TransCore 76007 Users Manual

875-0034-02 Rev1

Mercury®6e - T ranscore Developer’ s Guide

Government Limited Rights Notice: All documentation and manuals were developed at private expense and no part of it was developed using Government funds.

The U.S. Government’s rights to use, modify, reproduce, release, perform, display, or disclose the technical data contained herein are restricted by paragraph (b)(3) of the Rights in Technical Data — Noncommercial Items clause (DFARS 252.227-7013(b)(3)), as amended from time-to-time. Any reproduction of technical data or portions thereof marked with this legend must also reporduce the markings. Any person, other than the U.S. Government, who has been provided access to such data must promptly notify ThingMagic, Inc.

ThingMagic, Mercury, Reads Any Tag, and the ThingMagic logo are trademarks or registered trademarks of ThingMagic, Inc.

Other product names mentioned herein may be trademarks or registered trademarks of ThingMagic, Inc. or other companies.

ThingMagic, Inc. One Broadway, 5th floor Cambridge, MA 02142 866-833-4069

Revision 1 August, 2009

Introduction to the Mercury6e-Transcore Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13

Hardware Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Microcontroller 14 RFID ASIC 14 Connectors 14

M6e-TC Digital Connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Firmware Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Boot Loader. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Application Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Verifying Application FW Image CRC 16

Functionality of the Embedded Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Regional Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

Frequency Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18

Frequency Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

Frequency Hop Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Frequency Hop Interval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

RF Power Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Power Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Power Calibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

TX Read Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

TX Write Power. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Power Amplifier Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Antenna Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Monostatic Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Power Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Power Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Tag Buffer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Flash Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

Accessing the Flash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Upgrading Application FW. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Serial and USB Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Installing the USB Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Windows 26

General Purpose Inputs/Outputs (GPIO) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27

Default Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28

Overview of the Communication Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29

Host-to-Reader Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29

Reader-to-Host Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31

CCITT CRC-16 Calculation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Format for Microprocessor Reply to Host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34

Microprocessor ACK Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Microprocessor Fault Reply Message. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Microprocessor Data Reply Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37

Boot Loader Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38

Flash Read Sector (02h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Get Boot Loader/Firmware Version (03h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Responses 40

Returned Hardware Version Table 40

Boot Firmware (04h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Set Baud Rate (06h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Erase Flash Sector (07h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Verify Image CRC (08h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Start Bootloader (09h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Get Current Program (0Ch). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Write Flash Sector (0Dh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Loading an Application Image 44

Get Sector Size (0Eh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Modify Flash Sector (0Fh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Multi-Protocol Tag Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47

Get Tag Buffer (29h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Get Tags Remaining 47

Get Tag EPCs 48

Get Tag EPCs and Metadata 50

Clear Tag Buffer (2Ah) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Multi-Protocol Tag Read (2Fh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Allegro/Title-21 Tag Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57

Command Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Read Tag ID Single (21h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Write Request (24h; A003h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Title-21 ACK Request (24h; C000h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

General ACK Request (24h; F00Fh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Title-21 Read Request (28h; 8000h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Read Request (28h; C003h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Random Number Request (28h; D001h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

TDMA Read Request (28h; E003h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Jump to Reset Request (2Ch; D203h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

eGo/SeGo Tag Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73

Command Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Group Select Options 74

Read Tag ID Single (21h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Read Tag ID Multiple (22h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Standard Syntax 77

Minimal Syntax 79

Write Tag Data (24h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Lock Tag Data (25h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Read Tag Data (28h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Custom Tag Operations (2Dh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

ATA Tag Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91

Command Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Read Tag ID Single (21h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Read Tag ID Multiple (22h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

Gen2 Tag Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95

Tag Singulation/Select Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Select Algorithm and Parameters 96

Select Process 97

Flag Persistence Rules 98

Operations supporting Tag Singulation/Select 99

Read Tag Single (21h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Get Tag EPC 101

Get Tag EPC and Meta Data 102

Read Tag Multiple (22h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

Basic Tag Inventory 107

Tag Inventory with Select 109

Tag Inventory With Embedded Operations 110

Write Tag EPC (23h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Write Tag Data (24h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Lock Tag (25h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Kill Tag (26h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

Read Tag Data (28h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Get Tag Data 120

Get Tag Data and Meta Data 120

Get Tag Buffer (29h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Clear Tag Buffer (2Ah) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Gen2 Tag Specific (2Dh). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Alien Higgs Silicon (Chip Type=0x01) 123

NXP Silicon (Chip Type=0x02) 127

Erase Block Tag Specific (2Eh). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Get Configuration Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133

Get Hardware Version (10h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

Get Antenna Configuration (61h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Get Read TX Power (62h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

Get Current Tag Protocol (63h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

Get Write TX Power (64h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Get Frequency Hop Table (65h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Get User GPIO Inputs (66h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Get Current Region (67h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Get Power Mode (68h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

Get User Mode (69h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

Get Reader Configuration(6Ah) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

Get Protocol Configuration (6Bh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

Get Reader Statistics (6Ch) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Get Available Protocols (70h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

Get Available Regions (71h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

Get Current Temperature (72h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Set Configuration Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .148

Set Antenna Port (91h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Set Read TX Power (92h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Set Current Tag Protocol (93h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Set Write TX Power (94h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Set Frequency Hop Table (95h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Set User GPIO Outputs (96h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Set Current Region (97h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

Set Power Mode (98h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

Set User Mode (99h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

Set Reader Configuration(9Ah) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

Set Protocol Configuration (9Bh) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Set Gen2 Session 155

Set Q Value 156

FCC Test Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .157

Set Operating Frequency (C1h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Transmit CW Signal (C3h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Get Operating Frequency (C8h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Appendix A: Hardware Details. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

Mechanicals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .161

Antenna Connector. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

Communications Connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Connectors 163

Appendix B: Using the ArbSer Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

Reading a Tag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Get Version Command 167

Boot Firmware Command 168

Set Current Region Command 170

Set Current Tag Protocol Command 171

Set Read TX Power Command 171

Set Antenna Port Command 171

Unexpected Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Serial Communication Does Not Work 174

Commands Return a Non-Zero Status Code 174

No Tag ID is Returned 175

Appendix C: Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Common Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .177

FAULT_MSG_WRONG_NUMBER_OF_DATA – (100h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Cause 177

Solution 178

FAULT_INVALID_OPCODE – (101h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Cause 178

Solution 178

FAULT_UNIMPLEMENTED_OPCODE – 102h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Cause 178

Solution 178

FAULT_MSG_POWER_TOO_HIGH – 103h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Cause 178

Solution 179

FAULT_MSG_INVALID_FREQ_RECEIVED (104h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Cause 179

Solution 179

FAULT_MSG_INVALID_PARAMETER_VALUE - (105h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Cause 179

Solution 179

FAULT_MSG_POWER_TOO_LOW - (106h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Cause 179

Solution 180

FAULT_UNIMPLEMENTED_FEATURE - (109h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Cause 180

Solution 180

FAULT_INVALID_BAUD_RATE - (10Ah) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Cause 180

Solution 180

Bootloader Faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .181

FAULT_BL_INVALID_IMAGE_CRC – 200h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Cause 181

Solution 181

FAULT_BL_INVALID_APP_END_ADDR – 201h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Cause 181

Solution 181

FPGA Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .182

FAULT_PROGRAM_ERASE_FAILED – 2E0h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

Cause 182

Solution 182

FAULT_PROGRAM_FAILED – 2E1h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

Cause 182

Solution 182

FAULT_PROGRAM_VERIFY_FAILED – 2E2h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

Cause 183

Solution 183

FAULT_PROGRAM_OPERATION_FAILED – 2E3h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

Cause 183

Solution 183

FAULT_PROGRAM_NOT_LOADED – 2E4h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

Cause 183

Solution 183

Flash Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .184

FAULT_FLASH_BAD_ERASE_PASSWORD – 300h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

Cause 184

Solution 184

FAULT_FLASH_BAD_WRITE_PASSWORD – 301h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

Cause 184

Solution 185

FAULT_FLASH_UNDEFINED_ERROR – 302h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Cause 185

Solution 185

FAULT_FLASH_ILLEGAL_SECTOR – 303h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Cause 185

Solution 185

FAULT_FLASH_WRITE_TO_NON_ERASED_AREA – 304h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Cause 185

Solution 185

FAULT_FLASH_WRITE_TO_ILLEGAL_SECTOR – 305h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Cause 186

Solution 186

FAULT_FLASH_VERIFY_FAILED – 306h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .186

Cause 186

Solution 186

Protocol Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187

FAULT_NO_TAGS_FOUND – (400h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188

Cause 188

Solution 188

FAULT_NO_PROTOCOL_DEFINED – 401h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Cause 188

Solution 188

FAULT_INVALID_PROTOCOL_SPECIFIED – 402h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Cause 188

Solution 189

FAULT_WRITE_PASSED_LOCK_FAILED – 403h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Cause 189

Solution 189

FAULT_PROTOCOL_NO_DATA_READ – 404h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Cause 189

Solution 189

FAULT_AFE_NOT_ON – 405h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Cause 189

Solution 189

FAULT_PROTOCOL_WRITE_FAILED – 406h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Cause 190

Solution 190

FAULT_NOT_IMPLEMENTED_FOR_THIS_PROTOCOL – 407h . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Cause 190

Solution 190

FAULT_PROTOCOL_INVALID_WRITE_DATA – 408h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Cause 190

Solution 190

FAULT_PROTOCOL_INVALID_ADDRESS – 409h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Cause 190

Solution 191

FAULT_GENERAL_TAG_ERROR – 40Ah . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

Cause 191

Solution 191

FAULT_DATA_TOO_LARGE – 40Bh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191

Cause 191

Solution 191

FAULT_PROTOCOL_INVALID_KILL_PASSWORD – 40Ch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

Cause 191

Solution 191

FAULT_PROTOCOL_KILL_FAILED - 40Eh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Cause 192

Solution 192

FAULT_PROTOCOL_BIT_DECODING_FAILED - 40Fh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Cause 192

Solution 192

FAULT_PROTOCOL_INVALID_EPC – 410h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Cause 192

Solution 192

FAULT_PROTOCOL_INVALID_NUM_DATA – 411h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Cause 192

Solution 193

FAULT_GEN2 PROTOCOL_OTHER_ERROR - 420h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

FAULT_GEN2_PROTOCOL_MEMORY_OVERRUN_BAD_PC - 423h. . . . . . . . . . . . . . . . . . . . . . . . 193

FAULT_GEN2 PROTOCOL_MEMORY_LOCKED - 424h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

FAULT_GEN2 PROTOCOL_INSUFFICIENT_POWER - 42Bh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

FAULT_GEN2 PROTOCOL_NON_SPECIFIC_ERROR - 42Fh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

FAULT_GEN2 PROTOCOL_UNKNOWN_ERROR - 430h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Analog Hardware Abstraction Layer Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194

FAULT_AHAL_INVALID_FREQ – 500h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194

Cause 194

Solution 194

FAULT_AHAL_INVALID_FREQ – 501h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194

Cause 194

Solution 194

FAULT_AHAL_TRANSMITTER_ON – 502h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Cause 194

Solution 194

FAULT_ANTENNA_NOT_CONNECTED – 503h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Cause 195

Solution 195

FAULT_TEMPERATURE_EXCEED_LIMITS – 504h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Cause 195

Solution 195

FAULT_LOW_RETURN_LOSS – 505h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Cause 195

Solution 195

Tag ID Buffer Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196

FAULT_TAG_ID_BUFFER_NOT_ENOUGH_TAGS_AVAILABLE – 600h . . . . . . . . . . . . . . . . . . . . . . 196

Cause 196

Solution 196

FAULT_TAG_ID_BUFFER_FULL – 601h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .196

Cause 196

Solution 196

FAULT_TAG_ID_BUFFER_REPEATED_TAG_ID – 602h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Cause 197

Solution 197

FAULT_TAG_ID_BUFFER_NUM_TAG_TOO_LARGE – 603h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Cause 197

Solution 197

System Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198

FAULT_SYSTEM_UNKNOWN_ERROR – 7F00h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Cause 198

Solution 198

FAULT_TM_ASSERT_FAILED – 7F01h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198

Cause 198

Solution 198

Appendix D: FPGA Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Creating an FPGA Image DAT File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199

Loading an FPGA Image. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .203

Introduction to the Mercury6e-

Transcore Module

The ThingMagic® Mercury®6e embedded module is an RFID engine that you can integrate with other systems to create RFID-enabled products which support the custom Transcore tag protocols: eGo, SeGo, ATA and Allegro/Title-21.

The Arbser utility provides an easy to use command line inter face to conf igure the rea der, read from and write t ags, and demon strate t he modules capabil ities. ArbSer can issue t he

Command Set

the ArbSer application, see Appendix B: Using the ArbSer Application This document is for developers and explains how to incorporate the Mercury6e-

Transcore (M6e-TC) into a third-party host system.

that is detailed in this document in thier hex format. For information about

Hardware Overview

The M6e-TC module is based on the Mercury5e (M5e) embedded module, designed to be incorporated into products requiring powerful RFID capabilities in a small form factor.

The following table shows the basic features of the M6e-TC hardware:

Introduction to the Mercury6e-Transcore Module 13

Hardware Overview

Features of the M6e-TC Hardware

Item M6e-TC

Processor Atmel AT91SAM7SE-256 Flash memory 256 kB On-chip RAM 32 kB RF Architecture ASIC Intel R2000 with ThingMagic front end

for improved sensitivity

Input Power Requirements

Communication Interfaces

Protocols supported eGo, SeGo, ATA, Allegro/Title-21, Gen2 Dimensions:

(L x D x H) Regions supported NA, OPEN

+5VDC

• High-speed serial interface

• USB with auto-detect

78 x 63 x 8 mm

The M6e-TC is a single board module designed for more space- constrained appl ication s. The digital and analog electronics are on the same circuit board.

Microcontroller

The M6e-TC uses the Atmel ARM7 microcontroller with 256 kB of on-chip flash memory for storage of all calibration and program data.

