NRF24L01+ genuine vs. counterfeit - checked some modules
Today, my colleague and me were checked some modules to find out if they are using counterfeit or genuine NRF24L01+ chips inside.
We removed the top of the IC and compared the internals with the photos found here:
In really cheap modules, we found counterfeit IC-s.
Those modules are similar like the following one (however, they work surprisingly well, but they are counterfeit):
Edit - I have tested these modules (so they are counterfeit):
We also checked the modules bought here:
It is an official store of Nicerf, the module can be found at their website here: http://nicerf.com/product_147_88.html
In RF24L01F20, we found authentic NRF24L01+ IC inside.
We also found original IC in these modules:
RF2401F20 module is better as it also has CE / IC / FCC certifications, so it is a much complete solution.
These photos are not really good and the process was way too destructive, but we were able to clearly identify that RF24L01F20 and L24L01-D03 modules are built with genuine Nordic NRF24L01+ IC.
Also, these modules produced the best performance of those I have tried. Good to know they both use original chips inside.
I hope this experiment also helps others as well.
Here is a photo of RF24L01F20 without metal cap:
Here is the same module with three genuine ICs on the left which have been purchased from Mouser:
This is a photo of the IC in L24L01-D03 module without metal cap:
Above ICs are all genuine.
Counterfeit ICs had also a bit different printout - for example, the top left square sign was circle on them and text alignment usually was not perfect, but it may not be a good way to identify if they are genuine or counterfeit.
I hope this may be a good starting point for others who also looking for original products.
Wow. Good job!
@VaZso some first post! Awesome
Good way to recognise fake NRF24L01+ is measurement of current consumption. The best is measure current in power down mode, genuine chips have about 500nA (datasheet says 900nA) but fake copies has over 3uA usually 4uA.
In transmit or receive mode have fakes a little higher consumption than genuine. Genuine Tx-0dBm~11mA, Rx~13mA. Fakes have about 2mA more than genuine and it's consuption is out of datasheet range!
@xlibor Thank you. I read that, but still not measured it.
I have also read there is a mistake in datasheet and real NRF chip behaves differently than what is written in it, but Chineese manufacturers are also copied the error in datasheet, so that acknowledgement bit works in inverse compared to the real chip.
I still would like to also test this.
@VaZso this is not the first nrf24l01+ counterfeit discussion on this forum.
See also https://forum.mysensors.org/topic/1153/we-are-mostly-using-fake-nrf24l01-s-but-worse-fakes-are-emerging and https://forum.mysensors.org/topic/1664/which-are-the-best-nrf24l01-modules
@Yveaux Thank you for pointing this out.
I just wanted to share our findings with these modules.
First it was written to be a reply of an about two months old thread, but the system asked if I really want to post in a new thread and finally I did not post there.
I have read about counterfeit chips in some other threads/forums anyway, but I thought it is a good idea to share and name trustable modules with others, that is why I have finally put our findings in a new thread.
So Itead modules seems to be geniune (base on your photos) sorry for smartphonne "quality"
Have you run some tests on reliability/range/speed before destroying those chips? Because that's actually what is important 😀
@Fabien Maybe it is, but it would be good to see what is inside.
Anyway, I hope Itead sells genuine products as they have higher reputation in my mind...
@gohan L24L01-D03 used to run before, but this particular RF24L01F20 module was never soldered to any mainboard.
However, I have modules from the same source/branch of both.
We ran tests using both module types and we could achieve impressive range with appropriate antennas attached.
L24L01-D03 modules (linked above) came with relatively good antennas and the same seller sells RF24L01F20 with antenna included, which was also able to produce similar range.
We had an opportunity to check the antenna which arrived with L24L01-D03 module at an exhibition (other antennas were still on their way that time) with an expensive Rohde&Schwartz equipment. The man who measured it was not really impressed with the result of measurement as its characteristic was not really good and it had higher gain outside of the specified frequency range than in the range we need. However, it was still usable as antenna in the frequency range we need. After also checked all other antennas which we currently had (they arrived with other modules from China), it has been revealed this type was the only usable antenna we had at that time - others looked like they were attenuators...
We did not have a chance to also test the antenna came with RF24L01F20, but it is also usable in the same distance, albeit it is much smaller than the other.
We also bought some antennas from TME, which were also able to communicate in the same range.
We tried to communicate using two RF24L01F20 modules, one end with the two similar antennas and the other end with a PCB antenna ordered from TME.
They were able to communicate inside a two-story building with one end upstairs and the other one downstairs between several walls, maybe till about 40 meters in distance at 256 kbit/s.
Also tried them with the same modules when one end was upstairs and the other end was outside (so, through a roof and other buildings), we could walk some hundreds of meters with stable communication while it was relatively free way between them.
Range was better than the range of a good WiFi in 2.4G band.
Earlier, we could go close to 1km with open field using L24L01-D03 modules.
Also, we tried lowering RF gain to ensure we are in the allowed power range and it was also good in the house (we could achieve similar range inside).
Currently we don't need high bandwidth, so we only tried 256k extensively to achieve the best possible range.
Reliability and range seem to be really good, but we did not tried high communication speeds yet.
CE / FCC markings seem to be also really important for us in top of other parameters and that is why RF24L01F20 seems to be perfect for us, as it has also good parameters, original IC and these certifications.
@xlibor Today, I have tried to measure current consumption of the modules I have.
