NFC Tap App FW upgrade demo not working

JRios.1 · ‎2020-06-07

Hi,

Fast Transfer Mode data transaction and image transactions are working ok, but firmware upgrade and some other functionalities (like stopwatch transfer) are not working in Android NFC Tap Application...

I'm using:

ST25DV-Discovery kit with FW v1.1.2
Android NFC Tap Application v3.2.0 (ST25SDK v1.6.0).

Debugging into NFC Tap App, I note that the problem is that ST25DV tag didn't response to addressed mode FTM Write Command (RF Protocol request message flag set to addressable transaction, and tag UID used in message transaction. Request flags - 0x22; address flag set to '1'). Also, no GPO event is fired, the Tag is not placing the data into the Mailbox:

...
 
this = DecorView@c70cd2c[ST25DVFirmwareUpdateDemoActivity]
D/Iso15693CustomCommand: ==> Send readDynConfig command: 22 ad 02 06 0c 1a 05 00 25 02 e0 0d
D/Iso15693CustomCommand: Response: 00 01
D/Iso15693CustomCommand: ==> Send writeMsg command: 22 aa 02 06 0c 1a 05 00 25 02 e0 08 08 01 00 00 04 12 34 56 78
D/Iso15693CustomCommand: ==> Send readDynConfig command: 22 ad 02 06 0c 1a 05 00 25 02 e0 0d
D/Iso15693CustomCommand: Response: 00 01
 
...
 
D/Iso15693CustomCommand: ==> Send writeMsg command: 22 aa 02 06 0c 1a 05 00 25 02 e0 08 08 01 00 00 04 12 34 56 78
D/Iso15693CustomCommand: ==> Send readDynConfig command: 22 ad 02 06 0c 1a 05 00 25 02 e0 0d
D/Iso15693CustomCommand: Response: 00 01
 D/Iso15693CustomCommand: ==> Send writeMsg command: 22 aa 02 06 0c 1a 05 00 25 02 e0 08 08 01 00 00 04 12 34 56 78
D/Iso15693CustomCommand: ==> Send readDynConfig command: 22 ad 02 06 0c 1a 05 00 25 02 e0 0d
D/Iso15693CustomCommand: Response: 00 01
 
...

At Android App code function "int sendSimpleData(byte command)", if I replace the write to MB function:

response = mST25DVTag.writeMailboxMessage(size + SIMPLE_HEADER_SIZE, frame);

To force stop using adressed request, 0x02 (address flag set to '0'):

response = mST25DVTag.writeMailboxMessage(size + SIMPLE_HEADER_SIZE, frame, Iso15693Command.HIGH_DATA_RATE_MODE);

I can get FW upgrade and stopwatch functionalities working properly:

...
 
D/View: [Warning] assignParent to null: this = DecorView@11b3f91[ST25DVFirmwareUpdateDemoActivity]
D/Iso15693CustomCommand: Response: 00 01
D/Iso15693CustomCommand: ==> Send writeMsg command: 02 aa 02 08 08 01 00 00 04 12 34 56 78
D/Iso15693CustomCommand: Response: 00
D/Iso15693CustomCommand: ==> Send readDynConfig command: 22 ad 02 06 0c 1a 05 00 25 02 e0 0d
D/Iso15693CustomCommand: Response: 00 43
D/Iso15693CustomCommand: ==> Send readMsgLength command: 22 ab 02 06 0c 1a 05 00 25 02 e0
D/Iso15693CustomCommand: Response: 00 04
D/Iso15693CustomCommand: ==> Send readMsg command: 22 ac 02 06 0c 1a 05 00 25 02 e0 00 04
D/Iso15693CustomCommand: Response: 00 08 01 00 00 00
D/ViewRootImpl[Toast]: hardware acceleration = true , fakeHwAccelerated = false, sRendererDisabled = false, forceHwAccelerated = false, sSystemRendererDisabled = false
D/Surface: Surface::allocateBuffers(this=0x7531ee5000)
D/Surface: Surface::connect(this=0x7531ee5000,api=1)
D/Iso15693CustomCommand: ==> Send readDynConfig command: 22 ad 02 06 0c 1a 05 00 25 02 e0 0d
D/Iso15693CustomCommand: Response: 00 41
D/Iso15693CustomCommand: ==> Send writeMsg command: 02 aa 02 f8 04 00 00 01 00 01 cc c4 01 f4 00 01 ec 58 2f 01 20 9d 01 0a 08 e1 4c 0a 08 a9 34 0a 08 25 41 0a 08 ed 13 0a 08 89 62 0a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 60 0a 08 81 14 0a 08 00 00 00 00 03 4d 0a 08 79 61 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 b7 01 0a 08 21 17 0a 08 b7 01 0a 08 b7 01 0a 08
D/Iso15693CustomCommand: Response: 00
 
...
 
