NfcrdlibEx8_HCE_T4T example

nddona · ‎05-27-2026

We have a custom Linux platform where we have successfully made the PN5190 to work as a card reader for years.

Now we want to try out to make it work as a type 4A tag as in example "NfcrdlibEx8_HCE_T4T". We have tried to use the example with the reader library version 7.14.00 but we're getting the same results as reported in the thread: https://community.nxp.com/t5/NFC/HCE-T4T-Example-not-working-with-NXP-NFC-Library-v07-08-00-in/td-p/...

When Android (Samsung S23 ultra) is tapped with NXP "TagInfo" App, it's getting an invalid RATS. Rx buffer receives data starting with 0x11 0xD4 ... etc.

[phacDiscLoop_Sw_Run] Starting Listen Mode
[T4TCardEmulation] Card Activated in Listen mode...
[phpalI14443p4mC_Sw_Activate] RATS: 11 D4 00 8C 26 82 9B FA 12 01 DF 84 5B 00 00 00 30
[phpalI14443p4mC_Sw_Activate] Invalid RATS received...

Is it because the phone is trying to talk in NFC-DEP (P2P Mode / SNEP)?

Appreciate any help to resolve this issue.

Thanks!

nddona · ‎06-15-2026

Hi,

I have further question related to this topic.

Even though I got our device to work as a type 4 card emulator with "NfcrdlibEx8_HCE_T4T" example, it seems very slow. The application steps are as below.

1. Device runs in the reader (polling) mode

2. A phone is tapped and it reads a card in mobile wallet

3. Immediately turns off RF after reading finishes

4. Re-initialize the RF chip in HCE type 4 card emulator mode (passive listener mode)

5. Sends a URL (NDEF) to the smart phone

The issue is it takes about 1500ms to re-init the RF chip in card emulator mode and send the URL to smartphone.

Is there a faster way to do this, so that user doesn't have to keep the phone holding/tapping ?

When I searched on Google it says that it can be done via type 2 tag as below. But it didn't work. Nothing was received by the phone.

│
▼
Step 1: Terminate Field
│ (~1ms)
▼
Step 2: Load NDEF Data
│ (~3ms)
▼

Step 3: Go Autocoll

Appreciate if you can guide me on how exactly I can achieve this fast mode switching and a URL is sent to a phone within 500ms.

Thanks!

nddona · ‎06-16-2026

In related to my question above, the code I tried to implement after terminating the field as given below. I can get phhalHw_Autocoll() to return success but I get 0x020A for phhalHw_Pn5190_Instr_ExchangeRFData().

phhalHw_Pn5190_Autocoll() is also updated with the below.

phhalHw_Pn5190_Instr_SwitchModeAutocoll(pDataParams,bRfTechnology,PHHAL_HW_PN5190_AUTOCOLL_MODE_AUTONOMOUS_WITH_STANDBY))

int card_emulator_main_cutdown(void)

{

do

{

int ret;

phStatus_t status;

pHal_Hce = phNfcLib_GetDataParams(PH_COMP_HAL);

TRACE0("NfcLib data params pointers set successfully");

/* ================================================================= */

/* STEP 3: STAGE EMULATION PROFILE AND LOAD URL PAYLOAD */

/* ================================================================= */

TRACE0("Configuring hardware target layers and loading URL buffer...");

/* Configure target mode HAL parameters */

status = phAppHce_HALConfigAutoColl();

CHECK_STATUS(status);

if (status != PH_ERR_SUCCESS) {

TRACE1("phhalHw_TargetInit failed: 0x%04X", status);

return status;

}

/* ================================================================= */

/* STEP 4: ENGAGE AUTOCOLL (Autonomous Listening State) */

/* ================================================================= */

TRACE0("Entering sub-100ms Autonomous Listen mode...");

// CRITICAL FIX: Allocate valid storage memory to prevent PH_ASSERT_NULL crashes

uint8_t * pRxBufferPtr = NULL;

uint16_t wRxLengthData = 0;

uint16_t wProtocolParams = 0;

// Execute the function mapping strictly to your HAL's parameter footprint.

