Read SRIX4K from PN532

[giamma_barbato]

Hello there.

I wanted to know how could I read a SRIX4K tag by using a PN532 reader.

I know SRIX4K is a ISO 14443 Type-B  (part 2 and 3) tag.

I'm trying to use InListPassiveTarget (D4 4A) but no device is detected.

When I try to send a raw command through InCommunicateThru (D4 42) the reader goes in timeout (even raising timeout timing there's not response).

I know I have to follow a sequenze of commands for the SRIX4K tag:

Initiate() -> Command [06 00] + CRC

Select() -> Command [0E {Chip Id}] + CRC

Get_UID() -> Command  [0B] + CRC

But no response detected.

What can I do in order to get at least the UID of my key?

Thanks

*Srix4K manual

http://www.advanide.com/wp-content/uploads/products/rfid/SRIX4K.pdf 

[giamma_barbato]

Hello Kan

Just tried this script on my tag, but it doesn't work.

I'm using the PN532 inside an ACR122U.

Is there any configuration for the ACR122U that probably won't let the PN532 work properly?

By the way, i tried this configuration with both my tag and a brand new tag certified SRIX4K but it does not work on both (getting Timeout error).

I really don't what to do, hope for an answer.

Good day!

Gian Marco

[Kan_Li]

Hi Gian Marco,

I am sorry, but ACR122U is not a NXP product, please check with the right vendor for further help.

http://www.nfc-reader.com/ 

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[giamma_barbato]

Hello Kan, and thank you for the answer.

Sure I know ACR122U is not a product by NXP, by the way it mounts a full PN532 r/w chip, and i'm able to send APDU's directly to the PN532 inside.

In fact i get answers by the reading and writing over the PN532 register.

Still, i'm not able to read this kind of tags.

InListPassiveTarget answer that there's no tag in the field, but I read it's a common thing.

But when i send data through the InCommunicateThru command, no answer.

I don't know if there's a register somewhere i need to set up in order to read SRIX4Ks...

Have a good day,

Gian Marco

[Kan_Li]

Hi Gian Marco,

Actually the scripts I provided works on our side, so the only reason I could think out is due to the driver or some configuration related with RF. You know it related with the software and hardware implementation so Please contact the vendor for further support.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[giamma_barbato]

Hello Kan, thanks for your answer.

You were right, it was a problem of my reader (a configuration of it).

Now I ended up reading my SRIX4K tag. Thank you very much again.

Have a good day

[Kan_Li]

I have script file for type B card based on PN532, please refer to the following for details.

//Wake up PN532/c106 from LowVBat to Standby mode
.rawdata;
55 55 00 00 00 00 00 00 ff 03 fd d4 14 01 17 00;
// .loop;
.command;
// reset chip
08 63 31 0F;    // Softreset
//> IC Configuration:
//> -----------------
08 63 3C 10;    // ControlReg
08 63 02 83;    // TxModeReg - CRC en, 106 kbps, TypeB
08 63 03 83;    // RxModeReg - CRC en, 106 kbps, TypeB
08 63 08 85;    // RxThresholdReg
08 63 09 4D;    // DemodReg
08 63 16 69;    // RFCfgReg
08 63 17 FF;    // GsNReg
08 63 18 3F;    // CWGsPReg
08 63 19 10;    // ModGsPReg
08 63 0E 00;    // TypeBReg

08 63 05 07;    // TxAutoReg

//> Start Transceive:
//> -----------------
08 63 31 0c;    // CommandReg - transceive

//> REQB/WUPB :
//> -----------
08 63 3a 80;    // flush FIFO
08 63 39 05;    // FIFO - Anticollision Prefix
08 63 39 00;    // FIFO - AFI code (all families)
08 63 39 00;    // FIFO - Param (b3: WUPB, b0-b2: No. of Slots)
06 63 3a;    // Read FIFOLevel

08 63 3d 80;    // BitframingReg - StartSend, TxLastBits

.b;
//> Response ATQB:
//> --------------
06 63 34;    // Read CommIrqReg:74
06 63 36;     // Read ErrReg: 00
06 63 3a;     // Read FIFOLevel (12 bytes): 0C
06 63 39      // ATQB 1st byte 50
   63 39 63 39 63 39 63 39 // ATQB PUPI    
   63 39 63 39 63 39 63 39 // ATQB Application data
   63 39 63 39 63 39;// ATQB Protocol Info
06 63 3a;  // Read FIFOLevel (12 bytes): 0.

.b;
//> ATTRIB :
//> -----------
08 63 3a 80;    // flush FIFO
08 63 39 1D;    // FIFO - ATTRIB Prefix
08 63 39 03 39 00 39 00 39 00;    // FIFO - PUPI
08 63 39 00;    // FIFO - Param1
08 63 39 05;    // FIFO - Param2
08 63 39 03;    // FIFO - Param3
08 63 39 00;    // FIFO - Param4
06 63 3a;    // Read FIFOLevel

08 63 3d 80;    // BitframingReg - StartSend, TxLastBits

.b;
//> Response ATTRIB:
//> --------------
06 63 34;    

Hope that helps,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[giamma_barbato]

Hello Kan

Thank you for your answer.

