UHF-Reader通信协议

合集下载

UHF超高频RFID标准详解空中接口协议（物理层、MAC层）

UHF超高频RFID标准详解空中接口协议（物理层、MAC层）超高频RFID空中接口协议1RFID系统组成RFID(RadioFrequencyIdentificatiON)的基本原理就是将电子标签安装在被识别的物体上，当被标识的物体进入RFID系统的阅读范围时，射频识别技术利用无线电波或微波能量进行非接触双向通信，来实现识别和数据交换功能。

标签向读写器发送携带信息，读写器接收这些信息并进行解码，通过串口将读写器采集到的数据送到后端处理，并通过网络传输给服务器，从而完成信息的全部采集与处理过程，以达到自动识别被标识物体的目的。

RFID应用系统的架构如图1所示，基本由阅读器，天线和标签组成，另外还有后台的企业应用系统。

标签和读写器之间通过耦合元件实现射频信号的非接触耦合。

系统中有一个中间件负责完成系统与多种阅读器的适配，过滤阅读器从标签获得的数据，以减少网络流量。

标签与读写器之间通过空中接口协议进行通讯，读写器与中间件之间的通信通过读写器协议进行定义，中间件与应用系统之间的通信接口由ALE协议规定。

图2为RFID系统阅读器和标签之间的通信过程。

读写器和标签通过射频电磁场进行数据交换。

阅读器首先发送连续载波信号，通过ASK调制等方式发送各种读写命令，标签通过反向散射调制的方式响应阅读器发出的命令，返回EPC(电子产品编码)等信息。

2空中接口协议如图1所示，RFID系统涉及的协议从底层通讯到上层应用都有各自的规范，根据标签的供电方式不同，RFID系统可分为有源系统和无源系统两种;根据系统工作的频段不同，可分为低频，高频，超高频和微波频段的RFID系统。

论文主要讨论超高频段无源RFID空中接口协议部分的关键技术。

当前超高频RFID空中接口协议主要是ISO18000-6TYPEB协议和EPCGlobalClass1GEN2协议(EPCC1GEN2协议，现已经成为ISO18000-6TYPEC)。

两种协议的对比如表1所示。

实验2、HF高频RFID通讯协议

实验二、HF高频RFID通信协议一、实验目的1.1 掌握高频读卡器的通讯协议1.2 掌握本平台高频模块的操作过程1.3 掌握高频模块工作原理二、实验设备硬件：RFID实验箱套件，电脑等。

软件：Keil，串口调试助手。

三、实验原理2.1高频RFID系统典型的高频HF（12.56MHz）RFID系统包括阅读器（Reader）和电子标签（Tag，也称应答器Responder）。

电子标签通常选用非接触式IC卡，全称集成电路卡又称智能卡，可读写，容量大，有加密功能，数据记录可靠。

IC卡相比ID卡而言，使用更方便，目前已经大量使用在校园一卡通系统、消费系统、考勤系统、公交消费系统等。

目前市场上使用最多的是PHILIPS的Mifare系列IC卡。

读写器（也称为“阅读器”）包含有高频模块（发送器和接收器）、控制单元以及与卡连接的耦合元件。

由高频模块和耦合元件发送电磁场，以提供非接触式IC 卡所需要的工作能量以及发送数据给卡，同时接收来自卡的数据。

此外，大多数非接触式IC卡读写器都配有上传接口，以便将所获取的数据上传给另外的系统（个人计算机、机器人控制装置等）。

IC卡由主控芯片ASIC（专用集成电路）和天线组成，标签的天线只由线圈组成，很适合封状到卡片中，常见IC卡内部结构如图2.1所示。

图2.1 IC卡内部结构图较常见的高频RFID应用系统如图2.2所示，IC卡通过电感耦合的方式从读卡器处获得能量。

下面以典型的IC 卡MIARE1为例，说明电子标签获得能量的整个过程。

读卡器向IC 卡发送一组固定频率的电磁波，标签内有一个LC 串联谐振电路（如图2.3），其谐振频率与读写器发出的频率相同，这样当标签进入读写器范围时便产生电磁共振，从而使电容内有了电荷，在电容的另一端接有一个单向通的电子泵，将电容内的电荷送到另一个电容内储存，当储存积累的电荷达到2V 时，此电源可作为其他电路提供工作电压，将标签内数据发射出去或接收读写器的数据。

UHF读写器用户手册说明书

UHF Reader User Manual2E-26562E-2657Contents1. Model Parameter: (3)2. Model Package: (3)3. Wiring Diagram: (4)3.1 Example with Anson Controller (5)3.2 Connect to Ground: (5)4. Installation: (5)4.1 Installation 1 example: (6)4.2 Mounting reader and height adjustment (6)4.3 Reader Installation Angle Adjustment (7)4.4 Installation Example-Parking Lot (7)4.5 Tag position in vehicle (8)5. Application: (9)6. Quick Start for Software (9)6.1 Connect reader With PC (9)6.1.1 RS232 Communication (10)6.1.2 TCP/IP Communication (10)6.2 Basic Settings: (12)6.2.1 Wiegand Parameter Input Zone: (12)6.2.2 Basic Parameters Input Zone: (12)6.2.3 Freq Parameters Input Zone: (14)6.2.4 Senior Parameter Input Zone: (14)6.2.5 Active Encrypt Function (14)6.2.6 . Get Parameter (17)6.2.7 Set Parameter (17)6.2.8 Default All (17)6.2.9 Net Initialize (17)6.3.10 WIFI Initialize (17)6.3 Senior Settings (17)6.4 EPC Read and Write (18)6.5 ISO1800-6B Read and Write (19)7. Notice (20)1. Model Parameter:2. Model Package:In the package include one reader, 1 RS232 Serial port ， 12V adapter and the antenna bearer. When you open the box, please check the spare parts, if with any question, please contact distributor or sales department.See below picture for the inside package and separate products picture(2E -2656).RS232/485 RS232/4851-15mDescription PictureDeviceRS232 Serial PortCable12V AdapterAntenna Bearer3. Wiring Diagram:Description Model Wire No. Color Function1 Red DC9-15Positive 2E-2656/57V2 Black GND Negative 2E-2656/573.1 Example with Anson Controller3.2 Connect to Ground:In case you use the external power supply for the UHF reader, then you must have acommon ground with controller, or will cause unknown problems.4. Installation:In general there are two installation ways of UHF reader, see blow picture 1 and 2.7 2E-2656/572E-2656/57PIN58 Grey Trigger/ 2E-2656/57 9 Orange 485+ / 2E-2656/57 10 Purple 485-/ 2E-2656/57TCP/IP UHF reader without Grey, orange and purple cable. 4 Green Data0 Wiegand D0 5 Yellow TXD RS232 PIN26BrownRXDRS232 PIN32E-2656/577 Blue GND RS232 GND 3 White Data1 Wiegand D12E-2656/572E-2656/57(1) (2)Installation 1 will be easy for installation, but distance will be less than installation 2, installation 2 will be more difficult for installation.4.1 Installation 1 example:4.2 Mounting reader and height adjustmentFor installation 1, the mounting pole diameter should be 50-60mm, height should be 2.2m, we suggest to use the stainless steel material(thickness greater than 1.2mm), use the bearer inside the reader box to fix into pole top, and adjust the height from reader center position to road according to vehicle type, in general the height is 1.8-2.2m.For installation 2,the L type mounting pole diameter should be 60-80mm, the cross beam diameter should be 50-60mmmm, and we suggest to use the stainless steel material(thickness should be 1.2mm-2mm).Use the bearer inside the reader box to fix into pole top and adjust the height from reader center position to road according to vehicle type, in general the height is 3.5-4m.4.3 Reader Installation Angle AdjustmentSee below picture 3 and 4 for reference adjust angle for reader.3 44.4 Installation Example-Parking LotPrincipal to install the reader:（1）Reader and barrier gate linear distance no go across 1m.（2）Between reader and tag, no items covered.（3）Distance between reader and control panel or PC distance we suggest as closer as possible and install shielded communication cable.（4）For detailed installation please according to real situation.Reader close to barrier, and make sure the sensing area can cover the ground sensor,See below picture.4.5 Tag position in vehicleIn general, the parking devices are installed in the left side of the lane, then the tag should be stick in the position of below picture showed.For small vehicle, we suggest A, B and C position, for big truck or big bus, we suggest D, E and F position. The principal of the tagposition is not cover the eyesight of driver.Suggest Position: If reader install in left side, then suggest A and E position. If reader install in the top, then suggest B and F, if reader install in right side, then we suggest C and D position.Tag installation when vehicle windshield with metal UV film:（1） Original UV film: According to European standard, Position B willreserve2E-2656 is 1-6m, 2E-2657 is 1-15m. And the vehicle speed should less than 15km/h.120m*70mm space(no contain metal) for RFID stickers. When install the tag, just install in the B position.（2）Self-stick UV film: Cut a space 120*70mmm special for RFID stickers.We suggest B,D or E position.（3） Use anti-metal tags, install in the car license plate.（4） Manual hold the RFID card to read.Correct Hold Card Wrong Hold Card5. Application:(1) Transport Control:(2) Vehicle Management(3) Parking Management(4) Access Control Management(5) Product Anti-fake Detection(6) Anti-thief Management6. Quick Start for SoftwareThe UHF reader with software to read and write the tags and cards, as well to adjust the basic parameter of the reader.6.1 Connect reader With PCThere are two mode of reader, one is TCP/IP and RS232 communication, the other is RS232 communication only.6.1.1 RS232 CommunicationThere are two client in software package, on is RFIDDemo3203.exe other is Netconfig.exe. For RS232 communication device, just open RFIDDemo3203.exe client.See below.Please ensure serial port of reader connect with PC, and select correct port in PC, then select baud rate, then click connect.6.1.2 TCP/IP CommunicationFor TCP/IP communication, you need open two client, Netconfig.exe and RFIDDemo3203.exe. Netconfig.exe to get the IP address and port of connected UHF reader. You can open it by click broadcast.1.See blow procedure 1, click broadcast to get the IP of uhf reader.2.And input the detected IP, but make sure that your pc and the address at the same LAN, be simple, you can ping the IP, see procedure 2.3.Then click “Connect” to connect the reader.4. If communication OK, see below6.2 Basic Settings:6.2.1 Wiegand Parameter Input Zone:It is mainly related to Wiegand output interface. Only communication mode is Wiegand26 or Wiegand34 available.Byte Offset：The byte of card number to be offset, there is a initial position when read card number. To change the initial position, for example Wiegand 26,output 3 byte, but 18600-6B card number (E0 01 02 03 04 05 06 07) i s 8 byte, the parameter is this 3 byte, when the value is 0, it is (E0 01 02), when the value is 1, It is (01 02 03)... More details, please refer to Wiegand protocol.Output Period: It is frequency of Wiegand port. More details, please refer to Wiegand protocol. Pulse Width: It is the time length of Wiegand signal.Pulse Period: It is interval time that from first low pulse to next low pulse sending. For details, please refer to Wiegand protocol.Note: In general, user only need set byte offset, other setup is default.6.2.2 Basic Parameters Input Zone:Work Mode:It includes 3 items:Active , Passive and Response modeActive: Reader keep reading card, and transmit each of card number by communication port (apply to active upload data).Passive: Reader keep reading card, and each of card number store in reader, but do not upload card number,the max. storage is 100pcs (apply to passive upload). 3. Response: Reader do not read card, reader response according difference commands. For example, PC send a recognize card command, reader will read a time and reply card number to PC (apply to short distance read and write card, test).Output Mode:It includes RS232, TCPIP, CANBUS, Wiegand26 and Wiegand34.RS232: Serial port communication mode, It connects with PC serial port directly and point to point mode.TCPIP：Network communication mode, it communicate with PC by LAN or WAN. CANBUS：BUS communication mode, it is point to multiple mode.Wiegand26：It is standard reader communication mode, one-way communication mode. Wiegand34 ：It is standard reader communication mode, one-way communication mode.Read Interval:The speed of reading card.Note: read card interval must more than 10ms. If read card interval is too short, it will short lift of the reader.Power Size: The max. value is 30.Trigger:1. Close: Close trigger mode to read card.2. Low Trigger: When trigger lead (gray wire) connect with low power (OV), reader power on, when trigger lead (gray wire) connect with high power (12V), reader power off.Note: When Trigger mode is Close, trigger lead must connect with high power or low power and can not be dangling.Same ID Interval:When reader read a same card continuously, reader only upload one data. The read interval can be set at here, and if the read time is over set interval, reader will upload continuously. Buzzer: When reader read card, the buzzer beep or not.Buzzer:It includes disable and enable, disable mean turn off the buzzer, when read card, no beep, enable mean turn on the buzzer, when read card, with beep.Card Type:1. ISO18000-6B：Only read ISO18000-6B protocol tag.；2. EPC （GEN 2 ）Single – Tag ：Only read EPC（GEN 2）protocol tag, read one tag one time. Reader hard to or not read multiple tags when put them in the effective range.3. EPC （GEN 2 ）Multi – Tag：Only reader EPC （GEN 2 ）protocol tag, multi-tag can be read.4. EPC （GEN2 ）Multi –Data：Only read EPC （GEN 2 ）protocol tag,except read default EPC area 12 bytes data, other area data can be read. (Select this type and set to read the length of other area data in senior parameter, the max. Is 12 bytes)5. ISO18000-6B + EPC （GEN 2 ）: ISO18000-6B and EPC （GEN 2 ）protocol tag can be read.Freq Parameters Input Zone It refer to 18000-6b and EPC card, normally hopping need be selected.6.2.3 Freq Parameters Input Zone:It refer to 18000-6b and EPC card, normally hopping need be selected.6.2.4 Senior Parameter Input Zone:It is used for multiple channel reader (split reader), integrative reader default is antenna 6.2.5 Active Encrypt FunctionFor this version software, the encrypt function is hided, to enable the encrypt function, please see below procedure.1) Press”F8” 5 Time s2) Choose then “Enabled”, and set password, then set Parameters [Set Para].3) Now, put the tag on the reader, the reader is not beep;4) Presses “Encrypt Tag”, until the reader beep, then enc rypt succeed;Note: when the encrypt tag, you can move the tag to accelerate the process of encryption;6.2.6 . Get ParameterClick “Get Para” button, parameter of the reader can be acquired. Acquire parameter succeed if display green in status bar; Acquire parameter failure if display red in status bar.(Do not read card when acquire parameter)6.2.7 Set ParameterWhen change parameter in demonstration area, click “Set Para” button, updated data will be set in currently reader. Setup succeed if display green in status bar; Setup failure if display red in status bar.6.2.8 Default AllClick “ Default All” button, basic parameter and senior parameter will recover to default. (Need to click “parameter setup”, updated parameter will be set in reader).6.2.9 Net InitializeNull6.3.10 WIFI InitializeNull6.3 Senior SettingsSenior settings is mainly setup the TCP/IP reader parameter, such as IP address, Syris config and time config etc.TCP/IP config: User can modify the TCP/IP uhf readerSYRIS Config: It is to set Syris SN and Syris ID.Time Config: It is to set reader time.Soft Config: In general can ignore the function, soft reset, is reset the device by software.6.4 EPC Read and WriteThe module is used to read and write the EPC card number. when you click the module, will show below picture interface.Identify：When click, the card in the reader Hex number will display here.Read: When click read, the related address and length Hex number will display, for example the card number is 01-02-03-04-05-06-08-09-10-11-12,Address 2, length 2: 01-02, length is 3, then 01-02-03Address 3., length 2:03-04Address 4, length 2: 05-06...Write: When click write, will write the related Hex to related address.For example the card number is 01-02-03-04-05-06-07-08-09-12-10Address is 2 and length is 2, and write 02-01 to the address, then the card no. Become 02-01-03-04-05-06-07-08-09-10-11-12If write to address 3 and the length is 2.Then card number become 01-02-02-01-05-06-08-09-10-11-126.5 ISO1800-6B Read and WriteFor this module is to read and write 1800-6B card number.Identify：When click, the card in the reader Hex number will display here.Read: When click read, the related address and length Hex number will display, for example the card number is E0-04-00-00-3F-0B-22-07-00-00-00-00,Address 0, length 2: E0-04, length is 3, then E0-04-00Address 1., length 2:04-00Address 2, length 2: 00-00...Write: When click write, will write the related Hex to related address.For example the card number is E0-04-00-00-3F-0B-22-07-00-00-00-00,Address is 0 and length is 2, and write 01-02 to the address, then the card no. Become 01-02-00-00-3F-0B-22-07-00-00-00-00,If write to address 1 and the length is 2.Then card number become E0-01-02-00-3F-0B-22-07-00-00-00-007. Notice1. When reader is working, the operator should away from reader 30cm to satisfy the FCC RF requirement.2. Reader must away from the high he strong magnetic field3. When reader use external power supply, must connect the common ground with the controller or the device you connect with.4. For the reader, we suggest 9-15v power supply, you’d better use the power supply we supply or appropriate voltage power supply.5. Mount the reader on a round pole or flat surface when you do installation.6. Connect all the wire as wiring diagram suggest.。

UHF电子标签读写模块UHFReader用户手册V

UHF电子标签读写模块UHFReader86用户手册V1.10目录一、通讯接口规格 (1)二、协议描述 (1)三、数据的格式 (2)1. 上位机命令数据块 (2)2. 读写模块响应数据块 (2)四、操作命令总汇 (4)1. EPC C1 G2（ISO18000-6C）命令 (4)2. 读写模块自定义命令 (4)五、命令执行结果状态值 (5)六、电子标签返回错误代码 (9)七、标签存储区及需要注意的问题 (9)八、操作命令详细描述 (10)8.1 命令概述 (10)8.2 EPC C1G2命令 (10)8.2.1 询查标签 (10)8.2.2 读数据 (12)8.2.3 写数据 (14)8.2.4 写EPC号 (15)8.2.5 销毁标签 (15)8.2.6 设定存储区读写保护状态 (16)8.2.7 块擦除 (18)8.2.8 读保护设置(根据EPC号设定) (19)8.2.9 读保护设置(不需要EPC号) (20)8.2.10 解锁读保护 (21)8.2.11 测试标签是否被设置读保护 (21)8.2.12 EAS报警设置 (22)8.2.13 EAS报警检测 (23)8.2.14 询查单张标签 (23)8.2.15 块写命令 (23)8.2.16 读取Monza4QT工作参数 (25)8.2.17 设置Monza4QT工作参数 (26)8.2.18 指定掩码扩展读数据 (27)8.2.19 指定掩码扩展写数据 (28)8.2.20 带缓存询查 (30)8.3读写模块自定义命令 (32)8.3.1 读取读写模块信息 (32)8.3.2 设置读写模块工作频率 (33)8.3.3 设置读写模块地址 (34)8.3.4 设置读写模块询查时间 (34)8.3.5 设置串口波特率 (34)8.3.6 调整功率 (35)8.3.7蜂鸣器设置 (35)8.3.8 GPIO控制命令 (36)8.3.9 读取GPIO状态 (36)8.3.10 读写模块唯一序列号获取 (36)8.3.11 标签自定义功能设置 (37)8.3.12 设置缓存的EPC/TID长度 (37)8.3.13 获取缓存的EPC/TID长度 (37)8.3.14缓存数据获取 (38)8.3.15清缓存 (39)8.3.16 查询缓存区标签数量 (39)一、通讯接口规格读写模块通过UART或者USB接口与上位机串行通讯，按上位机的命令要求完成相应操作。

UHFReader18.DLL动态连接库使用手册

UHFREADER18.DLL动态连接库使用手册V2.01.操作系统： (1)2.函数详单： (1)2.1）通用函数： (1)2.2）EPCC1-G2协议函数： (2)2.3）18000-6B协议函数： (4)3.函数的描述： (5)3.1)通用函数： (5)3.1.1) AutoOpenComPort():自动连接串口 (5)3.1.2) OpenComPort()：连接到指定串口 (6)3.1.3) CloseComPort():关闭串口连接 (7)3.1.4) CloseSpecComPort()：关闭指定串口 (7)3.1.5)GetReaderInformation():获得读写器的信息 (7)3.1.6) WriteComAdr()：写入读写器地址 (8)3.1.7) WriteScanTime()：设置询查命令最大响应时间 (8)3.1.8) SetPowerDbm()：设置读写器功率 (9)3.1.9) Writedfre()：设置读写器工作频率 (9)3.1.10) Writebaud()：设置串口波特率 (10)3.1.11) SetWGParameter()：设置韦根参数 (10)3.1.12) SetWork Mode()：设置工作模式 (11)3.1.13) GetWork ModeParameter ()：读取工作模式参数 (12)3.1.14) ReadActiveModeData ()：读取主动模式数据- (12)3.1.15) SetAccuracy():EAS检测精度测试 (13)3.1.16) SetOffsetTime ():Syris响应偏置时间设置 (13)3.1.17) SetFhssMode ():设置读写器跳频模式 (13)3.1.18) GetFhssMode ():获取读写器跳频模式。

