How do I get the register map of ST25R95 ?

[Nkama]

I'm tring to detect tag infomation by ST25R95.

Main board is STM32L476RG.

I got the sample code from https://www.st.com/en/embedded-software/x-cube-nfc3.html.

Example commands are descripted in the datasheet https://www.st.com/resource/en/datasheet/st25r95.pdf.

However SPI commands that sample code actually sends are different.

Do you have register map of ST25R95 or more detailed datasheet ?

[Brian TIDAL]

Hi,

the command sent by the X-CUBE-NFC3 are the ones described in ST25R95 datasheet. 

Here is a capture from a logic analyzer:

MOSI 01 SPI Reset (§4.1.1)
MISO xx

MOSI 03 03 SPI Poll
MISO xx 06 Poll flags

MOSI 00 55 SPI Send 55=Echo command (see §5.13)
MISO xx xx 

MOSI 02 xx xx xx SPI Read
MISO xx 55 00 00     Echo response

MOSI 00 01 00 SPI Send 01=IDN Command (see §5.3)
MISO xx xx xx

MOSI 02 xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx SPI Read
MISO xx 0E 00 0F 4E 46 43 20 46 53 32 4A 41 53 54 34 00 2A CE  IDN response

Can you share more information about your statement "However SPI commands that sample code actually sends are different."?

Rgds

BT

[Nkama]

Hi, Brian.
Thank you for your reply.

For example, The sample code sends IDN commands as startup sequence.

IDN first command 
MOSI：00 01 03 03 00 55
IDN second command 
MOSI：00 01 00

The second command is descripted in datasheet as example.

But, the first command isn't descripted in data sheet.

What does this command mean?

I want to know the meaning of all MOSI data command.

Here is a capture from platformLog() debug.

MOSI to get tag data of ISO15693
0x00, 0x01, 0x03, 0x03, 0x00, 0x55
0x00, 0x01, 0x00
0x00, 0x07, 0x0E, 0x03, 0xA1, 0x00, 0xB8, 0x01, 0x18, 0x00, 0x00, 0x60, 0x60, 0x00, 0x00, 0x3F, 0x01
0x00, 0x07, 0x0E, 0x03, 0xA1, 0x00, 0xB8, 0x01, 0x18, 0x00, 0x00, 0x60, 0x60, 0x00, 0xFC, 0x3F, 0x01
0x00, 0x07, 0x0E, 0x03, 0xA1, 0x00, 0xB8, 0x01, 0x18, 0x00, 0x00, 0x60, 0x60, 0x00, 0x7C, 0x3F, 0x01
0x00, 0x07, 0x0E, 0x03, 0xA1, 0x00, 0xB8, 0x01, 0x18, 0x00, 0x00, 0x60, 0x60, 0x00, 0xBC, 0x3F, 0x01
0x00, 0x07, 0x0E, 0x03, 0xA1, 0x00, 0xB8, 0x01, 0x18, 0x00, 0x00, 0x60, 0x60, 0x00, 0x9C, 0x3F, 0x01
0x00, 0x07, 0x0E, 0x03, 0xA1, 0x00, 0xB8, 0x01, 0x18, 0x00, 0x00, 0x60, 0x60, 0x00, 0x8C, 0x3F, 0x01
0x00, 0x07, 0x0E, 0x03, 0xA1, 0x00, 0xB8, 0x01, 0x18, 0x00, 0x00, 0x60, 0x60, 0x00, 0x84, 0x3F, 0x01
0x00, 0x07, 0x0E, 0x03, 0xA1, 0x00, 0xB8, 0x01, 0x18, 0x00, 0x00, 0x60, 0x60, 0x00, 0x80, 0x3F, 0x01
0x00, 0x02, 0x02, 0x01, 0x0D
0x00, 0x09, 0x04, 0x68, 0x01, 0x01, 0x53
0x00, 0x04, 0x03, 0x26, 0x01, 0x00
0x00, 0x04, 0x03, 0x06, 0x01, 0x00
0x00, 0x04, 0x00

 So I want to get the more detailed datasheet.