RFID ASIC

All base-band analog circuitry and PLL circuitry are contained within the Impinj R2000 RFID ASIC with ThingMagic front end for improved sensitivity.

Connectors

The M6e-TC supports one MMCX connectors for a single monost a tic antenna.

14 Introduction to the Mercury6e-Transcore Module

Firmware Overview

M6e-TC Digital Connectors

The digital connector provides power, serial communications signals, and access to the GPIO inputs and output s. The communications i nterface for the M6e-TC is a 14-pin di gital connector. This connector provides power , serial communications signals, including USB support, and access to the GPIO inputs and outputs. See the following table:

Pin-out of 14-pin Digital Communications Connector

Pin # Signal

1GND 2GND 3GND 4+5V 5+5V 6 USB_+5V (Input to M6e-TC) 7 Digital Output 1 8 Digital Output 2 9 Digital Input 1 10 Digital Input 2 11 RS-232 RX TTL from host 12 RS-232 TX TTL to host 13 USB_DM 14 USB_DP

Firmware Overview

The software (SW) for the M6e-TC consists of two separat e programs that coex ist in flash memory:

 The boot loader, which is started at power on, is not field upgradable. It is

programmed into flash when the module is manufactured.

Introduction to the Mercury6e-Transcore Module 15

Firmware Overview

 The application firmware, which implements the actual reader functionality, is field

upgradable.

Boot Loader

The boot loader provides low-level functionality. This program provides a customer interface for upgrading the application firmware and storing data into fl ash.

When a module is powered up or reset, the boot loade r code is au tomaticall y copied from sector 0 of flash into the Microprocessor’s on-chip RAM, and executed. The boot loader provides the following features:

 Ability to read / write / erase flash memory  Upgrade application FW  Change serial baud rate  Verify image CRC

Application Firmware

The application firmware (FW) is an important software component of the module. It contains the protoc ol code as well as all the use r int erf aces t o set and get va rious syst em parameters. The applicati on FW is st arted using the Boot Firmware command in the boot loader; it does not start by itself upon power up.

Note

You can use the Arbser utility to upgrade the reader firmware.

Verifying Application FW Image CRC

The application FW has an image level Cycl ic Redundancy Check (CRC) embedded in it to protect against corrupted firmware during an upgrade process. (If the upgrade is unsuccessful, the CRC will not match the contents in f lash.) When the boot loader starts the application FW, it first verifies that the image CRC is corr ect. If this check fails, then the boot loader does not start the application FW.

The upgrade process uses a series of individual 250- byte packet write operations to ensure that an upgrade is successful ly completed f or the complet e image. It also ensur es that the application FW in flash was not corrupted acci dently, and can be expected to perform properly when executed.

16 Introduction to the Mercury6e-Transcore Module

Functionality of the Embedded

This section highlights some of the functionality of the modules. The details for using the serial commands to control this functionality are found in Overview of the Communication

Protocol.

Regional Support

The modules have differing levels of support for operation and use under the laws and guidelines of several regions.

Note

A region must be set before the module will perform any RF operations.

The regional support is shown in the following table.

Modules

Supported Regions

Region Regulatory Support M6e-TC

North America (NA) FCC 47 CFG Ch. 1 Part 15

Industrie Canada RSS-210

Open Region No regulatory compliance enforced Yes

The regional functionality i s set using a single serial command, Set Configuration

Commands. Setting the Region configures the regional default settings including:

 Loads the Frequency Hop Table with the appropriate table for the selected region.  Sets the PLL frequency to the first entry in the hop table, even if the RF is off.  Selects the transmit filter, if applicable.

Note

The Open Regi on allo ws the modu le to be manually configur ed withi n the ful l capabilities supported by the hardware. No regulatory limits, including: frequency range, channel spacing and transmit power limits, are enforced. The Open Region should be used with caution.

Functionality of the Embedded Modules 17

Yes

Frequency Setting

The modules have a PLL synthesizer that sets the modulation frequ ency to the desired value. Whenever the frequency is changed, th e module must first power off the modulation, change the frequency, and then turn on the modulation again. Since this can take several mill iseconds, it is possible that tags are powered off during a frequency hop. In addition to setting the defaul t regional setti ngs, the modules have commands t hat allow the transmit frequency to be set manually.

Frequency Setting

CAUTION!

Use these commands with extreme caution. It is possible to change the module’s compliance with the regional regulations.

Frequency Units

All frequencies in the Mercury embedded products are expressed in kHz using unsigned 32-bit integers. For instance, a carrier frequency of 915 MHz is expressed as 915000 kHz.

The PLL is set automatically to the closest frequency - based on the minimum frequency quantization for the current region - that matches the specified value. The Mercury embedded modules have an absolute minimum quantization of 50 kHz. Each region also has a minimum quantization based on regulatory specifications, which may be greater. The following table detai ls the frequency quantization in kHz for each region setting.

Regional Frequency Quantization

Region

Frequency

Quantization

Minimum

Frequency

Maximum

Frequency

NA 250 kHz 902,000 kHz 928,000 kHz Open 50 kHz 860,000 kHz 930,000 kHz

When manually setting frequencies the module will round down for any value that is not an even multiple of the supported frequency quantizati on.

18 Functionality of the Embedded Modules

Frequency Setting

For example: In the NA region, setting a frequency of 902,999 kHz results in a setting of 902,750 kHz.

When setting the frequency of the module, any frequencies out side of the valid range for the specified region are rejected.

Frequency Hop Table

The frequency hop table determines the frequencies used by the modules when transmitting. The hop table charact eristics are:

 Contains up to 62 slots.  Valid frequencies for the region currently selected.  Changes not stored in flash, thus changes made are not retained after a power cycle

or a restart of the boot loader.

 Inability to c hange indivi dual en tr ies af t er upl oading wi thou t reloadi ng the enti re table.  Frequencies used in the order of entries in the table.

If necessary for a region, the hop table can be randomized to cr eate a pseudo-random sequence of frequencies to use. This is done automati cally using the default hop tables provided for each region.

Frequency Hop Interval

When hopping frequencies the period of time the module will stay on an individual frequency is defined by the Hop Interval. This value is based on the region’s regulatory requirements and indicates th e maximum time the re ader will stay on a frequency which maybe lower than that allowed by the regulatory requirement s.The supported region s and their maximum hop interval is defined in the following table:

Maximum Frequency Hop Interval

Region Max Hop Interval

NA 200 ms Open 400 ms

Functionality of the Embedded Modules 19

RF Power Setting

The power setting is calibrated at the factory and parameters are stored in flash memory to ensure the power output is within +/– 1 dB of the desired setting. The power limits are set by both hardware limitati ons and e nforced by the firmware.

Power Units

All power values are reported in centi-dBm. Therefore, a power setting of 2500 corresponds to 25 dBm. All power values in the serial interface are specified as signed 16-bit integers. A dBm means power referenced to 1mW . Therefore, the conversion from watts to dBm is:

RF Power Setting

dBm = 10 log

For example: 0.1W = 100mW = 20dBm and 1W = 1000mW = 30dBm.

(power in mW)

Power Calibration

A power calibration event occurs when the Power set point is changed, the Frequency is changed, or the RF field is turned on. The power calibration routine calibrates the power within 10 ms.

Note

Power calibration onl y o ccur s on ce w h en the R F powe r is t ur ne d o n. It do es not occur periodically when the RF field is on.

This is not an issue during normal operation,= since a frequency hop occur s within the regulatory hop interval (see Maximum Frequency Hop Interval and thermal drift does not aff e ct the power level significantly. However, in CW waveform mode (Transmit CW Signal), no power calibration occurs unless the power or frequency is changed. Thus, it is possi ble to experienc e th ermal drif t in thi s usage i f the un it is l ef t t o transmit continuously for a significant period of time.

for region specific values)

TX Read Power

The TX read power is used for all non-write commands to tags. This may include, but is not limited to, commands to read a tag ID and read tag data.

20 Functionality of the Embedded Modules

TX Write Power

The TX write power is used only during commands that change a tag’s state. This includes commands for Lock, Kill, as well as Tag ID Write and Tag Data Write.

Note

During Write commands, which both write to and verify the written contents, the entire operation will be done at the Tx Write Power, including tag singulation and the write verify.

Power Amplifier Protection

Certain usage scenarios can cause the M6e-TC to operate into very low return loss situations and/or cause a considerable amount of reflected power to feed back into the M6e-TC power amplifier (PA). Under such conditions damage to the M6e-TC power amplifier has been observed due to this reflected power. To avoid damage to the P A in such cases the software protecti on wil l shut the transmitter down when these conditions are detected and the module will return the fault code 0x050 5-

FAULT_LOW_RETURN_LOSS – 505h

- for the response status code.

Power Amplifier Protection

The PA protection feature is on by default. It can be turned off using the Set Reader

Configuration(9Ah) command.

WARNING!

ThingMagic does not recommend turning off PA protection under any circumstance. Turning off PA protection greately increases the possibility of hardware damage. Module operation with PA protection off is at the users o wn risk.

Antenna Ports

Monostatic Mode

The M6e-TC has one antenna port which both transmits and receives. To set up the mo dule to use a single ant enna in monostat ic mode, connect the antenna t o

port 1 (labeled J1 on Printed Circuit Board) wh ich is responsible for both TX and RX communication.

Functionality of the Embedded Modules 21

Power Management

The modules use different methods and levels of power management.

Power Modes

The M6e-TC was designed for power efficiency and offers several dif ferent power management modes, set using Set Power Mode (98h) modes being offered:

 Full Power Mode – In this mode, the unit operates at full power to attain the best

performance possible. This mode is only intended for use in cases where power consumption is not an issue. This is the default Power Mo de at startup.

 Minimal Saving Mode – This automatically executes basic power savings that do not

severely degrade system performance May result in a nominal 1 ms additional delay.

Power Management

. The following lists the current

 Medium Saving Mode – This mode may add up to 50 ms of delay between

commands. It performs more aggressive power savings, such as automatically shutting down the analog section between serial commands, and then restarting it whenever a tag command is issued.

 Maximum Saving Mode – This mode essentially shuts down the digital and analog

boards, except to power the bare minimum logic required to wake the processor. It can take up to 150 ms to wake the processor and execute the desired command .

Note: In Maximum Saving Mode the USB interface is disabled and the RS232 interface

communication speed is limited to 9600 baud.

Tag Buffer

The Tag buffer stores tags, and their metadata, found using the Read Tag Multiple command. The size of the tag buffer for each module is defined in the following table:

22 Functionality of the Embedded Modules

Tag Buffer Size

Tag Buffer

M6e-TC

Tag Buffer Size in Tag ID entries

190

Each tag entry consis ts of a f ixed number of bytes. The size dep ends on t he value set fo r the Max EPC Length parameter in Set Reader Configuration(9Ah)

. Each entry consists of

the following fields:

Tag Buffer Entry

Total Ent ry

Size

18 bytes (Max EPC Length = 96bits)

68 bytes (Max EPC Length = 496bits)

Field Size Description

EPC Length

PC Word 2 bytes Contains the Protocol Control bits for the tag. EPC 12 bytes Contains the tag’s EPC value padded with

Tag CRC 2 bytes The tag’s CRC. EPC

Length

2 bytes Indicates the actual EPC length of the tag

read. Cannot exceed the Max EPC length setting.

trailing zeros if the size is less than the Max EPC Length size.

2 bytes Indicates the actual EPC length of the tag

read. Cannot exceed the Max EPC length setting. Varies by Protocol:

• Gen2 = PCWord + EPC ID + CRC

• Other = EPC ID + CRC PC Word 2 bytes Contains the Protocol Control bits for the tag. EPC 62 bytes Contains the tag’s EPC value padded with

trailing zeros if the size is less than the Max EPC Length size.

Tag CRC 2 bytes The tag’s CRC.

In addition to the tag EPC data each entry contains meta data about how, where and when the tag was read. When using the Get Tag Buffer (29h)

command you can choose to

get the following tag meta data returned with each tag extracted from the tag buffer:

Functionality of the Embedded Modules 23

Flash Memory

Tag Read Meta Data

Meta Data Field Description

Antenna ID The antenna on with the tag was read. Read Count The number of times the tag was read on [Antenna ID]. Timestamp The time the tag was read, relative to the time the command to

read was issued, in milliseconds. If the Tag Read Meta Data is not retrieved from the Tag Buffer between read commands there will be no way to distinguish order of tags read with dif-

ferent read command invocations. Frequency The frequency on which the tag was read RFU Reserved for Future Use - ThingMagic Only LQI/RSSI The receive signal strength of the tag response. Protocol ID

Whenever a Tag entry is placed in the buffer, it uses up a single entry with the EPC section containing the maximum EPC length number of b its, r egardless of the actual EPC size of the tag read. The extra bits in the entr y are padded with trailing zeros.

After the Multi-Protocol Tag Read command finishes, it places all of the found tags into the Tag buffer, and then returns the number of tags found to the user. Only unique tags read on each antenna are added t o the Tag buffer; none of the ent ries show repeated Tag EPCs. Repeated reads on an antenna will cause the Read Count fie ld to be incremented for that tag entry. Multiple Get Tag Buffer commands must be sent to read out the Tags. The Tag buf fer acts as a First In First Out (FIFO) — the first Tag found by the reader is the first one to be read out. See Get Tag Buffer (29h)

The Tag buffer is reset only when the Clear Tag Buffer command is sent. See Clear Tag

Buffer (2Ah). This allows multiple Multi-Protocol Tag Read commands to be used to

acquire one consistent tag buffer set.

Flash Memory

The M6e-TC has on-board flash memory. This flash is di vided into four diff erent sectors of varying sizes. Table 4 shows the memory map for the M6e-TC. Only sector 0x03 is set aside for user data and the other secto rs are used by the application FW. The flash sector utilities simplify the interface providing a means to develop interfaces that work acros s these platforms.

The tag’s Protocol ID as defined by the

Tag Protocol IDs table

24 Functionality of the Embedded Modules

Flash Memory Sector Mapping

Flash Memory

M6e-TC

Sector Access Code

BootLoader Read Only 0x01 0x000000 16 kB na na Application Read/Write 0x02 0x00C000 208 kB 0x08959121 0x02254410 User Memory Read/Write 0x03 0x008000 16 kB 0x79138766 0x76346700 Hardware Info

Application Data (RAM)

Read Only 0x04 0x004000

Start

Address

0x200000

M6e-TC

Size

(bytes)

16 kB 32 kB

Erase

Password

Write

Password

na na

Accessing the Flash

The flash is accessed onl y through t he boot loader pr ogram. Flash is not acc essible whi le the application FW is running.

All accesses to flash are in terms of two-byte word addresses and word lengths. Thus, the Write Flash Sector, Read Flash Sector, Erase Flash Sector, and Modify Flash Sector commands all use the same argument types. The maximum amount of flash that can be written or modified at a single time is 125 words, and the maximum amount of flash that can be read at a single time is 124 words. This is a limitation of the serial interface and data packet sizes. Multiple data packets are used to read/write/modify a larger area of flash.

When using the Erase Flash Sector or Write Flash Sector commands, the correct password must be provided to complete the operation. This is done to protect against accidentally erasing or writing to the flash. See Boot Loader Commands

Upgrading Application FW

The application FW is upgraded in flash. New versions of f irmware are released in a .sim binary file format . The .sim binary file format is a compressed file format that stores the data in raw binary.

Functionality of the Embedded Modules 25

Serial and USB Interfaces

The M6e-TC module can communicate to a host processor via the TTL logic level RS-232 serial protocol or via Universal Serial Bus (USB) protocol, both accessed on the 14-pin

M6e-TC Digital Connectors

The module does not need to be software configured to operate on one or the othe r interface, just s end data o ver the int erface to use it. However , the followi ng considerati ons should be made when using one or both interfaces:

 Once a command is initiated on one interface, the entire synchronous operation (full

command and response) must be completed on that interface. Upon completion of an operation a new command can be sent on either interface.

 If both interfaces are to be used the user is responsible for maintaining order of

execution. If commands are sent on both interfaces simultaneously execution order cannot be guaranteed.

 When setting the baud rate via Set Baud Rate (06h) this changes the communication

speed on the RS232 Interface only, whether set using the RS232 interface or USB. The USB speed is not changed. USB communication speed is dictated by the USB protocol and has a maximum bitrate of 12Mbps.

Serial and USB Interfaces

 When configuri ng Power Modes, using Maximum Saving Mode (0x03) will shut off the

USB interface. If Set Power Mode (98h) 0x03 is specified the module will instead be set to Medium Saving Mode (0x02). In order to set the module to mode 0x03 the command must b e cal led usi ng the RS232 interface.

is called using the USB interface and mode

 Power consumption will increase when the USB interface is connected.  A level converter is necessa ry to i nter face t o other devi ces that use s t andard 12V RS-

232.

 Only three pins are required for RS232 communicatio n (TX, RX, and GND). Hardware

handshaking is not supported.

 The interfaces use an interrupt-dr iven FIFO that empties into a circular buffer.  The developer is responsible for ensuri ng that the host processor’s RS232 receiver

has the capability to receive up to 256 bytes of data at a time without overflowing.

Installi ng the USB Driver

Windows

When connecting to the M6e-TC through the USB interface from a Windows PC a few installation steps are required for Windows to recogniz e the M6e-TC and properly

26 Functionality of the Embedded Modules

General Purpose Inputs/Outputs (GPIO)

configure the communications protocol. In order to use the USB interface with Windows you must have the m6etc.inf file. The installation steps are:

1. Plug in the USB cable to the M6e-TC (devkit) and PC.

2. Windows should report “Found New Hardware - M6e-TC Serial” and open the

Hardware Installation Wizard.

3. Select the Install from a list or specific location (Advanced) option, click Next.

4. Select Don’t search..., click Next, then Next again.

5. Click Have Disk and navigate to where the m6etc.inf file is stored; select it, click

Open, then OK.

6. “Mercury6eTC” should now be shown under the Model list. Select it and click Next then Finished.

Note

The M6e-TC driver file has not been Microsoft certified so comp atibility warnings will be displayed. These can be ignored and clicked through.

7. A COM port should now be assigned to the M6e-TC. If you aren’t sure what COM port is assigned you can find it using the Windows Device Manager:

a. Open the Device Manager (located in Control Panel | System). b. Select the Hardware tab and click Device Manager. c. Select View | Devices by Type | Ports (COM & LPT)

The device appears as Mercury6eTC (COM#).

General Purpose Inputs/Outputs (GPIO)

The M6e-TC modules has four TTL level signals, two 3.3/5V serial input sensor ports (GPIO inputs) and two output indicator ports (GPIO outputs) of up to 24 mA, available on the 14-pin digital connector. These can be controlled via the Get User GPIO Inputs and Set User GPIO Outputs commands.

For further information, see Get User GPIO Inputs (66h)

and Set User GPIO Outputs (96h).

Functionality of the Embedded Modules 27

Default Settings

Since default settings may change across release and be different across platforms we recommend using the Get Configuration Commands

None of the configurable set tings in the appl ication FW are saved in non- volatile memory. Thus the system will always boot up in the same default state, regardless of how it was previously configured.

Default Settings

to obtain default settings.

28 Functionality of the Embedded Modules

Overview of the Communication

Protocol

The serial communication between a computer (host) an d the reader is based on a synchronized command-response/master- slave mechanism. Whenever the host sends a message to the reader, it cannot sen d anot her me ssage until af te r it rec eiv es a respo nse. The reader never initiates a communication session; only the host initiates a communication session.

This protocol allows for each command to have its own timeout because some commands require more time to execute than others. The host manages retries, if necessary. The host keeps track of the state of the intended reader if it reissues a command.

Host-to-Reader Communication

Host-to-reader communication is packetized according to the following diagram. The reader can only accept one command at a time, and commands are executed serially, so the host waits for a reader-to-host response before issuing another host-to-reader command packet.

Header Data Length Command

Hdr Len Cmd CRC Hi CRC LO

1 byte 1 byte 1 byte 0 to N bytes 2 bytes

Overview of the Communication Protocol 29

Data

CRC-16 Checksum

Host-to-Reader Communication

The fields are summarized in the following table.:

Field Length Description

Header (Hdr) 1 byte Defines the start of the packet. Equal to 0xFF

Data Length (Len)

Command 1 byte Specifies the command that the reader is to execute. Data N bytes

CRC-16 Checksum (CRC HI, CRC LO)

1 byte Defines the length, N, of the data field contained in the

packet.

Defines the binary data required by the reader for use with a

(0 to 250)

2 bytes CRC-16 checksum (high order byte first). CRC polynomial is

command. This could, for example, represent transponder data to be written. The length, N, can vary between 0 and 250 bytes.

CCITT CRC-16, with a preload of 0xFFFF . This does not fully specify the operation of the CRC, see

CCITT CRC-16 Cal-

culation.

1.Minimum packet lengt h is 5 bytes; the maximum packet length is 255 bytes.

30 Overview of the Communication Protocol

Reader-to-Host Communication

The following diagram defines the format of the generic Response Packet sent from the reader to the host. The Response Packet is different in format from the Request Packet.

Reader-to-Host Communication

Header Data Length Command Data CRC-16 Checksum

Hdr Len

1 byte 1 byte

Cmd

1 byte

Status Word

CRC HI CRC LO

0 to M bytes2 bytes

2 bytes

The fields are summarized in the following table.:

Field Length Description

Header (Hdr) 1 byte Defines the start of the packet. Equal to 0xFF

Data Length (Len)

1 byte Defines the length, M, of the data field contained in the

packet. Length can be 0 – 248 bytes

Command

Status Word

Data M bytes

CRC-16 Checksum (CRC HI, CRC LO)

1 byte OpCode of the last command received 2 bytes Specifies the status of the last command, Successful =

0x0000, else it contains a fault code. Defines the binary data returned by the reader in response to

(0 to 248)

2 bytes CRC-16 checksum (high order byte first). CRC polynomial is

a command. This could, for example, represent data read from a transponder. Data length, M, can be a minimum of 0 and a maximum of 248 bytes.

CCITT CRC-16, with a preload of 0xFFFF. This does not fully specify the operation of the CRC, see

CCITT CRC-16 Calcu-

lation.

Overview of the Communication Protocol 31

Reader-to-Host Communication

1.The minimum packet length is 7 bytes and the maximum packet length is 255 bytes.

2.Each host command recei v es a resp onse fro m the read e r. In th e resp onse pack et, the Head er, Data Lengt h, Co mmand , Dat a, and Checksum are functionally similar to the command packet.

3.The only difference is the addition of the Status Word field. The Status Word has two types of values. A Status Word value of 0 (Zero) means the command received was successful. Any other value represents a fault.

CCITT CRC-16 Calculation

The same CRC calculation is performed on all serial communications between the host and the reader. The CRC is calculated on the Data Length, Command, Status Word, and Data bytes. The header (SOH, 0xFF) is not included in the CRC.

A sample implementation of the CCITT CRC-16 algorithm is shown in this section. The CRC_calcCrc8() function is written to calculate the CRC one byte at a time, with the calculated value stored in crc_calc. The crc_calc value must be pre-loaded the first time the CRC_calcCrc8() function is called with 0xFFFF to initialize the calculated CRC. The final value of crc_calc is sent as the 16-bit CRC at the end of the message.

32 Overview of the Communication Protocol

Reader-to-Host Communication

An example implementation of CRC calculation, taken from the Arbser source CrcUtils.c, is shown here:

/** @fn void CRC_calcCrc8(u16 *crcReg, u16 poly, u16 u8Data) * @ Standard CRC calculation on an 8-bit piece of data. To make it * CCITT-16, use poly=0x1021 and an initial crcReg=0xFFFF. *

* Note: This function allows one to call it repeatedly to continue * calculating a CRC. Thus, the first time it's called, it * should have an initial crcReg of 0xFFFF, after which it * can be called with its own result. * * @param *crcRegPointer to current CRC register. * @param poly Polynomial to apply. * @param u8Datau8 data to perform CRC on. * @return None. */

void CRC_calcCrc8(u16 *crcReg, u16 poly, u16 u8Data)

{

u16 i; u16 xorFlag; u16 bit; u16 dcdBitMask = 0x80;

for(i=0; i<8; i++)

{

// Get the carry bit. This determines if the polynomial should be // xor'd with the CRC register.

xorFlag = *crcReg & 0x8000;

// Shift the bits over by one.

*crcReg <<= 1;

// Shift in the next bit in the data byte

bit = ((u8Data & dcdBitMask) == dcdBitMask); *crcReg |= bit;

// XOR the polynomial

if(xorFlag)

{ }

// Shift over the dcd mask

dcdBitMask >>= 1;

} }

*crcReg = *crcReg ^ poly;

Overview of the Communication Protocol 33

Format for Microprocessor Reply to Host

There are three different types of replies tha t the microprocess or can make to the host as follows:

 Acknowledge that the command was properly processed (ACK)  Return a fault code  Provide data that is requested by the host

This section describes each of these three types. Unless otherwise specified, all commands ret urn, as part of the Reply message, a status

word with an ACK or a Fault. Those commands that return a Data Reply message are clearly shown.

Microprocessor ACK Message

Many of the commands require the microprocessor to perform a function, but do not require the microprocessor to send data back t o the host. Howev er, since the host cannot send a message until the microprocessor replies, an ACK is sent.

The ACK message contains no data. It returns the same OpCode that was sent or igina lly to the microprocessor, sets the Status Word to 0x0000 (zero) and the Data Length to 0x00 (zero).

34 Overview of the Communication Protocol

Format for Microprocessor Reply to Host

The following shows an example of an ACK message to an Erase Flash command.

FF 00 07 00 00 F4 27

SOH Length OpCode Status CRC

The value in the OpCode field (0x07) is the same as the Erase Flash OpCode, 0x07.

Microprocessor Fault Reply Message

If a problem occurs during the execution of a command, the microprocessor returns a non-zero status value. Although this usually implies a fault or error, sometimes the nonzero status simply indicates a condition of the system. For instance, when executing a Read Tag Single command, if no t ags are found, a sta tus code of 0x0 400 is retur ned. An example of a fault reply message is shown for the Erase Flash command.

FF 00 07 02 00 F6 27

SOH Length OpCode Status CRC

A list of error codes is included in Appendix C: Error Messages

. Refer to this list when

encountering any non-zero status codes.

Microprocessor Data Reply Message

If the requested command requires that the microprocessor returns data, then the microprocessor creates a message similar to the Microprocessor ACK Message with the data length set to a non-zero value. Sin ce this command does not r equire a data f ield, the length field is set to Zero.

FF 00 07 00 00 F4 27

SOH Length OpCode Status CRC

Overview of the Communication Protocol 35

Format for Microprocessor Reply to Host

Here is an example of a Reply message with Data Field Length not zero. This message happens to be a successful reply to Read Tag Single command.

FF 0A 21 00 00 C8 05 07 A8 00 84 C4 FF 9E E0 F7 25

SOH Length OpCode Status Tag ID Tag CRC CRC

36 Overview of the Communication Protocol

Command Set

The following list def ines t he OpCodes that a re used in the embedd ed modul es fi rmware. As these products grow, more OpCodes will be added to enhance the functionality of the product. The timeout for the commands are in milliseconds. The maximum value for any user-configurable timeout is 65,535msec (0xFFFF), unless otherwise noted. The OpCodes are divided into five main categories:

 0x00 – 0x1F: Boot Loader Commands  0x20 – 0x5F: Application Tag Commands - Depending on the current protocol setting

will correspond to: – Multi-Protocol Tag Commands – Allegro/Title-21 Tag Commands – eGo/SeGo Tag Command Set – ATA Tag Co m mand Se t – Gen2 Tag Commands

 0x60 – 0x8F: Get Configuration Commands  0x90 – 0xBF: Set Configuration Commands  0xC0 – 0xCF: FCC Test Commands

Command Set 37

Boot Loader Commands

The BootLoader is automatically started upon power up, and allows access to the onboard flash memory along with other commands. The program exits only when the Boot Firmware command is received. Once that occurs, the firmware image starts executing and sends back a reply to the Boot Firmware command. The BootLoader can also be started using command 0x09, Start BootLoader.

