875-0016-07 RevA Mercury5e and M5e-Compact Developer’s Guide For: Mercury5e and M5e-Compact (v1.7.
Government Limited Rights Notice: All documentation and manuals were developed at private expense and no part of it was developed using Government funds. The U.S. Government’s rights to use, modify, reproduce, release, perform, display, or disclose the technical data contained herein are restricted by paragraph (b)(3) of the Rights in Technical Data — Noncommercial Items clause (DFARS 252.227-7013(b)(3)), as amended from time-to-time.
Revision Table Date Version Description 2/2008 Rev1 Separated out M4e content and Reader Assistant into standalone documents. Created new M5e Family DevGuide 2/2008 Rev1 Updated TX Power section to correct TX Write power note. 2/2008 Rev1 Fixed Send CW Signal content with correct value for PRBS signal. 3/2008 Rev1 Added input voltage details to M5e/C Hardware comparison table.
Date 6/2008 Version Rev3 Description • Fixed Arbser help info to include -l5a for loading M5e firmware • Fixed Get Tag Buffer Response Fields to show Read Count as conditional 9/2008 02 RevA • Added info on EU2 usage and caution • Update Get/Set Reader Configuration commands to reflect the new key/value pair format • Fixed the CRC calc sample code • Fixed PRC region frequency range 11/2008 02 RevA • added info about why use Write Tag EPC over Write Tag Data 4/2009 03 RevA • Added 1.1.
Communication Regulation Information Communication Regulation Information EMC FCC 47 CFR, Part 15 Industrie Canada RSS-210 Federal Communication Commission Interference Statement This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation.
Communication Regulation Information any additional compliance requirements required with this module installed (for example, digital device emissions, PC peripheral requirements, etc.). Note In the event that these conditions can not be met (for certain configurations or co-location with another transmitter), then the FCC authorization is no longer considered valid and the FCC ID can not be used on the final product.
Communication Regulation Information or “Contains FCC ID: QV5MERCURY5E.” (Replace QV5MERCURY5E, for the Mercury5e, with QV5MERCURY5EC for the M5eCompact). Industry Canada Operation is subject to the following two conditions: (1) this device may not cause interference, and (2) this device must accept any interference, including interference that may cause undesired operation of the device.
Communication Regulation Information 8
Contents Communication Regulation Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Federal Communication Commission Interference Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Industry Canada . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . .
Power Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Power Calibration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . TX Read Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . TX Write Power. . . . . . . . . . . . .
Microprocessor ACK Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Microprocessor Fault Reply Message. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Microprocessor Data Reply Message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Boot Loader Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tag Inventory with Select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Tag Inventory With Embedded Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Error Status Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Write Tag EPC (23h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Set Single Tag Operations Antennas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 Set Multi-Antenna Search Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Set Antenna’s Power and Settling Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154 Set Read TX Power (92h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Transmit CW Signal (C3h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Appendix A: Hardware Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Mechanicals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189 Antenna Connector. . . . . . . . . . . . . . . . . . . . . . . . .
Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 FAULT_INVALID_OPCODE – 101h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Solution . . . . . . . . . . . . . . . . . . . . . . . .
Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 FAULT_FLASH_UNDEFINED_ERROR – 302h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218 Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 FAULT_PROTOCOL_INVALID_WRITE_DATA – 408h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
FAULT_AHAL_TRANSMITTER_ON – 502h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Cause . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 FAULT_ANTENNA_NOT_CONNECTED – 503h . . . . . . . . . . . . . . .
Write Tag Data (24h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235 GEN2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 Lock Tag (25h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237 Kill Tag (26h) . . . . . . . . . . . .
Mercury Embedded Modules Developer’s Guide
Introduction The ThingMagic® Mercury® embedded modules are RFID engines that you can integrate with other systems to create RFID-enabled products. Applications to control the M5e-Family of modules and derivative products can be written in the low level Serial Protocol Command Set and also using the high level MercuryAPI. The MercuryAPI supports Java and .NET environments starting with version 1.1 and C starting with version 1.5.
Product Line Overview Product Line Overview The embedded modules were designed to be incorporated into products requiring powerful RFID capabilities in a small form factor. The M5e is a small form-factor, low power, low cost Gen2 module. The M5e is ideal for embedding a powerful RFID module with read and write capabilities into a product or system. The M5e-Compact is a smaller version of the M5e. It has one MMCX connector for a monostatic antenna.
Hardware Overview Electrostatic Discharge • IEC-61000-4-2 discharge direct to operational antenna port tolerates max 300 Volt Pulse • MIL-883 3015.7 discharge direct to operational antenna port tolerates max 1200 Volt Pulse Note: Survival level varies with antenna return loss and antenna characteristics. See Appendix E: Environmental Considerations for methods to increase ESD tolerances. W A R N I N G ! The M5e antenna ports may be susceptible to damage from Electrostatic Discharge (ESD).
Hardware Overview RFID ASIC All base-band analog circuitry and PLL circuitry are contained within the Impinj Indy1000 RFID ASIC with ThingMagic front end for improved sensitivity. Connectors The M5e supports two MMCX connectors for bistatic or monostatic antennas. The M5eCompact supports one MMCX connector for a monostatic antenna.
Hardware Overview Hardware Revisions Table 2 lists the different Mercury Embedded hardware versions and their power output capabilities. Mercury Embedded Hardware Versions l Module Minimum Power Out Maximum Power Out Comments M5e 1 Watt 5 dBm 30 dBm Supports 1 Watt operation in NA and KR regions and less than 0.2 Watt operation in EU and PRC regions in typical applications. M5e EU 1 Watt 5 dBm 30 dBm Supports 1 Watt operation in EU region. M5e-Compact 0.2 Watt 10 dBm 23 dBm Supports 0.
SW Overview Pin-out of 12-pin Digital Communications Connector Pin # Signal 1 +5V 2 +5V 3 GND 4 GND 5 Digital Output 1 6 Digital Output 2 7 Digital Input 1 8 Digital Input 2 9 UART TTL RX from host 10 UART TTL TX to host 11 Mfg test purposes 12 Mfg test purposes SW Overview The software (SW) for the embedded products consists of two separate programs that coexist in flash memory: The boot loader, which is started at power on, is not field upgradable.
SW Overview Boot Loader The boot loader provides low-level functionality. This program provides a customer interface for upgrading the application firmware and storing data into flash. When a module is powered up or reset, the boot loader code is automatically copied from sector 0 of flash into the Microprocessor’s on-chip RAM, and executed.
SW Overview About the Reader Assistant An easy-to-use user interface (Reader Assistant) can be installed to simplify reader communication. This Reader Assistant can be used to demonstrate the embedded module or perform detailed evaluations of the product’s performance.
Functionality of the Embedded Modules This section highlights some of the functionality of the modules. The details for using the serial commands to control this functionality are found in Overview of the Communication Protocol. Regional Support The modules have differing levels of support for operation and use under the laws and guidelines of several regions. The regional support is shown in the following table.
Regional Support Supported Regions Region Regulatory Support M5e M5e-C M5e EU North America (NA) FCC 47 CFG Ch.
Regional Support Regions Supporting LBT - Default Settings Region LBT Enabled LBT Threshold EU Yes -96 dBm EU3 No n/a Open No -96 dBm Note The Open Region allows the module to be manually configured within the full capabilities supported by the hardware. No regulatory limits, including: frequency range, channel spacing and transmit power limits, are enforced. The Open Region should be used with caution. ! C A U T I O N ! ! The EU2 Region does not implement LBT.
Frequency Setting Frequency Setting The modules have a PLL synthesizer that sets the modulation frequency to the desired value. Whenever the frequency is changed, the module must first power off the modulation, change the frequency, and then turn on the modulation again. Since this can take several milliseconds, it is possible that tags are powered off during a frequency hop.
Frequency Setting Regional Frequency Quantization Region Frequency Quantization Minimum Frequency Maximum Frequency NA 250 kHz 902,000 kHz 928,000 kHz EU 100 kHz 865,100 kHz 867,900 kHz IN 100 kHz 865,200 kHz 866,800 kHz EU2 50 kHz 869,000 kHz 869,850 kHz EU3 100 kHz 865,600 kHz 867,600 kHz KR 25 kHz 910,000 kHz 914,000 kHz KR2 25kHz 917,300 kHz 920,300 kHz PRC 250 kHz 920,125 kHz 924,875 kHz AU 250kHz 920,750 kHz 925,250 kHz NZ 250 kHz 922,250 kHz 927,250 kHz Op
Frequency Setting Frequencies used in the order of entries in the table. If necessary for a region, the hop table can be randomized to create a pseudo-random sequence of frequencies to use. This is done automatically using the default hop tables provided for each region. EU3 Region By default the frequency hop table for the EU3 region will use four channels. In addition to the default configuration the EU3 region can also be used in a single channel mode.
RF Power Setting RF Power Setting The power setting is calibrated at the factory and parameters are stored in flash memory to ensure the power output is within +/– 1 dB of the desired setting. The power limits are set by both hardware limitations and enforced by the firmware. Power Units All power values are reported in centi-dBm. Therefore, a power setting of 2500 corresponds to 25 dBm. All power values in the serial interface are specified as unsigned 16-bit integers.
Antenna Ports The default, module-wide, setting is specified using Set Read TX Power (92h). This setting is used for all read operations on all ports, except: The power for individual logical antennas can be specified using Set Antenna’s Power and Settling Time. When a logical antennas power is set using that command it will override the module-wide setting for all read operations. TX Write Power The TX write power is used only during commands that change a tag’s state.
Antenna Ports Note The M5e-Compact has one antenna port and only supports monostatic operation. Monostatic Mode To set up the module to use a single antenna in monostatic mode, connect the antenna to port 1 (labeled J1 on Printed Circuit Board) which is responsible for both TX and RX communication. If possible, terminate the unused port to prevent damage to the reader if it is accidentally commanded to transmit through it.
Antenna Ports Output lines. In order to enable automatic multiplexer port switching the module must be configured to use Use GPIO as Antenna Switch in Set Reader Configuration(9Ah). Once the GPIO line usage has been enabled the following control line states are applied when the different Logical Antenna settings are used in Set Antenna Port (91h). Note The TX/RX Logical Antenna values are static labels indicating the available control line states.
Antenna Ports Note Just as under non-Multiplexing operation, Physical Module Port #1 must be used for transmitting and Port #2 for receiving when configured for bistatic operation.
Power Management Power Management The modules use different methods and levels of power management. Power Modes The M5e and M5e-Compact were designed for power efficiency and offer several different power management modes. The following lists the current modes being offered: Full Power Mode – In this mode, the unit operates at full power to attain the best performance possible. This mode is only intended for use in cases where power consumption is not an issue. This is the default Power Mode at startup.