D/Iso15693CustomCommand: ==> Send writeMsg command: 02 aa 02 f8 04 00 00 01 00 01 cc c4 01 f4 00 0a ec 3a 46 ff f7 bf fe 32 46 bd e8 f0 41 00 f0 5c b8 00 00 f0 3f c1 f3 0a 52 c1 f3 13 01 40 f2 ff 33 41 f4 80 11 9a 42 02 da 00 20 01 46 70 47 40 f2 33 43 9a 42 a2 f2 33 42 02 dc 52 42 ff f7 5b be 00 f0 42 b8 30 b5 04 1e 71 f1 00 04 04 db 4f f0 00 44 40 42 64 eb 01 01 14 1e 73 f1 00 04 05 db 1c 46 4f f0 00 43 52 42 63 eb 04 03 8b 42 08 bf 82 42 30 bd 30 b5 04 1e 71 f1 00 04 04 db 4f f0 00 44 40 42 64 eb 01 01 14 1e 73 f1 00 04 05 db 1c 46 4f f0 00 43 52 42 63 eb 04 03 99 42 08 bf 90 42 30 bd 06 4c 07 4d 06 e0 e0 68 40 f0 01 03 94 e8 07 00 98 47 10 34 ac 42 f6 d3 ff f7 42 fc 8c ca 0b 08 ac ca 0b 08 20 2a 04 db 20 3a 00 fa 02 f1 00 20 70 47 91 40 c2 f1 20 03 20 fa 03 f3 19 43 90 40 70 47 20 2a 06 db cb 17
D/Iso15693CustomCommand: Response: 00
D/Iso15693CustomCommand: ==> Send writeMsg command: 02 aa 02 f8 04 00 00 01 00 01 cc c4 01 f4 00 0b ec 20 3a 41 fa 02 f0 43 ea e0 73 06 e0 41 fa 02 f3 d0 40 c2 f1 20 02 91 40 08 43 19 46 70 47 70 b5 8c 18 10 f8 01 5b 15 f0 07 03 01 d1 10 f8 01 3b 2a 11 06 d1 10 f8 01 2b 03 e0 10 f8 01 6b 01 f8 01 6b 5b 1e f9 d1 2b 07 05 d4 00 23 52 1e 0d d4 01 f8 01 3b fa e7 10 f8 01 3b cb 1a 92 1c 03 e0 13 f8 01 5b 01 f8 01 5b 52 1e f9 d5 a1 42 d8 d3 00 20 70 bd 4a 49 10 b5 d1 f8 04 23 22 f4 40 32 c1 f8 04 23 d1 f8 04 23 43 68 1a 43 c1 f8 04 23 01 68 4a 68 22 f4 80 72 4a 60 01 68 4a 68 03 69 42 ea 03 22 4a 60 01 68 4a 68 22 f0 40 72 4a 60 01 68 4a 68 83 68 1a 43 4a 60 01 68 8a 68 22 f4 00 62 8a 60 01 68 8a 68 c3 68 1a 43 8a 60 81 6a 6f f0 70 62 d1 42 01 68 8a 68 22 f0 70 62 8a 60 01 68 8a 68 0c d0 83 6a 1a 43 8a 60
D/Iso15693CustomCommand: Response: 00
 
...

Summarizing:

Send writeMsg command not working:
[22 aa 02 06 0c 1a 05 00 25 02 e0 08 08 01 00 00 04 12 34 56 78]
	RequestFlags: 22 (address_flag is set to 1 and data rate flag set to 1)
	CMD: aa (writeMsg)
	IC_MFG_CODE: 02
	UID: 06 0c 1a 05 00 25 02 e0 (address_flag is set to 1)
	MSG_LEN: 08
	MSG_DATA: 08 01 00 00 04 12 34 56 78
No Response from Tag!
 
Send writeMsg command working:
[02 aa 02 08 08 01 00 00 04 12 34 56 78]
	RequestFlags: 02 (address_flag is set to 0 and data rate flag set to 1)
	CMD: aa (writeMsg)
	IC_MFG_CODE: 02
	UID: None (address_flag is 0)
	MSG_LEN: 08
	MSG_DATA: 08 01 00 00 04 12 34 56 78
Response from Tag: 00

What can be the reason that ST25DV is not responding to addressed commands?

As documentation said, the tag didn't response if the message didn't contains the correct tag UID:

Maybe UID byte order (LSB/MSB) in Write Message is inverted and tag expects the other order?

Could it be a reader (smartphone) incompatibility in ISO-15963 for address mode transactions (I use the same reader device all the time)?

Sounds strange to me that no body report this problem before, maybe I miss something...

Regards.

France Berthelot · ‎2020-06-09

Hello

We apologize, I think the root cause is in the file ST25DVTransferTask.java with following changes to do:

//HEADER SIZE + 8 bytes UID + 3 bytes (CMD + FLAG + ST code) + 1 byte size to write in mb

// For optimization reasons we remove the 8 UID bytes in write...

mMaxPayloadSizeTx = tag.getReaderInterface().getMaxTransmitLengthInBytes() -

CHAINED_HEADER_SIZE - 3 - 1 -8;

Please add UID Length (8), issue will probably be solved, we supposed we are not in a @mode.

Can you please confirm on your side that this solved your issue.

BR

View solution in original post

France Berthelot · ‎2020-06-09

Hello

I will do some tests according to your issue with Android application and some updates/changes in order to reproduce.

Already did some tests with an external reader, not a phone, and found no issues……and have no tag answer only in the case of wrong UID set with or without @mode

If Tag do not answer, it is probably due to wrong UID…Your UID seems to be in the right order.

Concerning phone incompatibility, custom command in @mode on iOS is not working…..May be a track….! Which smartphone do you use ?

I will complete the answer as soon as tests done on Android side have been done.

BR

JRios.1 · ‎2020-06-09

I'm using an Ulefone Power 6 (firmware version Power_6_SF1_EEA_V02_20191013-1028 and BSP K65v1_64_bsp) with Android version 9.

About the tag, it is a ST25DV04K-JF with IC revision 0x12:

ST25DV IC Reference: 0x24

ST25DV IC Revision: 0x12

ST25DV Tag size: 512 bytes

ST25DV Tag UID MSB: 0xE0022500

ST25DV Tag UID LSB: 0x051A0C06

France Berthelot · ‎2020-06-09

Hello

We apologize, I think the root cause is in the file ST25DVTransferTask.java with following changes to do:

//HEADER SIZE + 8 bytes UID + 3 bytes (CMD + FLAG + ST code) + 1 byte size to write in mb

// For optimization reasons we remove the 8 UID bytes in write...

mMaxPayloadSizeTx = tag.getReaderInterface().getMaxTransmitLengthInBytes() -

CHAINED_HEADER_SIZE - 3 - 1 -8;

Please add UID Length (8), issue will probably be solved, we supposed we are not in a @mode.

Can you please confirm on your side that this solved your issue.

BR

JRios.1 · ‎2020-06-09

Hi,

Changed, but get same behavior, no response.

Regards.

France Berthelot · ‎2020-06-10

Hello

I have done some tests on my side with HUAWEI phone and works fine.

Do you have the same behavior with an other phone, Did you check with an other smartphone?

An other point, when host side is accessing the Mailbox, , the tag cannot read the UID present in memory so it cannot check if the command is for it or not. Perhaps this can explain "the no answer". For the moment, when using the Mailbox, it is wise to use non addressed commands

Do not have more information to provide for the moment .

BR

JRios.1 · ‎2020-06-10

About host mcu accessing to Mailbox. It happens using ST25DV-Discovery kit motherboard demo firmware, the host is just waiting for a GPO event when no reponse occurs, and host just check for mailbox data whet the GPO event fire.

At this moment, I can just modify App to don't use addressed commands and all goes fine.

I don't have another phone with NFC support at this moment, so I can't test it right now. When I have access to another reader device (or phone) I'll come back with the results.

Kind regards.

JRios.1 · ‎2020-06-21

Hi,

Tested with other reader (Samsung Galaxy A40) and it works OK.

So I can verify that the issue is related to some Ulefone Power 6 NFC incompatibility when using addressed commands.

Issue solved, thanks.