The tiny chip that powers Montreal subway tickets
The article discusses the MIFARE Ultralight EV1 chip in Montreal subway tickets, detailing its battery-free operation, NFC communication with turnstiles, security measures, and data storage capabilities. It highlights the chip's design, functionality, and handling requirements.
Read original articleThe article delves into the intricate details of the tiny chip embedded in Montreal subway tickets, explaining how it operates without a battery and communicates with turnstiles using NFC technology. The chip, specifically the MIFARE Ultralight EV1, is designed for one-time ticketing applications, providing data to the reader through a small EEPROM. Despite lacking advanced security features, the chip includes a unique identification code, password-protected memory access, and one-way counters for ticket usage control. The article also describes the process of extracting and examining the chip, highlighting its minuscule size and delicate handling requirements. Additionally, it explains the chip's functionality, including load modulation for data transmission back to the reader. The chip's structure, with digital logic for processing commands and an EEPROM for data storage, is detailed, emphasizing its ability to hold data for up to 10 years. Overall, the article provides a comprehensive insight into the technology behind Montreal subway tickets' operation, shedding light on the chip's design, features, and manufacturing process.
Related
Unisoc and Xiaomi's 4nm Chips Said to Challenge Qualcomm and MediaTek
UNISOC and Xiaomi collaborate on 4nm chips challenging Qualcomm and MediaTek. UNISOC's chip features X1 big core + A78 middle core + A55 small core with Mali G715 MC7 GPU, offering competitive performance and lower power consumption. Xiaomi's Xuanjie chip includes X3 big core + A715 middle core + A510 small core with IMG CXT 48-1536 GPU, potentially integrating a MediaTek baseband. Xiaomi plans a separate mid-range phone line with Xuanjie chips, aiming to strengthen its market presence. The successful development of these 4nm chips by UNISOC and Xiaomi marks progress in domestically produced mobile chips, enhancing competitiveness.
Hacking eInk Price Tags (2021)
Hackers repurpose eInk electronic shelf labels (ESLs) into photo frames or status displays by customizing firmware. Detailed exploration of hacking challenges, including Marvell chip analysis, bootloader functions, memory storage, communication protocols, and debugging methods.
Vulnerability in Popular PC and Server Firmware
Eclypsium found a critical vulnerability (CVE-2024-0762) in Intel Core processors' Phoenix SecureCore UEFI firmware, potentially enabling privilege escalation and persistent attacks. Lenovo issued BIOS updates, emphasizing the significance of supply chain security.
A 10-cent microcontroller deserves a 10-cent devboard: RISC-V CH32V003
The article details a low-cost development board for the CH32V003 RISC V microcontroller, assembled with inexpensive components. Step-by-step instructions for assembly and firmware uploading are provided, focusing on simplicity and accessibility.
Microfeatures I love in blogs and personal websites
The article explores microfeatures for blogs and websites inspired by programming concepts. It highlights sidenotes, navigation tools, progress indicators, and interactive elements to improve user experience subtly. Examples demonstrate practical implementations.
It’s kind of the same, though. The physical communication layer is different, but the higher protocol layers are basically identical. Smart cards with contacts follow ISO 7816. These MIFARE contactless cards are ISO 14443 Type A cards, and their protocol follows ISO 7816-4.
This shouldn’t be terribly surprising — the entire ecosystem built for smart cards with contacts wants to support contactless cards with minimal changes, and this includes the host software, the readers, and the logic in the cards. There are even plenty of devices where the same device supports contact and contactless uses — plenty of credit cards, bank cards, and FIDO devices are like this.
This is analogous to WiFi and wired Ethernet. They’re have very different physical layers, but they are logically compatible, and the same software supports both.
This is like a 100 bytes, a qr code can be over 2kb
This is a cheap plastic substrate with ink printing over the top. A qr code is just ink - or some other even cheaper printing process if you prefer.
This needs a specific ticket technology supplier over the next 10’s of years. QR codes can be drawn on screens or printed on paper and you can change suppliers for every component - from mobile phone apps to paper type to physical printer and reader devices - until your heart’s content over the next years. That flexibility can’t be underestimated in a space like public ticketing over decades.
