How to Enable the Mailbox and Perform Write/Read on ST25DV via RF (ISO15693)

[taufiquesiddiqui]

Hello ST Team,

I am working on enabling the mailbox feature on an ST25DV tag and performing RF mailbox Write and Read operations using a custom Android NFC application (ISO15693 commands). I need clarification on the correct sequence to fully enable the mailbox, and how to verify that the mailbox is enabled properly.

What I Have Done So Far

• I am using ISO15693 custom commands through an Android phone (NFC).

• I can successfully send the Write Message (0xAA) command over RF.
  The tag responds with a valid Flags byte (0x01), and after writing, the HOST_PUT_MSG indication appears, which confirms that the RF write is accepted.

However, when checking the MB_CTRL_Dyn value through the ST25DV app, it still shows 0x00, meaning the mailbox is not actually enabled.

So, it appears that RF Write works even when the mailbox is not fully enabled, which caused confusion.

Additional Details:

My Understanding / Confusion

I initially assumed that successful RF Write + HOST_PUT_MSG flag meant the mailbox was enabled. Later, I realized that I was reading only the ISO15693 Flags byte, not the actual MB_CTRL_Dyn register byte.

From the documentation, it seems that enabling the mailbox properly requires:

1. Presenting the correct password (if static area is protected)

2. Setting the MB_MODE bit in the Static FTM register (0x0D)

3. Then setting the MB_EN bit in the MB_CTRL_Dyn (0x0D)

Only after both steps should mailbox become active and MB_CTRL_Dyn should return 0x01 or 0x03.

The Help I Need

I would like clarification on the following:

1. What is the exact correct sequence (with command values) to:

   • Present password

   • Enable MB_MODE in Static FTM register

   • Enable MB_EN in the MB_CTRL_Dyn register

2. Should the mailbox reject RF Write (0xAA) when MB_EN is not set?
   Because currently, I am able to write a message even when MB_EN = 0.

3. After enabling mailbox correctly, what exact values should I expect when reading:

   • MB_CTRL_Dyn

   • MB_LEN_Dyn

4. Is there an official example or recommended flow for RF-only mailbox usage, especially for Android NFC implementations (without I²C host initially)?

Goal

My goal is to fully enable the mailbox via RF, write data to mailbox, and read back from mailbox correctly — and to properly verify enable status through the correct registers, not just the status flags.

Any guidance, clarification, or step-by-step command references would be highly appreciated. If possible, an example command sequence would help ensure my Android implementation matches the proper ST25DV expected behavior.

Thank you,
Siddiqui