EL-UHF-RMT01 Protocol

Frame Definition §

The serial communication between the Host Computer and the Interrogator is done frame by frame with formats explained below.

Frame Format §

The CRC is calculated by summing the frame bytes from Type to the last byte of Parameter, only taking the LSB byte.

Frame Type §

Each command frame has a corresponding response frame. The response frame indicates whether the instruction has been executed.

There are corresponding notification frames for single inventory instructions and multiple inventory instructions. The notification frames is automatically sent to the Host Computer by the Interrogator according to the reading situation. When the Interrogator reads a tag, it sends a notification frame, and when the Interrogator reads multiple tags, it sends multiple notification frames.

Frame Code Index §

This is the list of possible code for the command frame and the corresponding response frame. Usually, the response frame will have the same code as the command code with this exception:

• 0xE5 command code can have 0xE5 or 0xE6 response code
• 0xD3 command code can have 0xD3 or 0xD4 response code
• Error response frame will have 0xFF as the response code

Response Error Codes §

If the execution of the instruction fails, the interrogator will return a response frame of execution failure which has 0xFF as the Command Code.

The response frame parameter will be 1 Byte of error code, and sometimes with PC+EPC of the tag if available.

NXP G2X ReadProtect Custom Command Error §

EPC Gen2 Error §

This is the format of the error response frame related to EPC Gen2 Protocol.

The error codes specified by the EPC Gen2 protocol is only 4 bits, and it is represented on the lower 4 bits of the response frame error code. The upper 4 bits is 0xA — 0xE depending on the command it corresponds to.

EPC Gen2 protocol returns an error code with this format:

This is from Table I.2: Tag error codes of EPCglobal Gen2 Specification v2.0.1.

Frame Examples §

Interrogator Module Configuration §

0x03 Get Interrogator module information §

Get module information: hardware version, software version or manufacturer information.

Instruction Code: 0x03

Command Parameter:

• Hardware version: 0x00
• Software version: 0x01
• Manufacturer: 0x02

Response Parameter:

• First byte will be the same as the command parameter.
• Next bytes will be the hardware module name and version in ASCII encoding.

Command to get the hardware version §

Successful Response §

The response parameter starts with 0x00, corresponding to the command parameter. The next bytes are 4D 31 30 30 20 56 31 2E 30 30, which is ASCII code of “M100 V1.00”

0x11 Set communication baud rate §

The baud rate in the parameter is the actual baud rate divided by 100. For this example, the target baud rate is 19200, so the value is 19200 / 100 = 192 = 0xC0.

Command §

No Response Frame §

There is no response frame for this instruction. After the Interrogator has changed the communication baud rate, the Host Computer will need to reconnect to the Interrogator with the new baud rate.

0x17 Module Sleep §

The module sleep command allows the Interrogator to maintain a low-power sleep mode. The Host Computer can wake the Interrogator up by sending any byte through the serial port, but the data will be discarded.

The first command received after the module sleeps will not respond because the first character of the first command will Was abandoned. This command will reset the M100/QM100 chip after power-off. After the module wakes up, it will re-download the firmware to the M100/QM100 chip and reset some parameters to the module (these parameters include the power, frequency, and frequency hopping configured before sleep Mode, sleep time, receiver demodulator parameters, excluding Select mode, Select parameters, etc.), so some parameters may need to be reset. The instructions are as follows:

Command §

Response §

0x1D Module Idle sleep time §

This command can set how long the module will automatically enter the sleep state after no operation. After the module sleeps, it can wake up by sending any character through the serial port. After the module sleeps, the first command received will not respond because the first character of the first command will be discarded. This command will reset the M100/QM100 chip. After the module wakes up, it will re-download the firmware to the M100/QM100 chip and reset some parameters to the module (these parameters include the power, frequency, and frequency hopping mode configured before sleep. Sleep time, receiver demodulator parameters, excluding Select mode, Select parameters, etc.), so some parameters may need to be reset.

The parameter define number of minutes of inactivity before sleep. The range is 1 to 30 minutes. 0x00 means no sleep.

Command §

To set the idle sleep time to two minutes:

Successful Response §

0x04 Module Idle mode §

This command allows the module to enter IDLE working mode. In IDLE mode, except for the digital part and communication interface, all other analog and RF parts of the power supply are turned off to reduce power consumption when not working. After the module enters the IDLE mode, it can still communicate with the module normally, the set parameters are still saved, and the module can normally respond to the instructions of the Host Computer. After entering IDLE mode, the first inventory (or instructions that require interaction with tags such as reading or writing tag data) will restore the module to its normal state, but the first inventory may be successful due to the unstable power state of the RF part The rate drops, and subsequent inventory and other operations can return to normal.

First parameter: 0x00: Exit Idle Mode, 0x01: Enter Idle Mode

Second Parameter: Reserved as 0x01

Idle Mode Time: Number of minutes before entering Idle mode. The value ranges from 0x00 to 0x1E (30 Minutes). 0x00 means never enter Idle mode.

Command §

To set the idle mode time to three minutes:

Successful Response §

Inventory Commands §

0x22 Single Inventory §

Complete an inventory operation in the EPC Class1 Gen2 protocol. The instruction does not include the Select operation. The power amplifier will be turned on and off automatically before and after each inventory command is executed. In the single inventory command, the Query operation parameter is configured by another command, and the initial value is already in the firmware.

Command §

Notification §

After the Interrogator receives a single inventory command, if it can read the tag with the correct CRC check, the Interrogator will return the data including RSSI, PC, EPC and CRC.

The Interrogator will return one notification frame for each of the successfully read Tag.

The RSSI value reflects the size of the signal at the input of the chip, excluding antenna gain and directional coupler attenuation. RSSI is the signal strength at the input end of the chip, signed in hexadecimal, and the unit is dBm. In the above example, the RSSI is 0xC9, which means the signal strength at the input of the chip is -55dBm.input end of the chipinput end of the chip

0x15 Error Response §

If no tag is detected or the data CRC error is detected, the parameter value will be error code 0x15:

0x27 Multiple Inventory §

Command §

Inventory multiple times, and the number of polling times is limited to 0-65535. If the number of polling is 10000 times, the command is as follows:

0x2710 = 10,000.

Notification §

The multiple inventory response frame is the same as the single inventory response frame:

0x15 Error Response §

If no tag is detected or the data CRC error is detected, the parameter value will be error code 0x15:

0x28 Stop multiple inventory §

This instruction stops the multiple inventory in process.

Command §

Success Response Frame §

Select Commands §

The parameters of this select commands are explained in 6.3.2.12.1 Select commands.

0x0C Set Select §

Command: §

Set the Select parameter and set the Select mode to 0x02 at the same time (Send the Select command before inventory the label). In the case of multiple tags, you can only inventory, read and write operations for specific tags based on the Select parameter. E.g:

SelParam: 0x01 (Target: 0b000, Action: 0b000, MemBank: 0b01)
SelParam has a total of 1 Byte, of which Target occupies the highest 3 bits, Action occupies the middle 3 bits, and MemBank occupies the last 2 bits.

• Target
  Refer to EPC Gen2 Protocol
• Action
  Refer to EPC Gen2 Protocol
• Membank
  The meaning of MemBank is as follows:
  • 0b00: Reserved Memory Bank
  • 0b01: EPC Memory Bank
  • 0b10: TID Memory Bank
  • 0b11: User Memory Bank

Pointer: 0x00000020 (in bits, not words) Starting from the EPC Memory Bank

MaskLen: 0x60 (6 words, 96 bits) )

Whether Truncate: 0x00 (0x00 is Disable truncation, 0x80 is Enable truncation)

When the Select Mask length is greater than 80 bits (5 words), sending the Select command will first set all tags in the field to Inventoried Flag as A and SL Flag as ~SL, and then operate according to the selected Action. When the Select Mask length is less than 80 bits (5 words), the label status will not be set to Inventoried Flag A and SL Flag ~SL through the Select command in advance.

