diff --git a/firmware/application/src/app_cmd.c b/firmware/application/src/app_cmd.c
index 0ba5ac2..4123a69 100644
--- a/firmware/application/src/app_cmd.c
+++ b/firmware/application/src/app_cmd.c
@@ -602,7 +602,7 @@ static data_frame_tx_t *cmd_processor_mf1_manipulate_value_block(uint16_t cmd, u
 }
 
 static data_frame_tx_t *cmd_processor_em410x_scan(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
-    uint8_t card_buffer[16] = { 0x00 };
+    uint8_t card_buffer[7] = {0x00};
     status = scan_em410x(card_buffer);
     if (status != STATUS_LF_TAG_OK) {
         return data_frame_make(cmd, status, 0, NULL);
@@ -647,7 +647,7 @@ static data_frame_tx_t *cmd_processor_hidprox_write_to_t55xx(uint16_t cmd, uint1
 }
 
 static data_frame_tx_t *cmd_processor_hidprox_scan(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
-    uint8_t card_data[16] = { 0x00 };
+    uint8_t card_data[16] = {0x00};
     status = scan_hidprox(card_data, data[0]);
     if (status != STATUS_LF_TAG_OK) {
         return data_frame_make(cmd, status, 0, NULL);
diff --git a/firmware/application/src/app_main.c b/firmware/application/src/app_main.c
index 3ff1224..5151236 100644
--- a/firmware/application/src/app_main.c
+++ b/firmware/application/src/app_main.c
@@ -580,61 +580,69 @@ static void offline_status_blink_color(uint8_t blink_color) {
 }
 
 static void offline_status_error(void) {
-    offline_status_blink_color(0);
+    offline_status_blink_color(RGB_RED);
 }
 
 static void offline_status_ok(void) {
-    offline_status_blink_color(1);
+    offline_status_blink_color(RGB_GREEN);
 }
 
-// fast detect a 14a tag uid to sim
-static void btn_fn_copy_ic_uid(void) {
-    bool lf_copy_succeeded = false;
-    bool hf_copy_succeeded = false;
-    uint8_t status;
-    uint8_t id_buffer[5] = { 0x00 };
-    // get 14a tag res buffer;
-    uint8_t slot_now = tag_emulation_get_slot();
-    tag_slot_specific_type_t tag_types;
-    tag_emulation_get_specific_types_by_slot(slot_now, &tag_types);
-
-    nfc_tag_14a_coll_res_entity_t *antres = NULL;
-
-    bool is_reader_mode_now = get_device_mode() == DEVICE_MODE_READER;
-    // first, we need switch to reader mode.
-    if (!is_reader_mode_now) {
-        // enter reader mode
-        reader_mode_enter();
-        bsp_delay_ms(8);
-        NRF_LOG_INFO("Start reader mode to offline copy.")
+static void btn_fn_copy_lf(uint8_t slot, tag_specific_type_t type) {
+    tag_data_buffer_t *buffer = get_buffer_by_tag_type(type);
+    if (buffer == NULL) {
+        // empty HF slot, nothing to do
+        return;
     }
-
-    switch (tag_types.tag_lf) {
+    size_t size = 0;
+    uint8_t id_buffer[16] = {0x00};
+    uint8_t status = STATUS_LF_TAG_NO_FOUND;
+    uint8_t *data = NULL;
+    switch (type) {
+        case TAG_TYPE_HID_PROX:
+            status = scan_hidprox(id_buffer, 0);
+            size = LF_HIDPROX_TAG_ID_SIZE;
+            data = id_buffer;
+            break;
         case TAG_TYPE_EM410X:
             status = scan_em410x(id_buffer);
-
-            if (status == STATUS_LF_TAG_OK) {
-                tag_data_buffer_t *buffer = get_buffer_by_tag_type(TAG_TYPE_EM410X);
-                memcpy(buffer->buffer, id_buffer, LF_EM410X_TAG_ID_SIZE);
-                tag_emulation_load_by_buffer(TAG_TYPE_EM410X, false);
-                NRF_LOG_INFO("Offline LF uid copied")
-                lf_copy_succeeded = true;
-                offline_status_ok();
-            } else {
-                NRF_LOG_INFO("No LF tag found");
-                offline_status_error();
-            }
-            break;
-        case TAG_TYPE_UNDEFINED:
-            // empty LF slot, nothing to do, move on to HF
+            size = LF_EM410X_TAG_ID_SIZE;
+            data = id_buffer + 2; // skip tag type
             break;
         default:
             NRF_LOG_ERROR("Unsupported LF tag type")
             offline_status_error();
     }
 
-    tag_data_buffer_t *buffer = get_buffer_by_tag_type(tag_types.tag_hf);
-    switch (tag_types.tag_hf) {
+    if (status == STATUS_LF_TAG_OK) {
+        memcpy(buffer->buffer, data, size);
+        tag_emulation_load_by_buffer(type, false);
+        NRF_LOG_INFO("Offline lf tag copied")
+
+        char *nick = "cloned";
+        uint8_t nick_buffer[36];
+        nick_buffer[0] = strlen(nick);
+        memcpy(nick_buffer + 1, nick, nick_buffer[0]);
+
+        fds_slot_record_map_t map_info;
+        get_fds_map_by_slot_sense_type_for_nick(slot, TAG_SENSE_LF, &map_info);
+        fds_write_sync(map_info.id, map_info.key, sizeof(nick_buffer), nick_buffer);
+        offline_status_ok();
+    } else {
+        NRF_LOG_INFO("No lf tag found");
+        offline_status_error();
+    }
+}
+
+static void btn_fn_copy_hf(uint8_t slot, tag_specific_type_t type) {
+    tag_data_buffer_t *buffer = get_buffer_by_tag_type(type);
+    if (buffer == NULL) {
+        // empty HF slot, nothing to do
+        return;
+    }
+
+    uint8_t status = 0;
+    nfc_tag_14a_coll_res_entity_t *antres = NULL;
+    switch (type) {
         case TAG_TYPE_MIFARE_Mini:
         case TAG_TYPE_MIFARE_1024:
         case TAG_TYPE_MIFARE_2048:
@@ -657,64 +665,72 @@ static void btn_fn_copy_ic_uid(void) {
             antres = &(p_info->res_coll);
             break;
         }
-
-        case TAG_TYPE_UNDEFINED:
-            // empty HF slot, nothing to do
-            break;
-
         default:
             NRF_LOG_ERROR("Unsupported HF tag type")
             offline_status_error();
             break;
     }
-    if (antres != NULL) {
-        if (!is_reader_mode_now) {
-            // finish HF reader initialization
-            pcd_14a_reader_reset();
-        }
-        pcd_14a_reader_antenna_on();
-        bsp_delay_ms(8);
-        // select a tag
-        picc_14a_tag_t tag;
 
