EL-UHF-RC4 Protocol
Communication Protocol
EL-UHF-RC4 can communicate with external application through:
- RS232
- USB
- TCP/IP depending on the reader interfaces.
Serial port communication parameter
115200 8N1:
- Baud rate: 115200 bps
- 8 data bit
- 1 stop bit
- Without parity check bit
Command
Command refers to the data packets sent by the external application to the EL-UHF-RC4 module.
HEAD | ADDR | CMD | LEN | Param | CHECK |
---|---|---|---|---|---|
1Byte | 1Byte | 2Bytes | 1Byte | 0~255Byte | 2Byte |
Response
Response refers to the data packets returned by the module to the external application
HEAD | ADDR | CMD | LEN | STATUS | Param | CHECK |
---|---|---|---|---|---|---|
1Byte | 1Byte | 2Bytes | 1Byte | 1Byte | 0~254Byte | 2Byte |
Data Frame Format
Field | Length (Byte) | Description |
---|---|---|
HEAD | 1 | HEAD is always 0xCF,this byte is used for data frame synchronization. |
ADDR | 1 | Reader address, ranges from 0x00 to 0xFE. 0xFF is a brodacast address. Readers will response to command with 0xFF or ADDR that matches with its own address. The default address of all readers is 0x00. |
CMD | 2 | Command Code |
LEN | 1 | Total length of STATUS and Data[] field in bytes, max length is 255 Bytes (0xFF). |
STATUS | 1 | Execution status of the command. Response contains STATUS field, while Command doesn’t. 0x00 indicates that the command was successfully executed. Status list |
Parameter | 0 - 255 | Parameter field, certain commands doesn’t use this field. |
MSB-CRC16 | 1 | MSB of CRC16 calculated from HEAD to Data[]. |
LSB-CRC16 | 1 | LSB of CRC16 calculated from HEAD to Data[]. |
Status List
STATUS | Error description |
---|---|
0x00 | Successful execution (this only means that the module successfully received the tag response data. If there is a tag execution status in the tag response, you should further judge whether the tag execution status is correct) |
0x01 | The parameter value is wrong, out of range, or the module does not support the parameter value |
0x02 | Command execution failed due to module internal error |
0x03 | Reserved |
0x12 | No tag found during inventory, or tag inventory has finished |
0x14 | Tag response timeout |
0x15 | Demodulation tag response error |
0x16 | Protocol authentication failed |
0x17 | Password error |
0xFF | No more data |
Status code returned by tag:
Operation status code | Operation status | Description |
---|---|---|
0x81 | Other errors | Unknown error returned by label |
0x82 | Storage overflow | The destination store does not exist |
0x83 | Store lock | Write to the storage area locked as non writable, Perform or erase operation, and read the storage area locked as unreadable |
0x84 | Insufficient power | The tag does not have enough energy to complete the operation |
0x85 | Unspecified error | Unknown error returned by label |
CRC16 Calculation
CRC16 is calculated from HEAD to Data[].
#define PRESET_VALUE 0xFFFF
#define POLYNOMIAL 0x8408
unsigned int uiCrc16Cal(unsigned char const * pucY, unsigned char ucX) {
unsigned char ucI,ucJ;
unsigned short int uiCrcValue = PRESET_VALUE;
for(ucI = 0; ucI < ucX; ucI++) {
uiCrcValue = uiCrcValue ^ *(pucY + ucI);
for(ucJ = 0; ucJ < 8; ucJ++) {
if(uiCrcValue & 0x0001) {
uiCrcValue = (uiCrcValue >> 1) ^ POLYNOMIAL;
} else {
uiCrcValue = (uiCrcValue >> 1);
}
}
}
return uiCrcValue;
}
In Python:
def calculate_checksum(data: bytes) -> bytearray:
value = 0xFFFF
for d in data:
value ^= d
for ucJ in range(8):
value = (value >> 1) ^ 0x8408 if value & 0x0001 else (value >> 1)
crc_msb = value >> 0x08
crc_lsb = value & 0xFF
return bytearray([crc_msb, crc_lsb])
HEADER = 0xCF
BROADCAST_ADDRESS = 0xFF
INIT_DEVICE_COMMAND = bytearray([0x00, 0x50])
DATA = bytearray([])
DATA_LENGTH = len(DATA) # 00
request_data = bytearray([HEADER, BROADCAST_ADDRESS])
request_data.extend(INIT_DEVICE_COMMAND)
request_data.extend(DATA)
request_data.extend(bytearray([DATA_LENGTH])) # CF FF 00 50 00
checksum = calculate_checksum(request_data) # 07 26
request_data.extend(checksum)
print(' '.join("{:02X}".format(d) for d in request_data)) # CF FF 00 50 00 07 26
Command list
Command Name | CMD | Description |
---|---|---|
INVENTORY_ISO_CONTINUE | 0x0001 | Start tag inventory |
INVENTORY_ISO_STOP | 0x0002 | Stop tag inventory |
MODULE_INT | 0x0050 | Initialize the module |
RESET | 0x0052 | Reset basic module settings to the default values. |
SET_PWR | 0x0053 | Set RF power |
SET_GET_NETWORK_SETTINGS | 0X005F | Set/get module network settings |
SET_GET_REMOTE_SETTINGS | 0x0064 | Set/get remote device settings |
GET_DEVICEINFO | 0X0070 | Get the device/module version and SN |
SET_BASIC_SETTINGS | 0x0071 | Set module basic settings |
GET_BASIC_SETTINGS | 0x0072 | Get module basic settings |
SET_GET_FILTER | 0x0073 | Controls filter settings |
SET_GET_IO_SETTINGS | 0x0074 | Input/output IO settting |
OPEN_CLOSE_RELAY | 0x0077 | Release/close relay |
Inventory Commands
INVENTORY_ISO_CONTINUE
This command is the ISO 18000-6C Standard of multi-tag Inventory with anti-collision algorithm.
HEAD | ADDR | CMD | LEN | Reserved | CRC16 |
---|---|---|---|---|---|
0xCF | 0xFF | 0x0001 | 0x05 | 0x0000000000 | 0xF5B5 |
Command frame:
CFFF0001050000000000F5B5
Response:
HEAD | ADDR | CMD | LEN | STATUS | InventoryParam | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0x00 | 0x0001 | 1Byte | 1Byte | 2Byte |
Status:
- 0x00 - Inventory successful, Param will contain tag info
- 0x01 - MemBank parameter is wrong, or length is inconsistent
- 0x02 - Command execution failed due to module internal error
- 0x12 - No tag found during inventory, or tag inventory has finished
- 0x17 - Tag Info length exceeds maximum
InventoryParam
🔗
- RSSI - 2Bytes
- RSSI of the Tag ACK Response
- Unit: 0.1dBm
- Encoding: two’s complement format
- 0xFE48 = -440 = -44 dBm
- Antenna - 1Byte
- Value: 0x01 for single antenna unit
- Channel - 1Byte
- Tag Info Length - 1Byte
- Unit: Bytes
- Tag Info - N Bytes
INVENTORY_ISO_STOP
Command:
HEAD | ADDR | CMD | LEN | CRC16 |
---|---|---|---|---|
0xCF | 0xFF | 0x0002 | 0x00 | 2Byte |
Response:
HEAD | ADDR | CMD | LEN | STATUS | CRC16 |
---|---|---|---|---|---|
0xCF | 0x00 | 0x0002 | 0x01 | 1Byte | 2Byte |
INVENTORY_ACTIVE
In active Work mode, the reader will always inventory and send this response as the result of the inventory:
HEAD | ADDR | CMD | LEN | STATUS | InventoryParam | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0x00 | 0x0001 | 1Byte | 1Byte | 2Byte |
InventoryParam
- RSSI - 2Bytes
- RSSI of the Tag ACK Response
- Unit: 0.1dBm
- Encoding: two’s complement format
- 0xFE48 = -440 = -44 dBm
- Antenna - 1Byte
- Value: 0x01 for single antenna unit
- Channel - 1Byte
- Tag Info Length - 1Byte
- Unit: Bytes
- Tag Info - N Bytes
Inventory Response Example
HEAD | ADDR | CMD | LEN | STATUS | RSSI | Antenna |
---|---|---|---|---|---|---|
0xCF | 0x00 | 0x0001 | 0x12 | 00 | 0xFE48 | 0x01 |
OK | -44 dBm |
Channel | Tag Info Length | Tag Info | CRC16 |
---|---|---|---|
0x00 | 0x0C | 0xE2806F120000000221506094 | 0x7B78 |
12 Bytes |
Setting Commands
MODULE_INT
Initialize the module. This command is used to confirm whether the module is online.
Command:
HEAD | ADDR | CMD | LEN | CRC16 |
---|---|---|---|---|
0xCF | 0xFF | 0x0050 | 0x00 | 2Byte |
Response:
HEAD | ADDR | CMD | LEN | STATUS | CRC16 |
---|---|---|---|---|---|
0xCF | 0x00 | 0x0050 | 0x01 | 1Byte | 2Byte |
Only STATUS 0x00 si valid.
RESET
Reset basic module settings to the default values.
Command:
HEAD | ADDR | CMD | LEN | CRC16 |
---|---|---|---|---|
0xCF | 0xFF | 0x0052 | 0x00 | 2Byte |
Response:
HEAD | ADDR | CMD | LEN | STATUS | CRC16 |
---|---|---|---|---|---|
0xCF | 0x00 | 0x0052 | 0x01 | 1Byte | 2Byte |
SET_PWR
Set RF power (0-30Bm).
Command:
HEAD | ADDR | CMD | LEN | RF Power | Resv | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0xFF | 0x0053 | 0x02 | 1Byte | 0x00 | 2Byte |
Response:
HEAD | ADDR | CMD | LEN | STATUS | CRC16 |
---|---|---|---|---|---|
0xCF | 0x00 | 0x0053 | 0x01 | 1Byte | 2Byte |
SET_GET_NETWORK_SETTINGS
Set/get network parameters (Applicable to LAN)
- Set/Get:
- 0x01 = Set
- 0x02 = Get
NetPara:
Field | Byte | Description |
---|---|---|
IPAddr | 4 | IP address 192.168.1.1 = {0xC0, 0xA8 , 0x01, 0x01} |
MacAddr | 6 | MAC address 00-08-DC-11-11-11 = {0x00, 0x08, 0xDC, 0x11, 0x11, 0x11} |
Port | 2 | Listening port between 0 and 65536, default to 2022 |
NetMask | 4 | Netmask code, default to {0xFF, 0xFF, 0xFF, 0x00} |
GateWay | 4 | Gateway, default to {0xC0, 0xA8, 0x01, 0x01} |
Command:
HEAD | ADDR | CMD | LEN | Set/Get | NetPara | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0xFF | 0x005F | 1Byte | 1Byte | 2Byte |
Set response:
HEAD | ADDR | CMD | LEN | STATUS | Set/Get | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0x00 | 0x005F | 1Byte | 1Byte | 1Byte | 2Byte |
Get response:
HEAD | ADDR | CMD | LEN | STATUS | Set/Get | NetPara | CRC16 |
---|---|---|---|---|---|---|---|
0xCF | 0x00 | 0x005F | 2+N | 1Byte | 1Byte | N Byte | 2Byte |
SET_GET_REMOTE_SETTINGS
Set/get remote network parameters, which is the device (PC, microcontroller, etc) that can receive the data sent from EL-UHF-RC4 Module.
- Set/Get:
- 0x01 = Set
- 0x02 = Get
Netpara:
Field | Byte | Description |
---|---|---|
Enable | 1 | 0 = Disabled 1 = Enabled |
IPAddr | 4 | Remote IP address, 192.168.1.1 = {0xC0, 0xA8, 0x01, 0x01} |
Port | 2 | Listening port, between 0 and 65536, default: 5000 |
Heartbeat | 1 | Heartbeat time (unit: 5 s) |
Command:
HEAD | ADDR | CMD | LEN | Set/Get | NetPara | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0xFF | 0x0064 | 1Byte | 1Byte | 2Byte |
Set response:
HEAD | ADDR | CMD | LEN | STATUS | Set/Get | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0x00 | 0x0064 | 1Byte | 1Byte | 1Byte | 2Byte |
Get response:
HEAD | ADDR | CMD | LEN | STATUS | Get/Set | NetPara | CRC16 |
---|---|---|---|---|---|---|---|
0xCF | 0x00 | 0x0064 | 2 + N | 1Byte | 1Byte | N Byte | 2Byte |
GET_DEVICEINFO
Get the device/module version and SN.
Command:
HEAD | ADDR | CMD | LEN | CRC16 |
---|---|---|---|---|
0xCF | 0xFF | 0x0070 | 0x00 | 2Byte |
Response:
HEAD | ADDR | CMD | LEN | STATUS |
---|---|---|---|---|
0xCF | 0x00 | 0x0070 | 0x99 | 1Byte |
HardVer | FirmVer | SN_code | Reserved | CRC16 |
---|---|---|---|---|
32Bytes | 32Bytes | 12Bytes | 76Bytes | 2Byte |
Field decription:
Field | Byte | Description |
---|---|---|
HardVer | 32 | Module hardware version, in ASCII |
FirmVer | 32 | Module firmware version, in ASCII |
SNCode | 12 | Module serial number, in ASCII |
Reserved | 76 | Reserved for future use |
SET_BASIC_SETTINGS
Set module basic parameters.
Command:
HEAD | ADDR | CMD | LEN | BASIC_SET | CRC16 |
---|---|---|---|---|---|
0xCF | 1Byte | 0x0071 | 1Byte | 25Bytes | 2Bytes |
- ADDR is the current module address that is being targetted by this command.
BASIC_SET Field
Total: 25Bytes:
🔗
- Addr - 1Byte
- Resv - 1Byte - 0x01
- Work mode - 1Byte
- Interface - 1Byte
- Baud rate - 1Byte
- WG - 1Byte
- Resv - 1Byte - 0x01
- RFID Freq - 8Bytes
- RF Power - 1Byte
- MemBank - 1Byte
- QValue - 1Byte
- Session - 1Byte
- Acs Addr - 1Byte
- Acs Data Len - 1Byte
- Filter Time - 1Byte
- Trigger Time - 1Byte
- Buzzer Time - 1Byte
- Polling Interval - 1Byte
Response:
HEAD | ADDR | CMD | LEN | STATUS | CRC16 |
---|---|---|---|---|---|
0xCF | 0xXX | 0x0071 | 0x01 | 1Byte | 2Byte |
- STATUS
- 0x00 - Successful
- 0x01 - Parameter error
GET_BASIC_SETTINGS
Get module basic settings.
Command:
HEAD | ADDR | CMD | LEN | CRC16 |
---|---|---|---|---|
0xCF | 0xFF | 0x0072 | 0x00 | 2Bytes |
Response:
HEAD | ADDR | CMD | LEN | STATUS | BASIC_SET | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0xFF | 0x0072 | 0x1A | 1Byte | 25Bytes | 2Bytes |
BASIC_SET Field
Total: 25Bytes:
🔗
- Addr - 1Byte
- Resv - 1Byte - 0x01
- Work mode - 1Byte
- Interface - 1Byte
- Baud rate - 1Byte
- WG - 1Byte
- Resv - 1Byte - 0x01
- RFID Freq - 8Bytes
- RF Power - 1Byte
- MemBank - 1Byte
- QValue - 1Byte
- Session - 1Byte
- Acs Addr - 1Byte
- Acs Data Len - 1Byte
- Filter Time - 1Byte
- Trigger Time - 1Byte
- Buzzer Time - 1Byte
- Polling Interval - 1Byte
SET_GET_FILTER
Controls the Tag filter settings, this device can filter the tags by data mask and/or access password
Command:
HEAD | ADDR | CMD | LEN | Param | CRC16 |
---|---|---|---|---|---|
0xCF | 0xFF | 0x0073 | 0x16 | 16Bytes | 2Bytes |
Set response:
HEAD | ADDR | CMD | LEN | STATUS | Option | CRC |
---|---|---|---|---|---|---|
0xCF | 0x00 | 0x0073 | 1Byte | 1Byte | 1Byte | 2Bytes |
Get response:
HEAD | ADDR | CMD | LEN | STATUS | Param | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0xFF | 0x0073 | 0x17 | 1Byte | 16Bytes | 2Bytes |
Param:
- Command get or set - 1Byte
- 0x01 - Set
- 0x02 - Get
- Enable access password filter - 1Byte
- 0x00 - Disabled (Default)
- 0x01 - Enabled
- Access password filter - 4Bytes
- Default: {0x00, 0x00, 0x00, 0x00}
- Enable mask filter - 1Byte
- 0x00 - Disabled (Default)
- 0x01 - Enabled
- Start address - 1 Byte
- The starting address of the memory that is being matched with the mask
- Default: 0x00
- Mask length - 1Byte
- Value range: [0, 12]
- Mask data - 12Bytes
- If mask is less than 12Bytes, fill the rest of the field with 0x00
- Default: {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
- Filter setting - 1Byte
- 0x00 - Access password or mask match (Default)
- 0x01 - Access password and mask match
SET_GET_IO_SETTINGS
Command:
HEAD | ADDR | CMD | LEN | Param | CRC16 |
---|---|---|---|---|---|
0xCF | 0xFF | 0x0074 | 0x12 | 18Bytes | 2Bytes |
Get Response:
HEAD | ADDR | CMD | LEN | STATUS | Param | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0xFF | 0x0074 | 0x13 | 1Byte | 18Bytes | 2Bytes |
Param:
- Command get or set - 1Byte
- 0x01 - Set
- 0x02 - Get
- Automatic Relay Enabled - 1Byte
- 0x00 - Disabled (Default)
- 0x01 - Enabled
- Automatic Relay Time - 1Byte
- Unit: seconds
- Default value: 0x03
- Trigger Enabled - 1Byte
- 0x00 - Disabled (Default)
- 0x01 - Enabled
- Trigger Level - 1Byte
- 0x00 less than 0.5V triggers inventory
- 0x01 higher than 2V triggers inventory (Default)
- Buffer Enabled - 1Byte
- 0x00 - Disabled (Default)
- 0x01 - Enabled
- Reserved - 12Bytes
-
[0x00] * 12
-
OPEN_CLOSE_RELAY
Manually open or close relay regardless of the automatic relay caused by inventory. It is recommended to use this while disabling the automatic relay setting in the SET_GET_IO_SETTINGS.
Command:
HEAD | ADDR | CMD | LEN | Option | ValidTime | CRC16 |
---|---|---|---|---|---|---|
0xCF | 0xFF | 0x0077 | 1Byte | 1Byte | 1Byte | 2Byte |
- Option - 1Byte
- 0x01 - Open
- 0x02 - Close
- ValidTime - 1Byte
- Unit: seconds
- 0x00 - The relay will always be set as the option selected
- 0x01 - The relay will be set for 1 seconds
- 0x02 - The relay will be set for 1 seconds
- and so on..
Response:
HEAD | ADDR | CMD | LEN | STATUS | Option | ValidTime | CRC16 |
---|---|---|---|---|---|---|---|
0xCF | 0x00 | 0x0077 | 1Byte | 1Byte | 1Byte | 1Byte | 2Byte |
BASIC_SET
BASIC_SET is a 25 bytes of field to be used in SET_BASIC_SETTINGS and GET_BASIC_SETTINGS command.
BASIC_SET Field
Total: 25Bytes:
- Addr - 1Byte
- Resv - 1Byte - 0x01
- Work mode - 1Byte
- Interface - 1Byte
- Baud rate - 1Byte
- WG - 1Byte
- Resv - 1Byte - 0x01
- RFID Freq - 8Bytes
- RF Power - 1Byte
- MemBank - 1Byte
- QValue - 1Byte
- Session - 1Byte
- Acs Addr - 1Byte
- Acs Data Len - 1Byte
- Filter Time - 1Byte
- Trigger Time - 1Byte
- Buzzer Time - 1Byte
- Polling Interval - 1Byte
Addr
Addr is the new module IP Address, ranges from 0x00 to 0xFE.
