Reader Protocol Specification Revision 1.0.0
3M TRACK AND TRACE SOLUTIONS
3M RFID Reader
Model 210
Protocol Specification
Specification Version 1.0.0
June 1, 2009
Firmware version(s): 5.0.2 and greater
Reader platforms:USB Powered Pad
10/14/2018© 3M 2009. All rights reserved. Page 1
Reader Protocol Specification Revision 1.0.0
Table of Contents
1Introduction and Scope
1.1Introduction
1.2Scope
2Communication Scheme
3Overview of the Protocol
3.1Reading the Hierarchy Tables
3.2Hierarchy for Requests from the Host to the Reader
3.3Hierarchy Responses from the Reader to the Host
4BCC
53M™ Reader Error(s)
6Format of the Data
7Normal Commands
7.1Read Block UID
7.2Reader Version
7.3ISO Pass thru
7.4Quiet
7.5Read Multiblock
7.6Write Multiblock
7.7Write Block
7.8Write & Lock Block
7.9Lock Block
7.10Get AFI
7.11Write AFI
7.12Lock AFI
7.13Check EAS
7.14EAS Control
7.15Get DSFID
7.16Write DSFID
7.17Lock DSFID
7.18Tag Info
Appendix A: Error Codes
Appendix B: ISO Manufacturer Codes
Appendix C: CRC Calculations
Appendix E: Revisions History
1Introduction and Scope
1.1Introduction
The purpose of this document is to define the communication protocol used by the 3M™RFID Reader USB powered pad Model 210.
This reader protocol was designed for use with a variety of tag types including ISO 15693 tags and TITag-It™ tags. This document will explain how to use the RS-232 Serial Protocol.
The basic operation of the reader is as follows. The reader will wait until it receives a valid command on the RS232 Port. Upon receiving a command the reader will complete the requested task and send a response to the host. This can be any device capable of sending and receiving RS232 data, such as a computer or PDA. The host should take care to not send another command until a complete response has been received from the RFID Reader. The reader will ignore a command sent while it is processing another command.
1.2Scope
The intended audience of this document is programmers creating software to interface with 3M RFID Readers. The user should have general knowledge of what an RFID Reader does and its basic functions. The reader should also have extensive knowledge of RS232 communications.
Values prefaced with x or 0x are in hex. Example values in the left column of tables are in hex.
2Communication Scheme
The reader uses a standard USB to serial converter interface. Which means the reader will appear and operate as a COM port to the host. The communication with the 3M Reader shall be at 19200 baud, 8N1 (8 Data Bits, 1 Stop Bit, No Parity Bits).
Further detail on RS-232 communication is outside the scope of this document.
3Overview of the Protocol
The protocol consists of two types of field. The mandatory fields are in every command of the protocol. Examples of mandatory fields are start byte, length, command code and BCC. The Conditional Fields are only implemented in some commands. The conditional parts will be described in the detailed section of each command. When a conditional field is not used it will be absent from the command being sent.
All messages to and from the reader contain the following parts.
Start Byte / 1 Byte in Length / This is a 0xD6 hex number that is sent at the beginning of all messages.Length / 2 Bytes in Length / This is the total of all bytes that will be sent following the transmission of the length bytes themselves.
Command Code / 1 Byte in Length / Every Command has a unique identifier that is placed at this point in the message.
Conditional Fields / Variable in Length / This is defined in each of the command descriptions. There may not be any data at all for a command.
BCC / 2 Bytes in Length / This is a CRC calculated on all of the bytes proceedingwith the exception of the Start Byte.
3.1Reading the Hierarchy Tables
The following tables show the layout of the different fields in a command. For a user creating a command this table should be used as a reference as to where a field should be placed relative to other fields. If a command only has one conditional field, for example, serial number, then serial number would be placed after the command code and before the BCC. If a command uses more than one conditional field then the fields are placed according to their order on the following charts. Address comes before Block Number and so on.
3.2Hierarchy for Requests from the Host to the Reader
This is the Field Hierarchy. In the individual command description Other Fields will be described and their use will be explained.