-        status = pcd_14a_reader_scan_auto(&tag);
-        pcd_14a_reader_antenna_off();
-        if (status == STATUS_HF_TAG_OK) {
-            // copy uid
-            antres->size = tag.uid_len;
-            memcpy(antres->uid, tag.uid, tag.uid_len);
-            // copy atqa
-            memcpy(antres->atqa, tag.atqa, 2);
-            // copy sak
-            antres->sak[0] = tag.sak;
-            // copy ats
-            antres->ats.length = tag.ats_len;
-            memcpy(antres->ats.data, tag.ats, tag.ats_len);
-            NRF_LOG_INFO("Offline HF uid copied")
-            hf_copy_succeeded = true;
-            offline_status_ok();
-        } else {
-            NRF_LOG_INFO("No HF tag found");
-            offline_status_error();
-        }
+    if (antres == NULL) {
+        return;
     }
-    if (lf_copy_succeeded || hf_copy_succeeded) {
-        fds_slot_record_map_t map_info;
+
+    pcd_14a_reader_antenna_on();
+    bsp_delay_ms(8);
+    // select a tag
+    picc_14a_tag_t tag;
+
+    status = pcd_14a_reader_scan_auto(&tag);
+    pcd_14a_reader_antenna_off();
+    if (status == STATUS_HF_TAG_OK) {
+        // copy uid
+        antres->size = tag.uid_len;
+        memcpy(antres->uid, tag.uid, tag.uid_len);
+        // copy atqa
+        memcpy(antres->atqa, tag.atqa, 2);
+        // copy sak
+        antres->sak[0] = tag.sak;
+        // copy ats
+        antres->ats.length = tag.ats_len;
+        memcpy(antres->ats.data, tag.ats, tag.ats_len);
+        NRF_LOG_INFO("Offline HF uid copied")
+
         char *nick = "cloned";
-        uint8_t buffer[36];
-        buffer[0] = strlen(nick);
-        memcpy(buffer + 1, nick, buffer[0]);
-        if (lf_copy_succeeded) {
-            get_fds_map_by_slot_sense_type_for_nick(slot_now, TAG_SENSE_LF, &map_info);
-            fds_write_sync(map_info.id, map_info.key, sizeof(buffer), buffer);
-        }
-        if (hf_copy_succeeded) {
-            get_fds_map_by_slot_sense_type_for_nick(slot_now, TAG_SENSE_HF, &map_info);
-            fds_write_sync(map_info.id, map_info.key, sizeof(buffer), buffer);
-        }
+        uint8_t nick_buffer[36];
+        nick_buffer[0] = strlen(nick);
+        memcpy(nick_buffer + 1, nick, nick_buffer[0]);
+
+        fds_slot_record_map_t map_info;
+        get_fds_map_by_slot_sense_type_for_nick(slot, TAG_SENSE_HF, &map_info);
+        fds_write_sync(map_info.id, map_info.key, sizeof(nick_buffer), nick_buffer);
+        offline_status_ok();
+    } else {
+        NRF_LOG_INFO("No HF tag found");
+        offline_status_error();
     }
+}
+
+// fast detect a 14a tag uid to sim
+static void btn_fn_copy_ic_uid(void) {
+    // get 14a tag res buffer;
+    uint8_t slot_now = tag_emulation_get_slot();
+    tag_slot_specific_type_t tag_types;
+    tag_emulation_get_specific_types_by_slot(slot_now, &tag_types);
+
+    bool is_in_reader_mode = get_device_mode() == DEVICE_MODE_READER;
+    // first, we need switch to reader mode.
+    if (!is_in_reader_mode) {
+        // enter reader mode
+        reader_mode_enter();
+        bsp_delay_ms(8);
+        NRF_LOG_INFO("Start reader mode to offline copy.")
+    }
+
+    btn_fn_copy_lf(slot_now, tag_types.tag_lf);
+    btn_fn_copy_hf(slot_now, tag_types.tag_hf);
+
     // keep reader mode or exit reader mode.
-    if (!is_reader_mode_now) {
+    if (!is_in_reader_mode) {
         tag_mode_enter();
     }
 }
diff --git a/firmware/application/src/app_status.h b/firmware/application/src/app_status.h
index 58097ac..26d7bf2 100644
--- a/firmware/application/src/app_status.h
+++ b/firmware/application/src/app_status.h
@@ -1,7 +1,6 @@
 #ifndef STATUS_H
 #define STATUS_H
 
-
 /////////////////////////////////////////////////////////////////////
 // 14a status
 /////////////////////////////////////////////////////////////////////
@@ -19,10 +18,7 @@
 // lf status
 /////////////////////////////////////////////////////////////////////
 #define     STATUS_LF_TAG_OK                        (0x40)  // Some of the low -frequency cards are successful!
-#define     STATUS_EM410X_TAG_NO_FOUND              (0x41)  // Can't search for valid EM410X tags
-#define     STATUS_LF_TAG_NO_FOUND                  (0x42)  // Can't search for valid LF tag
-#define     STATUS_HIDPROX_TAG_NO_FOUND             (0x43)  // Can't search for valid HIDProx tags
-
+#define     STATUS_LF_TAG_NO_FOUND                  (0x41)  // Can't search for valid LF tags
 
 /////////////////////////////////////////////////////////////////////
 // other status
@@ -35,4 +31,5 @@
 #define     STATUS_FLASH_WRITE_FAIL                 (0x70)  // Flash writing failed
 #define     STATUS_FLASH_READ_FAIL                  (0x71)  // Flash read failed
 #define     STATUS_INVALID_SLOT_TYPE                (0x72)  // Invalid slot type
+
 #endif
diff --git a/firmware/application/src/ble_main.c b/firmware/application/src/ble_main.c
index 44346b0..5a9c308 100644
--- a/firmware/application/src/ble_main.c
+++ b/firmware/application/src/ble_main.c
@@ -11,7 +11,6 @@
 #include "nrf_sdh_ble.h"
 #include "nrf_ble_gatt.h"
 #include "nrf_ble_lesc.h"
-#include "nrf_drv_saadc.h"
 
 #include "peer_manager.h"
 #include "peer_manager_handler.h"
@@ -63,12 +62,15 @@ NRF_LOG_MODULE_REGISTER();
 #define NEXT_CONN_PARAMS_UPDATE_DELAY   APP_TIMER_TICKS(30000)                      /**< Time between each call to sd_ble_gap_conn_param_update after the first call (30 seconds). */
 #define MAX_CONN_PARAMS_UPDATE_COUNT    3                                           /**< Number of attempts before giving up the connection parameter negotiation. */
 
-// #define BATTERY_LEVEL_MEAS_INTERVAL     APP_TIMER_TICKS(1000)                       /**< Battery level measurement interval (ticks). This value corresponds to 1 seconds. */
-#define BATTERY_LEVEL_MEAS_INTERVAL     APP_TIMER_TICKS(5000)                     /**< Battery level measurement interval (ticks). This value corresponds to N seconds. */
+#define BATTERY_LEVEL_MEAS_INTERVAL     APP_TIMER_TICKS(5000)                       /**< Battery level measurement interval (ticks). This value corresponds to N seconds. */
 
 #define ADC_REF_VOLTAGE_IN_MILLIVOLTS  600  //!< Reference voltage (in milli volts) used by ADC while doing conversion.
 #define ADC_RES_12BIT                  16383 //!< Maximum digital value for 14-bit ADC conversion.
 #define ADC_PRE_SCALING_COMPENSATION   12    //!< The ADC is configured to use VDD with 1/3 prescaling as input. And hence the result of conversion is to be multiplied by 3 to get the actual value of the battery voltage.
+#define ADC_CHANNEL                    0
+#define ADC_BUF_SIZE                   2048
+#define ADC_BUF_COUNT                  2
+
 
 /**@brief Macro to convert the result of ADC conversion in millivolts.
  *
@@ -88,9 +90,11 @@ BLE_ADVERTISING_DEF(m_advertising);
 
 uint16_t          batt_lvl_in_milli_volts = 0;
 uint8_t           percentage_batt_lvl = 0;
-static nrf_saadc_value_t adc_buf[2];
+static nrf_saadc_value_t adc_buf[ADC_BUF_SIZE][ADC_BUF_COUNT];
 static uint16_t   m_conn_handle          = BLE_CONN_HANDLE_INVALID;                 /**< Handle of the current connection. */
 static uint16_t   m_ble_nus_max_data_len = BLE_GATT_ATT_MTU_DEFAULT - 3;            /**< Maximum length of data (in bytes) that can be transmitted to the peer by the Nordic UART service module. */
+lf_adc_callback_t m_lf_adc_callback      = NULL;
+
 static ble_uuid_t m_adv_uuids[]          =                                          /**< Universally unique service identifier. */
 {
     {BLE_UUID_NUS_SERVICE, NUS_SERVICE_UUID_TYPE},
@@ -100,6 +104,14 @@ volatile bool g_is_ble_connected = false;
 volatile bool g_is_low_battery_shutdown = false;
 static ble_opt_t m_static_pin_option;
 
+// Simple function to provide an index to the next input buffer
+// Will simply alernate between 0 and 1 when SAADC_BUF_COUNT is 2
+static uint32_t next_free_buf_index(void) {
+    static uint32_t buffer_index = -1;
+    buffer_index = (buffer_index + 1) % ADC_BUF_COUNT;
+    return buffer_index;
+}
+
 
 /**@brief Function for the ble connect key setup.
  *
@@ -495,7 +507,6 @@ static void ble_stack_init(void) {
     NRF_SDH_BLE_OBSERVER(m_ble_observer, APP_BLE_OBSERVER_PRIO, ble_evt_handler, NULL);
 }
 
-
 /**@brief Function for handling events from the GATT library. */
 void gatt_evt_handler(nrf_ble_gatt_t *p_gatt, nrf_ble_gatt_evt_t const *p_evt) {
     if ((m_conn_handle == p_evt->conn_handle) && (p_evt->evt_id == NRF_BLE_GATT_EVT_ATT_MTU_UPDATED)) {
@@ -669,60 +680,29 @@ static void peer_manager_init(void) {
 
 /**@brief Function for handling the ADC interrupt.
  *
- * @details  This function will fetch the conversion result from the ADC, convert the value into
- *           percentage and send it to peer.
+ * @details  This function fetchs conversion result from the ADC, then callback lf with samples.
  */
-void saadc_event_handler(nrf_drv_saadc_evt_t const *p_event) {
-    if (p_event->type == NRF_DRV_SAADC_EVT_DONE) {
-        nrf_saadc_value_t adc_result;
-        uint32_t          err_code;
-
-        adc_result = p_event->data.done.p_buffer[0];
-        // NRF_LOG_INFO("ADC sample value = %d", adc_result);
-
-        err_code = nrf_drv_saadc_buffer_convert(p_event->data.done.p_buffer, 1);
+void saadc_event_handler(nrfx_saadc_evt_t const *p_event) {
+    if (p_event->type == NRFX_SAADC_EVT_DONE && m_lf_adc_callback != NULL) {
+        ret_code_t err_code;
+        err_code = nrfx_saadc_buffer_convert(&adc_buf[next_free_buf_index()][0], ADC_BUF_SIZE);
         APP_ERROR_CHECK(err_code);
 
-        batt_lvl_in_milli_volts = ADC_RESULT_IN_MILLI_VOLTS(adc_result) + 100;
-        // NRF_LOG_INFO("batt_lvl_in_milli_volts: %d", batt_lvl_in_milli_volts);
-        percentage_batt_lvl = BATVOL2PERCENT(batt_lvl_in_milli_volts);
-
-        // if battery service is notification enable, we can send msg to device.
-        err_code = ble_bas_battery_level_update(&m_bas, percentage_batt_lvl, BLE_CONN_HANDLE_ALL);
-        if ((err_code != NRF_SUCCESS) &&
-                (err_code != NRF_ERROR_INVALID_STATE) &&
-                (err_code != NRF_ERROR_RESOURCES) &&
-                (err_code != NRF_ERROR_BUSY) &&
-                (err_code != NRF_ERROR_FORBIDDEN) &&
-                (err_code != BLE_ERROR_GATTS_SYS_ATTR_MISSING)) {
-            APP_ERROR_HANDLER(err_code);
-        }
-
-        // check low battery level, if level == 0, we can try to shutdown.
-        if (percentage_batt_lvl == 0) {
-            NRF_LOG_INFO("battery too low, try to shutdown...");
-            g_is_low_battery_shutdown = true;
-            sleep_timer_start(SLEEP_NO_BATTERY_SHUTDOWN);
-        } else {
-            g_is_low_battery_shutdown = false;
-        }
+        m_lf_adc_callback(p_event->data.done.p_buffer, p_event->data.done.size);
     }
 }
 
 /**@brief Function for configuring ADC to do battery level conversion.
  */
 static void adc_configure(void) {
-    ret_code_t err_code = nrf_drv_saadc_init(NULL, saadc_event_handler);
+    ret_code_t err_code;
+
+    nrfx_saadc_config_t cfg = NRFX_SAADC_DEFAULT_CONFIG;
+    err_code = nrfx_saadc_init(&cfg, saadc_event_handler);
     APP_ERROR_CHECK(err_code);
 
-    nrf_saadc_channel_config_t config = NRF_DRV_SAADC_DEFAULT_CHANNEL_CONFIG_SE(BAT_SENSE);
-    err_code = nrf_drv_saadc_channel_init(0, &config);
-    APP_ERROR_CHECK(err_code);
-
-    err_code = nrf_drv_saadc_buffer_convert(&adc_buf[0], 1);
-    APP_ERROR_CHECK(err_code);
-
-    err_code = nrf_drv_saadc_buffer_convert(&adc_buf[1], 1);
+    nrf_saadc_channel_config_t ch = NRFX_SAADC_DEFAULT_CHANNEL_CONFIG_SE(BAT_SENSE);
+    err_code = nrfx_saadc_channel_init(ADC_CHANNEL, &ch);
     APP_ERROR_CHECK(err_code);
 }
 
@@ -737,9 +717,41 @@ static void adc_configure(void) {
 static void battery_level_meas_timeout_handler(void *p_context) {
     UNUSED_PARAMETER(p_context);
 
+    // When LF sample is enabled, PWM triggers ADC samples through PPI, at 125khz sample rate.
+    // To avoid corrupt LF samples, here we ignore battery level measure timer for a while.
+    if (m_lf_adc_callback != NULL) {
+        return;
+    }
+
+    // Here we fetch the conversion result from the ADC, convert the value into
+    // percentage and send it to peer.
     ret_code_t err_code;
-    err_code = nrf_drv_saadc_sample();
+    nrf_saadc_value_t adc_result;
+    err_code = nrfx_saadc_sample_convert(ADC_CHANNEL, &adc_result);
     APP_ERROR_CHECK(err_code);
+
+    batt_lvl_in_milli_volts = ADC_RESULT_IN_MILLI_VOLTS(adc_result) + 100;
+    percentage_batt_lvl = BATVOL2PERCENT(batt_lvl_in_milli_volts);
+
+    // if battery service is notification enable, we can send msg to device.
+    err_code = ble_bas_battery_level_update(&m_bas, percentage_batt_lvl, BLE_CONN_HANDLE_ALL);
+    if ((err_code != NRF_SUCCESS) &&
+        (err_code != NRF_ERROR_INVALID_STATE) &&
+        (err_code != NRF_ERROR_RESOURCES) &&
+        (err_code != NRF_ERROR_BUSY) &&
+        (err_code != NRF_ERROR_FORBIDDEN) &&
+        (err_code != BLE_ERROR_GATTS_SYS_ATTR_MISSING)) {
+        APP_ERROR_HANDLER(err_code);
+    }
+
+    // check low battery level, if level == 0, we can try to shutdown.
+    if (percentage_batt_lvl == 0) {
+        NRF_LOG_INFO("battery too low, try to shutdown...");
+        g_is_low_battery_shutdown = true;
+        sleep_timer_start(SLEEP_NO_BATTERY_SHUTDOWN);
+    } else {
+        g_is_low_battery_shutdown = false;
+    }
 }
 
 void create_battery_timer(void) {
@@ -766,3 +778,32 @@ void ble_slave_init(void) {
     conn_params_init();                 // Connection parameter initialization
     peer_manager_init();                // Peer manager Initialization
 }
+
+void register_lf_adc_callback(lf_adc_callback_t cb) {
+    m_lf_adc_callback = cb;
+
+    nrfx_saadc_uninit();
+
+    ret_code_t err_code;
+
+    nrfx_saadc_config_t cfg = NRFX_SAADC_DEFAULT_CONFIG;
+    err_code = nrfx_saadc_init(&cfg, saadc_event_handler);
+    APP_ERROR_CHECK(err_code);
+
+    nrf_saadc_channel_config_t ch = NRFX_SAADC_DEFAULT_CHANNEL_CONFIG_SE(NRF_SAADC_INPUT_AIN5);
+    ch.acq_time = NRF_SAADC_ACQTIME_5US;
+    err_code = nrfx_saadc_channel_init(ADC_CHANNEL, &ch);
+    APP_ERROR_CHECK(err_code);
+
+    err_code = nrfx_saadc_buffer_convert(&adc_buf[next_free_buf_index()][0], ADC_BUF_SIZE);
+    APP_ERROR_CHECK(err_code);
+
+    err_code = nrfx_saadc_buffer_convert(&adc_buf[next_free_buf_index()][0], ADC_BUF_SIZE);
+    APP_ERROR_CHECK(err_code);
+}
+
+void unregister_lf_adc_callback(void) {
+    nrfx_saadc_uninit();
+    adc_configure();
+    m_lf_adc_callback = NULL;
+}
\ No newline at end of file
diff --git a/firmware/application/src/ble_main.h b/firmware/application/src/ble_main.h
index 49c9edc..9250d2f 100644
--- a/firmware/application/src/ble_main.h
+++ b/firmware/application/src/ble_main.h
@@ -1,13 +1,15 @@
 #ifndef BLE_MAIN_H
 #define BLE_MAIN_H
 
+#include "ble_bas.h"
 #include "ble_gatts.h"
 #include "ble_nus.h"
-#include "ble_bas.h"
-
+#include "nrfx_saadc.h"
 
 extern uint16_t batt_lvl_in_milli_volts;
-extern uint8_t  percentage_batt_lvl;
+extern uint8_t percentage_batt_lvl;
+
+typedef void (*lf_adc_callback_t)(nrf_saadc_value_t *, size_t);
 
 void ble_slave_init(void);
 void advertising_start(bool erase_bonds);
@@ -17,4 +19,7 @@ void nus_data_response(uint8_t *p_data, uint16_t length);
 bool is_nus_working(void);
 void set_ble_connect_key(uint8_t *key);
 
+void register_lf_adc_callback(lf_adc_callback_t cb);
+void unregister_lf_adc_callback(void);
+
 #endif
diff --git a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c
index d31bc0a..30d6090 100644
--- a/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c
+++ b/firmware/application/src/rfid/nfctag/lf/lf_tag_em.c
@@ -30,7 +30,7 @@ static volatile bool m_is_lf_emulating = false;
 // Cache tag type
 static tag_specific_type_t m_tag_type = TAG_TYPE_UNDEFINED;
 
-// The pwm to broadcast FSK2a modulated card id
+// The pwm to broadcast modulated card id
 const nrfx_pwm_t m_broadcast = NRFX_PWM_INSTANCE(0);
 const nrf_pwm_sequence_t *m_pwm_seq = NULL;
 
@@ -135,7 +135,7 @@ static void pwm_init(void) {
 
 static void lf_sense_enable(void) {
     lpcomp_init();
-    pwm_init();  // use precise hardware timer to broadcast card id
+    pwm_init();  // use precise hardware pwm to broadcast card id
     if (is_lf_field_exists()) {
         lpcomp_event_handler(NRF_LPCOMP_EVENT_UP);
     }
@@ -163,21 +163,18 @@ void lf_tag_125khz_sense_switch(bool enable) {
     // turn off mod, otherwise its hard to judge RSSI
     ANT_NO_MOD();
 
-    // forTheFirstTimeOrDisabled,OnlyInitializationIsAllowed
-    if (m_lf_sense_state == LF_SENSE_STATE_NONE || m_lf_sense_state == LF_SENSE_STATE_DISABLE) {
-        if (enable) {
-            m_lf_sense_state = LF_SENSE_STATE_ENABLE;
-            lf_sense_enable();
-        }
-    } else {  // inOtherCases,OnlyAntiInitializationIsAllowed
-        if (!enable) {
-            m_lf_sense_state = LF_SENSE_STATE_DISABLE;
-            lf_sense_disable();
-        }
+    if ((m_lf_sense_state == LF_SENSE_STATE_NONE || m_lf_sense_state == LF_SENSE_STATE_DISABLE) && enable) {
+        // switch from disable -> enable
+        m_lf_sense_state = LF_SENSE_STATE_ENABLE;
+        lf_sense_enable();
+    } else if (m_lf_sense_state == LF_SENSE_STATE_ENABLE && !enable) {
+        // switch from enable -> disable
+        m_lf_sense_state = LF_SENSE_STATE_DISABLE;
+        lf_sense_disable();
     }
 }
 
-/** @brief lf card load data
+/** @brief lf card data loader
  * @param type     Refined tag type
  * @param buffer   Data buffer
  */
diff --git a/firmware/application/src/rfid/nfctag/lf/protocols/protocols.h b/firmware/application/src/rfid/nfctag/lf/protocols/protocols.h
index 6bab966..28bac8d 100644
--- a/firmware/application/src/rfid/nfctag/lf/protocols/protocols.h
+++ b/firmware/application/src/rfid/nfctag/lf/protocols/protocols.h
@@ -5,6 +5,7 @@
 #include <stdint.h>
 
 #include "nrf_pwm.h"
+#include "tag_base_type.h"
 
 typedef void* (*codec_alloc)(void);
 typedef void (*codec_free)(void* codec);
@@ -21,7 +22,7 @@ typedef struct {
 } decoder_t;
 
 typedef struct {
-    uint16_t tag_type;
+    tag_specific_type_t tag_type;
     const size_t data_size;
     codec_alloc alloc;
     codec_free free;
diff --git a/firmware/application/src/rfid/nfctag/tag_emulation.c b/firmware/application/src/rfid/nfctag/tag_emulation.c
index 41b068e..ab17fa8 100644
--- a/firmware/application/src/rfid/nfctag/tag_emulation.c
+++ b/firmware/application/src/rfid/nfctag/tag_emulation.c
@@ -164,6 +164,9 @@ tag_sense_type_t get_sense_type_from_tag_type(tag_specific_type_t type) {
  * Get buffer data according to tag type.
  */
 tag_data_buffer_t *get_buffer_by_tag_type(tag_specific_type_t type) {
+    if (type == TAG_TYPE_UNDEFINED) {
+        return NULL;
+    }
     for (int i = 0; i < ARRAY_SIZE(tag_base_map); i++) {
         if (tag_base_map[i].tag_type == type) {
             return tag_base_map[i].data_buffer;
@@ -647,7 +650,7 @@ uint8_t tag_emulation_slot_find_prev(uint8_t slot_now) {
 }
 
 /**
- *Set the card specified by the specified card slot card slot card type card to the specified type
+ * Set the card specified by the specified card slot card slot card type card to the specified type
  */
 void tag_emulation_change_type(uint8_t slot, tag_specific_type_t tag_type) {
     tag_sense_type_t sense_type = get_sense_type_from_tag_type(tag_type);
@@ -673,8 +676,8 @@ void tag_emulation_change_type(uint8_t slot, tag_specific_type_t tag_type) {
 }
 
 /**
- * @briefThe factory initialization function of the emulation card
- * Some data that can be used to initialize the default factory factory
+ * The factory initialization function of the card emulation.
+ * Defaults to a dual-frequency card in slot 1, a hf M1 card in slot 2, and a lf em410x card in slot 3.
  */
 void tag_emulation_factory_init(void) {
     fds_slot_record_map_t map_info;
diff --git a/firmware/application/src/rfid/reader/lf/lf_125khz_radio.c b/firmware/application/src/rfid/reader/lf/lf_125khz_radio.c
index 4d732ad..9f70f23 100644
--- a/firmware/application/src/rfid/reader/lf/lf_125khz_radio.c
+++ b/firmware/application/src/rfid/reader/lf/lf_125khz_radio.c
@@ -10,28 +10,11 @@
 #include "nrfx_timer.h"
 #include "rfid_main.h"
 
-#define SAADC_BUF_SIZE (2048)
-#define SAADC_BUF_COUNT (2)
-
-static nrf_saadc_value_t samples[SAADC_BUF_SIZE][SAADC_BUF_COUNT];
+static bool m_reader_inited = false;
 nrfx_pwm_t m_pwm = NRFX_PWM_INSTANCE(0);
-nrf_ppi_channel_t m_ppi_channel;
-nrfx_timer_t m_timer_lf_reader = NRFX_TIMER_INSTANCE(2);
-
-static void pwm_init(void);
-static void saadc_init(void);
-static void timer_counter_init(void);
-static void gpiote_init(void);
-static void pwm_saadc_sample_ppi_init(void);
-static void pwm_timer_counter_ppi_init(void);
-
-// Simple function to provide an index to the next input buffer
-// Will simply alernate between 0 and 1 when SAADC_BUF_COUNT is 2
-static uint32_t next_free_buf_index(void) {
-    static uint32_t buffer_index = -1;
-    buffer_index = (buffer_index + 1) % SAADC_BUF_COUNT;
-    return buffer_index;
-}
+nrfx_timer_t m_pwm_timer_counter = NRFX_TIMER_INSTANCE(2);
+nrf_ppi_channel_t m_pwm_saadc_sample_ppi_channel;
+nrf_ppi_channel_t m_pwm_timer_count_ppi_channel;
 
 // At present, only channel 1 is used, so only one channel can be configured
 static nrf_pwm_values_individual_t m_lf_125khz_pwm_seq_val[] = {
@@ -44,86 +27,22 @@ nrf_pwm_sequence_t const m_lf_125khz_pwm_seq_obj = {
     .repeats = 0,
     .end_delay = 0};
 