Issuing replacement tickets needs physical presence to collect the ticket, vs qr code which can be emailed, sent on whatsapp, shared as a screenshot or photo if you need to, but of course you can still exchange physical paper qr codes if you prefer.
The rfid reader for these are cheap and durable, the optical reader for qr codes can be almost as cheap and almost as durable but not quite, the rfid wins this one point by a small margin.
My wife, on the other hand, who is not at all technical, took it for granted that you would tap them and immediately figured it out intuitively.
I used this knowledge to replace the QR code membership card to my friend's bar with an NFC card version, it looks really cool in your wallet compared to all the flimsy paper stamp cards from the other bars.
For vision-impaired people, NFC tags can be attached to objects and the phone can read an audio description when the object is tapped against phone.
The problem is, they can be just as easily cloned. Your average Flipper Zero can do that.
If you want actual security, you have to go for a challenge-response scheme - i.e. every card is provisioned at the factory with a unique private / public key pair, and the public key gets signed by the factory. Then, to verify authenticity, the terminal gives some random nonce, the card signs it using its private key, and the terminal verifies that against the factory's public key.
> Even so, there were a couple of times that I lost track of the chip and had to check some specks under the microscope to determine which was the chip and which were dirt.
That is the really amazing part for me. We as humans have difficulty handling them, but how on earth does a machine even manufacture these, much less orient them consistently for the bond process to work?!
My understanding is that they are one time use?
In New Delhi metro, India, they used to use plastic tokens with these chips, but at the end of the journey, to exit the station you have to give the chip back.
Nowadays, they use a printed QR system, and they have even gone paperless. I can buy the ticket with my mobile app, pay using UPI instant payment, and show the qr code on the phone to the scanner and then travel.
For monthly card holders, rfid chip based cards are issued.
However oyster really is in its way out for most uses. contactless and especially a phone is far more convenient for non season use, and far less wasteful.
Also, you see these Montreal cards laying all over the streets. This card system just seems so messed up in Montreal.
Too many times I have been stuck in 15-20 minutes queues to buy those tickets and you cant refill them with an app... Plus south shore and north shore have they own system it's a mess.
- Montreals subway stations have this gritty, distinctively french atmosphere i loved it.
- Vancouvers above/below stations have no soul, distinctively anglo but above ground ones i liked.
- Montreal train cars use rubber wheels to my shock! Extremely loud.
- Vancouver train cars use some sort of electric system which im not familiar with ( have a few variants (newer hyundai rotem cars, old ones: https://www.youtube.com/watch?v=W_BoeXqaV9c)
- Montreal subway does not cover the entire region like Vancouver's skytrain. Getting around is difficult without uber. Road conditions are horrible (pot holes remain unfixed for decades, city went broke hosting olympics long time ago), I just shudder how you can get around during the winter.
But the biggest shock was that in some instances, it was faster for me to walk then walk to the station and wait for the subway.
- Arriving at YVR: Skytrain runs directly from airport to a satellite city where its numerous public buses cover almost the entire MV. I could just tap through the toll gate with my credit card and wait for a bus which arrives on time quite frequently.
- Arrriving at YUL: Have to take a bus from airport for 30 minutes to Montreal but doesn't seem to respect time schedule. Got off somewhere in Montreal I don't remember (there was a large open artsy area) tried to wait for a bus but never came, gave up, got uber.
These exist, but they're all behind NDAs and you're not allowed to have them. They're used for e.g. EMV.
Worth bearing in mind that in the UK train stations have mixed NFC, QR and magnetic readers. The ones which are the least reliable are the magnetic readers which operate on paper cards. The NFC readers are used for pre-paid ticket cards and credit/debit cards. The QR scanners for so called "E-Tickets".
I don't really ever see anyone have problems with the QR tickets (they're static and distributed as PDF or pkpass). Likewise with NFC. Only the paper magstripe cards commonly cause problems.
Meanwhile in the Shanghai metro they use chip coins. Small, reusable and NFC.
I think these paper NFC things are a unique combination of non-reusable, prone to damage, prone to jamming.
But they are cool.
That still seems expensive for a $3.75 metro fare.
2.4% of the cost of your ride is the chip in the ticket itself? Maybe it's worth it because it lets them eliminate mechanical ticket-reading and unify paper tickets with other NFC payment methods.
Ha ha ha ha... Love it! Always informative and interesting :)
As for the comments, there seems to be a big discussion on whether NFC or barcodes (includes QR codes) are the better technology for public transport ticket I have a completely different view: No matter what technology you are using, after having used public transport in multiple cities in Germany with the same flat rate tickets, I wonder if this could be feasible in every city or country. Just not caring about a ticket seems to be the most user friendly option. It seems to work well, but such a system would need to prove itself in areas where public transport is already quite crowded, like London.
We’re now down in the single digits for fabrication in nanometers, although I know that sort of just a name. This chip is so tiny already, if you were to fab it on a process like 7 nm I’m guessing it would be unworkably small. Too hard to cut, too hard to manipulate individual chips once you did manage to cut them.
So here’s my question: how small can we make a chip in area while still being able to cut them out and easily use them?
It’s obviously not a concern for the hundreds of square millimeters of a large processor, but I’ve never heard about the opposite end of the spectrum before.
Neat stuff, though I can’t say I love the concept of e-waste NFC.
Pet peeve: Calling these chips "NFC" is a bit misleading. NFC-A isn't defined by ISO 14443-A, but builds on it.
NFC is an umbrella standard that defines a way of storing structured data on a wide variety of existing contactless IC technologies (including, but not limited to ISO 14443) and products (such as NXP's various MIFARE chips, which in turn are based on various layers of ISO 14443 up to -4).
For the concrete example, it's correct to say that one possible implementation of an NFC-A tag is MIFARE Ultralight (that would be a NFC forum type 2 tag), but neither is NFC the only thing you can do with MIFARE Ultralight (and this transit use case almost certainly doesn't put an NDEF container on the ticket), nor is this the only type of tag you could use for NFC.
The reusable OPUS transit card expires after 4 years unless you have a photo registered. In almost all cities, adult transit cards don't expire and don't require photo/name registration. https://www.stm.info/en/info/fares/opus-cards-and-other-fare...
The system does not have a concept of a monetary balance ($). The system only has tickets (bought in blocks of 1, 2, or 10 with appropriate discounts) and unlimited passes (24 hr, 3 day, week, month). Note that I define a "ticket" as an abstract authorization to ride transit for one trip, not a physical object.
There is no discount for using OPUS. If you buy a block of 10 tickets, it's the same cost whether you load it onto a disposable paper card or on a plastic long-term OPUS card. There is no incentive to reduce waste.
The Greater Montreal Area is divided into fare zones, A/B/C/D. You can use any supported transport agency and vehicle (bus, subway, commuter rail, possibly others) to make your trip. Ticket/pass types have cumulative fare zones, i.e. A or AB or ABC or ABCD. This isn't wrong per se; this is just setting up a definition for what's to come.
An OPUS card is locked to one set of fare zones for the purpose of buying tickets. For example, your card might be set to zone A, or maybe zones ABC. You can only buy and spend tickets of that type. However, you can buy passes for any zones, but they are expensive and intended for long-term commuters.
A new paper card can be bought for any set of zones. e.g. If you want to travel from somewhere in zone A to somewhere in zone C, you buy a zone ABC fare ticket. A paper card cannot be reloaded after the initial purchase.
There is only tap-on, no tap-off. So if you board at zone A, there is no way for the transport system to electronically know if you exited in zone A, B, C, or D. This also means that an open payment supporting credit cards cannot deduct the correct fare amount. There are random fare inspections from human officers to ensure you hold a tapped card with the correct fare type at the location of the inspection.
In light of this entire setup, I can understand why an OPUS card is locked to one set of zones for tickets (which are counted down as you use them). If you tap your OPUS card at a reader in zone A but you own tickets of multiple zone types on the card, how does the reader know which ticket to deduct? Montreal has brought this problem on themselves by not having tap-off and also not using a money-based system.
To make matters worse, the fare vending machines at subway stations are inadequate. There are not enough of them, the menus are slow to navigate through, paying by cash or credit card may have additional frictions (e.g. cash rejected, no change, card payment failure). Thus there is often a queue to buy tickets, making the travel experience that much worse. (Meanwhile, I found Japan's ticket-vending machines to be top-notch - very clear instructions, fast machine response times, and excellent handling of cash.)
