RFID - the Disney way, two frequency bands

Disney theme park customers have special RFID bands, called MagicBand, helping them use the parks. A 13-month old Wired article called this a $1B bet on their MagicBands, but such an expenditure would have been more on the back end, rather than on the bands themselves.

formatting link

At the time, Disney was quite forthcoming with tech details, photos and teardowns about the RFID bands. EETimes has a video,

formatting link

At one level the MagicBands operated as 2.4GHz devices, but they also had a longer-range low-frequency capability they didn't discuss. This was explored by the fellow at AtDisneyAgain. See

formatting link

Their design has recently dramatically changed, which is obvious by comparing this photo I took, see dropbox, to the earlier teardowns.

formatting link

I wasn't able to identify the new 32-pin primary RFID controller IC. But note the coupling components and the 1/4 turn 2.4GHz antenna.

I also wasn't able to identify the large RF driver-IC / module connected to the outer five-turn low-frequency antenna loop (outer diameter 0.85 x 1.0 inches). Nor could I find any information about the low-frequency system, except that it could work at longer ranges.

Perhaps somebody here can help.

--
 Thanks, 
    - Win
Reply to
Winfield Hill
Loading thread data ...

125-128kHz and 13.56Mhz are two other RFID frequencies much used. Clearly not enough turns for LF so my guess is they use 13.56Mhz and 2.4GHz.

There are a lot of microcontroller+RF chips made for Zigbee/bluetooth usage that would be candidates for the 32pin device, for example I have seen Chipcon CC2xxx parts used for just that kind of RFID token.

Are you sure that larger object you think is an RF driver-IC is some kind of semiconductor? I wonder if it is a capacitor or filter?

piglet

Reply to
piglet

From the part number it's Nordic Semiconductors nRF31512. There's not much information in the web about it, but nRF has had a lot of chips that offer reduced functionality with lower price.

I could not find any datasheets or detailed information, but they've had a lot of proprietary 900MHz, 2.4GHz, BLE chips with 8051 and Cortex-M0/M4.

--
mikko
Reply to
Mikko OH2HVJ

Yes, that sounds right. A special reduced-functionality part. No doubt Disney bought millions at a reduced price.

--
 Thanks, 
    - Win
Reply to
Winfield Hill

** Right - a "Micky Mouse" part at a "Minnie Mouse" price.

... Phil

Reply to
Phil Allison

You might find this site easier to navigate than the FCCID mess:

If you go to the FCCID search page at: and enter: Grantee Code = Q3E Show [99] records (at bottom of page) and click "start search", you'll get all 12 of Disney's listings. The latest is dated Jan 2016 for the molded watch band.

Also, notice the lower and upper frequencies in the 2.4GHz band. A few seem to be specific frequencies rather than ranges, such as 2482.0 MHz for the Q3E-xBR-R1G1 reader. From: "The model xBR V3 device, with the FCC product code Q3E-xBR-R1G1, has multiple receiving radios to receive signals from wristband transmitters. The device also transmits using a single radio to control the wrist bands." It would be interesting to know what they "control" on the wrist band? Perhaps a Star Trek style "Agonizer"?

The design was by Synapse (A Cambridge Consultants Company):

The use of "UHF" in the tag was removed from the FCC certification in

2013 making the tag operational only on 2.4GHz: Strictly speaking, UHF means 300-3000MHz, so 2.4GHz would be considered UHF.

The 5 turn outer loop is 13.56MHz. Try this calculator to be sure: For something that isn't going to be used, the loop has appeared in all the known versions.

Somewhat later versions of the band: show the 13.56MHz loop buried in a flex PCB. The chip in the photo is someone's RFID chip which appears to be only connected to the 13.56MHz antenna.

