Balluff COBALT-01 Usr Manual

CHAPTER 5: RFID TAGS

CHAPTER 5:
RFID TAGS

RFID tags, which are also referred to as transponders, smart labels, or

inlays, come in a variety of sizes, memory capacities, read ranges,

frequencies, temperature survivability ranges and physical

embodiments.

Escort Memory Systems offers many different RFID tag models. Cobalt
Controllers are capable of reading all Escort Memory Systems’ HMS

and LRP series RFID tags as well most of those produced by other

manufacturers. Our patented tags can be read through obstructions

such as water, wood, plastic and more. Our specialty high-temperature

(HT) models are capable of surviving temperatures of 415° F.

5.1 RFID STANDARDS

It is important to note that not all 13.56MHz RFID tags are compatible with Cobalt
Controllers and even tags that are said to be compliant with ISO15693 or ISO14443
standards may not actually be compatible with RFID controllers adhering to the same
standards. This is partially due to the fact that these ISO standards are so new that they
leave many features open to the discretion and interpretation of the RFID equipment
manufacturer to implement or define. When using another manufacturer’s tags, ensure
compatibility of those tags with your RFID system provider.

5.1.1 ISO 14443A/B

RFID integrated circuits (ICs) designed to meet ISO 14443A and/or ISO 14443B
standards were originally intended to be embedded in secure smart cards such as credit
cards, passports, bus passes, ski lift tickets, etc. For this reason, there are many security
authentication measures implemented within the air protocol between the RFID controller
and the tag.

ISO 14443A/B compliant tags and controllers incorporate security authentication through
the exchanging of software “keys.” The RFID controller and the tag must use the same
security keys to authenticate communication before the transfer of data will begin. The
Cobalt Controller’s operating system manages these security features, making their
existence transparent to the user. However, it is important to understand the implications
associated with ISO 14443 when using another manufacturer’s RFID tags. Because of
these security “features,” an ISO 14443 tag made by one manufacturer may not
necessarily be readable by a Cobalt Controller and, likewise, an Escort Memory Systems
ISO 14443 compliant tag might not be readable by another manufacturer’s RFID
controller. The Cobalt Controllers support Escort Memory Systems’ security keys for use
on Philips mifare ISO 14443A tags.

Escort Memory Systems was one of the first companies to adopt ISO 14443 standards
and has incorporated much of the technology into our products designed for industrial
automation applications. But because most industrial environments do not require the
same level of security that monetary or passport applications necessitate, some features
have not been implemented in the Cobalt HF product line.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 51 OF 116

5.1.2 ISO 15693

ISO 15693 was established at a time when the RFID industry identified that the lack of
standards was preventing the market from growing. Philips Semiconductor and Texas
Instruments were, at that time, the major manufacturers producing RFID ICs for the
Industrial, Scientific, and Medical (ISM)
own unique protocol and modulation algorithm. Philips Semiconductor’s I-CODE® and
Texas Instruments Tag-it® product lines were eventually standardized on the mutually
compatible ISO 15693 standards. After the decision was made to standardize, the door
was opened for other silicon manufacturers to enter the RFID business, many of which
have since contributed to other RFID ISO definitions. This healthy competition has led to
rapid growth in the RFID industry and has pushed the development of new standards,
such as ISO 18000 for Electronic Product Code (EPC) applications.

5.1.3 ISO 18000-3.1

The ISO 18000 standard has not been implemented in the Cobalt HF product line at the
time of publication of this manual. It is a planned product enhancement for future
releases. The emerging ISO 18000 Standard will provide enhanced support for EPC and
Unique Identification (UID) tag applications.