The following table shows which commands are supported by the Boot loader and in some cases the application.

Boot Loader Commands

OpCode Command Name Arguments Return BL App

0x02

0x03

0x04 0x06 0x07

0x08 0x09 0x0C

0x0D

0x0E

Flash Read Sector (02h)

Get Boot Loader/Firmware Version (03h)

Boot Firmware (04h)

Set Baud Rate (06h)

Erase Flash Sector (07h)

Verify Image CRC (08h)

Start Bootloader (09h)

Get Current Program (0Ch)

Write Flash Sector (0Dh)

Get Sector Size (0Eh)

Address, Sector, bytes

none Acknowledge Y N

none Acknowledge Y N Baud Rate Acknowledge Y Y Sector Number ,

password none Acknowledge Y N

none Acknowledge N Y none 1 Byte indicating

Sector enum, memory offset, length, data to write

Sector enum Size of sector in

Data Y N

Ack Y N

YY program currently running

none Y N

YN bytes

0x0F

Modify Flash Sector (0Fh)

Sector enum, memory offset, length to read

Data in flash Y N

38 Command Set

Boot Loader Commands

Flash Read Sector (02h)

The Flash Read Sector command reads the contents of flash from the specified sector and offset address. Since the length of the Microprocessor reply packet is limited to 248 bytes, reading the application firmware data requires multiple read commands.

Note

Length is defined as the num be r of 16- b it wo rd s, an d the maximum value of length is 124 words.

In this example, the sector number 02 indicates the application area. This command reads the first five data elements of the application, which is equivalent to the original command (using data length of 05). The sect or codes can be found in Flash Memory

Sector Mapping..

FF 06 02 00 00 00 00 02 05 FA 59

SOH Length OpCode Start Address Sector Num Bytes To Read CRC

The reply to this command looks like this

FF 0A 02 00 00 01 23 45 67 89 AB CD EF 01 23 BC ED

SOH Length OpCode Status

1.Word 1 contains the data located at address 0x208000.

2.Word 2 contains the data at ad dre ss 0x208001, and so forth. (Remember that the Microproce sso r dat a is wo rd a ddre ssed.)

Word 1

Word 2

Word 3 Word 4 Word 5 CRC

Get Boot Loader/Firmware Version (03h)

The Get Boot Loader command returns the Boot Loader, Hardwar e, and Application version numbers. The Boot Loader, Hardware, and Application FW version numbers are stored in flash. The Boot Loader and Hardware version numbers are each 32-bit numbers. The application has a 96-bit version code. The command to retrieve firmware version is shown in the following table.

FF 00 03 1D 0C

SOH Length OpCode CRC

Command Set 39

Boot Loader Commands

Responses

A sample response for the M6e-TC is as follows:

FF 14 03 00 00 07 09 17 00 01 00 00 01 20 07 10 12 09 05 12 00

SOHLength OpCode Status BootLoader Ver Hardware Ver Firmware Date Firmware Version

00 00 00 10 6B CC

Supported Protocols CRC

The following information is embedded in the reply to the command:

 The boot loader version is 07.09.17. 00. This number is in hex format.  HW Version is 01000001. For a definition, see Returned HW Versions.  The application firmware was compiled on 2007-October-12.  The application firmware versi on is 09.05.12.00. This number is in hex format.  The protocol supported by this firmware – Gen2 and ISO 18000-6C.

Returned Hardware Version Table

The following table provides a definition of each HW version returned by the Get Boot Loader/Firmware Version command.

Returned HW Versions

Module Defined Version Description

M6e-TC HW_VERID_1_0W 0x10000001 A0 and B0 prototypes

If the Get Boot Loader/Firmware Version command returns a dif ferent val ue than those listed in the table, you should contact support@thingmagic.com

Boot Firmware (04h)

The Boot Firmware command tells the boot loader to run the current firmware image stored in flash in the following sequence:

1. If flash is locked application firmware is run.

40 Command Set

Boot Loader Commands

1. If flash is not locked: the application f irmware i mage CRC veri fied and flash i s lo cked before it is run.

2. If the image is invalid, a fault code is returned to the host.

3. If the application firmware is started successfully, it sends the response to the Boot Firmware command.

FF 00 04 1D 0B

SOH Length OpCode CRC

The response is identical to the response to a Get Version command, except that the OpCode is 0x04 instead of 0x03.

Note

The Applicati on Firmware boot up time takes ap proximately 600ms the f i rst time it is run after a new firmware installation. Subsequent boot up times will be approximately 50ms.

Set Baud Rate (06h)

The Set Baud Rate command has a default baud rate of 9600 bps. Since the code method of specifying the baud rate is processor dependent, a new interface was created to make the modules easily interchangeable.

The following table shows the hexadecimal equi valent for each baud rate:

Command Set 41

Boot Loader Commands

Baud Rate

(decimal)

9600 0x00002580 19200 0x00004B00 38400 0x00009600 57600 0x0000E100

115200 0x0001C200 230400 0x00038400 460800 0x00070800 921600 0x000E1000

Baud Rate

(hex)

In the following example, the baud rate is specified as a 32-bit value. This example sets the baud rate to 115200:

FF 04 06 00 01 C2 00 FD 30

SOH Length OpCode Baud Rate CRC

The response to baud rate change is sent at the baud rate that the Set Baud Rate command was transmitted. Once the baud rate has changed, t he new rate i s in ef fect until the baud rate is changed by power cycling the reader. The baud always reverts to 9600 after a power cycle.

Note

Set baud rate has no effect on the USB interface speed, only the RS232 interface, whether executed from the RS232 interface or USB.

42 Command Set

Boot Loader Commands

Erase Flash Sector (07h)

The Erase Flash Sector command erases the sector specified by the sector number. as defined by Flash Memory Sector Mapping

The following example shows the command to erase sector 2 of the flash.

FF 05 07 08 95 91 21 02 7F 91

SOH Length OpCode Password Sector CRC

Verify Image CRC (08h)

After uploading a new application fi rmware image, the application CRC can be checked with the Verify Image CRC command. The application CRC is already embedded in the firmware image, so this command cal culates the f irmware’ s CRC in f lash and comp ares it to the pre-stored value. It returns a fault code if the application firmware fails the CRC checks. A failed CRC means that the application cannot run, and needs to be downloaded again.

FF 00 08 1D 07

SOH Length OpCode CRC

The boot loader runs this command automatically before loading the application the first time it is l run. If the CRC check fails, the boot load er does not run the application to prevent corrupted code from executing on the Microprocessor. Subsequent invocations will not verify the CRC since the flash is locked.

Start Bootloader (09h)

The Start Bootloader command shuts off the analog board and starts the boot loader while inside the application. This is necessary to perform an upgrade of the firmware while the system is running.

FF 00 09 1D 06

SOH Length OpCode CRC

Command Set 43

Boot Loader Commands

Get Current Program (0Ch)

The Get Current Program command returns a code for the current program being executed in the module. These codes are defined as follows:

Code Program

0x21 M6e-TC Bootloader 0x22 M6e-TC Application

To get the current program command, send the following to the module:

FF 00 0C 1D 0C

SOH Length OpCode CRC

The module responds as follows, indicating that it is the application program:

FF 01 0C 00 00 22 ?? ??

SOH Length OpCode Status Program CRC

Write Flash Sector (0Dh)

The Write Flash Sector command is used to write data to the flash memory. Before writing to flash it is imperative that the flash be erased first. Attempting to write to flash before it is erased will generate an error. Alternatively the Modify Flash Sector (0Fh) command can be used.

Loading an Application Image

A series of write flash commands is used to load a new application program image into flash. The Write Flassh Sector command verifies the CRC of the received data but does not verify the CRC of the complete application image. Use the Verify Image CRC (08h) command to verify the application once it i s uploaded.

The start address is a 32-bit se ctor offset address. It is a word address, that is different from the byte address used for instr uction memory. The application code must be loaded

44 Command Set

Boot Loader Commands

starting from word address 0x00000000. Since the flash is a 16-bit device, there must be an even number of dat a bytes. Th e number of dat a bytes to be written is embedded in th e length of the payload (N) by the formula:

LengthDataToWriteInWords = (N – 8) / 2 The password required for each sector is defined in Flash Memory Sector Mapping

The following example shows a Write Flash Sector command writi ng to the Application Sector, starting at the beginning

FF 0F 0D 02 25 44 10 00 00 00 00 02 12 34 56 78 90 12 73 4C

SOH Length OpCode Password Start Address Sector Data T o Write CRC

Note

DO NOT send a packet that spans two sectors. Split the packet into 2 separate messages, then send the first message to sector “x” and the second to sector “x+1”.

Get Sector Size (0Eh)

The size of a flash sector can be retrieved from the module using the Get Sector Size command. Since different prod ucts may have dif ferent flash sector si zes, this command is useful for ensuring that the module has enough memory to store the desired data. This example receives the sector size for the application area:

FF 01 OE 02 D1 BF

SOH Length OpCode Sector CRC

The response to this command is shown in the following example:

FF 04 OE 00 00 00 03 40 00 88 54

SOH Length OpCode Status Size of Sector CRC

The size of the sector is returned in bytes. Sector 2 (application) is 212992 bytes.

Modify Flash Sector (0Fh)

The Modify Flash Sector command is used as a read-modify-write operation in the flash. Since the Modify Flash Sector command erases the flash sector each time it is

Command Set 45

Boot Loader Commands

called, it could prematur ely wear out the flash i f it i s used too of ten. This command s hould only be used to modify a few variables (that is less than one seri al packet’s worth) at a time.

This command works only for the User area.

FF 0F 0F 79 13 87 66 00 00 00 00 03 12 34 56 78 90 12 4C FA

SOH Length OpCode Password Start Address Sector Data To Write CRC

46 Command Set

Multi-Protocol Tag Commands

The application commands are used to interact with RFID t ags in the field. These commands can have slightly differ ent behavior based upon the current protocol selected in the system.

Applications Commands

OpCode Command Name

Multi-Protocol Tag Commands

0x29 0x2A 0x2F

Get Tag Buffer (29h)

Clear Tag Buffer (2Ah)

Multi-Protocol Tag Read (2Fh)

Get Tag Buffer (29h)

After a Multi-Protocol Tag Read command is executed, the found tags are stored in an internal Tag Buffer operations depending on the syntax used. These operations are:

 Get tags remaining in the tag buffer  Get tag EPCs  Get tag EPCs and their Tag Read Meta Data.

Get Tags Remaining

To determine the number of tags remaining in the buffer, send the Get Tag Buffer command with a data length of zero:

. The Get Tag Buffer command can perform several different

FF 00 29 1D 26

SOH Length OpCode CRC

This command returns the current read index, the location of the next t ag to be read, and the current write index, the locati on where the next tag will be written. These t wo numbers can be used to get the number of tags left in the tag buffer:

Multi-Protocol Tag Commands

Tags Left = WriteIndex - ReadIndex

The following response shows there are three tags left in the buffer, and the first one has already been read (the read index parameter starts counting from 0.):

FF 04 29 00 00 00 01 00 04 87 72

SOH Length OpCode Status ReadIndex WriteIndex CRC

Get Tag EPCs

When you want to get the tag EPCs out of the buffer and don’t care about the tag read metadata, the options available with this syntax maybe useful. This syntax reads out the requested number of tags from the buffer. A maximum of 13 tags are read at a time, less if Max EPC Length is set to 496 bi ts. Mult iple Get Tag Buffer commands may be required to obtain the complete result s from a single Multi-Protocol Tag Read command. If more tags are requested than remain in the buffer an error will be returned.

All tag buffer indexes are encoded as 16-bit unsigned integers. The indexes start counting from 0. Thus, a start index of 0 indicates tag #1, and a start index of 10 would indicate tag #11.

There are two ways to read tag EPCs out of the buffer when you only want EPC values. The first way is to send a Get Tag Buffer command with the desired number of tags, n. This retrieves the next n tags, starting from the current read index. In the previous example, the read index was 1, indicat ing th at one tag was already read. To read the next two tags, set the number of tags p arameter s to 2. This returns tags number 2 and 3 in the tag buffer:

FF 02 29 00 02 57 EB

SOH Length OpCode # Tag IDs to Return CRC

When using the Get Tag Buffer command in this way, the read index is automatically incremented internally. Thus, if the read index was ‘1’ before getting two tags, then it is incremented to ‘3’ at the end of this command.

Another way to get the second and third tags is to explicitly send the start and end indexes of the tags to read. This is used to ret rieve any contiguous block of tag buffer entries at any time.

Multi-Protocol Tag Commands

FF 04 29 00 01 00 03 CC 94

SOH Length OpCode Start Idx End Idx CRC

Using the start and end index method does not af fect the read index that is internally stored in the module. The above request returns a message with two tags. The length of each tag EPC record returned is defined based on the max EPC length configured with

Set Reader Configuration(9Ah)

and fields of the EPC portion of a tag buffer entry is defined in the Tag B uffer Entry

, regardless of the size of a specific tag’s EPC. The sizes

table.

For example:

 A 64-bit tag has the length set to 0x60 (16-bit PC + 64-bit t ag EPC + 16-bit t ag CRC),

but only the first 12 bytes of th e tag recor d is filled in, th e trail ing bytes, af ter t he CRC are padded with zeros.

 An 96-bit GEN2 tag, the l ength i s 0x80 (16- bit PC (Pro toco l Contr ol) wor d + 96 -bi t tag

EPC + 16-bit tag EPC CRC).

In the response below, two tag EPCs are returned. Tag #1 is a 96-bit EPC tag and t ag #2 is a 64-bit EPC tag.

FF 24 29 00 00

SOH Length OpCode Status

00 80 30 00 11 11 22 22 33 33 44 44 55 55 66 66 18 35

EPC Length

00 60 20 00 11 11 22 22 33 33 44 44 C2 41 00 00 00 00

EPC Length

PC Word Tag EPC Tag CRC

PC Word Tag EPC Tag CRC Padding

D3 32

CRC

Note

Using this syntax the number of tags in the response is not specified. It must be determined by the message length.

Multi-Protocol Tag Commands

Get Tag EPCs and Metadata

Using this syntax for getting information from the tag buffer provides several benefits:

 When at t ag EPC is returned there is no paddi ng if the actual tag EPC is shorter than

the configured max EPC length. This helps minimize the amount of data returned.

 Any or all fields of the Tag R ead M eta Data can be returned.  In the event of a commu nic ation err or th e last Get EPC and Metada ta r equest can be

repeated.

When data is requested using this syntax the response will contain as many tags as can be fit in the response packet. The response will indicate how many tags were returned and should be processed accordingly.

This version of Get Tag Buffer takes two additional fields: the Metadata Flags which defines what metadata will be returned and the Read Options which specifies special read functionality. The following table lists the supported values for t hese fields.

Get EPC and Metadata Request Fields

Field Value Description

Metadata Flags (to specify more than one OR the values together)

0x0000 When no flags are set no meta data will be returned, only the tag

EPC (including PC bits and tag CRC) 0x0001 When bit 0 is set the Read Count will be returned 0x0002 When bit 1 is set the LQI/RSSI will be returned 0x0004 When bit 2 is set the Antenna ID will be returned 0x0008 When bit 3 is set the Frequency will be returned 0x0010 When bit 4 is set the Timestamp will be returned 0x0020 RFU (ThingMagic Only) 0x0040

When bit 6 is set the Protocol ID, as defined by the

IDs table, will be returned

Tag Protocol

Multi-Protocol Tag Commands

Field Value Description

Read Option 0x00 Read the next set of tags from the Tag Buffer

0x01 Re-send the last set of tags.

Note: When setting this option the tags will be resent

starting at the same ReadIndex as the last command. If the metadata requested is different than the last request the number of tags returned might be different. To get those ‘missing’ tags, additional Get Tag Buffer commands should be sent without the re-send option, otherwis e it will reset the ReadIndex again.

Multi-Protocol Tag Commands

Examples

An example command requesting Read Count, AntennaID and Timestamp Metadata Flags = 0x0001 OR 0x0004 OR 0x0010 = 0x0015 is as follows:

FF 03 29 00 15 00 97 55

SOH Length OpCode Metadata Flags Read Options CRC

A response contains the followin g inf o rmation:

Get EPC and Metadata Response Fields

Field Length Value

SOH 1 byte 0xFF Length 1 byte Based on data returned OpCode 1 byte 0x29 Metadata Flags 2 bytes Metadata contained in response Read Options 1 byte As sent in request Tag Count 1 byte Number of tags in response Read Count 1 byte Tag EPC/Antenna Read Count RSSI

Antenna ID

1 byte Return Signal Strength Indicator 1 byte Antenna ID, 4 MSBs for TX and 4

LSBs for RX

Frequency Timestamp

3 bytes Frequency in kHz 4 bytes RTC Timestamp

Multi-Protocol Tag Commands

Field Length Value

RFU

2 bytes Reserved for Future Use - ThingMagic

Only Protocol ID 1 byte Protocol ID of tag read EPC Length 2 bytes Number of bits in EPC including PC

and CRC bits PC Word 2 bytes Tag EPC Protocol Control bits EPC ID N bytes Tag EPC. Tag CRC 2 bytes Tag EPC CRC Repeat fields starting at Read Count for remaining tags in message as defined

by Tag Count CRC 2 bytes M essage CRC

1 - Conditionally returned depending on the Metadata Fields specified in the request.

Here is an example response to the example request specified above. The response contains two tags as specified in the Tag Count field each with its EPC info and requested tag read metadata: Read Count, AntennaID and Timestamp:

FF 34 29 00 00 00 15 00

SOH Length OpCode Status Metadata

22 11 02 50 CE F6 00 80 31 C1 11 11 22 22 33 33 44 44 55 55 66 66 FB 15

Read

Count

Read

Count

Ant ID

OE 11 04 1D 3D 3C 00 80 30 00 05 00 00 00 00 00 00 00 00 00 23 54 4A C8

Ant ID

Timestamp EPC

Length

Timestamp EPC

Length

Flags

PC Word Tag EPC Tag CRC

Read Options

Tag Count

1A B8

CRC

Multi-Protocol Tag Commands

Clear Tag Buffer (2Ah)

The Clear Tag Buffer command res ets the tag buff er . This clears the buff er of any current tags and reset the read index to 0. A Multi-Protocol Tag Read or Read Tag Multiple command must be issued to load new tags into the buffer.

FF 00 2A 1D 25

SOH Length OpCode CRC

If Clear Tag Buffer or Get Tag Buffer is not used after a Multi-Protocol Tag Read to remove all tags, old tags wi ll be left in the buffer. This means that if tags that have not been removed from the buffer are read again they will not be added to the buffer as second time, only their Read Count will be incremen ted.

Multi-Protocol Tag Read (2Fh)

The Multi-Protocol Tag Read command allows tag reading and inventorying commands to be performed on tags with different protocols at the same time, using a single command. This command contains the following request fields:

Multi-Protocol Tag Read Request Fields

Field Value Description

TM OpCode 0x2F TM OpCode indicating a multi-protocol opera-

tion.

Timeout [2 bytes] Indicates how long the entire command

should spend attempting the operation, in milliseconds. When TM Option=0x00 the time gets divided equally across each proto col specified.

TM Options • 0x00 = Basic Multi-protocol search.

Uses Protocol Bitmask

Command Opcode • 0x00 - reserved

• 0x21 - tag read single

• 0x22 - tag read multiple

Indicates the operation to perform and additional fields that will be required.

Indicates the command that will be performed for each protocol specified.

Note: Allegro/Title-21 is not supported

with tag read multiple.

Note: Allegro/Title-21 uses Read Request

(28h; C003h) for tag read single.

Multi-Protocol Tag Commands

Field Value Description

Search Flags [2 bytes - bitwise setting]

Bit 0 = Enable end on tags found

Note: Least Significant Bit = bit 0

TM Option = 0x00 Fields - The following field is only used when TM Option = 0x00 Protocol Bitmask

Enables

[4 bytes - bitwise setting] bit 0-3 = not used bit 4 (0x00000010) = Gen2 bit 5-25 = not used bit 26 (0x04000000) = eGo bit 27 (0x08000000) = SeGo bit 28 (0x10000000) = ATA bit 29 (0x20000000) = Allegro/Title-21

Indicates search options. When bit is set = 1 the option will be enabled.

• Bit 0 = 1 (0x01) the search will stop after the first tag is found, after completing that protocols entire timeout. i.e. if 4 protocols are specified with a 100ms timeout and a tag is found during searching on the second protocol the remaining protocols will not be sear ched and the command w ill return after 50ms. Bit 0 = 0 all protocols will be searched, using entire timeout.

Indicates the protocols to operate on. If the protocols bit is set to ‘1’ tags of that protocol will be included in the operation. OR values together for final setting

Note: Least Significant Bit = bit 0

Multi-Protocol Tag Commands

Examples

TM Option = 0x00 Request

FF ?? 2F ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Timeout TM

Options

Response

FF ?? 2F ?? ?? 00 ?? ?? ??

SOHLength OpCod

Status TM

?? ?? ?? ?? ?? ....

Protocol

Id1

?? ?? ?? ?? ?? ....

Protocol

Id2

Option

Protocol Response Length

Cmd

Opcode

Protocol Response Data

(Includes Status word)

Protocol Response Data

(Includes Status word)

Cmd

Opcode

Flags

?? ??

CRC

Flags

Protocol Bitmask Enables

CRC

Note: If a multi-protocol Tag Read Single (command code 0x21) search results in zero tags

found it will not be reported. Only successful searches are reported.

Allegro/Title-21 Tag Commands

The Allego/Title-21 tag commands are used to operate on Allegro/Title-21 tags and perform operations specific to those tags. These commands can only be used when the Tag Protocol of the reader is set to Allegro/Title-21 (0x001E) using Set Current Tag

Protocol (93h). These commands cannot be run when in Bootloader mode, only in

Application mode.

Allegro/Title-21 Tag Commands

OpCode

0x21 Read ID Single

0x24 Modify

0x28 Read

0x2C Reset

Operation

Type

Allegro/Title-21 Command

Read Tag ID Single (21h)

Write Request (24h; A003h)

Title-21 ACK Request (24h; C000h)

General ACK Request (24h; F00Fh)

Title-21 Read Request (28h; 8000h)

Read Request (28h; C003h)

Random Number Request (28h; D001h)

TDMA Read Request (28h; E003h)

Jump to Reset Request (2Ch; D203h)

Transaction

Type Code

n/a

0xA003 0xC000 0xF00F 0x8000 0xC003 0xD001 0xE003 0xD203

Allegro/Tit le-21 Tag Commands

Command Syntax

All Allegro/T itle-21 tag commands, except Read Tag ID Single, follow the same standard syntax. The commands are grouped into three Thi ngMagic M6e-TC OpCodes, as defined in the Allegro/Title-21 Tag Commands addition to the 1 of 3 OpCodes each command will have the following fields:

Standard Request Fields

Field Value Description

TM OpCode 0x24 TM OpCode Timeout [2 bytes] Indicates how long the command should spend

TM Options 0x00 Reserved for Future Use. Transaction Type Code [2 bytes] Allegro/Title-21 code indicating operation to per-

table, indicating their general operation type. In

attempting the operation, in milliseconds.

form.

The remaining fields for each command are as defined by Transcore based on the Transaction Type Code. They occur in the same order and require the same values as described in the [Transcore doc reference].

Allegro/Title-21 Tag Commands

Read Tag ID Single (21h)

The Read Tag ID Single/Tag Detect command performs a search operation and returns the first Allegro/Title-21 tag it finds.

Read Tag ID Single Request Fields

Field Value Description

TM OpCode 0x21 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempting

the operation, in milliseconds.

TM Options

Note: This and following

fields are optional.

Metadata Flags (to specify more than one OR the values together)

Examples

An example, without TM Options, command:

Bit 4 (LSB=bit 0))

0x0000 When no flags are set no meta data will be returned, only the

0x0001 When bit 0 is set the Read Count will be returned 0x0002 When bit 1 is set the LQI/RSSI will be returned 0x0004 When bit 2 is set the Antenna ID will be returned 0x0008 When bit 3 is set the Frequency will be returned 0x0010 When bit 4 is set the Timestamp will be returned 0x0020 When bit 5 is set the RFU (ThingMagic Only) will be returned 0x0040 When bit 6 is set the Protocol is returned.

• 0 - Metadata flags must not be passed and Meta Data will not be returned.

• 1 - Metadata flags must be passed and the corresponding Metadata shall be returned with the tag EPC.

tag EPC.

FF 02 21 00 FA D6 1B

SOH Length OpCode Time-

out (ms)

CRC

ACK Response

FF 04 21 00 00 ?? ?? ?? ?? ?? ??

SOH Length OpCode Status Tag ID CRC

NACK Response

No Response

Allegro/Tit le-21 Tag Commands

FF 00 21 ?? ?? ?? ??

SOH Length OpCode Status CRC

FF 00 21 04 00 B4 83

SOH Length TM

OpCode

Status CRC

Allegro/Title-21 Tag Commands

Write Request (24h; A003h)

The Write Request command writes dat a to t he specified ar ea of t he specified tag. A nonacknowledge (NACK) error response shall be returned if an invalid password was included in the request. This command contains the following request fields:

Write Request Fields

Field Value Description

TM OpCode 0x24 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xA003 Allegro/Title-21 code indicating operation to per-

form. Options [1 byte] Command specific options Page Number [2 bytes] Indicates which page of the tag is to be written to. Tag ID [4 bytes] Optional, based on value of Options parameter.

Indicates the ID of the tag to operate on. User Password/

Global Password

[4/8 bytes] Optional, based on the value of the Options param-

eter. The password to operation on the tag, if

required. Page Data Byte Count [1 byte] Indicates the number of data bytes to follow. Page Data Bytes [N bytes] Data to write to the tag.

Examples

An example command requesting ? be written to tag ? with a User Password = 0x? is:

FF 0E + N 24 ?? ?? 00 A0 03 ?? ?? ??

SOH Length TM

OpCode

?? ?? ?? ?? ?? ?? ?? ?? ?? NN NN ?? ??

Timeout

(ms)

Option

Transaction

Type Code

Option Page

Number

Tag ID User/Global

Password

Page

Data

Count

Page Data CRC

ACK Response

Allegro/Tit le-21 Tag Commands

SOH Length TM

0C +

(N+1)

24 00 00 00 A0 03 ?? ?? ?? ?? ?? ?? ?? ?? NN NN ?? ??

OpCode

FF 0B 24 04 0A 00 A0 03 ??

SOH Length TM

Title-21 ACK Request (24h; C000h)

Status TM

Option

NACK Response

OpCode

No Response

Transaction

Type Code

Status TM

FF 00 24 04 00 E4 26

SOH Length TM

Options Tag ID Page

Option

Transaction

Type Code

OpCode

Options Tag ID CRC

Status CRC

???????

Number

Page Data

Count (if

requested)

Page Data CRC

?? ??

The Title-21 ACK Request command informs the tag that the reader has successfully received the tag ID. This will result in the tag not responding to any message whose transaction type is identical to the most recent ly received message for a specified period of 10 seconds, as defined in Title 21 release 1. This command contains the following request fields:

Allegro/Title-21 Tag Commands

Title-21 ACK Request Fields

Field Value Description

TM OpCode 0x24 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xC000 Allegro/Title-21 code indicating operation to per-

form. Tag ID [4 bytes] Indicates the ID of the tag to operate on. Reader ID [4 bytes] The reader number for the reader that is acknowl-

edging the receipt of the message. Transaction Status Code [2 bytes] Code indicating the status of the transaction.

Examples

An example command requesting an ACK from tag XXX from reader XXX is:

FF 0D 24 ?? ?? 00 C0 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Time-

out (ms)

ACK Response

FF 03 24 ?? ?? 00 C0 00 ?? ??

SOH Length TM

NACK Response

FF 0B 24 ?? ?? 00 C0 00 ?? ?? ?? ?? ?? ?? ??

SOH Length TM

OpCode

Option

Transaction

Type Code

OpCode

Status TM

Option

Tag ID Reader ID Transaction

Status TM

Option

Transaction

Type Code

Status Code

Transaction

Type Code

Options Tag ID CRC

CRC

No Response

Allegro/Tit le-21 Tag Commands

FF 00 24 04 00 E4 26

SOH Length TM

OpCode

Status CRC

General ACK Request (24h; F00Fh)

The General ACK Request, or Sign Off Request, command informs the tag that it should not respond to any commands from the reader for the specified time period. This command contains the following request fields:

General ACK Request Fields

Field Value Description

TM OpCode 0x24 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xF00F Allegro/Title-21 code indicating operation to per-

form. Options [1 byte] Command specific options

Tag ID [4 bytes] Indicates the ID of the tag to operate on. Time Out [1 byte] Indicates the amount of time the tag shall ignore

commands from the reader, in seconds from 0-127. Condition Code Bits [1 byte] Represents a condition applicable to a tolling envi-

ronment. LCD Message Page Pointer [1 byte] Tag memory page where the LCD message to be

displayed is stored in ASCII. Valid range = 0x02 -

0x0F.

Allegro/Title-21 Tag Commands

Examples

An example command requesting an ACK from tag XXX from reader XXX is:

FF 0C 24 ?? ?? 00 F0 0F ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Timeout

(ms)

ACK Response

FF 03 24 ?? ?? 00 F0 0F ?? ??

SOH Length TM

NACK Response

FF 0A 24 ?? ?? 00 F0 0F ??

SOH Length TM

No Response

OpCode

Option

Transaction

Type Code

OpCode

Status TM

Option

FF 00 24 04 00 E4 26

SOH Length TM

Option Tag ID Time

Status TM

Option

Transaction

Type Code

OpCode

Transaction

Type Code

Options Tag ID CRC

Status CRC

Out

CRC

???????

Condition

Code

?? ??

LCD

Page

Ptr

CRC

T itle-21 Read Request (28h; 8000h)

The Title-21 Read Request command reads the Title-21 tag ID from the tag. This command contains the following request fields:

Allegro/Tit le-21 Tag Commands

Title-21 Read Request Fields

Field Value Description

TM OpCode 0x28 TM OpCode for Read operations Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0x8000 Allegro/Title-21 code indicating operation to per-

form. Agency Code [2 byte] Agency operating the reader installation.

Examples

An example command requesting an ACK from tag XXX from reader XXX is:

FF 04 28 ?? ?? 00 80 00 ?? ?? ?? ??

SOH Length OpCode Time-

out (ms)

Option

Transaction

Type Code

Agency

Code

CRC

ACK Response

FF 0A 28 00 00 00 80 00 ?? ?? ?? ?? ?? ??

SOH Length TM

OpCode

Status TM

Option

Transaction

Type Code

Tag ID CRC

NACK Response

FF 0B 28 ?? ?? 00 80 00 ?? ??

SOH Length TM

OpCode

Status TM

Option

Transaction

Type Code

CRC

No Response

FF 00 28 04 00 25 AA

SOH Length TM

OpCode

Status CRC

Allegro/Title-21 Tag Commands

Read Request (28h; C003h)

The Read Request command reads data fr om the specified are a of the specified tag. This command contains the following request fields:

Read Request Fields

Field Value Description

TM OpCode 0x28 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xC003 Allegro/Title-21 code indicating operation to per-

form. Options [1 byte] Command specific options.

• Determines whether the AntiPlayBack/BIST data will be included in the response.

Start Page Number [2 bytes] Indicates which page of the tag is to be read. Page Count [1 byte] Number of pages to read. Tag ID [4 bytes] Optional, based on value of Options parameter.

Indicates the ID of the tag to operate on.

User Password/ Global Password

[4/8 bytes] Optional, based on the value of the Options param-

eter. The password to operation on the tag, if required.

Examples

An example command format is:

FF 0C 28 ?? ?? 00 C0 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length TM

OpCode

Timeout

(ms)

Option

Transaction

Type Code

Option Page

Number

Page

Count

Tag ID CRC

Allegro/Tit le-21 Tag Commands

ACK Response

FF ?? + N 28 00 00 00 C0 03 ?? ?? ?? ?? ?? ?? ?? ?? .. .. ?? NN NN ?? ??

SOH Length TM

OpCode

SOH Length TM

Random Number Request (28h; D001h)

Status TM

Option

Transaction

Type Code

Options Tag ID Page

Number

AntiPlay-

Back

(0, 1, 2)

[Based

Options]

Page

Count

Page Data CRC

NACK Response

FF 0B 28 04 0A 00 C0 03 ?? ?? ?? ?? ?? ?? ??

OpCode

Status TM

Option

Transaction

Type Code

Options Tag ID CRC

No Response

FF 00 28 04 00 25 AA

SOH Length TM

OpCode

Status CRC

The Random Number Request command requests a 32-bit random number from the specified tag which is used in the P/W authentication scheme. This command also specifies which page is to be read or written to with the encrypted P/W on the next cycle. This command contains the following request fields:

Allegro/Title-21 Tag Commands

Random Number Request Fields

Field Value Description

TM OpCode 0x28 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xD001 Allegro/Title-21 code indicating operation to per-

form. Options [1 byte] Command specific options Tag ID [4 bytes] Indicates the ID of the tag to operate on. Page Number [2 bytes] Species which page is to be operated on in the next

transaction. Next Command [2 bytes] Specifies which command the reader will be send-

ing ot the tag on the next transaction, by Transac-

tion Type Code. Only Read and Write Request

commands are supported.

Examples

An example command:

FF 0C 28 ?? ?? 00 D0 01 ??

SOH Length TM

OpCode

ACK Response

FF ?? + N 28 00 00 00 D0 01 ?? ?? ?? ?? ?? ?? ?? ??

SOH Length TM

NACK Response

FF 0B 28 04 0A 00 D0 01 ?? ?? ?? ?? ?? ?? ??

SOH Length TM

Timeout

(ms)

OpCode

Option

Status TM

Transaction

Type Code

Option

Option Tag ID Page

Transaction

Type Code

Transaction

Type Code

???????

Random Number ATA

Options Tag ID CRC

?? ?? ?? ?? ?? ??

Page

Number

Next Com-

mand

CRC

Number

CRC

No Response

Allegro/Tit le-21 Tag Commands

FF 00 28 04 00 25 AA

SOH Length TM

OpCode

Status CRC

TDMA Read Request (28h; E003h)

The TDMA Read Request command returns the tag ID from the first tag to respond only. This command contains the following request fields:

TDMA Read Request Fields

Field Value Description

TM OpCode 0x28 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xE003 Allegro/Title-21 code indicating operation to per-

form. Options [1 byte] Command specific options

Number of Slots [1 byte] Specifies how many slots are available for the tags

to choose from. Valid values from 0x01-0xFF

Examples

An example command is:

FF ?? 28 ?? ?? 00 E0 03 ?? ?? ?? ??

SOH Length TM

OpCode

ACK Response

FF 0B 28 00 00 00 E0 03 ?? ?? ?? ?? ?? ?? ??

SOH Length TM

OpCode

Timeout

(ms)

Status TM

Option

Transaction

Type Code

Transaction

Type Code

Option Number

Option Tag ID CRC

of Slots

CRC

Allegro/Title-21 Tag Commands

NACK Response

FF 0B 28 04 0A 00 E0 03 ?? ?? ?? ?? ?? ?? ??

SOH Length TM

OpCode

Status TM

Option

Transaction Type Code

Options Tag ID CRC

No Response

FF 00 28 04 00 25 AA

SOH Length TM

OpCode

Status CRC

Jump to Reset Request (2Ch; D203h)

The Jump to Reset Request command requests the tag perform a hard reset. The reset will occur the same as a hardware reset and the decis ion is made by the t ag to perfor m a cold boot or a warm boot by analyzing the first 32 bits of p age 0000 in the tag. If the bits are all 0s or all 1s, then a cold boot will be performed, otherwise a warm boot will occur. This command contains the following request fields:

Jump to Reset Request Fields

Field Value Description

TM OpCode 0x2C TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xD203 Allegro/Title-21 code indicating operation to per-

form.

Examples

An example command is:

FF 05 2C ?? ?? 00 D2 03 ?? ??

SOH Length TM

OpCode

Timeout

(ms)

Option

Transaction

Type Code

CRC

NACK Response

Allegro/Tit le-21 Tag Commands

FF 00 2C 04 00 65 2E

SOH Length TM

OpCode

Status CRC

eGo/SeGo Tag Command Set

The eGo/SeGo tag commands are used to operate oneGo/SeGo tags and perform operations specific to those tags. These commands can only be used when the Tag Protocol of the reader is set to eGo/SeGo (0x001B or 0x001C) using Set Current Tag

Protocol (93h). These commands cannot be run when in Bootloader mode, only in

Application mode.

eGo/SeGo Tag Commands

OpCode Command Name

eGo/SeGo Tag Command Set

0x21 0x22 0x24 0x25 0x28 0x2D

Read Tag ID Single (21h)

Read Tag ID Multiple (22h)

Write Tag Data (24h)

Lock Tag Data (25h)

Read Tag Data (28h)

Custom Tag Operations (2Dh)

eGo/SeGo Tag Command Set

Command Syntax

All eGo/SeGo tag commands follow the same standard syntax. Each command has the following common fields followed by additional fields required for the specific operation being performed:

Standard Request Fields

Field Value Description

TM OpCode 0xXX

TM OpCode as defined in

eGo/SeGo Tag Com-

mands

Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x01 Must be set to 0x01, indicating Command Type and

eGo/SeGo specific fields to follow. Command Type [1 byte] Depending on the operation indicates either the

Group Select Options to apply or a specific sub-

command.

Group Select Options

The following table defines the Command Type values to use for the desired Group Select Option when performing a Read Tag ID Single (21h)

Write Tag Data (24h)

. The Group Select Option along wi th the Select Fi elds (Byte Address,

Byte Mask and Word Data) determine which tags will respond to the specifi ed query.

Group Select Options

Command

Type Value

Group Select Option Tag Selection Behavior

, Read Tag ID Multiple (22h) or

0x00 GROUP_SELECT_EQ All tags in the field whose data EQUALS the

specified Select Fields will respond.

0x01 GROUP_SELECT_NE All tags in the field whose data does NOT

EQUAL the specified Select Fields will respond.

0X02 GROUP_SELECT_GT All tags in the field whose data is GREATER

THAN the specified Select Fields will respond.

eGo/SeGo Tag Command Set

Command

Type Value

0X03 GROUP_SELECT_LT All tags in the field whose data is LESS

0X04 GROUP_UNSELECT_EQ All tags except those in the field whose data

0X05 GROUP_UNSELECT_NE All tags except those in the field whose data

0X06 GROUP_UNSELECT_GT All tags except those in the field whose data is

0X07 GROUP_UNSELECT_LT All tags except those in the field whose data is

Group Select Option Tag Selection Behavior

THAN the specified Select Fields will respond.

EQUALS the specified Select Fields will respond.

does NOT EQUAL the specified Select Fields will respond.

GREATER THAN the specified Select Fields will respond.

LESS THAN the specified Select Fields will respond.

eGo/SeGo Tag Command Set

Read Tag ID Single (21h)

The Read Tag ID Single command executes a query for tags matching the criteria specified by the Command Type and subsequent fields and returns the first tag found.

Read Tag ID Single Request Fields

Field Value Description

TM OpCode 0x21 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempt-

ing the operation, in millisecon ds .

TM Options Bit 0 • 1 - Indicates Command Type and additional fields to

Bit 4 (LSB=bit 0))

Metadata Flags (to specify more than one OR the values together)

Command Type [1 byte] Indicates the Group Select criteria to apply as defined in

0x0000 When no flags are set no meta data will be returned,

0x0040 When bit 6 is set the Protocol is returned.

follow.

• 0 - Metadata flags must not be passed and Meta Data will not be returned.

• 1 - Metadata flags must be passed and the corresponding Metadata shall be returned with the tag EPC.

only the tag EPC (including PC bits and tag CRC)

returned

Group Select Options.

Byte Address [1 byte] Byte Mask [1 byte] Word Data [8 bytes]

eGo/SeGo Tag Command Set

Examples

An example command:

FF 0E 21 ?? ?? 01 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Time-

out (ms)

TM Option

Command Type

Byte Address

Byte Mask

Word Data CRC

ACK Response

FF 0C 21 ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Status TM

Option

Command Type

Tag Data CRC

NACK Response

FF 02 21 ?? ?? 01 ?? ?? ??

SOH Length OpCode Status TM

Option

Command Type

CRC

No Response

FF 00 21 04 00 B4 83

SOH Length TM

OpCode

Status CRC

Read Tag ID Multiple (22h)

The Read Tag ID Multiple command performs a search for the specified period of time then returns the number of t ags that have been found. Af t erwards, multi ple Get Tag Buffer

(29h) commands can be sent to receive the found tag IDs.

Standard Syntax

The search criteria for the Standard Synt ax whic h allows contr ol over the select cri teri a is specified by the Command Type and subsequent fields.

eGo/SeGo Tag Command Set

Read Tag ID Multiple Request Fields

Field Value Description

TM OpCode 0x22 TM OpCode TM Options 0x01 Indicates Command Type and additional fields to follow. Search Flags 0x0000 Reserved for Future Use. Timeout [2 bytes] Indicates how long the command should spend attempt-

ing the operation, in millisecon ds .

