MP300 SC1 (spy+smartcard simulation)

A cutting edge ISO/IEC 7816-3, SWP, USB 2.0 and USB-IC protocol analyser and smartcard emulator

  • Ideal CLF tester

  • Protocol analysis and spy of ISO/IEC 7816, SWP, USB-IC and USB 2.0 protocols

  • Emulation of ISO/IEC 7816 and SWP smartcards

  • Electrical measurement features


This tester will typically be used in the following contexts :

  • Protocolary analysis of a handset or a banking terminal
  • On-site debugging sessions
  • Characterisation of a CLF, or of a smartcard reader

 

The main features of the MP300 SC1 are :

  • Protocol analysis of exchanges happening following the ISO/IEC 7816-3 and -4, SWP/S-HDLC/HCI, and USB 2.0 protocols
  • Compatible with ETSI TS 102 613 and TS 102 622 specifications
  • Automatic detection of baudrate changes
  • Detailed graphical representation of the spied exchanges
  • Non intrusive data acquisition probe
  • All protocols can be spied simultaneously
  • Possibility to perform physical measurement (current and voltage oscilloscope-like display)
  • Evolutivity into a smartcard emulator (ISO/IEC 7816-3 and –4 and SWP)
  • Numerous possibilities of protocolary testing (response times, wrong CRC, parity errors)
  • Physical customisation of the emulated smartcard
  • Wide range of probes available, to cover all types of handsets, as well as traditional ID1 smartcards
  • Backwards compatibility with the Star 3150
  • Open platform : integrate the MP300 SC1 inside your own test platform
  • Supplied with the MPManager software suite, enabling the complete control of the tester without any programming knownedge
  • Possibility to synchronise this tool with a MP300 TCL2 or SCL1, for the analysis of a complete NFC or dual interface transaction

 

Supported protocols

Protocol analysis mode

ISO/IEC 7816-3
T=0 and T=1 protocols
  • 100% implemented
Block level spy
  • Available

SWP (ETSI TS 102 613 and TS 102 622)
Baudrate supported
  • From 49kbps to 1.9Mbps
Block level spy
  • Available
LLC level spy (S_HDLC, ACT, CLT)
  • Available
HCI
  • Available

Synchronous chips (memory chips)
Implemented
Example of supported chips
  • Eurochip
  • T2G
  • SLE 4442
  • SLE 4407
  • AT24CXX

USB 2.0
Supported speeds
  • Low speed, full speed

USB-IC
Supported voltage classes
  • All classes are supported

Smartcard emulation mode

ISO/IEC 7816-3
T=0 and T=1 protocol
  • 100% implemented by firmware
Custom protocol emulation
  • Available

SWP (ETSI TS 102 613 and TS 102 622)
Baudrate supported
  • From 49kbps to 1.9Mbps
Block level spy
  • Available
LLC level spy (S_HDLC, ACT, CLT)
  • Available

Programmable parameters

Protocol analysis mode

ISO/IEC 7816-3
I/O direction detection threshold

SWP (ETSI TS 102 613 and TS 102 622)
SWP S2 channel current threshold

Smartcard emulation mode

ISO/IEC 7816-3
Guard time
  • Defined in ETUs
Smartcard response time
  • Defined in ETUs

SWP (ETSI TS 102 613 and TS 102 622)
Current values on SWP S2 signal (high and low states)
  • From 1nA to 2mA
Smartcard response time

Spy feature

Accuracy
  • 20ns
Signals displayed
  • Signals C1, C2, C3, C4, C6, C7, C8
  • SWP S1, SWP S2
  • Trigger in
  • Trigger out
Protocols supported
  • ISO/IEC 7816-3, SWP, USB 2.0 (simultaneous spy possible without accuracy damage)
Type of events displayed
  • Logical state change
  • Characters
  • Modification of baudrate
  • Clock frequency detection
  • Analog representation of the signals
  • I/O direction

Available tests

Electrical measurement (available for all versions)
Possibility to execute simultaneous voltage and current measurement to characterise both the terminal and the smartcard
Number of samples
  • 512000 (unlimited for Vcc)
Contacts available
  • C1, C6, C7

Perturbations (smartcard emulation mode)

ISO/IEC 7816
Sending out of standard blocks (wrong CRC, wrong data length, ...)
Sending characters with parity error
Simulating reception of parity errors
Modifying the guardtime on the fly

SWP (ETSI TS 102 613 and TS 102 622)
Sending out of standard blocks
Removal of bit stuffing
Card response time
Master resume time measurement

Triggers

The MP300 SC1 offers triggers, to synchronise or to be synchronised by external laboratory devices (oscilloscopes,...)

Physical information

Weight
  • 1.98 kg
Dimensions
  • Width : 150mm
  • Height : 78mm
  • Depth : 270mm

Communication parameters

USB 2.0
TCP/IP 10/100 Mbps
RS 232

Software development

Remote development (the code is executed from the PC)
Elements available
  • MPSDK .NET library available on demand
  • Communication Dll supplied
Supported programming languages
  • C, C++, VB, Java, .NET
  • Any language that supports Dll

Embedded development (the code is executed directly by the MP300)
Recommended cross compiler
  • Windriver compiler (prefered version : 4.4b)

User Interface

MPManager

The MP300 SC1 is supplied with the MPManager software, whose aim, is to open all of the tester’s functionalities, accessible just with mouse clicks.

First, the user just needs to select the information he is interested in. The choice is available contact per contact.

 
In this example, the pin C6 (SWP). It is possible to select the level of display (character,logical, physical)


 

Starting the spy is just as simple as clicking a button. At the end of the session, the viewer is available.

 
Here, a SWP transaction, decoded at the LLC level


 

Different levels of analysis are available.

 
HCI analysis level is also available


 

The MP300 SC1 also allows you to perform physical measurement when trapping an exchange

 
An example of very noisy communication happening on the SWP bus


 


Micropross supplies a complete range of accessories for the MP300 SC1, that include :

  • A SIM to ISO converter
  • Numerous shapes of probes, to use this tester with different types of contact smartcard readers and handsets
  • A probe to enable spying sessions between a smartcard and an external reader
  • A probe for oscilloscope connection

We also supply packages to extend the warranty of the tester. Please ask us for the maintenance contracts available.