Government Limited Rights Notice: All documentation and manuals were
developed at private expense and no part of it was developed using
Government funds.
The U.S. Government’s rights to use, modify, reproduce, release, perform,
display, or disclose the technical data contained herein are restricted by
paragraph (b)(3) of the Rights in Technical Data — Noncommercial Items
clause (DFARS 252.227-7013(b)(3)), as amended from time-to-time. Any
reproduction of technical data or portions thereof marked with this legend must
also reporduce the markings. Any person, other than the U.S. Government, who
has been provided access to such data must promptly notify ThingMagic, Inc.
ThingMagic, Mercury, Reads Any Tag, and the ThingMagic logo are trademarks
or registered trademarks of ThingMagic, Inc.
Other product names mentioned herein may be trademarks or registered
trademarks of ThingMagic, Inc. or other companies.
The ThingMagic® Mercury®6e embedded module is an RFID engine that you can
integrate with other systems to create RFID-enabled products which support the custom
Transcore tag protocols: eGo, SeGo, ATA and Allegro/Title-21.
The Arbser utility provides an easy to use command line inter face to conf igure the rea der,
read from and write t ags, and demon strate t he modules capabil ities. ArbSer can issue t he
Command Set
the ArbSer application, see Appendix B: Using the ArbSer Application
This document is for developers and explains how to incorporate the Mercury6e-
Transcore (M6e-TC) into a third-party host system.
that is detailed in this document in thier hex format. For information about
.
Hardware Overview
The M6e-TC module is based on the Mercury5e (M5e) embedded module, designed to
be incorporated into products requiring powerful RFID capabilities in a small form factor.
The following table shows the basic features of the M6e-TC hardware:
Introduction to the Mercury6e-Transcore Module 13
Hardware Overview
Features of the M6e-TC Hardware
ItemM6e-TC
ProcessorAtmel AT91SAM7SE-256
Flash memory256 kB
On-chip RAM32 kB
RF ArchitectureASIC Intel R2000 with ThingMagic front end
The M6e-TC is a single board module designed for more space- constrained appl ication s.
The digital and analog electronics are on the same circuit board.
Microcontroller
The M6e-TC uses the Atmel ARM7 microcontroller with 256 kB of on-chip flash memory
for storage of all calibration and program data.
RFID ASIC
All base-band analog circuitry and PLL circuitry are contained within the Impinj R2000
RFID ASIC with ThingMagic front end for improved sensitivity.
Connectors
The M6e-TC supports one MMCX connectors for a single monost a tic antenna.
14Introduction to the Mercury6e-Transcore Module
Firmware Overview
M6e-TC Digital Connectors
The digital connector provides power, serial communications signals, and access to the
GPIO inputs and output s. The communications i nterface for the M6e-TC is a 14-pin di gital
connector. This connector provides power , serial communications signals, including USB
support, and access to the GPIO inputs and outputs. See the following table:
Pin-out of 14-pin Digital Communications Connector
The software (SW) for the M6e-TC consists of two separat e programs that coex ist in flash
memory:
The boot loader, which is started at power on, is not field upgradable. It is
programmed into flash when the module is manufactured.
Introduction to the Mercury6e-Transcore Module15
Firmware Overview
The application firmware, which implements the actual reader functionality, is field
upgradable.
Boot Loader
The boot loader provides low-level functionality. This program provides a customer
interface for upgrading the application firmware and storing data into fl ash.
When a module is powered up or reset, the boot loade r code is au tomaticall y copied from
sector 0 of flash into the Microprocessor’s on-chip RAM, and executed. The boot loader
provides the following features:
The application firmware (FW) is an important software component of the module. It
contains the protoc ol code as well as all the use r int erf aces t o set and get va rious syst em
parameters. The applicati on FW is st arted using the Boot Firmware command in the
boot loader; it does not start by itself upon power up.
Note
You can use the Arbser utility to upgrade the reader firmware.
