MICROPROSS | Test and personnalisation tools for smartcards, RFID and NFC industry

The main features of the combination MP300 TC3 + MP300 TCL2 are :

Spy of ISO/IEC 7816-3, SWP, USB 2.0, ISO/IEC 14443, Mifare TM, FeliCa TM, ISO/IEC 15693 exchanges on one single session
Convenient display of the captured data using the MPManager software
Contact and contactless exchanges can be synchronised for better
Simple to setup
Possibility to check the influence of one interface on the other
All features of both MP300 testers remain available
Enables to capture a complete NFC transaction

The combination of MP300 TC3 + MP300 TCL2 will typically be used in the following contexts :

Characterisation of a dual interface smartcard
Debug of a CLF (contactless front end)

MP300 TC3 : Supported protocols

ISO/IEC 7816-3
T=0 and T=1 protocols	100% implemented, managed by firmware
Hardware acceleration	Transmission and reception of characters managed by the MicroSmart technology
USB 2.0
Available speeds	Low speed, full speed
Classes	ISO/IEC 7816-12, mass storage, custom protocols
USB-IC
SWP (ETSI TS 102 613 and TS 102 622)
SWP transmission	Assisted by hardware
LLC layers support	ACT, CLT and S-HDLC realised by firmware
Evolutivity	This tester can be upgraded to support future evolutions of the standard
Synchronous chips (memory chips)
Available libraries	T2G Eurochip SLE 4442 SLE 4407 AT24CXX
Custom protocols development	Available
Hardware acceleration	Available
Raw mode
Gives the possibility to exchange frames without any Protocolary encapsulation
Out of standard chips support
Benefit from Micropross'experience in smart card programming

MP300 TC3 : Programmable parameters

Physical parameters
Voltages
Vcc	0V to 10V
Vol	0V to 5V Each contact can be adjusted independently
Voh	1V to 7V Each contact can be adjusted independently
Vil	0,2V to 5V
Vih	1V to 6,8V
Frequency
ISO 7816 clock frequency	10kHz to 20MHz
ISO 7816 clocy duty cycle	30% to 70%
Rise and fall times
Vcc	From 20ns to 1.8V/ms
C2, C3, C4, C6, C7, C8	From 10ns to 5µs (500µs on C2) Each contact can be adjusted independently)
Pin states
All pins are independent from each other, and can be separately managed
ISO 7816 communication parameters
ETU with	From 1 to 4096 clock cycles (bit sampling adjustable)
BGT, initial ETU width	Adjustable in clock cycles
BWT, CWT, EGT, RGT, WWT	Adjustable in ETUs
Clock stop at high or low state	Adjustable
Clock stop tG and tH timings	Adjustable in clock cycles
Parity control	Can be forced to 0, 1, odd, even
Input parity error checking	Can be disabled
Pull-up resistor	5kΩ or 22kΩ by fixed pull-up resistor Any value between 1kΩ and 100kΩ can be emulated
SWP communication parameters
Baudrate	Adjustable from 49kbps to 1.9Mbps
SWP duty cycle (definition of SWP S1 high and low states duration)	Adjustable from 0% to 50%
SWP S2 detection threshold	Adjustable from 1nA to 1.1mA
Activation time, P2, P3 timings	Adjustable
USB-IC parameters
USB-IC specific attachment procedure	Managed by the tester
Voltage classes supported	1.8V and 3.0V

MP300 TC3 : Spy feature

Accuracy	20ns
Signals displayed	Signals C1, C2, C3, C4, C6, C7, C8 SWP S1, SWP S2 Trigger in Trigger out
Protocols supported	ISO/IEC 7816-3, SWP, USB 2.0 (simultaneous spy possible without accuracy damage)
Type of events displayed	Logical state change Characters (ISO/IEC 7816, SWP, USB 2.0, USB-IC Modification of baudrate Clock frequency detection Analog representation of the signals I/O direction

MP300 TC3 : Available tests

Electrical tests
Open/short test
Available contacts	Contact C1, C2, C3, C4, C5, C6, C7, C8
Forced current	Adjustable between –500µA and 500µA
Leakage current measurement
Available contacts	Contact C1, C2, C3, C4, C6, C7, C8
Measurement ranges	+/- 5mA + - 500µA
Voltage measurement
Available contacts	Contacts C1, C2, C3, C4, C6, C7, C8
Range available	+/- 10V
Modes available	Dynamic mode : we give you an analog like vision of the voltage on the pin you chose from the moment you chose Static mode : we give you the instant voltage value Burst mode : 512000 voltage measurements are made with 40ns in between, on C1, C6 or C7, to give an analog like display of the studied signal
Current measurement
Available contacts	Contacts C1, C2, C3, C4, C6, C7, C8
Ranges available	+/- 100mA +/- 25mA +/- 5mA +/- 500µA
Modes available	Dynamic mode : we give you an analog like vision of the current on the pin you chose from the moment you chose Static mode : we give you the instant current value on the selected contact Burst mode : 512000 current measurements are made with 40ns in between, on C1, C6 or C7, to give an analog like display of the studied signal
Parametric tests
Available contacts	Contacts C1, C2, C3, C4, C6, C7, C8
Modes available	Force a current, measure a voltage Force a voltage, measure a current
SWP specific measurement functions
S2 signal characterisation	Measurement of minimum and maximum values of the current on the S2 signal during a given period
Logical tests
Anti tearing test
Simulate the chip's immunity against tearing from the reader
Timing measurement
Measure the chip response to a command
Concurrent I/O testing
Simultaneous sending of characters in ISO/IEC 7816 and SWP, with a user defined time offset (can be 0 ns)
Personalisation assisted by hardware
Do not lose a microsecond while sending data to the chip thanks to the hardware assisted data sending mechanism