Name / Bytes / Description / Mandatory or OptionalStart Byte (0xD6) / 1 / Start byte for all commands / Mandatory
Length / 2 / The number of bytes that will follow this section / Mandatory
Command Code / 1 / Unique Code for each command / Mandatory
Address / 8 / The Serial Number of the tag being communicated with for this command / Conditional
Other Fields / X / Any number of other variables that need to be passed for a command will go here / Conditional
BCC / 2 / This is a checksum for the command. It is calculated on all bytes preceding this excluding the start byte / Mandatory
3.3Hierarchy Responses from the Reader to the Host
These are all of the fields that can be included in a response and which order they are returned. In the individual command descriptions the Other Fields will be described.
Name / Bytes / Description / Mandatory or OptionalStart Byte (0xD6) / 1 / Start byte for all commands / Mandatory
Length / 2 / The number of bytes that will follow this section / Mandatory
Command Code / 1 / Unique Code for each command / Mandatory
Error Code / 1 / If an error occurred during the command / Mandatory
Address / 8 / If an address was sent during the command then it will be returned to the host here / Conditional
Other Fields / X / Any number of other variables that need to be passed for a command will go here / Conditional
BCC / 2 / This is a checksum for the command. It is calculated on all bytes preceding this excluding the start byte / Mandatory
4BCC
The BCC is a CRC checksum found at the end of every message sent to, and received from, the RFID reader. The BCC is calculated on all of the bytes in the message with the exception of the Start Byte.
CRC Type / Length / Polynomial / Direction / Preset / ResidueCRC-CCITT / 16 bits / X16 + X12 + X5 + 1 / Forward / FFFF16 / 1D0F16
Example:
Outgoing Message: D6 00 09 03 00 02 00 00 00 03
Calculate CRC on all bytes but D6, resulting CRC = 12 E6
See Appendix B for sample code on how to calculate the CRC.
A more detailed explanation of BCC is outside the scope of this document.
53M™ Reader Error(s)
The reader will send a general error when a command is received that has not been implemented in the firmware. This could occur because the wrong value was inserted into the command code field, or this could occur because an old version of firmware does not have a certain command implemented. When the reader receives a message for a command that is not supported, the response will look exactly as follows except the CC in Command Code will be the same value that was passed to the reader from the host.
Example of a Reader Error Response for an unimplemented command:
Example Value / Name / Description / ValuesD6 / Start / Start Byte / Fixed
00 04 / Length / Bytes after this field / Variable
CC / Command Code / Command Code of the Request sent to the reader. / Variable
02 / Error Code / Command Not Implemented / Fixed
XX XX / BCC / CRC checksum / Calculated
For a description of the other error code values, see the appendix.
6Format of the Data
Numeric data (serial numbers, 16 bit integers, etc.) being transmitted to and sent from the reader shall be sent in the Big-Endian format. Meaning the MSB is transmitted first and the LSB is transmitted last. When reading a number in the documentation the number on the left represents the MSB and shall be transmitted first.
Example- a 500 needs to be sent for a 16bit integer field:
500 = 1F4 hex so the following would be transmitted in 2 bytes: 01 F4.
Serial Numbers:
When transmitting a serial number of an ISO tag use the following manner:
MSB-LSB
E0 07 00 00 06 71 53 99
When transmitting the serial number of a TI tag fill the first 32 bits with 0’s
0’s ------MSB---LSB
00 00 00 00 1A 23 B5 9F
This format is consistent with the 32-bit TI format of transmitting and receiving data.
7Normal Commands
This section has detailed examples of all the standard commands implemented in the protocol. Each section will have a description of what the purpose of the command is and then will have an explanation of all the conditional fields used in this command.
