MP300 TC3 + MP300 TCL2


  • Simple synchronisation link

  • Contact and contactless exchanges displayed on the same time base

  • Convenient data display thanks to the MPManager software suite

  • Possibility to do parametric tests on both contact and contactless interfaces of the combi card






The main features of the combination MP300 TC3 + MP300 TCL2 are :

  • Spy of ISO/IEC 7816-3, SWP, USB 2.0, ISO/IEC 14443, Mifare TM, FeliCa TM, ISO/IEC 15693 exchanges on one single session
  • Convenient display of the captured data using the MPManager software
  • Contact and contactless exchanges can be synchronised for better
  • Simple to setup
  • Possibility to check the influence of one interface on the other
  • All features of both MP300 testers remain available
  • Enables to capture a complete NFC transaction
  • Presence of numerous business oriented interpreters, including SWP/S-HDLC/HCI, EMV, GSM, 3G, LTE, NFC-IP1, NFC Forum for a better understanding of all spied exchanges.

 

The combination of MP300 TC3 + MP300 TCL2 will typically be used in the following contexts :

  • Characterisation of a dual interface smartcard
  • Debug of a CLF (contactless front end)

 

MP300 TC3 : Supported protocols

ISO/IEC 7816-3
T=0 and T=1 protocols
  • 100% implemented, managed by firmware
Hardware acceleration
  • Transmission and reception of characters managed by the MicroSmart technology

USB 2.0
Available speeds
  • Low speed, full speed
Classes
  • ISO/IEC 7816-12, mass storage, custom protocols

USB-IC

SWP (ETSI TS 102 613 and TS 102 622)
SWP transmission
  • Assisted by hardware
LLC layers support
  • ACT, CLT and S-HDLC realised by firmware
Evolutivity
  • This tester can be upgraded to support future evolutions of the standard

Synchronous chips (memory chips)
Available libraries
  • T2G
  • Eurochip
  • SLE 4442
  • SLE 4407
  • AT24CXX
Custom protocols development
  • Available
Hardware acceleration
  • Available

Raw mode
Gives the possibility to exchange frames without any Protocolary encapsulation

Out of standard chips support
Benefit from Micropross'experience in smart card programming

MP300 TC3 : Programmable parameters

Physical parameters

Voltages
Vcc
  • 0V to 10V
Vol
  • 0V to 5V
  • Each contact can be adjusted independently
Voh
  • 1V to 7V
  • Each contact can be adjusted independently
Vil
  • 0,2V to 5V
Vih
  • 1V to 6,8V

Frequency
ISO 7816 clock frequency
  • 10kHz to 20MHz
ISO 7816 clocy duty cycle
  • 30% to 70%

Rise and fall times
Vcc
  • From 20ns to 1.8V/ms
C2, C3, C4, C6, C7, C8
  • From 10ns to 5µs (500µs on C2)
  • Each contact can be adjusted independently)

Pin states
All pins are independent from each other, and can be separately managed

ISO 7816 communication parameters
ETU with
  • From 1 to 4096 clock cycles (bit sampling adjustable)
BGT, initial ETU width
  • Adjustable in clock cycles
BWT, CWT, EGT, RGT, WWT
  • Adjustable in ETUs
Clock stop at high or low state
  • Adjustable
Clock stop tG and tH timings
  • Adjustable in clock cycles
Parity control
  • Can be forced to 0, 1, odd, even
Input parity error checking
  • Can be disabled
Pull-up resistor
  • 5kΩ or 22kΩ by fixed pull-up resistor
  • Any value between 1kΩ and 100kΩ can be emulated
SWP communication parameters
Baudrate
  • Adjustable from 49kbps to 1.9Mbps
SWP duty cycle (definition of SWP S1 high and low states duration)
  • Adjustable from 0% to 50%
SWP S2 detection threshold
  • Adjustable from 1nA to 1.1mA
Activation time, P2, P3 timings
  • Adjustable
USB-IC parameters
USB-IC specific attachment procedure
  • Managed by the tester
Voltage classes supported
  • 1.8V and 3.0V