Verifying Application FW Image CRC
The application FW has an image level Cycl ic Redundancy Check (CRC) embedded in it
to protect against corrupted firmware during an upgrade process. (If the upgrade is
unsuccessful, the CRC will not match the contents in f lash.) When the boot loader starts
the application FW, it first verifies that the image CRC is corr ect. If this check fails, then
the boot loader does not start the application FW.
The upgrade process uses a series of individual 250- byte packet write operations to
ensure that an upgrade is successful ly completed f or the complet e image. It also ensur es
that the application FW in flash was not corrupted acci dently, and can be expected to
perform properly when executed.
16Introduction to the Mercury6e-Transcore Module
Functionality of the Embedded
This section highlights some of the functionality of the modules. The details for using the
serial commands to control this functionality are found in Overview of the Communication
Protocol.
Regional Support
The modules have differing levels of support for operation and use under the laws and
guidelines of several regions.
Note
A region must be set before the module will perform any RF operations.
The regional support is shown in the following table.
Modules
Supported Regions
RegionRegulatory SupportM6e-TC
North America (NA)FCC 47 CFG Ch. 1 Part 15
Industrie Canada RSS-210
Open RegionNo regulatory compliance enforcedYes
The regional functionality i s set using a single serial command, Set Configuration
Commands. Setting the Region configures the regional default settings including:
Loads the Frequency Hop Table with the appropriate table for the selected region.
Sets the PLL frequency to the first entry in the hop table, even if the RF is off.
Selects the transmit filter, if applicable.
Note
The Open Regi on allo ws the modu le to be manually configur ed withi n the ful l
capabilities supported by the hardware. No regulatory limits, including:
frequency range, channel spacing and transmit power limits, are enforced.
The Open Region should be used with caution.
Functionality of the Embedded Modules 17
Yes
Frequency Setting
The modules have a PLL synthesizer that sets the modulation frequ ency to the desired
value. Whenever the frequency is changed, th e module must first power off the
modulation, change the frequency, and then turn on the modulation again. Since this can
take several mill iseconds, it is possible that tags are powered off during a frequency hop.
In addition to setting the defaul t regional setti ngs, the modules have commands t hat allow
the transmit frequency to be set manually.
Frequency Setting
!!
CAUTION!
Use these commands with extreme caution.
It is possible to change the module’s compliance with the regional regulations.
Frequency Units
All frequencies in the Mercury embedded products are expressed in kHz using unsigned
32-bit integers. For instance, a carrier frequency of 915 MHz is expressed as 915000
kHz.
The PLL is set automatically to the closest frequency - based on the minimum frequency
quantization for the current region - that matches the specified value. The Mercury
embedded modules have an absolute minimum quantization of 50 kHz. Each region also
has a minimum quantization based on regulatory specifications, which may be greater.
The following table detai ls the frequency quantization in kHz for each region setting.
When manually setting frequencies the module will round down for any value that is not
an even multiple of the supported frequency quantizati on.
18Functionality of the Embedded Modules
Frequency Setting
For example: In the NA region, setting a frequency of 902,999 kHz results in a
setting of 902,750 kHz.
When setting the frequency of the module, any frequencies out side of the valid range for
the specified region are rejected.
Frequency Hop Table
The frequency hop table determines the frequencies used by the modules when
transmitting. The hop table charact eristics are:
Contains up to 62 slots.
Valid frequencies for the region currently selected.
Changes not stored in flash, thus changes made are not retained after a power cycle
or a restart of the boot loader.
Inability to c hange indivi dual en tr ies af t er upl oading wi thou t reloadi ng the enti re table.
Frequencies used in the order of entries in the table.
If necessary for a region, the hop table can be randomized to cr eate a pseudo-random
sequence of frequencies to use. This is done automati cally using the default hop tables
provided for each region.