Mask: 0x30751FEB705C5904E3D50D70

Success Response:

0x0B Get Select §

Command: §

Response: §

SelParam: 0x01 (Target: 3’b000, Action: 3’b000, MemBank: 2’b01)

Pointer: 0x00000020 (in bits, not words) Starting from the EPC Memory Bank

MaskLen: 0x60 (6 words, 96 bits) )

Whether Truncate: 0x00 (0x00 is Disable truncation, 0x80 is Enable truncation)

0x12 Set Select mode §

Command: §

If the Select parameter has been set, execute this command to set the Select mode. For example, if you want to cancel the Select command:

Select Mode Mode:
0x00: Send the Select command in advance to select a specific label before all operations on the label.
0x01: Do not send the Select command before operating on the label.
0x02: Only send the Select command before the tag operation except Inventory, such as
Before Read, Write, Lock, Kill, select a specific label through Select.

Success Response: §

RFID Tag Commands §

0x39 Read Tag memory §

Read the data of the specified address and length in the memory Bank of a tag. This instruction takes four parameters:

• Access Password
• MemBank
• WordPtr
• WordCount

Before this instruction, the Select parameter should be set to select the specified tag to read the tag data area. If the Access Password is all zeros, no Access command is sent.

Command §

This command reads from 2 words (4 bytes) starting from address 0x00 of User Memory Bank using 0x0000FFFF as Access Password.

Successful Response §

0x09 Read Fail Response §

0x09 error code means the tag is not in range, or there is an error of the EPC code.

0x16 Wrong Access Password Error §

0xA3 EPC Gen2 Error Response: §

Error Code 0xA3 means that this is an EPC Gen2 error code 0x03: Memory Overrun.

0x49 Write Tag memory §

Before this instruction, the Select parameter should be set first to select the specific tag to write to. If the Access Password is all zeros, no Access command is sent.

The WordCount should not exceed 32 words (64 Bytes = 512 bits).

Command §

Successful Response §

Parameter 0x00 means that the instruction is executed successfully.

0x10 Error Response §

0x10 error code means the tag is not in range, or there is an error of the EPC code.

0x16 Wrong Access Password Error §

0xB3 EPC Gen2 Error Response §

Error code 0xB3 means that this is an EPC Gen2 error code 0x03: Memory Overrun.

0x82 Lock Tag Memory §

Change lock status of a memory bank of the specified tag. Before this instruction, the Select parameter should be set to target the specified tag.

Command §

In this command, the LD is 0x020008.

0x020080 = 0b0000 0b0010 0b0000 0b0000 0b1000 0b0000

The upper 4 bits of the LD is reserved to 0b0000 because the EPC Gen2 Lock-Command Payload only requires 20 bits of data. (Refer to section 6.3.2.11.3.5 of EPC Gen2 Protocol v2.0.1)

Only actions whose mask bits are 1 are going to be executed.

In this 0x020080 example, the mask bits of Access Password is 01 and the action of Access Password is 01. Thus, the access password will be permanently readable and writable.

Successful Response §

0x13 Error Response §

0x13 error code means the tag is not in range, or there is an error of the EPC code.

0x16 Wrong Access Password Error §

0xC4 EPC Gen2 Error Response §

Error Code 0xC4 means that this is an EPC Gen2 error code 0x04: Memory Locked.

0x65 Kill Tag §

Before this instruction, the Select parameter should be set first to select the specific tag to kill.

Command §

Successful Response §

0x12 Error Response §

0x12 error code means the tag is not in range, or there is an error of the EPC code.

0xD0 EPC Gen2 Error Response §

Error Code 0xD0 means that this is an EPC Gen2 error code 0x00: Other error. This may be because the kill password of the tag hasn’t been set.

0xD3 BlockPermalock / 0xD4 Read Permalock Status §

This instruction can permanently lock certain blocks in the user area, or read the lock status of the block. Before this instruction, the Select parameter should be set to the targeted tag.

According to section 6.3.2.12.3.9 of EPCglobal Gen2 Specification v2.0.1:

A BlockPermalock may permalock between zero and 4080 memory blocks. The block size, which is predefined by the Tag manufacturer, is fixed at between one and 1024 words, is the same for all files, and is the same for block permalocking and file allocation. The memory blocks specified by a BlockPermalock need not be contiguous.

