June 23rd, 2024

The tiny chip that powers Montreal subway tickets

The article discusses the MIFARE Ultralight EV1 chip in Montreal subway tickets, detailing its battery-free operation, NFC communication with turnstiles, security measures, and data storage capabilities. It highlights the chip's design, functionality, and handling requirements.

Read original articleLink Icon
The tiny chip that powers Montreal subway tickets

The article delves into the intricate details of the tiny chip embedded in Montreal subway tickets, explaining how it operates without a battery and communicates with turnstiles using NFC technology. The chip, specifically the MIFARE Ultralight EV1, is designed for one-time ticketing applications, providing data to the reader through a small EEPROM. Despite lacking advanced security features, the chip includes a unique identification code, password-protected memory access, and one-way counters for ticket usage control. The article also describes the process of extracting and examining the chip, highlighting its minuscule size and delicate handling requirements. Additionally, it explains the chip's functionality, including load modulation for data transmission back to the reader. The chip's structure, with digital logic for processing commands and an EEPROM for data storage, is detailed, emphasizing its ability to hold data for up to 10 years. Overall, the article provides a comprehensive insight into the technology behind Montreal subway tickets' operation, shedding light on the chip's design, features, and manufacturing process.

Related

Unisoc and Xiaomi's 4nm Chips Said to Challenge Qualcomm and MediaTek

Unisoc and Xiaomi's 4nm Chips Said to Challenge Qualcomm and MediaTek

UNISOC and Xiaomi collaborate on 4nm chips challenging Qualcomm and MediaTek. UNISOC's chip features X1 big core + A78 middle core + A55 small core with Mali G715 MC7 GPU, offering competitive performance and lower power consumption. Xiaomi's Xuanjie chip includes X3 big core + A715 middle core + A510 small core with IMG CXT 48-1536 GPU, potentially integrating a MediaTek baseband. Xiaomi plans a separate mid-range phone line with Xuanjie chips, aiming to strengthen its market presence. The successful development of these 4nm chips by UNISOC and Xiaomi marks progress in domestically produced mobile chips, enhancing competitiveness.

Hacking eInk Price Tags (2021)

Hacking eInk Price Tags (2021)

Hackers repurpose eInk electronic shelf labels (ESLs) into photo frames or status displays by customizing firmware. Detailed exploration of hacking challenges, including Marvell chip analysis, bootloader functions, memory storage, communication protocols, and debugging methods.

Vulnerability in Popular PC and Server Firmware

Vulnerability in Popular PC and Server Firmware

Eclypsium found a critical vulnerability (CVE-2024-0762) in Intel Core processors' Phoenix SecureCore UEFI firmware, potentially enabling privilege escalation and persistent attacks. Lenovo issued BIOS updates, emphasizing the significance of supply chain security.

A 10-cent microcontroller deserves a 10-cent devboard: RISC-V CH32V003

A 10-cent microcontroller deserves a 10-cent devboard: RISC-V CH32V003

The article details a low-cost development board for the CH32V003 RISC V microcontroller, assembled with inexpensive components. Step-by-step instructions for assembly and firmware uploading are provided, focusing on simplicity and accessibility.

Microfeatures I love in blogs and personal websites

Microfeatures I love in blogs and personal websites

The article explores microfeatures for blogs and websites inspired by programming concepts. It highlights sidenotes, navigation tools, progress indicators, and interactive elements to improve user experience subtly. Examples demonstrate practical implementations.

Link Icon 42 comments
By @amluto - 5 months
> Presumably, the makers thought that making the card look like a smart card would help people understand it. The card actually uses an entirely different technology.

It’s kind of the same, though. The physical communication layer is different, but the higher protocol layers are basically identical. Smart cards with contacts follow ISO 7816. These MIFARE contactless cards are ISO 14443 Type A cards, and their protocol follows ISO 7816-4.

This shouldn’t be terribly surprising — the entire ecosystem built for smart cards with contacts wants to support contactless cards with minimal changes, and this includes the host software, the readers, and the logic in the cards. There are even plenty of devices where the same device supports contact and contactless uses — plenty of credit cards, bank cards, and FIDO devices are like this.

This is analogous to WiFi and wired Ethernet. They’re have very different physical layers, but they are logically compatible, and the same software supports both.