CHAPTER 5: RFID TAGS

frequency of 13.56MHz. However, each had their

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 52 OF 116

CHAPTER 5: RFID TAGS

5.2 RFID TAG COMPATIBILITY

The following RFID tags are compatible with the Cobalt HF Controller:

5.2.1 HMS Series RFID Tags

Integrated Circuits (ICs) used in Escort Memory Systems’ HMS-Series RFID tags include:

x Philips mifare Classic, 1 kilobyte (KB) + 32-bit Tag ID (ISO 14443A). One KB is

the total memory in the IC. Of this memory, 736 bytes are available for user data.

x Philips mifare Classic, 4 KB + 32-bit Tag ID (ISO 14443A). Four KB is the total

memory in the IC. Of this memory, 3,440 bytes are available for user data.

Figure 5-1: HMS125HT and HMS150HT RFID Tags

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 53 OF 116

CHAPTER 5: RFID TAGS

5.2.2 LRP Series RFID Tags

ICs used in Escort Memory Systems’ LRP-Series RFID tags include:

x Philips I•CODE 1, 48-byte + 64-bit Tag ID

x Philips I•CODE SLi, 112-byte + 64-bit Tag ID (ISO 15693)

x Texas Instruments Tag-it, 32-byte + 64-bit Tag ID (ISO 15693)

x Infineon My-D Vicinity, 1kb + 64-bit Tag ID (ISO 15693)

Figure 5-2: LRP125 and LRP250 RFID Tags

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 54 OF 116

CHAPTER 5: RFID TAGS

5.3 RFID TAG PERFORMANCE

Many factors can affect the performance between the controller’s antenna and the tag’s
antenna. These include, but are not limited to: the tag integrated circuit (IC), the antenna
coil design, the antenna conductor material, the antenna coil substrate, the bonding
method between tag IC antenna coil, and the embodiment material.

Additionally, the mounting environment of the tag and controller can hinder performance
due to other materials affecting the tuning of either antenna. Escort Memory Systems has
undergone extensive testing to produce tags that obtain optimum performance with our
RFID controllers. In most cases, optimal range will be obtained when mounting the tag
and controller antenna in locations free from the influence of metals, ESD and EMI
emitting devices.

5.4 RFID TAG EMBODIMENTS

RFID tags come in a variety of sizes and packages. The most common and cost effective
tag embodiment is the RFID label.

5.4.1 RFID Labels

RFID Labels (inlays or inlets) are the lowest cost RFID tag solution and are typically used
in an open system in which the tag leaves the facility attached to a product or is
destroyed at the end of the process.

An inlay is a substrate (made of polyester or Mylar) with a
printed, screened or etched antenna coil. Sometimes the
coil consists of a wire that is laid down onto the substrate
and is bonded to it with heat. Typically, the RFID IC is
attached by means of flip-chip technology and the
electrical connections are made by means of conductive
epoxies.

RFID inlays are usually applied to sticker backed paper to
create label tags which are manufactured in high volumes
on roll-to-roll production equipment. Inlays can be
laminated an used in smart credit cards, providing a low
cost RFID tag with some protection from impact damage.

The materials and procedures used to manufacture an RFID label’s antenna coil are
critically important. Low cost processes (such as printing or screening) produce low
quality antenna coils which can exhibit poor conductivity and cracking when flexed.

Labels with copper wire wound coils are generally considered efficient conductors of RF
energy and can usually survive considerable flexing, but are often more expensive due to
more involved production processes.

RFID labels with etched copper antenna coils have been found to be the most reliable,
semi-low cost tag solution. Etched inlay antenna coils are usually of consistent quality
and can survive a great deal of flexing and bending. However, because etching is
inherently a subtractive process, the cost per tag increases in part due to copper and
other metals discarded during the fabrication process.

As RFID label manufacturing technology advances, there have been several new
developments made in the areas of high volume, low cost, antenna coil manufacturing.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 55 OF 116

CHAPTER 5: RFID TAGS

One area, in particular, that has shown recent promise is the process of electroplating
printed or screened antenna coils with an additional layer of copper to improve durability
and conductivity.

5.4.2 Printed Circuit Board RFID Tags

RFID tags that incorporate Printed Circuit Board (PCB) technology are designed for
encasement inside totes, pallets, or products that can provide the protection normally
associated with injection-molded
enclosures.

