MP300 SC1 + MP300 TCL2

Spy complex transactions, mixing contact and contactless technologies using the combination of MP300 SC1 and MP300 TCL2

  • Simple synchronisation link

  • Contact and contactless exchanges displayed on the same time base

  • Convenient data display thanks to the MPManager software suite

  • Possibility to do parametric tests on both contact and contactless interfaces of the NFC component


The main features of the combination MP300 SC1 + MP300 TCL2 are :

  • Spy of ISO/IEC 7816-3, SWP, ISO/IEC 14443, FeliCa, ISO/IEC 15693 exchanges on one single session
  • Convenient display of the captured data using the MPManager software
  • The NFC transaction is initiated by the MP300 TCL2
  • Simple to setup
  • Possibility to measure translation time of a contactless frame into SWP by a NFC component
  • All features of both MP300 testers remain available
  • Enables to capture a complete NFC transaction
  • Also compatible with dual interface smartcards

 

The combination of MP300 SC1 + MP300 TCL2 will typically be used in the following contexts :

  • Characterisation of a NFC host component
  • Debug of a CLF (contactless front end)
  • Analysis of a combi card

 

MP300 TCL2 : Supported protocols

ISO/IEC 18092 (NFC-IP1, NFC-IP2) and NFC Forum
Communication modes supported
  • Passive initiator
  • Passive target (optionnal)
  • Active initiator
  • Active target

ISO/IEC 14443-3 (proximity cards)
Type A
  • Supported
Type B
  • Supported
Anticollision
  • Managed by firmware
T=CL protocol
  • Managed by firmware
Supported baudrates
  • 106, 212, 424, 828 kbps
  • Asymetrical baudrates supported

B' (Innovatron)
Supported

ISO/IEC 15693 (vicinity cards)
Coding type
  • Manchester
Encoding modes
  • 1 out of 4
  • 1 out of 256

ISO 18000-3 Mode 1
Supported

Mifare TM

Types supported
  • Classic
  • Light
  • Ultra Light
  • Ultra Light C
  • Many more
Encryption
  • Assisted by hardware

FeliCa TM
Available baudrates
  • 212 and 424 kbps
Encryption
  • Available through an external device

Raw mode
Gives the possibility to exchange frames without any protocolary encapsulation

Out of standard chips
Benefit from Micropross'experience in smartcard programming

MP300 TCL2 : Programmable parameters

Physical parameters (contacless interface)
Field strength
  • Adjustable
Modulation index
  • From 0% to 100%
Field rise time
  • 0ms to 5ms
Carrier frequency
  • 12.56MHz to 14.56MHz
Modulation rise and fall times
  • 0µs to 10µs

Logical parameters (contact interface)
Type A pause width
  • 0 to 4.4µs
Frame waiting time
  • Adjustable in ETU
Type B framing (SOF, EGT, EOF, bit duration)
  • Adjustable in clock cycles
TR2 timing
  • Adjustable with the sequencer
Communication speed
  • 106, 212, 424, 848 kbps

MP300 TCL2 : Spy feature

Resolution
  • 20ns
Events displayed
  • Field detection
  • External field detection (for active mode)
  • Carrier and subcarrier detection
  • Type A sequences
  • Phase changes
  • Bytes
  • Frames
  • User events
  • Trigger in
  • Trigger out
  • I/O direction
  • Baudrate changes (asymetrical baudrates are supported)

MP300 TCL2 : Available tests

Electrical measurement

Resonance frequency measurement (loaded and unloaded modes)
Range
  • 11 to 24 MHz

Q factor measurement

Chip impedance
Frequency at which the measurement is done
  • 13.56MHz

Magnetic field measurement

Logical testing

Automatic testing
Send type A command, wait, send type B command and receive answer (for type B cards)
Send type B command, wait, sent type A command and receive answer (for type A cards)
Switch on field, wait, send request command (A or B), receive answer
Send request, wait, send request, receive the answer
Antitearing
PICC reset characterization
Check minimum FDT (frame delay time)

Testing through API manipulation
Response time measurement (FDT, TR0, TR1)
Sending of out of standard frames
Sending misformed blocks (wrong number of bits)
Retro modulation ratio measurement
Distance simulation checking
Separated RX channel allowing communication using a RF amplifier

MP300 TCL2 : Triggers

The MP300 TCL2 offers many triggers, to synchronise or to be synchronised by external laboratory devices (oscilloscopes,...)