By @CraigJPerry - 5 months
QR codes seem like a better ticket medium.

This is like a 100 bytes, a qr code can be over 2kb

This is a cheap plastic substrate with ink printing over the top. A qr code is just ink - or some other even cheaper printing process if you prefer.

This needs a specific ticket technology supplier over the next 10’s of years. QR codes can be drawn on screens or printed on paper and you can change suppliers for every component - from mobile phone apps to paper type to physical printer and reader devices - until your heart’s content over the next years. That flexibility can’t be underestimated in a space like public ticketing over decades.

Issuing replacement tickets needs physical presence to collect the ticket, vs qr code which can be emailed, sent on whatsapp, shared as a screenshot or photo if you need to, but of course you can still exchange physical paper qr codes if you prefer.

The rfid reader for these are cheap and durable, the optical reader for qr codes can be almost as cheap and almost as durable but not quite, the rfid wins this one point by a small margin.

By @justusthane - 5 months
This is fascinating. We were just in Europe where we experienced these tickets for the first time. I had trouble with them; I was trying to figure out how to scan them because it never occurred to me that they might contain an NFC chip.

My wife, on the other hand, who is not at all technical, took it for granted that you would tap them and immediately figured it out intuitively.

By @kalleboo - 5 months
I recently learned that you can just give a printing company a hundred bucks or so and have custom NFC cards printed for you, you don't actually have to be a big transit agency with an ongoing contract for millions of the things and a custom JavaCard NFC application or w/e coded for you.

I used this knowledge to replace the QR code membership card to my friend's bar with an NFC card version, it looks really cool in your wallet compared to all the flimsy paper stamp cards from the other bars.

By @stacktrust - 5 months
You can use these around the house or car for location-tap automation. Tap on NFC tag and mobile phone can trigger a custom shortcut for local action or SSH script to Linux SBC or micro PC. Response time is about one second. Even the iPhone SE2 has an NFC reader.

For vision-impaired people, NFC tags can be attached to objects and the phone can read an audio description when the object is tapped against phone.

By @kens - 5 months
Author here for all your NFC chip questions :-)
By @mschuster91 - 5 months
> The Ultralight chip has a few features beyond a printed ticket, though. The chips are manufactured with a unique 7-byte identification code (UID). Moreover, the UID is signed, ensuring that fake UIDs cannot be generated.

The problem is, they can be just as easily cloned. Your average Flipper Zero can do that.

If you want actual security, you have to go for a challenge-response scheme - i.e. every card is provisioned at the factory with a unique private / public key pair, and the public key gets signed by the factory. Then, to verify authenticity, the terminal gives some random nonce, the card signs it using its private key, and the terminal verifies that against the factory's public key.

> Even so, there were a couple of times that I lost track of the chip and had to check some specks under the microscope to determine which was the chip and which were dirt.

That is the really amazing part for me. We as humans have difficulty handling them, but how on earth does a machine even manufacture these, much less orient them consistently for the bond process to work?!

By @kumarvvr - 5 months
I am apalled at the crazy amount of waste this creates. Millions of tickets with chips inside them?

My understanding is that they are one time use?

In New Delhi metro, India, they used to use plastic tokens with these chips, but at the end of the journey, to exit the station you have to give the chip back.

Nowadays, they use a printed QR system, and they have even gone paperless. I can buy the ticket with my mobile app, pay using UPI instant payment, and show the qr code on the phone to the scanner and then travel.

For monthly card holders, rfid chip based cards are issued.

By @chgs - 5 months
Mifare is what’s been used in London’s Oyster cards for 20 years (not the ultralight ones mind), and Hong Kong for even longer.

However oyster really is in its way out for most uses. contactless and especially a phone is far more convenient for non season use, and far less wasteful.

By @_spduchamp - 5 months
OMG! Last time I went to get on the Subway in Montreal, the line up at the station to purchase one of these tickets was crazy long that I just gave up. There was no way to enter the subway by paying directly. You had to purchase one of these tickets. In Toronto, you can just tap your credit card to get on the subway.

Also, you see these Montreal cards laying all over the streets. This card system just seems so messed up in Montreal.