These tags are made primarily from
etched copper PCB materials (FR-4,
for example) and are die bonded by
means of high quality wire bonding.
This procedure ensures reliable
electrical connections that are
superior to flip-chip assembly
methods. The RFID tag’s integrated
circuit is then encapsulated in epoxy
to protect it and the electrical
connections.

5.4.3 Molded RFID Tags

Molded tags, which are PCB tags
that have been protected with a durable resin overmolding, are the most rugged and
reliable type of tag offered by Escort Memory Systems. These tags are designed for

closed loop applications where the tag is reused;
thereby the cost of the tag can be amortized over
the life of the production line.

Typically, molded tags will be mounted to a pallet
or carrier which transports the product throughout
the production process. Some of the applications
for these tags include, but are not limited to:
embedding the tag into concrete floors for location
identification by forklifts and automatically guided
vehicles (AGVs), shelf identification for storage
and retrieval systems, and tool identification.

High temperature (HT) tags, using patented
processes and specialized materials, allow tags to
survive elevated temperatures, such as those
found in automotive paint and plating applications.
Escort Memory Systems offers a wide variety of
molded tags that have been developed over the
years for real world applications.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 56 OF 116

5.5 TAG M EMORY

Tag memory addressing begins at address 00 (0x0000), with the highest addressable
memory location equal to one less than the total number of bytes in the tag. Each
address is equal to one byte (8-bits), where the byte is the smallest addressable unit of
data. So for example, writing 8-bytes to a tag beginning at address 00 will actually fill
addresses 00 through 07 with 64-bits of data in all.

Depending on the manufacturer, RFID labels, molded tags and embedded PCBs can
have differing memory storage capacities
blocks of bytes that can vary in structure from manufacturer to manufacturer. Even when
compliant to ISO standards, byte memory addressing can differ from one manufacturer to
another. For example, tag memory can be organized in blocks of 4 or 8 bytes, depending
on the RFID IC. Additionally, all bytes may not be available for data storage as some
bytes may be used for security and access conditions. For more information regarding a
specific RFID tag’s memory allocation, please refer to IC manufacturer’s published
datasheet or Website.

Escort Memory Systems has taken great care to simplify tag memory addressing. The
mapping from logical address to physical address is handled by the Cobalt Controller’s
operating system. Users only need to indicate the starting address location on the tag
and the number of bytes to be read or written.

CHAPTER 5: RFID TAGS

and organization. Tag memory is grouped into

Is it a Bit or a Byte?

Customers need to understand that there are some RFID tag manufacturers that
measure and specify their tag memory size by the total number of bits, as this method
generates a much larger (8X) overall number. Escort Memory Systems, on the other
hand, prefers to specify total tag memory size in terms of bytes (rather than in bits), as
this method more closely reflects how data is stored and retrieved from a tag and is
typically what users really want to know.

5.5.1 Mapping Tag Memory

Creating an RFID Tag Memory Map

Creating a Tag Memory Map is much like creating a spreadsheet that outlines the actual
data you plan to capture as well as the specific tag memory locations in which you wish
to store said data. Tag Memory maps should be carefully planned, simple and
straightforward. It is advisable to allow additional memory space than is initially required
as inevitably a need will arise to store more data.

In the example below, 90-bytes of a 112-byte tag have been allocated to areas of the
Memory Map (leaving roughly 20% free for future uses). Because a short paragraph of
alphanumeric characters could quickly use all 90 bytes, creating an efficient mapping
scheme which utilizes all 720-bits (out of the 90-bytes allocated) will provide a better use
of tag space.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 57 OF 116

CHAPTER 5: RFID TAGS

TAG M EMORY M AP E XAMPLE

TAG ADDRESS USAGE

00 – 15

16 - 47

48 - 63

64 - 71

72 - 89

90 - 111

Serial #

Model #

Production Date

Lot #

Factory ID

Reserved for Future Use

Table 5-1: Tag Memory Map Example

5.5.2 Tag Memory Optimization

Data stored in tag memory is always written in binary (1’s and 0’s). Binary values are
notated using the hexadecimal numbering system (otherwise it might be confusing
viewing a page full of 1’s and 0’s).

