Initiator Peer to Peer (P2P) SNEP Operations using TRF7970A + MSP430 Training

Initiator Peer to Peer (P2P) SNEP Operations using

TRF7970A + MSP430 Training

Erick Macias & Josh Wyatt02/19/2013

TI Confidential - Internal Only

Peer to Peer (P2P) SNEP Operation Overview

• P2P SNEP example outline covered here includes:• NFC-F Protocol• NFC-DEP • SNEP• NDEF Message Format• Logical Disconnection Process

DP = NFCForum-TS-DigitalProtocol-1.0 LLP = NFCForum-TS-Logical_LinkProtocol SNEP = NFCForum-TS-SNEP_1.0

TRF7970A Configuration for P2P Active Initiator

• In the TRF7970A controlling MCU code, create NFC_Initiator_InitLoop() in Initiator_p2p.c to initialize the TRF7970A as active initiator @ 424kbps. • 0x83 (Soft Init Direct Command), 0x80 (Idle Direct Command)

• 0x00 (Chip Status Control) 0x21 (RF output active, +5 V operation)

• 0x01 (ISO Control) 0x1B (Active Initiator @ 424 kbps)

• 0x09 (Modulator Control) 0x21 SYS_CLK (in this case 13.56MHz) out optional, based on system requirements

• 0x0B (Regulator Control) 0x87• 0x14 (FIFO IRQ Level) 0x0F (RX high 96, TX low 32 bytes)

• 0x96 , 0x8F, 0x97 (Disable Decoder, Clear FIFO, Enable Decoder Direct commands)

Interaction with an NFC enabled device• The typical NFC enabled device (i.e. an Android phone) is polling through different

protocols in a “round robin” cycle (illustrated below):

• In this case, we are the initiator, so we will send SENSF_REQ command to the handset or other NFC P2P device capable of NFC-F in the field.

• We then follow the data and payload format outlined in the NFC Forum Digital protocol spec (Section 6.4, page 74, Figure 23)

Card EmulationNFC ActiveType AType BType F @ 424kpbsType F @ 212kpbsISO 15693

1. Send SENSF_REQ• SENSF_REQ (See Section 6.6, NFC Digital Protocol v1.0, Table 40)

Byte # Description Value (hex)• 0 Length 06 • 1 Command 00 (DP, SENSF_REQ)• 2:3 System Code (SC) FF FF (DP, Section 6.6.1.1, default)• 4 Request Code (RC) 00 (DP, no system code information requested)• 5 Time Slot Number (TSN) 03 (DP, Table 42, 4 time slots)

2. Receive SENSF_RES• SENSF_RES (See Section 6.6.2, NFC Digital Protocol v1.0, Table 43)

Byte # Description Value (hex)• 0 Length 12 (or 14, see note below on RD)• 1 Command 01 (SENSF_RES)• 2:9 NFCID2 01 FE 6F 5D 88 11 4A 0F (for example)• 10:11 PAD0 C0 C1 • 12:14 PAD1 C2 C3 C4• 15 MRTICHECK C5 • 16 MRTIUPDATE C6 • 17 PAD2 C7 • 18:19 Request Data (RD) (only present when RC ≠ 00,sent in

SENSF_REQ)

3. Send Attribute Request (ATR_REQ)• ATR_REQ (See NFC Digital Protocol, Section 14.6, Table 87)

Byte # Description Value (hex)NFC-DEP portion

• 0 Length 25 (37 bytes)• 1:2 Command D4 00 (ATR_REQ)• 3:12 NFCID3I NFCID3I = 01 FE 6F 5D 88 11 4A 0F 00 00• 13 DIDI 00• 14 BSI 00• 15 BRI 00• 16 PPI 32 (max payload 254 bytes)

LLCP portion• 17:19 LLCP Magic # 46 66 6D• 20:22 TLV: Version # 01 01 11 (v1.1)• 23:26 TLV: MIUX 02 02 07 80 (128 + MIU (1792) = 1920 bytes)• 27:30 TLV: Services 03 02 00 03 (WKS LLC Link Management)• 31:33 TLV: LTO 04 01 32 (500mSec timeout, Figure 22, LLP)• 34:36 TLV: Option Param 07 01 03 (Class 3) (Table 7, LLP)

4. Receive Attribute Response (ATR_RES)

• ATR_RES (See NFC Digital Protocol Table 92, LLP Spec Section 6.2.3.2)


• 0 Length 1F (31 bytes)• 1:2 Command D5 01 (ATR_RES, fixed values)• 3:12 NFCID3T NFCID3T = F3 95 62 DF C3 28 BD 9D 94 E0• 13 DIDT 00• 14 BST 00• 15 BRT 00• 16 TO 0E• 17 PPT 32 (max payload 254 bytes)

