Tranceive() method throws a tag lost exception only for specific chips

[amirf]

I wrote an android application that reads and writes iso15693 tags using NfcV.transceive() method. I have tested this app with several chips: nxp #icode sli, TI TAGIT HFI, STM LRI2K and Fujitsu MB89R118 on #siemens RFID tags of MDS series. In the transceive() method I use the ISO commands for read (0x20) and write (0x21) single block reading/writing 112 bytes in a loop.
Read command works fine with all chips, but write command works only with TI and Fujitsu chips properly. With STM chip only first block is written, and I always get the exception tag.lost . With nxp chip in Siemens tag MDS D126 write command works properly, but with NXP chip in Siemens tags MDS D100, D124 and D165 I always get the exception tag.lost. No block is written on the tag in this case. What could be the reason for this behavior?

[Kan_Li]

Hi Amir,

I think maybe some position in the user memory is protected so you can not write 112 byte in on time. Please kindly refer to the following snapshot from the data sheet.

Hope that helps,
Have a great day,
Kan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[amirf]

Hi Kan,

thanks a lot for your answer. Anyway, the user memory is not protected. I can write the data to the Siemens tag MDS D100 (with NXP ICODE SLI chip inside) with some Siemens industrial RFID Readers like RF340R. I can also write the Ndef data with the Android App NFC Tools PRO with my smartphone Samsung S7 to this tag. The exception appears when transceive() is used for the first time with write single block (0x21). The same software works with some other RFID chips like Fujitsu MB89R118 or TI TAGIT HFI. Transceive() with read single block (0x20) or GetSystemInfo (0x2B) works with all chips. I tried also to wait a little bit (100 ms or even 1 second) before transceive() with write single block is executed, but with no success.

My Software is like:

@Override
    protected void onNewIntent(Intent intent) {

        Toast.makeText(this, "NFC intent received!", Toast.LENGTH_SHORT).show();

        Tag tag = intent.getParcelableExtra(NfcAdapter.EXTRA_TAG);
        String[] techList = tag.getTechList();
        if (java.util.Arrays.asList(techList).contains("android.nfc.tech.NfcV")){
            NfcV nfcv = NfcV.get(tag);

            try {
                nfcv.connect();

.......

                byte[] data = new byte[MEMORY_SIZE_2];
                byte[] command = new byte[3 + iByteInBlock];
                command[0] = 0x40; // Flags
                command[1] = 0x21; // Command: Write single block
                command[2] = 0x00; // Number of block

.......

               boolean boDataOK = true;

               for (int i = 0; i < iLoops; i++) {
                  command[2] = (byte) i;
                  System.arraycopy(data, i * iByteInBlock, command, 3, iByteInBlock);
                  byte[] responseByte = nfcv.transceive(command);
                  if (responseByte[0] != 0x00) boDataOK = false;
               }
               if (boDataOK) Toast.makeText(this, "Tag successfully written!", Toast.LENGTH_LONG).show();

               nfcv.close();

            } catch (Exception e) {
              Toast.makeText(this, "Error exception! " + e, Toast.LENGTH_LONG).show();
            }
        }else{
           Toast.makeText(this, "Tag not supported!", Toast.LENGTH_LONG).show();
        }
       super.onNewIntent(intent);
    }

Do you have any other idea?

Have a great day too,

Amir

[Kan_Li]

Hi Amir,

Did you also run the tested App with your Samsung S7? Is it possible to post the data transaction during the issue? Looks like it is a software issue as other readers can work well with the tags.

Thanks for your patience!

Have a great day,
Kan

[amirf]

Hi Kan‌,

thanks for your support. Yes, I tested my App with my Samsung S7.

The transaction is like:

byte[] responseByte = nfcv.transceive(command);

where command is Array of 7 Bytes:

command[0] = 0x40; // Flags
command[1] = 0x21; // Command: Write single block
command[2] = 0x00; // Number of block, will change in the Loop from 0 to 27 in case of 112 Byte tag

command[3..6] = // data, like e.g. 0x2D 0xD5 0x01 0x00 for integer 120109 or e.g. 0x00 0x00 0x00 0x00

The question is, why the App works with TI and Fujitsu chips and not with all NXP and  STM chips. The App even works with NXP chip in Siemens tag D126 but not with (same?) chip in Siemens tag D100. What is the difference between chips in D126 and D100? 

I just found this on http://stackoverflow.com/questions/33633736/whats-the-difference-between-enablereadermode-and-enable...:

enableReaderMode: Limit the NFC controller to reader mode while this Activity is in the foreground.

enableForegroundDispatch: This will give give priority to the foreground activity when dispatching a discovered Tag to an application.

So basicly you can use both for the same purpose, which is reading/writing a tag. enableReaderMode is used by Android phones in combination with a Broadcom NFC controller, because there is a bug on the precense check. As far as i know, only the enableReaderMode can dodge this by increasing EXTRA_READER_PRESENCE_CHECK_DELAY.