Below is an example of how hexadecimal notation is used to simplify the process of
expressing the decimal number 52,882.

Decimal Binary Hexadecimal

52,882 1100 1110 1001 0010 CE92

Rather than using five bytes to store the five individual ASCII characters representing the
numerical values 5, 2, 8, 8, and 2 (ASCII bytes: 0x35, 0x32, 0x38, 0x38 and 0x32), by
simply writing two Hex bytes (0xCE and 0x92), 60% less tag memory is required to store
the same amount of information.

When an alphabetical character is to be written to a tag, the Hex equivalent of the ASCII
value is written to the tag. So for example, to write a capital “D” (ASCII value 0x44), the
Hex value 0x44 is written to the tag.

Additionally, if a database with look up values is used in the RFID application, the logic
level of the individual bits within the tag can be used to further maximize tag memory.

(Note: refer to

Appendix D

in this document for a chart of ASCII characters, their

corresponding Hex values and their decimal value equivalents).

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 58 OF 116

CHAPTER 5: RFID TAGS

O PTIMIZING THE T AG

The following example illustrates how a
single byte (8 bits) can be used to track
an automobile’s inspection history at
eight inspection stations. The number
one (1) represents a required operation
and the number zero (0) represents an
operation that is not required for a
particular vehicle.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 59 OF 116

CHAPTER 6: COMMAND PROTOCOLS

CHAPTER 6:
COMMAND PROTOCOLS

6.1 COMMAND P ROTOCOL O VERVIEW

In order to correctly recognize and execute commands, the Cobalt HF and the host must
be able to communicate using the same language. The language that is used to
communicate is referred to as the Command Protocol.

There are two Command Protocols used by Cobalt HF RFID Controllers.

x ABx Fast Command Protocol

(-232, -422 and –USB models).

x CBx Command Protocol

drop (Subnet16) networks and Industrial Ethernet applications (-485 and –IND
models).

These two Command Protocols have different packet structures and parameter settings,
which are explained later in this chapter.

– for Point-to-Point, Host/Controller applications

– for multiple RFID controller configurations, Multi-

6.2 ABX F AST C OMMAND P ROTOCOL

The command protocol used by the Cobalt HF -232, -422 and -USB Controllers for Point­to-Point data transmission is known as the ABx Fast Command Protocol. ABx Fast has
a single-byte oriented packet structure that permits the rapid execution of RFID
commands while requiring the transfer of a minimal number of bytes.

ABx Fast supports the inclusion of an optional checksum byte. By default, the HF-CNTL­232, -422 and -USB controllers are configured to use ABx Fast without the checksum
option. However, when increased data integrity is required, the checksum should be
utilized. See Section 6.2.4 for more on using the checksum parameter.

6.2.1 ABx Fast - Command / Response Procedure

After an RFID command is issued by the host, a packet of data, called the “Command
Packet” is sent to the Cobalt Controller. The command packet contains information that

instructs the controller to perform a certain task.

The Cobalt Controller automatically parses the incoming data packet, searching for a
specific pair of start characters, known as the “Command Header.” (Note: in ABx Fast,
the Command Header / Start Characters are 0x02, 0x02). When a Command Header is
recognized, the controller then checks for proper formatting and the presence of a
Terminator byte. (Note: in ABx Fast, the Terminator byte is 0x03).

Having identified a valid command, the controller will attempt to execute the instructions,
after which it will generate a host-bound response message containing EITHER the
results of the attempted command or an error code if the operation failed.

All commands will generate a response from the controller. Before sending another
command, the host must first process (remove from memory) any pending response
data.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 60 OF 116

CHAPTER 6: COMMAND PROTOCOLS

6.2.2 ABx Fast - Command Packet Structure

The packet structure of every ABx Fast command contains certain basic elements,
including a Command Header, a number of command parameters and a Terminator.