Command §

To permanently lock the blocks 5, 6, 7:

0xD3 Read Successful Response §

0xD4 Write Successful Response §

0x14 Tag Not Found Error §

0xE3 EPC Gen2 Error Response §

Error Code 0xE3 means that this is an EPC Gen2 error code 0x03: Memory Overrun.

0x16 Wrong Access Password Error §

Query Commands §

Query command is documented on section 6.3.2.12.2 of EPC Gen2 Protocol v2.0.1.

The parameters for communication between the Host Computer and the Interrogator is documented in the table below with the data represented in binary:

0x0D Get Query parameters §

Command §

Successful Response §

The parameter is 2 bytes, and the following specific parameters are spliced bit by bit. The response parameter corresponding to the above response frame is 0x1020 = 0b0001000000100000

Refer to section 6.3.2.12.2.1 EPC Gen2 Protocol v2.0.1

In the table below, the data are reresented in binary.

DR=8, M=1, TRext=Use pilot tone, Sel=All, Session=S0, Target=A, Q=4

0x0E Set Query parameters §

Command §

This command set the Query parameters to the same value as the previous get Query parameters instruction example.

Successful Response §

Radio Frequency §

Radio frequency of the Interrogator is determined by the region and the frequency channel listed below.

0x07 Set Frequency Region §

To set the Frequency Region 920++ MHz Based, set the Region Index to 0x01.

Command §

Successful Response §

0x08 Get Frequency Region §

Command §

Successful Response §

The region index is 01, so the frequency region is 920++ MHz Based.

0xAB Set Frequency Channel §

If it is the 900++ MHz Based, to set the frequency channel of the reader to 920.375 MHz, set the CH_Index to: (920.375 - 920.125) / 0.25 = 01.

Command §

Successful Response §

0xAA Get Frequency Channel §

Command §

Successful Response §

If the frequency region is 920++ MHz based, the CH_Index 0x00 means the frequency channel is: (0 * 0.25 + 920.125) MHz = 920.125 MHz.

0xAD Set automatic frequency hopping §

In the automatic frequency hopping mode, if the user executes the instruction to insert the working channel, the reader will randomly select the channel frequency hopping from the channel list set by the user, otherwise, the channel frequency hopping will be randomly selected according to the internal preset channel list.

Possible parameter for the command is:

• 0x00: Disable automatic frequency hopping
• 0xFF: Enable automatic frequency hopping

Command §

Successful Response §

0xA9 Insert working channel §

Inserting the working channel allows the user to independently set the frequency hopping channel list. After executing this command, the reader will randomly select the channel hopping frequency from the channel list set by the user. The command is defined as follows:

Command §

Successful Response §

0xB7 Get transmit power §

Command §

Response §

Power: 0x07D0 = Decimal 2000 = 20 dBm

0xB6 Set Transmit Power §

Command §

Successful Response §

0xB0 Set to transmit continuous wave §

Parameter:

• 0x00: Disable Continuous Wave
• 0xFF: Enable Continuous Wave

Command §

Successful Response §

0xF1 Get receiver demodulator parameters §

Includes: Mixer gain, IF AMP gain and signal demodulation threshold.

Command §

Response §

Mixer gain Mixer_G: 0x03 (Mixer gain is 9dB)

IF amplifier gain IF_G: 0x06 (IF AMP gain is 36dB)

Signal demodulation threshold Thrd: 0x01B0 (the smaller the signal demodulation threshold, the lower the return RSSI of the demodulated tag, but the more unstable it is. It cannot be demodulated at all if the value is lower than a certain value; on the contrary, the larger the threshold, the demodulated tag return signal RSSI The larger the distance, the more stable. 0x01B0 is the recommended minimum)

0xF0 Set the receiver demodulator parameters §

Command §

Successful Response §

0xF2 Test the blocking signal at the RF input §

Testing the blocking signal at the RF input Scan Jammer is used to detect the magnitude of the blocking signal of each channel of the reader antenna in the current area.