Frequency Hop Interval
When hopping frequencies the period of time the module will stay on an individual
frequency is defined by the Hop Interval. This value is based on the region’s regulatory
requirements and indicates th e maximum time the re ader will stay on a frequency which
maybe lower than that allowed by the regulatory requirement s.The supported region s and
their maximum hop interval is defined in the following table:
Maximum Frequency Hop Interval
RegionMax Hop Interval
NA200 ms
Open400 ms
Functionality of the Embedded Modules19
RF Power Setting
The power setting is calibrated at the factory and parameters are stored in flash memory
to ensure the power output is within +/– 1 dB of the desired setting. The power limits are
set by both hardware limitati ons and e nforced by the firmware.
Power Units
All power values are reported in centi-dBm. Therefore, a power setting of 2500
corresponds to 25 dBm. All power values in the serial interface are specified as signed
16-bit integers. A dBm means power referenced to 1mW . Therefore, the conversion from
watts to dBm is:
RF Power Setting
dBm = 10 log
For example: 0.1W = 100mW = 20dBm and 1W = 1000mW = 30dBm.
(power in mW)
10
Power Calibration
A power calibration event occurs when the Power set point is changed, the Frequency is
changed, or the RF field is turned on. The power calibration routine calibrates the power
within 10 ms.
Note
Power calibration onl y o ccur s on ce w h en the R F powe r is t ur ne d o n. It do es
not occur periodically when the RF field is on.
This is not an issue during normal operation,= since a frequency hop occur s within the
regulatory hop interval (see Maximum Frequency Hop Interval
and thermal drift does not aff e ct the power level significantly. However, in CW waveform
mode (Transmit CW Signal), no power calibration occurs unless the power or frequency
is changed. Thus, it is possi ble to experienc e th ermal drif t in thi s usage i f the un it is l ef t t o
transmit continuously for a significant period of time.
for region specific values)
TX Read Power
The TX read power is used for all non-write commands to tags. This may include, but is
not limited to, commands to read a tag ID and read tag data.
20Functionality of the Embedded Modules
TX Write Power
The TX write power is used only during commands that change a tag’s state. This
includes commands for Lock, Kill, as well as Tag ID Write and Tag Data Write.
Note
During Write commands, which both write to and verify the written contents,
the entire operation will be done at the Tx Write Power, including tag
singulation and the write verify.
Power Amplifier Protection
Certain usage scenarios can cause the M6e-TC to operate into very low return loss
situations and/or cause a considerable amount of reflected power to feed back into the
M6e-TC power amplifier (PA). Under such conditions damage to the M6e-TC power
amplifier has been observed due to this reflected power. To avoid damage to the P A in
such cases the software protecti on wil l shut the transmitter down when these conditions
are detected and the module will return the fault code 0x050 5-
FAULT_LOW_RETURN_LOSS – 505h
- for the response status code.
Power Amplifier Protection
The PA protection feature is on by default. It can be turned off using the Set Reader
Configuration(9Ah) command.
WARNING!
ThingMagic does not recommend turning off PA protection under any
circumstance. Turning off PA protection greately increases the
possibility of hardware damage. Module operation with PA protection off
is at the users o wn risk.
Antenna Ports
Monostatic Mode
The M6e-TC has one antenna port which both transmits and receives.
To set up the mo dule to use a single ant enna in monostat ic mode, connect the antenna t o
port 1 (labeled J1 on Printed Circuit Board) wh ich is responsible for both TX and RX
communication.
Functionality of the Embedded Modules21
Power Management
The modules use different methods and levels of power management.
Power Modes
The M6e-TC was designed for power efficiency and offers several dif ferent power
management modes, set using Set Power Mode (98h)
modes being offered:
Full Power Mode – In this mode, the unit operates at full power to attain the best
performance possible. This mode is only intended for use in cases where power
consumption is not an issue. This is the default Power Mo de at startup.
Minimal Saving Mode – This automatically executes basic power savings that do not
severely degrade system performance May result in a nominal 1 ms additional delay.