LLCP portion• 18:20 LLCP Magic # 46 66 6D• 21:23 TLV: Version # 01 01 11 (ver1.1)• 24:27 TLV: Services 03 02 00 13 (WKS LLC Link Management)• 28:30 TLV: LTO 04 01 96 (1.5 sec)

5. Send DEP_REQ SYMM PDU• SYMM PDU (See Logical Link Protocol Tech Spec, Fig 4)


• 0 Length 06• 1:2 Command D4 06 (DEP_REQ, Table 103, DP doc)• 3 PFB 00 (info PDU, PNI 0, Table 105, DP doc)

LLCP portion• 4:5 DSAP,PTYPE,SSAP 00 00 (SYMM PDU)

6. Receive DEP_RES SYMM PDU• SYMM PDU (See Logical Link Protocol Tech Spec, Fig 4)


• 0 Length 06• 1:2 Command D5 07 (DEP_RES, Table 104, DP doc)• 3 PFB 00 (info PDU, PNI 0, Table 105, DP doc)


7. Send DEP_REQ SYMM PDU• SYMM PDU (See Logical Link Protocol Tech Spec, Fig 4)


• 0 Len 06• 1:2 Command D4 06 (DEP_REQ, Table 103, DP doc)• 3 PFB 01 (info PDU, PNI 1)


8. Receive DEP_RES SYMM PDU• SYMM PDU (See Logical Link Protocol Tech Spec, Fig 4)


• 0 Len 06• 1:2 Command D5 07 (DEP_RES)• 3 PFB 01 (info PDU, PNI 1)


9. Send CONNECT PDU• CONNECT PDU (See Logical Link Protocol Spec, Section 4.3.5, Fig 9)


• 0 Len 1E• 1:2 Command D4 06 (DEP_REQ)• 3 PFB 01 ( info PDU, PNI 1)

note: PNI value varies based on where process isLLCP portion

• 4:5 DSAP,PTYPE,SSAP 05 20 (CONNECT PDU)• 6 Type 06 ( Service Name)• 7 Length 0F• 8:22 Service Name “urn:nfc:sn:snep”• 23:26 TLV: MIUX 02 02 07 80• 27:29 TLV: RWS 05 01 04NOTE: (Section 5.6.2.2, LLP doc, this # can go up to 0F, which can increase throughput to the initiator)

10. Receive Connection Complete (CC) PDU

• CC PDU (See Logical Link Protocol Spec, Section 4.3.7, Fig 11)


• 0 Len 0A• 1:2 Command D5 07 (DEP_RES)• 3 PFB 02( info PDU, PNI 2)

LLCP portion• 4:5 CC PDU (DSAP,PTYPE,SSAP) 81 84 (DSAP = 20, PTYPE = 6, SSAP = 04)• 6 Type 02 (Figure 20, LLP Spec)• 7 Length 02 (Figure 20, LLP Spec)• 8:9 MIUX 00 78 (Maximum Information Unit Extension)

11. Send I PDU (SNEP mode)

• I PDU (See Logical Link Protocol Spec, Section 4.3.10, Fig 14)


• 0 Length 2C (44 bytes)• 1:2 Command D4 06 (DEP_REQ)• 3 PFB 00 (info PDU, PNI 0)

LLCP portion• 4:5 I_PDU (DSAP,PTYPE,SSAP) 13 20 (DSAP 04, PTYPE = C, SSAP = 20)• 6 Sequence 00

SNEP Request Message• 7 SNEP Protocol Version 10 (SNEP v1.0)• 8 Request Field 02 (Put – Section 3.1.2, SNEP)• 9:12 Length 00 00 00 1F (31 bytes of payload)• See next slide for payload (NDEF Message)

11. Send I PDU (SNEP mode, cont.)NDEF Text Record Type

Byte # Description Value (hex)• 13 Message Info D1 (Short record, NFC well-known RTD)• 14 Length of Record Name 01• 15 Payload Length 1B (27 bytes)• 16 Payload Type 54 (‘T’ = Text) • 17 Status byte 02 (UTF-8, 2 byte lang. code)• 18:19 Language 65 6E (“en” = English)• 20:43 Payload “NFC powered by Stollmann”

12. Receive RR PDU• RR PDU (See Logical Link Protocol Spec Section 4.3.11, Fig 15)


• 0 Length 07• 1:2 Command D5 07 (DEP_RES)• 3 PFB 00 ( info PDU, PNI 0)

LLCP portion• 4:5 PP PDU 83 44 (DSAP=20,PTYPE=D,SSAP=04)• 6 Sequence 01 (Sequence Number N(R))

13. Receive I-PDU (SNEP mode)

• I PDU (See Logical Link Protocol Spec, Section 4.3.10, Fig. 14)


• 0 Length 0D (13 bytes)• 1:2 Command D5 07 (DEP_RES)• 3 PFB 01 (info PDU, PNI 1)

LLCP portion• 4:5 I_PDU (DSAP,PTYPE,SSAP) 83 04 (DSAP 20, PTYPE = C, SSAP = 04)• 6 Sequence 01

SNEP Response Message• 7 SNEP Protocol Version 10 (SNEP v1.0)• 8 Response 81 (Success, Table 3, SNEP)• 9:12 Length 00 00 00 00 (no information)

14. Send RECEIVE READY (RR) PDU

• RR PDU (See Logical Link Protocol Spec Section 4.3.11, Fig 15)


• 0 Length 07• 1:2 Command D4 06 (DEP_REQ)• 3 PFB 02 ( info PDU, PNI 2)

LLCP portion• 4:5 RR I-PDU 13 60 (DSAP = 04,PTYPE = D,SSAP=20)• 6 Sequence N(R) 01

15. Send DISCONNECT (DISC) PDU

• DISC PDU (See Logical Link Protocol Spec, Section 4.3.6, Fig 10)


• 0 Length 06• 1:2 Command D4 06 (DEP_REQ)• 3 PFB 03 ( info PDU, PNI 3)

LLCP portion• 4:5 DISC PDU 11 60 (DSAP = 04,PTYPE = 5,SSAP = 20)

16. Receive DISCONNECTED MODE (DM) PDU

• DM PDU (See Logical Link Protocol Tech Spec Fig 12 and Table 3, Pages 15-16)


• 0 Length 07• 1:2 Command D5 07 (DEP_RES)• 3 PFB 03 ( info PDU, PNI 3)

LLCP portion• 4:5 DISC PDU 81 C4 (DSAP = 20,PTYPE = 7,SSAP = 04)• 6 Reason 00Note: Table 4, LLP, the Reason Byte indicates that the LLC has received a DISC PDU and is now logically disconnected from the data link connection.

Thank you

TI Private– Strictly Private Information

BACKUP SLIDES (these are older ones from NPP ops)


TRF7970A Configuration for P2P Target

• See NFC_Target_InitLoop() in android_p2p.c• 0x83 (Soft Init cmd)• 0x80 (Idle cmd)• 0x00 (Chip Status Control) – 0x21 (RF output active, 5 V operation)• 0x01 (ISO Control) – 0x23 (Passive Target – 424 kbps)• 0x09 (Modulator Control) – 0x21 (13.56 MHz)• 0x0A (RX Special Settings) – 0x1C • 0x0B (Regulator Control) – 0x01• 0x14 (FIFO IRQ Level) – 0x0F ( RX high 96, TX low 32 bytes)• 0x16 (NFC Low Detection) – 0x01• 0x37 (NFCID) – 0x01, 0xFE, etc. (01 FE needed as first 2 bytes to

indicated support of NFC-DEP protocol in the NFC-F SENSF_RES)• 0x18 (NFC Target Level) – 0x86 (NFCID length of 10 bytes) • 0x96 , 0x97 (Disable Decoder, Enable Decoder cmds)


Interaction with Android Handset

• The Android phone polls through different protocols:

• We will receive an IRQ for RX start (Register 0x1C – 0x40) and check the target protocol for Felica/NFC-F (0x59 – 0xD3). Else reset the TRF.

Card EmulationNFC ActiveType AType BType F @ 424 kpbsType F @ 212 kpbsISO 15693


1. Receive SENSF_REQ

• SENSF_REQ (See NFC Digital Protocol Table 40) Bit # Description Value (hex)• 0 Len 06• 1 Command 00 (SENSF_REQ)• 2:3 SC FF FF (default)• 4 RC 01 (System Code request)• 5 TSN 01 (2 time slots)


2. Transmit SENSF_RES

• SENSF_RES (See NFC Digital Protocol Table 43)

Bit # Description Value (hex)• 0 Len 12 / 14 ( See the Note below)• 1 Command 01 (SENSF_RES)• 2:11 NFCIDt 01 FE etc. (NFC-DEP support)• 12:13 PAD0 FF FF (don’t care)• 14:15 PAD1 C2 C3 C4(don’t care)• 17 MRTIcheck C5 (don’t care)• 18 MRTIupdate C6 (don’t care)• 19 PAD2 C7 (don’t care)


3. Receive ATR_REQ

• ATR_REQ (See NFC Digital Protocol Table 87)

Bit # Description Value (hex)NFC-DEP portion

• 0 Len 1E• 1:2 Command D4 00 (ATR_REQ)• 3:12 NFCIDi NFCID random #• 13 DIDi 0• 14 BSi 0• 15 BRi 0• 16 PPi 32

