Disposable NFC: Ken Shirriff Reverse Engineers the Tech Behind Montreal Métro Tickets

Ken Shirriff has placed an unusual chip under the microscope for a look at just how it's possible to put wireless-capable electronics into a disposable piece of paper: the Montreal Métro tickets.

"To use the Montreal subway (the Métro), you tap a paper ticket against the turnstile and it opens," Shirriff says. "The ticket works through a system called NFC [Near Field Communication], but what's happening internally? How does the ticket work without a battery? How does it communicate with the turnstile? And how can it be so cheap that you can throw the ticket away after one use? To answer these questions, I opened up a ticket and examined the tiny chip inside."

Each ticket, Shirriff explains, comes with an embedded chip sandwiched between the paper — part of a plastic insert that includes metal foil acting as an antenna. While the tickets also include what appears to be the gold contacts for a smartcard chip at one end, they're printed on the paper with non-metallic ink and are entirely decorative. As a result, there's no need to put the paper ticket into a smartcard reader: just tap it against a turnstile and you're good to go.

The secret, of course, is NFC, or Near-Field Communication — a standard by which a compact chip is powered using energy harvested from a nearby reader's radio transmissions. How compact? "It is about the size of a grain of salt," Shirriff writes. "The chip is also extremely thin — 75µm or 120µm — so you can't even feel the chip inside the ticket."

That tiny chip is a MIFARE Ultralight EV1, one of the lowest-cost parts in the MIFARE family. It lacks advanced features available in more upmarket versions, and is tailored for single use — replacing printed barcodes or QR Codes with something more challenging to fool with a photocopier. Unlike printed tickets, it not only transmits information to the reader but can store information in turn — updating internal counters that can be used to limit the number of times a ticket is valid for transit.

To see what's inside the tiny part, Shirriff first extracted it from the paper ticket by soaking it in water. The plastic was then removed with boiling sulphuric acid, leaving behind the silicon die. Boiling phosphoric acid took care of a passivation layer on top of the die, which was then treated with an etchant and hydrochloric acid. While the process requires the careful handling of a range of boiling acids, Shirriff had something else on his mind: "My biggest concern while processing this chip," he explains, "was to avoid losing it."

Placing the chip under a high-powered microscope, Shirriff was able to trace out its various blocks: analog circuitry, a large chunk of standard-cell digital logic, an EEPROM to store data, and a charge pump to boost the low-voltage harvested energy to a level suitable for writing to said EEPROM. "It's remarkable that these NFC chips can be manufactured so cheaply that they are disposable," Shirriff concludes.

The full write-up is available on Shirriff's website.