NFC 13.56 MHz Protocol Guide: Tags, Readers & Diagnostics

Core Technical Specifications

center Freq 13.56 MHz

modulation ASK / Load Modulation (106–424 kbps)

data Encoding Miller encoding (PCD→PICC), Manchester (PICC→PCD)

operating Range 0–10 cm

antenna PCB coil antenna (tuned LC circuit at 13.56 MHz)

tx Power Reader field: ≤1.5 A/m at 10 cm

bandwidth ±7 MHz (ISO 14443)

channel Spacing N/A (single frequency)

Real-World Devices & Applications

Payments & Access

Contactless bank cards (Visa payWave, Mastercard PayPass)
Transit cards (Oyster, Suica, PRESTO)
Building access badges (MIFARE DESFire)
Digital car keys (CCC/NFC)

Consumer & IoT

NFC tags for automation (NTAG213/215/216)
Device pairing (Bluetooth handover via NFC)
Digital business cards (vCard via NDEF)
Nintendo Amiibo figures (NTAG215)

Reference Circuits & Schematics

NFC Reader Module — PN532

The NXP PN532 is the most popular NFC reader/writer IC. Supports I²C, SPI, and UART interfaces. Reads/writes all major NFC tag types.

Pin	Description
`VCC`	3.3V or 5V (onboard regulator on breakout boards)
`GND`	Ground
`SDA/MOSI/TX`	Data line (varies by interface mode: I²C/SPI/UART)
`SCL/SCK/RX`	Clock/receive line
`IRQ`	Interrupt output when tag detected
`ANT`	External antenna coil (if not integrated)

Circuit Walk-Through

The PN532 generates a 13.56 MHz alternating magnetic field through its antenna coil. When an NFC tag enters the field, it draws power inductively and responds via load modulation. The PN532 demodulates this response and presents tag data to the host MCU. Supported protocols: ISO 14443A/B (MIFARE, NTAG), ISO 15693, FeliCa. NDEF messages can be read/written for URLs, text, or Bluetooth pairing records.

Signal Structure & Waveform Analysis

NFC Communication Modes

NFC operates in three modes depending on application.

Reader/Writer

Active mode

Reader powers tag, reads/writes NDEF data

Peer-to-Peer

Bidirectional

Two NFC devices exchange data (e.g., Android Beam)

Card Emulation

Passive mode

Phone emulates NFC card (Apple Pay, Google Pay)

Tag Types

Type 1–5

Type 2 (NTAG), Type 4 (DESFire) most common

Timing Notes: ISO 14443A anticollision: REQA → ATQA → SELECT → SAK → RATS. UID lengths: 4, 7, or 10 bytes. MIFARE Classic uses proprietary Crypto-1 (broken). DESFire uses AES-128 (secure).

Analysis & Capture Tips

Proxmark3: sniff NFC communication, clone tags, emulate cards
NFC Tools app: read NDEF, tag type, UID, memory size
Check antenna tuning with NanoVNA — resonance must be at 13.56 MHz
For payment cards: EMV protocol analysis requires specialised tools

Bench Troubleshooting & Repair Guide

1. Read Range Issues

NanoVNA / LCR meter

NFC range depends on antenna size and tuning. Verify antenna resonance at 13.56 MHz with NanoVNA. Add/remove tuning capacitor to adjust. Larger antenna coil = longer range.

2. Tag Not Detected

NFC Tools app / PN532 debug output

Check tag type compatibility with reader. PN532 supports ISO 14443A/B and FeliCa. Some readers don’t support ISO 15693. Verify tag isn’t damaged (try another tag).

3. MIFARE Classic Security

Proxmark3 / MFOC

MIFARE Classic Crypto-1 is broken. Use mfkey32/mfkey64 to recover keys. DESFire requires proper key management. Never use Classic for security-critical applications.

NFC (13.56 MHz)