LLCP portion• 17:19 LLCP Magic # 46 66 6D• 20:22 TLV: Version # 01 01 11 (ver 1.1)• 23:26 TLV: Services 03 02 00 13 (WKS LLC Link Management)• 27:29 TLF: LTO 04 01 96 (1.5s timeout)


4. Transmit ATR_RES

• ATR_RES (See NFC Digital Protocol Table 92)


• 0 Len 1C • 1:2 Command D5 01 (ATR_RES)• 3:12 NFCIDt NFCID of target• 13 DIDi 0• 14 BSi 0• 15 BRi 0• 16 TO 0E• 17 PPi 32

LLCP portion• 17:19 LLCP Magic # 46 66 6D• 20:22 TLV: Version # 01 01 10 (ver 1.0)• 23:26 TLV: Services 03 02 FF FF (all Services)


5. Receive SYMM PDU

• SYMM PDU (See Logical Link Protocol Tech Spec Fig 4)


• 0 Len 06• 1:2 Command D4 06 (DEP_REQ)• 3 PFB 00 ( info PDU, PNI 0)



Communication flow once the NFC-DEP connection is established

• To send message from MSP430 to phone:(Phone in tag discovery/reader mode)

1. Receive SYMM. 2. Reply CONNECT.3. Receive CC.4. Reply I PDU with message.5. Receive RR. 6. Send DISC.7. Receive DM.

• To receive message from phone on MSP430(Phone in NDEF Push mode)

1. Receive CONNECT (once the screen is tapped).2. Reply CC.3. Receive I with message.4. Reply SYMM.5. Receive DISC.6. Send DM.


6. Transmit CONNECT PDU

• CONNECT PDU (See Logical Link Protocol Tech Spec Fig 9)


• 0 Len 17• 1:2 Command D4 07 (DEP_RES)• 3 PFB 00 ( info PDU, PNI 0)

LLCP portion• 4:5 DSAP,PTYPE,SSAP 05 21 (CONNECT PDU)• 6 Type 06 ( Service Name)• 7 Length 0F• 8:22 Service Name “com.android.npp”


7. Receive CC PDU

• CC PDU (See Logical Link Protocol Tech Spec Fig 11)


• 0 Len 06• 1:2 Command D4 06 (DEP_REQ)• 3 PFB 02( info PDU, PNI 0)

LLCP portion• 4:5 DSAP,PTYPE,SSAP 85 90 (DSAP 21, SYMM PDU, SSAP 10)• 6 Type 02 (MIUX)• 7 Length 02• 8:9 MIUX 00 78


8. Transmit I PDU

• I PDU (See Logical Link Protocol Tech Spec Fig 14)


• 0 Len 26• 1:2 Command D4 07 (DEP_RES)• 3 PFB 02( info PDU, PNI 0)

LLCP portion• 4:5 DSAP,PTYPE,SSAP 43 21 (DSAP 10, I PDU, SSAP 21)• 6 Sequence 00

NPP Header• 7 NPP Protocol Version 01• 8:11 # of NDEF entries 00 00 00 01

NPP NDEF Entry• 12 Action Code 01 (default)• 13:16 NDEF Length 00 00 00 15


8. Transmit I PDU (cont.)

Bit # Description Value (hex)NDEF

• 17 Message Info D1 (Short record, NFC RTD)• 18 Type Length 01• 19 Payload Length 11• 20 Payload Type 54 (‘T’ = Text) • 21 Status byte 02 (UTF-8, 2 byte lang. code)• 22:23 Language 65 6E (“en” = English)• 24:37 Payload “Hello Android” (Text Message)


9. Receive RR PDU

• RR PDU (See Logical Link Protocol Tech Spec Fig 15)


• 0 Len 07• 1:2 Command D4 06 (DEP_REQ)• 3 PFB 03 ( info PDU, PNI 0)

LLCP portion• 4:5 DSAP,PTYPE,SSAP 87 50 (RR PDU)• 6 Sequence 00 ( Sequence Number N(R) )


8. Transmit PDU (cont.)

Bit # Description Value (hex)NDEF

• 17 Message Info D1 (Short record, NFC RTD)• 18 Type Length 01• 19 Payload Length 11• 20 Payload Type 54 (‘T’ = Text) • 21 Status byte 02 (UTF-8, 2 byte lang. code)• 22:23 Language 65 6E (“en” = English)• 24:37 Payload “Hello Android” (Text Message)


9. Transmit DISC PDU

• DISC PDU (See Logical Link Protocol Tech Spec Fig 10)


• 0 Len 06• 1:2 Command D4 07 (DEP_RES)• 3 PFB 03 ( info PDU, PNI 0)

LLCP portion• 4:5 DSAP,PTYPE,SSAP 41 31 (DISC PDU)

Documents

Initiator Peer to Peer (P2P) SNEP Operations using TRF7970A + MSP430 Training