MP300 TC3 : Sequencer tests

Generation of glitches on Vcc, C3, C6
Modification at a user defined moment of the state of a pin
Sending out of standard frames/provoking collisions
Creation of custom activation/deactivation sequences
Generation of parity errors on transmission, simulation of parity errors on reception
Management of triggers
Sudden modification of an electronic parameter
Definition of the time between two commands

MP300 TCL2 : Supported protocols

ISO/IEC 18092 (NFC-IP1, NFC-IP2) and NFC Forum
Communication modes supported	Passive initiator Passive target (optionnal) Active initiator Active target
ISO/IEC 14443-3 (proximity cards)
Type A	Supported
Type B	Supported
Anticollision	Managed by firmware
T=CL protocol	Managed by firmware
Supported baudrates	106, 212, 424, 828 kbps Asymetrical baudrates supported
B’ (Innovatron)
Supported
ISO/IEC 15693 (vicinity cards)
Coding type	Manchester
Encoding modes	1 out of 4 1 out of 256
ISO 18000-3 Mode 1
Supported
Mifare TM
Types supported	Classic Light Ultra Light Ultra Light C Many more
Encryption	Assisted by hardware
FeliCa TM
Available baudrates	212 and 424 kbps
Encryption	Available through an external device
Raw mode
Gives the possibility to exchange frames without any protocolary encapsulation
Out of standard chips
Benefit from Micropross’experience in smartcard programming

MP300 TCL2 : Programmable parameters

Physical parameters (contacless interface)
Field strength	Adjustable
Modulation index	From 0% to 100%
Field rise time	0ms to 5ms
Carrier frequency	12.56MHz to 14.56MHz
Modulation rise and fall times	0µs to 10µs
Logical tests (contact interface)
Type A pause width	0 to 4,4µs
Frame waiting time	Adjustable in ETU
Type B framing (SOF, EGT, EOF, bit duration)	Adjustable in clock cycles
TR2 timing	Adjustable with the sequencer
Communication speed	106, 212, 424, 848 kbps

MP300 TCL2 : Spy feature

Resolution	20ns
Events displayed	Field detection External field detection (for active mode) Carrier and subcarrier detection Type A sequences Phase changes Bytes Frames User events Trigger in Trigger out I/O direction Baudrate changes (asymetrical baudrates are supported)

MP300 TCL2 : Available tests

Electrical measurements
Resonance frequency measurement (loaded and unloaded modes)
Range	11 to 24 MHz
Q factor measurement
Chip impedance
Frequency at which the measurement is done	13.56MHz
Magnetic field measurement
Logical testing
Automatic testing
Send type A command, wait, send type B command and receive answer (for type B cards)
Send type B command, wait, sent type A command and receive answer (for type A cards)
Switch on field, wait, send request command (A or B), receive answer
Send request, wait, send request, receive the answer
Antitearing
PICC reset characterization
Check minimum FDT (frame delay time)
Testing through API manipulation
Response time measurement (FDT, TR0, TR1)
Sending of out of standard frames
Sending misformed blocks (wrong number of bits)
Retro modulation ratio measurement
Distance simulation checking
Separated RX channel allowing communication using a RF amplifier

MP300 TCL2 : Triggers

The MP300 TCL2 offers many triggers, to synchronise or to be synchronised by external laboratory devices (oscilloscopes,...)

MP300 TCL2 : Physical information

Weight (Uniterary rack package)	1.98 kg
Dimensions (Uniterary rack package)	Width : 150mm Height : 78mm Depth : 270mm

MP300 TCL2 : Communication parameters

USB 2.0
TCP/IP 10/100 Mbps
RS 232

MP300 TCL2 : Software development

Remote development (the code is executed from the PC)
Elements available	MPSDK .NET library available on demand Communication Dll supplied
Supported programming languages	C, C++, VB, Java, .NET Any language that supports Dll
Embedded development (the code is executed directly by the MP300)
Recommended cross compiler	Windriver compiler (prefered version : 4.4b)

MP300 TCL2 : User Interface

MPManager

The software that is used for the display of the trapped exchanges is MPManager.

Once the spy session is over, the “Viexer” window of MPManager shows all signals that have been spied (contact and contactless exchanges)

Here, exchanges in SWP and ISO 14443B have been spied simultaneously

The viewer window of MPManager also gives a graphical display of the trapped exchanges.
For example on the following screenshot, we have a contactless command (starting a payment application). This command will be in fact executed by the U-SIM. The contactless frame thus needs to be translated into SWP

Here, contactless and SWP exchanges are displayed together, on the same time base

The time between the contact, and the SWP blocks, is the time it takes to the NFC component to do the translation job.
By positionning two cursors, we will know how long it takes to the NFC component to perform this job.

The blue cursor is set at the end of the contactless frame

The red cursor is set at the beginning of the SWP frame.

MPManager gives us the time difference between both cursors

It took 2.3 ms for the NFC component to do the translation

Micropross supplies a complete range of accessories for their laboratory tools, that include :

A SIM to ISO converter
Numerous shapes of probes, to use this tester with different types of contact smartcard readers and handsets
A probe to enable spying sessions between a smartcard and an external reader
A probe for oscilloscope connection
Different sizes of antennas, to handle any kind of form factors

We also supply packages to extend the warranty of the tester. Please ask us for the maintenance contracts available.

Test and personalization tools for smartcards, RFID and NFC industry

Whatever you need, we have the solution

MP300 TC3 + MP300 TCL2