MP300 TC3 : Spy feature

Accuracy
  • 20ns
Signals displayed
  • Signals C1, C2, C3, C4, C6, C7, C8
  • SWP S1, SWP S2
  • Trigger in
  • Trigger out
Protocols supported
  • ISO/IEC 7816-3, SWP, USB 2.0 (simultaneous spy possible without accuracy damage)
Type of events displayed
  • Logical state change
  • Characters (ISO/IEC 7816, SWP, USB 2.0, USB-IC
  • Modification of baudrate
  • Clock frequency detection
  • Analog representation of the signals
  • I/O direction

MP300 TC3 : Available tests

Electrical tests

Open/short test
Available contacts
  • Contact C1, C2, C3, C4, C5, C6, C7, C8
Forced current
  • Adjustable between –500µA and 500µA

Leakage current measurement
Available contacts
  • Contact C1, C2, C3, C4, C6, C7, C8
Measurement ranges
  • +/- 5mA
  • + - 500µA

Voltage measurement
Available contacts
  • Contacts C1, C2, C3, C4, C6, C7, C8
Range available
  • +/- 10V
Modes available
  • Dynamic mode : we give you an analog like vision of the voltage on the pin you chose from the moment you chose
  • Static mode : we give you the instant voltage value
  • Burst mode : 512000 voltage measurements are made with 40ns in between, on C1, C6 or C7, to give an analog like display of the studied signal

Current measurement
Available contacts
  • Contacts C1, C2, C3, C4, C6, C7, C8
Ranges available
  • +/- 100mA
  • +/- 25mA
  • +/- 5mA
  • +/- 500µA
Modes available
  • Dynamic mode : we give you an analog like vision of the current on the pin you chose from the moment you chose
  • Static mode : we give you the instant current value on the selected contact
  • Burst mode : 512000 current measurements are made with 40ns in between, on C1, C6 or C7, to give an analog like display of the studied signal

Parametric tests
Available contacts
  • Contacts C1, C2, C3, C4, C6, C7, C8
Modes available
  • Force a current, measure a voltage
  • Force a voltage, measure a current

SWP specific measurement functions
S2 signal characterisation
  • Measurement of minimum and maximum values of the current on the S2 signal during a given period

Logical tests

Anti tearing test
Simulate the chip's immunity against tearing from the reader

Timing measurement
Measure the chip response to a command

Concurrent I/O testing
Simultaneous sending of characters in ISO/IEC 7816 and SWP, with a user defined time offset (can be 0 ns)

Personalisation assisted by hardware
Do not lose a microsecond while sending data to the chip thanks to the hardware assisted data sending mechanism

MP300 TC3 : Sequencer tests

Generation of glitches on Vcc, C3, C6
Modification at a user defined moment of the state of a pin
Sending out of standard frames/provoking collisions
Creation of custom activation/deactivation sequences
Generation of parity errors on transmission, simulation of parity errors on reception
Management of triggers
Sudden modification of an electronic parameter
Definition of the time between two commands

MP300 TCL2 : Supported protocols

ISO/IEC 18092 (NFC-IP1, NFC-IP2) and NFC Forum
Communication modes supported
  • Passive initiator
  • Passive target (optionnal)
  • Active initiator
  • Active target

ISO/IEC 14443-3 (proximity cards)
Type A
  • Supported
Type B
  • Supported
Anticollision
  • Managed by firmware
T=CL protocol
  • Managed by firmware
Supported baudrates
  • 106, 212, 424, 828 kbps
  • Asymetrical baudrates supported

B’ (Innovatron)
Supported

ISO/IEC 15693 (vicinity cards)
Coding type
  • Manchester
Encoding modes
  • 1 out of 4
  • 1 out of 256

ISO 18000-3 Mode 1
Supported

Mifare TM
Types supported
  • Classic
  • Light
  • Ultra Light
  • Ultra Light C
  • Many more
Encryption
  • Assisted by hardware

FeliCa TM
Available baudrates
  • 212 and 424 kbps
Encryption
  • Available through an external device

Raw mode
Gives the possibility to exchange frames without any protocolary encapsulation

Out of standard chips
Benefit from Micropross’experience in smartcard programming