Non-addressed commands (from the standpoint of the serial protocol):
Command Name / Description / Command CodeRead Block UID / Poll (inventory) for tags / 0xFE
Reader Version / Get firmware version / 0x11
ISOPass thru / Send raw ISO air commands / 0x14
Addressed commands (commands that require a specific tag serial number):
Command Name / Description / Command CodeQuiet / Quiet a specific tag / 0x01
Read Multiblock / Read block(s) data from a specific tag / 0x02
Write Multiblock / Write block(s) data to a specific tag / 0x04
Write Block / Write 1 block of data to a specific tag / 0x05
Write and Lock Block / Write/lock 1 block of data to a specific tag / 0x07
Lock Block / Lock 1 block of data on a specific tag / 0x08
Get AFI / Read AFI from a specific tag / 0x0A
Write AFI / Write AFI to a specific tag / 0x09
Lock AFI / Lock AFI on a specific tag / 0x06
Check EAS / Read EAS from a specific tag / 0x03
EAS Control / Write EAS to a specific tag / 0x0C
Get DSFID / Read DSFID from a specific tag / 0x0F
Write DSFID / Write DSFID to a specific tag / 0x0B
Lock DSFID / Lock DSFID on a specific tag / 0x0E
Tag Info / Get many things from a specific tag / 0x0D
7.1Read Block UID
Description: The primary purpose of this command is to identify all of the transponders in the field. For each transponder found, various optional data will be returned given by the Response Options Field. The operation of this command is affected by the Set Air Interface command unless protocols are specific in the request fields. Depending on the options set this command will return ISO tags, Tag-It tags or both.
Command Code: 0xFE
Tags Supported: ISO 15693 tag
TITag-It™tag
Request Fields: AFI - Return only tags with this AFI value; 0 for all tags.
Response Options –
Bit 0: Address – return 8 byte serial number for each tag
Bit 1: DSFID – return 1 byte DSFID for each tag
(Note that DSFID is returned BEFORE the address)
Bit 2*: Ignored unless bit4 set
Bit 3*: used when bit4 set otherwise reserved (set 0)
Bit 5: Skip quiet and 2nd poll
Bit 6: Protocol(s) are included
Bit 7: Reserved (set 0)
Protocols – when bit above is set –
Bit0: Tag-It
Bit1: ISO
Bits 2-7: Reserved (set 0)
Response Fields: AFI – Requested AFI
Response Options – Requested response options
Number of Transponders – How many tags were found
[DSFID, Address] – optional data returned for each tag found
Error Codes:
0x31 – Response Option(s) not supported
0x02 – Command not implemented
Remarks: The AFI and the response options fields determine what tags are found and what data is returned. TI Tag-It tags are NOT returned when a non-zero AFI is specified. The DSFID byte, when requested, is returned before the 8 byte serial number. A DSFID of 0 is returned for TI Tag-It tags which mirror what is returned by ISO tags that do not support a DSFID. Reserved bits in the response options field should be set to 0 (note that bit 2 has effectively been orphaned because older firmware interpreted 0x01 and 0x05 in the same manner). Note that it is possible for the same address to be returned more than once in a single Read Block UID response (e.g. if the tag does not hear the quiet command it will respond in the 2nd poll and the reader does not remove duplicate addresses).
Example of a Request:
Example Value / Name / Description / ValuesD6 / Start / Start Byte / Fixed
00 05 / Length / Bytes after this field / Variable
FE / Command Code / Read Block UID / Fixed
00 / AFI / Return all tags (0) or tags with a specific AFI value / 0-255
05 / Response Options / What to return for each tag found. / See above
XX XX / BCC / CRC checksum / Calculated
Example of a Response with no error:
Request: D6 00 05 FE 00 05 XX XX
Example Value / Name / Description / ValuesD6 / Start / Start Byte / Fixed
00 17 / Length / Bytes after this field / Variable
FE / Command Code / Read Block UID / Fixed
00 / Error Code / No Error / 00 – No Error
00 / AFI / AFI from request / Same as request
05 / Response Options / What is returned for each tag found / Same as request
02 / Num Tags / 2 tags were found / Variable
00 00 00 00
00 AD 63 02 / Address / UID of 1st tag / Any Legal UID
E0 07 00 00
00 60 00 AE / Address / UID of 2nd tag / Any Legal UID
XX XX / BCC / CRC checksum / Calculated
7.2Reader Version
Description: This is the internal firmware version number.