Command Type [1 byte] Indicates the Group Select criteria to apply as defined in

Group Select Options.

Byte Address [1 byte] Byte Mask [1 byte] Word Data [8 bytes]

Examples

An example command requesting :

FF 10 22 01 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode TM

Option

ACK Response

SOH Length OpCode Status TM

NACK Response

Search Flags

FF ?? 22 ?? ?? 01 00 00 ?? ?? ?? ?? ??

Timeout (ms)

FF 02 22 ?? ?? 01 ?? ?? ??

SOH Length OpCode Status TM

Command Type

Option

Byte Address

Search Flags

Option

Byte Mask

Word Data CRC

Command Type

Tag IDs Detected

CRC

No Response

eGo/SeGo Tag Command Set

FF 00 22 04 00 84 E0

SOH Length TM

OpCode

Status CRC

Minimal Syntax

The Read Tag ID Multiple command can also be used in a reduced syntax format. In this case only the Timeout is specified. This syntax performs a search for the specified period of time with no selection criteria, returning the number of tags that have been found.

Example

FF 02 22 03 E8 E5 6A

SOH Length OpCode Timeout (ms) CRC

An example response is as follows:

FF 01 22 00 00 02 46 BA

SOH Length OpCode Status # Tag IDs Found CRC

Write Tag Data (24h)

The Write Tag Data command writes data to a tag. The tag to write to, the loca tion and the data to write are specified in the fields as defined below:

eGo/SeGo Tag Command Set

Write Tag Data Request Fields

Field Value Description

TM OpCode 0x24 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempt-

ing the operation, in milliseconds.

TM Options

Note: T M O p ti o ns field

combines bits 0-4 indicating the verification method and bits 5 & 6 for authentication information. For the final TM Options setting, the two “fields” should be OR’d.

Command Type

Note: If TM Options bits

0-4=0 then the Command Type is implicity = 0x0D and this byte should not be specified in the request command.

[1 byte] excluding bits 5 & 6

(LSB = bit 0)

• 0x00 = A READ is executed after the WRITE has reported success for verification. Lock if requested.

Note: When 0x00 the Command Type is impli city =

0x0D and the Command Type 1 byte field should be removed from the request command.

• 0x01 = No verification is executed after WRITE reports success.

• 0x02 = A READ_VERIFY is executed after the WRITE reports success for verification.

• 0x03 = Only used with Command Type = 0x0E or 0x93. Indicates extra Select fields will be specified.

bits 5 & 6

(LSB = bit 0)

0x0D Indicates the eGo/SeGo Write by Byte operation will be

0x8D Indicates the eGo/SeGo Write by Page operation will be

0x0E Indicates the eGo/SeGo Write Multiple operation will be

0x93 Indicates the eGo/SeGo Streamlined Group Select

Specify authentication method to use:

• 0x00 = authentication is disabled and Key values must not be passed.

• 0x20 = RFU

• 0x40 = authent ic ati on i s en abl ed and Key values must be passed.

• 0x60 = RFU

used.

used

used.

Equal Page Write operation will be used.

eGo/SeGo Tag Command Set

Field Value Description

Lock [1 byte] • 0x00 = no lock

• 0x01 = lock the data specified by Write Data

Write by Page won’t lock if authentication information is not specified. Write multiple won’t lock

Write Address [1|4byte] Indicates the start address of tag memory to be written:

• 4 Byte Address when TM Option = 0xX0

• 1 Byte Address otherwise

Select Command Type [1 byte] Indicates the Group Select criteria to apply as defined in

Group Select Options.

Only passed when TM Option=0x03. For Command Type = 0x0E, indicates Select Type

For Command Type = 0x93, RFU Select Address [1 byte] Only passed when TM Option=0x03. Select Mask [1 byte] Only passed when TM Option=0x03.

For Command Type = 0x0E, indicates Select Mask

For Command Type = 0x93, RFU Tag ID | Select Data [8 bytes] When:

• Command Type = 0x0D, 0x0E or 0x8D:

8 bytes = Tag ID

• Command Type = 0x93 AND TM Options=0x03:

[1 byte] = Select Data [7 bytes] = RFU

• Command Type = 0x93 AND TM Options=0x01 or 0x02

[1 byte] = Select Address [1 byte] = Select Data [6 bytes] = RFU

Write Data [1|8 byte] Indicates the data to be written to the specified tag starting

at the specified address.

• 1 Byte when Command=0x0D and 0x0E

• 8 Bytes (1 page) when Command=0x8D and 0x93

Key Address [1 byte] Only passed when authentication enabled in TM Options. Key Length in Bytes [1 byte] Only passed when authentication enabled in TM Options.

eGo/SeGo Tag Command Set

Field Value Description

Key [0-N bytes] Only passed when authe nti ca tio n enabl ed in TM Opti ons.

Note: Value passed with MSB first.

Examples

An example command requesting :

FF 0F 24 ?? ?? 01 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Timeout

(ms)

ACK Response

When Command Type = 0x0D or 0x0E,

SOH Length OpCode Status TM

When Command Type = 0x8D

FF 0A 24 ?? ?? ?? 8D

SOH Length OpCode Status TM

When Command Type = 0x93

FF 1 3 24 ?? ?? ?? 93 ??

TM Option

FF 0 3 24 ?? ?? ?? 0D | O E ?? ?? ??

Command Type

Lock Write

Address

Option

Tag ID Write

Command Type

Verified Write Data

?? ?? ?? ?? ?? ?? ?? ??

Verified Write Data

?? ?? ?? ?? ?? ?? ?? ??

CRC

?? ??

CRC

?? ?? ?? ?? ?? ?? ?? ??

Data

CRC

?? ??

SOH Length OpCode Status TM

Note

ACK Status will be: 0x0000 FAULT_SUCCESS_CODE 0x0403 FAULT_WRITE_PASSED_LOCKED_FAILED

Option

Command Type

Tag ID Length

Tag ID (length

defined by ID Length)

Verified Write Data

CRC

NACK Response

FF 02 24 ?? ?? 01 0D ?? ??

eGo/SeGo Tag Command Set

SOH Length OpCode Status TM

Option

Command Type

CRC

No Response

FF 00 24 04 00 E4 26

SOH Length TM

OpCode

Status CRC

Lock Tag Data (25h)

The Lock Tag Data command locks and unlocks a tag’s memory locations. The tag to (un)lock and memory location to be (un)locked are speci fied in the fields as defined below:

Lock Tag Data Request Fields

Field Value Description

TM OpCode 0x25 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempt-

ing the operation, in milliseconds.

TM Options

Note: TM Options field

combines bit 0 indicating general processing information and bits 5 & 6 indicating authentication method. For the final TM Options setting, the two “fields” should be OR’d.

0x01 Indicates Command Type and additional fields to follow. bits 5 & 6

(LSB = bit 0)

Specify authentication method to use:

• 0x00 = authentic ation is disabl ed and Key value s must not be passed.

• 0x20 = RFU

• 0x40 = authenticat ion is en able d and Key values must be passed.

• 0x60 = RFU

eGo/SeGo Tag Command Set

Field Value Description

Command Type 0x00 Performs a QueryLock, immediate followed by an UnLock

0x01 Performs a QueryLock, immediate followed by a Lock 0x0F LockByte operation. Performs QLock/Lock/QLock 0x10 UnLock Byte. Performs QLock/UnLock/QLock 0x11 QueryLock 0x8F Lock Page. Performs QLock/Lock/QLock

0x90 UnLock Page. Performs QLock/UnLock/QLock Lock Address [1 byte] Indicates the address of tag memory to be (un)locked. Tag ID [8 byte] Indicates the Tag ID of the tag to be (un)locked. Key Address [1 byte] Only passed when authentication enabled in TM Options. Key Length in Bytes [1 byte] Only passed when authentication enabled in TM Options. Key [0-N bytes] Only passed when authentication enabled in TM Options.

Note: Value passed with MSB first.

Examples

An example command requesting :

FF 0D 25 ?? ?? 01 0F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Timeout

(ms)

Option

Command Type

Lock Address

Tag ID CRC

ACK Response

When Command Type = 0x00 or 0x01

FF 03 25 ?? ?? ?? 00 | 01 ?? ?? ??

eGo/SeGo Tag Command Set

SOH Length OpCode Status TM

Option

Command Type

(Un)Lock Response

CRC

When Command Type = all others

FF 04 25 ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Status TM

Option

Command Type

Lock Response

Query Lock Response

NACK Response

FF 03 25 ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Status TM

Option

Command Type

Lock Response

No Response

FF 00 25 04 00 F4 07

SOH Length TM

OpCode

Status CRC

CRC

Note

For eGo Plus tags a k ey must be provided for lock/ unlock operations. If a key is not provided then the tag will not respond. In that case a status=0x0400 is the expected command response.

Read Tag Data (28h)

The Read Tag Data command reads data from a tag. The tag to read from and the location to read the data from are specified in the fields as defined below:

eGo/SeGo Tag Command Set

Read Tag Data Request Fields

Field Value Description

TM OpCode 0x28 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempting the

operation, in milliseconds.

TM Options

Note: TM Options field

combines bits 0-4 indicating general processing information and bits 5 & 6 indicating authentication method. For the

[1 byte] Indicates Command Type and additional fields to follow:

• 0x01 = For Standard Read Operations

bits 5 & 6

(LSB = bit 0)

Specify authentication method to use:

• 0x00 = authentic ati on is di sab le d and Key values must not be passed.

• 0x20 = RFU

• 0x40 = authentication is enabled and Key values must be passed.

• 0x60 = RFU

final TM Options setting, the two “fields” should be OR’d.

Command Type 0x0C eGo/SeGo Read, or Protected Read

0x0B eGo/SeGo Data_ Read 0x12 eGo/SeGo Read_Verify

Note: Requires a Write to occur immediately before.

0x80 eGo/SeGo Streamline_Group_Select _Equal_Page_Read

Note: Only works with eGo Plus tags.

0x92 eGo/SeGo Read_Verify_Page

Note: Requires a Write to occur immediately before.

RFU [1 byte] Reserved for Future Use Read Byte Count [1 byte] Number of bytes starting at Read Address to read. Can

request 1 to 8 bytes.

Read Address [1 byte] Indicates the start address of tag memory to be read.

eGo/SeGo Tag Command Set

Field Value Description

Tag ID | Select Data [8 bytes] When:

• Command Type = 0x0B, 0x0C, 0x12 or 0x92:

8 bytes = Tag ID

• Command Type = 0x80

[1 byte] = Selec t Ad d r es s [1 byte] = Select Data [6 bytes] = RFU

Key Address [1 byte] Only passed when authentication enabled by TM Options. Key Length in Bytes [1 byte] Only passed when authentication enabled by TM Options. Key [0-N bytes] Only passed when authentication enabled by TM Options.

Note: Value passed with MSB first.

Examples

An example command requesting :

FF 0F 28 ?? ?? 01 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode T imeout

(ms)

TM Option

Command Type

RFU Read

Byte Count

Read Address

Tag ID CRC

ACK Response

FF ?? 28 ?? ?? 01 0C ?? ?? ??

SOH Length OpCode Status TM

Option

Command Type

Read Data

CRC

When Command Type = 0x80

FF ?? 28 ?? ?? ?? 80 ??

SOH Length OpCode Status TM

Option

Command Type

Tag ID Length

?? ?? ?? ?? ?? ?? ?? ??

Tag ID (length defined by ID Length)

?? ?? ?? ?? ?? ?? ?? ??

Read Data CRC

?? ??

NACK Response

FF 02 28 ?? ?? 01 0C ?? ??

eGo/SeGo Tag Command Set

SOH Length OpCode Status TM

Option

Command Type

CRC

No Response

FF 00 28 04 00 25 AA

SOH Length TM

OpCode

Status CRC

Custom Tag Operations (2Dh)

The Custom Tag Operations command provides access to several eGo/SeGo tag specific operations including: Fail, Success, Initialize, Resend, Read_All_Data, Read_All_Lock, and RN_Request. The operation to be performed is indicated by the Command Type field:

Custom Tag Operations Request Fields

Field Value Description

TM OpCode 0x2D TM OpCode

Timeout [2 bytes] Indicates how long the command should spend

attempting the operation, in milliseconds. TM Options 0x01 Indicates Command Type to follow. Command Type 0x08 Fail

0x09 Success 0x0A Initialize 0x15 Resend 0x81 RN Request 0x82 Tag Authentication. When specified the Key fields

also must be passed.

0x83 Mutual Authentication. When specified the Key

fields also must be passed.

eGo/SeGo Tag Command Set

Field Value Description

Key Address [1 byte] Only passed when Command=0x82 or 0x83. Key Length in Bytes [1 byte] Only passed when Command=0x82 or 0x83. Key [0-N bytes] Only passed when Command=0x82 or 0x83.

Note: Value passed with MSB first.

Examples

An example command requesting :

FF 04 2D ?? ?? 01 0C ?? ??

SOH Length OpCode Timeout

(ms)

TM Option

Command Type

CRC

ACK Response

FF 05 2D ?? ?? 01 0C ?? ... NN ?? ??

SOH Length OpCode Status TM

Option

Command Type

Tag Data (0-N based on Command Type)

NACK Response

FF 02 2D ?? ?? 01 ?? ?? ??

SOH Length OpCode Status TM

Option

Command Type

CRC

No Response

FF 00 2D 04 00 75 0F

SOH Length TM

OpCode

Status CRC

CRC

eGo/SeGo Tag Command Set

ATA Tag Command Set

The ATA tag commands are used to perform operations specific to ATA tags. These commands can only be used when the Tag Protocol of the reader is set to ATA (0x001D) using Set Current Tag Protocol (93h) mode, only in Application mode.

