Skip to content

Cubic Nextfare MFC

Jump to bottom Edit New page
Michael Farrell edited this page Jun 2, 2019 · 39 revisions

Cubic Nextfare is a ticketing platform. This document describes the format used by systems on MIFARE Classic.

Generic support for cards on the Cubic Nextfare platform is added in Metrodroid 2.9.29.

These cards use Mifare Classic 1K for older versions, and Mifare Plus 1K (SL1) for newer cards. The older MFC cards have the card number printed in black on the card. The newer MFP cards have the number engraved in brown.

Encryption keys are unique for each sector and each individual card. Two cards on the same operator will have different keys.

All numbers on the card are stored as little-endian.

Identifying a Cubic Nextfare MFC card

  • Card serial numbers start with "0160", and have 16 digits. (eg: 0160 1234 5678 9012)
  • The card serial number can be printed (for older cards) or engraved (for newer cards).
  • The card magic identifier on the card.

Note: These only apply to Nextfare on MIFARE Classic. Other systems use different numbering.

Deployments (cities)

Former deployments

Confirmed:

  • Breeze blue cards (Atlanta, GA, USA). Since replaced with DESFire.

Possible former deployments:

  • SmarTrip (Washington, DC, installed 1999, Replaced with fully locked MiFare Plus SL3)
  • ChicagoCard (changed to Ventra)

Block layout

Sector Block Content
0 1 Card magic identifier
0 2 Secondary magic identifier
1 0-1 Balance
1 2 Configuration
2 0-2 Top-up
3 0-2 Travel Pass
5-8 0-2 Tap record

Card magic identifier

Block 1:

First Last Length Field description
1 8 8 Magic: 16 18 1A 1B 1C 1D 1E 1F
9 15 6 System Identifier

System Identifiers

Identifier System
010101010101 Transit Access Pass, Breeze, Go-To (Minneapolis) (see below)
202122230101 Go card (old cards)
5A5B20212223 Go card

Identifier 01 01 01 01 01 01 is shared between many operators. Using Block 2, the difference can be mostly detected:

Block 2 content System
00000000000000000000000000000000 Transit Access Pass, Breeze
3f332211c0ccddee3f33221101fe01fe Go-To (Minneapolis)

Breeze MFC cards are no longer issued or valid for travel.

Serial number

The card serial number is 16 digits, typically printed in groups of 4 digits.

First Last Length Field description
1 3 3 Always 0160
4 15 12 Mifare UID, printed as 32-bit little-endian integer
16 16 1 Luhn check digit.

Balance (NextfareBalanceRecord)

First Last Length Field description
1 1 1 Balance is negative (in debt) if bit 0x80 is set
2 3 2 Balance in cents
5 6 2 ?? gets cleared when travel pass added, gets set when travel pass in use
7 7 1 0xff pass unused, 0x00 pass used
8 8 1 0xff pass used, 0x00 pass unused
13 13 1 Balance sequence number. The higher of multiple balance records has precedence.
14 15 2 Checksum

Configuration (NextfareConfigRecord)

First Last Length Field description
4 8 27 bits Expiry timestamp (see below)
8 10 2 Ticket type??

Top-up (NextfareTopupRecord)

First Last Length Field description
0 0 1 Record type (0x31 for automatic top-ups)
2 5 27 bits Timestamp (see below)
6 8 31 bits Credit amount, in cents. Drop highest bit (& 0x7FFF).
12 13 2 Terminal ID
14 15 2 Checksum

Travel pass (NextfareTravelPassRecord)

First Last Length Field description
0 0 1 Record type (0x31 for automatic top-ups)
2 5 27 bits Expiry timestamp (see below)
12 13 2 Terminal ID
14 15 2 Checksum

Transaction record (NextfareTransactionRecord)

First Last Length Field description
0 0 1 Tap type (see below)
1 1 1 Vehicle type / Agency ID (varies based on system)
2 5 27 bits Timestamp (see below)
5 5 1 bit Transfer / Continuation (bit 5/0x10 only)
5 6 11 bits Journey ID. Lower 5 bits of byte 5 are another field
7 9 2 Cost. If (value > 0x8000), then this is a "debit", otherwise it is a credit.
12 13 2 Station ID
14 15 2 Checksum

For a transit provider that has "tap on" and "tap off", the "tap on" typically debits the default / maximum fare, then the "tap off" will adjust for the difference in cost between that fare and the actual fare.

So if a provider has a default fare of 500 cents, but the actual fare is 300 cents, then there will be:

  • A tap record debiting for 500 cents
  • A tap record crediting for 200 cents

Transaction types

  • 0x05: Travel pass trips (LAX)
  • 0x31: Stored value trips (SEQ, LAX)
  • 0x41: Travel pass sale (LAX)
  • 0x71, 0x79: Stored value top-up (SEQ, LAX)

Timestamps

Timestamps are built as follows, in bits (shown byte-reversed):

First Last Length Field description
0 4 5 Not used for timestamps, belongs to adjacent field
5 15 11 Minutes since midnight
16 22 7 Number of years since 2000
23 26 4 Month, 1 is January
27 31 5 Day of month, 1 is the first day of the month

All timestamps are local time of the operator.

Metrodroid and its authors are not affiliated with any public transit agency.

Clone this wiki locally