# How to boost RFID signal

#### spitsnsparkin

Joined Jun 19, 2011
5
Hi rjjenkins,

I followed the previous links in the responses and watch the demonstration video. The read range is impressive, but likely due to the battery power supply. Noise greatly effects the quality of the read.

My project initially started with an off-the-shelf module which had the RFID reader IC and on-board MCU for decoding. The module's datasheet indicated that the “continuous read” mode consisted of back-to-back, discrete, 100ms frames. Each frame required two consecutive and error-free decodings of the tag id before it was output to the serial port. The on-board MCU decoded the tag id by watching the demodulated bit-stream for the “header” and then the following tag id data bits. If the tag's demodulated data was stable and the header was detected near the start of the frame, then it would likely succeed and output the tag id. However, if the header was detected toward the end, then the module would time-out the frame and start again. In my application, the module could not stream different tag ids at a fast enough rate, due to it's framed-sequential detection method. Using the HTRC1100 and Microchip MCU, I pipelined the acquisition and decoding processes. I used a clock-driven SPI interrupt to record the demodulated output of the HTRC1100 into a buffer. When enough bytes were captured for the received frame, the MCU would then search, align and decode the data bits (if present) in the buffer, while the SPI interrupt continued to acquire the next frame. Since you mentioned that you success rate was 98%, but random in error, it may be due to the MCU's acception/rejection policy as well as power supply noise quality.

As I'm an old-school assembly programmer, I'm half-tempted to order one of these modules and reverse-engineer the AFE, then reprogram the on-board MCU! On the module, I can see the discrete half-bridge driver and source originating from pin14 which also is passed to the MCU for synchronization. Likewise, the on-board resonant cap, filter and half-wave AM-envelope detector before I loose the signal is the tightly packed SMD caps and resistors beside the RFID chip.
Spitsnsparkin.

#### rjjenkins

Joined Apr 16, 2011
179
Hi Spitsnsparkin

That is all interesting. I am using batteries as in the demo video, plus the electrolytic cap as recommended. Is there anything else I can do to reduce noise?

Two things I've noticed: the second antenna module set which is better tuned to 125kHz appears to be performing better, which is not really surprising. Also, I think that when there are tags not-yet-to-be-read but not very far away, that may be increasing the error rate. I can see that this could sometimes cause confusion and rejection.

I would encourage you to submit to your half-temptation!

#### Irving

Joined Jan 30, 2016
1,161
It looks very like the EM4095 chip but one vendor of the module says that it "far exceeds" the performance of that chip. When I have a moment I will see if the pinouts correspond at all.
they don't, and EM4095 is 16pin not 14pin. I've not found a suitable 14pin chip that has a XTAL on pins 5 & 6.

#### Beau Schwabe

Joined Nov 7, 2019
80
"Resonant inductive coupling" - is what you want to look into.
https://en.wikipedia.org/wiki/Resonant_inductive_coupling

There is no need to alter your existing "tuned coil" but by introducing a second coil (larger) that is also tuned to the 125kHz in proximity to the original coil will create a magnifying effect to the overall system.

In May of 2014 I presented a demonstration at RMISC (Rocky Mountain Information Security Conference) exploiting a major vulnerability with RFID tags. Our record still stands with a valid read of a passive 125kHz RFID tag at a distance of 20 feet. Our detection coil was only 3.5 inches in diameter. Our findings led to one of the reasons you hardly ever swipe your credit card anymore at a grocery store, but instead use the chip on your credit card.

Attached is a coil calculator that I have put together over the years.
For a hand wound air coil, you want to focus on "Special Case Multi-Layer where l equals b"
1) Enter your wire gauge in F39
2) Enter your Coil Form diameter in F32
3) Enter your Number of Turns in F28
The approximate inductance will be in cell D34 in uH

Note: This is an iterative process and I have had good results working backwards with a specific inductance and 3D printing a coil form to match the diameter based on a specific number of turns.

#### Attachments

• 30.5 KB Views: 6

#### rjjenkins

Joined Apr 16, 2011
179
Beau Schwabe -
Fascinating. 20 feet! Did you ever publish this as a paper?
Thanks for the spreadsheet. To make a second resonant circuit I presume I need a capacitor in parallel with the new coil?

#### Beau Schwabe

Joined Nov 7, 2019
80
No, I didn't publish a paper but for awhile I made kits available.

The "exploit" was that I didn't need to read the actual tag, but instead listen to the door reader itself. When a tag is introduced to the door reader, the door reader becomes a transmitter. The problem is, with a radio tuned specifically to 125kHz, that now I can "see" not only the negotiation of the tag data but also any querying that the door reader might do to a tag to facilitate communication. My particular radio was able to sense the door reader from 20 feet away and report a valid tag. You can see how this might be a problem ... A credit card reader that you swipe the card has a bias frequency typically anywhere from 70kHz to 100kHz. A similar approach mentioned above with the RFID door card can also be applied here.

In answer to the capacitor question, YES, absolutely. The inductance value is relatively meaningless unless you create a resonant tank with a complementing capacitor in parallel with the coil .... in the upper right of the spreadsheet there is a clickable link to an LC filter calculator (<-- nothing fancy)

#### rjjenkins

Joined Apr 16, 2011
179
I presume those kits are long gone?

Anyway ... my original coil is 10cm square. I made a second one 14cm square and, according to my calculations, with a 100nF cap it should have a resonant frequency of 125kHz. Placed next to the original coil it certainly shows a nice sine wave of that frequency but the peak to peak amplitude is <1V at best. Should I be aiming for more or am I in the right ball park?

#### Irving

Joined Jan 30, 2016
1,161
Anyway ... my original coil is 10cm square. I made a second one 14cm square and, according to my calculations, with a 100nF cap it should have a resonant frequency of 125kHz. Placed next to the original coil it certainly shows a nice sine wave of that frequency but the peak to peak amplitude is <1V at best. Should I be aiming for more or am I in the right ball park?
You probably weren't on tune. A 100nF capacitor typically has a tolerance of 10% so your tank resonance could have been way off.

Did you mean 100nF?

$$F = 1/(2\pi\sqrt(LC))$$

so

$$L = 1/((2\pi F)^2C)$$

$$= 1/((2\pi 125000)^2 . 100e-9)$$ = 16.21uH = 155turns 28awg 14 x 14cm (= 16.1uH)

F could be anywhere between 119.5 and 132.2kHz even if your coil was spot on.

155turns on 14 x 14cm = 0.7ohms so Q should be reasonable

#### rjjenkins

Joined Apr 16, 2011
179
Yes I did mean 100nF. I used this calculator for square coils (since the other one was for round ones):
The coil former is 138mm square and I was using .2mm wire and 15 turns gave me - I now see - 160uH not 16uH as I had thought.
But 155 turns would give 0.016H or 16mH which is way off, so I am now very confused.

#### Irving

Joined Jan 30, 2016
1,161
Yes I did mean 100nF. I used this calculator for square coils (since the other one was for round ones):
The coil former is 138mm square and I was using .2mm wire and 15 turns gave me - I now see - 160uH not 16uH as I had thought.
But 155 turns would give 0.016H or 16mH which is way off, so I am now very confused.
My bad, I mistranscribed it...should have been 15.5 turns (I think). I used a different calculator that took all measurements in metres.. Anyway, as you say 15 turns 0.2wire on 138mm sq former will give 160uH, so C = 10.1nF. If you have an LCR meter or multimeter with capacitance measurement it would be worth checking the actual capacitance of a 10nF (esp if its a MLCC ceramic from one of those cheap chinese kits where 50% tolerance is more realistic!). Though 10% variation is much less of an effect than with 100nF, <0.5dB variation.

With 100nF it would be well off tune in th order of ~-11dB or about 1/4 of what it should be..

Last edited:

#### rjjenkins

Joined Apr 16, 2011
179
My bad, I mistranscribed it...should have been 15.5 turns (I think). I used a different calculator that took all measurements in metres.. Anyway, as you say 15 turns 0.2wire on 138mm sq former will give 160uH, so C = 10nF
Ok thanks we both messed up in opposite directions. I’ll try a lower value cap.

#### spitsnsparkin

Joined Jun 19, 2011
5
Hi rjjenkins,

If you notice in the video, the demonstrator is only using the output LED on the module to indicate the successful reading of the tag. There is no connection, via the TTL serial port, to any host to do anything with the tag information. This results in the best-case, non-practical application of the module's performance. From visual observation of the pictures, the module also incorporates separate positive power supply pins: one for the RFID driver (pin 9) and one for the on-board MCU (pin 3). They are tied together for the demonstration, but may best be separate in practical application.

If noise IS the source of your issue and battery power is fine for your end application, then try using two battery packs, one for the RFID driver and one for the MCU. If the performance improves, then digital noise may be coupling into the RFID received AM envelope detector. If your using a single external power supply, try splitting the positive supply into two feeds and pass each of them through a (10ohm+100uF) RC filter. Better yet, perhaps a higher voltage power supply with two linear-regulated LDO outputs.

You may also need to isolate any noise from the host which connects via the serial TTL pins. I ran into a noise problem with an external A/D which was converting thermocouple voltages via an SPI serial link. Noise from the host MCU via the SPI data lines affected the converted analog voltage. I introduced RC low pass filters (100ohm + 220pf, calculated from the rise/fall time of the line drivers) on all of the lines from the host to the A/D (even on the returned SDI line which was driven by the A/D SDO output). If you are using one of those RS232 to digital ICs (with the on-board capacitor charge-pump), it's switching noise will pass through the TTL serial data lines and into the RFID module. I'd use the same RC combination as well. As the MCU module has the I/O drive capability to momentarily flash an LED, then using the serial output to drive the LED of an opto-coupler would be the best bet to isolate the noise from a power-supply driven host and a battery-powered RFID module.
Spitsnsparkin.

#### rjjenkins

Joined Apr 16, 2011
179
Good detective work on those pinouts. I will try two separate power supplies (I'm using batteries).
In my experience, whenever the LED comes on, I get a successful tag read.
There are other parts of my arrangement which might be having an effect - maybe? The serial output from the module goes straight to an arduino pro mini which reads it via software serial. The read result is then transmitted via a NRF24L01 (2.45GHz) which has an SPI connection to the arduino. However, all this is some way from the module (about 30cm) so I'm not sure there would be much noise.

#### rjjenkins

Joined Apr 16, 2011
179
OK - some progress, I think.
I believe the main problem was due to the alignment of the tags, which meant that the field wasn't strong enough to excite the tag coil when it was in a certain orientation. I made two resonant coils with capacitors (having finally got the maths right and tuned them with a scope) and put them perpendicular to the main coil. The voltage wasn't very high when the coils were oriented like this (about 3V) but they seem to make the overall field less polarised and increased the read success

#### sparky 1

Joined Nov 3, 2018
490
If 98% of the time the reader arrangement is sufficient something must be working alright so what exactly is the cause of the 2% error ?
Is the infrequent event from the transponder being slightly skewed or not ? Or is it something else ?
A misread event captured on a scope might isolate why the data signal does not function correctly.

Last edited: