Can't write on a Type1 tag (ACR122U-A9)

Asked by Jean-Philippe Eisenbarth on 2015-07-02


I try to write on Type1 tags using tagtool and ndeftool.

First I create a file containing my msg in plain text. Then I "packed" it using ndeftool and I use the load command of tagtool to write it to the tag.

But I got this error :

 $ ./ load packed.txt
[nfc.clf] searching for reader with path 'usb'
[nfc.clf] using ACS ACR122U PICC Interface at usb:001:026
[main] touch a tag
[main] old message:
record 1
  type = 'urn:nfc:wkt:T'
  name = ''
  data = '\x02enhello '
Traceback (most recent call last):
  File "./", line 475, in <module>
  File "/home/jp/dev/nfc_test/", line 283, in run
    while self.run_once() and self.options.loop:
  File "/home/jp/dev/nfc_test/", line 278, in run_once
    return clf.connect(**kwargs)
  File "/home/jp/dev/nfc_test/nfc/", line 404, in connect
    result = self._rdwr_connect(rdwr_options, terminate)
  File "/home/jp/dev/nfc_test/nfc/", line 424, in _rdwr_connect
    if callback and callback(tag):
  File "./", line 221, in on_rdwr_connect
  File "./", line 317, in load_tag
    tag.ndef.message = nfc.ndef.Message(
  File "/home/jp/dev/nfc_test/nfc/tag/", line 176, in message
    offset += 1
  File "/home/jp/dev/nfc_test/nfc/tag/", line 239, in __exit__
    self.write_block(block, self._mmap[block<<3:(block+1)<<3])
  File "/home/jp/dev/nfc_test/nfc/tag/", line 297, in write_block
    return self.transceive(cmd)
  File "/home/jp/dev/nfc_test/nfc/tag/", line 251, in transceive
    return, timeout)
  File "/home/jp/dev/nfc_test/nfc/", line 553, in exchange
    rcvd_data =, timeout)
  File "/home/jp/dev/nfc_test/nfc/dev/", line 584, in send_cmd_recv_rsp
    raise nfc.clf.TimeoutError("send_cmd_recv_rsp")
nfc.clf.TimeoutError: send_cmd_recv_rsp

Maybe this is not the way to write something on a Type1 tag. If so can you please tell me how to do it.

The old message has been written using a smartphone and the TagWriter app but I want to use nfcpy instead of this app.

Thank you in advance.

Have a good day.

Question information

English Edit question
nfcpy Edit question
No assignee Edit question
Solved by:
Stephen Tiedemann
Last query:
Last reply:

There seems nothing wrong with the way you're doing it. Can you please run the tagtool command with option "-d nfc.tag" and post the result.


thank you for your answer.

Here is the information you asked :

$ ./ -d nfc.tag
[main] enable debug output for module 'nfc.tag'
[nfc.clf] searching for reader with path 'usb'
[nfc.clf] using ACS ACR122U PICC Interface at usb:001:019
[main] touch a tag
[nfc.tag.tt1] read all
[nfc.tag.tt1] capability container e1103f00
[nfc.tag.tt1] dynamic lock byte tlv at 0xC
[nfc.tag.tt1] memory control tlv at 0x11
[nfc.tag.tt1] ndef message tlv at 0x16
[nfc.tag.tt1] ndef message length is 12
Type1Tag UID=6dc29300
NDEF capabilities:
  version = 1.0
  readable = yes
  writeable = yes
  capacity = 462 byte
  message = 12 byte
NDEF record list:
record 1
  type = 'urn:nfc:wkt:T'
  name = ''
  data = '\x02enhello'

I'm sorry that I will have only bad news for you. You have a Topaz 512 card and this can't be written with the ACR122U. It is based on a PN532 chipset which has a firmware bug that does not allow to send commands for dealing with the larger memory (compared to Topaz 96). The same problem exists for PN533 and RC-S956 that have the same core.

Though I have recently found workarounds for PN532 and PN533 they do not work for the ACR122U because of the embedded CPU that sits between the contactless chip and the host controller communication. I can only recommend you to buy another reader, and strongly recommend anyone else to **not buy the ACR122**.

Thanks Stephen Tiedemann, that solved my question.

I see that in the overview section of the doc you wrote : "The NXP PN53x can not properly handle Type 1 Tags with dynamic memory layout (Topaz 512) due to a firmware bug that does not allow READ-8 and WRITE-8 commands to be executed."

I guess it's related to your post but if I'm not wrong you don't warn in the doc that the ACR122 is concerned by the PN532 chipset bug. Maybe you could add a comment in the doc to warn about this reader.

Anyway, I bought a new reader (the Sony RC S380).

Thank you for your answers =)

Have a good day.

Thanks for the suggestion about ACR122 warning. I'm anyway rewriting parts of the documentation and will highlight this fact.

Just out of curiosity, where have you bought the RC-S380?

I have bought it on this site (not received yet but soon =)