My guess(tm) is that there are actually two RFID devices in the package. One non-removable battery powered active device for 2.4GHz, and one passive device for 13.56MHz. Using the "follow the money" principle, my guess(tm) would be that the 13.56MHz section is for some kind of NFC payment device for a future "Disney Pay" contrivance as illustrated in the FCCID pages:

Yet another guess(tm). The 2.4GHz device might be transmitting a beacon at some random interval, which would likely be used for tracking visitors in the park. If the band you tore apart is still functional, you might check for this feature.

Did the device you posted at: have a different FCCID number from the previous mutations? (Q3E-MB-R1G1)

--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
 Click to see the full signature
Reply to
Jeff Liebermann

On Sat, 29 Apr 2017 11:00:27 -0700, Jeff Liebermann wrote: (...)

Disney also has some other FCC ID prefixes.

2AJS4-TP-R1G2 "The TPv2 is a second generation Digital Access Point. The primary function of the device is to read multiple media types and relay that information using an Ethernet connection. The TPv2 is able to read HF RFID tags. The TPv2 can read UHF RFID tags embedded in cards. The TPv2 also has 2.4 GHz transmit and receive radios." So, it's a reader with 3 frequency bands, 13.56MHz, 900MHz(UHF), and 2.4GHz (bi-directional).

This reader was added recently (Apr 11, 2017):

2AJS4-TP-R1G2 I'm not sure what this device really looks). Notice that it transmits on 900MHz and 2.4GHz, and receives on 13.56, 900MHz, and 2.4GHz. The RF test report includes tests for all 3 bands, so I guess 900MHz is back in the picture.
--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
 Click to see the full signature
Reply to
Jeff Liebermann

Low frequency receive and high frequency transmit are quite common... saves power since receiver is either on all the time, or keyed on to listen every fraction of a second or so... the chip designs I did for SAVI Technology (was independent, then Lockheed-Martin, now private: LaSalle Capital Group) were like that... since they're primarily used to track trucks and pallets. ...Jim Thompson

--
| James E.Thompson                                 |    mens     | 
| Analog Innovations                               |     et      | 
 Click to see the full signature
Reply to
Jim Thompson

I'll assume that you're talking about the tag, not the reader.

I don't see how that saves power.

As I understand it, having both 13.56Mhz and 2.4GHz gives the tag the advantage of still being functional if the battery dies in the active tag and/or can do full duplex with data to the tag on 13.56MHz and from the tag on 2.4GHz. A passive 13.56MHz tag is cheap but a limited range of about 8 meters max as I recall. Meanwhile, the active 2.4Ghz tag can do very long distances. For example: Judging by the button cell used by the Disney MagicBand, I would guess(tm) that these have about the same range as an automotive alarm key fob (30 meters). Since the MagicBand battery is small and cannot be replaced, methinks the intended lifetime might be rather short. So, rather than have someone show up at the gate with a dead battery in their MagicBand, the reader can at least identify the owner on

13.56MHz, which somewhat explains the 2nd tag. However, I'm guessing (as usual).

I believe that their biggest customers are NATO and the US military:

--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
 Click to see the full signature
Reply to
Jeff Liebermann

Disney theme parks have a lot of rides and attractions that are completely indoors, say Space Mountain, the Epcot dome, and whatever else they've built in the 2 decades or so since I was last at the Magic Kingdom.

Could they be using some kind of system where they have local 2.4 GHz receivers for the wristbands within the indoor attractions, but are then transmitting at a higher power on a lower frequency from a centralized location to achieve wall penetration, so they don't have to also install a transmitting system in every single building?

Reply to
bitrex

[snip]

Yes.

SAVI Technology (battery-powered) tag for tracking trucks and pallets (at/near loading docks), original design early 2001, with embellishments thru 2009, received on 132kHz, transmitted on 434MHz.

Nominal current when not active, 5uA... wake-up, listen for request of THAT particular tag serial number, if not heard, go back to sleep. ONLY if proper serial number heard did 434MHz transmitter respond.

This was prior to Lockheed-Martin acquisition.