COMMAND PACKET PARAMETER CONTENT SIZE

COMMAND HEADER:

The first two bytes of an ABx Fast Command Packet:

COMMAND SIZE:

This 2-byte value defines the number of bytes in the packet
(excluding Header, Command Size, Checksum and
Terminator).

COMMAND ID:

This single-byte value indicates the RFID command to execute.

START ADDRESS:

The 2-byte Start Address parameter indicates the location of
tag memory where a read or write operation shall begin.

READ/WRITE LENGTH:

The 2-byte Read/Write Length parameter represents the
number of bytes that are to be retrieved from or written to the
RFID tag.

TIMEOUT VALUE:

This 2-byte integer indicates the maximum length of time for
which the controller will attempt to complete the command.
Measured in milliseconds, this value can have a range of
0x0001 to 0xFFFE or between 1 and 65,534 msecs (0x07D0 =
2000 x .001 = 2 seconds).

0x02, 0x02 2 bytes

0x0008

2-byte
integer

0x06

1 byte

(Write Data)

0x0000

2-byte
integer

0x0001

2-byte
integer

0x07D0

2-byte
integer

ADDITIONAL DATA:

This parameter uses one byte to hold a single character for fill
operations and supports the use of multiple bytes when several
characters are needed for write commands (when applicable).

CHECKSUM:

This optional parameter holds a single-byte checksum (only
applicable when using ABx Fast with Checksum).

TERMINATOR:

0x00

One or
more bytes
(when
applicable)

optional

1 byte
(when
applicable)

0x03 1 byte

Single-byte command packet terminator:

Table 6-1: ABx Fast - Command Packet Structure

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 61 OF 116

CHAPTER 6: COMMAND PROTOCOLS

6.2.3 ABx Fast - Response Packet Structure

After performing a command, the Cobalt HF will generate a host-bound response
message. ABx Fast responses contain a Response Header, a number of response
values (or retrieved data bytes), and a Terminator.

RESPONSE PACKET PARAMETER CONTENT SIZE

RESPONSE HEADER:

The first two bytes of an ABx Fast response packet.

RESPONSE SIZE:

This 2-byte integer defines the total number of bytes in
the response packet (excluding Header, Response
Size, Checksum and Terminator).

COMMAND ECHO:

The single-byte Command Echo parameter reiterates
the Hex value of the command for which the response
packet was generated.

RETRIEVED DATA:

This parameter is used to hold one or more bytes of
data that was requested by the command (when
applicable).

CHECKSUM:

This optional parameter holds a single-byte checksum
(only applicable when using ABx Fast with
Checksum).

0x02, 0x02 2 bytes

0x0001 2-byte integer

0x06 1 byte

Data

1 or more bytes
(when
applicable)

Optional

1 byte
(when
applicable)

TERMINATOR:

0x03 1 byte

Single-byte response packet terminator:

Table 6-2: ABx Fast - Response Packet Structure

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 62 OF 116

CHAPTER 6: COMMAND PROTOCOLS

6.2.4 ABx Fast - Command Packet Parameters

C OMMAND S IZE

Command
Size = number

of bytes in
these fields

The ABx Fast protocol requires that the byte count, known as the

Command Size

, be
specified as a 2-byte integer. To calculate Command Size, add the total number of bytes
within the command packet while excluding the two bytes for the Header, the two bytes
for the Command Size, the one byte for the Checksum (if present) and the one byte for
the Terminator (see example below).

PACKET
PARAMETER

Header

Command Size

Command ID

Start Address

Read/Write Length

Timeout Value

Additional Data Bytes

Checksum

Terminator

# OF
BYTES

INCLUDED IN
COMMAND SIZE?

2 No

2 No

1 Yes

2 Yes

2 Yes

2 Yes

1 Yes

1 No

1 No

In the above command packet example, 8 bytes of data are located between the
Command Size parameter and the Checksum parameter. Therefore, the Command Size
for this example is 0x0008.