(14)3.1.19) SetT riggerTime():触发延时设置。

UHFReader18.DLL动态连接库使用手册

(14)3.1.19) SetT riggerTime():触发延时设置。

玖锐技术UhfReader_DEMO 使用手册new

J IURAY U HF R EADER_DEMO使用手册深圳市玖锐技术有限公司深圳市南山区高新科技园区TEL:0755-********Web：目录Jiuray UhfReader_DEMO使用手册 (3)1 简介 (3)2硬件说明 (3)2.1硬件接口说明 (3)2.2 硬件使用说明 (4)2.2.1外部触发方式 (4)2.2.2串口控制模式 (5)3 软件驱动安装说明 (5)3.1 运行环境 (5)3.2 安装驱动程序 (5)4Jiuray UhfReader_DEMO软件界面说明 (7)4.1 读写器通讯 (7)4.2 参数设置 (8)4.3 EPC数据读/写 (8)4.4 Select操作 (9)4.5 其他操作 (10)4.6 帮助 (11)5Jiuray UhfReader_DEMO功能说明 (12)5.1 读写器通讯 (12)5.1.1 串口连接 (12)5.1.2 网口连接 (13)5.1.3 通讯类型 (13)5.2参数设置 (14)5.2.1 输出功率 (14)5.2.2 工作频率 (14)5.2.3 频率说明 (15)5.2.4 设备状态 (15)5.3 EPC数据读/写 (16)5.3.1 标签识别 (16)5.3.2 ACCESS操作 (16)5.3.3 写EPC (18)5.3.4 锁定操作 (19)5.3.5 销毁操作 (19)5.3.6 循环校验 (19)5.4 Select 操作 (20)5.4.1 【添加 Select】 (20)5.4.2 【删除 Select】 (20)5.4.3 【选择 Select】 (20)5.4.4 【读取 Select】 (21)5.5 其他操作 (22)5.6帮助 (23)5.7 界面操作 (24)5.7.1【保存记录】 (24)5.7.2【清空记录】 (24)5.7.3【退出】 (24)6Jiuray UhfReader_DEMO上层API 说明 (25)6.1 DemoPublic.cs文件说明 (25)6.2 PublicFunction.cs文件说明 (25)Jiuray UhfRead er_DEMO使用手册1 简介Jiuray UhfReader_DEMO是玖锐技术超高频读写器模块体验包的演示程序。

