Design of 14443A card reader based on base station chip RC522

Introduction

14443 TypeA closely coupled RFID card standard is widely used in access control, identity recognition and electronic wallet, and RC522, as a new member of Philips base station chip product series, is not only compatible with 14443A/MIFARF standard, but also has the advantages of low voltage (3.3V), low power consumption (sleep current SPI, I2C, etc.), and its control is realized by reading/writing 4 pages of 64 registers inside the chip. Since register control involves functional modules such as digital interface, anti-collision and communication analog interface, the design difficulty of the card reader based on RC522 is mainly reflected in the interaction between software and RC522 chip registers to realize the control of the communication process between RC522 and system main control chip and between RC522 and 14443A RFID card.

The card reader system designed in this paper uses PICl6F7x microcontroller as the main control chip, and uses MIFARE S50 cards. The card reader and the card communicate at a rate of 106kbps, and at the same time realize anti-collision processing during card reading and read/write functions of the card E2PROM block content. The card reader is equipped with a Flash memory to store card data. When the Flash capacity is full, all data can be read out to the management center host computer through the Ethernet port of the card reader, which is convenient for establishing a comprehensive management system for card data.

1 Hardware system design

The hardware block diagram of the card reader is shown in Figure 1.

The microcontroller PICl6F7x is connected to RC522 and Flash chip AT45D011 through SPI bus, and the Ethernet interface chip C58900 is connected with simplified ISA bus to provide the ability to connect to the local area network. AT45D011 has a storage capacity of 1Mb, which can store more than 7400 groups of MIFARE E2PROM blocks and UID numbers at the same time, providing enough storage capacity for the amount of information read by the card reader in one day. Philips has a special manual for the design of the RC522 antenna part, which will not be repeated in this article. The SPI bus interface of RC522 has its own timing requirements. It can only work in slave mode, with a maximum transmission rate of 10 Mbps, and the phase relationship between data and clock meets the constraint relationship of "idle clock is low level, synchronous reception and transmission of data on the rising edge of the clock, and data conversion on the falling edge". The on-chip peripherals of the PICl6F7x series microcontrollers include 1 SSP module. This module can be configured to use as an SPI interface. The corresponding registers can be used to control the data transmission rate, data-to-clock phase ratio and other communication parameters of the SPI interface. In this article, the SSP module is configured to work in SPI master mode, the clock is 1/4 of the microcontroller main frequency, and the receiving and sending of data occur on the rising edge of the clock.

It should be noted that since RC522 supports a variety of digital interfaces, the chip will detect the external pin connection relationship every time it is reset. For the SPI interface, the relevant pins of RC522 must be configured according to the connection relationship shown in Figure 2.

In addition to the four common SPI signal lines (clock line SCK, input data line MOSI, output data line MOSO and select line NSS), RC522 requires two additional pins I2C and EA to be fixed at low and high levels respectively. These two pins do not participate in SPI bus transmission, but only serve to set the RC522 digital interface to use the SPI interface. In addition, the chip select signal must be guaranteed to be low during the data stream writing period and high when there is no data stream writing; users must not always set NSS to low level to save PIC microcontroller pin resources.

2 Software system design

Compared with other 14443 base station chips produced by Philips (such as RC500, RC530, etc.), RC522 simplifies the internal system structure and removes the on-chip E2PROM. This greatly reduces the chip command set. In addition, the control of the carrier modulation circuit, the transmission circuit, and the demodulation and decoding circuits is also simplified accordingly, removing the cumbersome operations such as calibrating the I clock and Q clock of the receiving circuit and calibrating the phase of the transmission and reception clocks. Generally speaking, the communication process between the microcontroller and RC522 is shown in Figure 3.

Depending on the different control flow data transmitted between RC522 and MIFARE card, different states may appear during the communication process. Different processing is required for each state, which is the difficulty of software system development. The following are the communication states and processing that may be encountered during the execution of the two most basic commands (Tranceive and MFAunt) in the RC522 command set. These two commands implement the functions of sending/receiving data to/from MIFARE card and encryption authentication respectively. In fact, all operations on MIFARE card can be completed through them, including Request, Anticollision, Select, READ, WRITE, etc.