TART A DDRESS

S

The Start Address parameter is holds a two-byte integer representing the tag memory
address location where a read or write operation will begin.

EAD/WRITE LENGTH

R

The two-byte Read/Write Length parameter indicates the number of bytes that are to be
read from or written to the RFID tag.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 63 OF 116

CHAPTER 6: COMMAND PROTOCOLS

T IMEOUT V ALUE PARAMETER

ABx Fast commands include a two-byte Timeout Value parameter (measured in
increments of one millisecond) that is used to limit the length of time that the Cobalt HF
will attempt to complete a specified operation.

The maximum Timeout Value is 0xFFFE or 65,534 milliseconds (slightly longer than one
minute). Setting a long Timeout Value does not necessarily mean that a command will
take any longer to execute. This value only represents the period of time for which the
Cobalt HF will attempt execution of the command.

IMPORTANT

During write commands, the tag must remain within the antenna’s RF field until the write
operation completes successfully, or until the Timeout Value has expired.

If a write operation is not completed before the tag leaves the controller’s RF field, data
may be incompletely written.

C HECKSUM P ARAMETER

The ABx Fast Command Protocol supports the inclusion of an additional checksum byte
that is used to verify the integrity of data being transmitted between host and controller.

The checksum is calculated by adding together (summing) the byte values in the
command packet (less the Header, Checksum and Terminator parameters), and then
subtracting the total byte sum from 0xFF. Therefore, when the byte values of each
parameter (from Command Size to Checksum) are added together, the byte value sum
will equal 0xFF.

To enable the use of the checksum parameter, download the RFID Dashboard Utility

www.ems-rfid.com

from

, and use it to set the ABx Protocol parameter to ABx Fast with

Checksum.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 64 OF 116

CHAPTER 6: COMMAND PROTOCOLS

C HECKSUM E XAMPLE

The following example depicts Command 0x05 (Read Data) using a checksum.

Checksum =
[0xFF – (sum
of these
fields)]

Add the byte values from the Command Size, Command ID, Start Address, Read Length
and Timeout Value parameters together and subtract from 0xFF. Resulting value will be
the checksum.

COMMAND

CONTENTS USED IN CHECKSUM

PARAMETER

Header 0x02, 0x02 n/a

Command Size 0x0007 0x00, 0x07

Command ID 0x05 0x05

Start Address 0x0001 0x00, 0x01

Read Length 0x0004 0x00, 0x04

Timeout Value 0x07D0 0x07, 0xD0

Checksum

0x17

n/a

Terminator 0x03 n/a

[0x07

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 65 OF 116

+ 0x05 + 0x01 + 0x04 + 0x07 + 0xD0] = 0xE8

The checksum equation is: [0xFF

– 0xE8] = 0x17

CHAPTER 6: COMMAND PROTOCOLS

6.3 CBX C OMMAND P ROTOCOL

The CBx Command Protocol, utilized by the Cobalt -485 and -IND models, includes
Multi-drop Subnet16 networking support for use with Industrial Ethernet applications.

CBx is based on a double-byte oriented packet structure where commands always
contain a minimum of six data “words,” even when one (or more) parameters are not
applicable to the command. CBx does not support the inclusion of a checksum byte.

The CBx packet structures described herein are protocol independent and can be
implemented the same for all Industrial Ethernet protocols (Ethernet/IP, Modbus TCP,
etc.).

6.3.1 CBx – Command Procedure

C OBALT HF-CNTL-485-01 – COMMAND P ROCEDURE

Commands are initiated by a host PC or Programmable Logic Controller (PLC) and are
distributed to the controller via a Subnet16 Gateway or Subnet16 Hub Interface Device
that is connected to the host or PLC by standard Ethernet cabling.