UHFRFID指令集和通讯协议-AS3992protocol

UHFRFID指令集和通讯协议-AS3992protocolE l e c Ki t sAS3992 ProtocolSupport Uart and USB versionElecKits UHF RFID Reader ModuleElecKits Technologies, Inc.E l e c Ki t sAfter connecting the USB version reader to the computer it is automatically installed as a HID (Human Interface Device). The HID protocol defines different reports. Every report has its own report ID, length and a definition if it is an IN- or OUT-report. A report starts with a report ID.1. Command-FrameAs mentioned before a frame starts with the report ID. The report ID is also called command in this documentation. The second byte is the length of the frame (the ID and the length bytes are included in the length).Byte 1Byte 2Variable length Report ID Frame Length PayloadTable 1: Command frame2. Error ByteSome commands from the controller to the host include an error byte:0x00No Error0x80-0xFF Look at the EPC Specification for more information 0xFFNo response from the Tag (time out)Table 2: Error ByteIf the tag does not respond, the cause might be that the tag is no longer in the field or a communication error. For more information please refer to the EPC specification [EPC 2005] or Annex A below. Error-Code SupportError Code Error-Code NameNo reply error from Tag1000 0000Other errorCatch-all for errors not covered by othercodes 1000 0011Memory overrun or unsupported PC valueThe specified memory location does not exist or the PC value is not supported bythe tag1000 0100 Memory locked The specified memory location is lockedand/or perm locked and is either notwriteable or not readableError-specific1000 1011Insufficient power The tag has insufficient power to perform the memory-write operationE l e c Ki t sNon-specific 1000 1111 Non-specific error The tag does not support error-specificcodesno Reply1111 1111No reply error from Tag The Tag has not replied to the reader commandTable 3: Annex A Error Codes3. Memory BankSome commands contain the tag's memory bank: Memory Bank Value Implementation state for Firmware MEM_RES 0x00 Implemented since 0.0.6 MEM_EPC 0x01 Implemented MEM_TID 0x02 Implemented since 0.0.6 MEM_USER0x03Implemented since 0.0.6Table 4: Memory Bank4. Reports(Commands)Only the following reports are implemented. There are enough other values for additional new reports (value 0 is reserved and the maximum value is 0xFF). OUT stands for a report from the host to the controller and IN means a report from the controller to the host.Reportvalue Report value OUT_FIRM_HARDW_ID 0x10 OUT_KILL_TAG 0x3D IN_FIRM_HARDW_ID 0x11 IN_KILL_TAG 0x3E OUT_DEVICE_INFO 0x12 OUT_INVENTORY_6B_ID 0x3F IN_DEVICE_INFO 0x13 IN_INVENTORY_6B_ID 0x40 OUT_CPU_RESET 0x16 OUT_CHANGE_FREQ 0x41 OUT_ANTENNA_POWER 0x18 IN_CHANGE_FREQ 0x42 OUT_WRITE_REG 0x1A OUT_INVENTORY_RSSI 0x43 IN_WRITE_REG 0x1B IN_INVENTORY_RSSI 0x44 OUT_READ_REG 0x1C OUT_NXP_COMMAND 0x45 IN_READ_REG 0x1DIN_NXP_COMMAND 0x46 OUT_INVENTORY 0x31 OUT_WRITE_TO_TAG_6B_ID 0x47 IN_INVENTORY 0x32 IN_WRITE_TO_TAG_6B_ID 0x48 OUT_SELECT_TAG 0x33 OUT_READ_FROM_TAG_6B_ID 0x49 IN_SELECT_TAG 0x34 IN_READ_FROM_TAG_6B_ID 0x50 OUT_WRITE_TO_TAG 0x35 OUT_FIRM_PROGRAM_ID 0x55 IN_WRITE_TO_TAG 0x36 IN_FIRM_PROGRAM_ID 0x56 OUT_READ_FROM_TAG 0x37OUT_REGS_COMPLETE_ID 0x57E l e c Ki t sIN_READ_FROM_TAG 0x38 IN_REGS_COMPLETE_ID 0x58 OUT_LOCK_UNLOCK 0x3B OUT_GEN2_SETTINGS_ID 0x59 IN_LOCK_UNLOCK0x3C IN_GEN2_SETTINGS_ID 0x5aTable 5: Report ListIt is advised to send the reports always with the maximal report length of 64 bytes. Most reports are already defined in the descriptor with the maximal length. The others may change in future. Windows truncates longer reports and discards shorter reports!5. Reader-Oriented CommandsThis command does not start a communication with the tags. They are usable for configuring the microcontroller and/or the AS399X and for getting (some) information.Serial communication port (UART) configuration (initialization): Parameter ConfigurationPort COMx (this is serial communication port connecting to RFID reader) Baud Rate 115200 Check bit NONE Data bits 8 Stop bits1Table 6: InitializationPower-on reset or click reset switch S1, the serial port debugging tool show (see Figure 1):Hello 20110324 World INTVCO_lwmLwm_as399xInitialize () returned 0000E l e c Ki t sFigure 1.5.1 Command Send Firm-/Hardware IDThis command is used to read out the reader’s firmware and hardware ID. The command sent from the host to the microcontroller looks the following way:Byte 0/ID Byte 1Byte 20x10 FRAME LengthFirm-/HardwareTable 7: Command frame: Send Firm-/Hardware ID from host.With byte 3 the host can select the ID which the microcontroller shall return:value ID 0x00 Firmware 0x01Hardware Table 8: Firmware-/Hardware ID byte (Byte 2).The command sent to the host has the following form: Byte 0/ID Byte 1Variable length but maximum 64 bytes 0x11Frame LengthstringTable 9: Command frame: Send Firm-/Hardware ID from microcontroller.Ec. Software version indentify commandSend: 10 03 00E l e c Ki t sReceive: 11 23 41 53 33 39 39 31 20 4D 69 6E 69 20 52 65 61 64 65 72 20 46 69 72 6D 77 61 72 65 20 31 2E 35 2E 31 (select the Show Hex)Or receive: 0x11_AS3991 Mini Reader Firmware 1.5.1 (not select the Show Hex)To achieve through the software key on the serial port debugging tool. Hardware version indentify command Send: 10 03 01Receive: 11 22 41 53 33 39 39 31 20 52 4F 47 45 52 20 52 65 61 64 65 72 20 48 61 72 64 77 61 72 65 20 31 2E 32Or receive: 0x11_AS3991 ROGER Reader Hardware 1.2To achieve through the hardware key on the serial port debugging tool.Figure 2.To the software key, the codes are as follows:void CGpsDlg::OnButtonSoftware() {// TODO: Add your control notification handler code here BYTE buf[] = {0x10,0x03,0x00}; CByteArray hexdata;this->m_Function.ByteToByteArray(buf,sizeof(buf),hexdata); this->m_CommCtrl.SetOutput(COleVariant(hexdata)); } To the hardware key, the codes are as follows:E l e c Ki t svoid CGpsDlg::OnButtonHardware() {char Send_str[]={0X10,0X03,0X01}; CByteArray hexdata; //buffer how to into cbytearraythis->m_Function.ByteToByteArray((BYTE*)Send_str,sizeof(Send_str),hexdata);this->m_CommCtrl.SetOutput(COleVariant(hexdata)); }5.2 Command Antenna PowerTo change the antenna power uses this command. Command from host: Byte 0/ID Byte 1Byte 20x18Frame lengthAntenna power Table 10: Command frame: Antenna Power from hostWith byte 3 the host can select the antenna output power: Value Antenna Power 0x00Power OFF0x01 - 0xFE Reserved to change the output level in later versions. 0xFFPower ONTable 11: Antenna Power ByteResponse from microcontroller: Byte 0/ID Byte 1Byte 2 0x19Frame lengthRfuTable 12: Command frame: Write Register from controllerByte 2 is reserved for further use.Ec. Send: 18 03 00Receive: 19 03 00Now the microcontroller can not communicate with the tags. This command acts as a switch of antenna control.5.3 Command Write RegisterThe write register command can be used to directly manipulate the AS399XE l e c Ki t sregisters.Command from host: Byte 0/ID Byte 1 Byte 2Byte 3 (Byte 4 & 5 optional) 0x1A FramelengthRegister AddressDataTable 13: Command frame: Write register from host.If data is longer than one byte the data is written into one of the 3 bytes deep register.Response from microcontroller:Byte 0/ID Byte 1 Byte 20x1B Frame length Error byteTable 14: Command frame: Write Register from controllerThe controller sends back an error byte if anything goes wrong.Ec. Send: 1A 04 08 00Receive: 1B 03 00 No errorRX Wait Time (08)5.4 Command Read RegisterTo read directly an AS399X register, use this command. Command from host:E l e c Ki t sByte 0/ID Byte 1Byte 20x1C Frame length Register AddressTable 15: Command frame: Read register from host.If one of the 3 bytes deep registers is selected the controllersends back 3 bytes data.Response from microcontroller: Byte 0/ID Byte 1Byte 2 (Byte 3 & 4 optional) 0x1DFrame lengthDataTable 16: Command frame: Read register from microcontroller.Ec. Read the RX Wait Time register,Send: 1C 03 08 Receive: 1D 06 00 00 00 00 Write to it,Send: 1A 04 08 07 Receive: 1B 03 00 Read again,Send: 1C 03 08 Receive: 1D 06 07 00 00 005.5 Command Change FrequencyTo change the frequency of the reader and to get the reflected power or the RSSI value of the channel, use this command.Command from host: Byte 0/ID Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 0x41 FramelengthMASK Freq low Byte freq mid Byte freq high Byte RSSIlevelTable 17: Command frame: Read register from host.With the mask byte, it is possible to select either the RSSI value that isscanned with no carrier (LBT) or the reflected power that is received with activated carrier.Mask 0x00: No specific value; - measurement skipped no valid dates in response Mask 0x01: RSSI scanMask 0x02: reflected power scanMask 0x04: turn hop mode on; - add the frequency to the List Mask 0x08: turn hop mode off clear the List Mask 0x10: setLBT parameters Byte0/IDByte 1 Byte 2 Byte 3Byte 4 Byte 5 Byte 6 Byte 7 Byte 8 0x41 Frame 0x10 listening listeningmaxmaxidleidleE l e c Ki t slengthTime low Time high SendingTime low SendingTimehigh Timelow Time highTable 18: Command frame.The frequency is transmitted in kHz: that means 868000 means 868 MHz.With the RSSI value in dBm you can define the LBT border which is used in the hop mode.Response from microcontroller: Byte 0/ID Byte 1Byte 2 Byte 3 0x42Frame LengthData XData YTable 19: Command frame: Get data after set frequencyYou can change the frequency of the reader using this command. The frequency profiles for different countries are shown in the following table:Profile Start freq[khz] End freq [khz]Increme nt [khz]RSSI Threshold [dBm]ListenTime [ms] Idle Time [ms] Max. Allocation [ms] Europ e 865,700 0x0d35a4 867,500 0x0d3cac 600 0x0258 -40 0xd8 1 10000 Japan 952,400 952,600 200 -87 10 100 4000 USA902,750 0x0dc65e 927,250 0x0e2612 500 0x01f4 -40 0xd8 1 0 400 China 920.625 920,625 924,375750 -40110000China 840.125 840,125844,875250-40110000Korea917,300920,300600-40110000Table 20: Frequency ProfilesSpecific European frequency: 865700 khz 866300 khz 866900 khz 867500 khz 0x0d35a40x0d37fc0x0d3a540x0d3cacThe existing frequency profiles are defined in a CSV (Comma Separated Values) file within the installation directory (e.g. C:\Program Files\AS399x Reader Suite). The “profiles.csv” file can be modified if the user may want to add a new frequency profile by adding a new line. The syntax for adding a new profile is defined as follows:E l e c Ki t sName,StartFreq,StopFreq,Increment,dBm,listenTime,IdleTim e,maxAllocationTi meFor example the European frequency profile is defined as: Europe,865.7,867.5,0.6,-40,1,0,10000Besides changing the frequency profile the user may change each frequency related parameter individually.Ec. Send: 41 08 08 AC 3C 0D D8 01Receive: 42 40 FE FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Value Meaning0x41 Command Frequency change ID0x08 Frame Length0x08Turn hop mode off clear the List0xAC 0x3C 0x0DThe frequency of the reader you want,867.5Mhz0xD8 RSSI Threshold,-40 dBm0x01Profile No.Notes: After this command is sent, the reader will work at the frequency you set. The reader does not work in the hop mode, it works at a fixed frequency.Send: 41 08 04 54 3A 0D D8 01Receive: 42 40 FC FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00Value Meaning0x41 Command Frequency change ID0x08 Frame Length0x04 turn hop mode on; - add the frequency to the List 0x54 0x3A 0x0DThe frequency of the reader you want to add to thelist,866.9Mhz 0xD8 RSSI Level,-40 dBm0x01 Profile0x42 Answering sends 0x410xFE Answering sends 0x08, hop mode off 0XFCAnswering sends 0x04, hop mode onNotes: After this command is sent, the reader will work in the hop mode, it works at the frequency that hops between 867.5Mhz and 866.9Mhz. You canE l e c Ki t scontinue to add new frequency to the list accordingly. Use the serial port debugging tool:Click ReadSetting button, check box ShowHex, pop AdvanceReaderSettings dialog box, select Europe in the profile list box, click the OK button, see below:Figure 3.Codes are as follows:void CGpsDlg::OnButtonReadsettings() {// TODO: Add your control notification handler code here if(this->m_ReadSettingsDlg.DoModal()==IDOK) {//UINT freqs[50];//usa frequency numbers UINT start,end,increment,freq; // unsigned char mode =8; m_mode = 8; start = this->m_ReadSettingsDlg.m_StartFreq;//KHZ end = this->m_ReadSettingsDlg.m_EndFreq; increment = this->m_ReadSettingsDlg.m_Increment;this->m_freqs_size = 0; for ( freq = start; freq <= end; freq += increment) {E l e c Ki t sm_freqs[m_freqs_size++] = freq; } this->SetTimer(1,1000,NULL);//start time1 }// }void CGpsDlg::OnTimer(UINT nIDEvent) {// TODO: Add your message handler code here and/or call default if(1==nIDEvent) { unsigned char rssi =this->m_ReadSettingsDlg.m_RssiThreshold; unsigned char profile = this->m_ReadSettingsDlg.m_profile; //for(int i=0;i<="" bdsfid="358" if(size="" int="" size="0;" static="" this-="" {="">m_freqs_size){ this->setFrequency(m_freqs[size],this->m_mode,rssi,profile); this->m_mode = 4; size++; } else { size =0; //shold kill the timer KillTimer(1); } } }void CGpsDlg::setFrequency( UINT frequencyKHz, unsigned char mode, unsigned char rssi, unsigned char profile) { BYTE buf[64];//QByteArray buf; // buf.resize(64); buf[0] = OUT_CHANGE_FREQ;//0x41 buf[1] = sizeof(buf);//7; buf[2] = mode; buf[3] = frequencyKHz & 0x000000FF; buf[4] =(frequencyKHz & 0x0000FF00) >> 8; buf[5] = (frequencyKHz & 0x00FF0000) >> 16; buf[6] = rssi; buf[7] = profile; CByteArray hexdata;E l e c Ki t sthis->m_Function.ByteToByteArray(buf,sizeof(buf),hexdata); this->m_CommCtrl.SetOutput(COleVariant(hexdata)); } The serial port debugging tool receives:42 40 FE FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0042 40 FC FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0042 40 FC FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0042 40 FC FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00Figure 4.There are a total of 4 responses to the European frequency corresponding to its four frequencies. There are a total of 50 responses to the USA frequency and so on.5.6Set GEN2 ParametersE l e c Ki t sTo access GEN2 specific parameters use this report: Command from host: Byte 0/ID Byte 1 Byte 2 Byte 3Byte 4 Byte 5 0x59 Frame length linkfrequencyset linkfrequencymillersetmiller setting Byte 6 Byte 7 Byte 8 Byte 9 Byte 10Byte 11 session setsessiontrext settrextqbeginset qbeginTable 21: Command frame:The “set” bytes define if the subsequent byte should be set in the reader firmware. The answer to this command returns all the actually set values. This allows reading out the values without actually changing anything.The parameters are:·linkfrequency: 0=40kHz,3=80kHZ,6=160kHz,8=213kHz, 9=256 kHz, 12=320kHz,15=640kHz· miller: 0=FM0, 2=Miller2, 2=Miller4, 3=Miller8· session: 0=S0, 1= S1, 2=S2, 3=S3, 4=S4 · trext: 1 use long pilot tone, 0: don’t use · qbegin: Start value for q when doing inventory rounds. The first round will have 2q slotsThe controller sends back following frame: Byte 0/IDByte 1Byte 2 Byte 3Byte 4 Byte 5 0x5A Frame length 0linkfrequency 0millersetting Byte 6 Byte 7 Byte 8 Byte 9 Byte 10 Byte 11 0sessiontrextqbeginTable 22: Command frame: Lock Tag Memory from controller5.7 Register BulkGets the complete register list in one big bulk. Command from host: Byte 0/IDByte 1E l e c Ki t s0x57 Frame lengthTable 23: Command frame:Response from device: Byte 0/ID Byte 1 Byte 2 … By te 21 Byte 22 Byte 23 … Byte 42 0x58Frame lengthregister 0register 0x12-1register 0x12-2register 0x13register 0x1eTable 24: Complete Register List (Bulk)Ec. Send: 57 02Receive: 58 2D 02 06 F0 62 35 05 00 07 07 01 08 02 00 37 0B 10 98 02 0C 40 00 38 83 84 0A 06 3F 20 06 41 E4 46 18 01 00 87 00 00 00 00 00 00 00It gets the value in each register of AS388X.6. Transponder Oriented CommandsTransponder oriented commands are commands which force the microcontroller to communicate with the tags. Therefore the antenna power output must be enabled and there must be at least one tag in the field.6.1 Command InventoryTo start an inventory round to find new tags use this command. To get tag information of all found tags also use this command with the next tag information flag set.Command from host: Byte 0/ID Byte 1 Byte 20x31Frame Length Start inventory / Next tag informationTable 25: Command frame: Inventory from hostWith byte 2 the host can select whether it wants to start a new round or if it wants to get information about the next tag in the microcontroller list. Value Start/Next0x01 Start inventory round0x02Next Tag information (should not be sent anymore since v1.3.0)Table 26: Start/Next byte (Byte 2).Response from microcontroller:E l e c Ki t sByte 0/ID Byte 1 Byte 2 Byte 3Byte 4-Byte xx Bytexx+1..Byte 630x32Frame length Number of found tags Length of EPC byteEPC 1…x rfuTable 27: Command frame: Inventory from microcontroller on Firmware.With byte 2 the controller reports how many tags are found by the inventory command. After sending the first inventory with the next flag set, the controller sends back only the count of the leftover tags. This is used to inform the host how often he has to call the inventory command with the next flag set until he has the tag information of all found tags. But the tag information is still in the microcontroller's tag list. No tag information is deleted. The complete report length is 64 bytes and needs to be taken into account in the Host Software.Ec. Send: 31 03 01Receive: 32 12 01 0E 30 00 01 02 03 04 05 06 07 08 09 10 6A 0FValueMeaning0x32 Answering sends 0x31 0x12 Frame length,0x12=18 0x01 Representatives one label 0x0E Length of EPC byte 0X30 0X00 Reserved0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x10 0x6A 0x0FRFID tag ID. Different tag has differentvalue.6.2 Command Inventory with RSSITo start an inventory round to find new tags use this command. This command must be executed first. Reading or writing to the tag will not work without this command executed first. To get tag information of all found tags also use this command with the next tag information flag set.Command from host: Byte 0/ID Byte 1Byte 20x43Frame LengthStart inventory / Next tag informationTable 28: Command frame: Inventory from hostWith byte 3 the host can select whether it wants to start a new round or if it wants to get information about the next tag in the microcontroller list.E l e c Ki t svalue Start/next0x01 Start inventory round 0x02 Next tag informationTable 29: Start/Next byte (Byte 2).Response from microcontroller: Byte 0/ID Byte 1 Byte 2 Byte 3 Byte 4 Byte 5-Bytexx Byte xx+1..Byte63 0x44Frame lengthNumber of found tagsRSSILength of EPC byteEPC 1 (x)rfuTable 30: Command frame: Inventory from microcontroller.With byte 2 the controller reports how many tags are found by the inventory command. After sending the first inventory with the next flag set, the controller sends back only the count of the leftover tags. This is used to inform the host how often he has to call the inventory command with the next flag set until he hasthe tag information of all found tags. But the tag information is still in the microcontroller's tag list. No tag information is deleted. The complete report length is 64 bytes and needs to be taken into account in the Host Software.Ec. Send: 43 03 01Receive: 44 16 01 9E AC 3C 0D 0E 30 00 01 02 03 04 05 06 07 08 09 10 6A0FValue Meaning0x44 Answering sends 0x430x16 FRAME length0x01 Representatives one label 0x9E Means Q value, I value;Signal strength of signal Q =(0x9E>>4)*2=18 Signal strength of signal I =(0x9E&0x0F)*2=280xAC 0x3C 0x0D Frequency 866900kz ，can be obtained by calculation 0D<<16 |3C<<8 | AC =0x0D3CAC=867500kz=867.5M=865.7+0.6+0.6+0.6M;This is European standard frequency;For example, the European frequency profile is define as:Europe,865.7,867.5,0.6,-40,1,0,100000x0E Length of EPC byte0x30 0x00 Reserved0x01 0x02E l e c Ki t s0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x10 0x6A 0x0FRFID tag ID.Different tag has different value.Click the SCAN button on the serial port debugging tool, seebelow:Figure 5.Codes are as follows:void CGpsDlg::OnButtonScan() {// TODO: Add your control notification handler code here BYTE buf[] ={0X43,0X04,0X01,0Xcd}; CByteArray hexdata;this->m_Function.ByteToByteArray(buf,sizeof(buf),hexdata); this->m_CommCtrl.SetOutput(COleVariant(hexdata)); }6.3 Command Select or Isolate TagTo communicate with one tag the host must isolate one of the found tags. The host needs to send always all EPC bytes to the controller regardless how long。