2.1 Implementation of RC522 command set

The main status indication registers of RC522 include ComIrqReg, ErrorReg, Status2Reg and FIFOLevelReg, etc. The idea of ​​software processing: get the internal interrupt status of RC522 through ComIrgReg; judge the communication process information between RC522 and MIFARE card by the interrupt, so as to decide whether to proceed to the next process; if the interrupt indicates an error, it is necessary to further read the content of ErrorReg and return the error word accordingly.

2.1.1 Tranceive command

The specific execution process of the Tranceive command: read all the data in the RC522 FIFO, and send it to the MIFARE card in the form of radio frequency through the communication interface after baseband coding and digital carrier modulation; after sending, detect whether there is a response to the radio frequency signal sent by the MIFARE card through the communication interface, and demodulate and decode the received signal and put it into the FIFO. By analyzing the above Tranceive command execution process, we can get the algorithm flow chart for processing this command, as shown in Figure 4.

In order to handle the situation that the MIIFARE card is not removed from the exciting field after being excited in the electromagnetic field generated by the card reader, the timer inside the RC522 chip is enabled in the software. If the card does not respond within the set time, the communication with the card is terminated and the error message "no response from the card" is returned.

From Figure 4, we can see the core processing method of the Tranceive command: various error status words are returned according to the content of the relevant communication status indication register. If there is a bit conflict error, the bit conflict position is further returned. The Tranceive command does not process bit-oriented frames, which can only appear in the MIFARE card anti-collision cycle. In order to maintain the universality of the Tranceive command for various MI-FARE card commands, this command only completes the sending and receiving of frames, does not process the frame information, and all bit conflict processing is left outside the function.

It should be noted that the Tranceive command cannot be automatically terminated. In any case, when returning from this command, the IDLE instruction must be executed first to put the RC522 into the idle state.

2.1.2 MFAuthent Command

RC522 simplifies the encryption authentication operation with MIFARE card, and replaces the two commands Authent1 and Authent2 required by the original RC500 with one MFAuthent command. The ultimate purpose of executing the MFAuthent command is to open the encryption authentication unit of RC522. After the command is successfully executed, the communication information between the RC522 chip and the MIFARE card will be encrypted first, and then sent through the radio frequency interface. In essence, MFAuthent is a disguised Tranceive command, and its algorithm flow chart is consistent with Figure 4. However, the RC522 chip has already processed various communication states in the communication process, and the command is automatically terminated after execution. Therefore, the user only needs to detect the timer state and the error register state to determine the execution status. In fact, MFAuthent can only have one error state (RC522 and MI-FARE card communication frame format error), at which time the command cannot open the encryption authentication unit, and the user must re-execute the authentication operation.

During the execution of MFAuthent, RC522 will read 1-byte authentication mode, 1-byte E2PROM block number to be authenticated, 6-byte key and 4-byte RFID card UID number from FIFO in turn. Before the command is executed, it must be ensured that these 12 bytes of data are completely stored in FIFO. There are two authentication modes: A key authentication and B key authentication. Generally, A key authentication is selected.

One MFAutllent authentication can only guarantee the decryption of 4 data blocks in one sector of the MIFARE card. If the user wants to operate the data of other sectors, he must also start the authentication operation of the sector.

2.2 MIFARE card operation instructions

Common operation instructions for MIFARE cards include query, anti-collision, card selection, read/write E2PROM blocks, etc. Among them, the anti-collision instruction is the essence of the 14443A protocol and is difficult to implement. The following will focus on the software implementation method of the anti-collision algorithm.

2.2.1 Anti-collision instruction

The anti-collision algorithm defined by the 14443A standard is essentially a channel multiplexing method based on channel time division multiplexing. If multiple RF cards occupy the RF channel to communicate with the card reader at a certain moment, the card reader will detect the conflicting position of the bit stream; then restart another communication process with the RF card, set the bit value at the conflicting position to a certain value (usually 1) and start a binary search until no conflict error is detected. The MIFARE card has a 4-byte globally unique serial number UID, and the purpose of RC522 anti-collision processing is to finally determine the UID of the MIFARE card. The anti-collision instruction format of the 14443A standard is as follows:

Among them: the command code "93" means that the UID of the RF card to be processed is only 4 bytes; NVM indicates the correct number of bits in the UID field of this anti-collision command; the BCC byte exists only when NVM is 70 (that is, all 4 bytes of the UID are correct), which means that the entire UID has been identified and the anti-collision process is completed.
The anti-collision algorithm flow chart is shown in Figure 5.