Power Management Low Power Mode This mode minimizes power consumption and optimizes thermal characteristics without compromising performance in many, but not all, applications. Low power mode uses less DC power than High Performance mode at all RF transmit levels. It consumes up to 7.5W (6.5 typical) at a transmit level of +30dBm, decreasing to 3.5W at transmit levels of +20dBm and below.
Tag Buffer Power Mode per Duty Cycle and Ambient Temperature Transmit Duty Cycle (% transmitting) 50% 75% 100% Low Power Mode 60oC 60oC 60oC High Performance Mode 60oC 55oC 40oC Tag Buffer The Tag buffer stores tags, and their metadata, found using the Read Tag Multiple (22h) command. The size of the tag buffer for each module is defined in the following table: Tag Buffer Size M5e Tag Buffer Size in Tag ID entries 200 M5eCompact 200 Each tag entry consists of a fixed number of bytes.
Tag Buffer Tag Buffer Entry Total Entry Size 18 bytes (Max EPC Length = 96bits) 68 bytes (Max EPC Length = 496bits) Field Size Description EPC Length 2 bytes Indicates the actual EPC length of the tag read. Cannot exceed the Max EPC length setting. PC Word 2 bytes Contains the Protocol Control bits for the tag. EPC 12 bytes Contains the tag’s EPC value padded with trailing zeros if the size is less than the Max EPC Length size. Tag CRC 2 bytes The tag’s CRC.
Tag Buffer Tag Read Meta Data Meta Data Field Description Antenna ID The antenna on with the tag was read. If the same tag is read on more than one antenna there will be a tag buffer entry for each antenna on which the tag was read. When Using a Multiplexer, if appropriately configured, the Antenna ID entry will contain the logical antenna port of the tag read. Read Count The number of times the tag was read on [Antenna ID]. Protocol ID Protocol of tag. Only 0x05 (Gen2) is supported.
Tag Operations In First Out (FIFO) — the first Tag found by the reader is the first one to be read out. See Get Tag Buffer (29h). The Tag buffer is reset when the Clear Tag Buffer (2Ah) command is sent or when the protocol is set or changed using Set Current Tag Protocol (93h). This allows multiple Read Tag Multiple commands to be used to acquire one consistent tag buffer set.
Flash Memory Flash Memory Sector Mapping Code M5e/M5eCompact Start Addr M5e/M5eCompact Size (bytes) Sector Access BootLoader Read Only 0x01 0x000000 8 kB Application Read/Write 0x02 0x004000 224 kB User Memory Read/Write 0x03 0x03C000 16 kB Hardware Info Read Only 0x04 0x002000 8 kB Accessing the Flash The flash is accessed only through the boot loader program. Flash is not accessible while the application FW is running.
Flash Memory M4e Direct Flash Addressing This interface divides the flash into 11 different sectors of varying sizes. Only whole sectors of flash can be erased at a time. However, any amount of flash can be written provided that it is currently blank. This interface should no longer be used, Table 5 shows the memory map for the flash chip. Notice that only sector 9 is set aside for user data and the other sectors are used by the application FW.
Flash Memory Flash memory map Sector Word Address Size (kB) Erase Password Write Password Comments 0 0x200000 32 -- -- Boot loader area 1 0x208000 32 0x08959121 0x02254410 Application FW 2 0x210000 32 0x08959121 0x02254410 Application FW 3 0x218000 32 0x08959121 0x02254410 Application FW 4 0x220000 32 0x08959121 0x02254410 Application FW 5 0x228000 32 0x08959121 0x02254410 Application FW 6 0x230000 32 0x08959121 0x02254410 Application FW 7 0x238000 16 0x0
Serial Port Serial Port The modules communicate to a host processor via the TTL logic level UART serial port, accessed on the 12-pin digital connector for M5e/M5e-Compact. See M5e/M5e-Compact Digital Connectors. UART TTL Level TX V-Low: Max 0.4 VDC V-High: 2.9 to 3.3 VDC 8 mA max UART TTL Level RX V-Low: -0.3 to 0.8 VDC V-High: 2 to 5.5 VDC (Tied to 3.3 V through a pull-up resistor. Not harmful, but not recommended to drive the input above 3.3 V because then the input will be sourcing current to the 3.
General Purpose Inputs/Outputs (GPIO) M5e and M5e-Compact GPIOs The M5e has two 3.3/5V serial input sensor ports (GPIO inputs) and two output indicator ports (GPIO outputs) of up to 24 mA. The M5e-Compact has two 3.3/5V GPIO inputs and two GPIO outputs of up to 8 mA.
Default Settings Default Settings Since default settings may change across release and be different across platforms we recommend using the Get Application Commands to obtain default settings. None of the configurable settings in the application FW are saved in non-volatile memory. Thus the system will always boot up in the same default state, regardless of how it was previously configured.
Default Settings 52 Functionality of the Embedded Modules
Overview of the Communication Protocol The serial communication between a computer (host) and the reader is based on a synchronized command-response/master-slave mechanism. Whenever the host sends a message to the reader, it cannot send another message until after it receives a response. The reader never initiates a communication session; only the host initiates a communication session.
Host-to-Reader Communication The fields are summarized in the following table.: Field Length Description Header (Hdr) 1 byte Defines the start of the packet. Equal to 0xFF 1 1 byte Defines the length, N, of the data field contained in the packet. Command 1 byte Specifies the command that the reader is to execute. Data N bytes (0 to 250) Defines the binary data required by the reader for use with a command. This could, for example, represent transponder data to be written.
Reader-to-Host Communication Reader-to-Host Communication The following diagram defines the format of the generic Response Packet sent from the reader to the host. The Response Packet is different in format from the Request Packet. Command Status Word Header Data Length Hdr Len Cmd 1 byte 1 byte 1 byte Data CRC HI Status Word 2 bytes CRC-16 Checksum 0 to M bytes CRC LO 2 bytes The fields are summarized in the following table.
Reader-to-Host Communication 1.The minimum packet length is 7 bytes and the maximum packet length is 255 bytes. 2.Each host command receives a response from the reader. In the response packet, the Header, Data Length, Command, Data, and Checksum are functionally similar to the command packet. 3.The only difference is the addition of the Status Word field. The Status Word has two types of values. A Status Word value of 0 (Zero) means the command received was successful. Any other value represents a fault.
Reader-to-Host Communication An example implementation of CRC calculation, taken from the Arbser source CrcUtils.c, is shown here: /** @fn void CRC_calcCrc8(u16 *crcReg, u16 poly, u16 u8Data) * @ Standard CRC calculation on an 8-bit piece of data. To make it * CCITT-16, use poly=0x1021 and an initial crcReg=0xFFFF. * * Note: This function allows one to call it repeatedly to continue * calculating a CRC.
Format for Microprocessor Reply to Host Format for Microprocessor Reply to Host There are three different types of replies that the microprocessor can make to the host as follows: Acknowledge that the command was properly processed (ACK) Return a fault code Provide data that is requested by the host This section describes each of these three types. Unless otherwise specified, all commands return, as part of the Reply message, a status word with an ACK or a Fault.
Format for Microprocessor Reply to Host The following shows an example of an ACK message to an Erase Flash command. FF SOH 00 Length 07 00 OpCode 00 F4 Status 27 CRC The value in the OpCode field (0x07) is the same as the Erase Flash OpCode, 0x07. Microprocessor Fault Reply Message If a problem occurs during the execution of a command, the microprocessor returns a non-zero status value.
Format for Microprocessor Reply to Host Here is an example of a Reply message with Data Field Length not zero. This message happens to be a successful reply to Read Tag Single command.
Command Set The following list defines the OpCodes that are used in the embedded modules firmware. As these products grow, more OpCodes will be added to enhance the functionality of the product. The timeout for the commands are in milliseconds. The maximum value for any user-configurable timeout is 65,535msec (0xFFFF), unless otherwise noted.
Format for Microprocessor Reply to Host Format for Microprocessor Reply to Host There are three different types of replies that the microprocessor can make to the host as follows: Acknowledge that the command was properly processed (ACK) Return a fault code Provide data that is requested by the host This section describes each of these three types. Unless otherwise specified, all commands return, as part of the Reply message, a status word with an ACK or a Fault.
Format for Microprocessor Reply to Host The following shows an example of an ACK message to an Erase Flash command. FF SOH 00 Length 07 00 OpCode 00 F4 Status 27 CRC The value in the OpCode field (0x07) is the same as the Erase Flash OpCode, 0x07. Microprocessor Fault Reply Message If a problem occurs during the execution of a command, the microprocessor returns a non-zero status value.
Boot Loader Commands Here is an example of a Reply message with Data Field Length not zero. This message happens to be a successful reply to Read Tag Single command. FF 0A SOH Length 21 OpCode 00 00 C8 05 07 Status A8 00 Tag ID 84 C4 FF 9E E0 F7 Tag CRC 25 CRC Boot Loader Commands The BootLoader is automatically started upon power up, and allows access to the onboard flash memory along with other commands. The program exits only when the Boot Firmware command is received.
Boot Loader Commands The following table shows which commands are supported by the Boot loader, the application, and the modules.
Boot Loader Commands Read Flash (02h) The Read Flash command reads the contents of flash from the specified address. Since the length of the Microprocessor reply packet is limited to 248 bytes, reading the application firmware data requires multiple read commands. Note Length is defined as the number of 16-bit words, and the maximum value of length is 124 words.
Boot Loader Commands Get Boot Loader/Firmware Version (03h) The Get Boot Loader command returns the Boot Loader, Hardware, and Application version numbers. The Boot Loader, Hardware, and Application FW version numbers are stored in flash. The Boot Loader and Hardware version numbers are each 32-bit numbers. The application has a 96-bit version code. The command to retrieve firmware version is shown in the following table.
Boot Loader Commands Returned Hardware Version Table The following table provides a definition of each HW version returned by the Get Boot Loader/Firmware Version command. Returned HW Versions Module Defined Version HW_VERID_0_5W 0xFFFFFFFF 0.
Boot Loader Commands Boot Firmware (04h) The Boot Firmware command tells the boot loader to run the current firmware image stored in flash in the following sequence: 1. The boot loader verifies the checksum of the application image before it is run. 2. If the image is invalid, a fault code is returned to the host. 3. If the application firmware is started successfully, it sends the response to the Boot Firmware command.
Boot Loader Commands 4608001 0x00070800 9216001 0x000E1000 Note: 1 - 460800 and 921600 cannot be used in bootloader mode, only application mode. ! C A U T I O N ! ! When using the 921600 baud rate you must pass an extra byte of data (0x00) at the end of each message, after the CRC. This is due to a timing issue. If the extra byte is not passed the message will not be processed until the another byte of data is received. In the following example, the baud rate is specified as a 32-bit value.
