# Program and encode NFC seals Prepare a batch, program each NFC chip from start to finish, check the result, and react when a chip does not answer. Source: https://docs.sealtrust.io/en/gravure-sceaux-nfc/ --- When you leave this page, you will know how to prepare a batch of NFC seals, program a chip end to end, check what was written into it, and decide what to do with a chip that does not answer. Programming is run from the console, on a workstation fitted with a contactless reader, one chip at a time. The word programming here means writing into the chip. Nothing is marked on the product itself. > [!INFO] Who runs the programming > Physical programming is an operation run on a fitted workstation. Depending on > the path of your account, the entries of the **Tools** menu appear grayed out > and point to a contact, with the note "Not included in your plan. Click to > talk to us about it." The encoding wizard of a batch then states that physical > encoding is handled by SealTrust for your plan, and sends you back to the page > of the batch. You keep the view on the progress of the batch. ## What gets written into a chip A blank chip holds nothing useful out of the box. Programming places five things in it, in this order. 1. **The keys.** They replace the factory keys. They close the settings of the chip and the computation of its read proof. 2. **The URL.** That is what the chip presents to the phone that reads it. The workstation writes it into the area readable by a phone. 3. **The seal, on a sealed batch only.** The chip starts reporting any opening. Switching it on is permanent. 4. **The dynamic read setting.** Secure dynamic reading, called SDM in the console, makes the chip recompute a new proof at each read and add it to the URL it presents. The server checks that proof at each read. The protection against copying the content of a chip comes from that computation. 5. **The chip certificate.** A block signed by the key of your brand, written into the memory of the chip. The console marks an item as programmed only if the read setting and the certificate have both succeeded. If the certificate could not be written, the item is not marked as programmed and stays selected on screen. Run the operation again on the same chip, without leaving the page. ## The hardware > [!ATTENTION] The programming tool is not downloaded from this site > We install it with you on the programming workstation. Write to us before > ordering your chips and your readers, so that we prepare the workstation > together. - **A PC/SC contactless reader**, plugged into the programming workstation. The tool detects the readers present and offers them to you in a list. The ACS ACR1252U model is supported by name. - **NTAG 424 DNA chips.** The diagnostic screen tells you, chip by chip, whether the chip placed on the reader really is one. - **For a sealed batch, NTAG 424 DNA TT chips with an intact loop.** The tool reads the hardware subtype of the chip before acting and refuses any chip that is not a TT. - **The programming workstation**, with the SealTrust programming tool running. The console talks to that tool on the local machine. The tool must therefore run on the workstation where the console is open. - **A console account** whose plan includes NFC encoding. Without that line in the plan, the entries of the **Tools** menu stay grayed out. ## Prepare the batch Everything starts from a product model. Open the model, then **Mint batch**. | Field | What you fill in | | --- | --- | | Quantity | From 1 to 10,000 items. | | Production date | The date the batch will carry. | | Batch code | Proposed automatically, editable. | | Manufacturing site | Optional. | | Authentication method | `NFC`, `QR` or `NFC + QR`. | | Sealed batch | Checkbox, visible only if the batch carries a chip. | The **Sealed batch (tamper tags)** checkbox states its own reach on its own: "Switches the seal on for every tag of this run. Permanent on the chip, it cannot be undone. Tags must be NTAG 424 DNA TT with an intact tab." A batch in `QR` alone does not go through programming. QR is an identification mode in its own right, and its codes are generated from the page of the batch. A batch in `NFC + QR` goes through programming, like a batch in `NFC`. On validation, the console creates the items awaiting programming, places the batch in the encoding queue, and takes you to the encoder with that batch already selected. > [!DANGER] The sealed batch checkbox commits the whole run > The choice is carried by the batch, and the programming screen applies it > without discussing it again. Every chip of the run will get its seal switched > on, and that write cannot be undone. A chip whose loop is already broken would > send the product out with a proof of opening straight from the factory. ## Connect the reader Go to **Tools**, then **Reader connection**. 1. Choose the **reader** in the list, or leave `Auto (first reader)`. 2. Click **Connect to daemon**. The daemon is the programming service installed on the workstation. The screen also offers a drop-down list of brands. That choice stays on the screen and changes nothing in the programming. When the link is established, the console displays "Connected to NFC daemon. You can now use any NFC page." > [!ATTENTION] Check the link before programming a run > Before starting a run, check that the console displays the link as > established. If in doubt, stop and contact us. ## Program a chip, step by step Open **Tools**, then **NFC Encoder**. The screen works on one batch at a time and gives you three buttons in the order of use. ### 1. Take an item Click **Take 1 item (ready)**. The console displays the first item of the batch still awaiting programming, in the **Selected item** card. The counters at the top follow the progress of the batch: to encode, encoded, failures. > [!ATTENTION] One workstation per batch > That button reads the queue, it reserves nothing. Two workstations open on the > same batch display the same item and program two chips for a single unit. Have > a single workstation work on a batch. ### 2. Load the keys into the chip Click **Provision Keys**. That button only concerns new chips. The console asks for confirmation and restates what is about to happen: the chip must be new, it receives new keys, the operation is irreversible without those keys, and no data is written into the area readable by a phone. Place the chip on the reader and leave it there. The tool waits for the answer for up to 60 seconds. Two normal outcomes: - **Keys written.** The console indicates which keys changed. - **Step skipped.** The chip already carried the keys asked for. The console says so and invites you to move to the next step. Only use genuine NTAG 424 DNA chips. A chip whose origin you do not know must not go out to a customer. ### 3. Configure dynamic reading and mint the product Click **Configure SDM + Mint (+ URL)**. That button chains six operations on the same chip, without taking it off the reader. 1. **Reading the UID.** The console reads the unique identifier of the chip. It waits for the chip for up to 75 seconds. 2. **Minting the product.** The console mints the item on the blockchain and attaches it to that UID. The server includes in its answer the URL to write into the chip. 3. **Writing the URL.** The workstation writes the URL into the area readable by a phone. 4. **Switching the seal on**, on a sealed batch only. It comes before the activation of the read setting, because the read setting is replayed and switching the seal on is not. 5. **Activating the dynamic read setting.** The chip becomes active at the next read. 6. **Writing the chip certificate.** The console asks the server for the certificate, then the workstation writes it into the chip. The console displays the number of bytes written. A failure at that step leaves the item not marked as programmed. The console then marks the item as programmed, updates the counters, and automatically takes the next item of the batch. > [!ATTENTION] Check the chip after a second pass on the same item > After a second pass on the same item, bring a phone close to the chip and > check that it does open the verification page, before shipping the unit. > [!ATTENTION] Leave the chip in place for the whole sequence > Reading the identifier waits for up to 75 seconds. The following steps wait > for up to 60 seconds each. Leave the chip flat on the antenna from start to > finish. A chip taken away along the way interrupts the operation under way. ### Program a batch in series with the wizard The page of a batch offers a wizard in four steps: scan the UIDs of the blank chips one by one, confirm the pairing between each item and each UID, mint the whole batch, then program the chips one by one with the encoder. The order of the scan serves as the default pairing, and you can correct it item by item before minting. The wizard is available on any batch that carries a chip and that has an open encoding job. The console recommends it beyond about twenty items. ## Check after programming Four checks, from the quickest to the most complete. **Read the chip on the bench.** In the encoder, open **Diagnostic** then **Read Tag**. The console displays the UID, whether the chip really is an NTAG 424, and the state of dynamic reading: `Configured` or `New tag`. A programmed chip must announce `Configured`. **Look at the counters of the batch.** The encoder permanently displays the number of items to encode, encoded and failed. The **Export CSV** button downloads the result of the batch. The log at the bottom of the page keeps the last 200 lines. **Bring a phone close.** The URL written into the chip opens the verification page. At each read, the chip adds a counter that increases and a recomputed proof. The server refuses a read whose counter has already been seen, which makes the replay of a recorded read fail. **Open the product record.