MP300 SC1 : Suppported protocols

Protocol analysis mode

ISO/IEC 7816-3
T=0 and T=1 protocols
  • 100% implemented
Block level spy
  • Available

SWP (ETSI TS 102 613 and TS 102 622)
Baudrate supported
  • From 49kbps to 1.9Mbps
Block level spy
  • Available
LLC level spy (S_HDLC, ACT, CLT)
  • Available
HCI
  • Available

Synchronous chips (memory chips)
Implemented
Example of supported chips
  • Eurochip
  • T2G
  • SLE 4442
  • SLE 4407
  • AT24CXX

USB 2.0
Supported speeds
  • Low speed, full speed

Smartcard emulation mode

ISO/IEC 7816-3
T=0 and T=1 protocol
  • 100% implemented by firmware
Custom protocol emulation
  • Available

SWP (ETSI TS 102 613 and TS 102 622)
Baudrate supported
  • From 49kbps to 1.9Mbps
Block level spy
  • Available
LLC level spy (S_HDLC, ACT, CLT)
  • Available

MP300 SC1 : Programmable parameters

Protocol analysis mode

ISO/IEC 7816-3
I/O direction detection threshold
SWP (ETSI TS 102 613 and TS 102 622)
SWP S2 channel current threshold

Smartcard emulation mode

ISO/IEC 7816-3
Guard time
  • Defined in ETUs
Smartcard response time
  • Defined in ETUs

SWP (ETSI TS 102 613 and TS 102 622)
Current values on SWP S2 signal (high and log stated)
  • From 1nA to 2mA
Smartcard response time

MP300 SC1 : Spy feature

Accuracy
  • 20ns
Signals displayed
  • Signals C1, C2, C3, C4, C6, C7, C8
  • SWP S1, SWP S2
  • Trigger in
  • Trigger out
Protocols supported
  • ISO/IEC 7816-3, SWP, USB 2.0 (simultaneous spy possible without accuracy damage)
Type of events displayed
  • Logical state change
  • Characters
  • Modification of baudrate
  • Clock frequency detection
  • Analog representation of the signals
  • I/O direction

MP300 SC1 : Available tests

Electrical measurement (available for all versions)
Possibility to execute simultaneous voltage and current measurement to characterise both the terminal and the smartcard
Number of samples
  • 512000 (unlimited for Vcc)
Contacts available
  • C1, C6, C7

Perturbations (smartcard emulation mode)

ISO/IEC 7816
Sending out of standard blocks (wrong CRC, wrong data length, ...)
Sending characters with parity error
Simulating reception of parity errors
Modifying the guardtime on the fly

SWP (ETSI TS 102 613 and TS 102 622)
Sending out of standard blocks
Removal of bit stuffing
Card response time
Master resume time measurement

MP300 SC1 : Triggers

The MP300 SC1 offers triggers, to synchronise or to be synchronised by external laboratory devices (oscilloscopes,...)

MP300 SC1 : Communication parameters

USB 2.0
TCP/IP 10/100 Mbps
RS 232

MP300 SC1 : Software development

Remote development (the code is executed from the PC)
Elements available
  • MPSDK .NET library available on demand
  • Communication Dll supplied
Supported programming languages
  • C, C++, VB, Java, .NET
  • Any language that supports Dll

Embedded development (the code is executed directly by the MP300)
Recommended cross compiler
  • Windriver compiler (prefered version : 4.4b)

MP300 SC1 : User Interface

MPManager

The software that is used for the display of the trapped exchanges is MPManager.

First, the user defines which commands will be sent by the MP300 TCL2 on the contactless interface of the device under test.

 
Here, the MP300 TCL2 will attempt to start a payment application


 

Once the spy session is over, the “Viexer” window of MPManager shows all signals that have been spied (contact and contactless exchanges)

 
Here, exchanges in SWP and ISO 14443B have been spied simultaneously


 

The viewer window of MPManager also gives a graphical display of the trapped exchanges.
For example on the following screenshot, we have a contactless command (starting a payment application). This command will be in fact executed by the U-SIM. The contactless frame thus needs to be translated into SWP

 
Here, contactless and SWP exchanges are displayed together, on the same time base


 

The time between the contact, and the SWP blocks, is the time it takes to the NFC component to do the translation job.
By positionning two cursors, we will know how long it takes to the NFC component to perform this job.

 
The blue cursor is set at the end of the contactless frame


 

MPManager gives us the time difference between both cursors

 
It took 2.3 ms for the NFC component to do the translation


 


Micropross supplies a complete range of accessories for their laboratory tools, that include :

  • A SIM to ISO converter
  • Numerous shapes of probes, to use this tester with different types of contact smartcard readers and handsets
  • A probe for oscilloscope connection
  • Numerous sizes of antennas, to adapt to various form factors


We also supply packages to extend the warranty of the tester. Please ask us for the maintenance contracts available.