Boot Loader Commands checks. A failed CRC means that the application cannot run, and needs to be downloaded again. FF SOH 00 Length 08 1D OpCode 07 CRC The boot loader runs this command automatically before loading the application. If the CRC check fails, the boot loader does not run the application to prevent corrupted code from executing on the Microprocessor.
Boot Loader Commands Get Current Program (0Ch) The Get Current Program command returns a code for the current program being executed in the module.
Boot Loader Commands Error Status Codes FAULT_MSG_WRONG_NUMBER_OF_DATA – 100h FAULT_FLASH_ILLEGAL_SECTOR – 303h FAULT_FLASH_BAD_WRITE_PASSWORD – 301h Get Sector Size (0Eh) The size of a flash sector can be retrieved from the module using the Get Sector Size command. Since different products may have different flash sector sizes, this command is useful for ensuring that the module has enough memory to store the desired data.
Boot Loader Commands Error Status Codes FAULT_MSG_WRONG_NUMBER_OF_DATA – 100h FAULT_FLASH_ILLEGAL_SECTOR – 303h FAULT_FLASH_BAD_ERASE_PASSWORD – 300h 74 Command Set
Application Tag Commands Application Tag Commands The application commands are used to interact with RFID tags in the field. These commands can have slightly different behavior based upon the current protocol selected in the system.
Application Tag Commands parameters as defined by the EPCGlobal Gen2 v1.2 Specification. The current user controlled options are: Gen2 Session (User Controlled) This setting determines which tag inventory flag is altered when a tag responds to a Gen2 Query (each flag has a unique persistence profile, as defined by the Gen2 Specification). The value of Gen2 Session and Gen2 Target is set using the Set Protocol Configuration (9Bh) command.
Application Tag Commands Gen2 Target (User Controlled) This setting determines which inventory flag or SL flag is going to have its state determined by the matching algorithm. Currently always set to ‘4’, indicating the Gen2 Select command modifies a tag’s SL flag.
Application Tag Commands – The SL flag must be asserted – The Session flag (Target setting) for session 0, 1, 2, or 3 (specific Session value is in the Query and depends on the reader’s Session setting) must be in the user defined state (the default value is ‘A’). 3. Matching tags will respond to the Query, but after responding, will change their own state in the following way: – The Inventory flag corresponding to the Session specified in the Query will be changed to the opposite state (A->B or B->A).
Application Tag Commands Session 1 Keeps its state between 0.5 and 5 seconds, regardless of whether the tag is energized or not. The intent is that when the session is set to 1 the tag will respond to an appropriate Query immediately, and then respond periodically if the Query is repeated by the reader. This allows a larger population of tags to be reliable read.
Application Tag Commands Release Version 1.0.34. The command information in this section has been updated to only include the new format. The following fields have been added to all the specified commands. Please check each command for exact order, and any exceptions, as they may not all correspond with the order below. Tag Singulation Fields Values Field Select Options 0x00 Select functionality is disabled. First tag found will be the tag operated on.
Application Tag Commands Field Values Description The Select Options field is typically followed by command specific fields. After the command specific fields the following Tag Singulation fields should be specified as appropriate for the Select Contents specified. Select Address 4 bytes Contains the offset, in bits, within the memory bank, specified by the Option value, at which the comparison is to start.
Application Tag Commands Gen2 Memory Map When performing a Tag Singulation/Select most of the criteria specifies values of data in certain locations in a Gen2 tag’s memory map. The following is a logical view of the Gen2 memory map from the Generation2 Protocol v1.2 that can be used for reference when trying to determine the memory address you are trying to match on: Gen2 Tag Memory Map Note The address values specified in the memory map are hexidecimal, zerobased bit offset within each memory bank (i.e.
Application Tag Commands Read Tag Single (21h) For deprecated version (including non-Gen2 protocol specific syntax) of this command see Appendix D: Read Tag Single (21h) The Read Tag Single command will search for a tag for the specified timeout or a single tag is found, whichever comes first. The search criteria is specified using the Tag Singulation Fields.
Application Tag Commands FF 0A 21 03 E8 03 SOH Length OpCode Timeout (ms) Option 00 00 00 Select Address 20 10 12 Select Data Length 34 E5 Select Data AC CRC If Option=0x00 or 0x01 were used then the unused Tag Singulation Fields must be removed from the request. The response to this command varies depending upon the number of bits in the tag EPC of the tag found.
Application Tag Commands Read Tag Single Get EPC and Metadata Request Fields Field Option Value Description Bit 4=0 (0x0X) No Metadata flags are specified and Meta Data will not be returned. This is the Get Tag EPC syntax. The lower bits (X) are specified as defined by Tag Singulation/Select Functionality. Bit 4=1 (0x1X) Indicates that Metadata flags are to follow and the corresponding Metadata shall be returned with the tag EPC.
Application Tag Commands Read Tag Single Get EPC and Metadata Response Fields Field Length Value SOH 1 byte 0xFF Length 1 byte Based on data returned OpCode 1 byte 0x21 Status 2 bytes Status of command Options 1 byte As sent in request Metadata Flags 2 bytes Metadata contained in response Read Count1 1 byte Tag EPC/Antenna Read Count RSSI1 1 byte Return Signal Strength Indicator Antenna ID1 1 byte Antenna ID, 4 MSBs for TX and 4 LSBs for RX Frequency1 3 bytes Frequency in kH
Application Tag Commands Metadata Flags = 0x0004 OR 0x0010 = 0x0014 with no tag singulation criteria, just return the first tag found, is as follows: FF 05 21 01 SOH Length OpCode E8 10 Timeout 00 Options 14 2F Metadata Flags 6D CRC Here is an example response to the example request specified above.
Application Tag Commands updating the Option field to set the appropriate flag for the tag singulation based on EPC value FF 12 21 SOH Length OpCode 60 11 01 11 E8 11 Timeout 22 22 00 Options 33 Select Data Length 33 44 14 Metadata Flags 44 55 55 66 C E 9F 66 Select Data (EPC) CRC The response contains the requested metadata and the tag EPC matching the requested tag EPC: 22 Ant ID FF 16 21 SO H Length OpCod e 0F C8 CD B7 00 00 Status 11 11 00 Options 11
Application Tag Commands Read Tag Multiple (22h) For deprecated version of this command see Appendix D: Read Tag ID Multiple (22h) The Read Tag Multiple command supports several different levels of functionality. In addition to performing a Basic Search Operation for all tags in the field it can also perform advanced searching and perform operations on the tags found. The different syntax for Read Tag Multiple are defined as follows: Basic Tag Inventory - Searches for and returns all tags in the field.
Application Tag Commands Read Tag Multiple Search Flags 2 Flag Value Antenna Usage (bits 0, 1, 2) 0x0000 Use single antenna as configured by the most recent Set Antenna command. 1 0x0001 Automatically search on both monostatic antennas, starting with Antenna 1. The search cycles through antennas moving to the next antenna when no more tags are found on the current antenna. It stops when the search timeout expires. 10x0002 Automatically search on both monostatic antennas, starting with Antenna 2.
Application Tag Commands Examples For example, the syntax for a Read Tag Multiple with automatic multi-antenna search starting with antenna1 is: FF 04 22 00 01 03 E8 SOH Length OpCode Antennas Flag Timeout (ms) 3F 8E CRC The response format for both is the following: FF 01 22 00 SOH Length OpCode 00 Status 02 # Tag IDs Found 46 BA CRC Tag Inventory with Select If you want to inventory only tags meeting a specific criteria this syntax should be used.
Application Tag Commands Examples Here is an example request and response showing the use of Tag Singulation/Select Functionality to inventory tags which meet a specific criteria: This command will inventory all tags with an EPC value ending in 0x66, which requires adding the appropriate Tag Singulation Fields to the Basic Tag Inventory syntax FF 0F 22 04 SOH Length OpCode Options (EPC Mem) 00 00 00 Access Password 00 00 00 00 03 Search Flags 00 00 Timeout 78 Select Address (bits) E8
Application Tag Commands Read Tag Multiple Embedded Command Fields Field Value Description Select Options [1 byte] The Options value of the Tag Singulation Fields Search Flags [2 bytes] Bit 3 of the Read Tag Multiple Search Flags must be set indicating this request contains embedded command(s). Timeout [2 bytes] Indicates how long the command should spend searching AND performing the embedded command.
Application Tag Commands Read Tag Multiple Embedded Response Fields Field Value Description Status [2 bytes] Error Code if command failed, otherwise 0x0000 for Success Select Options [1 byte] Options set in the Request Command Search Flags [2 bytes] Search Flags set in the Request Command Tags Found [1 byte] Number of tags found and added to the Tag Buffer matching Select criteria. Follows the standard criteria of adding tags the Tag Buffer.
Application Tag Commands Write Tag Data (24h) to write 0x12345678 into the Reserved Memory Bank starting at Word address 0x00000002 (Access Password) FF 1E 22 04 00 SOH Length OpCode Options (EPC Mem) 01 0C 24 Embd Cmd Count Embd Cmd Lengt h Embd Cmd OpCod e 04 Search Flags 00 03 00 Timeout 00 Embd Cmd Timeout (Not Used) E8 00 00 00 Access Password 00 00 Embd Cmd Options (Must be 0x00) 00 00 00 00 00 78 Select Data Address (bits) 02 Write Address (Words) 00 12 Writ
Application Tag Commands Example with Embedded Read Tag Data When using Read Tag Multiple with an embedded Read Tag Data command an extra field containing the requested Data from the first tag which responded matching the Select criteria is added to the response. Up to 4 bytes of tag data for the other tags responding, if any, is available as Tag Read Meta Data.
Application Tag Commands Example with Embedded Kill Tag This command will inventory all tags with an EPC value with the first 88bits equal to 0x30940425C4C1967400004E, which requires adding the appropriate Tag Singulation Fields to the Basic Tag Inventory syntax then will use Kill Tag (26h) to kill all matching tags, assuming they have their Kill password set to 0x12345678: FF 20 22 01 00 SOH Length OpCode Options (EPC Mem) 04 Search Flags 01 08 26 Embd Cmd Count Embd Cmd Lengt h Embd Cmd O
Application Tag Commands Error Status Codes FAULT_MSG_WRONG_NUMBER_OF_DATA – 100h FAULT_MSG_INVALID_PARAMETER_VALUE - 105h FAULT_NO_PROTOCOL_DEFINED – 401h FAULT_AFE_NOT_ON – 405h FAULT_NO_TAGS_FOUND – 400h FAULT_TAG_ID_BUFFER_FULL – 601h FAULT_ANTENNA_NOT_CONNECTED – 503h FAULT_TEMPERATURE_EXCEED_LIMITS – 504h FAULT_HIGH_RETURN_LOSS – 505h Write Tag EPC (23h) The Write Tag EPC command should be used when updating the EPC value of a tag.
Application Tag Commands Write Tag EPC Command Fields Field Value Description Length [1 byte] Number of bytes in the command following the OpCode. OpCode 0x23 Write Tag EPC Time Out [2 bytes] Command timeout in milliseconds. Select Options [1 byte] The Options value of the Tag Singulation Fields Access Password [4 bytes] The Access Password of the tags expected to be inventoried for the embedded command, if they are locked. If the tags are not locked specify 0x00000000.
Application Tag Commands Error Status Codes FAULT_MSG_WRONG_NUMBER_OF_DATA – 100h FAULT_MSG_INVALID_PARAMETER_VALUE - 105h FAULT_NO_PROTOCOL_DEFINED – 401h FAULT_AFE_NOT_ON – 405h FAULT_NO_TAGS_FOUND – 400h FAULT_ANTENNA_NOT_CONNECTED – 503h FAULT_TEMPERATURE_EXCEED_LIMITS – 504h FAULT_HIGH_RETURN_LOSS – 505h Write Tag Data (24h) For the deprecated version of this command see Appendix D: Write Tag Data (24h).
Application Tag Commands Write Tag Data Fields Field Value Description Write Address 4 bytes The Address field is the offset in the specified Memory Bank, in 16-bit words, where the contents of the Data field is written. It corresponds to the WordPtr argument in the Gen2 specification. Note: Addresses are always zero-based. Specifying 0x00 indicates starting at the first address location. Write MemBank 1 byte The MemBank field specifies which of the tag’s memory banks the data is to be written to.
Application Tag Commands Examples The following example will attempt to write to Reserved Memory to set the Kill password=0x11112222. It will write this data to a tag matching the following criteria for a max timeout of 1000 ms. Memory Bank = User Memory.
Application Tag Commands 01 23 45 67 89 AB DC EF 01 23 45 67 11 11 22 Select Data 22 00 00 00 00 81 Write Data E7 CRC Note: Try reading back the value written in this example with the Read Tag Data Examples showing reading from the same tag.
Application Tag Commands Lock Tag Fields Field Value Description AccessPwd 4 byes The Access Password for the tag. Mask Bits1 2 bytes The Mask bits specify which fields should be modified according to the Actions bits. When a Mask Bit =0 the corresponding Action bit is not applied and the current lock setting is retained. When a Mask Bit =1 the corresponding Action bit is applied and the new lock setting is implemented.
Application Tag Commands 0x0000 in the Action field unlocks all the memory banks as long as all memory banks exist and are lockable.
Application Tag Commands Examples The following example shows an attempt to kill a tag whose EPC ID=0x112233445566778899AA and whose Kill password=0x11112222: FF 13 26 SOH Length OpCode 03 E8 Timeout (ms) 01 11 Option 11 22 22 Kill Password 00 50 RFU Select Data Length 11 22 33 44 55 66 77 88 99 AA Select EPC ID DD CRC Note If the tag’s kill password is set to 0, the protocol does not allow the tag to be killed.
Application Tag Commands Read Tag Data (28h) For the deprecated version of this command see Appendix D: Read Tag Data (28h). The Read Tag Data command reads the specified memory bank at data address location within that memory bank of a tag. The tag which will be read can be specified using the Tag Singulation Fields or, if Option=0x00 of the Tag Singulation Fields is specified, it will attempt to read from the first tag it finds.
Application Tag Commands Get Tag Data Examples The following example will attempt to read the Kill Password (the first 2 words) from Reserved Memory. It will read this data from a tag matching the following criteria for a max timeout of 1000 ms. Memory Bank = User Memory.
Application Tag Commands timeout of 1000 ms. Note the Options field, no metadata is requested unlike the previous example. EPC ID = 0x0123456789ABCDEF01234567.
Application Tag Commands Read Tag Data Get Data and Metadata Request Fields Field Value Option Description Bit 4=0 (0x0X) No Metadata flags are specified and Meta Data will not be returned. This is the Get Tag Data syntax. The lower bits (X) are specified as defined by Tag Singulation/Select Functionality. Bit 4=1 (0x1X) Indicates that Metadata flags are to follow and the corresponding Metadata shall be returned with the tag data.
Application Tag Commands Field Status Length 2 bytes Value 0x0000 for success.
Application Tag Commands Examples The following example will attempt to read the Access Password (the first 2 words) from Reserved Memory. It will read this data from a tag matching the following criteria for a max timeout of 1000 ms. Memory Bank = EPC.
Application Tag Commands FAULT_GEN2 PROTOCOL_MEMORY_LOCKED - 424h FAULT_ANTENNA_NOT_CONNECTED – 503h FAULT_TEMPERATURE_EXCEED_LIMITS – 504h FAULT_HIGH_RETURN_LOSS – 505h Get Tag Buffer (29h) After a Read Tag Multiple command is executed, the found tags are stored in an internal Tag Buffer. The Get Tag Buffer command can perform several different operations depending on the syntax used. These operations are: Get tags remaining in the tag buffer Get tag EPCs Get tag EPCs and their Tag Read Meta Data.
Application Tag Commands Get Tag EPCs When you want to get the tag EPCs out of the buffer and don’t care about the tag read metadata, the options available with this syntax maybe useful. This syntax reads out the requested number of tags from the buffer. A maximum of 13 tags are read at a time, less if Max EPC Length is set to 496 bits. Multiple Get Tag Buffer commands may be required to obtain the complete results from a single Read Tag Multiple command.
Application Tag Commands A 64-bit tag has the length set to 0x60 (16-bit PC + 64-bit tag EPC + 16-bit tag CRC), but only the first 12 bytes of the tag record is filled in, the trailing bytes, after the CRC are padded with zeros. An 96-bit GEN2 tag, the length is 0x80 (16-bit PC (Protocol Control) word + 96-bit tag EPC + 16-bit tag EPC CRC). In the response below, two tag EPCs are returned. Tag #1 is a 96-bit EPC tag and tag #2 is a 64-bit EPC tag.
Application Tag Commands In the event of a communication error the last Get EPC and Metadata request can be repeated. When data is requested using this syntax the response will contain as many tags as can be fit in the response packet. The response will indicate how many tags were returned and should be processed accordingly.
Application Tag Commands Metadata Flags = 0x0001 OR 0x0004 OR 0x0010 = 0x0015 is as follows: FF 03 29 SOH Length OpCode 00 15 Metadata Flags 00 97 Read Options 55 CRC A response contains the following information: Get EPC and Metadata Response Fields Field Length Value SOH 1 byte 0xFF Length 1 byte Based on data returned OpCode 1 byte 0x29 Status 2 bytes 0x0000 for success.
Application Tag Commands Field Length Value Tag Data Length1 2 byte Length, in bits, of the tag data read for this tag. This value indicates how many bytes (ceiling[bits/8]), up to 32, will follow. Example: if the value is 0x1D (29) then 4 bytes will follow: 29/4 = 3.625 -- ceiling(3.625) = 4.
Application Tag Commands 1A B8 CRC Error Status Codes FAULT_MSG_WRONG_NUMBER_OF_DATA – 100h FAULT_MSG_INVALID_PARAMETER_VALUE - 105h FAULT_TAG_ID_BUFFER_NOT_ENOUGH_TAGS_AVAILABLE – 600h FAULT_TAG_ID_BUFFER_NUM_TAG_TOO_LARGE – 603h Clear Tag Buffer (2Ah) The Clear Tag Buffer command resets the tag buffer. This clears the buffer of any current tags and reset the read index to 0. A Read Tag Multiple command must be issued to load new tags into the buffer.
Application Tag Commands NXP G2X* Silicon (Chip Type=0x02) NXP G2i* Silicon (Chip Type=0x07) Impinj Monza 4 Silicon (Chip Type=0x08) IDS SL900A (Chip Type=0x0A) Hitachi Hibiki (Chip Type=0x06) [Deprecated] Note Most of the Gen2 Tag Specific commands can be used as an embedded operation in Tag Inventory With Embedded Operations commands. The exceptions are noted in the specific Chip Type command definitions. Note The syntax for the Gen2 Tag Specific commands changed in M5e firmware v1.5.
Application Tag Commands Partial Load Image Sub Command=0x01 If the first bit of Sub Command is 1 (Sub Command=0x01), the Gen2 Tag Specific command writes an EPC with a length of up to 96-bits, plus the Kill and Access passwords without locking in a single command.
Application Tag Commands Default Values X X X X X X X X X X Lock Values X X X X X X X X X X 5 4 3 2 1 0 APW Lock APW P-lock KPW Lock KPW P-lock EPC Lock 0 0 0 0 0 0 1 1 1 1 1 1 EPC Plock Currently, only the first six bits of this field are used. A value of zero in each bit field keeps the corresponding memory segment unlocked.
Application Tag Commands Password 0x01234567, the Access Password 0x89ABCDEF into the tag without changing the NSI bits of the tag and locks the EPC memBank. However, to access and write the NSI bits into the tag, set the third bit of the option field to 1 (option=0x07). In the example, if option is set to 0x07, the NSI bits are overwritten by zeros.
Application Tag Commands Alien Higgs3 Command Sub Command value 0x0009 BlockReadLock FastLoadImage Sub Command=0x0001 This command writes all of the following data to the Higgs3 tags in a single command, thereby reducing the tag programming time compared to the use of LoadImage or multiple Write Tag Data (24h) commands. Access Passwords Kill Password EPC Data (96 bits only) ! C A U T I O N ! ! The FastLoadImage command automatically erases the content of all User Memory.
Application Tag Commands FastLoadImage Command Fields Field Value Description Length 0x1E Number of bytes in the command following the OpCode. OpCode 0x2D Gen2 Tag Specific Command. Time Out [2 bytes] Command timeout in milliseconds. Chip Type 0x05 Alien Higgs3.
Application Tag Commands format of the response is: FF 09 2D 00 SOH Length OpCode 00 Status 05 44 00 01 XX XX ...
Application Tag Commands LoadImage Command Fields Field Value Description Length 0x5E Number of bytes in the command following the OpCode. OpCode 0x2D Gen2 Tag Specific Command. Time Out [2 bytes] Command timeout in milliseconds. Chip Type 0x05 Alien Higgs3.
Application Tag Commands The response to the LoadImage command is an ACK with the written EPC data. The format of the response is: FF XX 2D 00 SOH Length OpCode 00 Status 05 44 00 03 XX XX ...
Application Tag Commands BlockReadLock Command Fields Field Value Description Length 0x09 Number of bytes in the command following the OpCode. OpCode 0x2D Gen2 Tag Specific Command. Time Out [2 bytes] Command timeout in milliseconds. Chip Type 0x05 Alien Higgs3.
Application Tag Commands 11 11 22 22 Current Access Pwd XX ?? ?? Lock Bits CRC The response to the BlockReadLock command is an ACK.
Application Tag Commands NXP Sub Commands Sub Command value NXP Command 0x0001 Set ReadProtect 0x0002 Reset ReadProtect 0x0003 Change EAS 0x0004 EAS Alarm 0x0005 Calibrate All NXP-proprietary commands contain the following fields: Command Set 131
Application Tag Commands NXP Common Fields Field Value Length [1 byte] OpCode 0x2D Timeout [2 bytes] Notes Ignored when used as an embedded command for Tag Inventory With Embedded Operations Chip Type [1 byte] • 0x02 - NXP G2X* • 0x07 - NXP G2i* Tag Singulation Fields [1 byte] | Select Option • bit 6 (x1xx xxxx | 0x40) must be set, indicating a 2-byte sub command follows this byte, and before the remaining Tag Singulation Fields Sub Command [2 bytes] NXP Sub Commands Tag Singulation Fie
Application Tag Commands “Reset ReadProtect” is received.
Application Tag Commands Note Only the G2i command can be performed as an embedded operation in a Read Tag Multiple. The G2x version cannot.
Application Tag Commands Change EAS (1 byte: 0x01=Set EAS; 0x02=Reset EAS) It is invoked with the following command: FF 11 2D SOH Length OpCode 03 E8 Timeout (ms) 02 44 00 03 Chip Type Option Sub Cmd 00 00 00 78 Select Data Address 08 34 Select Length Selct Data 11 22 33 44 Access Password 01 ?? EAS CRC The response to the ChangeEAS command is a simple ACK with standard status: FF 04 2D SOH Length OpCode 00 00 Status 02 44 00 03 Chip Type Option Sub Cmd ?? ?
Application Tag Commands TrExt as Per Gen2 (1 byte: Current fixed to 0x01, M5e and M5e-C only support extended Pilot Tone) It is invoked with the following command, it does not support tag singulation: FF 09 2D SOH Length OpCode 03 E8 Timeout (ms) 02 4o 00 04 Chip Type Option Sub Cmd 01 DR 02 M 01 ?? TrExt ?? CRC The response to the EAS Alarm command contains 8 bytes of EAS Alarm Data, only if Status=0x0000.
Application Tag Commands Calibrate The NXP command Calibrate causes the tag to return a random data pattern that is useful in some frequency spectrum measurements. Calibrate can only be sent when the tag is in the Secured state, when the access password is non-zero. This command uses only the common fields and is invoked with the following command.
Application Tag Commands ChangeConfig The ChangeConfig command is used to toggle the bits of the G2i* tag’s ConfigWord (see ConfigWord to Command Bit Address Map table). Specify a ‘1’ in the desired bit location of the Config Data word of the command in order to toggle that bit. Note Different version of the G2i* tags support different features. See tag data sheet for specific bits supported. The ChangeConfig command can ONLY be sent in the Secured state, i.e. requires a nonzero password.
Application Tag Commands Config Data Bit Address (LSB=bit 0) G2i* ConfigWord Bit Address (Hex) Toggle Bit Description 2 0x20D Read Protect EPC Bank (permanently stored in tag memory) 1 0x20E Read Protect TID (permanently stored in tag memory) 0 0x20F PSF Alarm Flag (permanently stored in tag memory) Command Set 139
Application Tag Commands NXP G2i* Command Fields Field Value Notes Length [1 byte] OpCode 0x2D Timeout [2 bytes] Ignored when used as an embedded command for Tag Inventory With Embedded Operations Chip Type 0x07 0x07 - NXP G2i* Tag Singulation Fields [1 byte] • bit 6 (x1xx xxxx | 0x40) must be set, indicating a 2-byte sub command follows this byte, and before the remaining Tag | Select Option Singulation Fields Sub Command [2 bytes] Access Password [4 bytes] Must be non-zero for Change
Application Tag Commands response is: FF 09 2D SOH Length OpCode 00 00 Status 07 44 00 07 00 00 Chip Type Option Sub Cmd New ConfigWord Value ?? ?? CRC ChangeConfig embedded in a Read Tag Multiple takes the following form: FF 19 22 04 SOH Length OpCode Options (EPC Mem) 00 04 Search Flags 01 09 2D Embd Cmd Count Embd Cmd Length Embd Cmd OpCode 00 03 E8 Timeout 11 22 33 44 Access Password 00 07 Embd Cmd Timeout (Not Used) Chip Type 40 Option 00 00 00 00
Application Tag Commands Impinj Monza 4QT Command Fields Field Value Length [1 byte] OpCode 0x2D Timeout [2 bytes] Notes Ignored when used as an embedded command for Tag Inventory With Embedded Operations Chip Type 0x08 0x08 - Impinj Monza 4QT Tag Singulation Fields [1 byte] bit 6 (x1xx xxxx | 0x40) must be set, indicating a 2-byte sub command follows this byte, and before the remaining Tag | Select Option Singulation Fields Sub Command 0x0000 • 0x0000 - QT Read/Write Access Password [
Application Tag Commands An example QT Read/Write single tag command is:. FF 09 2D SOH Length OpCode 03 E8 Timeout (ms) 08 40 00 00 00 00 Chip Type Option Sub Cmd Control Byte 00 ?? Payload ?? CRC The response to the QT Read/Write command contains the payload read or written as specified by the control byte’s Read/Write bit.
Application Tag Commands Error Status Codes FAULT_MSG_WRONG_NUMBER_OF_DATA – 100h FAULT_MSG_INVALID_PARAMETER_VALUE - 105h FAULT_NO_PROTOCOL_DEFINED – 401h FAULT_AFE_NOT_ON – 405h FAULT_NO_TAGS_FOUND – 400h FAULT_PROTOCOL_INVALID_ADDRESS – 409h FAULT_GENERAL_TAG_ERROR – 40Ah FAULT_GEN2 PROTOCOL_OTHER_ERROR - 420h FAULT_ANTENNA_NOT_CONNECTED – 503h FAULT_TEMPERATURE_EXCEED_LIMITS – 504h FAULT_HIGH_RETURN_LOSS – 505h BlockWrite (2Dh) BlockWrite is a Gen2 2.0 Optional command.
Application Tag Commands BlockWrite Command Fields Field Value Notes Length [1 byte] Number of bytes in the command following the OpCode. OpCode 0x2D BlockWrite Timeout [2 bytes] Ignored when used as an embedded command for Tag Inven- tory With Embedded Operations Chip Type 0x00 Standard Gen2 2.
Application Tag Commands 00 00 00 01 00 00 Write Flag Mem Bank Word Pointer Word Count ?? Data ?? CRC The response to the BlockWrite command is an ACK.
Application Tag Commands Field Value BlockPermaLock Command Fields Description Length [1 byte] Number of bytes in the command following the OpCode. OpCode 0x2E Gen2 Optional Command. Time Out [2 bytes] Command timeout in milliseconds. Chip Type 0x00 Gen2 2.
Application Tag Commands An example BlockPermaLock single tag command, locking Block 5, is:.
Application Tag Commands BlockErase (2Eh) BlockErase is a Gen2 2.0 Optional command. On tags which support this command, it allows multiple words in any memory bank to be erased in a single operation.
Application Tag Commands Field BlockWrite Command Fields Description Value Length [1 byte] Number of bytes in the command following the OpCode. OpCode 0x2E Gen2 Optional Command. Time Out [2 bytes] Command timeout in milliseconds. Chip Type 0x00 Gen2 2.
Application Tag Commands The same BlockErases embedded in a Read Tag Multiple takes the following form: FF 21 22 02 SOH Length OpCode Options (TID Mem) 00 04 03 Search Flags E8 11 Timeout 01 0F 2E Embd Cmd Count Embd Cmd Length Embd Cmd OpCode 00 00 22 33 44 00 Access Password 00 00 00 Embd Cmd Timeout (Not Used) Chip Type 00 02 Address 00 00 00 Select Data Address (bits) 40 01 Mem Bank Word Count E2 Select Data Length (bits) Select Data 00 Option 01 08 ??
Set Application Commands Set Application Commands The Set commands are used to set configurable values in the firmware. Since the values are not stored in flash, these values are reset to the default values whenever the application firmware is restarted. The application responds with a fault code / ACK to all commands.
Set Application Commands Set Antenna Port (91h) The Set Antenna Port command supports multiple options (Option=0x01 is not supported) each setting the different aspects of the modules antenna configuration. Please read all the details of various options for setting antenna configuration parameters before using the command.
Set Application Commands Set Multi-Antenna Search Configuration Option = 0x02 allows the order antennas will be used during a multi-antenna search with Read Tag Multiple (22h) to be specified. The multi-antenna search allows mixing of monostatic and bistatic configurations and ports can be duplicated in the search list if it is desirable to return to some antennas more often than others.
Set Application Commands ! C A U T I O N ! ! When the TX power for a logical antenna is defined using this command the power setting specified for each port specified will be used for all operations, overriding the default, module wide, value set in Set Read TX Power (92h) and Set Write TX Power (94h). If a logical antenna’s power is not set with this command then it will use the module-wide value set in those commands.
Set Application Commands Set Read TX Power (92h) The Set Read TX Power command sets the default, module-wide, power level to be used for reading tags. The power is specified as a 16-bit value in centi-dBm. For instance, a power of 25 dBm is 2500 centi-dBm, which is 0x09C4. FF 02 92 SOH Length OpCode 09 C4 Power in centi-dBm 48 9D CRC Note Power settings for individual logical antenna ports specified in Set Antenna’s Power and Settling Time override the value set here.
Set Application Commands Set Current Tag Protocol (93h) To select a protocol, send the Set Current Tag Protocol code to the reader. A table of valid protocol codes is found in Get Current Tag Protocol (63h). The following example sets the protocol to GEN2: FF 02 93 SOH Length OpCode 00 05 Current Protocol 51 7D CRC Only protocols that are enabled in the reader are available.
Set Application Commands Set Frequency Hop Table (95h) The Set Frequency Hop Table command sets the list of frequencies and, optionally, the Regulatory hop time, to use when hopping. Each frequency is encoded as a 32-bit value in kHz. For instance, 915MHz is encoded as 915000kHz, which is 0x000DF638. The maximum number of hop frequencies is 62, since that is the maximum number of 32-bit values that can be sent using a message packet.
Set Application Commands Set Regulatory Hop Time Command Fields (Option = 0x01) Field Value Description Length 0x05 Number of bytes after OpCode OpCode 0x95 Set Frequency Hop Table Option 0x01 Indicates the Regulatory Hop Time will be passed. Regulatory Hop Time [4 bytes] The time between frequency hops, in milli-seconds, to be used for the defined hop table. Note: The max hop time is restricted by regulatory limits based on the region set via Set Current Region (97h).