After a command is sent, it is executed either directly by the interface device (Gateway or
Hub) or is otherwise routed to the RFID controller specified in the command. Note that
when issuing controller-bound commands, instructions are directed to the appropriate
RFID controller by specifying the “Node ID Number” of the particular controller. Each
Cobalt -485 Controller on a Multi-drop Subnet16 network is assigned an individual Node
ID number.

OBALT HF-CNTL-IND-01 – COMMAND P ROCEDURE

C

Commands are initiated by a host PC or Programmable Logic Controller (PLC) and are
distributed directly to the controller via an M12 D-Code to Ethernet cable.

After a command is sent, it is immediately executed by the Cobalt Controller. Note that
instructions are directed to the controller by specifying in the command the “Node ID
Number” of the Cobalt Controller. For the Cobalt HF-CNTL-IND-01, the Node ID will
always be 01 (0x01).

6.3.2 CBx – Response Procedure

Following the execution of an RFID command, the controller will automatically generate a
host-bound response message that contains EITHER the results of the attempted
command or an error code if the operation could no be completed successfully.

Similar to ABx Fast, all CBx commands will generate a response from the controller.
Before the host can send another command to the controller, it must first process
(remove from memory) the controller’s pending response data.

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 66 OF 116

CHAPTER 6: COMMAND PROTOCOLS

6.3.3 CBx - Command Packet Structure

As noted, CBx commands contain a minimum of six words. Below is the structure of a
standard CBx command packet. For the Cobalt HF-CNTL-485-01 model, refer to the
Subnet16 Gateway or Subnet16 Hub - Operator’s Manuals.

WORD#COMMAND PACKET PARAMETER MSB LSB

01

02

03

04

05

Overall Length: 2-byte integer indicating the number

of 16-bit “words” in the entire command packet. This
value will always be at least 6, as each command has
a minimum of 12-bytes (or 6 words). Overall Length
will increase when additional data words are used in
the command (for fills, writes, etc.).

AA in MSB

Command ID: single-byte value indicating command

to perform in LSB.

00 in MSB

Node ID: single-byte Node ID number of the controller

to which the command is intended. (Must be 0x01 for
Cobalt -IND).

Timeout Value: 2-byte integer representing the length
of time allowed for the completion of the command,
measured in 1 millisecond units (when applicable).

Start Address: 2-byte integer indicating the location of
tag memory where the Read/Write operation will begin
(when applicable).

0x00

0x06 +
(number of
additional data
words, if any)

0xAA Command ID

0x00 0x01

Timeout

Timeout LSB

MSB

Start MSB Start LSB

06

Read/Write Length: 2-byte integer indicating the

number of bytes that are to be Read/Written beginning

Length
MSB

Length LSB

at the Start Address (when applicable).

07

Additional Data – (bytes 1 & 2) used to hold 2-bytes

D1 D2

of data used for writes and fills (when applicable).

08

Additional Data – (bytes 3 & 4): used to hold 2-bytes

D3 D4

of data for writes and fills (when applicable).

Table 6-3: CBx - Command Packet Structure

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 67 OF 116

CHAPTER 6: COMMAND PROTOCOLS

6.3.4 CBx - Response Packet Structure

After performing a command, the Cobalt HF RFID Controller will issue a host-bound
response message. Below is the packet structure of a standard CBx response message.

WORD#RESPONSE PACKET

PARAMETER

01

Overall Length: 2-byte value indicating the

number of “words” in the response packet.
This value will always be at least 6 words.

02

AA in MSB

Command Echo: single-byte value

indicating the command that was performed
in LSB.

03

Instance Counter in MSB

(see description below)

Node ID Echo in LSB (will be 0x01 for the
Cobalt -IND)

04

05

06

Month and Day timestamp Month DOM

Hour and Minute timestamp Hour Minutes

Second timestamp in MSB

MSB LSB

0x00

06 + (number of
additional data
words retrieved)

0xAA Command Echo

Instance

Node ID Echo

Counter

Seconds N-bytes

Number of Additional Data Bytes
Retrieved in LSB

07

Retrieved Data – (bytes 1 & 2) used to hold

D1 D2

2-bytes of retrieved data (when applicable).

