Disposable NFC: Ken Shirriff Reverse Engineers the Tech Behind Montreal Métro Tickets

Ken Shirriff has positioned an uncommon chip below the microscope for a have a look at simply the way it’s potential to place wireless-capable electronics right into a disposable piece of paper: the Montreal Métro tickets.

“To make use of the Montreal subway (the Métro), you faucet a paper ticket towards the turnstile and it opens,” Shirriff says. “The ticket works by way of a system known as NFC [Near Field Communication], however what’s occurring internally? How does the ticket work and not using a battery? How does it talk with the turnstile? And the way can it’s so low cost you can throw the ticket away after one use? To reply these questions, I opened up a ticket and examined the tiny chip inside.”

Every ticket, Shirriff explains, comes with an embedded chip sandwiched between the paper — a part of a plastic insert that features steel foil appearing as an antenna. Whereas the tickets additionally embrace what seems to be the gold contacts for a smartcard chip at one finish, they’re printed on the paper with non-metallic ink and are solely ornamental. In consequence, there is no must put the paper ticket right into a smartcard reader: simply faucet it towards a turnstile and also you’re good to go.

The key, in fact, is NFC, or Close to-Subject Communication — a normal by which a compact chip is powered utilizing power harvested from a close-by reader’s radio transmissions. How compact? “It’s in regards to the dimension of a grain of salt,” Shirriff writes. “The chip can be extraordinarily skinny — 75µm or 120µm — so you may’t even really feel the chip contained in the ticket.”

That tiny chip is a MIFARE Ultralight EV1, one of many lowest-cost components within the MIFARE household. It lacks superior options accessible in additional upmarket variations, and is tailor-made for single use — changing printed barcodes or QR Codes with one thing more difficult to idiot with a photocopier. In contrast to printed tickets, it not solely transmits data to the reader however can retailer data in flip — updating inner counters that can be utilized to restrict the variety of occasions a ticket is legitimate for transit.

To see what’s contained in the tiny half, Shirriff first extracted it from the paper ticket by soaking it in water. The plastic was then eliminated with boiling sulphuric acid, abandoning the silicon die. Boiling phosphoric acid took care of a passivation layer on high of the die, which was then handled with an etchant and hydrochloric acid. Whereas the method requires the cautious dealing with of a variety of boiling acids, Shirriff had one thing else on his thoughts: “My greatest concern whereas processing this chip,” he explains, “was to keep away from dropping it.”

Inserting the chip below a high-powered microscope, Shirriff was in a position to hint out its varied blocks: analog circuitry, a big chunk of standard-cell digital logic, an EEPROM to retailer information, and a cost pump to spice up the low-voltage harvested power to a stage appropriate for writing to stated EEPROM. “It is outstanding that these NFC chips might be manufactured so cheaply that they’re disposable,” Shirriff concludes.

The complete write-up is obtainable on Shirriff’s web site.