Set Application Commands This example sets the GPIO Output #1 to ‘1’ (high). To get the current status of the GPIO output pins, send the same command, with the length set to 0: FF 00 96 1D SOH Length OpCode 99 CRC The response looks similar to the Get User GPIO Inputs command: FF 02 96 00 SOH Length OpCode 00 Status 00 01 29 Output #1 Output #2 E0 CRC Set Current Region (97h) The Set Current Region command sets the current region for use in the reader.
Set Application Commands Note When LBT is disabled in the Open region the M5e/M5e-Compact will implement frequency hopping as implemented for the NA region with a frequency hop interval of 400ms. Set Power Mode (98h) The Set Power Mode command can set the M5e to four different power management modes. See Available power modes.
Set Application Commands Note Setting the parameters using Set User Mode will override the values set by a previous call to Set Protocol Configuration (9Bh). Note For details on the behavior of the Gen2 parameter settings see the EPCGlobal Gen2 RFID Air Interface Specification v1.2.0 or later. Set Reader Configuration(9Ah) The Set Reader Configuration command is used to set several configuration options on the reader.
Set Application Commands Available Configuration Options Option 0x00 Key Value Reader Configuration setting Indicates the deprecated format of this command will be used: Appendix D: Set Reader Configura- tion(9Ah) Command Set 163
Set Application Commands 0x01 0x00 Antenna port is a unique characteristic of a Tag Buffer Entry (Default) 0x01 Antenna port is ignored for Tag Buffer Entries.
Set Application Commands Send the following to enable the Low power transmit mode: FF 03 9A 01 01 01 SOH Length OpCode Option Key Value AE 5C CRC Note Multiple settings cannot be applied in a single command. Set Protocol Configuration (9Bh) The Set Protocol Configuration command is used to set protocol-specific configuration parameters.
Set Application Commands which can be set and the supported settings. Additional parameters will be supported in the future. Protocol Value 0x05 (Gen2) Parameter Gen2 Session used for Inventory commands. = 0x00 Option N/A Value 0x00 - Session = S0 - (Default) 0x01 - Session = S1 0x02 - Session = S2 0x03 - Session = S3 Gen2 Target used for Inventory commands.
Set Application Commands Note Setting the parameters using Set Protocol Configuration will override the implicit value set by a previous call to Set User Mode. Likewise, a subsequent call to Set User Mode will override the parameters set by Set Protocol Configuration. Get Protocol Configuration will always return the current setting regardless of whether it was set by Set Protocol Configuration or Set User Mode.
Set Application Commands Note For details on the behavior of the Gen2 parameter settings see the EPCGlobal Gen2 RFID Air Interface Specification v1.2.0 or later.
Get Application Commands Get Application Commands The Get commands listed in the following table are used to get settable parameters from the Mercury Embedded module. All of the commands have a data length of zero, and return data or a fault code.
Get Application Commands Get Hardware Version (10h) The Get Hardware Version command is used to get information about the module it is executed on. Most of the information is not currently user-relevant but will often be required by ThingMagic Support to help diagnose problems. Get Hardware Version Fields Field Value Description Option 0x00 Currently the only supported value. 1 0x00 When no flags are set all data will be returned.
Get Application Commands Non-Multiplexer Options For backward compatibility the following syntax(Option=0x00 and 0x01) is supported when using only the physical module ports directly. For new development the Logical Antenna Options syntax should be used. The format of the command is: FF 01 61 00 SOH Length OpCode Option BD BD CRC The reply is formatted similar to the Set Antenna Port command. Data byte 01 returns the current TX antenna, and data byte 02 returns the current RX antenna.
Get Application Commands Logical Antenna Options The new Get Antenna Configuration options allow you to get the logical antenna configuration of the module. This syntax supports detecting antennas connected to a multiplexer provided the appropriate GPIO control lines have been enabled using Set Reader Configuration(9Ah).
Get Application Commands Field Value Description Repeat for all available logical antennas, as defined by the settings in Set Reader Configuration(9Ah) Get Read TX Power (62h) For deprecated version of this command see Appendix D: Get Read TX Power (62h) The Get Read TX Power command returns the current TX power and, optionally, the minimum and maximum power levels supported by the module (and region setting) for reading tags, in centi-dBm.
Get Application Commands Get Current Tag Protocol (63h) The Get Current Tag Protocol command returns the currently set tag protocol(s). This is the protocol being used by the reader. The following table assigns a 16-bit code to each available protocol.
Get Application Commands Get Write TX Power (64h) For deprecated version of this command see Appendix D: Get Write TX Power (64h) The Get Write TX Power command returns the current TX power and, optionally, the minimum and maximum power levels supported by the module for reading tags, in centidBm. The option field allows you to specify what data you want returned: Option Data returned 0x00 Returns only the current TX power.
Get Application Commands FF 00 65 SOH Length OpCode 1D 6A CRC The reply format is similar to the Set Frequency Hop Table command. The length must be set to a multiple of four, and a maximum of 62 hop frequencies is returned. The frequencies are returned in kHz.
Get Application Commands Note Option=0x00 is reserved and not the same as when no option is specified.
Get Application Commands Get User GPIO Inputs (66h) The Get User GPIO Inputs command returns the status of the User Input GPIO lines: FF 00 66 SOH Length OpCode 1D 69 CRC The status of the GPIO lines is returned. FF 02 66 SOH Length OpCode 00 00 Status 00 01 Input #1 Input #2 CA B2 CRC Note The GPI lines are level sensed and not edge sensed. When Get User GPIO Inputs is called it will respond with the signal level (high or low) on the line at that moment.
Get Application Commands Region codes Region Code NA 0x01 EU 0x02 KR 0x03 IN 0x04 PRC 0x06 EU2 0X07 EU3 0x08 KR2 0x09 AU 0x0B NZ 0x0C Open 0xFF To get the current region send the following command: FF 00 67 SOH Length OpCode 1D 68 CRC The command generates the following reply, which indicates that the reader is set to the NA region: FF 01 67 SOH Length OpCode 00 00 Status 01 Region B4 80 CRC Get Power Mode (68h) The Get Power Mode command returns the current Po
Get Application Commands Available power modes Hex Power Mode 0x00 Full power mode 0x01 Minimal saving mode. 0x02 Medium saving mode. 0x03 Maximum saving mode. 0x04-0xFF Reserved for future use.
Get Application Commands FF 01 69 SOH Length OpCode 00 00 Status 01 97 User Mode 8F CRC Get Reader Configuration(6Ah) For the previous version of this command see Appendix D: Get Reader Configuration(6Ah) The Get Reader Configuration command returns the current reader configuration for the setting specified by the key field as defined in Set Reader Configuration(9Ah) when using Option=0x01. When using Option=0x00 it will use the previous format of the command.
Get Application Commands a FF 03 6B SOH Length OpCode 00 00 Status 05 00 02 Protocol Parameter Value 08 76 CRC Get Reader Statistics (6Ch) The Get Reader Statistics command allows the user to get and reset various statistics on the reader operation. The command takes the following fields: Get Reader Statistics Request Fields Field Option (1 byte) Value • 0x00 - Get statistics specified by the Statistics Flag • 0x01 - Reset the specified statistic.
Get Application Commands Available Statistics Statistics Flag Bit Bit 0 (0x01) Statistic RF On Time (ms)- Indicates the aggregate time the transmitter has been on, in milliseconds, since the counter was last reset. Returned value contains N bytes (N/2 on the M5e-Compact), Where N = the number of valid logical antennas based on the Antenna Ports configuration X 4 bytes for each antenna. Note: Clock rolls over every 232 milliseconds and must be taken into account by user application.
Get Application Commands Get Statistics Response Fields Field Description Status (2 bytes) Standard response status Option (1 byte) Same as the Requested Value Requested Statistics Flag (1 byte) Same as the Requested Value For each individual statistics requested as part of the Requested Statistics Flag the following fields will be repeated according to the Statistics Response value. They will be in bit value order. Statistic Flag (1 byte) The bit corresponding to the requested statistic.
Get Application Commands Get Available Protocols (70h) The Get Available Protocols command returns the list of protocols that the reader is capable of reading. The protocol codes are defined in Get Current Tag Protocol (63h). The total number of protocols in the system cannot exceed 32.
Get Application Commands Get Current Temperature (72h) The Get Current Temperature command returns the current board component temperature on the module in degrees Celsius as a signed 8-bit integer. This information can be used to determine if the module is exceeding its recommended operating temperature range. If the returned value exceeds the values specified in the table below an effort should be made to reduce the ambient temperature of the module or reduce the module’s duty cycle.
FCC Test Commands FCC Test Commands The following OpCodes are used for test purposes including regulatory certification testing. Note Set Power Mode to Full 0x00 before running FCC commands.
FCC Test Commands Set Operating Frequency (C1h) The Set Operating Frequency command takes a 32-bit frequency value, expressed in kHz. For instance, to set the frequency to 915.26MHz, send the data value 915260 (0x000D F73C) to the reader. FF 04 C1 SOH Length OpCode 00 0D F7 3C F3 Freq to Set B7 CRC Transmit CW Signal (C3h) The Transmit CW Signal command turns the Continuous Wave (CW) signal On or Off or enables a PRBS signal.
Appendix A: Hardware Details This Appendix details the mechanicals for the embedded modules and also provides pin 1 locations for the M5e and M5e-Compact serial connectors. Mechanicals The following figures detail the hardware layouts that comprise the Mercury Embedded Modules.
Mechanicals M5e Mechanicals 190 Appendix A: Hardware Details
Mechanicals M5e-Compact Mechanical Antenna Connector The M5e has two MMCX connectors and the M5e-Compact has one MMCX connector for interfacing to the antennas.
Mechanicals Communications Connector The communications interface on the modules provides power, serial communications signals, and access to the GPIO inputs and outputs. The M5e and M5e-Compact have a 12-pin connector. For the interface pin-out, see M5e/ M5e-Compact Digital Connectors. The following figure shows the diagrams of the M5e, and M5e-Compact communications interface as you face the boards.
Appendix B: Getting Started - Devkit Devkit Hardware Included Components With the devkit, you will receive the following components: The M5e/C module and power/interface developers board One USB cable (may contain two host-side connectors, do not use the Red one) One antenna One coax cable One 9V power supply International power adapter kit Sample tags Two paper inserts: – QuickStart Guide - Details on which documents and software to download to get up and running quickly, and how to register for and conta
Devkit Hardware Connecting the Antenna ThingMagic supplies one antenna that can read tags from 20’ away with most of the provided tags. The antenna is monstatic. Use the following procedure to connect the antenna to the DevKit. 1. Connect one end of the coax cable to the antenna. 2. Connect the other end of the cable to Ant 1 connector on the DevKit. Powering up and Connecting to a PC After connecting the antenna you can power up the DevKit and establish a host connection. 1.
