RC522Hacking

Project RC522Hacking
Status	Completed
Contact	bertrik
Last Update	2020-05-11

Introduction

This page is about the RC-522 mifare reader board.

This board can be found for a rather low price (about E3,-) on ebay, and usually comes packaged with a mifare 1k card and a mifare 1k key fob. It is 'arduino-compatible' in the sense that you interface with it through a SPI connection. It should be able to read all 'mifare' kind of RFID cards.

The problem with this board however, is that in its default configuration only seems to work reliably with the card/key-fob that it was packaged with. It doesn't to work with other mifare cards (e.g. OV-chipkaart).

This project is about modifying this board to make it actually work with other mifare cards.

Investigation

My two main suspicions why this board doesn't quite work, are:

• some software problem, quite a few things can be modified in software (conductance of the driving transistors, sensitivity settings)
• some hardware problem, either using the wrong circuit between the chip and the antenna, or using sub-standard components in the circuit

I've played a lot already with the software settings, but can't seem to make a change that actually improves performance with the non-working mifare cards.

With respect to hardware, I ordered two of these boards, and one of them came with a poorly soldered capacitor (C8). This one actually worked with a mifare light card! Properly soldering the capacitor made it no longer work. It also gave me a chance to measure the capacitor value, it has a value about 220 pF.

The image on the right shows the reverse engineered part of the circuit that sits between the RC522 chip and the reader/writer coil. The reader/writer coil itself consists of 4 turns, each about 40x35 mm, with an estimated total inductance of about 1 uH, it is center-tapped to the TVSS signal. Assuming the total coil length is 54 cm, copper thickness is 35 um, trace width is 0.8 mm, the resistance can be calculated to be about 0.33 ohm. I was able to measure C8/C9 (220 pF), somehow I couldn't get a capacitance reading of circuit parts C6/C7/C10/C11.

This schematic only vaguely resembles the example circuit in the datasheet. For example, I don't see any resistance in the resonance circuit to bring down the quality factor.

Results

Resonance capacitance fix

TDLR, my most up-to-date fix is:

• replace C8 and C9 with a 100 pF capacitor

This enables reading of all cards I currently own, but seems to reduce the reading distance a bit for the card that came shipped with it. I can't really justify the 100 pF value. It's been determined empirically. With this value, the resonant circuit sees about the same capacitance (200 pF) as it saw in the not-properly-soldered-but-working situation (220 pF), only now more symmetrical.

Damping resistor fix

This has not been tested yet, only theoretically determined.

The fix is to replace C10/C11 with resistors, resulting in a _parallel_ damped resonant circuit. The theory is that we need some damping in the resonant circuit to widen its bandwidth. Probably C10/C11 don't actually do much (couldn't measure capacitance, so it's likely to be a rather small value compared to C8/C9, probably very much smaller than 100 pF), so we can safely replace these capacitors by resistors. The resistor value is chosen such the resonant circuit gets a Q of about 35, as recommended in the antenna design application note.

Given an L of 0.5 uH (for one half of the reader/writer coil), a C of 220 pF (C8/C9) and a desired Q of 35, the parallel resistance to be substituted in place of C10/C11 should be about 1700 ohm.

References

• NXP MFRC522 datasheet
• NXP application note AN1445, Antenna design guide
• A document describing changes made to improve the RFID circuit of an Adafruit PN532 board: Changes PN532 Breakout board