I tried to send the following commands

//Wake
D4 14 01 17 00

//Softreset
D4 08 63 31 0F

//IC Configuration
D4 08 63 3C 10
D4 08 63 02 83
D4 08 63 03 83
D4 08 63 08 85
D4 08 63 09 4D
D4 08 63 16 69
D4 08 63 17 FF
D4 08 63 18 3F
D4 08 63 19 10
D4 08 63 0E 00

//Start Transceive
D4 08 63 31 0C

//REQB/WUPB
D4 08 63 3A 80

And then i tried to send with InCommunicateThru
D4 42 06 00

I did all this commands with the tag on the reader.

But still no response.
What am I doing wrong?

[Kan_Li]

Please try the whole script not just partially . Looks like you didn't send out a complete REQB command...

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[giamma_barbato]

Hello Kan

Thank you for your answer.

I tried to execute the whole script like this:

//> REQB/WUPB :
//> -----------
D4 08 63 3a 80;    // flush FIFO
D4 08 63 39 05;    // FIFO - Anticollision Prefix
D4 08 63 39 00;    // FIFO - AFI code (all families)
D4 08 63 39 00;    // FIFO - Param (b3: WUPB, b0-b2: No. of Slots)
D4 06 63 3a;    // Read FIFOLevel

D4 08 63 3d 80;    // BitframingReg - StartSend, TxLastBits

Then I sent

InCommunicateThru
D4 42 06 00

Still no response. (D5 43 01 - Timeout error).

Then i went on with 

.b;
//> Response ATQB:
//> --------------
D4 06 63 34;    // Read CommIrqReg:74
D4 06 63 36;     // Read ErrReg: 00
D4 06 63 3a;     // Read FIFOLevel (12 bytes): 0C
D4 06 63 39      // ATQB 1st byte 50
   D4 06 63 39 63 39 63 39 63 39 // ATQB PUPI    
   D4 06 63 39 63 39 63 39 63 39 // ATQB Application data
   D4 06 63 39 63 39 63 39;// ATQB Protocol Info
D4 06 63 3a;  // Read FIFOLevel (12 bytes): 0.

Then I sent again

InCommunicateThru
D4 42 06 00

Still no response. (D5 43 01 - Timeout error).

Then i tried to send the InCommunicateThru each time i performed a command of the script, like this:

> D4 08 63 3A 80 (Flush Fifo)

< D5 09 (Ok)

> D4 42 06 00 (InCommunicateThru)

< D5 43 01  (Timeout)

> D4 08 63 39 05 (FIFO - Anticollision Prefix)

< D5 09 (Ok)

> D4 42 06 00 (InCommunicateThru)

< D5 43 01 (Timeout)

> ... etc.

Always got a "Timeout" error.

In reality, i really find hard to understand this script. I just tryed the commands without any understanding of them, i just know they write in PN532 register.

I remember that SRIX4K follows only Part 2 and Part 3 of the ISO14443-B standard, if it can helps.

How can I request the communication with this kind of tag through this script?

Thanks in advance

Gian Marco

[Kan_Li · Accepted solution]

Hi Gian Marco,

The following script might meet your requirement, please try it on your side.

------------------------------------------------------------------------------------------------------------------------------------------

//  PN532 InCommunicateThru script with Type B configuration

// WakeUp the PN532 if needed

.rawdata;

55 55 00 00 00 00 00 FF 03 FD D4 14 01 17 00;

.command;

// Read the mask version

02;

// Set number of Retries of ATR_REQ, PSL_RES to 0. For the InListPassiveTarget to give hand back quickly (after only one REQB)

32 05 00 00 00;

// Set the timeouts

32 02 00 0B 0E;

// InListPassiveTarget - 1 Target, 106 kbps Type B

// Should abort quickly if no card in the field.

4A 01 03 00;

// Field off to deselect card if needed.

32 01 00;

// Field on

32 01 01;

// Now the field is on, and the Front end is configured in Type B mode

// Send a ApGen Frame (example of a type B' card)

42 01 0B 3F 80;

// Send any data to the card

42 <Raw Data>

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[rgzz]

When I use InCommunicateThru to read the MIFARE 1k card, and follow the above configuration, I still get a timeout error. This is why？

PN532 connected on COM7
TAMA >[ 00 00 FF 0F F1 55 55 00 00 00 00 00 FF 03 FD D4 14 01 17 00 57 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 15 16 ]
TAMA >[ 00 00 FF 02 FE D4 02 2A 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 03 32 01 06 07 E8 ]
PN532 FW version = 106
TAMA >[ 00 00 FF 06 FA D4 32 05 00 00 00 F5 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 33 F8 ]
----RFConfiguration Retry
TAMA >[ 00 00 FF 06 FA D4 32 02 00 0B 0E DF 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 33 F8 ]
----RFConfiguration timeout
PN532 connected
TAMA >[ 00 00 FF 04 FC D4 4A 01 00 E1 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 4B 01 01 00 04 08 04 E3 18 40 00 93 ]
----InListPassiveTarget
TAMA >[ 00 00 FF 0E F2 D4 42 60 01 FF FF FF FF FF FF E3 18 40 00 54 00 ]
TAMA <[ 00 00 FF 00 FF 00 ]
TAMA <[ 00 00 FF D5 43 01 E7 ]
Read CMD Error2!!!