Work mode
- 0 - Answer mode
- 1 - Active mode
- 2 - Trigger mode
Interface
- 0x80 - RS232
- 0x20 - RJ45
Baud rate
- 0 - 9600 bps
- 1 - 19200 bps
- 2 - 38400 bps
- 3 - 57600 bps
- 4 - 115200 bps
WG
- 1 Byte of Wiegand parameter:
- Bit7
- 0 - close WG output
- 1 - open WG output
- Bit6
- 0 - wg26
- 1 - wg34
- Bit5
- 0 - low bit first
- 1 - high bit first
- Bit4 - Bit0
- Reserved
- Bit7
RFID Freq
-
8 Bytes of RFID Frequency parameter:
- 1Byte - Region
- 0x00 - User defined
- 0x01 - US [902.75~927.25]
- 0x02 - Korea [917.1~923.5]
- 0x03 - EU [865.1~868.1]
- 0x04 - JAPAN [952.2~953.6]
- 0x05 - MALAYSIA [919.5~922.5]
- 0x06 - EU3 [865.7~867,5]
- 0x07 - CHINA_BAND1 [840.125~844.875]
- 0x08 - CHINA_BAND2 [920.125~924.875]
- 4Bytes - Frequency Min defines the integer and decimal part of the frequency start, for example for 920.125 MHz:
- 2Bytes - Integer part, example:
- 0x0398 - 920 MHz
- 2Bytes - Decimal part, example:
- 0x007D - 0.125 MHz
- 2Bytes - Integer part, example:
- 2Bytes - Frequency Step defines the width of each frequency channel
- 0x7D - 0.125 MHz
- 1Byte - Channel Number
- 1Byte - Region
-
Frequency calculation
- Min Freq = {Frequency Min}
- Max Freq = {Frequency Min} + {Channel Number} * {Frequency Step}
-
Calculation formula for each frequency region
- Chinese band2: Fs = 920.125 + CN * 0.25 (MHz) CN∈[0, 19]。
- US band: Fs = 902.75 + CN * 0.5 (MHz) CN∈[0,49]。
- Korean band: Fs = 917.1 + CN * 0.2 (MHz) CN∈[0, 31]。
- EU band: Fs = 865.1 + CN*0.2(MHz) CN∈[0, 14]。
- Ukraine band: Fs = 868.0 + CN*0.1(MHz) CN∈[0, 6]。
- Peru band: Fs = 916.2 + CN*0.9(MHz) CN∈[0, 11]。
- Chinese band1: Fs = 840.125 + CN * 0.25 (MHz) CN∈[0, 19]。
- EU3 band: Fs = 865.7 + CN * 0.6(MHz) CN∈[0, 3]。
- US band3: Fs = 902 + CN * 0.5 (MHz) CN∈[0,52]。
- Taiwan band: Fs = 922.25 + CN * 0.5 (MHz) CN∈[0,11]。
RF Power
RF power of the module, range: [0, 30]
MemBank
Memory Bank to be read during Inventory
- 0x01 - EPC (Default)
- 0x02 - TID
- 0x03 - User
QValue
Q-parameter - Default: 0x04 - Range: [0, 15]
Session
- Session - The session value used when querying the EPC tag
- 0x00 - S0 (default)
- 0x01 - S1
- 0x02 - S2
- 0x03 - S3
Acs Addr
- Address of the memory bank being read during tag inventory
- Unit: Byte
- Default value: 0
- When accessing the EPC memory, 0x00 indicates the starting address of the EPC number segment of the EPC area without the CRC and PC segment
Acs Data Len
- Acs Data Len - Length of data in memory bank to be read during inventory
- Unit: Byte
Filter Time
Filters tag with the same data so it will only returned once for the duration of the filter time
- Unit: seconds
- Default value: 0 (No filter)
Trigger Time
The duration of inventory after the trigger signal is stopped - Unit: seconds - Value range: [0, 255] - Default: 1
Buzzer Time
The duration of buzzer when the reader finds tag - Unit: 10ms - Value range: [0, 255] - Default: 1 - 0 - Buzzer off
Polling Interval
Inventory interval - Unit: 10ms - Value range: [0, 255] - Default: 1