Command §

Response §

If there are a total of 20 channels in the 900MHz frequency band in China, and the scanning of the radio frequency input blocking signal Scan Jammer channel is executed correctly

Test start channel CH_L: 0x00 (Test start channel Index is 0)

Test end channel CH_H: 0x13 (Test end channel Index is 19)

Channel blocking signal JMR: 0xF2F1F0EFECEAE8EAECEEF0F1F5F5F5F6F5F5F5F5 (blocking signal for each channel
JMR is represented by a signed Byte, where 0xF2 is -14dBm).

0xF3 Test channel RSSI §

Command §

Response §

If there are 20 channels in 900MHz Based Frequency, this is the returned RSSI for each channel.

Each channel RSSI is represented by a signed Byte, where 0xBA is -70 dBm.

NXP Custom Commands §

0xE1 NXP ReadProtect/Reset ReadProtect Command §

NXP G2X tags support ReadProtect/Reset ReadProtect commands. When the tag executes the ReadProtect command successfully, the ProtectEPC and ProtectTID bits of the tag will be set to ‘1’ and the tag will enter the data protection state. If the label returns to the normal state from the data protection state, the Reset ReadProtect command needs to be executed. Before this instruction, the Select parameter should be set to select the specified label for operation.

Command §

To set read protect to the selected tag with 0x0000FFFF access password:

Successful Response §

Successful Reset Read Protect Response §

0x2A Tag Not Found when Setting Read Protect §

0x2A error code means the tag is not in range, or there is an error of the EPC code.

0x2B Tag not Detected when Resetting Read Protect §

0x16 Wrong Access Password Error §

0xE3 NXP Change EAS §

NXP G2X tags support the Change EAS command. When the tag executes the Change EAS command successfully, the PSF bit of the tag will change to ‘1’ or ‘0’ accordingly. When the PSF position of the tag is ‘1’, the tag will respond to the EAS_Alarm instruction, otherwise the tag will not respond to the EAS_Alarm instruction. Before this instruction, the Select parameter should be set to select the specified label for operation.

Command §

To set PSF bit to 1 (Tag will response to EAS_Alarm):

Successful Response §

0x1B Tag Not Found Error §

0x16 Wrong Access Password Error §

0xE4 NXP EAS_Alarm §

Tags with PSF bit set to 1 will respond to this instruction by returning 64-bit EAS Alarm code.

Command §

Successful Response §

0x1D No Tag Responding §

0xE0 NXP ChangeConfig §

Some series of NXP G2X tags (such as G2iM and G2iM+) support the ChangeConfig command, which can be used to read or modify the 16bits Config-Word of NXP G2X tags. The Config-Word of the NXP G2X tag is located at the address 20h (word address) of EPC Memory Bank and can be read by a normal Read command. When the tag is in the Secured state (safe state), the Config-Word of the tag can be rewritten. It should be noted that rewriting Config-Word means flipping the corresponding data bit of Config-Word, that is, writing the corresponding bit of ‘1’ flipping (‘1 ‘Becomes ‘0’, ‘0’ becomes ‘1’), the corresponding bit written in ‘0’ remains unchanged. Before this instruction, the Select parameter should be set to select the specified label for operation.

Config parameter: when 0x0000 means read.

Command §

Successful Response §

0x1A No Tag Responding §

0x16 Wrong Access Password Error §

Impinj Monza Custom Commands §

0xE5 Impinj Monza QT Command §

Impinj Monza 4 QT tags support the QT command, which can modify the QT Control word of the tag. Setting the QT_SR bit can shorten the operation distance of the tag in the Open and Secured states or when it is about to enter the Open and Secured states. Modifying the QT_MEM bit can switch the label to use Public Memory Map (Public Memory Map) or Private Memory Map (Private Memory Map). Before this instruction, the Select parameter should be set to select the specified label for operation.

Command §

To write to NVM memory with QT_SR 0x40 and QT_MEM 0x00:

0xE5 Read Successful Response §

0xE6 Write Successful Response §

0x2E Tag Not Found Error §

0x16 Wrong Access Password Error §