Power Management
. The following lists the current
Medium Saving Mode – This mode may add up to 50 ms of delay between
commands. It performs more aggressive power savings, such as automatically
shutting down the analog section between serial commands, and then restarting it
whenever a tag command is issued.
Maximum Saving Mode – This mode essentially shuts down the digital and analog
boards, except to power the bare minimum logic required to wake the processor. It
can take up to 150 ms to wake the processor and execute the desired command .
Note: In Maximum Saving Mode the USB interface is disabled and the RS232 interface
communication speed is limited to 9600 baud.
Tag Buffer
The Tag buffer stores tags, and their metadata, found using the Read Tag Multiple
command. The size of the tag buffer for each module is defined in the following table:
22Functionality of the Embedded Modules
Tag Buffer Size
Tag Buffer
M6e-TC
Tag Buffer Size in Tag ID
entries
190
Each tag entry consis ts of a f ixed number of bytes. The size dep ends on t he value set fo r
the Max EPC Length parameter in Set Reader Configuration(9Ah)
. Each entry consists of
the following fields:
Tag Buffer Entry
Total Ent ry
Size
18 bytes
(Max EPC
Length = 96bits)
68 bytes
(Max EPC
Length = 496bits)
FieldSizeDescription
EPC
Length
PC Word2 bytesContains the Protocol Control bits for the tag.
EPC12 bytesContains the tag’s EPC value padded with
Tag CRC2 bytesThe tag’s CRC.
EPC
Length
2 bytesIndicates the actual EPC length of the tag
read. Cannot exceed the Max EPC length
setting.
trailing zeros if the size is less than the Max
EPC Length size.
2 bytesIndicates the actual EPC length of the tag
read. Cannot exceed the Max EPC length
setting. Varies by Protocol:
• Gen2 = PCWord + EPC ID + CRC
• Other = EPC ID + CRC
PC Word2 bytesContains the Protocol Control bits for the tag.
EPC62 bytesContains the tag’s EPC value padded with
trailing zeros if the size is less than the Max
EPC Length size.
Tag CRC2 bytesThe tag’s CRC.
In addition to the tag EPC data each entry contains meta data about how, where and
when the tag was read. When using the Get Tag Buffer (29h)
command you can choose to
get the following tag meta data returned with each tag extracted from the tag buffer:
Functionality of the Embedded Modules23
Flash Memory
Tag Read Meta Data
Meta Data FieldDescription
Antenna IDThe antenna on with the tag was read.
Read CountThe number of times the tag was read on [Antenna ID].
TimestampThe time the tag was read, relative to the time the command to
read was issued, in milliseconds. If the Tag Read Meta Data is
not retrieved from the Tag Buffer between read commands
there will be no way to distinguish order of tags read with dif-
ferent read command invocations.
FrequencyThe frequency on which the tag was read
RFUReserved for Future Use - ThingMagic Only
LQI/RSSIThe receive signal strength of the tag response.
Protocol ID
Whenever a Tag entry is placed in the buffer, it uses up a single entry with the EPC
section containing the maximum EPC length number of b its, r egardless of the actual EPC
size of the tag read. The extra bits in the entr y are padded with trailing zeros.
After the Multi-Protocol Tag Read command finishes, it places all of the found tags into
the Tag buffer, and then returns the number of tags found to the user. Only unique tags
read on each antenna are added t o the Tag buffer; none of the ent ries show repeated Tag
EPCs. Repeated reads on an antenna will cause the Read Count fie ld to be incremented
for that tag entry. Multiple Get Tag Buffer commands must be sent to read out the Tags.
The Tag buf fer acts as a First In First Out (FIFO) — the first Tag found by the reader is the
first one to be read out. See Get Tag Buffer (29h)
The Tag buffer is reset only when the Clear Tag Buffer command is sent. See Clear Tag
Buffer (2Ah). This allows multiple Multi-Protocol Tag Read commands to be used to
acquire one consistent tag buffer set.
