even better than previous version.

See photos here http://bvernoux.free.fr/hw/TRF7970A_v1_1/ (http://bvernoux.free.fr/hw/TRF7970A_v1_1/)

Best Regards

Benjamin

Hi, do you plan to release schematics/board? I would like to play with that IC and I would like to save
some time spent on board design etc. :) Thanks.

Hi,

I'm sorry but because of a problem with a company I will not release the design publicly
If you are interested by the full design and depending on project contact me by email with your project
Best regards
 Benjamin

Hey Benjamin,

Any luck interfacing this board with an Arduino?

Thanks,
Brian

[quote author="TitanMKD"]I'm sorry but because of a problem with a company I will not release the design publicly[/quote]
Hi Benjamin,

have you a problem with a company, also for the source code?

Hi,

In fact all is my own work (and developed only by me hw & sw side) and it was intended to be sell to a company and because this company declined the offer, because maybe they was thinking they could have all for free when the full source code and hw will be open source as it was planned, so I decided to do not publish it.
So for those really interested you can contact me to obtain hw + sw for very good price (especially if it is for non commercial use).

Best Regards
Benjamin

[quote author="TitanMKD"]Hi,

In fact all is my own work (and developed only by me hw & sw side) and it was intended to be sell to a company and because this company declined the offer, because maybe they was thinking they could have all for free when the full source code and hw will be open source as it was planned, so I decided to do not publish it.
So for those really interested you can contact me to obtain hw + sw for very good price (especially if it is for non commercial use).

Best Regards
Benjamin[/quote]

You could release it under the CC BY NC license..the non-comertial... basically you could sue the pants of the company if they attempt to use it in commercial purposes..

Hi Benjamin! I am new to the world RFID-NFC and am starting to do some work and experiments with 13,56 Mhz passive tags. i would apreciate any help or hint that u could give me at this first work:
 
 
I'm interested to know how I can physically connect (circuit level diagram) a TRF7970A to make it work as a PASSIVE TARGET!. I found that in the datasheet of TRF7970A shows a circuit-level configuration to operate the TRF7970A as READER / WRITER. Also, I would like to know if this setup allows me to function as passive target or only as reader / writer.
 
Another intriguing question is that I know in NFC, the IC tag (in this case TRF7970A) must work in conjunction with a MCU (for comfort may be the MSP430), and suppose that the MCU must be programmed (with some physical socket and software)  before mounting the circuit. There are libraries and codes already defined and available to the MSP430 make the system MCU + IC + Antenna works as PASSIVE TARGET?.
 
As last, I have understood that to configure TRF7970A must be modified a number of registers to configure to my liking and need (registers that are contained in the TRF7079A internally or am I wrong?). Which hardware and software i can use to change those records? Or simply this is done directly from the MCU code?
 
 
 
Thank you very much for your kind and apreciated assistance!

Hi Bankomer,

Of course the TRF7970A work in any mode PASSIVE or ACTIVE.
In my own application I use Passive mode and special registers to sniff data received & sent by a TAG in order to debug transfer or learn new protocol.

About code available for PASSIVE Target like to emulate a TAG there is no code available (the code in TI EVM is not working and commented IIRC) and I have not implemented this mode but it is well described in datasheet, when I will have some spare time I will probably try to implement it.
About using it with MSP430 I cannot reply as I use a bigger MCU the STM32F4 which is enough for all NFC mode and especially sniffing which requires lot of CPU power to sniff and decode frame in realtime at up to 848KHz.

For the last question how to modify TRF7970A register just look at TRF7970A EVM GUI it is Windows GUI software to do that and test lot of stuff.
This PC software work with TRF7970A EVM firmware of the TRF7970A EVM board (MSP430), but I have ported the code to STM32F4 too.

If you want more details you can check my blog http://titanmkd.blogspot.com (http://titanmkd.blogspot.com) as I even explain how to read UID of NFC card with just a Bus Pirate.

Best Regards
Benjamin

Hi,
i am using / playing with a STM32VLDiscovery Board at the moment, but also bought a STM32F4 Discovery (but not tested yet, and the STM32F3 also looks cool).
I just wanted to do some NFC experiments with my Nexus S.

How much work is it, to port the TI MSP430 sources to a STM32 µC?

Is Chibi-OS an advantage for this?
I already looked at this OS earlier, and it seems really cool, especially for the STM32 Controller;
but as having no experiences with a RTOS, in the moment i am working with simpler program structures  like state machines, and the ST standard peripheral libraries.