OpCode Command Name

. These commands cannot be run when in Bootloader

ATA Tag Commands

ATA Tag Command Set

0x21 0x22

Read Tag ID Single (21h) Read Tag ID Multiple (22h) [Not yet

Implemented]

ATA Tag Command Set

Command Syntax

All ATA tag commands follow the same st andard syntax. Each command has the following common fields followed by additional fields required for the specific operation being performed:

Standard Request Fields

Field Value Description

TM OpCode 0xXX Timeout [2 bytes] Indicates how long the command should spend

TM OpCode as defined in

attempting the operation, in milliseconds.

ATA Tag C ommand s

ATA Tag Command Set

Read Tag ID Single (21h)

The Read Tag ID Single/Tag Detect command performs a search operation and returns the first ATA tag it finds.

Read Tag ID Single Request Fields

Field Value Description

TM OpCode 0x21 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempting

the operation, in milliseconds.

TM Options

Note: This and following

fields are optional.

Metadata Flags (to specify more than one OR the values together)

Examples

An example, without TM Options, command:

Bit 4 (LSB=bit 0))

0x0000 When no flags are set no meta data will be returned, only the

• 0 - Metadata flags must not be passed and Meta Data will not be returned.

• 1 - Metadata flags must be passed and the corresponding Metadata shall be returned with the tag EPC.

tag EPC.

FF 02 21 ?? ?? ?? ??

SOH Length OpCode Time-

out (ms)

CRC

ATA Tag Command Set

ACK Response

FF 0A 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

SOH Length OpCode Status Tag ID CRC

NACK Response

FF 00 21 ?? ?? ?? ??

SOH Length OpCode Status CRC

No Response

FF 00 21 04 00 B4 83

SOH Length TM

OpCode

Read Tag ID Multiple (22h)

[Not yet implemented]

Status CRC

Gen2 Tag Commands

The Gen2 tag commands are used to operate on Gen2 tags and perform operations specific to those tags. These commands can only be used when the Tag Protocol of the reader is set to Gen2 (0x0005) using Set Current Tag Protocol (93h) cannot be run when in Bootloader mode, only in Applicati on mode .

Gen2 Tag Commands

OpCode Command Name Arguments Return BL App

Gen2 Tag Commands

. These commands

0x21 0x22

0x23

0x24

0x25

0x26

0x28

0x29 0x2A 0x2D

Read Tag Single (21h)

Read Tag Multiple (22h)

Write Tag EPC (23h)

Write Tag Data (24h)

Lock Tag (25h)

Kill Tag (26h)

Read Tag Data (28h)

Get Tag Buffer (29h)

Clear Tag Buffer (2Ah)

Gen2 Tag Specific (2Dh)

Timeout (ms) Tag ID N Y Timeout (ms),

Antennas Flag Timeout (ms), lock

bit, password, tag ID

Timeout (ms), lock bit, address, data

Timeout (m s ), p r oto col specific data

Timeout (ms), Address, Tag ID

various various N Y none none N Y Timeout (ms), Chip

Type, option, Kill password, Access password, Tag ID

Multiple Tag IDs

None N Y

Tag data N Y

none N Y

0x2E

Erase Block Tag Specific (2Eh)

Timeout (ms), chip type, option addr, mem bank, number of words to erase

none N Y

Gen2 Tag Commands

Tag Singulation/Select Functionality

Many of the Gen2 tag commands now support the ability to singulate a specif ic tag or inventory only tags matching a defined criteria, i.e. matching on values in the EPC, TID and User Memory banks.

Select Algorithm and Parameters

The algorithm used to perform a Gen2 Select and its impact on subsequent Gen2 Query operations on a population of tags is deter mined by several user defined settings which either correspond directly to or are used t o determine the var ious Gen2 Select and Query parameters as defined by the EPCGlobal Gen2 v1.2 Specification. The current user controlled options are:

Gen2 Session (User Contr o ll e d)

This setting determines which tag inven tory flag is altere d when a tag responds to a Gen2 Query (each flag has a unique persistence profile, as defined by the Gen2 Specificat ion). The value of Gen2 Session is set using the Set Protocol Configuration (9Bh) The supported values are 0, 1, 2, or 3.

command.

Select Invert (User Controlled)

This setting is used to determine the Gen2 Action value sent in the Gen2 Select command. The value of Select Inv ert is def ined using bit 3 o f the Select Opt ion fiel d in the

Tag Singulation Fields

. The supported values are:

 0 (False) - Tags which match the Select criteria are to respond. Set Gen2

Action=0.

 1 (True) - Tags which DO NOT match the Select criteria a re t o respond. Set Gen2

Action=4.

The settings specified for Gen2 Session and Select Invert determi ne the settings within the Select command which is sent befor e the correspondin g Gen2 Query and the sett ings in the subsequent Gen2 Query(s). These implicit sett ings used by the Gen2 Select are:

Gen2 Action (defined by Select Invert)

This parameter can be one of 8 values, as defined by the Gen2 specification, which determine which of 4 possible flag actions (assert, de-assert, negate, or leave alone) will be done if the criteria matches and, similarly, which of the 4 possible flag actions will be done if the criteria does not match. Only two values are currently used:

Gen2 Tag Commands

 0 - Assert (or put in state “A” for inven tory f lags) t he t ar get flag if there IS a match;

de-assert (or put in state “B” for inventory flags) the target flag if there IS NOT a match.

 4 - Assert (or put in state “A” for inventory flags) the target flag if there IS NOT a

match; de-assert (or put in stat e “B” for inventory flags) the target flag if there IS a match

Gen2 Target (Static)

This setting determines which inventory flag or SL flag is going to have its state determined by the matching algorithm. Curr ently always set to ‘4’, indicating the Gen2 Select command modifies a tag’s SL flag.

The following table defines the currently supported User Settings and the resulting behavior of the Gen2 Select and Gen2 Query:

Gen2 Select and Query Behavior

User Settings Select Behavior Query Behavior Comments

• Gen2 Session = 0,1,2,3

• Invert = 0

• Gen2 Session = 0,1,2,3

• Invert = 1

Gen2 Select Settings:

• Target = 4

• Action = 0

If tags match the criteria, put their SL flag in the ‘Assert’ state; and SL of non-matching tags into the ‘De-assert’ state.

Gen2 Select Settings:

• Target = 4

• Action = 4

If tags match the criteria, put their SL flag in the ‘Deassert’ state; and SL of non-matching tages into the ‘Assert’ state.

Gen2 Query Settings:

• SEL = 3

• Target = “A”

• Session = [User Defined]

Ask tags to respond if their SL flag is in the ‘Assert’ state and their session appropriate inventory flag is in the ‘A’ state. Once a tag responds, it puts the inventory flag in the ‘B’ state, preventing further matches until the inventory flag’s

Flag Persistence Rules

returns it to the ‘A’ state.

Tag state persistence before a Query is based on SL flag persistence; Tag state persistence after a Query is based on inventory flag corresponding to the Session used.

Select Proces s

The following defines how the Select process work s when attempt ing to select tags that match a defined criteria:

Gen2 Tag Commands

1. The Reader issues a Select containing the desired tag memory values and instructions for the t ag to assert if its contents matches that specified in the request (and, conversely, de-assert the SL flag if it does not match) as defined by the Tag

Singulation Fields. The de-assert will generally have no effect because the de-

asserted state is the defaul t, but is hel pful i f tags st ill have their SL fl ag assert ed from a previous Select.

– Tags that are selected, at this point, are not selected withi n a specific Sessi on. The

persistence of their state depends ent irely on that of the SL flag.

2. A Query is issued which specifies the flag settings whi ch must match b efore a tag will respond:

– The SL flag must be asserted – The Session flag for session 0, 1, 2, or 3 (specific Session value is in the Query

and depends on the reader’s Session setting) must be ‘A’ (the default value).

3. Matching tags will respond to the Query, but after responding, will change their own state in the following way:

– The Inventory flag corresponding to the Session specified in the Query will be

changed to the ‘B’ state.

– The SL flag will remain asserted (per its ongoing Flag Persistence Rules

4. If subsequent indentical Queries are issued (identical to the first), this tag will remain silent until the Flag Persistence Rules state cause the flag to fall back into the ‘A’ state. At that point, the t ag will respond again (assuming that the persistence rule s of the SL flag are still keeping it in the ‘assert’ state).

for the inventory flag that was put int o the ‘B’

)

Note

A search with Invert=1 specified will perform the same steps except in step 1 the tag will “de-assert if its contents matches that specified in the request (and, conversely, assert the SL flag if it does not match) as defined by the

Tag Singulation Fields.”

Note

A Select will be performed once per antenna when Select is specified during a

Read Tag Multiple (22h) with multiple antennas configured.

Flag Persistence Rules

Session 0

 Keeps state as long as tag is energized

Gen2 Tag Commands

 Returns to default state as soon as the tag is no longer energized

Its state will often get reset during the course of executing a singl e command, for example, between inventory rounds, or when there is a frequency hop, or when a new antenna is selected during a Read Tag Multiple search. the result is that when the session is set to ‘0’, all tags will respond to every appropriat e Query, considerably lengthening the time to inventory a large population of tags. Session 0 is typically used for operations where a single tag is expected to be in the field, for example, printers.

Session 1

 Keeps its st ate between 0.5 and 5 seconds, regardless of whether the tag is

energized or not.

The intent is that when the sessi on is set to 1 t he t ag will respo nd to an ap propria te Query immediately, and then respond periodically if the Query is repeated by the reader. This allows a larger population of tags to be reliable read. Session 1 is typically used i n applications where a large population of tags is being continuously inventoried allowing for it to be determined when tags enter and leave the field.

Session 2, 3 and SL Flags

 Keeps state as long as the tag is energized.  Keeps its state for at least 2 seconds after the tag is no longer energized and will

refresh its state if the tag is re-energized during that period.

The intent is that when the session is set to ‘2’ or ‘3’ a tag will only respond once to an appropriate Query, then remain silent as the Query is repeated by the reader to elicit responses from other tags. Typically used in oper ations when you are performing an action on tag or population of tags which you do not want/need repeated.

Operations supporting Tag Singulation/Select

The commands currently supporting tag singulati on through Select are:

 Read Tag Single (21h)

 Read Tag Multiple (22h)

 Write Tag Data (24h)

 Lock Tag (25h)

 Kill Tag (26h)

Gen2 Tag Commands

 Read Tag Data (28h)

The following fields apply to all the specif ied commands. Please check each command for exact order, and any exceptions, as they may not all correspond with the order below.

Tag Singulation Fields

Field Values Description

Select Option 0x00 Select functionality is disabled. First tag found will be the tag

operated on. No other Tag Singulation Fields should be specified. Option field must always be specified.

0x01 Select on the value of the EPC. Requires all fields except

the Select Address field.

0x02 Select on contents of TID memory bank (Gen2 bank 0x02).

Requires all fields.

0x03 Select on contents of User Memory memory bank (Gen2

bank 0x03). Requires all fields.

0x04 Select on contents of the EPC memory bank (Gen2 bank

0x01). Requires all fields.

0x08 Sets Invert Flag. This results in tags NOT matching the

specified Tag Singulation Fields will be returned, as defined

Select Algorithm and Parameters.

Select Address 4 bytes Contains the offset, in bits, within the memory bank, speci-

fied by the Option value, at which the comparison is to start. NOTE: specifying Option=0x04 and Select Address=0x 20 is the equivalent, for Gen2 v1 tags, of specifying Option=0x01, both specify a comparison against the tag EPC ID data.

Note: Addresses are always zero-based. Specifying

0x00 indicates starting at the first address location.

Select Data Length 1 byte Contains the length of the data (Select Data) to be com-

pared, in bits, to the EPC when Option=0x01, or to the data beginning at Select Address for other options.

Select Data M bytes Contains the data to be compared against the specified tag

data (memory bank and address, or EPC as specified by the Option value)

100

TransCore 76007 Users Manual

Specifications and Main Features

Frequently Asked Questions

User Manual

Contents

Hardware Overview

Introduction to the Mercury6e-Transcore Module 13

Microcontroller

RFID ASIC

Connectors

Firmware Overview

M6e-TC Digital Connectors

Boot Loader

Application Firmware

Verifying Application FW Image CRC

Regional Support

Functionality of the Embedded Modules 17

Frequency Setting

Frequency Units

Frequency Hop Table

Frequency Hop Interval

RF Power Setting

Power Units

Power Calibration

TX Read Power

TX Write Power

Power Amplifier Protection

Antenna Ports

Monostatic Mode

Power Management

Power Modes

Tag Buffer

Flash Memory

Accessing the Flash

Upgrading Application FW

Serial and USB Interfaces

Installi ng the USB Driver

Windows

General Purpose Inputs/Outputs (GPIO)

Default Settings

Host-to-Reader Communication

Overview of the Communication Protocol 29

Reader-to-Host Communication

CCITT CRC-16 Calculation

Format for Microprocessor Reply to Host

Microprocessor ACK Message

Microprocessor Fault Reply Message

Microprocessor Data Reply Message

Command Set

Boot Loader Commands

Flash Read Sector (02h)

Get Boot Loader/Firmware Version (03h)

Responses

Returned Hardware Version Table

Boot Firmware (04h)

Set Baud Rate (06h)

Erase Flash Sector (07h)

Verify Image CRC (08h)

Start Bootloader (09h)

Get Current Program (0Ch)

Write Flash Sector (0Dh)

Loading an Application Image

Get Sector Size (0Eh)

Modify Flash Sector (0Fh)

Multi-Protocol Tag Commands

Get Tag Buffer (29h)

Get Tags Remaining

Get Tag EPCs

Get Tag EPCs and Metadata

Examples

Clear Tag Buffer (2Ah)

Multi-Protocol Tag Read (2Fh)

Examples

Allegro/Title-21 Tag Commands

Command Syntax

Read Tag ID Single (21h)

Examples

Write Request (24h; A003h)

Examples

Title-21 ACK Request (24h; C000h)