1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。

SC UHF Reader 控制协议UART通信波特率：1152008个数据位，没有奇偶校验位，1个停止位。

（8 N 1）RCP(Reader Control Protocol) 协议格式Payload End Mask CRC-16 Preamble Message Type Code Payload Length(unit of byte : N)1 BYTE 1 BYTE 1 BYTE2 BYTE N BYTE 1 BYTE 2 BYTERCP 协议中，同一域段里，高字节在前。

Preamble为最先发送字节，CRC-16的低字节为最后发送的字节。

Preamble and End Mark fieldPreamble 的值为0xBB.（不参与计算CRC）End mark 的值为0x7E. （参与计算CRC）在Payload中也可能包括，0xBB与0x7E。

因此不能以0xBB,0x7E判断帧的开始与结束。

Message type fieldCommand ：用户发送到读写器的信息。

Response 和notification ：读写器返回给用户的信息。

Code value (HEX)Command 0x00Response 0x01Notification 0x02Command and responseCommand：用户发送到读写器的命令。

Response：读写器响应用户的命令，每一条命令都会有相应的响应。

Notification读写器主动返回的信息，如：查询标签命令发送后，当有标签在读写器范围内时，读写器将会返回标签的EPC号。

Message code fieldMessage code Message type Code Get Region 0x00 / 0x01 0x06 Set Region 0x00 / 0x01 0x07 Set System Reset 0x00 / 0x01 0x08 Get Type C A/I Select Parameters 0x00 / 0x01 0x0B Set Type C A/I Select Parameters 0x00 / 0x01 0x0C Get Type C A/I Query Related Parameters 0x00 / 0x01 0x0D Set Type C A/I Query Related Parameters 0x00 / 0x01 0x0E Get current RF Channel 0x00 / 0x01 0x11 Set current RF Channel 0x00 / 0x01 0x12 Get FH and LBT Parameters 0x00 / 0x01 0x13 Set FH and LBT Parameters 0x00 / 0x01 0x14 Read Type C UII 0x00 / 0x01 0x22 Start Auto Read 0x00 / 0x01 / 0x02 0x27 Stop Auto Read 0x00 / 0x01 0x28 Read Type C Tag Data 0x00 / 0x01 0x29 Get Frequency Hopping Table 0x00 / 0x01 0x30 Set Frequency Hopping Table 0x00 / 0x01 0x31 Get Modulation 0x00 / 0x01 0x32 Set Modulation 0x00 / 0x01 0x33 Start Auto Read2 0x00 / 0x01 / 0x02 0x36 Stop Auto Read2 0x00 / 0x01 0x37 Write Type C Tag Data 0x00 / 0x01 0x46 BlockWrite Type C Tag Data 0x00 / 0x01 0x47 BlockErase Type C Tag Data 0x00 / 0x01 0x48 Kill/Recom Type C Tag 0x00 / 0x01 0x65 Lock Type C Tag 0x00 / 0x01 0x82 Get RSSI 0x00 / 0x01 0xC5 Update Registry 0x00 / 0x01 0xD2 Command Failure 0x01 0xFF1.Get Region (6)2.Set Region (7)3.Get Type C A/I Select Parameters (8)4.Set Type C A/I Select Parameters (9)5.Get Type C A/I Query Parameters (10)6.Set Type C A/I Query Parameters (11)7.Get current RF Channel (12)8.Set current RF Channel (13)9.Get FH and LBT Parameters (14)10.Set FH and LBT Parameters (15)11.Read Type C UII (16)12.Start Auto Read (17)13.Stop Auto Read (19)14.Start Auto Read2 (20)15.Read Type C Tag Data (22)16.Get Frequency Hopping Table (23)17.Set Frequency Hopping Table (24)18.Get Modulation Mode (25)19.Set Modulation Mode (27)20.Write Type C Tag Data (29)21.BlockWrite Type C Tag Data (30)22.BlockErase Type C Tag Data (31)23.BlockPermalock Type C Tag (32)24.Kill Type C Tag (33)25.Lock Type C Tag (34)26.Get RSSI (35)27.Update Registry(Save all setting) (36)mand failure (37)CRC GeneralThe Command and Response use the same CRC-16 for verify a purity of message bits. The 16-bit CRC shall be calculated on all the message bits from the message type field to the end mark field . The Polynomial used to calculate the CRC is X16+X12+X5+1 (initial value is 0xFFFF). The resulting CRC value shall be attached to the end of the packet (after End Mark filed) and transmitted. The most significant byte shall be transmitted first. The most significant bit of each byte shall be transmitted first.unsigned short crc16_ccitt_tableH[256]={0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50a5, 0x60c6, 0x70e7,0x8108, 0x9129, 0xa14a, 0xb16b, 0xc18c, 0xd1ad, 0xe1ce, 0xf1ef,0x1231, 0x0210, 0x3273, 0x2252, 0x52b5, 0x4294, 0x72f7, 0x62d6,0x9339, 0x8318, 0xb37b, 0xa35a, 0xd3bd, 0xc39c, 0xf3ff, 0xe3de,0x2462, 0x3443, 0x0420, 0x1401, 0x64e6, 0x74c7, 0x44a4, 0x5485,0xa56a, 0xb54b, 0x8528, 0x9509, 0xe5ee, 0xf5cf, 0xc5ac, 0xd58d,0x3653, 0x2672, 0x1611, 0x0630, 0x76d7, 0x66f6, 0x5695, 0x46b4,0xb75b, 0xa77a, 0x9719, 0x8738, 0xf7df, 0xe7fe, 0xd79d, 0xc7bc,0x48c4, 0x58e5, 0x6886, 0x78a7, 0x0840, 0x1861, 0x2802, 0x3823,0xc9cc, 0xd9ed, 0xe98e, 0xf9af, 0x8948, 0x9969, 0xa90a, 0xb92b,0x5af5, 0x4ad4, 0x7ab7, 0x6a96, 0x1a71, 0x0a50, 0x3a33, 0x2a12,0xdbfd, 0xcbdc, 0xfbbf, 0xeb9e, 0x9b79, 0x8b58, 0xbb3b, 0xab1a,0x6ca6, 0x7c87, 0x4ce4, 0x5cc5, 0x2c22, 0x3c03, 0x0c60, 0x1c41,0xedae, 0xfd8f, 0xcdec, 0xddcd, 0xad2a, 0xbd0b, 0x8d68, 0x9d49,0x7e97, 0x6eb6, 0x5ed5, 0x4ef4, 0x3e13, 0x2e32, 0x1e51, 0x0e70,0xff9f, 0xefbe, 0xdfdd, 0xcffc, 0xbf1b, 0xaf3a, 0x9f59, 0x8f78,0x9188, 0x81a9, 0xb1ca, 0xa1eb, 0xd10c, 0xc12d, 0xf14e, 0xe16f,0x1080, 0x00a1, 0x30c2, 0x20e3, 0x5004, 0x4025, 0x7046, 0x6067,0x83b9, 0x9398, 0xa3fb, 0xb3da, 0xc33d, 0xd31c, 0xe37f, 0xf35e,0x02b1, 0x1290, 0x22f3, 0x32d2, 0x4235, 0x5214, 0x6277, 0x7256,0xb5ea, 0xa5cb, 0x95a8, 0x8589, 0xf56e, 0xe54f, 0xd52c, 0xc50d,0x34e2, 0x24c3, 0x14a0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405,0xa7db, 0xb7fa, 0x8799, 0x97b8, 0xe75f, 0xf77e, 0xc71d, 0xd73c,0x26d3, 0x36f2, 0x0691, 0x16b0, 0x6657, 0x7676, 0x4615, 0x5634,0xd94c, 0xc96d, 0xf90e, 0xe92f, 0x99c8, 0x89e9, 0xb98a, 0xa9ab,0x5844, 0x4865, 0x7806, 0x6827, 0x18c0, 0x08e1, 0x3882, 0x28a3,0xcb7d, 0xdb5c, 0xeb3f, 0xfb1e, 0x8bf9, 0x9bd8, 0xabbb, 0xbb9a,0x4a75, 0x5a54, 0x6a37, 0x7a16, 0x0af1, 0x1ad0, 0x2ab3, 0x3a92,0xfd2e, 0xed0f, 0xdd6c, 0xcd4d, 0xbdaa, 0xad8b, 0x9de8, 0x8dc9,0x7c26, 0x6c07, 0x5c64, 0x4c45, 0x3ca2, 0x2c83, 0x1ce0, 0x0cc1,0xef1f, 0xff3e, 0xcf5d, 0xdf7c, 0xaf9b, 0xbfba, 0x8fd9, 0x9ff8,0x6e17, 0x7e36, 0x4e55, 0x5e74, 0x2e93, 0x3eb2, 0x0ed1, 0x1ef0};unsigned short do_crcH(unsigned short crcInit, unsigned char *message, unsigned int len) {unsigned short int crc = crcInit;while(len--){crc = (crc<<8) ^ crc16_ccitt_tableH[((crc>>8) ^ *message++) & 0xff];}return crc;}Get the current region.CommandMessage Type: Command (0x00)Code: Get Region (0x06)Arguments- NonePreamble Msg Type Code PL (MSB) PL (LSB) End Mark CRC-160xBB 0x00 0x06 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Get Region (0x06)- Korea (0x11)- US (0x21)- Europe (0x31)- Japan (0x41)- China (0x52)Preamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x06 0x00 0x01 0x31 0x7E 0xNNNNSet the current region.CommandMessage Type: Command (0x00)Code: Set Region (0x07)Arguments- Korea (0x11)- US (0x21)- Europe (0x31)- Japan (0x41)- China (0x52)Preamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x00 0x07 0x00 0x01 0x31 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Set Region (0x07)Arguments- Success (0x00)Preamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x07 0x00 0x01 0x00 0x7E 0xNNNNGet 18000-6C air interface protocol command ‘Select’parameters.CommandMessage Type: Command (0x00)Code: Get Type C A/I Select Parameters (0x0B)Arguments- NonePreamble M sg Type Code PL (MSB) PL (LSB) End Mark CRC-160xBB 0x00 0x0B 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Get Type C A/I Select Parameters (0x0B)Arguments- Target (3-bit): S0 (000), S1 (001), S2 (010), S3 (011), SL (100)- Action (3-bit): Refer to ISO18000-6C.- Memory Bank (2-bit): 00 RFU, 01 EPC, 10 TID, 11 User- Pointer (32-bit): Starting mask address- Length (8-bit): mask length bits- Truncate (1-bit): Enable (1) and Disable (0)- Reserve (7-bit): Reserved 0000000 value should be placed here.- Mask (0~255 bits): Mask valueExample)Target=S0, Action=assert SL or inventoried - > A, MB=User, Pointer = 0x000000FF,Length =0x20, T=0, Mask = 11111111111111110000000000000000Preamble Msg Type Code PL(MSB) PL (LSB) T A M Ptr(MSB)0xBB 0x01 0x0B 0x00 0x0B 000 000 11 0x00 0x00 Ptr (LSB) Length T Reserve Mask(MSB)0x00 0xFF 0x20 0 0000000 0xFF 0xFF 0x00 0x00 End Mark CRC-160x7E 0xNNNNSet 18000-6C air interface protocol command ‘Select’parameters.CommandMessage Type: Command (0x00)Code: Set Type C A/I Select Parameters (0x0C)Arguments- Target (3-bit): S0 (000), S1 (001), S2 (010), S3 (011), SL (100)- Action (3-bit): Refer to ISO18000-6C.- Memory Bank (2-bit): RFU (00), EPC (01), TID (10), User (11)- Pointer (32-bit): Starting mask address- Length (8-bit): mask length bits- Truncate (1-bit): Enable (1) and Disable (0)- Reserve (7-bit): Reserved 0000000 value should be placed here.