MP300 TCL2 : Programmable parameters

Physical parameters (contacless interface)
Field strength
  • Adjustable
Modulation index
  • From 0% to 100%
Field rise time
  • 0ms to 5ms
Carrier frequency
  • 12.56MHz to 14.56MHz
Modulation rise and fall times
  • 0µs to 10µs

Logical tests (contact interface)
Type A pause width
  • 0 to 4,4µs
Frame waiting time
  • Adjustable in ETU
Type B framing (SOF, EGT, EOF, bit duration)
  • Adjustable in clock cycles
TR2 timing
  • Adjustable with the sequencer
Communication speed
  • 106, 212, 424, 848 kbps

MP300 TCL2 : Spy feature

Resolution
  • 20ns
Events displayed
  • Field detection
  • External field detection (for active mode)
  • Carrier and subcarrier detection
  • Type A sequences
  • Phase changes
  • Bytes
  • Frames
  • User events
  • Trigger in
  • Trigger out
  • I/O direction
  • Baudrate changes (asymetrical baudrates are supported)

MP300 TCL2 : Available tests

Electrical measurements

Resonance frequency measurement (loaded and unloaded modes)
Range
  • 11 to 24 MHz

Q factor measurement

Chip impedance
Frequency at which the measurement is done
  • 13.56MHz

Magnetic field measurement

Logical testing

Automatic testing
Send type A command, wait, send type B command and receive answer (for type B cards)
Send type B command, wait, sent type A command and receive answer (for type A cards)
Switch on field, wait, send request command (A or B), receive answer
Send request, wait, send request, receive the answer
Antitearing
PICC reset characterization
Check minimum FDT (frame delay time)

Testing through API manipulation
Response time measurement (FDT, TR0, TR1)
Sending of out of standard frames
Sending misformed blocks (wrong number of bits)
Retro modulation ratio measurement
Distance simulation checking
Separated RX channel allowing communication using a RF amplifier

MP300 TCL2 : Triggers

The MP300 TCL2 offers many triggers, to synchronise or to be synchronised by external laboratory devices (oscilloscopes,...)

MP300 TCL2 : Physical information

Weight (Uniterary rack package)
  • 1.98 kg
Dimensions (Uniterary rack package)
  • Width : 150mm
  • Height : 78mm
  • Depth : 270mm

MP300 TCL2 : Communication parameters

USB 2.0
TCP/IP 10/100 Mbps
RS 232

MP300 TCL2 : Software development

Remote development (the code is executed from the PC)
Elements available
  • MPSDK .NET library available on demand
  • Communication Dll supplied
Supported programming languages
  • C, C++, VB, Java, .NET
  • Any language that supports Dll

Embedded development (the code is executed directly by the MP300)
Recommended cross compiler
  • Windriver compiler (prefered version : 4.4b)

MP300 TCL2 : User Interface

MPManager

The software that is used for the display of the trapped exchanges is MPManager.

Once the spy session is over, the “Viewer” window of MPManager shows all signals that have been spied (contact and contactless exchanges)

 
Here, exchanges in ISO 7816, SWP and ISO 14443B have been spied simultaneously

 

The viewer window of MPManager also gives a graphical display of the trapped exchanges.
For example on the following screenshot, we have a contactless command (starting a payment application). This command will be in fact executed by the U-SIM. The contactless frame thus needs to be translated into SWP

 
Here, contactless and SWP exchanges are displayed together, on the same time base

 

The time between the contact, and the SWP blocks, is the time it takes to the NFC component to do the translation job.
By positionning two cursors, we will know how long it takes to the NFC component to perform this job.

 
The blue cursor is set at the end of the contactless frame

 

The red cursor is set at the beginning of the SWP frame.

 
The red cursor is set at the beginning of the SWP frame.

 

MPManager gives us the time difference between both cursors

 
It took 2.3 ms for the NFC component to do the translation

 


Micropross supplies a complete range of accessories for their laboratory tools, that include :

 

  • A SIM to ISO converter
  • Numerous shapes of probes, to use this tester with different types of contact smartcard readers and handsets
  • A probe to enable spying sessions between a smartcard and an external reader
  • A probe for oscilloscope connection
  • Different sizes of antennas, to handle any kind of form factors

We also supply packages to extend the warranty of the tester. Please ask us for the maintenance contracts available.