** The NFC section of the record shows the hash of the UID, the date of the last read, the state of the chip and the total number of reads. A record whose last read is empty has never been read by a phone. On a sealed batch, the tool reads the state of the seal before and after switching it on. It requires a seal still asleep before, and a closed seal after. Any other answer stops the operation, and you set the unit aside. ## When a chip does not answer | What you see | What it means | What you do | | --- | --- | --- | | `Not connected` badge | The programming service is not running on this workstation, or the console does not reach it. | Restart the tool on the workstation, then reopen **Reader connection**. | | Empty reader list | The tool sees no reader on this workstation. | Check that the reader is plugged in, then connect again. | | `Scan UID: failed or timeout.` | No chip answered within the allotted time. | Put the chip back flat at the center of the antenna and run the operation again. | | Authentication failure on every candidate key | The chip carries keys that do not come from your account, or from another fleet. | Set the unit aside. The chip can no longer be opened without its keys. | | The key step announces itself as skipped | The chip already carried the keys asked for. | Continue with **Configure SDM + Mint (+ URL)**. | | `This UID is already minted on-chain.` | That chip is already attached to a minted unit. | Recover the chip from the **Wipe tag** screen before reusing it. | | Chip subtype refused on a sealed batch | The chip placed on the reader is not a TT, so it has no loop to watch. | Take a chip of the right model. A sealed batch is only programmed on TT chips. | | Seal state refused before encoding | The seal has already been switched on, or the loop is already broken. | Set the unit aside. It would go out with a proof of opening straight from the factory. | | The seal does not announce the closed state after being switched on | The loop was probably damaged during handling. | Do not ship that unit, set it aside. | | `Batch type unknown (sealed or standard)` | The console did not get the type of the batch from the server, and refuses to assume. | Reload the page. Do not force it: assuming would program a permanent seal onto standard chips. | | Failure to generate or write the certificate | The chip is configured but incomplete. | The item is not marked as programmed and stays selected on screen. Put the chip back and run the operation again, without leaving the page. | The **Selected item** card carries the recovery actions. - **Retry** puts the item back to awaiting programming, then the console displays the next item awaiting. - **Next** moves to the next item without programming anything. - **Mark failed** forces the failed state, in every circumstance. - **Mark written** is only accepted on an item already minted and being programmed. On an item merely taken from the queue, the click has no effect and no message. Do not leave the page between the minting of an item and the end of its programming. An item left in that intermediate state no longer counts among the items to encode, and **Take 1 item (ready)** no longer returns it. ## Recover a chip already programmed The **Tools** screen, then **Wipe tag**, offers four operations that you tick separately. They run in a fixed order, and a failure on one does not interrupt the others. 1. **Database cleanup.** Detaches the chip from its product record and submits the destruction of the matching token on the blockchain. The console asks you to retype the identifier it displays, serial number or token identifier, then a two-factor authentication code. If the chip matches no record, nothing is destroyed and the console says so. 2. **Erase the URL.** The chip no longer opens the verification page when a phone reads it. 3. **Erase the chip certificate.** The chip no longer carries the block signed by the key of your brand. 4. **Factory reset.** Puts the keys and the access rights of the chip back to their factory values. The console requires you to type `RESET` to confirm. > [!DANGER] Switching a seal on is permanent > The factory reset covers the keys and the access rights of the chip. Switching > the seal on, for its part, cannot be undone. Treat a chip sealed by mistake as > lost for any unsealed use. ## What is left to do after programming Your programmed items are minted, attached to their chip and readable by a phone. The digital passport, the access rules and putting them on sale are then handled from the catalog, on the record of the batch and on that of each item. ## To go further - [Digital Product Passport](/en/passeport-dpp/): what the passport carries, and how to fill it in for the items you have just programmed. - [Physical identification](/en/identification-physique/): what the QR code and the chip each bring, and how to choose between the two. - [Create products](/en/creer-des-produits/): creation one at a time and in batches from the console, upstream of programming.