Devkit Hardware Native USB Not applicable to the M5e. Devkit Jumpers J8 Jumpers to connect M5e I/O lines to devkit. J9 Header for alternate power supply. Make sure DC plug (J1) is not connected if using J9. J10, J11, J13, J15 Do not change. Jump pins OUT to GPIO# to connect M5e GPIO lines to output LEDs. Jump pins IN to GPIO# to connect M5e GPIO to corresponding input switches SW[3-6]GPIO#.
Devkit Hardware J17 Jump pins 1 and 2 to use the 5V INPUT and GND inputs to provide power. Jump pins 2 and 3 to use the DevKit’s DC power jack and power brick power. J19 Do not change Devkit Schematics Available upon request from support@thingmagic.com.
Demo Application Demo Application A demo application which supports multi-protocol reading and writing is provided in the MercuryAPI SDK package. The executable for this example is included in the MercuryAPI SDK package under /cs/samples/exe/Universal-Reader-Assistant.exe and the source code under /cs/samples/Universal-Reader-Assistant/Universal-Reader-Assistant.exe. See the Readme.txt in /cs/samples/Universal-Reader-Assistant/Universal-ReaderAssistant for usage details.
Demo Application Arbser Command Line Utility The ArbSer program is a simple terminal program with which you can communicate with the M5e, and M5e-C modules. It provides several pre-formed commands, as well as a raw message interface that can be used to generate any command. The source code is part of the developer’s kit to provide an example of the message format and CRC calculation. The executable was built using a Windows 2000 PC.
Demo Application -msg xx xx xx ... – Send properly formatted msg (appends SOH and CRC). -raw xx xx xx ... – Send raw hexadecimal msg (illegal msgs possible). -ver – Returns the version information. When using ArbSer, the serial port and baud rate can be changed from the default of COM1 and 9600 bps. Then, one of the options must be selected. The most useful ones are ‘-go’, ‘-msg’, and ‘-ver’. These commands provide the ability to exercise every feature of the modules.
Demo Application Get Version Command When the unit is first powered up, the boot loader is running.
Demo Application Data[017] = 00 Data[018] = 00 Data[019] = 07 CRC = 42EA The module returns its version information. In the previous example, the version number shows the following: Boot loader version #3.1.5 Application FW build date: 11/03/2004 Application FW version #3.1.6 3 protocols enabled (EPC0, EPC1, ISO18000-6B).
Demo Application Valid message received: Data Length = 14 OpCode = 04 Status = 00 00 Data[000] = 03 Data[001] = 01 Data[002] = 00 Data[003] = 05 Data[004] = FF Data[005] = FF Data[006] = FF Data[007] = FF Data[008] = 20 Data[009] = 04 Data[010] = 11 Data[011] = 03 Data[012] = 03 Data[013] = 01 Data[014] = 00 Data[015] = 06 Data[016] = 00 Data[017] = 00 Data[018] = 00 Data[019] = 07 CRC 202 = 4B6A Appendix B: Getting Started - Devkit
Demo Application This returns the same version information as the -ver command previously documented. Now that the application FW has been started, the reader is ready to accept protocol commands. To read an EPC0 tag, place the tag about one foot away from the antenna. Then send the following series of commands. Set Current Region Command Before you can start reading tags with the M5e and M5e-C, you must set the region in which the reader resides.
Demo Application Set Current Tag Protocol Command When the application FW first starts, there is no default protocol loaded. Thus, the protocol to use must be specified. For this example, the protocol is set to EPC0 using the Set Current Tag Protocol command: C:\> ArbSer –msg 02 93 00 01 < Equivalent to: FF 02 93 00 01 51 79 > Valid message received: Data Length = 00 OpCode = 93 Status = 00 00 CRC = 371A Set Read TX Power Command The default read power setting for the modules is 26.5 dBm.
Demo Application read tags. For example, to use a one-port configuration that uses only port 1, use the Set Antenna Port command: C:\> ArbSer –msg 02 91 01 01 < Equivalent to: FF 02 91 01 01 70 3B > Valid message received: Data Length = 00 OpCode = 91 Status = 00 00 CRC = 1758 Finally, the module is ready to execute a read command. The timeout for the read can be set anywhere from 0 ms to 65,536 ms.
Demo Application C:\> ArbSer –msg 02 21 03 E8 < Equivalent to: FF 02 21 03 E8 D5 09 > Valid message received: Data Length = 0E OpCode = 21 Status = 00 00 Data[000] = 12 Data[001] = 34 Data[002] = 56 Data[003] = 78 Data[004] = 9A Data[005] = BC Data[006] = DE Data[007] = F0 Data[008] = AA Data[009] = BB Data[010] = CC Data[011] = DD Data[012] = 23 Data[013] = 79 CRC = 2384 The module should now return the tag ID of the tag.
Demo Application Unexpected Results Sometimes you do not get the results that you expected. The following sections explain some problems that can occur when the previously listed sequence of commands are used. The following sections explain some of the frequently encountered errors. Serial Communication Does Not Work If serial communications fails to work using the ArbSer command, check the following: The baud rate is correct.
Demo Application Send a Boot Firmware command to verify that the application FW is running. If the boot loader is currently running, then a set command will return a 0x0101 status code, indicating an invalid OpCode. The parameter(s) to the set command are invalid. If an invalid parameter is sent, then a 0x0105 status code is returned, indicating an invalid parameter value. If the wrong number of data elements is used, then a 0x0100 status code (wrong number of data) is returned.
Minimum Set of Serial Commands Minimum Set of Serial Commands The minimum set of commands required to setup the M5e for reading are: Boot Firmware (04h): 0xFF 0x00 0x04 0x1D 0x0B Set Current Tag Protocol (93h) [to Gen2] 0xFF 0x02 0x93 0x00 0x05 0x51 0x7D Set Current Region (97h) [to EU3] 0xFF 0x01 0x87 0x08 0x4B 0xB5 Notice you must first boot the application firmware (0x04) so you can successfully execute the setup commands. The "Set" commands cannot be executed when running in the bootloader mode.
Notice on Restricted Use of the DevKit Notice on Restricted Use of the DevKit The Mercury5e Developers Kit (DevKit) is intended for use solely by professional engineers for the purpose of evaluating the feasibility of applications. The user’s evaluation must be limited to use within a laboratory setting. This DevKit has not been certified for use by the FCC in accordance with Part 15 of the FCC regulations, ETSI, KCC or any other regulatory bodies and may not be sold or given for public use.
Appendix C: Error Messages Common Error Messages The following table lists the common faults discussed in this section.
Common Error Messages Solution Make sure the number of arguments matches the data length. FAULT_INVALID_OPCODE – 101h Cause The opCode received is invalid or not supported in the currently running program (bootloader or main application) or is not supported in the current version of code. Solution Check the following: Make sure the command is supported in the currently running program. Check the documentation for the opCode the host sent and make sure it is correct and supported.
Common Error Messages FAULT_MSG_POWER_TOO_HIGH – 103h Cause A message was sent to set the read or write power to a level that is higher than the current HW supports. Solution Check the HW specifications for the supported powers and insure that the level is not exceeded. The M5e 1 Watt units support power from 5 dBm to 30 dBm. The M5e-Compact units support power from 10 dBm to 23 dBm.
Common Error Messages FAULT_MSG_POWER_TOO_LOW - 106h Cause A message was received to set the read or write power to a level that is lower than the current HW supports. Solution Check the HW specifications for the supported powers and insure that level is not exceeded. The M5e supports powers between 5 and 30 dBm. The M5e-Compact units support power from 10 dBm to 23 dBm. FAULT_UNIMPLEMENTED_FEATURE - 109h Cause Attempting to invoke a command not supported on this firmware or hardware.
Common Error Messages FAULT_INVALID_REGION – 10Bh Cause The region code specified in Set Current Region (97h) is invalid or not supported in the currently running application program or not supported in the current version of code. Solution Check the supported Region codes for the hardware in use.
Bootloader Faults Bootloader Faults The following table lists the common faults discussed in this section. Fault Message Code FAULT_BL_INVALID_IMAGE_CRC 200h FAULT_BL_INVALID_APP_END_ADDR 201h FAULT_BL_INVALID_IMAGE_CRC – 200h Cause When a Verify Image CRC (0x08), or Boot Firmware (0x02) command is issued, the reader checks the image stored in flash and returns this error if the calculated CRC is different than the one stored in flash.
Flash Faults Flash Faults The following table lists the common faults discussed in this section.
Flash Faults Solution Make sure that you have the correct password for the flash sector. Check the Accessing the Flash for more information about the flash passwords and sectors. FAULT_FLASH_UNDEFINED_ERROR – 302h Cause This is an internal error and it is caused by a software problem in module. Solution Contact support at support@thingmagic.com. FAULT_FLASH_ILLEGAL_SECTOR – 303h Cause An erase or write flash command was received with the sector value and password not matching.
Flash Faults FAULT_FLASH_WRITE_TO_ILLEGAL_SECTOR – 305h Cause The module received a write flash command to write across a sector boundary that is prohibited. Solution If the data spans two sectors, separate the data into two messages. FAULT_FLASH_VERIFY_FAILED – 306h Cause The module received a write flash command that was unsuccessful because data being written to flash contained an uneven number of bytes. Solution Verify that the data being sent is an even number of bytes.
Protocol Faults Protocol Faults The following table lists the common faults discussed in this section.
Protocol Faults FAULT_NO_TAGS_FOUND – 400h Cause A command was received (such as like read, write, or lock) but the operation failed. There are many reasons that can cause this error to occur. Here is a list of possible reasons that could be causing this error: No tag in the RF field Read/write power too low Antenna not connected Tag is weak or dead Solution Make sure there is a good tag in the field and all parameters are set up correctly.
Protocol Faults Solution This value is invalid or this version of SW does not support the protocol value. Check the documentation for the correct values for the protocols in use. FAULT_WRITE_PASSED_LOCK_FAILED – 403h Cause During a Write Tag Data for ISO18000-6B or UCODE, if the lock fails, this error is returned. The write command passed but the lock did not. This could be a bad tag. Solution Try to write a few other tags and make sure that they are placed in the RF field.
Protocol Faults FAULT_PROTOCOL_WRITE_FAILED – 406h Cause This fault can occur when an operation such as write, lock, kill, set password, or initialize, fails. There are many reasons for failure. Solution Check that the tag is good and try another operation on a few more tags. FAULT_NOT_IMPLEMENTED_FOR_THIS_PROTOCOL – 407h Cause A command was received which is not supported by a protocol. Solution Check the documentation for the supported commands and protocols.