Thanks.

[Brian TIDAL · Accepted solution]

Hi,

your "IDN first command" is not an IDN command. This is various frames sent after the startup sequence:

01="Reset" followed by 03 03="SPI poll" followed by 00 55="SPI send command Echo" and there is an unexpected 00 being printed in front of this line (please check your log and make sure to follow the SPI CS signal to split the MOSI data into frames).

For your reference, I've downloaded the binary provided inside the X-CUBE-NFC3 package on my board and here is the commented output from the logic analyzer:

Feel free to connect a logic analyzer on the SPI (CLK/MOSI/MISO/CS)+IRQ_OUT+IRQ_IN and to send me your trace. Also, make sure your logging is correct (the very first 00 is either a logging issue or an expected character being sent due to one of your changes in the original code). 

Note: The ST25R95 datasheet contains the description of all the commands being used in the X-CUBE-NFC3 firmware. 

Rgds

BT

[Nkama]

Hi , Brian.

I checked it.

I misread the reset command and Echo command.
I understand the startup sequnce.
And it is same your capture.
Thank you.

But what I don't understand the most is SendRecv command.
In case that only one tag is detected, I can get the tag data by following command.

00 04 03 26 01 00

 If two tag are detected(collision detected), the sample code sends additionally two commnads.

00 04 03 06 01 00
00 04 00

What means these command respectively?

Thanks.

[Brian TIDAL]

Hi,

All those commands are SendReceived commands (0x04). The payloads inside those commands (e.g. 26 01 00 or 06 01 00) are the data sent to tag as part of the ISO15693 protocol. 

• 26 01 00:
  • 26=request flags: Inventory_flag & Data_rate_flag=high datarate & Nb_slots_flag=1 slot
  • 01=Inventory command
  • 00= mask length
• 06 01 00:
  • 06=request flags: Inventory_flag & Data_rate_flag=high datarate & !Nb_slots_flag=16 slots
  • 01=Inventory command
  • 00= mask length

See ISO/IEC 15693-3 for further details about those ISO15693 requests and responses

The third command (00 04 00) is an empty SendReceived used to trigger the sending of an EOF in case of 16 slots inventory. See ISO/IEC 15693-3 for details on anticollision with 16 slots.

Rgds

BT

[Nkama]

Hi, Brian.

I checked ISO/IEC 15693-3.
I understand the protocol.
Thank you for your information.

Can I one more question at last?
About Idle command.
The sample code sends this command 8 times.

00 07 0E 03 A1 00 B8 01 18 00 00 60 60 00 00 3F 01
00 07 0E 03 A1 00 B8 01 18 00 00 60 60 00 FC 3F 01
00 07 0E 03 A1 00 B8 01 18 00 00 60 60 00 7C 3F 01
00 07 0E 03 A1 00 B8 01 18 00 00 60 60 00 BC 3F 01
00 07 0E 03 A1 00 B8 01 18 00 00 60 60 00 9C 3F 01
00 07 0E 03 A1 00 B8 01 18 00 00 60 60 00 8C 3F 01
00 07 0E 03 A1 00 B8 01 18 00 00 60 60 00 84 3F 01
00 07 0E 03 A1 00 B8 01 18 00 00 60 60 00 80 3F 01

I understand that this command is initial calibration sequence.

But why 8 times?
Does it have any goal?

Thanks.

[Brian TIDAL]

Hi,

See the comment inside the st25r95CalibrateTagDetector() function:

/* 8 steps dichotomy implementation as per AN3433 */

The calibration process is explained in Application note AN3433. An example of the 8 steps dichotomy is given in Annex C. The st25r95CalibrateTagDetector() function implements this 8 steps calibration process.

Rgds

BT

[Nkama]

Hi Brian.

Thank you to resolve my all problem.