-typedef enum {
-    LF_125K_RADIO_MODE_NONE,
-    LF_125K_RADIO_MODE_SAADC,
-    LF_125K_RADIO_MODE_GPIOTE,
-} lf_125k_radio_mode_t;
-static lf_125k_radio_mode_t m_lf_125k_radio_mode = LF_125K_RADIO_MODE_NONE;
-
-/**@brief Low -frequency reading card decrease along the trigger collection
- * event
+/**
+ * LF reading card decrease along the trigger collection event
  */
 static void lf_125khz_gpio_handler(nrfx_gpiote_pin_t pin, nrf_gpiote_polarity_t action) {
     // Directly transfer to the event
     gpio_int0_irq_handler();
 }
 
-// initialize 125kHz signal PWM modulation (use saadc, FSK)
-void lf_125khz_radio_saadc_init(void) {
-    if (m_lf_125k_radio_mode == LF_125K_RADIO_MODE_SAADC) {
-        return;
-    }
-
-    if (m_lf_125k_radio_mode == LF_125K_RADIO_MODE_GPIOTE) {
-        lf_125khz_radio_uninit();
-    }
-
-    pwm_init();
-    saadc_init();
-    pwm_saadc_sample_ppi_init();
-    m_lf_125k_radio_mode = LF_125K_RADIO_MODE_SAADC;
-}
-
-// initialize 125kHz signal PWM modulation (use gpiote, ASK)
-void lf_125khz_radio_gpiote_init(void) {
-    if (m_lf_125k_radio_mode == LF_125K_RADIO_MODE_GPIOTE) {
-        return;
-    }
-
-    if (m_lf_125k_radio_mode == LF_125K_RADIO_MODE_SAADC) {
-        lf_125khz_radio_uninit();
-    }
-
-    pwm_init();
-    timer_counter_init();
-    pwm_timer_counter_ppi_init();
-    gpiote_init();
-    m_lf_125k_radio_mode = LF_125K_RADIO_MODE_GPIOTE;
-}
-
+// The LF collection decline is interrupted, and the GPIO is pulled down
+// by default. The trigger method is triggering
 static void gpiote_init(void) {
     nrfx_err_t err_code;
 
-    // The LF collection decline is interrupted, and the GPIO is pulled down
-    // by default. The trigger method is triggering
-    nrfx_gpiote_in_config_t in_config = NRFX_GPIOTE_CONFIG_IN_SENSE_LOTOHI(false);
-    err_code = nrfx_gpiote_in_init(LF_OA_OUT, &in_config, lf_125khz_gpio_handler);
+    nrfx_gpiote_in_config_t cfg = NRFX_GPIOTE_CONFIG_IN_SENSE_LOTOHI(false);
+    err_code = nrfx_gpiote_in_init(LF_OA_OUT, &cfg, lf_125khz_gpio_handler);
     APP_ERROR_CHECK(err_code);
-    nrfx_gpiote_in_event_enable(LF_OA_OUT, true);
-}
-
-// Anti -initialization
-void lf_125khz_radio_uninit(void) {
-    if (m_lf_125k_radio_mode == LF_125K_RADIO_MODE_NONE) {
-        return;
-    }
-
-    if (m_lf_125k_radio_mode == LF_125K_RADIO_MODE_SAADC) {
-        nrfx_ppi_channel_free(m_ppi_channel);
-        nrfx_saadc_uninit();
-    }
-
-    if (m_lf_125k_radio_mode == LF_125K_RADIO_MODE_GPIOTE) {
-        nrfx_gpiote_in_event_disable(LF_OA_OUT);
-        nrfx_gpiote_in_uninit(LF_OA_OUT);
-        nrfx_ppi_channel_free(m_ppi_channel);
-        nrfx_timer_uninit(&m_timer_lf_reader);
-    }
-
-    nrfx_ppi_free_all();  // nrf_drv_ppi_uninit();
-    nrfx_pwm_uninit(&m_pwm);
-    m_lf_125k_radio_mode = LF_125K_RADIO_MODE_NONE;
 }
 
 /**
@@ -159,31 +78,27 @@ static void pwm_init(void) {
     APP_ERROR_CHECK(err_code);
 }
 
-static void timer_counter_init(void) {
+static void pwm_timer_counter_init(void) {
     nrfx_err_t err_code;
 
     nrfx_timer_config_t timer_cfg = NRFX_TIMER_DEFAULT_CONFIG;
     timer_cfg.mode = NRF_TIMER_MODE_COUNTER;
 
-    err_code = nrfx_timer_init(&m_timer_lf_reader, &timer_cfg, NULL);
+    err_code = nrfx_timer_init(&m_pwm_timer_counter, &timer_cfg, NULL);
     APP_ERROR_CHECK(err_code);
-
-    nrfx_timer_enable(&m_timer_lf_reader);
 }
 
-static void pwm_timer_counter_ppi_init() {
+// trigger timer count task from pwm
+static void pwm_timer_count_ppi_init(void) {
     nrfx_err_t err_code;
 
-    err_code = nrfx_ppi_channel_alloc(&m_ppi_channel);
+    err_code = nrfx_ppi_channel_alloc(&m_pwm_timer_count_ppi_channel);
     APP_ERROR_CHECK(err_code);
 
     err_code = nrfx_ppi_channel_assign(
-        m_ppi_channel,
+        m_pwm_timer_count_ppi_channel,
         nrfx_pwm_event_address_get(&m_pwm, NRF_PWM_EVENT_PWMPERIODEND),
-        nrfx_timer_task_address_get(&m_timer_lf_reader, NRF_TIMER_TASK_COUNT));
-    APP_ERROR_CHECK(err_code);
-
-    err_code = nrfx_ppi_channel_enable(m_ppi_channel);
+        nrfx_timer_task_address_get(&m_pwm_timer_counter, NRF_TIMER_TASK_COUNT));
     APP_ERROR_CHECK(err_code);
 }
 
@@ -191,45 +106,70 @@ static void pwm_timer_counter_ppi_init() {
 static void pwm_saadc_sample_ppi_init(void) {
     nrfx_err_t err_code;
 
-    err_code = nrfx_ppi_channel_alloc(&m_ppi_channel);
+    err_code = nrfx_ppi_channel_alloc(&m_pwm_saadc_sample_ppi_channel);
     APP_ERROR_CHECK(err_code);
 
     err_code = nrfx_ppi_channel_assign(
-        m_ppi_channel,
+        m_pwm_saadc_sample_ppi_channel,
         nrfx_pwm_event_address_get(&m_pwm, NRF_PWM_EVENT_PWMPERIODEND),
         nrf_saadc_task_address_get(NRF_SAADC_TASK_SAMPLE));
     APP_ERROR_CHECK(err_code);
+}
 
-    err_code = nrfx_ppi_channel_enable(m_ppi_channel);
+void lf_125khz_radio_saadc_enable(lf_adc_callback_t cb) {
+    register_lf_adc_callback(cb);
+
+    nrfx_err_t err_code;
+    err_code = nrfx_ppi_channel_enable(m_pwm_saadc_sample_ppi_channel);
     APP_ERROR_CHECK(err_code);
 }
 
-void lf_saadc_event_handler(nrfx_saadc_evt_t const* p_event) {
-    if (p_event->type == NRFX_SAADC_EVT_DONE) {
-        ret_code_t err_code;
-        err_code = nrfx_saadc_buffer_convert(&samples[next_free_buf_index()][0], SAADC_BUF_SIZE);
-        APP_ERROR_CHECK(err_code);
-        saadc_irq_handler(p_event->data.done.p_buffer, p_event->data.done.size);
+void lf_125khz_radio_saadc_disable(void) {
+    nrfx_err_t err_code;
+    err_code = nrfx_ppi_channel_disable(m_pwm_saadc_sample_ppi_channel);
+    APP_ERROR_CHECK(err_code);
+
+    unregister_lf_adc_callback();
+}
+
+void lf_125khz_radio_gpiote_enable(void) {
+    nrfx_err_t err_code;
+    err_code = nrfx_ppi_channel_enable(m_pwm_timer_count_ppi_channel);
+    APP_ERROR_CHECK(err_code);
+
+    gpiote_init();
+    nrfx_timer_enable(&m_pwm_timer_counter);
+    nrfx_gpiote_in_event_enable(LF_OA_OUT, true);
+}
+
+void lf_125khz_radio_gpiote_disable(void) {
+    nrfx_gpiote_in_event_disable(LF_OA_OUT);
+    nrfx_gpiote_in_uninit(LF_OA_OUT);
+    nrfx_timer_disable(&m_pwm_timer_counter);
+
+    nrfx_err_t err_code;
+    err_code = nrfx_ppi_channel_disable(m_pwm_timer_count_ppi_channel);
+    APP_ERROR_CHECK(err_code);
+}
+
+// init 125kHz signal PWM modulation (use gpiote for ASK & saadc for FSK)
+void lf_125khz_radio_init(void) {
+    if (!m_reader_inited) {
+        pwm_init();
+        pwm_timer_counter_init();
+        pwm_timer_count_ppi_init();
+        pwm_saadc_sample_ppi_init();
+        m_reader_inited = true;
     }
 }
 