08

Retrieved Data – (bytes 3 & 4) used to hold

D3 D4

2-bytes of retrieved data (when applicable).

Table 6-4: CBx - Response Packet Structure

I

NSTANCE COUNTER

The Instance Counter is a one-byte value used by a Subnet16 Gateway or Subnet16
Hub to track the number of responses generated by a given Node ID number. The
Gateway/Hub tallies in its internal RAM separate Instance Counter values for each Node
ID. The Instance Counter value is incremented by one following each response. If, for
example, 10 responses were generated by the controller assigned Node ID 01, its
Instance Counter value will read 10. When the Gateway/Hub is power cycled or
rebooted, all Instance Counter values will be reset to zero (0x00).

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 68 OF 116

CHAPTER 6: COMMAND PROTOCOLS

6.3.5 CBx - Command Example

In the example below, Command 0x05 (Read Data) is issued to the Cobalt Controller
assigned to Node ID 01. The controller will be instructed to read 4 bytes of data from a
tag beginning at tag address 0x20. The Timeout Value has been set to two seconds for
the completion of this command (0x07D0 = 2000 x .001 = 2 seconds).

WORD # DESCRIPTION MSB LSB

01 Overall Length of Command

02 AA

03 00

04

05

in MSB

Command ID

in MSB

Node ID

2-byte

2-byte

in LSB: (0x01 for the Cobalt)

Timeout Value

Start Address

in LSB: (0x05: Read Data)

measured in ms

for the Read

Operation: (0x0020)

06

2-byte

Read Length

: (0x0004)

6.3.6 CBx - Response Example

Below is an example of a typical controller response after successfully executing the
Read Data command (as issued in the previous example).

WORD # DESCRIPTION MSB LSB

01 Overall Length of Response

(in words)

02 AA

in MSB

Command Echo

(0x05 Read Data)

in LSB:

(in words)

0x00 0x06

0xAA 0x05

0x00 0x01

0x07 0xD0

0x00 0x20

0x00 0x04

0x00 0x08

0xAA 0x05

03 00

in MSB

Node ID Echo

04 Month

(March 19

05 Hour

and

and

in LSB

Day

th

)

Minute

timestamp:

timestamp

0x00 0x01

0x03 0x13

0x0A 0x0B

(10:11: AM)

06 Seconds

timestamp in MSB

0x24 0x04

(:36 seconds)

# of Additional Data Bytes
Retrieved

07 Retrieved Data

08 Retrieved Data

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 69 OF 116

in LSB: (0x04)

(bytes 1 & 2)

(bytes 3 & 4)

0x01 0x02

0x03 0x04

CHAPTER 7: RFID COMMANDS

CHAPTER 7:
RFID COMMANDS

Most RFID commands can be divided into two primary categories: READ and WRITE.
Read commands retrieve data from a tag or obtain information from the controller. Write
commands transfer information to a tag or update settings on the controller.

7.1 RFID COMMANDS TABLE

COMMAND
ID

0x04

0x05

0x06

0x07

0x08

0x0D

0x35

0x38

COMMAND DESCRIPTION

Fill Tag

Read Data

Write Data

Read Tag ID

Tag Search

Start/Stop
Continuous
Read

Reset
Controller

Get
Controller
Info

Writes a specified data byte to all defined
tag addresses.

Reads a specified length of data from
contiguous (sequential) areas of tag
memory.

Writes a specified number of bytes to a
contiguous area of tag memory.

Reads a tag’s unique tag ID number.

Instructs the controller to search for a tag
in its RF field.

Instructs the controller to start or stop
Continuous Read mode.

Resets power to the controller.

Reads hardware, firmware and serial
number information from the controller.

Table 7-1: RFID Commands Table

COBALT HF RFID CONTROLLERS OPERATOR’S MANUAL

P/N: 17-1320 REV 01 (03-06) PAGE 70 OF 116