Flash Memory
The M6e-TC has on-board flash memory. This flash is di vided into four diff erent sectors of
varying sizes. Table 4 shows the memory map for the M6e-TC. Only sector 0x03 is set
aside for user data and the other secto rs are used by the application FW. The flash sector
utilities simplify the interface providing a means to develop interfaces that work acros s
these platforms.
The tag’s Protocol ID as defined by the
.
Tag Protocol IDs table
24Functionality of the Embedded Modules
Flash Memory Sector Mapping
Flash Memory
M6e-TC
SectorAccessCode
BootLoaderRead Only0x010x00000016 kBnana
ApplicationRead/Write0x020x00C000208 kB0x089591210x02254410
User MemoryRead/Write0x030x00800016 kB0x791387660x76346700
Hardware Info
Application
Data (RAM)
Read Only0x040x004000
Start
Address
0x200000
M6e-TC
Size
(bytes)
16 kB
32 kB
Erase
Password
Write
Password
nana
Accessing the Flash
The flash is accessed onl y through t he boot loader pr ogram. Flash is not acc essible whi le
the application FW is running.
All accesses to flash are in terms of two-byte word addresses and word lengths. Thus,
the Write Flash Sector, Read Flash Sector, Erase Flash Sector, and Modify Flash Sector commands all use the same argument types. The maximum amount of flash that
can be written or modified at a single time is 125 words, and the maximum amount of
flash that can be read at a single time is 124 words. This is a limitation of the serial
interface and data packet sizes. Multiple data packets are used to read/write/modify a
larger area of flash.
When using the Erase Flash Sector or Write Flash Sector commands, the correct
password must be provided to complete the operation. This is done to protect against
accidentally erasing or writing to the flash. See Boot Loader Commands
.
Upgrading Application FW
The application FW is upgraded in flash. New versions of f irmware are released in a .sim
binary file format . The .sim binary file format is a compressed file format that stores the
data in raw binary.
Functionality of the Embedded Modules25
Serial and USB Interfaces
The M6e-TC module can communicate to a host processor via the TTL logic level RS-232
serial protocol or via Universal Serial Bus (USB) protocol, both accessed on the 14-pin
M6e-TC Digital Connectors
The module does not need to be software configured to operate on one or the othe r
interface, just s end data o ver the int erface to use it. However , the followi ng considerati ons
should be made when using one or both interfaces:
Once a command is initiated on one interface, the entire synchronous operation (full
command and response) must be completed on that interface. Upon completion of
an operation a new command can be sent on either interface.
If both interfaces are to be used the user is responsible for maintaining order of
execution. If commands are sent on both interfaces simultaneously execution order
cannot be guaranteed.
When setting the baud rate via Set Baud Rate (06h) this changes the communication
speed on the RS232 Interface only, whether set using the RS232 interface or USB.
The USB speed is not changed. USB communication speed is dictated by the USB
protocol and has a maximum bitrate of 12Mbps.
.
Serial and USB Interfaces
When configuri ng Power Modes, using Maximum Saving Mode (0x03) will shut off the
USB interface. If Set Power Mode (98h)
0x03 is specified the module will instead be set to Medium Saving Mode (0x02). In
order to set the module to mode 0x03 the command must b e cal led usi ng the RS232
interface.
is called using the USB interface and mode
Power consumption will increase when the USB interface is connected.
A level converter is necessa ry to i nter face t o other devi ces that use s t andard 12V RS-
232.
Only three pins are required for RS232 communicatio n (TX, RX, and GND). Hardware
handshaking is not supported.
The interfaces use an interrupt-dr iven FIFO that empties into a circular buffer.
The developer is responsible for ensuri ng that the host processor’s RS232 receiver
has the capability to receive up to 256 bytes of data at a time without overflowing.