I have powered them up, but they were not initialised - it was the simplest way as only VCC and GND were connected, but it worked.
There was a significant difference between modules containing genuine or counterfeit ICs.
Also genuine modules with PA consumed less than 1μA while others consumed more than 4μA.
As lowering power consumption is not an easy task, I think this is the best way to determine if a module has real or counterfeit IC inside.
Today i tested this method, and ... It works :-D:-D:-D:-D
Fake over 1mA, genuine about 0,5uA :-D
But this can't be probably used as proof in disputes on aliexpress. But for quick test is this method insuperable.
@xlibor It is true, but if you find a trustable seller / modules (like the modules above), you may order more from that seller.
Another indicator may be the price.
Original Nordic NRF24L01+ IC is about 1.78 USD per piece (+TAX) if you buy 1000 pieces. So let's say IC's price may be about 1 USD in high volume - a complete module in the range of 1 USD per piece (including PCB, crystal, etc.) is hard to believe to be original - however, expensive module also may be counterfeit...
Otherwise, yesterday I was not sure if I was remember well, but today my colleague confirmed that those modules which I said to consumed more than 4μA is true, but the measured value was ~660μA, so it was also almost 1mA in my case - much worse than modules with original IC.
Anyway, those small modules with counterfeit chips also worked surprisingly well - using a genuine module with PA one side, that counterfeit module (without PA) could also communicate hundreds of meters in open field, but most other modules from China failed that way (one problem could be the unusable external antenna anyway, but other modules with integrated PCB antenna were also worse than this module).
These are the modules I am speaking about: https://www.aliexpress.com/item/10-pcs-Free-Shipping-2-4GHz-NRF24l01-Wireless-Module-Mini-Version/32297159921.html
Their pinout is the same as the pinout of RF24L01F20 - that module is only a little bit larger, but with PA and certs, so it has much better range and quality.
Earlier, I said we were able to do some tests at an exhibition using really expansive instruments with a help of a professional in that field.
At that time, we did not know if we have any original modules, but later it has been revealed that most of our modules were genuine, so we tested our modules with authentic IC on board.
We bought two development boards with us where NRF modules were plugged in to do some tests.
One of those modules was sending at 256k (and in some tests at 1M and 2M), other one just received the packets and acked it (when it was turned on). Payload was 32 byte, but we also tested in another module of us with 4 byte payload and same results.
So, after ack has been received (or an about 1ms timeout exceeded), the module sent another message.
We chose a frequency for our test where no other transmitter was working.
The transmitter had an antenna attached and the analyzer also had an antenna connected - they were placed close to each other.
We looked at the spectrum (using a realtime spectrum analyzer / EMI Test Receiver) and saw some strange noise near the chosen frequency which started to fill near frequencies in the spectrum with peak hold activated.
We looked the frequency deeper and found the signal sometimes not looks to be as narrow as other times.
The instrument was set to trigger and hold the signal when it has beat the trigger field (reddish rectangle in the top left of the photo). We saw this:
...and so on.
We took two videos of it.
In this one, the trigger was on and the instrument was holding the problematic frame a short time:
Nrf24l01(1) – 00:07
— Márió Tóth
In this one it is harder to see the problem, but you may notice some wider signals:
Nrf24l01(2) – 00:15
— Márió Tóth
As we did not know if the module we used was original IC and we did not have NRF24L01+ from authentic source that time, we desoldered the IC from one of our authentic modules (as later revealed) and replaced it with an IC found in a Gigabyte mouse's receiver (so these two ICs were interchanged). It was an NRF24L01 (without "+"), so it did not support 256k mode, but otherwise it worked well... but with the same behaviour in frequency band.
Also, nothing has changed when we set the transmitter to another channel (other frequency).
Then we tried to examine the communication of the Gigabyte (and a Logitech) mouse, but it was much harder as they are doing frequency hopping like bluetooth technology does.
So, we were less sure about what we see, but we noticed they also produced this symptom.
Back to our modules... so all of the modules we tried had similar behaviour, with or without PA, with external antenna or with PCB antenna, be it a module with authentic or counterfeit IC, did not matter. When we turned the module off, the wider frequency component has also disappeared, so it was not some noise from elsewhere. Also mice seemed to have the same problem.
We tried to modify our source code, but it has not helped.
We also examined the receiver board, so when it has transmitted acks - it did the exact same peaks.
Between two communications, NRF was in standby-II mode.
Actual library was the same, but in two different boards, one with AVR and other one with STM32, not speaking about mice.
It made us a bit unsure if we are allowed to use this module (by regulations) or not.
So, it produces much less noise than a WLAN does, but WLAN is also much higher in bandwidth.
The following thread seems to describe the same problem:
Also, many manufacturers use the same IC in commercial equipments, so I assume this problem is not as huge as we thought, also the module above could pass the tests of certification.
Maybe the instrument we used was too high-class (with its price above 200 thousands of USD) or the specific rules allow this behaviour.
These examinations led us to look what modules have genuine IC and what modules don't, and how to distinguish them... I have created this thread as a result of our findings initiated by these measurements.
What are your opinions about this?
I would like to know how others see this problem, or if someone knows more about regulations especially in Europe / EU (as we live here), but it would be interesting to hear about the same also from other parts of the globe.
Maybe there are professionals here who know much more about it and may share their knowledge.
Thank you in advance.