Protocol Faults Solution Make sure that the address specified is within the scope of the tag data address space and available for the specific operation. The protocol specifications contain information about the supported addresses. FAULT_GENERAL_TAG_ERROR – 40Ah Cause This error is used by the M5e GEN2 module. This fault can occur if the read, write, lock, or kill command fails. This error can be internal or functional.
Protocol Faults FAULT_PROTOCOL_KILL_FAILED - 40Eh Cause Attempt to kill a tag failed for an unknown reason Solution Check tag is in RF field and the kill password. FAULT_PROTOCOL_BIT_DECODING_FAILED - 40Fh Cause Attempt to operate on a tag with an EPC length greater than the Maximum EPC length setting. Solution Call Set Reader Configuration(9Ah) to set the Max EPC to 496 bits..
Protocol Faults Solution Check the data that is being passed in the command resulting in this error.
Analog Hardware Abstraction Layer Faults Analog Hardware Abstraction Layer Faults FAULT_AHAL_INVALID_FREQ – 500h Cause A command was received to set a frequency outside the specified range. For example, in North America the frequency range is from 902 MHz to 928 MHz. Solution Check the values you are trying to set and be sure that they fall within this range. FAULT_AHAL_CHANNEL_OCCUPIED – 501h Cause With LBT enabled an attempt was made to set the frequency to an occupied channel.
Analog Hardware Abstraction Layer Faults FAULT_ANTENNA_NOT_CONNECTED – 503h Cause An attempt was made to transmit on an antenna which did not pass the antenna detection when antenna detection was turned on. Solution Connect a detectable antenna (antenna must have some DC resistance). FAULT_TEMPERATURE_EXCEED_LIMITS – 504h Cause The module has exceeded the maximum or minimum operating temperature and will not allow an RF operation until it is back in range.
Analog Hardware Abstraction Layer Faults Check environment to ensure no occurrances of high signal reflection back at antennas. FAULT_AHAL_INVALID_ANTENA_CONFIG – 507h Cause An attempt to set an antenna configuration that is not valid based on the current GPIO as Antenna Switch setting applied using Set Reader Configuration(9Ah). Solution Use the correct antenna setting or change the reader configuration.
Tag ID Buffer Faults Tag ID Buffer Faults The following table lists the common faults discussed in this section. Fault Message Code FAULT_TAG_ID_BUFFER_NOT_ENOUGH_TAGS_AVAILABLE – 600h 600h FAULT_TAG_ID_BUFFER_FULL – 601h 601h FAULT_TAG_ID_BUFFER_REPEATED_TAG_ID – 602h 602h FAULT_TAG_ID_BUFFER_NUM_TAG_TOO_LARGE – 603h 603h FAULT_TAG_ID_BUFFER_NOT_ENOUGH_TAGS_AVAILA BLE – 600h Cause A command was received to get a certain number of tag ids from the tag id buffer.
Tag ID Buffer Faults FAULT_TAG_ID_BUFFER_REPEATED_TAG_ID – 602h Cause The module has an internal error. One of the protocols is trying to add an existing TagID to the buffer. Solution Report this problem to ThingMagic at http://support.thingmagic.com. FAULT_TAG_ID_BUFFER_NUM_TAG_TOO_LARGE – 603h Cause The module received a request to retrieve more tags than is supported by the current version of the software.
System Errors System Errors FAULT_SYSTEM_UNKNOWN_ERROR – 7F00h Cause The error is internal. Solution Make note of the operations you were executing and contact ThingMagic at http:// support.thingmagic.com. FAULT_TM_ASSERT_FAILED – 7F01h Cause An unexpected Internal Error has occurred. Solution The error will cause the module to switch back to Bootloader mode. When this occurs make note of the operations you were executing, save FULL error response and contact ThingMagic at support@thingmagic.com.
Appendix D: Deprecated and Modified Commands The following contains the deprecated versions of Serial commands grouped by the release they were deprecated in. These commands are still supported for backward compatibility. For new development the new formats for each, as specified in Command Set, should be used.
Release Version 1.0.34 Release Version 1.0.34 Read Tag Single (21h) If a tag is read using the currently set tag protocol, its EPC is returned in the tag ID section of the packet. If no tag is read, a fault code is reported. The Read Tag Single command takes a 16-bit timeout value in milliseconds.
Release Version 1.0.34 Read Tag ID Multiple (22h) The Read Tag ID Multiple command performs a search for the specified period of time then returns the number of tags that have been found. Afterwards, multiple Get Tag ID Buffer commands can be sent to receive the found tag IDs. Each protocol defines its own search method.
Release Version 1.0.34 GEN2 For Gen2, if Option=00, the write tag data is performed without the select option with the following format: FF N+8 24 03 SOH Length OpCode E8 Timeout (ms) 00 00 Option 00 00 02 Address 01 N bytes MemBank Data to Write ?? ?? CRC In the previous example, the reader can singulate a tag with Q=0 and would try to write N bytes of data into the first tag it can see, starting at the address 0x2 of EPC MemBank (the first word of the tag’s EPC).
Release Version 1.0.34 MemBan k Description 0x00 Reserved 0x01 EPC 0x02 TID 0x03 User For more information about the MemBank structure and the memory map of the Gen2 tag, please refer to the EPC Global GEN2 protocol specification. This command is not supported by the EPC1 protocol. Lock Tag (25h) The Lock Tag command locks a specific address in the tag data section. The ID of the tag, the address to lock, and a password for killing the tag need to be provided.
Release Version 1.0.34 First Byte (0x11 above) Bit 15 14 13 12 11 10 Unused 9 Second Byte (0x22 above) 8 Kill Pwd 7 6 5 4 3 2 1 0 Access Pwd EPC Mem TID Mem User Mem Mask X X X X X X L L L L L L L L L L Actio n X X X X X X R/W Perm R/W Perm W Perm W Perm W Perm Where a Mask bit is specified as “L,” a “1” in that bit indicates that the corresponding bit in the Action field is set or cleared.
Release Version 1.0.34 FF 07 26 SOH Length OpCode 03 E8 Timeout (ms) 11 22 33 Kill Password 44 00 RFU ?? ?? CRC The kill password must correspond to the kill password programmed in the tag. Note If the tag’s kill password is set to 0, the protocol does not allow the tag to be killed. A non-zero kill password must be set (using the Write Tag Data command) before the kill command succeeds. The RFU field should be set to 0.
Release Version 1.0.34 Read Tag Data (28h) The Read Tag Data command reads data from the tag. Because each protocol has different formats for reading / writing data, the address field may have different meanings. The general format for the Read Tag Data command is shown in the following example. The tag ID field can be either 8 or 12 bytes, depending on whether it is a 64-bit or 96-bit tag.
Release Version 1.0.34 The response to the Read Data command for the GEN2 protocol has the following format. FF M 28 00 SOH Length OpCode 00 01 … Status M ?? Data ?? CRC Read Tag Data Response The length (M) of the data returned is twice the WordCount value in the original command because the return packet length is counted in bytes.
Release Version 1.0.34 FF 00 64 SOH Length OpCode 1D 6B CRC Microprocessor reply is similar to Set Write TX Power. The default Write TX power is set to 30 dBm: FF 02 64 00 SOH Length OpCode 00 0A Status 5A Power in centi-dBm AE 89 CRC Get Current Region (67h) The Get Current Region command gets the current region set in the reader. Currently available region codes are shown in the following table.
Release Version 1.0.34 To get the current region, send the following command: FF 00 67 SOH Length OpCode 1D 68 CRC The command generates the following reply, which indicates that the reader is set to the NA region: FF 01 67 SOH Length OpCode 00 00 01 Status B4 Region 80 CRC Get Transmit Mode (6Ah) The Get Transmit Mode command returns the tranmit modethe M5e is current set to.
Release Version 1.0.34 Set Current Region (97h) The Set Current Region command sets the current region for use in the reader. The list of region codes are found in Region codes. However, the module is able to support only a limited subset of those regions. Setting the region performs the following: 1. Frequency hop table is set to the default for the region. 2. Power limits are applied to ensure unit does not send out too much power. 3. Any other region specific settings are enforced.
Release Version 1.0.37.27 Release Version 1.0.37.27 Set Reader Configuration(9Ah) For the deprecated version of this command see Appendix D: Set Transmit Mode (9Ah) [M5e Only] The Set Reader Configuration command is used to set several configuration options on the reader. The configuration options, defined in the table below are enabled bitwise, although the option value is specified in hexidecimal (2 bytes).
Release Version 1.0.37.
Appendix E: Environmental Considerations This Appendix details environmental factors that should be considered relating to reader performance and survivability. ElectroStatic Discharge (ESD) Considerations W A R N I N G ! The M5e antenna ports may be susceptible to damage from Electrostatic Discharge (ESD). Equipment failure can result if the antenna or communication ports are subjected to ESD.
ElectroStatic Discharge (ESD) Considerations has returned to the bootloader to prevent any further damage. This jump to boot loader caused by power amp damage occurs at the start of any read tag commands. Ultimately determining that ESD is the root cause of failures is difficult because it relies on negative result experiments, i.e. it is the lack of failure after a configuration change, rather than a positive flag wave that says “I’m ESD”.
ElectroStatic Discharge (ESD) Considerations What actually gets to the M5E is also strongly influenced by the antenna installation, cabling, and grounding discussed above. Use the mean operating time statistic before and after one or more of the changes listed below to quantitatively determine if the change has resulted in an improvement. Be sure to restart your statistics after the change.
ElectroStatic Discharge (ESD) Considerations Raising the ESD Threshold For applications where full M5E power is needed for maximum tag read range and ESD is suspected the following components are recommended additions to the installation to raise the level of ESD the reader can tolerate: Select or change to an antenna with all radiating elements grounded for DC. The MTI MT-262031-T(L,R)H-A is such an antenna. The Laird IF900-SF00 and CAF95956 are not such antennas.
Variables Affecting Performance Variables Affecting Performance Reader performance may be affected by the following variables, depending on the site where your Reader is being deployed: Environmental Tag Considerations Multiple Readers Environmental Reader performance may be affected by the following environmental conditions: Metal surfaces such as desks, filing cabinets, bookshelves, and wastebaskets may enhance or degrade Reader performance.
Tag Orientation: Reader performance is affected by the orientation of the tag in the antenna field. The ThingMagic antenna is circularly polarized, so it reads face-to but not edge-to. Tag Model: Many tag models are available. Each model has its own performance characteristics. Multiple Readers The Reader adversely affect performance of 900 MHz devices. These devices also may degrade performance of the Reader.
