How to Enable the Mailbox and Perform Write/Read on ST25DV via RF (ISO15693)

[taufiquesiddiqui]

Hello ST Team,

I’m enabling the mailbox on an ST25DV tag and performing RF mailbox Write/Read using ISO15693 custom commands. I’d like to confirm the correct enable sequence and how to verify that the mailbox is truly enabled.

What I observe

I can send Write Message (0xAA) over RF and see HOST_PUT_MSG afterward.

But reading MB_CTRL_Dyn shows 0x00, which suggests the mailbox isn’t enabled.

My understanding
From the docs, proper enable requires:

Presenting the system password (if protection is active),

Setting MB_MODE in the static FTM configuration,

Setting MB_EN in MB_CTRL_Dyn (dynamic register).
Only then should MB_CTRL_Dyn report enabled (e.g., MB_EN=1) and lengths appear in MB_LEN_Dyn.

Questions

What is the exact recommended RF sequence (request frames) to:

Present password,

Set MB_MODE (static FTM),

Set MB_EN (dynamic control)?

Should Write Message (0xAA) be accepted when MB_EN=0?

After a correct enable, what values should I expect when reading MB_CTRL_Dyn and MB_LEN_Dyn?

Is there an official example/flow for RF-only mailbox usage?

Goal: enable mailbox via RF, write a message, read it back, and verify enable status using registers (not just flags).

[taufiquesiddiqui]

Merged from separate thread - as it's the same topic, please keep the discussion in the same thread.

[JL. Lebon · Accepted solution]

Hello, 

The sequence you are using to enable the mailbox seems correct:

1. set MB_MODE=1. This will authorize the usage of the mailbox. This can be done from the RF interface or from the I2C interface. From the RF interface, the RF_PWD_00 must be presented first, and the Write Configuration command should be used to write @0x0D. From I2C interface, the I2C password should be presented, and a write should be done at @0x0D. This has to be done once only since this is a static register that is persistent after reboot.

2. enable the mailbox by setting MB_EN=1 in the MB_CTRL_Dyn register. This can also be done by I2C or RF. From RF, the Write Dynamic Configuration command is used to do this. No password required. The VCC must be present, otherwise no write is made into the register (actually, if VCC disappears, the MB_EN bit is reset to 0).

3. Once MB_EN=1, it is possible to write into the mailbox. The RF command to write into the mailbox is Write Message (0xAA). If the command is successful, the response contains only the response flag with value 0x00. If there is an error, the response contains the response flag with value 0x01 and an error code.

Once the message has been written, you can read the MB_CTRL_Dyn register. The RF_PUT_MSG, RF_CURRENT_MSG and MB_EN bit should be set (value 0x85). The MB_LEN_dyn should contain the length of the message minus 1.

If this does not work, you can check if the VCC is present with more than 1.8V.
You can also check if the mailbox watchdog is not enabled: the MB_WDG field should be equal to 0.

Best regards.