-static void saadc_init(void) {
-    nrfx_saadc_uninit();
-
-    ret_code_t err_code;
-
-    nrfx_saadc_config_t config = NRFX_SAADC_DEFAULT_CONFIG;
-    err_code = nrfx_saadc_init(&config, lf_saadc_event_handler);
-    APP_ERROR_CHECK(err_code);
-
-    nrf_saadc_channel_config_t ch_config = NRFX_SAADC_DEFAULT_CHANNEL_CONFIG_SE(NRF_SAADC_INPUT_AIN5);
-    ch_config.acq_time = NRF_SAADC_ACQTIME_5US;
-    err_code = nrfx_saadc_channel_init(0, &ch_config);
-    APP_ERROR_CHECK(err_code);
-
-    err_code = nrfx_saadc_buffer_convert(&samples[next_free_buf_index()][0], SAADC_BUF_SIZE);
-    APP_ERROR_CHECK(err_code);
-
-    err_code = nrfx_saadc_buffer_convert(&samples[next_free_buf_index()][0], SAADC_BUF_SIZE);
-    APP_ERROR_CHECK(err_code);
+// uninitialize
+void lf_125khz_radio_uninit(void) {
+    if (m_reader_inited) {
+        nrfx_ppi_channel_free(m_pwm_saadc_sample_ppi_channel);
+        nrfx_ppi_channel_free(m_pwm_timer_count_ppi_channel);
+        nrfx_timer_uninit(&m_pwm_timer_counter);
+        nrfx_pwm_uninit(&m_pwm);
+        m_reader_inited = false;
+    }
 }
\ No newline at end of file
diff --git a/firmware/application/src/rfid/reader/lf/lf_125khz_radio.h b/firmware/application/src/rfid/reader/lf/lf_125khz_radio.h
index 4b867eb..f452ebf 100644
--- a/firmware/application/src/rfid/reader/lf/lf_125khz_radio.h
+++ b/firmware/application/src/rfid/reader/lf/lf_125khz_radio.h
@@ -1,10 +1,14 @@
-#ifndef LF_125KHZ_RADIO_H_
-#define LF_125KHZ_RADIO_H_
+#pragma once
 
-void lf_125khz_radio_gpiote_init(void);
-void lf_125khz_radio_saadc_init(void);
+#include "ble_main.h"
+
+void lf_125khz_radio_init(void);
 void lf_125khz_radio_uninit(void);
+
+void lf_125khz_radio_saadc_enable(lf_adc_callback_t cb);
+void lf_125khz_radio_gpiote_enable(void);
+void lf_125khz_radio_saadc_disable(void);
+void lf_125khz_radio_gpiote_disable(void);
+
 void start_lf_125khz_radio(void);
 void stop_lf_125khz_radio(void);
-
-#endif
diff --git a/firmware/application/src/rfid/reader/lf/lf_em410x_data.c b/firmware/application/src/rfid/reader/lf/lf_em410x_data.c
index f20d8d0..682fe7a 100644
--- a/firmware/application/src/rfid/reader/lf/lf_em410x_data.c
+++ b/firmware/application/src/rfid/reader/lf/lf_em410x_data.c
@@ -1,4 +1,4 @@
-#include "lf_em410x_data.h"
+#include "lf_reader_data.h"
 
 #include "bsp_delay.h"
 #include "bsp_time.h"
@@ -14,6 +14,8 @@
 #include "nrf_log_default_backends.h"
 NRF_LOG_MODULE_REGISTER();
 
+#define EM410X_BUFFER_SIZE (128)
+
 static circular_buffer cb;
 
 // GPIO interrupt recovery function is used to detect the descending edge
@@ -29,12 +31,13 @@ void gpio_int0_cb(void) {
     clear_lf_counter_value();
 }
 
-void init_em410x_hw(void) {
+static void init_em410x_hw(void) {
     register_rio_callback(gpio_int0_cb);
-    lf_125khz_radio_gpiote_init();
+    lf_125khz_radio_gpiote_enable();
 }
 
-void uninit_em410x_hw(void) {
+static void uninit_em410x_hw(void) {
+    lf_125khz_radio_gpiote_disable();
     unregister_rio_callback();
 }
 
diff --git a/firmware/application/src/rfid/reader/lf/lf_em410x_data.h b/firmware/application/src/rfid/reader/lf/lf_em410x_data.h
deleted file mode 100644
index 161d03b..0000000
--- a/firmware/application/src/rfid/reader/lf/lf_em410x_data.h
+++ /dev/null
@@ -1,25 +0,0 @@
-#ifndef __EM_410X_DATA_H__
-#define __EM_410X_DATA_H__
-
-#include <stdbool.h>
-
-#include "bsp_time.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#define CARD_BUF_BYTES_SIZE 5  // Card byte buffer size
-
-#define RAW_BUF_SIZE 24  // The maximum record buffer
-#define CARD_BUF_SIZE 8  // Card size
-
-#define EM410X_BUFFER_SIZE (128)
-
-bool em410x_read(uint8_t *data, uint32_t timeout_ms);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/firmware/application/src/rfid/reader/lf/lf_hidprox_data.c b/firmware/application/src/rfid/reader/lf/lf_hidprox_data.c
index 715a625..84edaf3 100644
--- a/firmware/application/src/rfid/reader/lf/lf_hidprox_data.c
+++ b/firmware/application/src/rfid/reader/lf/lf_hidprox_data.c
@@ -1,5 +1,3 @@
-#include "lf_hidprox_data.h"
-
 #include <stdio.h>
 
 #include "bsp_delay.h"
@@ -8,8 +6,10 @@
 #include "lf_125khz_radio.h"
 #include "lf_reader_data.h"
 #include "lf_reader_main.h"
+#include "nrfx_saadc.h"
 #include "protocols/hidprox.h"
 #include "time.h"
+#include "rfid_main.h"
 
 #define NRF_LOG_MODULE_NAME lf_read
 #include "nrf_log.h"
@@ -21,23 +21,22 @@ NRF_LOG_MODULE_REGISTER();
 
 static circular_buffer cb;
 
-// saadc irq is used to sample ANT GPIO level.
-void saadc_cb(int16_t *vals, size_t size) {
+// saadc irq is used to sample ANT GPIO.
+static void saadc_cb(nrf_saadc_value_t *vals, size_t size) {
     for (int i = 0; i < size; i++) {
-        uint16_t val = vals[i];
+        nrf_saadc_value_t val = vals[i];
         if (!cb_push_back(&cb, &val)) {
             return;
         }
     }
 }
 
-void init_hidprox_hw(void) {
-    register_saadc_callback(saadc_cb);
-    lf_125khz_radio_saadc_init();
+static void init_hidprox_hw(void) {
+    lf_125khz_radio_saadc_enable(saadc_cb);
 }
 
-void uninit_hidprox_hw(void) {
-    unregister_saadc_callback();
+static void uninit_hidprox_hw(void) {
+    lf_125khz_radio_saadc_disable();
 }
 
 bool hidprox_read(uint8_t *data, uint8_t format_hint, uint32_t timeout_ms) {
diff --git a/firmware/application/src/rfid/reader/lf/lf_hidprox_data.h b/firmware/application/src/rfid/reader/lf/lf_hidprox_data.h
deleted file mode 100644
index 0ba4456..0000000
--- a/firmware/application/src/rfid/reader/lf/lf_hidprox_data.h
+++ /dev/null
@@ -1,19 +0,0 @@
-#ifndef __LF_HIDPROX_DATA_H__
-#define __LF_HIDPROX_DATA_H__
-
-#include <stdbool.h>
-
-#include "bsp_time.h"
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-bool hidprox_read(uint8_t *data, uint8_t format_hint, uint32_t timeout_ms);
-bool hidprox_debug(uint8_t *data, uint32_t timeout_ms);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/firmware/application/src/rfid/reader/lf/lf_reader_data.c b/firmware/application/src/rfid/reader/lf/lf_reader_data.c
index a81a3c3..208fd56 100644
--- a/firmware/application/src/rfid/reader/lf/lf_reader_data.c
+++ b/firmware/application/src/rfid/reader/lf/lf_reader_data.c
@@ -1,9 +1,9 @@
 #include "lf_reader_data.h"
 