Installi ng the USB Driver
Windows
When connecting to the M6e-TC through the USB interface from a Windows PC a few
installation steps are required for Windows to recogniz e the M6e-TC and properly
26Functionality of the Embedded Modules
General Purpose Inputs/Outputs (GPIO)
configure the communications protocol. In order to use the USB interface with Windows
you must have the m6etc.inf file. The installation steps are:
1. Plug in the USB cable to the M6e-TC (devkit) and PC.
2. Windows should report “Found New Hardware - M6e-TC Serial” and open the
Hardware Installation Wizard.
3. Select the Install from a list or specific location (Advanced) option, click Next.
4. Select Don’t search..., click Next, then Next again.
5. Click Have Disk and navigate to where the m6etc.inf file is stored; select it, click
Open, then OK.
6. “Mercury6eTC” should now be shown under the Model list. Select it and click Next
then Finished.
Note
The M6e-TC driver file has not been Microsoft certified so comp atibility
warnings will be displayed. These can be ignored and clicked through.
7. A COM port should now be assigned to the M6e-TC. If you aren’t sure what COM
port is assigned you can find it using the Windows Device Manager:
a. Open the Device Manager (located in Control Panel | System).
b. Select the Hardware tab and click Device Manager.
c. Select View | Devices by Type | Ports (COM & LPT)
The device appears as Mercury6eTC (COM#).
General Purpose Inputs/Outputs (GPIO)
The M6e-TC modules has four TTL level signals, two 3.3/5V serial input sensor ports
(GPIO inputs) and two output indicator ports (GPIO outputs) of up to 24 mA, available on
the 14-pin digital connector. These can be controlled via the Get User GPIO Inputs and Set User GPIO Outputs commands.
For further information, see Get User GPIO Inputs (66h)
and Set User GPIO Outputs (96h).
Functionality of the Embedded Modules27
Default Settings
Since default settings may change across release and be different across platforms we
recommend using the Get Configuration Commands
None of the configurable set tings in the appl ication FW are saved in non- volatile memory.
Thus the system will always boot up in the same default state, regardless of how it was
previously configured.
Default Settings
to obtain default settings.
28Functionality of the Embedded Modules
Overview of the Communication
Protocol
The serial communication between a computer (host) an d the reader is based on a
synchronized command-response/master- slave mechanism. Whenever the host sends a
message to the reader, it cannot sen d anot her me ssage until af te r it rec eiv es a respo nse.
The reader never initiates a communication session; only the host initiates a
communication session.
This protocol allows for each command to have its own timeout because some
commands require more time to execute than others. The host manages retries, if
necessary. The host keeps track of the state of the intended reader if it reissues a
command.
Host-to-Reader Communication
Host-to-reader communication is packetized according to the following diagram. The
reader can only accept one command at a time, and commands are executed serially, so
the host waits for a reader-to-host response before issuing another host-to-reader
command packet.
HeaderData LengthCommand
HdrLenCmdCRC HiCRC LO
1 byte1 byte1 byte0 to N bytes2 bytes
Overview of the Communication Protocol 29
Data
CRC-16 Checksum
I
Host-to-Reader Communication
The fields are summarized in the following table.:
FieldLengthDescription
Header (Hdr)1 byteDefines the start of the packet. Equal to 0xFF
1
Data Length (Len)
Command1 byteSpecifies the command that the reader is to execute.
DataN bytes
CRC-16 Checksum
(CRC HI, CRC LO)
1 byteDefines the length, N, of the data field contained in the
packet.
Defines the binary data required by the reader for use with a
(0 to 250)
2 bytesCRC-16 checksum (high order byte first). CRC polynomial is
command. This could, for example, represent transponder
data to be written. The length, N, can vary between 0 and
250 bytes.
CCITT CRC-16, with a preload of 0xFFFF . This does not fully
specify the operation of the CRC, see
CCITT CRC-16 Cal-
culation.
1.Minimum packet lengt h is 5 bytes; the maximum packet length is 255 bytes.
30Overview of the Communication Protocol
Loading...
+ 174 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.