The initial value of NVM is 20, which means that the command contains only 2 bytes, namely "93+20", without UID data. The MIFARE card must return all UID bytes as a response. If there is a bit conflict in the returned UID data, the NVM value is updated according to the conflict position. It can be seen that in the search cycle, as the number of known UID bits is added, NVM continues to increase until it reaches 70. It means that in addition to the two command bytes "93+70", there are 5 UID data bytes UID0~UID3 and BCC. At this time, there are 7 command bytes in total, and the anti-collision command is transformed into a card selection command.

If the anti-collision process encounters a situation where bit-oriented frames need to be sent and received, the communication control register BitFramingReg must be set in advance. This register can indicate the number of incomplete bits in the last byte of the sent frame and the first byte of the received frame.

2.2.2 Card reading and writing instructions

The 14443A protocol does not specifically specify the read and write operation mode of the radio frequency card, so the read and write operations of each card must consider the storage area organization form and response form of the card. The internal memory of MIFARE card is composed of E2PROM, which is divided into 16 sectors, each sector has 4 blocks, and each block has 16 bytes. The reading and writing of E2PROM are performed in blocks, that is, 16 bytes are read/written each time.

Taking the card writing instruction as an example, MIFARE card requires a two-step handshake, and the instruction formats are as follows.
Setp A: Query block status.

If the block is ready, the MIFARE card returns a 4-bit response. If the value is 1010, the next step can be performed; if the value is not 1010, it means that the block is not ready and you must wait until the block is ready.
Step B: Write data.

If the write is successful, the MIFARE card returns a 4-bit response with the value 1010; if it is not 1010, it means the write failed.
The card reading instruction format is as follows:

If the execution is successful, the MIFARE card returns an 18-byte response bit. It should be noted that only 16 bytes are the read block data, and the other 2 bytes are padding bytes. If the number of bytes is not 18, it can be determined that the card reading operation is wrong.

MIFARE card data is encrypted in sectors, and one encryption authentication can only operate the data of one sector. This provides convenience for users to realize the "one card" function. Users can use different encryption methods in different sectors to store various purpose application data without interfering with each other. A common application in real life is electronic wallets, and the write operation of the card must be performed in a certain format. The data composition of a block is as follows:

Note: The address value is meaningless, but the inverted value must be stored in bytes 4 to 7 when writing the value.

2.3 Overall software design of the card reader

The software design idea of ​​the card reader is to use the Tranceive command of RC522 as a standard function and implement the MIFARE card operation instructions by calling this function. The operation process of the MIFARE card is shown in Figure 6. The key point is to put the card that has completed the operation into the dormant state, and reduce the number of cards that may conflict until all cards are operated. At this time, there is no card response to the anti-collision function.

The RC522 chip must be reset before each use. In addition to inputting a transition edge from low level to high level at the reset pin NRSTPD, the soft reset command code 0x0I? must be written to the command register CommandReg of the RC522 for soft reset. Before using the RC522 to operate the MIF'RAE card, the user must correctly set the working state of the chip analog part. According to the author's experience, the RC522 modulation and demodulation methods can generally be set to the default settings; it can be used normally at a communication rate of 106 kbps, but the antenna drive interface must be opened, which can be achieved by setting the Tx-controlReg register. In addition, since the 14443A protocol uses ASK modulation with a modulation depth of 100, which is different from the default setting, the TxASKRc must be set accordingly to implement this modulation method.

The communication parameter settings of the RC522 are very complex, and the modulation phase, modulation bit width, RF signal detection strength, and sending/receiving speed can be adjusted. During the hardware debugging process, users can choose the setting form that suits their own use according to actual conditions.

Conclusion

The card reader designed in this paper has a card reading distance of 50 mm at a communication rate of 106 kbps, and can realize attendance and electronic wallet functions; the entire card reader uses low-power components and can work reliably as a network terminal with a battery as a backup power supply. For the application of Rc522, the settings of anti-collision and communication interface are the key points. Different radio frequency card protocols have different anti-collision processes and communication interfaces, but modifying the relevant settings of Rc522 can make the physical interface meet the protocol requirements. For anti-collision processing, Rc522 supports a processing method based on bit collision detection, and cannot process ALOHA time slot methods similar to 144.13B.