- Mask (0~255 bits): Mask valueExample)Target=S0 where C, Action=assert SL ors inventoried - > A, MB=User, Pointer =0x000000FF Length=0x20, T=0, Mask=11111111111111110000000000000000Preamble Msg Type Code PL(MSB) PL (LSB) T A M Ptr(MSB)0xBB 0x00 0x0C 0x00 0x0B 000 000 11 0x00 0x00 Ptr (LSB) Length T Reserve Mask(MSB)0x00 0xFF 0x20 0 0000000 0xFF 0xFF 0x00 0x00 End Mark CRC-160x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Set Type C A/I Select Parameters (0x0C)Arguments- Success (0x00)Example)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-160xBB 0x01 0x0C 0x00 0x01 0x00 0x7E 0xNNNNGet 18000-6C air interface protocol command ‘Query’parameters.CommandMessage Type: Command (0x00)Code: Get Type C A/I Query Parameters (0x0D)Arguments- NonePreamble M sg Type Code PL (MSB) PL (LSB) End Mark CRC-160xBB 0x00 0x0D 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Get Type C A/I Query Parameters (0x0D)Arguments- DR (1-bit): DR=8 (0), DR=64/3 (1)- M (2-bit): M=1 (00), M=2 (01), M=4 (10), M=8 (11)- TRext (1-bit): No pilot tone (0), Use pilot tone (1)- Sel (2-bit): All (00 or 01), ~SL (10), SL (11)- Session (2-bit): S0 (00), S1 (01), S2 (10), S3 (11)- Target (1-bit): A (0), B (1)- Q (4-bit): 0-15; the number of slots in the round.Example)DR=8, M=1, TRext=Use pilot tone, Sel=All, Session=S0, Target=A, Q=4, No change to Q Preamble Msg Type Code PL (MSB) PL (LSB) DR M TR Sel S 0xBB 0x01 0x0D 0x00 0x02 0 00 1 00 00 T Q RSV EndMark CRC-160 0100 000 0x7E 0xNNNN6.Set Type C A/I Query ParametersSet 18000-6C air interface protocol command ‘Query’parameters.CommandMessage Type: Command (0x00)Code: Set Type C A/I Query Parameters (0x0E)Arguments- DR (1-bit): DR=8 (0), DR=64/3 (1)- M (2-bit): M=1 (00), M=2 (01), M=4 (10), M=8 (11)- TRext (1-bit): No pilot tone (0), Use pilot tone (1)- Sel (2-bit): All (00 or 01), ~SL (10), SL (11)- Session (2-bit): S0 (00), S1 (01), S2 (10), S3 (11)- Target (1-bit): A (0), B (1)- Q (4-bit): 0-15; the number of slots in the round.Example)DR=8, M=1, TRext=Use pilot tone, Sel=All, Session=S0, Target=A, Q=4, No change to Q Preamble Msg Type Code PL (MSB) PL (LSB) DR M TR Sel S 0xBB 0x01 0x0E 0x00 0x02 0 00 1 00 00 T Q RSV EndMark CRC-160 0100 000 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Set Type C A/I Query Parameters (0x0E)Arguments- Success (0x00)Example)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-160xBB 0x01 0x0E 0x00 0x01 0x00 0x7E 0xNNNNGet RF channel. This command is valid only for non-FH mode.CommandMessage Type: Command (0x00)Code: Get current RF Channel (0x11)Arguments- NoneExample)Get current RF channelPreamble M sg Type Code PL (MSB) PL (LSB) End Mark CRC-16 0xBB 0x00 0x11 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Get current RF Channel (0x11)Arguments- CN (8-bit): Channel Number. The range of channel number depends on regional settings - CNO (8-bit): Channel number offset for miller subcarrier.Example)Channel Number = 10Preamble M sg Type Code PL (MSB) PL (LSB) CN CNO0xBB 0x01 0x11 0x00 0x02 0x0A 0x00 End Mark CRC-160x7E 0xNNNNSet RF channel. This command is valid only for non-FHSS mode.CommandMessage Type: Command (0x00)Code: Set current RF Channel (0x12)Arguments- CN (8-bit): Channel number. The range of channel number depends on regional settings - CNO (8-bit): Channel number offset for miller subcarrier.Example)Channel Number = 10, Channel Number Offset = 0Preamble M sg Type Code PL (MSB) PL (LSB) CN CNO0xBB 0x00 0x12 0x00 0x02 0x0A 0x00End Mark CRC-160x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Set current RF Channel (0x12)Arguments- NoneExample)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x12 0x00 0x01 0x00 0x7E 0xNNNNGet FH and LBT controlCommandMessage Type: Command (0x00)Code: Get FH and LBT Parameters (0x13)Arguments- NoneExample)Preamble M sg Type Code PL (MSB) PL (LSB) End Mark CRC-16 0xBB 0x00 0x13 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Get FH and LBT Parameters (0x13)Arguments- RT (16-bit): Read Time (1 = 1ms)- IT (16-bit): Idle Time (1 = 1ms)- CST (16-bit): Carrier Sense Time (1 = 1ms)- RFL (16-bit): Target RF power level (-dBm x 10)- FH (8-bit): enable (0x01 or over) / disable (0x00)- LBT (8-bit): enable (0x01 or over) / disable (0x00)- CW (8-bit): enable (0x01) / disable (0x00)Example)Success, FH disable, LBT enable, RT 400ms, IT 100ms, CST 10ms, RFL -630 (-63.0 dBm) Preamble M sg Type Code PL (MSB) PL (LSB) RT MSB RT (LSB) 0xBB 0x01 0x13 0x00 0x0B 0x01 0x90IT (MSB) IT (LSB) CST(MSB) CST (LSB) RFL(MSB) RFL (LSB) FH0x00 0x64 0x00 0x0A 0xFD 0x8A 0x00 LBT CW End Mark CRC-160x01 0x00 0x7E 0xNNNNSet FH and LBT ParametersCommandMessage Type: Command (0x00)Code: Set FH and LBT Parameters (0x14)Arguments- RT (16-bit): Read Time (1 = 1ms)- IT (16-bit): Idle Time (1 = 1ms)- CST (16-bit): Carrier Sense Time (1 = 1ms)- RFL (16-bit): Target RF power level (-dBm x 10)- FH (8-bit): enable (0x01 or over) / disable (0x00)- LBT (8-bit): enable (0x01 or over) / disable (0x00)- CW (8-bit): enable (0x01) / disable (0x00)Example1)FH enable (with LBT feature), RT 400ms, IT 100ms, CST 10ms, RFL -740 (-74.0 dBm) Preamble M sg Type Code PL (MSB) PL (LSB) RT MSB RT (LSB) 0xBB 0x00 0x14 0x00 0x0B 0x01 0x90IT (MSB) IT (LSB) CST(MSB) CST (LSB) RFL(MSB) RFL (LSB) FH0x00 0x64 0x00 0x0A 0xFD 0x8A 0x01LBT CW End Mark CRC-160x01 0x00 0x7E 0xNNNNExample2)LBT enable (with FH feature), RT 400ms, IT 100ms, CST 10ms, RFL -740 (-74.0 dBm) Preamble M sg Type Code PL (MSB) PL (LSB) RT MSB RT (LSB) 0xBB 0x00 0x14 0x00 0x0B 0x01 0x90IT (MSB) IT (LSB) CST(MSB) CST (LSB) RFL(MSB) RFL (LSB) FH0x00 0x64 0x00 0x0A 0xFD 0x8A 0x01LBT CW End Mark CRC-160x02 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Set FH and LBT Parameters (0x14)Arguments- NoneExample)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x14 0x00 0x01 0x00 0x7E 0xNNNN11.Read Type C UIIRead a EPC Block (PC + EPC)CommandMessage Type: Command (0x00)Code: Read Type C UII (0x22)Arguments- NoneExample)Preamble M sg Type Code PL (MSB ) PL (LSB) End Mark CRC-16 0xBB 0x00 0x22 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Read Type C UII (0x22)Arguments- EPC Block (PC + EPC)Example)PC = 0x3000, EPC = 0xE2003411B802011383258566Preamble M sg Type Code PL (MSB) PL (LSB) PC (MSB) PC (LSB) 0xBB 0x01 0x22 0x00 0x0E 0x30 0x00 EPC(MSB)0xE2 0x00 0x34 0x11 0xB8 0x02 0x01EPC (LSB) End Mark CRC-16 0x13 0x83 0x25 0x85 0x66 0x7E 0xNNNN12.Start Auto ReadStart an automatic tag read operation during the inventory round, tag IDs are sent back to user though notification packet.CommandMessage Type: Command (0x00)Code: Start Auto Read (0x27)Arguments- Command Code (0x22)- RC (16-bit): Repeat cycle (how many times reader perform inventory round)Example)Repeat Cycle = 100Preamble M sg Type Code PL (MSB) PL (LSB) Reserve RC (MSB) 0xBB 0x00 0x27 0x00 0x03 0x22 0x00RC (LSB) End Mark CRC-160x64 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Start Auto Read (0x27)Arguments- Success (0x00)Example)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x27 0x00 0x01 0x00 0x7E 0xNNNNNotification 1:Message Type: Notification (0x02)Code: Read Type C UII (0x22)Arguments- EPC Block (PC + EPC)Example)PC = 0x3000, EPC = 0xE2003411B802011383258566Preamble M sg Type Code PL (MSB) PL (LSB) PC (MSB) PC (LSB) 0xBB 0x02 0x22 0x00 0x0E 0x30 0x00EPC(MSB)0xE2 0x00 0x34 0x11 0xB8 0x02 0x01EPC (LSB) End Mark CRC-160x13 0x83 0x25 0x85 0x66 0x7E 0xNNNNNotification 2:Message Type: Notification (0x02)Code: Start Auto Read (0x27)Arguments- Read complete (0x1F)Preamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x02 0x27 0x00 0x01 0x1F 0x7E 0xNNNNStop an automatic tag read operation.CommandMessage Type: Command (0x00)Code: Stop Auto Read (0x28)Arguments- NoneExample)Preamble Msg Type Code PL(MSB) PL (LSB) End Mark CRC-160xBB 0x00 0x28 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Stop Auto Read (0x28)Arguments- Success (0x00)Example)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x28 0x00 0x01 0x00 0x7E 0xNNNNStart an automatic tag read operation, tag IDs are sent back to user though notification packet. CommandMessage Type: Command (0x00)Code: Start Auto Read2 (0x36)Arguments- Reserve: type B tag (0x01), type C Tag (0x02)- MTNU: maximum number of tag to read- MTIME: maximum elapsed time to tagging (sec)- RC (16-bit): Repeat cycle (how many times reader perform inventory round).Example)MTNU = 0, MTIME = 0, Repeat Cycle = 100Preamble M sg Type Code PL (MSB) PL (LSB) Reserve MTNU0xBB 0x00 0x36 0x00 0x05 0x02 0x00 MTIME RC(MSB) RC(LSB) End Mark CRC-160x00 0x00 0x64 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Start Auto Read2 (0x36)Arguments- Success (0x00)Example)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x36 0x00 0x01 0x00 0x7E 0xNNNNNotification 1:Message Type: Notification (0x02)Code: Read Type C UII (0x22)Arguments- EPC Block (PC + EPC)Example)PC = 0x3000, EPC = 0xE2003411B802011383258566Preamble M sg Type Code PL (MSB) PL (LSB) PC(MSB) PC(LSB) 0xBB 0x02 0x22 0x00 0x0E 0x30 0x00EPC(MSB)0xE2 0x00 0x34 0x11 0xB8 0x02 0x01EPC (LSB) End Mark CRC-160x13 0x83 0x25 0x85 0x66 0x7E 0xNNNN Notification 2:Message Type: Notification (0x02)Code: Start Auto Read2 (0x36)Arguments- Read complete (0x1F)Preamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x02 0x36 0x00 0x01 0x1F 0x7E 0xNNNN15.Read Type C Tag DataRead Type C tag data from specified memory bank.CommandMessage Type: Command (0x00)Code: Read Type C Tag Memory (0x29)Arguments- AP (32-bit): Access Password if target memory bank was password protected. Otherwise, set AP filed to 0x00000000.