By @devl547 - 5 months
All Moscow public transport powered by these chips (actually it was, nowadays the chips we use are clones, made in Russia itself) - trains, metro and buses.
By @Sytten - 5 months
They are going away soon (TM), the tech is cool but they are impractical. I will be happy to use my credit card or phone.

Too many times I have been stuck in 15-20 minutes queues to buy those tickets and you cant refill them with an app... Plus south shore and north shore have they own system it's a mess.

By @localfirst - 5 months
Comparing Montreal subway with Vancouver's skytrain:

- Montreals subway stations have this gritty, distinctively french atmosphere i loved it.

- Vancouvers above/below stations have no soul, distinctively anglo but above ground ones i liked.

- Montreal train cars use rubber wheels to my shock! Extremely loud.

- Vancouver train cars use some sort of electric system which im not familiar with ( have a few variants (newer hyundai rotem cars, old ones: https://www.youtube.com/watch?v=W_BoeXqaV9c)

- Montreal subway does not cover the entire region like Vancouver's skytrain. Getting around is difficult without uber. Road conditions are horrible (pot holes remain unfixed for decades, city went broke hosting olympics long time ago), I just shudder how you can get around during the winter.

But the biggest shock was that in some instances, it was faster for me to walk then walk to the station and wait for the subway.

- Arriving at YVR: Skytrain runs directly from airport to a satellite city where its numerous public buses cover almost the entire MV. I could just tap through the toll gate with my credit card and wait for a bus which arrives on time quite frequently.

- Arrriving at YUL: Have to take a bus from airport for 30 minutes to Montreal but doesn't seem to respect time schedule. Got off somewhere in Montreal I don't remember (there was a large open artsy area) tried to wait for a bus but never came, gave up, got uber.

By @hlandau - 5 months
The NFC chip I want still doesn't exist: a CPU and flash I can write a program for, directly, no VMs, no Java, without an NDA'd datasheet.

These exist, but they're all behind NDAs and you're not allowed to have them. They're used for e.g. EMV.

By @Arch-TK - 5 months
Interesting discussions in the comments regarding reuse, waste, QR codes, etc.

Worth bearing in mind that in the UK train stations have mixed NFC, QR and magnetic readers. The ones which are the least reliable are the magnetic readers which operate on paper cards. The NFC readers are used for pre-paid ticket cards and credit/debit cards. The QR scanners for so called "E-Tickets".

I don't really ever see anyone have problems with the QR tickets (they're static and distributed as PDF or pkpass). Likewise with NFC. Only the paper magstripe cards commonly cause problems.

Meanwhile in the Shanghai metro they use chip coins. Small, reusable and NFC.

I think these paper NFC things are a unique combination of non-reusable, prone to damage, prone to jamming.

But they are cool.

By @ForHackernews - 5 months
> a per-chip price of nine cents

That still seems expensive for a $3.75 metro fare.

2.4% of the cost of your ride is the chip in the ticket itself? Maybe it's worth it because it lets them eliminate mechanical ticket-reading and unify paper tickets with other NFC payment methods.

By @piombisallow - 5 months
The diameter of a neuron's axon is about 1 μm, this is getting close to biological levels of miniaturization.
By @egl2021 - 5 months
Phosphoric acid, hydrochloric acid, and boiling sulfuric acid: I should have paid more attention in chemistry lab. This is a neat project and answered a lot of questions.
By @webwielder2 - 5 months
So how much more powerful is this chip than the ones NASA used in the the Apollo program?
By @Nition - 5 months
How is a chip like this actually manufactured? Especially the analogue components area.
By @johnklos - 5 months
"Tie die"

Ha ha ha ha... Love it! Always informative and interesting :)

By @ck45 - 5 months
The article itself is a very interesting summary of the technology used.

As for the comments, there seems to be a big discussion on whether NFC or barcodes (includes QR codes) are the better technology for public transport ticket I have a completely different view: No matter what technology you are using, after having used public transport in multiple cities in Germany with the same flat rate tickets, I wonder if this could be feasible in every city or country. Just not caring about a ticket seems to be the most user friendly option. It seems to work well, but such a system would need to prove itself in areas where public transport is already quite crowded, like London.