Hi,

[quote author="krex3c"]Hi,
i am using / playing with a STM32VLDiscovery Board at the moment, but also bought a STM32F4 Discovery (but not tested yet, and the STM32F3 also looks cool).
I just wanted to do some NFC experiments with my Nexus S.

How much work is it, to port the TI MSP430 sources to a STM32 µC?

Is Chibi-OS an advantage for this?
I already looked at this OS earlier, and it seems really cool, especially for the STM32 Controller;
but as having no experiences with a RTOS, in the moment i am working with simpler program structures  like state machines, and the ST standard peripheral libraries.[/quote]

Porting TI MSP430 EVM code to ChibiOS takes me about 5 days of work (for a basic portage), it requires to use ChibiOS driver and rewrite the interrupt events and cleanup lot of stuff everywhere in the code as there is lot of code specific to MSP430.
For a proper stuff I will advise to rewrite all from scratch because finally the ported code was like a full rewrite at end.

Anyway for such fast result you need a good knowledge of ChibiOS/driver and how the MSP430 code work (with very good knowledge of TRF7970A datasheet) as it is full of trap and bugs, but it is a very good starting point especially for a demo or to quickly check basic stuff like reading UID ...

So to do that from start without knowledge on TRF7970A, it can takes between 2 weeks and 1 month(it is more realistic) depending on your own experience on C/driver and how low level stuff work(including datasheet and testing with oscilloscope and logic analyzer).
Anyway the most consuming task was to develop the NFC sniffer but it's an other part as it requires tons of tests and hacking because of usage of non documented part in TRF7970A and also because it requires DMA and custom drivers with hard real-time (to output decoded symbol in real-time during sniffing).

Best Regards
Benjamin

Thank you for your answer, it seems to be not as easy as i hoped.
Especially when there is  lot of MSP430 specific distributed everywhere in the code.
When I find the time, i think i will start with reading the MSP430 sources and the TRF7970A datasheet.

Hi again Benjamin.

As I said some time ago, im trying to make work an trf7970a as a passive target or card.

I have an TRF7970A IC + PIC16F886 to do the work. Also, i got an TRF7970 EVM, so i would like to port the MSP430 code (from the EVM) to the PIC16F886. Could you explain me how to port this code? (I readed that it can be possible to port the msp code by the GUI).

Also, could you explain me (and sorry for the dummy question) what is, for example, when on trf7970a' datasheets says:

"Initialize SPI with SS by using Direct Command 0x03 -> 0x83"

1.- The Direct command 0x03 (And ALL the Direct Commands) is a MSP430 custom command previosly defined? Or are commands that can be used by any MCU and the when the IC receive it, execute "a specific action"?
2.- The "->" means to set high the Most Significant Bit?


Thank you so much!

Hi Bankoner,

DIrect Command 0x3 -> is 0x83 because MSB = 1 for Read, 0 = Write

I have explained it on my document Test of TRF7970A Breakout Board V1 with BusPirateV3, see PDF in attachement. [attachment=0]

I will also, advise you to download the latest TRF7970A datasheet (January 2013).
http://http://www.ti.com/lit/ds/symlink/trf7970a.pdf

Best Regards
Benjamin

Thank you so much Benjamin for the docs.

Now, I understand about the MSB, but im still confused about the Direct Commands and how they works... ( question 1 ) If you could explain me that, would be so great ( since im a electronic's begineer jeje)..

Thank you a lot!

P.D.: I have finished and mounted all the hardware ... I only need to program the PIC16F886 to make it work and do the tests!!

Also, Im thinking about to detect the TRF with the TRF7970EVM.. But well... I Need to understand the Direct Commands to build the code!

Thank You!

Hi  again Titan!

In my application (Make TRF7970A+PIC16F886 works as NFC TARGET), I will communicate the MCU - TRF7970A with SPI interface, for which I wired:

I/O_4 - Slave Select
I/O_6 - MISO
I/O_7 - MOSI
DATA_CLK - DATA_CLK

1) Are all these necessary connections? Also, I need to wire the IRQ port?

2) The frequency of DATA_CLK between Master (PIC) and Slave (TRF) must be 2 Mhz?

3) As I have understood, SYS_CLK serves to give an auxiliary clock signal to an external MCU, but I'm still not entirely clear. The MCU clock signal is provided by  SYS_CLK? or I can generate MCU clock signal with a crystal or an internal oscillator? (I'm sorry for this dummy question).

4) I made the antenna as described in the Application Report SLOA135 provided by Texas Instruments. The antenna must be connected between the two 0 ohm resistors shown in the Figure 4.2 of TRF7970A  Datasheet?

Thanks in advance.

Armando.