I use enableForegroundDispatch at the moment. I will try to use enableReaderMode and increase presence check delay.

Thanks,

Amir

[Kan_Li]

Hi Amir,

Thanks for the information! I am sorry I don't know which chip is in Siemens tag D126, you might have to check with Siemens .

Is it possible to give us some log information regarding the data transaction between the tag and your phone? like phone sent 0x40 0x21 0x00 .....and tag replied xxxx or something like that. That might be helpful for us to analyze the problem.

Thanks for your patience！

Hope that helps,
Have a great day,
Kan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[amirf]

Hi Kan‌,

I do not get any reply from the tag in the error case. I get the exception that the tag is lost, not there anymore. With some other RFID tags I get the answer 0x00 (write was successful).

In the meantime I have tried also to use enableReaderMode and have changed EXTRA_READER_PRESENCE_CHECK_DELAY to 100, 1000 or 10000 (milliseconds probably). But this also did not help. With enableReaderMode I also get the exception TagLost.

Thanks for your help,

Amir

[amirf]

In the meantime I have tried to write to the RFID tag using the Android App NFC Tools PRO. This App allows to send NfcV (ISO 15693) commands to the tag. I tried to write to two different tags: Siemens MDS D100 with NXP ICODE SLI chip and Siemens MDS D126 with the same chip inside. Here is the log with D100 tag and with my comments:

> Waiting

> Chip detected: A5:D0:74:08:00:01:04:E0 // tag UID

> Available I/O Class: NfcV

> Connecting NfcV...

> Connected

> Sending bytes: 60:21:A5:D0:74:08:00:01:04:E0:00:09:00:00:00 // Write single block in addressed mode, block 0 with value 09000000

> Result: 01:0F  // Unknown error

If I try to write to the tag in not addressed mode I get this log:

> Chip detected: A5:D0:74:08:00:01:04:E0  // tag UID

> Available I/O Class: NfcV

> Connecting NfcV...

> Connected

> Sending bytes: 40:21:00:02:00:00:00  // Write single block, block 0 with value 02000000

> Error: I/O failure  // just like with my app

Here is the log with D126 tag and with my comments:

> Waiting

> Chip detected: F2:25:F2:62:50:01:04:E0 // tag UID

> Available I/O Class: NfcV

> Connecting NfcV...

> Connected

> Sending bytes: 60:21:F2:25:F2:62:50:01:04:E0:00:09:00:00:00 // Write single block in addressed mode, block 0 with value 09000000

> Result: 00 // Command was successful

Same command in not addressed mode:

> Chip detected: F2:25:F2:62:50:01:04:E0 // tag UID

> Available I/O Class: NfcV

> Connecting NfcV...

> Connected

> Sending bytes: 40:21:00:02:00:00:00 // Write single block , block 0 with value 02000000

> Result: 00 // Command was successful

Why does it work with one tag and not with another, even if both chips inside should be the same?

Another try with Siemens tag MDS D200 with Texas Instruments chip TAGIT HFI inside:

> Chip detected: 4E:4C:B5:92:1A:80:07:E0 // tag UID

> Available I/O Class: NfcV

> Connecting NfcV...

> Connected

> Sending bytes: 60:21:4E:4C:B5:92:1A:80:07:E0:00:09:00:00:00 // Write single block in addressed mode, block 0 with value 09000000

> Result: 01:13  // Means Programming was unsuccessful, but the block was actually written

Same command in not addressed mode:

> Chip detected: 4E:4C:B5:92:1A:80:07:E0 // tag UID

> Available I/O Class: NfcV

> Connecting NfcV...

> Connected

> Sending bytes: 40:21:00:02:00:00:00 // Write single block , block 0 with value 02000000

> Result: 01:13  // Means Programming was unsuccessful, but the block was actually written

[4pch]

Regarding  NXP ICODE SLI in a NXP forum, Weirdo, that nobody did not reacted to this  :

As per amirf:

> Chip detected: A5:D0:74:08:00:01:04:E0 // tag UID

> Sending bytes: 60:21:A5:D0:74:08:00:01:04:E0:00:09:00:00:00 // Write single block in addressed mode, block 0 with value 09000000

> Result: 01:0F  // Unknown error

But as far as I know, NXP-SLI Tags (UID E0 04) do not require Option Flag then:

The addressed command should be 20:21:A5:D0:74:08:00:01:04:E0:00:09:00:00:00

and will return 00 : Write transceive command Ok & Block written...

Re Tag-It (sorry for NXP forum...) , I'm currently also facing the same return value (01:13) despite the block being actually written and thus after various Flags values but unsuccessful trials...If s1 got some idea, I will appreciate..

[Gentili]

Hi,

I have the same issue, did you solve it?

Thanks