By comparison, Toronto has a different strategy and different problems on the PRESTO contactless fare card. The TTC has a flat fare and 2-hour free transfers within the system. GO transit has tap-on and tap-off for buses and trains. For a long time, there was no fare integration between transit agencies, so you had to pay separately on each system; this changed in Feb 2024 so that you pay more or less the maximum of what each agency on your trip charges rather than the sum of the components.
Japan's transit systems mostly use tap-on tap-off, even many buses, and charge by distance. (There are small exceptions like the Kyoto bus being flat fare.) Transit pricing and ticketing is almost an entirely solved problem for decades; the rest of the world can learn from them. (There are still small exceptions, like how travelling between two different IC card regions, like from Numazu to Tokyo, requires a paper ticket.)
As you can see, even if you live permanently in Montreal and own an OPUS card (e.g. zones AB), as soon as you need to make a trip outside (e.g. zones ABCD) your usual area, you need to interact with a ticket-vending machine and buy a paper card. Meanwhile, in Toronto or Japan, you hold one card and the transit systems deduct the correct amount of money based on the trip that you take. Heck, Toronto introduced open payments in 2023, so you don't even need to buy the transit card.
Again, this problem wouldn't exist if we can optimize WFH methods. We don't need to solving "physical problems" from start to finish. Making, distributing, and recycling all those ticket papers.
No matter how advanced your transportation tech is, moving people long distances is still really costly. Sorry to "steer" this conversation into WFH and WFO topics.
Makes me get out of bed and tap my phone on a specific NFC tag placed somewhere around the house, in order to turn off the alarm. Then, I may as well wake up, since I'm already out of bed : )
It's a nice companion to help perform 'habit stacking' as Atomic Habits calls it. Want to do pushups right after waking up? Place an NFC card under your workout mat, so you're forced to the mat first thing in the morning.
NFC Alarm Clock https://play.google.com/store/apps/details?id=com.nfcalarmcl... is a really great and simple Android alarm. Share if anyone has a good iOS recommendation.
> It's remarkable that these NFC chips can be manufactured so cheaply that they are disposable
In our times, where we slowly understand that we have problems of resources and waste, I find it very disturbing that "disposable" is considered a positive achievement by the author.
Related
Unisoc and Xiaomi's 4nm Chips Said to Challenge Qualcomm and MediaTek
UNISOC and Xiaomi collaborate on 4nm chips challenging Qualcomm and MediaTek. UNISOC's chip features X1 big core + A78 middle core + A55 small core with Mali G715 MC7 GPU, offering competitive performance and lower power consumption. Xiaomi's Xuanjie chip includes X3 big core + A715 middle core + A510 small core with IMG CXT 48-1536 GPU, potentially integrating a MediaTek baseband. Xiaomi plans a separate mid-range phone line with Xuanjie chips, aiming to strengthen its market presence. The successful development of these 4nm chips by UNISOC and Xiaomi marks progress in domestically produced mobile chips, enhancing competitiveness.
Hacking eInk Price Tags (2021)
Hackers repurpose eInk electronic shelf labels (ESLs) into photo frames or status displays by customizing firmware. Detailed exploration of hacking challenges, including Marvell chip analysis, bootloader functions, memory storage, communication protocols, and debugging methods.
Vulnerability in Popular PC and Server Firmware
Eclypsium found a critical vulnerability (CVE-2024-0762) in Intel Core processors' Phoenix SecureCore UEFI firmware, potentially enabling privilege escalation and persistent attacks. Lenovo issued BIOS updates, emphasizing the significance of supply chain security.
A 10-cent microcontroller deserves a 10-cent devboard: RISC-V CH32V003
The article details a low-cost development board for the CH32V003 RISC V microcontroller, assembled with inexpensive components. Step-by-step instructions for assembly and firmware uploading are provided, focusing on simplicity and accessibility.
Microfeatures I love in blogs and personal websites
The article explores microfeatures for blogs and websites inspired by programming concepts. It highlights sidenotes, navigation tools, progress indicators, and interactive elements to improve user experience subtly. Examples demonstrate practical implementations.