The PN532 configured as target has been released by its initiator

Question

I'm trying to put my PN532 in card-emulation mode. When i send the TgGetData command the error i get an error back from the reader.

1 . Read register

{(byte)0xFF,0x00,0x00,0x00,0x08,  (byte)0xD4, 0x06, 0x63, 0x05, 0x63, 0x0D, 0x63, 0x38 }

RESPONSE :: D507 07 07 15 9000

2 . Update registers

byte xx = (byte) 07;    
byte yy = (byte) 07;
byte zz = (byte) 15;
xx = (byte) (xx | 0x004); 
yy = (byte) (yy & 0x0EF); 
zz = (byte) (zz & 0x0F7);  

3 . Write register

{(byte)0xFF,0x00,0x00,0x00,0x11,  (byte) 0xD4, 0x08, 0x63, 0x02, (byte) 0x80, 
0x63, 0x03, (byte) 0x80, (byte) 0x63, (byte) 0x05,
xx, 0x63, 0x0D,yy, 0x63, 0x38, zz}

RESPONSE :: D509 9000

4 . Set parameters

{(byte)0xFF, 0x00, 0x00 ,0x00, 0x03, (byte)0xD4, 0x12, 0x30}

RESPONSE :: D513 9000 

5 . TgInitAsTarget

{(byte)0xFF, 0x00, 0x00, 0x00 , 0x27 , (byte)0xD4, (byte)0x8C , 
0x05 , 0x04, 0x00 , 0x12, 0x34, 0x56 , 0x20 , 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00 , 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00 , 0x00}

RESPONSE :: D58D 08 E0 80 9000

6 . TgGetData

{(byte)0xFF, 0x00, 0x00 ,0x00, 0x02, (byte)0xD4, (byte)0x86}

RESPONSE :: D587 29 9000

So the response of TgGetData gives a error code D587 29 9000 with means following the PN532 user manual:

• Error code 0x29: The PN532 configured as target has been released by its initiator

Any advice or comment related to this code is welcome.

Many thanks in advance!

Answer 1

First of all, there exist several different versions of the ACR122U that differ significantly in their behavior. I've successfully tested the above sequence with version 101 and 102 and could emulate a constactless smartcard with those readers. However, version 103 seems to accept those commands but is not detectable as contactless card. None of my tests revealed your issue though.

Besides that inconsistent behavior, there could be several causes for this issue:

• The connection times out in between the TgInitAsTarget and TgGetData because there is too much delay between the response to TgInitAsTarget and the TgGetData command. I experienced this while single-step debugging my card emulation code.

• The reader automatically enables itself for auto PICC detection (this seems to be available on version 2xx only) and consequently overrides the commands and parameters you sent for card emulation. The ACR122U manual indicates that you can disable automatic PICC detection by sending the APDU command FF 00 51 00 00. I tried this with my 10x versions and they did not understand that command.

• The activation that causes the emulated PICC to be released (and consequently causes TgGetData to return status code 0x29) could be part of the reader's regular operation: This could indicate, for instance, that the reader activated the emulated PICC, then halted it and deactivated the HF field, the reader could then reactivate the HF field and reactivate the emulated PICC. In that case you would have to restart the PICC emulation (issue another TgInitAsTarget command as soon as you received the status code 0x29 from TgGetData.