By @EncomLab - 5 months
Ken is a treasure - he's a walking encyclopedia of all things electronic!
By @elric - 5 months
Free public transport would make all of this stuff unnecessary.
By @wkjagt - 5 months
I can't help but feeling a little sad about single use electronics. Not even from an environmental perspective (though there's that too) but just the fact that there's some pretty cool electronics, doing digital and analog stuff, wireless communication etc, that does it's thing once, and then never again.
By @neop1x - 5 months
They use something similar in Athens, a paper one-use ticket with a tiny chip inside https://realgreekexperiences.com/locals-guide-to-taking-the-...
By @MBCook - 5 months
The article says the chips are made on a 180 nm process and they come out about the size of a table salt grain.

We’re now down in the single digits for fabrication in nanometers, although I know that sort of just a name. This chip is so tiny already, if you were to fab it on a process like 7 nm I’m guessing it would be unworkably small. Too hard to cut, too hard to manipulate individual chips once you did manage to cut them.

So here’s my question: how small can we make a chip in area while still being able to cut them out and easily use them?

It’s obviously not a concern for the hundreds of square millimeters of a large processor, but I’ve never heard about the opposite end of the spectrum before.

By @BOOSTERHIDROGEN - 5 months
I would like a comprehensive analysis of FeliCa.
By @Waterluvian - 5 months
On the topic of NFC: my iPhone ApplePay thing taps so much more reliably than any of my credit or debit cards. Is this because it has its own power supply and doesn’t have to first be powered up by the machine?
By @GnarfGnarf - 5 months
In the 60's I hacked the Montreal Metro's transfers, and rode free. The punched holes recorded time and date code.
By @reportgunner - 5 months
I was living under the impression that the Oyster card already solved this problem years ago.
By @Charon77 - 5 months
I wonder why they don't use magnetic paper instead like how Japan is using? Seems cheaper
By @bobthepanda - 5 months
This wasn’t super obvious to me until later in the article but this is about the single use tickets.

Neat stuff, though I can’t say I love the concept of e-waste NFC.

By @lxgr - 5 months
> There are multiple NFC standards with differences in speed, protocol, and range, including NFC-A, NFC-B, NFC-C, NFC-F, and NFC-V. The MIFARE Ultralight cards use NFC-A, which is defined by the standard "ISO/IEC 14443 Type A".

Pet peeve: Calling these chips "NFC" is a bit misleading. NFC-A isn't defined by ISO 14443-A, but builds on it.

NFC is an umbrella standard that defines a way of storing structured data on a wide variety of existing contactless IC technologies (including, but not limited to ISO 14443) and products (such as NXP's various MIFARE chips, which in turn are based on various layers of ISO 14443 up to -4).

For the concrete example, it's correct to say that one possible implementation of an NFC-A tag is MIFARE Ultralight (that would be a NFC forum type 2 tag), but neither is NFC the only thing you can do with MIFARE Ultralight (and this transit use case almost certainly doesn't put an NDEF container on the ticket), nor is this the only type of tag you could use for NFC.

By @nayuki - 5 months
While the chip technology is interesting, I found the human factors on Montreal's public transit system to be bad. This is based on my experiences in 2023.

The reusable OPUS transit card expires after 4 years unless you have a photo registered. In almost all cities, adult transit cards don't expire and don't require photo/name registration. https://www.stm.info/en/info/fares/opus-cards-and-other-fare...

The system does not have a concept of a monetary balance ($). The system only has tickets (bought in blocks of 1, 2, or 10 with appropriate discounts) and unlimited passes (24 hr, 3 day, week, month). Note that I define a "ticket" as an abstract authorization to ride transit for one trip, not a physical object.

There is no discount for using OPUS. If you buy a block of 10 tickets, it's the same cost whether you load it onto a disposable paper card or on a plastic long-term OPUS card. There is no incentive to reduce waste.

The Greater Montreal Area is divided into fare zones, A/B/C/D. You can use any supported transport agency and vehicle (bus, subway, commuter rail, possibly others) to make your trip. Ticket/pass types have cumulative fare zones, i.e. A or AB or ABC or ABCD. This isn't wrong per se; this is just setting up a definition for what's to come.

An OPUS card is locked to one set of fare zones for the purpose of buying tickets. For example, your card might be set to zone A, or maybe zones ABC. You can only buy and spend tickets of that type. However, you can buy passes for any zones, but they are expensive and intended for long-term commuters.