-#include "nrf_drv_timer.h"
+#include "nrfx_timer.h"
 
 RIO_CALLBACK_S RIO_callback;
-SAADC_CALLBACK_S SAADC_callback;
+extern nrfx_timer_t m_pwm_timer_counter;
 
 // Register recovery function
 void register_rio_callback(RIO_CALLBACK_S P) {
@@ -14,15 +14,6 @@ void unregister_rio_callback(void) {
     RIO_callback = NULL;
 }
 
-// Register recovery function
-void register_saadc_callback(SAADC_CALLBACK_S P) {
-    SAADC_callback = P;
-}
-
-void unregister_saadc_callback(void) {
-    SAADC_callback = NULL;
-}
-
 // GPIO interrupt is the RIO pin
 void gpio_int0_irq_handler(void) {
     if (RIO_callback != NULL) {
@@ -30,18 +21,10 @@ void gpio_int0_irq_handler(void) {
     }
 }
 
-void saadc_irq_handler(int16_t *val, size_t size) {
-    if (SAADC_callback != NULL) {
-        SAADC_callback(val, size);
-    }
-}
-
-extern nrfx_timer_t m_timer_lf_reader;
-
 // Get the value of the counter
 uint32_t get_lf_counter_value(void) {
-    return nrfx_timer_capture(&m_timer_lf_reader, NRF_TIMER_CC_CHANNEL1);
+    return nrfx_timer_capture(&m_pwm_timer_counter, NRF_TIMER_CC_CHANNEL1);
 }
 
 // Clear the value of the counter
-void clear_lf_counter_value(void) { nrfx_timer_clear(&m_timer_lf_reader); }
+void clear_lf_counter_value(void) { nrfx_timer_clear(&m_pwm_timer_counter); }
diff --git a/firmware/application/src/rfid/reader/lf/lf_reader_data.h b/firmware/application/src/rfid/reader/lf/lf_reader_data.h
index aeab8b3..ef76f50 100644
--- a/firmware/application/src/rfid/reader/lf/lf_reader_data.h
+++ b/firmware/application/src/rfid/reader/lf/lf_reader_data.h
@@ -1,31 +1,26 @@
-#ifndef __READER_IO_H__
-#define __READER_IO_H__
+#pragma once
 
 #include <stddef.h>
 #include <stdint.h>
-
-// #define debug410x
+#include <stdbool.h>
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 typedef void (*RIO_CALLBACK_S)(void);  // Call the function format
-typedef void (*SAADC_CALLBACK_S)(int16_t *, size_t);
 
 void register_rio_callback(RIO_CALLBACK_S P);
 void unregister_rio_callback(void);
-void register_saadc_callback(SAADC_CALLBACK_S P);
-void unregister_saadc_callback(void);
 void gpio_int0_irq_handler(void);
-void saadc_irq_handler(int16_t *val, size_t);
 
 // Counter
 uint32_t get_lf_counter_value(void);
 void clear_lf_counter_value(void);
 
+bool em410x_read(uint8_t *data, uint32_t timeout_ms);
+bool hidprox_read(uint8_t *data, uint8_t format_hint, uint32_t timeout_ms);
+
 #ifdef __cplusplus
 }
 #endif
-
-#endif
diff --git a/firmware/application/src/rfid/reader/lf/lf_reader_main.c b/firmware/application/src/rfid/reader/lf/lf_reader_main.c
index 3911ee6..fc431b7 100644
--- a/firmware/application/src/rfid/reader/lf/lf_reader_main.c
+++ b/firmware/application/src/rfid/reader/lf/lf_reader_main.c
@@ -4,8 +4,7 @@
 #include "bsp_time.h"
 #include "hex_utils.h"
 #include "lf_125khz_radio.h"
-#include "lf_em410x_data.h"
-#include "lf_hidprox_data.h"
+#include "lf_reader_data.h"
 #include "protocols/em410x.h"
 #include "protocols/hidprox.h"
 #include "protocols/t55xx.h"
@@ -26,25 +25,17 @@ uint8_t scan_em410x(uint8_t *uid) {
     if (em410x_read(uid, g_timeout_readem_ms)) {
         return STATUS_LF_TAG_OK;
     }
-    return STATUS_EM410X_TAG_NO_FOUND;
+    return STATUS_LF_TAG_NO_FOUND;
 }
 
 /**
  * Search HID Prox tag
  */
-uint8_t scan_hidprox(uint8_t *data, uint8_t format) {
-    if (hidprox_read(data, format, g_timeout_readem_ms)) {
+uint8_t scan_hidprox(uint8_t *data, uint8_t format_hint) {
+    if (hidprox_read(data, format_hint, g_timeout_readem_ms)) {
         return STATUS_LF_TAG_OK;
     }
-    return STATUS_HIDPROX_TAG_NO_FOUND;
-}
-
-/**
- * Debug HIDProx
- */
-uint8_t debug_hidprox(uint8_t *data) {
-    hidprox_debug(data, g_timeout_readem_ms);
-    return STATUS_SUCCESS;
+    return STATUS_LF_TAG_NO_FOUND;
 }
 
 /**
diff --git a/firmware/application/src/rfid/reader/lf/lf_reader_main.h b/firmware/application/src/rfid/reader/lf/lf_reader_main.h
index a411e92..5a2ac39 100644
--- a/firmware/application/src/rfid/reader/lf/lf_reader_main.h
+++ b/firmware/application/src/rfid/reader/lf/lf_reader_main.h
@@ -1,19 +1,14 @@
-#ifndef __LF_READER_MAIN_H__
-#define __LF_READER_MAIN_H__
+#pragma once
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include "app_status.h"
 #include "lf_125khz_radio.h"
-#include "lf_em410x_data.h"
+#include "lf_reader_data.h"
 
 void set_scan_tag_timeout(uint32_t ms);
-
 uint8_t scan_em410x(uint8_t *uid);
+uint8_t scan_hidprox(uint8_t *uid, uint8_t format_hint);
 uint8_t write_em410x_to_t55xx(uint8_t *uid, uint8_t *newkey, uint8_t *old_keys, uint8_t old_key_count);
-uint8_t write_hidprox_to_t55xx(uint8_t format, uint32_t fc, uint64_t cn, uint32_t il, uint32_t oem, uint8_t *new_passwd, uint8_t *old_passwds, uint8_t old_passwd_count) ;
-uint8_t scan_hidprox(uint8_t *uid, uint8_t format);
-uint8_t debug_hidprox(uint8_t *data);
-
-#endif
+uint8_t write_hidprox_to_t55xx(uint8_t format, uint32_t fc, uint64_t cn, uint32_t il, uint32_t oem, uint8_t *new_passwd, uint8_t *old_passwds, uint8_t old_passwd_count);
diff --git a/firmware/application/src/rfid/reader/lf/lf_t55xx_data.c b/firmware/application/src/rfid/reader/lf/lf_t55xx_data.c
index 769bd10..efcce82 100644
--- a/firmware/application/src/rfid/reader/lf/lf_t55xx_data.c
+++ b/firmware/application/src/rfid/reader/lf/lf_t55xx_data.c
@@ -1,9 +1,7 @@
 #include "bsp_delay.h"
 #include "hex_utils.h"
 #include "lf_125khz_radio.h"
-#include "lf_reader_data.h"
 #include "nrf_gpio.h"
-#include "nrf_sdh_soc.h"
 #include "protocols/t55xx.h"
 #include "timeslot.h"
 
@@ -120,10 +118,11 @@ void t55xx_send_cmd(uint8_t opcode, uint32_t *passwd, uint8_t lock_bit, uint32_t
 }
 
