CRC error from PN532 NFC board when sending GetInitiatorCommand (0x88) instruction

[david_ferguson]

I am using an Adafruit PN532 breakout board to emulate an NTAG213 ISO/IEC 14443-2 tag. I have configured the board for emulation with TgInitAsTarget as follows:

[ 0x8C, 0x01, 0x44, 0x00, 0x7B, 0x58, 0x80, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00 ];

in response to which I get a ReadSig request for the originality signature:

[ 0x8D, 0x00, 0x3C ]

which confirms communication with the initiator is working. I successfully handle the request by returning the originality signature shown in part and obscured here for obvious reasons:

[ 0x90, 0x??, 0x??, 0x??, ... ]

to which I get a positive response:

[ 0x91, 0x00 ]

I then repeatedly send an explicit GetInitiatorCommand instruction at 100ms intervals (I have tried up to 250ms with no luck) in order to retrieve the next command from the initiator:

[ 0x88 ]

to each of which the PN532 responds with a CRC error:

[ 0x89, 0x02 ]

I am using the same algorithm to calculate the checksum on all these commands when I send them so I don't think my CRC is actually wrong, but to be explicit the full data frame sent to the PN532 is:

[ 0x00, 0x00, 0xFF, 0x02, 0xFE, 0xD4, 0x88, 0xA4, 0x00 ]

When I run the calculations manually this appears to have the correct CRC's for both length and data.

Incidentally if I use a completely different device as the initiator it behaves similarly - though responding initially with a Read command (0x30) - which suggests the problem is on my end.

Does the CRC error maybe apply to something else, the packets going between PN532 and the initiator perhaps? Am I submitting instructions in the wrong order? I admit I don't fully understand the implications of all the options in the TgInitAsTarget data set which I copied from another known good app, maybe I have set up my PN532 emulator incorrectly? Clearly I'm doing something wrong.

Any tips as to what I'm doing wrong or how to diagnose the root cause?

[david_ferguson]

While the original question stands Jeremy's post with actual data helped confirm the basic configuration was correct.  Ultimately we have encountered a limitation with the PN532 which makes it unusable in our situation and we will be pursuing the PN7150 platform instead so I'm going to mark Jeremy's answer as the solution and close this inquiry.

[jeremygeslin · Accepted solution]

Hi,

Please find attached an example application (VS2012 project) demonstarting PN532 in card emulation mode.

Running it with PN532 UART Demoboard and tapping an NFC reader should lead to the following scenario (no CRC error returned):

PN532 connected on COM4
TAMA >[ 00 00 FF 0F F1 55 55 00 00 00 00 00 FF 03 FD D4 14 01 17 00 57 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 15 16 ]
TAMA >[ 00 00 FF 02 FE D4 02 2A 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 03 32 01 06 07 E8 ]
PN532 FW version = 106
TAMA >[ 00 00 FF 03 FD D4 12 20 FA 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 13 18 ]
TAMA >[ 00 00 FF 27 D9 D4 8C 01 44 00 7B 58 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 8D 00 30 00 6E ]
PN532 received: 0x30 0x00
PN532 connected as tag
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 30 00 72 ]
PN532 received: 0x30 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 00 50 00 52 ]
PN532 received: 0x50 0x00
PN532 sends: 0x01 0x02 0x03 0x04
TAMA >[ 00 00 FF 06 FA D4 90 01 02 03 04 92 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 91 00 9A ]
TAMA >[ 00 00 FF 02 FE D4 88 A4 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 89 0B 97 ]
PN532 disconnected

Please check it in your side, and if CRC error stiil occurs on 0x88 command, try with another board (any chance you could get access to PN32 demoboard ?).

Regards,

Jeremy.

[david_ferguson]

Oh, and I have tried a second board with the same result.  I don't have access to a PN52 demoboard, is that something I can find online?

[estephania_mart]

Hello,

I was not able to locate the example, I'll look for it.

Regards

[david_ferguson]

Thank you Jeremy!  That gets me a little closer.  Using the same data as in your example I have got an Android device to send multiple READ_DATA (0x30) commands, but only intermittently.  Sometimes I get the same CRC error that prompted this post.  So it looks like a timing issue of some sort.  My code is responding as fast as possible so I don't think it's a time out - though it is running in a debugger.  I'll explore this theory.  In the mean time, what is the 0x50 command at the end of your log?  I'm getting the same thing after several 0x30's but I find no command with the value 0x50 in the NTAG213 spec so I don't know how I am supposed to respond to it.

[estephania_mart]

Hello,

Please consider that this part is not recommended for new designs, if you are creating a new design, we recommend PN7120 or PN7150.

Have you checked and compare the available examples in the web page for that device ? as well as the AN133910?

Regards,
Estephania

[david_ferguson]

I will look into the PN7150, thank you for that information.

I have scoured the web for examples of tag emulation (including the link provided in your reply) but thus far have found nothing addressing this specific scenario.

I have read AN1433910 and other related docs which explain the process of emulating a tag, but provide nothing about troubleshooting errors that may occur.  I am following the configuration guidance they provide as well as I can but clearly am missing something.  I am hoping someone can look at the details provided in my original post and suggest reasons the CRC error (0x02) may occur.

[estephania_mart]

Hello,

Just as a comments , please remember that to have a complete secure card functionality is only possible in combination with a secure IC using the NFC-WI/S2C interface.

Those command responses and definitions are cleared in the FeliCa or ISO/IEC 14443A/MIFARE card interface specifications, this can't be shared in a public way as those  need to be requested to the NFC Forum.

Regards,

Estephania

[david_ferguson]

We are not using a secure element in our scenario.  The tag is being used only to store local device data completely unrelated to online transactions and such requiring secure card functionality.  As outlined in the original post we are just trying to retrieve the next command from the initiator.  We should be able to do that regardless of the presence of a secure element, correct?