Command Code: 0x11
Request Fields: None
Response Fields: Version Number – this is a 4-byte code as follows:
Byte0: x0A (3M Readers)
Byte1: Major Value
Byte2: Minor Value
Byte3: Build Version
Error Codes:
0x02 – Command not implemented
Example of a Request:
Example Value / Name / Description / ValuesD6 / Start / Start Byte / Fixed
00 03 / Length / Bytes after this field / Variable
11 / Command Code / Reader Version / Fixed
XX XX / BCC / CRC checksum / Calculated
Example of a Response:
Request: D6 00 03 11 XX XX
Example Value / Name / Description / ValuesD6 / Start / Start Byte / Fixed
00 08 / Length / Bytes after this field / Variable
11 / Command Code / Reader Version / Fixed
00 / Error Code / No Error / 00 – No Error
0A 03 02 06 / Firmware Version / 3M™ Reader
Version 03.02.06 / Variable
XX XX / BCC / CRC checksum / Calculated
7.3ISOPass thru
Description: This command allows low-level ISO air commands to be sent directly. It is mainly for the use of manufacturer implemented custom ISO commands but it can also be used to override the reader firmware’s default processing with specific tags. The reader should be familiar with the ISO/IEC 15693-2 and 15693-3 specifications.
Command Code: 0x14
Request Fields: Send Data Size* – 2Byte size of ISO air command send data
Receive Size* – 2Byte size of air command response
Control Options – 2Bytes as follows:
Bit 0-10 / 11**: number of clock waits for response
Bit 11 set 1***: no intelligence when “raw receive” set
Bit 12 set 1**: override standard clock wait; use above
Bit 13 set 1**: send 100% EOF after wait to get response
Bit 14 set 1***: “raw receive” mode (minimal intelligence)
Bit 15: set 1 if RF Flags is included below
[RF Flags] – if bit15 in control options set, 1 byte as follows:
Bit 3: set 1 to stop receiving if no sof (“raw receive” only)
Bit 4: set 1 for t1 nominal timing, 0 for t1 max
Send Data* – ISO air command data
Response Fields: Result Flags – 1 byte for debugging purposes, low bits as follows:
Bit 0: the SOF was found
Bit 1: the EOF was found
Bit 2: there were code violation(s) in the data
Receive Size* – 2Byte size of air command response data
Receive Data* – ISO air command response data
Error Codes:
0x31 – Control option(s) not supported
0x02 – Command not implemented
* In normal use, send and receive sizes/data do NOT include the ISO spec CRC. The CRC is added/checked automatically by the firmware. Also, the receive size should be the maximum expected bytes (less may be returned). In “raw receive” mode, however, the receive size becomes the exact number of bytes you want to receive.
** The override bit must be set for bits 0-11 to be used, otherwise the firmware uses a standard clock wait. Typically for ISO air commands that read tag data you can pass 0x0000 for the control options. ISO air commands that write tag data will probably need control options. For example, TI ISO tags required the send EOF about 10ms after a command that writes data (block, afi, etc). Note that the clock waits are bits 0-10 when “raw receive” is set. “Clock waits” are 9.44uS clocks when using the “send 100% EOF” method (i.e. TI tags) and 18.88uS clocks when this method is not used (i.e. NXP and ST tags).
*** “Raw receive” mode gives three options. Raw receive with no intelligences reads bits as they are read over the air and returns exactly receive size bytes of them (so any SOF and EOF will be returned as bits). No checking on anything is done so the returned Result Flags are undefined. Raw receive mode with minimal intelligence (no intelligence bit set to 0) checks/discards the first 8 bits and last 8 bits for SOF/EOF and sets the Result Flags appropriately. If RF Flags are included and the “stop if no sof” bit is clear, then all bits between the expected SOF/EOF are de-manchestered until there are receive size bytes of them, which are then returned. If the “stop if no sof” bit is set then reading stops if the sof was not found but receive size bytes (of random values) are still returned so you need to check the returned Result Flags. If there are code violations anywhere in the data stream, the Result Flag bit is set AND any bytes with code violation(s) are returned as 0xFF. Note that in raw receive mode the clock waits are limited to bits 0-10. Some reader platforms do not support the “no intelligence” bit – you can check for the option not supported error code in this command or use the Extended Info with Reader Platform Flags ID to find out before-hand.