- UL (16-bit): Target tag’s EPC length- EPC (variable): Target tag’s EPC- MB (8-bit): Target memory bank; RFU (0x00), EPC (0x01), TID (0x02), User (0x03)- SA (16-bit): Starting Address word pointer- DL (16-bit): Data Length (Word Count)Example)Access Password = 0x 00000000, UL = 12 (0x0C) byte,EPC = 0xE2003411B802011526370494, Target memory bank = RFU,Start Address = 0x0000, Length = 4 wordPreamble M sg Type Code PL (MSB) PL (LSB) AP (MSB)0xBB 0x00 0x29 0x00 0x17 0x00 0x00 AP (LSB) UL (MSB) UL (LSB) EPC(MSB)0x00 0x00 0x00 0x0C 0xE2 0x00 0x340x11 0xB8 0x02 0x01 0x15 0x26 0x37 EPC (LSB) MB SA (MSB) SA (LSB) DL (MSB) DL (LSB) 0x04 0x94 0x00 0x00 0x00 0x00 0x04End Mark CRC-160x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Read Type C Tag Memory (0x29)Arguments- Tag memory contents (variable)Example)RFU memory bank = 0x0000000000000000Preamble Msg Type Code PL(MSB) PL (LSB) Argument0xBB 0x01 0x29 0x00 0x08 0x00 0x00 0x00 Argument End Mark C RC-160x00 0x00 0x00 0x00 0x00 0x7E 0xNNNNGet current frequency hopping table.CommandMessage Type: Command (0x00)Code: Get Frequency Hopping Table (0x30)Arguments- NoneExample)Preamble M sg Type Code PL (MSB) PL (LSB) End Mark CRC-16 0xBB 0x00 0x30 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Get Frequency Hopping Table (0x30)Arguments- Table Size (8-bit)- Channel Number (variable)Example)Table Size = 6, channel numbers = 47, 19, 20, 23, 46, 16Preamble Msg Type Code PL(MSB) PL (LSB) Table Size Argument0xBB 0x01 0x30 0x00 0x07 0x06 0x2F 0x13 Argument End Mark CRC-160x14 0x17 0x2E 0x10 0x7E 0xNNNNSet current frequency hopping table.CommandMessage Type: Command (0x00)Code: Set Frequency Hopping Table (0x31)Arguments- Table Size (8-bit)- Channel Numbers (variable)Example)Table Size = 6, channel numbers 47, 19, 20, 23, 46, 16Preamble Msg Type Code PL(MSB) PL (LSB) Table Size Argument 0xBB 0x00 0x31 0x00 0x07 0x06 0x2F 0x13 Argument End Mark CRC-160x14 0x17 0x2E 0x10 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Set Frequency Hopping Table (0x31)Arguments- Success (0x00)Example)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x31 0x00 0x01 0x00 0x7E 0xNNNN18.Get Modulation ModeGet current modulation mode. The modulation mode is combination Rx modulation type and BLF.CommandMessage Type: Command (0x00)Code: Get Modulation Mode (0x32)Arguments- NoneExample)Preamble M sg Type Code PL (MSB) PL (LSB) End Mark CRC-16 0xBB 0x00 0x32 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Get Modulation Mode (0x32)Arguments- BLF (16-bit): backscatter link frequency- RxMod (8-bit): data rate and modulation format- DR (8-bit): divide ratioBLF RxMod DR40KH, FM0, DR=8 0x0028 0x00 0x0080KH, FM0, DR=8 0x0050 0x00 0x00160KH, FM0, DR=64/3 0x00A0 0x00 0x01320KH, FM0, DR=64/3 0x0140 0x00 0x01640KH, FM0, DR=64/3 0x0280 0x00 0x0140KH, M2, DR=8 0x0028 0x01 0x0080KH, M2, DR=8 0x0050 0x01 0x00160KH, M2, DR=64/3 0x00A0 0x01 0x01320KH, M2, DR=64/3 0x0140 0x01 0x01640KH, M2, DR=64/3 0x0280 0x01 0x0140KH, M4, DR=8 0x0028 0x02 0x0080KH, M4, DR=8 0x0050 0x02 0x00160KH, M4, DR=64/3 0x00A0 0x02 0x01320KH, M4, DR=64/3 0x0140 0x02 0x01640KH, M4, DR=64/3 0x0280 0x02 0x0140KH, M8, DR=8 0x0028 0x03 0x0080KH, M8, DR=8 0x0050 0x03 0x00160KH, M8, DR=64/3 0x00A0 0x03 0x01320KH, M8, DR=64/3 0x0140 0x03 0x01640KH, M8, DR=64/3 0x0280 0x03 0x01Example)BLF = 160KHz, RxMod = M8, DR = 64/3Preamble M sg Type Code PL (MSB) PL (LSB) BLF(MSB) BLF (LSB) 0xBB 0x01 0x32 0x00 0x04 0x00 0xA0 RxMod DR End Mark CRC-160x03 0x01 0x7E 0xNNNN19.Set Modulation ModeSet current modulation mode. The modulation mode is combination Rx modulation type and BLF.CommandMessage Type: Command (0x00)Code: Set Modulation Mode (0x33)Arguments- Modulation Mode (8-bit): High Sensitivity (0x00), High Speed (0x01), Manual (0xFF)- BLF (16-bit), RxMod (8-bit), DR (8-bit): only available when modulation mode is manual.BLF RxMod DR40KH, FM0, DR=8 0x0028 0x00 0x0080KH, FM0, DR=8 0x0050 0x00 0x00160KH, FM0, DR=64/3 0x00A0 0x00 0x01320KH, FM0, DR=64/3 0x0140 0x00 0x01640KH, FM0, DR=64/3 0x0280 0x00 0x0140KH, M2, DR=8 0x0028 0x01 0x0080KH, M2, DR=8 0x0050 0x01 0x00160KH, M2, DR=64/3 0x00A0 0x01 0x01320KH, M2, DR=64/3 0x0140 0x01 0x01640KH, M2, DR=64/3 0x0280 0x01 0x0140KH, M4, DR=8 0x0028 0x02 0x0080KH, M4, DR=8 0x0050 0x02 0x00160KH, M4, DR=64/3 0x00A0 0x02 0x01320KH, M4, DR=64/3 0x0140 0x02 0x01640KH, M4, DR=64/3 0x0280 0x02 0x0140KH, M8, DR=8 0x0028 0x03 0x0080KH, M8, DR=8 0x0050 0x03 0x00160KH, M8, DR=64/3 0x00A0 0x03 0x01320KH, M8, DR=64/3 0x0140 0x03 0x01640KH, M8, DR=64/3 0x0280 0x03 0x01Example)Normal modePreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x00 0x33 0x00 0x01 0x00 0x7E 0xNNNNExample)Manual, BLF = 160KHz, RxMod = M8, DR = 64/3Preamble M sg Type Code PL (MSB) PL (LSB) Mod Mode BLF(MSB) 0xBB 0x00 0x33 0x00 0x05 0xFF 0x00BLF (LSB) RxMod DR End Mark CRC-160xA0 0x03 0x01 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Set Modulation Mode (0x33)Arguments- NoneExample)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x33 0x00 0x01 0x00 0x7E 0xNNNN20.Write Type C Tag DataWrite type C tag data.CommandMessage Type: Command (0x00)Code: Write Type C User Data (0x46)Arguments- AP (32-bit): Access Password if target memory bank was password protected. Otherwise, set AP filed to 0x00000000.- UL (16-bit): Target tag’s EPC length- EPC (variable): Target tag’s EPC- MB (8-bit): Target memory bank; 0x00 Reserved, 0x01 EPC, 0x02 TID, 0x03 User- SA (16-bit): Starting Address word pointer- DL (16-bit): Data Length to write (Word Count)- DT (variable): Data to writeExample)Access Password = 0x 00000000, UL = 12 (0x0C),EPC = 0xE2003411B802011526370494,Target memory bank = RFU, Start Address = 0x0000, Data Length = 4 word,Data to write = 0x1234567800000000Preamble Msg Type Code PL(MSB) PL (LSB) AP(MSB)0xBB 0x00 0x46 0x00 0x1F 0x00 0x00 0x00 AP (LSB) U L(MSB) UL(LSB) EPC(MSB)0x00 0x00 0x0C 0xE2 0x00 0x34 0x11 0xB8EPC(LSB) MB 0x02 0x01 0x15 0x26 0x37 0x04 0x94 0x00 SA(MSB) SA (LSB) DL (MSB) DL (LSB) DT(MSB)0x00 0x00 0x00 0x04 0x12 0x34 0x56 0x78DT (LSB) E nd Mark CRC-160x00 0x00 0x00 0x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: Write Type C User Data (0x46)Arguments- Success (0x00)Example)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-160xBB 0x01 0x46 0x00 0x01 0x00 0x7E 0xNNNN21.BlockWrite Type C Tag DataBlockwrite type C tag data.CommandMessage Type: Command (0x00)Code: BlockWrite Type C User Data (0x47)Arguments- AP (32-bit): Access Password if target memory bank was password protected. Otherwise, set AP filed to 0x00000000.- UL (16-bit): Target tag’s EPC length- EPC (variable): Target tag’s EPC- MB (8-bit): Target memory bank; 0x00 Reserved, 0x01 EPC, 0x02 TID, 0x03 User- SA (16-bit): Starting Address word pointer- DL (16-bit): Data Length to write (Word Count)- DT (variable): Data to writeExample)Access Password = 0x 00000000, UL = 12 (0x0C),EPC = 0xE2003411B802011526370494,Target memory bank = RFU, Start Address = 0x0000, Data Length = 4 word,Data to write = 0x1234567800000000Preamble M sg Type Code PL (MSB) PL (LSB) AP (MSB)0xBB 0x00 0x47 0x00 0x1F 0x00 0x00 AP (LSB) UL (MSB) UL (LSB) EPC(MSB)0x00 0x00 0x00 0x0C 0xE2 0x00 0x340x11 0xB8 0x02 0x01 0x15 0x26 0x37 EPC (LSB) MB SA (MSB) SA (LSB) DL (MSB) DL (LSB) 0x04 0x94 0x00 0x00 0x00 0x00 0x04DT (MSB)0x12 0x34 0x56 0x78 0x00 0x00 0x00DT (LSB) End Mark CRC-160x00 0x7E 0xNNNNResponseMessage Type: Response (0x01)Code: BlockWrite Type C User Data (0x47)Arguments- Success (0x00)Example)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x47 0x00 0x01 0x00 0x7E 0xNNNNBlock erases type C tag data.CommandMessage Type: Command (0x00)Code: BlockErase Type C Tag Data (0x48)Arguments- AP (32-bit): Access Password if target memory bank was password protected. Otherwise, set AP filed to 0x00000000.- UL (16-bit): Target tag’s EPC length- EPC (variable): Target tag’s EPC- MB (8-bit): Target memory bank; 0x00 RFU, 0x01 EPC, 0x02 TID, 0x03 User- SA (16-bit): Starting Address word pointer- DL (16-bit): Data Length (Word Count)Example)Access Password = 0x 00000000, UL = 12 (0x0C) byte,EPC = 0xE2003411B802011526370494,Target memory bank = RFU, Start Address = 0x0000, Length = 4 wordPreamble M sg Type Code PL (MSB) PL (LSB) AP (MSB)0xBB 0x00 0x48 0x00 0x17 0x00 0x00 AP (LSB) UL (MSB) UL (LSB) EPC(MSB)0x00 0x00 0x00 0x0C 0xE2 0x00 0x340x11 0xB8 0x02 0x01 0x15 0x26 0x37 EPC (LSB) MB SA (MSB) SA (LSB) DL (MSB) DL (LSB) 0x04 0x94 0x00 0x00 0x00 0x00 0x04End Mark CRC-160x7E 0xNNNNResponseMessage Type: Response (0x01)Code: BlockErase Type C Tag Data (0x48)Arguments- SuccessExample)SuccessPreamble Msg Type Code PL(MSB) PL (LSB) Arg End Mark CRC-16 0xBB 0x01 0x48 0x00 0x01 0x00 0x7E 0xNNNN。