Then development ceased, except for some low-noise preamp development for the receiver (original chip was all CMOS). [snip]

In late 2011, early 2012, I was called back to assist as expert witness to defend the patents... one of those patent scammer companies had a patent "if it looks like our vague description of tag it must infringe our patent".

One of their attorney's was harassing me trying to elicit from me that my design was as described by the scammer patent... but it was nothing like it.

Round and round we went until finally she said, "Well! I just don't understand, Mr. Thompson".

In a fit of pique I responded, "Maybe that's because you're a lawyer, and I'm an engineer!".

Brought down the house >:-}

Lockheed-Martin ultimately paid off the scammer... apparently cheaper than legal fees... I, alone, was billing $8-10K/week ;-)

That's now. When this thread started I reached out to see who was left of the original SAVI team... none.

One whose private E-mail I knew, responded yesterday with...

"Hi Jim,

Good to hear your still at it. They sold Savi 4-5 years ago and fired every last one of us. Moved it to east coast. I don't think they really design anything anymore.

Tim" ...Jim Thompson

--
| James E.Thompson                                 |    mens     | 
| Analog Innovations                               |     et      | 
 Click to see the full signature
Reply to
Jim Thompson

Lame, payouts like that is why those actual corporate parasites exist.

There should be some kind of scam-artist insurance fund that companies with IP can pay into so that when the scammers show up they can just grind them in court until they run out of money.

Reply to
bitrex

Saves power by only having continual dynamic power dissipation at the lower frequency (charging and discharging all those CMOS gate capacitances in whatever IC you're using) and not having to bias the RF receiver amps at the relatively high static currents required for the speedy-speedy I'd guess...

Reply to
bitrex

Ah, got it. LF receive doesn't draw much (or any) power and

433.925MHz is a good compromise between TX power and range. Much of this stuff was moved to 900MHz, where the antennas could be made smaller and less interference from key fobs and wireless weather stations. That worked fine until spread spectrum smart meters took over most of the 915-928MHz band. The powered tags are apparently now on 2.4GHz and a few on 5GHz leaving the passive tags on 900MHz. Also, in 2001, we didn't have the benefits of cheap 2.4GHz chips, components, and technology.

A friend worked for Savi just after Lockheed bought them. We would have dinner and he would ask me to interpret some of the political intrigues that were happening at the time. That gave me a rather biased view of the company, which I'll keep to myself.

When Lockheed decided to sell the company, there were numerous rounds of layoffs intended to reduce costs and make the business look profitable. When that didn't quite work, they moved the "leadership team" to the east coast, and continued the layoffs on the west coast: Oddly, they laid off from the top, so my low paid friend was one of the last to go.

Things apparently settled down when the company was sold to LaSalle: Some clues on GlassDoor.com:

Nicely done.

--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
 Click to see the full signature
Reply to
Jeff Liebermann

Jim mentioned that his Savi tag receiver is running at 132KHz. CMOS only draws power when transitioning from a 0 to 1 or 1 to 0. Therefore, the lower the frequency, the lower the power consumption for an active tag. 132KHz will use less power than 13.56MHz.

What's a "speedy-speedy"? If you mean while the tag is moving, that's taken care of by the modulation scheme. Most tags are OOK (On Off Keying). The doppler shift that screws up tags using FM modulation is not a problem with OOK. That's not to say that doppler is useless. There are some schemes that determine the tag direction of travel and location by its doppler shift.

--
Jeff Liebermann     jeffl@cruzio.com 
150 Felker St #D    http://www.LearnByDestroying.com 
 Click to see the full signature
Reply to
Jeff Liebermann

Not to mention... for all intents and purposes, chip was an analog amplifier with two digital outputs, (1) signal strong enough to trust (RSSI), and (2) data... very slow stuff... 300uS bit width.

[snip] ...Jim Thompson
--
| James E.Thompson                                 |    mens     | 
| Analog Innovations                               |     et      | 
 Click to see the full signature
Reply to
Jim Thompson

ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.