ISO 14443 Protocol Deep Dive

ISO 14443 Protocol Deep Dive

ISO 14443 is the foundational standard underlying almost all NFC transactions involving cards and smartphones. Published in four parts, it specifies everything from the physical dimensions of a proximity card to the byte-level framing of T=CL transport layer commands. Understanding this stack is essential for implementing custom APDU-based applications, debugging field-level interoperabilityinteroperabilityCross-manufacturer device/tag compatibility guaranteeView full → issues, and interpreting card response bytes.

Layer Structure

Application (EMV, NDEF, DESFire application)
    ↕
ISO 14443-4 (T=CL transport: RATS, ATS, I-blocks, R-blocks, S-blocks)
    ↕
ISO 14443-3 (Initialisation: REQA/ATQA, anti-collision, UID, HLTA)
    ↕
ISO 14443-2 (Signal interface: ASK modulation, encoding, bit rates)
    ↕
ISO 14443-1 (Physical: card size, RF field strength, power)

Part 1: Physical Characteristics

Part 1 defines ID-1 card dimensions (85.6 × 54 mm, ISO 7810) but does not mandate them for tags. NFC ForumNFC ForumIndustry body developing NFC standards, specifications, and certifications since 2004View full → tag form factors vary widely; the physical spec applies to full-size cards such as payment cards and government ID.

RF field requirements: - Minimum field strength: 1.5 A/m RMS - Maximum field strength: 7.5 A/m RMS - Frequency: 13.56 MHz ± 7 kHz - Operating distance: up to 10 cm (standard), up to 20 cm (extended compliance)

Part 2: RF Signal Interface

Type A Modulation

NFC-A uses: - Reader-to-card direction: 100% ASK modulation with Modified Miller coding - Card-to-reader direction: OOK subcarrier at 847.5 kHz with Manchester coding via load modulation

Modified Miller codingModified Miller codingBit encodingencodingData writing to NFC tags during manufacturing productionView full → for NFC-A reader-to-tag communicationView full → encodes bits as: - 1 → pulse at start of bit period - 0 (after 1) → no pulse (edge carried from previous period) - 0 (after 0) → pulse at centre of bit period

This encoding ensures a minimum pulse rate for clock recovery even in long zero sequences.

Type B Modulation

NFC-B uses: - Reader-to-card direction: 10% ASK with NRZ-L encoding - Card-to-reader direction: BPSK (Binary Phase Shift Keying) subcarrier at 847.5 kHz

Type B has simpler timing requirements for the card but is less common in NFC Forum tags. EMV payment cards must support both Type A and Type B.

Bit Rates

The standard defines four bit rate divisors (D) for each direction independently:

fc = 13.56 MHz carrier frequency. Higher rates require negotiation in RATS/ATS (Part 4).

Part 3: Initialisation and Anti-Collision

Type A Initialisation Sequence

Reader: REQA (0x26, 7-bit) or WUPA (0x52)
Card:   ATQA (2 bytes) — indicates UID size and anti-collision type
Reader: Anti-collision loop (select commands by UID cascade level)
Card:   UID bytes + BCC (block check character)
Reader: SELECT (complete UID)
Card:   SAK (1 byte) — indicates T=CL support (bit 5 set) or not

ATQA byte interpretation:

SAK byte interpretation:

Anti-Collision Bit-Frame Method

When multiple cards are in the field simultaneously, the collision is resolved by the cascade loop. The reader sends a SELECT with a partial UID and a bit-count NVB (Number of Valid Bits); only cards matching that prefix respond. The reader progressively narrows the search by detecting collision bits and resolving them one bit at a time.

Type B uses a time-slot anti-collisionanti-collisionProtocol for selecting individual tags from multiple in RF fieldView full → method: the reader specifies a number of slots (1, 2, 4, 8, or 16) and each card responds in a randomly chosen slot.

Part 4: T=CL Transmission Protocol

Part 4 defines the block-oriented transmission protocol used by all ISO 14443-4 compliant cards (SAK bit 5 = 1).

RATS and ATS

After the anti-collision SELECT succeeds and the SAK indicates 14443-4 support:

Reader: RATS (Request for Answer To Select)
         Byte 0: 0xE0
         Byte 1: [FSDI | CID]
                  FSDI = max frame size reader will accept (0=16, 8=256, C=4096 bytes)
                  CID  = logical card number (0–14) for multi-card sessions
Card:   ATS (Answer to Select)
         TL: ATS length
         T0: [TA(1) present | TB(1) present | TC(1) present | FSCI]
         TA(1): supported bit rates per direction
         TB(1): [FWI | SFGI] — frame waiting time and start-up frame guard time
         TC(1): [NAD supported | CID supported]
         Historical bytes (arbitrary app-level data, up to 15 bytes)

The FWI (Frame Waiting Time Integer) in TB(1) encodes the maximum time the card may take to respond after the reader's last byte:

FWT = 256 × 16 / fc × 2^FWI  [seconds]

FWI=0 → FWT = 302 µs; FWI=14 → FWT = 4949 ms. Payment cards typically use FWI=8 (≈ 77 ms).

Block Structure

Three block types carry data, control acknowledgements, and supervisory functions:

Wait Time Extension (WTX): If the card needs more processing time than FWT allows, it sends S(WTX) with a multiplier. The reader grants the extension; the card responds with the data block when ready. EMV cryptographic operations commonly require WTX.

PPS — Parameter Selection

After RATS/ATS, the reader may send PPS (Protocol and Parameter Selection Request) to negotiate higher bit rates:

Reader: PPS[CID] PPS1
         PPS1 bits 3:2 = DSI (card-to-reader bit rate divisor)
         PPS1 bits 1:0 = DRI (reader-to-card bit rate divisor)
Card:   PPS response (echo PPS header)

After PPS, both sides switch to the negotiated bit rate for all subsequent blocks.

Timing Summary

See also: NFC Standards Reference | NFC Tag Types Explained | Multi-Tag Polling and Collision Resolution | NFC Transit