// We pass 'A_MODE' to tell the switch code to select Passive NFC-A Technology.

status = phhalHw_Autocoll(

pHal_Hce,

A_MODE, // Bitmask flag forcing NFC-A technology profiling

&pRxBufferPtr, // Passed as a valid pointer reference to a pointer

&wRxLengthData, // Passed as a valid pointer reference to length

&wProtocolParams // Passed as a valid pointer reference to parameters

);

if ((status & PH_ERR_MASK) == PH_ERR_SUCCESS) {

TRACE0(" Tap-to-URL switch executed perfectly! Phone hit the antenna field.");

TRACE1("De-wrapped Activation Protocol Parameters: 0x%04X", wProtocolParams);

/* ================================================================= */

/* STEP 5: PROCESS INCOMING APDU COMMANDS FROM THE PHONE */

/* ================================================================= */

TRACE0("Listening for phone file system read commands...");

// Allocate data exchange buffers

uint8_t * pDataIn = NULL;

uint16_t wDataInLen = 0;

// Retrieve the initial data packet the phone transmitted right upon activation

// Your Autocoll snippet already stores the address in pRxBufferPtr / wRxLengthData

pDataIn = pRxBufferPtr;

wDataInLen = wRxLengthData;

// Enter a rapid loop to process the phone's Read commands

// The phone will send "Select NDEF Application" -> "Select NDEF File" -> "Read Binary"

//while (1)

{

//Use the correct Target Emulation transmit function to bypass the 0x0225 check

//PH_RECEIVE_RF_ENABLE_EVT_STATUS enables event tracking for the transfer

status = phhalHw_Pn5190_Instr_ExchangeRFData(

pHal_Hce,

PH_EXCHANGE_DEFAULT, // wOption

0, // bTxLastBits (0 indicates complete 8-bit byte layout)

0x05, // bRespControl: Bitmask 0x04 (Event Status) | 0x01 (Rx Status)

aNdefFile, // Your URL array structure

23, // Size of your URL data payload

&pRxBufferPtr, // Address of your response data pointer

&wRxLengthData // Address of your incoming length tracker

);

if (status == PH_ERR_SUCCESS) {

TRACE0(" Single-shot URL packet injected successfully. Task complete!");

} else {

TRACE1("Injection status / timeout: 0x%04X (Phone likely disconnected cleanly)", status);

}

} else {

TRACE1("Autocoll exited, timed out, or dropped with status: 0x%04X", status);

}

} while(0);

return 0;

}

// /* Mandatory NDEF file. It's set using phceT4T_SetElementaryFile. */

uint8_t aNdefFile[] = {

/* --- MANDATORY CONTACTLESS TRANSPORT HEADER --- */

//0x02, // 1. PCB Byte: Configures this frame as a Part 4 I-Block (Block Number 0)

0x00, 0x13, // 1. T4T Container Length Indicator (19 bytes total payload)

0xD1, // 2. NDEF Record Header (MB=1, ME=1, SR=1, TNF=0x01 Well-Known Type)

0x01, // 3. Type Length (1 byte long name)

0x0F, // 4. Payload Length (15 bytes for prefix + string)

0x55, // 5. Record Type: 'U' (0x55 for URI record)

0x02, // 6. URI Identifier Prefix: Code 0x02 maps to "https://www."

// 7. URI Payload String of 14bytes

0xww, 0xww, 0xww, 0xww, 0xww, 0xww, 0xww, 0xww, 0xww, 0xww, 0xww, 0xww, 0xww, 0xww,

/* --- MANDATORY SMART CARD STATUS TRAILER --- */

0x90, 0x00 // 21-22. APDU Success Status (tells Android the data read is complete)

};

Log output:

06-16 17:34:31.600 26047 27687 E nfc : [card_emulator_main_cutdown] NfcLib data params pointers set successfully

06-16 17:34:31.600 26047 27687 E nfc : [card_emulator_main_cutdown] Configuring hardware target layers and loading URL buffer...

06-16 17:34:31.605 26047 27687 E nfc : [card_emulator_main_cutdown] Entering sub-100ms Autonomous Listen mode...

06-16 17:34:31.607 26047 27999 V nfc : [socket_send_thread] Entered socketSend

06-16 17:34:31.607 26047 27999 V nfc :

06-16 17:34:32.456 26047 27687 E nfc : [card_emulator_main_cutdown] Tap-to-URL switch executed perfectly! Phone hit the antenna field.

06-16 17:34:32.456 26047 27687 W nfc : [card_emulator_main_cutdown] De-wrapped Activation Protocol Parameters: 0x0100

06-16 17:34:32.456 26047 27687 E nfc : [card_emulator_main_cutdown] Listening for phone file system read commands...

06-16 17:34:32.456 26047 27687 W nfc : [card_emulator_main_cutdown] Injection status / timeout: 0x020A (Phone likely disconnected cleanly)

nddona · ‎05-29-2026

This issue is solved by disabling some macros and updating the SAK to correct value 0x20.

Fabian_R · ‎06-01-2026

Hello sir,

Thank you for letting me know. I will address this for the respective clarifications and updates.

Have a great day!

Best Regards,
Fabian