A new paper card can be bought for any set of zones. e.g. If you want to travel from somewhere in zone A to somewhere in zone C, you buy a zone ABC fare ticket. A paper card cannot be reloaded after the initial purchase.

There is only tap-on, no tap-off. So if you board at zone A, there is no way for the transport system to electronically know if you exited in zone A, B, C, or D. This also means that an open payment supporting credit cards cannot deduct the correct fare amount. There are random fare inspections from human officers to ensure you hold a tapped card with the correct fare type at the location of the inspection.

In light of this entire setup, I can understand why an OPUS card is locked to one set of zones for tickets (which are counted down as you use them). If you tap your OPUS card at a reader in zone A but you own tickets of multiple zone types on the card, how does the reader know which ticket to deduct? Montreal has brought this problem on themselves by not having tap-off and also not using a money-based system.

To make matters worse, the fare vending machines at subway stations are inadequate. There are not enough of them, the menus are slow to navigate through, paying by cash or credit card may have additional frictions (e.g. cash rejected, no change, card payment failure). Thus there is often a queue to buy tickets, making the travel experience that much worse. (Meanwhile, I found Japan's ticket-vending machines to be top-notch - very clear instructions, fast machine response times, and excellent handling of cash.)

By comparison, Toronto has a different strategy and different problems on the PRESTO contactless fare card. The TTC has a flat fare and 2-hour free transfers within the system. GO transit has tap-on and tap-off for buses and trains. For a long time, there was no fare integration between transit agencies, so you had to pay separately on each system; this changed in Feb 2024 so that you pay more or less the maximum of what each agency on your trip charges rather than the sum of the components.

Japan's transit systems mostly use tap-on tap-off, even many buses, and charge by distance. (There are small exceptions like the Kyoto bus being flat fare.) Transit pricing and ticketing is almost an entirely solved problem for decades; the rest of the world can learn from them. (There are still small exceptions, like how travelling between two different IC card regions, like from Numazu to Tokyo, requires a paper ticket.)

As you can see, even if you live permanently in Montreal and own an OPUS card (e.g. zones AB), as soon as you need to make a trip outside (e.g. zones ABCD) your usual area, you need to interact with a ticket-vending machine and buy a paper card. Meanwhile, in Toronto or Japan, you hold one card and the transit systems deduct the correct amount of money based on the trip that you take. Heck, Toronto introduced open payments in 2023, so you don't even need to buy the transit card.

By @solarized - 5 months
To peoples asking: "Why not just QR codes?" Again it's all about latency. QR codes take longer when you tap them at the gate: opening the app, waiting for the scanner to adjust, connecting to inet. While NFC handle these tasks almost instantly. A big difference in super busy places where queues are a nightmare.

Again, this problem wouldn't exist if we can optimize WFH methods. We don't need to solving "physical problems" from start to finish. Making, distributing, and recycling all those ticket papers.

No matter how advanced your transportation tech is, moving people long distances is still really costly. Sorry to "steer" this conversation into WFH and WFO topics.

By @cypherpunks01 - 5 months
My favorite household NFC usage? NFC alarm clock.

Makes me get out of bed and tap my phone on a specific NFC tag placed somewhere around the house, in order to turn off the alarm. Then, I may as well wake up, since I'm already out of bed : )

It's a nice companion to help perform 'habit stacking' as Atomic Habits calls it. Want to do pushups right after waking up? Place an NFC card under your workout mat, so you're forced to the mat first thing in the morning.

NFC Alarm Clock https://play.google.com/store/apps/details?id=com.nfcalarmcl... is a really great and simple Android alarm. Share if anyone has a good iOS recommendation.

By @AbraKdabra - 5 months
Yeah, I read it's cheap, like, really cheap... But I refuse to believe this is cheaper and simpler than a piece of paper with a barcode, why add complexity to something that has to be discarded after like, 1 minute?
By @wiz21c - 5 months
FTA:

> It's remarkable that these NFC chips can be manufactured so cheaply that they are disposable

In our times, where we slowly understand that we have problems of resources and waste, I find it very disturbing that "disposable" is considered a positive achievement by the author.