 /**
- * @brief T55XX Write into HIDProx data
+ * @brief generic t55xx write data
  *
- * @param passwd The password for the final encryption (also the current password of the card) (is a pointer, 4 -byte width small end byte sequence storage)
- * @param data After the data of EM410X, you need to call the EM410X_ENCODER calculation
+ * @param passwd the password for the final encryption (also the current password of the card)
+ * @param blks the blocks data to write
+ * @param blk_count the number of blocks to write
  */
 void t55xx_write_data(uint32_t passwd, uint32_t *blks, uint8_t blk_count) {
     // write control bits (blk0) & data (w/wo passwd)
@@ -131,7 +130,6 @@ void t55xx_write_data(uint32_t passwd, uint32_t *blks, uint8_t blk_count) {
         t55xx_send_cmd(T5577_OPCODE_PAGE0, &passwd, 0, &blks[i], i);
         t55xx_send_cmd(T5577_OPCODE_PAGE0, NULL, 0, &blks[i], i);
     }
-
     t55xx_send_cmd(T5577_OPCODE_RESET, NULL, 0, NULL, 0);
 }
 
diff --git a/firmware/application/src/rfid_main.c b/firmware/application/src/rfid_main.c
index 730c0e8..8899b8a 100644
--- a/firmware/application/src/rfid_main.c
+++ b/firmware/application/src/rfid_main.c
@@ -27,7 +27,7 @@ void reader_mode_enter(void) {
         nrf_gpio_pin_clear(HF_ANT_SEL);     // hf ant switch to reader mode
 
         // init reader
-        lf_125khz_radio_gpiote_init();
+        lf_125khz_radio_init();
         pcd_14a_reader_init();
         pcd_14a_reader_reset();
     }
diff --git a/firmware/application/src/utils/timeslot.c b/firmware/application/src/utils/timeslot.c
index 42bced3..9e252a0 100644
--- a/firmware/application/src/utils/timeslot.c
+++ b/firmware/application/src/utils/timeslot.c
@@ -90,7 +90,7 @@ nrf_radio_signal_callback_return_param_t *radio_callback(uint8_t signal_type) {
 }
 
 /**
- * Request a sequence for high -precision operation
+ * Request a sequence for high-precision operation
  */
 void request_timeslot(uint32_t time_us, timeslot_callback_t callback) {
     ret_code_t err_code;
@@ -99,7 +99,7 @@ void request_timeslot(uint32_t time_us, timeslot_callback_t callback) {
     APP_ERROR_CHECK_BOOL(!m_is_timeslot_running);
     m_is_timeslot_running = true;
 
-    m_slot_length = time_us;    //The time for configuration application
+    m_slot_length = time_us;    // The time for configuration application
     m_callback    = callback;   // The configuration time application is applied to the operation after execution
 
     // Open the session
@@ -134,7 +134,7 @@ void request_timeslot(uint32_t time_us, timeslot_callback_t callback) {
     NVIC_EnableIRQ(RTC1_IRQn);
     NVIC_EnableIRQ(MWU_IRQn);
 
-    //Close the session and wait for the closure to complete
+    // Close the session and wait for the closure to complete
     err_code = sd_radio_session_close();
     APP_ERROR_CHECK(err_code);
     while (m_is_timeslot_working) {
@@ -143,8 +143,6 @@ void request_timeslot(uint32_t time_us, timeslot_callback_t callback) {
 
     // The task process is completed and the ending work
     m_is_timeslot_running = false;
-
-    //NRF_LOG_INFO("request timeslot done.");
 }
 
 /**
@@ -183,7 +181,7 @@ void timeslot_start(uint32_t time_us) {
 }
 
 /**
- * Stop high -precision operation
+ * Stop high-precision operation
  */
 void timeslot_stop(void) {
     ret_code_t err_code;
@@ -206,5 +204,4 @@ void timeslot_stop(void) {
 
     // The task process is completed and the ending work
     m_is_timeslot_running = false;
-    //NRF_LOG_INFO("timeslot stop.");
 }
diff --git a/software/script/chameleon_cli_unit.py b/software/script/chameleon_cli_unit.py
index c1938c6..eb58bca 100644
--- a/software/script/chameleon_cli_unit.py
+++ b/software/script/chameleon_cli_unit.py
@@ -466,19 +466,6 @@ class LFHIDIdArgsUnit(DeviceRequiredUnit):
         if oem is not None and oem > limit[3]:
             raise ArgsParserError(f"{HIDFormat(format)}: OEM must between 0 to {limit[3]}")
 
-        """
-        HIDFormat.: [0xFFF, 0x3FFFF, 0x7, 0],
-        HIDFormat.: [0x3FF, 0xFFFFFF, 0, 0x7],
-        HIDFormat.: [0xFFFF, 0xFFFFF, 0, 0],
-        HIDFormat.: [0xFFF, 0xFFFF, 0, 0],
-        HIDFormat.: [0, 0xFFFFFFFFFF, 0, 0],
-        HIDFormat.: [0xFFF, 0xFFFFF, 0, 0x7F],
-        HIDFormat.: [0x3FFF, 0x3FFFFFFF, 0, 0],
-        HIDFormat.: [0x003FFFFF, 0x007FFFFF, 0, 0],
-        HIDFormat.: [0xFFFFF, 0x3FFFFFFFF, 0, 0],
-        HIDFormat.: [0xFFFFFF, 0xFFFFFFFF, 0, 0],
-        """
-
     def before_exec(self, args: argparse.Namespace):
         if super().before_exec(args):
             format = HIDFormat.H10301.value
@@ -3209,9 +3196,9 @@ class LFHIDProxEconfig(SlotIndexArgsAndGoUnit, LFHIDIdArgsUnit):
                 args.il = 0
             if args.oem is None:
                 args.oem = 0
-            if args.format is None:
-                format = HIDFormat.H10301
-            format = HIDFormat[args.format]
+            format = HIDFormat.H10301
+            if args.format is not None:
+                format = HIDFormat[args.format]
             id = struct.pack(">BIBIBH", format.value, args.fc, (args.cn >> 32), args.cn & 0xffffffff, args.il, args.oem)
             self.cmd.hidprox_set_emu_id(id)
             print(' - Set hidprox tag id success.')
diff --git a/software/script/chameleon_cmd.py b/software/script/chameleon_cmd.py
index de7bc93..25d3be7 100644
--- a/software/script/chameleon_cmd.py
+++ b/software/script/chameleon_cmd.py
@@ -434,7 +434,7 @@ class ChameleonCMD:
         """
         resp = self.device.send_cmd_sync(Command.EM410X_SCAN)
         if resp.status == Status.LF_TAG_OK:
-            resp.parsed = struct.unpack('!h5s', resp.data[0:7]) # card type + uid
+            resp.parsed = struct.unpack('!h5s', resp.data) # tag type + uid
         return resp
 
     @expect_response(Status.LF_TAG_OK)
@@ -475,7 +475,6 @@ class ChameleonCMD:
         data = struct.pack(f'!13s4s{4*len(old_keys)}s', id_bytes, new_key, b''.join(old_keys))
         return self.device.send_cmd_sync(Command.HIDPROX_WRITE_TO_T55XX, data)
 
-
     @expect_response(Status.SUCCESS)
     def get_slot_info(self):
         """
diff --git a/software/script/chameleon_enum.py b/software/script/chameleon_enum.py
index dd70e73..082821f 100644
--- a/software/script/chameleon_enum.py
+++ b/software/script/chameleon_enum.py
@@ -137,11 +137,7 @@ class Status(enum.IntEnum):
     # Some operations with low frequency cards succeeded!
     LF_TAG_OK = 0x40
     # Unable to search for a valid EM410X tag
-    EM410X_TAG_NO_FOUND = 0x41
-    # Unable to search for a valid LF tag
-    LF_TAG_NO_FOUND = 0x42
-    # Unable to search for a valid HIDProx tag
-    HIDPROX_TAG_NO_FOUND = 0x43
+    LF_TAG_NO_FOUND = 0x41
 
     # The parameters passed by the BLE instruction are wrong, or the parameters passed
     # by calling some functions are wrong
@@ -176,12 +172,8 @@ class Status(enum.IntEnum):
             return "HF tag was supposed to send ATS but didn't"
         elif self == Status.LF_TAG_OK:
             return "LF tag operation succeeded"
-        elif self == Status.EM410X_TAG_NO_FOUND:
-            return "EM410x tag no found"
         elif self == Status.LF_TAG_NO_FOUND:
             return "LF tag not found"
-        elif self == Status.HIDPROX_TAG_NO_FOUND:
-            return "HIDProx tag no found"
         elif self == Status.PAR_ERR:
             return "API request fail, param error"
         elif self == Status.DEVICE_MODE_ERROR: