875-0034-05 RevA Mercury®6e - TC Developer’s Guide 1
Government Limited Rights Notice: All documentation and manuals were developed at private expense and no part of it was developed using Government funds. The U.S. Government’s rights to use, modify, reproduce, release, perform, display, or disclose the technical data contained herein are restricted by paragraph (b)(3) of the Rights in Technical Data — Noncommercial Items clause (DFARS 252.227-7013(b)(3)), as amended from time-to-time.
Contents Introduction to the Mercury6e-Transcore Module. . . . . . . . . . . . . . . . . . . . . . . . . 13 Hardware Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Microcontroller 14 RFID ASIC 14 Connectors 14 M6e-TC Digital Connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Firmware Overview . . . . . . . . . . . . . . . . . .
Tag Buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Flash Memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Accessing the Flash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Upgrading Application FW. . . . . .
Get Tag EPCs 52 Get Tag EPCs and Metadata 54 Clear Tag Buffer (2Ah) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Multi-Protocol Tag Read (2Fh). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Allegro/Title-21 Tag Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Command Syntax . . .
Basic Tag Inventory 111 Tag Inventory with Select 113 Tag Inventory With Embedded Operations 114 Write Tag EPC (23h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 Write Tag Data (24h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Lock Tag (25h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Set Current Region (97h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Set Power Mode (98h). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Set User Mode (99h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158 Set Reader Configuration(9Ah) . . . . . . . . . . . .
Cause 182 Solution 182 FAULT_MSG_POWER_TOO_HIGH – 103h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 Cause 182 Solution 183 FAULT_MSG_INVALID_FREQ_RECEIVED (104h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 Cause 183 Solution 183 FAULT_MSG_INVALID_PARAMETER_VALUE - (105h) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 Cause 183 Solution 183 FAULT_MSG_POWER_TOO_LOW - (106h) . . . . . . . . . .
FAULT_PROGRAM_NOT_LOADED – 2E4h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 Cause 187 Solution 187 Flash Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 FAULT_FLASH_BAD_ERASE_PASSWORD – 300h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Cause 188 Solution 188 FAULT_FLASH_BAD_WRITE_PASSWORD – 301h. . . . . . . . . . . . .
Solution 193 FAULT_AFE_NOT_ON – 405h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Cause 193 Solution 193 FAULT_PROTOCOL_WRITE_FAILED – 406h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Cause 194 Solution 194 FAULT_NOT_IMPLEMENTED_FOR_THIS_PROTOCOL – 407h . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Cause 194 Solution 194 FAULT_PROTOCOL_INVALID_WRITE_DATA – 408h . . . . . . .
FAULT_GEN2 PROTOCOL_NON_SPECIFIC_ERROR - 42Fh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 FAULT_GEN2 PROTOCOL_UNKNOWN_ERROR - 430h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Analog Hardware Abstraction Layer Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 FAULT_AHAL_INVALID_FREQ – 500h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Solution 202 Appendix D: FPGA Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 Creating an FPGA Image DAT File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 Loading an FPGA Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Introduction to the Mercury6eTranscore Module The ThingMagic® Mercury®6e embedded module is an RFID engine that you can integrate with other systems to create RFID-enabled products which support the custom Transcore tag protocols: eGo, SeGo, ATA and Allegro/Title-21. The Arbser utility provides an easy to use command line interface to configure the reader, read from and write tags, and demonstrate the modules capabilities.
Hardware Overview Features of the M6e-TC Hardware Item M6e-TC Processor Atmel AT91SAM7SE-256 Flash memory 256 kB On-chip RAM 32 kB RF Architecture ASIC Intel R2000 with ThingMagic front end for improved sensitivity Input Power Requirements +5VDC Communication Interfaces • High-speed serial interface • USB with auto-detect Protocols supported eGo, SeGo, ATA, Allegro/Title-21, Gen2 Dimensions: (L x D x H) 78 x 63 x 8 mm Regions supported See Supported Regions The M6e-TC is a single board
Firmware Overview M6e-TC Digital Connectors The digital connector provides power, serial communications signals, and access to the GPIO inputs and outputs. The communications interface for the M6e-TC is a 14-pin digital connector. This connector provides power, serial communications signals, including USB support, and access to the GPIO inputs and outputs.
Firmware Overview The application firmware, which implements the actual reader functionality, is field upgradable. Boot Loader The boot loader provides low-level functionality. This program provides a customer interface for upgrading the application firmware and storing data into flash. When a module is powered up or reset, the boot loader code is automatically copied from sector 0 of flash into the Microprocessor’s on-chip RAM, and executed.
Functionality of the Embedded Modules This section highlights some of the functionality of the modules. The details for using the serial commands to control this functionality are found in Overview of the Communication Protocol. Regional Support The modules have differing levels of support for operation and use under the laws and guidelines of several regions. Note A region must be set before the module will perform any RF operations. The regional support is shown in the following table.
Regional Support Supported Regions Region Regulatory Support M6e-TC North America (NA) FCC 47 CFG Ch. 1 Part 15 Industrie Canada RSS-210 Yes European Union (EU3) Revised ETSI EN 302 208 By default EU3 will use four channels. EU3 region can also be used in a single channel mode. These two modes of operation are defined as: Single Channel Mode • Set by manually setting the frequency hop table to a single frequency.
Regional Support Note The Open Region allows the module to be manually configured within the full capabilities supported by the hardware. No regulatory limits, including: frequency range, channel spacing and transmit power limits, are enforced. The Open Region should be used with caution.
Frequency Setting Frequency Setting The modules have a PLL synthesizer that sets the modulation frequency to the desired value. Whenever the frequency is changed, the module must first power off the modulation, change the frequency, and then turn on the modulation again. Since this can take several milliseconds, it is possible that tags are powered off during a frequency hop.
Frequency Setting Regional Frequency Quantization Region Frequency Quantization Minimum Frequency Maximum Frequency NA 250 kHz 902,000 kHz 928,000 kHz EU3 100 kHz 865,600 kHz 867,600 kHz PRC 250 kHz 920,125 kHz 924,875 kHz Open 50 kHz 860,000 kHz 930,000 kHz When manually setting frequencies the module will round down for any value that is not an even multiple of the supported frequency quantization.
RF Power Setting maybe lower than that allowed by the regulatory requirements.The supported regions and their maximum hop interval is defined in the following table: Maximum Frequency Hop Interval Region Max Hop Interval NA 400 ms EU3 4000 ms PRC 200 ms Open 400 ms RF Power Setting The power setting is calibrated at the factory and parameters are stored in flash memory to ensure the power output is within +/– 1 dB of the desired setting.
Power Amplifier Protection Note Power calibration only occurs once when the RF power is turned on. It does not occur periodically when the RF field is on. This is not an issue during normal operation,= since a frequency hop occurs within the regulatory hop interval (see Maximum Frequency Hop Interval for region specific values) and thermal drift does not affect the power level significantly.
Antenna Ports Antenna Ports Monostatic Mode The M6e-TC has one antenna port which both transmits and receives. To set up the module to use a single antenna in monostatic mode, connect the antenna to port 1 (labeled J1 on Printed Circuit Board) which is responsible for both TX and RX communication. Power Management The modules use different methods and levels of power management.
Tag Buffer Tag Buffer The Tag buffer stores tags, and their metadata, found using the Read Tag Multiple command. The size of the tag buffer for each module is defined in the following table: Tag Buffer Size M6e-TC Tag Buffer Size in Tag ID entries 190 Each tag entry consists of a fixed number of bytes. The size depends on the value set for the Max EPC Length parameter in Set Reader Configuration(9Ah).
Tag Buffer Tag Buffer Entry Total Entry Size 18 bytes (Max EPC Length = 96bits) 68 bytes (Max EPC Length = 496bits) Field Size Description EPC Length 2 bytes Indicates the actual EPC length of the tag read. Cannot exceed the Max EPC length setting. PC Word 2 bytes Contains the Protocol Control bits for the tag. EPC 12 bytes Contains the tag’s EPC value padded with trailing zeros if the size is less than the Max EPC Length size. Tag CRC 2 bytes The tag’s CRC.
Flash Memory Tag Read Meta Data Meta Data Field Description Antenna ID The antenna on with the tag was read. Read Count The number of times the tag was read on [Antenna ID]. Timestamp The time the tag was read, relative to the time the command to read was issued, in milliseconds. If the Tag Read Meta Data is not retrieved from the Tag Buffer between read commands there will be no way to distinguish order of tags read with different read command invocations.
Flash Memory Flash Memory Sector Mapping Code M6e-TC Start Address M6e-TC Size (bytes) Erase Password Write Password Sector Access BootLoader Read Only 0x01 0x000000 16 kB na na Application Read/Write 0x02 0x00C000 208 kB 0x08959121 0x02254410 User Memory Read/Write 0x03 0x008000 16 kB 0x79138766 0x76346700 Hardware Info Read Only 0x04 0x004000 16 kB na na 0x200000 32 kB Application Data (RAM) Accessing the Flash The flash is accessed only through the boot loader prog
Serial and USB Interfaces Serial and USB Interfaces The M6e-TC module can communicate to a host processor via the TTL logic level RS-232 serial protocol or via Universal Serial Bus (USB) protocol, both accessed on the 14-pin M6e-TC Digital Connectors. The module does not need to be software configured to operate on one or the other interface, just send data over the interface to use it.
General Purpose Inputs/Outputs (GPIO) configure the communications protocol. In order to use the USB interface with Windows you must have the m6etc.inf file. The installation steps are: 1. Plug in the USB cable to the M6e-TC (devkit) and PC. 2. Windows should report “Found New Hardware - M6e-TC Serial” and open the Hardware Installation Wizard. 3. Select the Install from a list or specific location (Advanced) option, click Next. 4. Select Don’t search..., click Next, then Next again. 5.
Default Settings Default Settings Since default settings may change across release and be different across platforms we recommend using the Get Configuration Commands to obtain default settings. None of the configurable settings in the application FW are saved in non-volatile memory. Thus the system will always boot up in the same default state, regardless of how it was previously configured.
Default Settings 32 Functionality of the Embedded Modules
Overview of the Communication Protocol The serial communication between a computer (host) and the reader is based on a synchronized command-response/master-slave mechanism. Whenever the host sends a message to the reader, it cannot send another message until after it receives a response. The reader never initiates a communication session; only the host initiates a communication session.
Host-to-Reader Communication The fields are summarized in the following table.: Field Length Description Header (Hdr) 1 byte Defines the start of the packet. Equal to 0xFF 1Data 1 byte Defines the length, N, of the data field contained in the packet. Command 1 byte Specifies the command that the reader is to execute. Data N bytes (0 to 250) Defines the binary data required by the reader for use with a command. This could, for example, represent transponder data to be written.
Reader-to-Host Communication Reader-to-Host Communication The following diagram defines the format of the generic Response Packet sent from the reader to the host. The Response Packet is different in format from the Request Packet. Header Data Length Command Status Word Len Cmd 1 byte 1 byte Hdr 1 byte Data CRC HI Status Word 2 bytes CRC-16 Checksum 0 to M bytes CRC LO 2 bytes The fields are summarized in the following table.
Reader-to-Host Communication 1.The minimum packet length is 7 bytes and the maximum packet length is 255 bytes. 2.Each host command receives a response from the reader. In the response packet, the Header, Data Length, Command, Data, and Checksum are functionally similar to the command packet. 3.The only difference is the addition of the Status Word field. The Status Word has two types of values. A Status Word value of 0 (Zero) means the command received was successful. Any other value represents a fault.
Reader-to-Host Communication An example implementation of CRC calculation, taken from the Arbser source CrcUtils.c, is shown here: /** @fn void CRC_calcCrc8(u16 *crcReg, u16 poly, u16 u8Data) * @ Standard CRC calculation on an 8-bit piece of data. To make it * CCITT-16, use poly=0x1021 and an initial crcReg=0xFFFF. * * Note: This function allows one to call it repeatedly to continue * calculating a CRC.
Format for Microprocessor Reply to Host Format for Microprocessor Reply to Host There are three different types of replies that the microprocessor can make to the host as follows: Acknowledge that the command was properly processed (ACK) Return a fault code Provide data that is requested by the host This section describes each of these three types. Unless otherwise specified, all commands return, as part of the Reply message, a status word with an ACK or a Fault.
Format for Microprocessor Reply to Host The following shows an example of an ACK message to an Erase Flash command. FF SOH 00 Length 07 OpCode 00 00 F4 Status 27 CRC The value in the OpCode field (0x07) is the same as the Erase Flash OpCode, 0x07. Microprocessor Fault Reply Message If a problem occurs during the execution of a command, the microprocessor returns a non-zero status value.
Format for Microprocessor Reply to Host Here is an example of a Reply message with Data Field Length not zero. This message happens to be a successful reply to Read Tag Single command.
Command Set The following list defines the OpCodes that are used in the embedded modules firmware. As these products grow, more OpCodes will be added to enhance the functionality of the product. The timeout for the commands are in milliseconds. The maximum value for any user-configurable timeout is 65,535msec (0xFFFF), unless otherwise noted.
Boot Loader Commands Boot Loader Commands The BootLoader is automatically started upon power up, and allows access to the onboard flash memory along with other commands. The program exits only when the Boot Firmware command is received. Once that occurs, the firmware image starts executing and sends back a reply to the Boot Firmware command. The BootLoader can also be started using command 0x09, Start BootLoader.
Boot Loader Commands Flash Read Sector (02h) The Flash Read Sector command reads the contents of flash from the specified sector and offset address. Since the length of the Microprocessor reply packet is limited to 248 bytes, reading the application firmware data requires multiple read commands. Note Length is defined as the number of 16-bit words, and the maximum value of length is 124 words. In this example, the sector number 02 indicates the application area.
Boot Loader Commands Responses A sample response for the M6e-TC is as follows: FF SO H 14 03 Length OpCode 00 Status 00 07 09 17 00 01 BootLoader Ver 00 00 00 00 01 Hardware Ver 00 10 Supported Protocols 6B 20 07 10 12 Firmware Date 09 05 12 00 Firmware Version CC CRC The following information is embedded in the reply to the command: The boot loader version is 07.09.17.00. This number is in hex format. HW Version is 01000001.
Boot Loader Commands 1. If flash is not locked: the application firmware image CRC verified and flash is locked before it is run. 2. If the image is invalid, a fault code is returned to the host. 3. If the application firmware is started successfully, it sends the response to the Boot Firmware command. FF SOH 00 Length 04 OpCode 1D 0B CRC The response is identical to the response to a Get Version command, except that the OpCode is 0x04 instead of 0x03.
Boot Loader Commands Baud Rate (decimal) Baud Rate (hex) 9600 0x00002580 19200 0x00004B00 38400 0x00009600 57600 0x0000E100 115200 0x0001C200 230400 0x00038400 460800 0x00070800 921600 0x000E1000 In the following example, the baud rate is specified as a 32-bit value. This example sets the baud rate to 115200: FF SOH 04 06 Length OpCode 00 01 C2 Baud Rate 00 FD 30 CRC The response to baud rate change is sent at the baud rate that the Set Baud Rate command was transmitted.
Boot Loader Commands Erase Flash Sector (07h) The Erase Flash Sector command erases the sector specified by the sector number. as defined by Flash Memory Sector Mapping. The following example shows the command to erase sector 2 of the flash. FF SOH 05 07 Length OpCode 08 95 91 21 02 Password Sector 7F 91 CRC Verify Image CRC (08h) After uploading a new application firmware image, the application CRC can be checked with the Verify Image CRC command.
Boot Loader Commands Get Current Program (0Ch) The Get Current Program command returns a code for the current program being executed in the module.
Boot Loader Commands starting from word address 0x00000000. Since the flash is a 16-bit device, there must be an even number of data bytes. The number of data bytes to be written is embedded in the length of the payload (N) by the formula: LengthDataToWriteInWords = (N – 8) / 2 The password required for each sector is defined in Flash Memory Sector Mapping.
Boot Loader Commands called, it could prematurely wear out the flash if it is used too often. This command should only be used to modify a few variables (that is less than one serial packet’s worth) at a time. This command works only for the User area.
Multi-Protocol Tag Commands Multi-Protocol Tag Commands The application commands are used to interact with RFID tags in the field. These commands can have slightly different behavior based upon the current protocol selected in the system. Applications Commands OpCode Command Name 0x29 Get Tag Buffer (29h) 0x2A Clear Tag Buffer (2Ah) 0x2F Multi-Protocol Tag Read (2Fh) Get Tag Buffer (29h) After a Multi-Protocol Tag Read command is executed, the found tags are stored in an internal Tag Buffer.
Multi-Protocol Tag Commands Tags Left = WriteIndex - ReadIndex The following response shows there are three tags left in the buffer, and the first one has already been read (the read index parameter starts counting from 0.): FF 04 29 SOH Length OpCode 00 00 Status 00 01 00 04 ReadIndex WriteIndex 87 72 CRC Get Tag EPCs When you want to get the tag EPCs out of the buffer and don’t care about the tag read metadata, the options available with this syntax maybe useful.
Multi-Protocol Tag Commands FF 04 29 00 01 00 03 SOH Length OpCode Start Idx End Idx CC 94 CRC Using the start and end index method does not affect the read index that is internally stored in the module. The above request returns a message with two tags. The length of each tag EPC record returned is defined based on the max EPC length configured with Set Reader Configuration(9Ah), regardless of the size of a specific tag’s EPC.
Multi-Protocol Tag Commands Get Tag EPCs and Metadata Using this syntax for getting information from the tag buffer provides several benefits: When at tag EPC is returned there is no padding if the actual tag EPC is shorter than the configured max EPC length. This helps minimize the amount of data returned. Any or all fields of the Tag Read Meta Data can be returned. In the event of a communication error the last Get EPC and Metadata request can be repeated.
Multi-Protocol Tag Commands Field Read Option Value Description 0x00 Read the next set of tags from the Tag Buffer 0x01 Re-send the last set of tags. Note: When setting this option the tags will be resent starting at the same ReadIndex as the last command. If the metadata requested is different than the last request the number of tags returned might be different.
Multi-Protocol Tag Commands Examples An example command requesting Read Count, AntennaID and Timestamp Metadata Flags = 0x0001 OR 0x0004 OR 0x0010 = 0x0015 is as follows: FF 03 29 SOH Length OpCode 00 15 Metadata Flags 00 97 Read Options 55 CRC A response contains the following information: Get EPC and Metadata Response Fields Field 56 Length Value SOH 1 byte 0xFF Length 1 byte Based on data returned OpCode 1 byte 0x29 Metadata Flags 2 bytes Metadata contained in response Read
Multi-Protocol Tag Commands Field Length Value RFU1 2 bytes Reserved for Future Use - ThingMagic Only Protocol ID 1 byte Protocol ID of tag read EPC Length 2 bytes Number of bits in EPC including PC and CRC bits PC Word 2 bytes Tag EPC Protocol Control bits EPC ID N bytes Tag EPC.
Multi-Protocol Tag Commands Clear Tag Buffer (2Ah) The Clear Tag Buffer command resets the tag buffer. This clears the buffer of any current tags and reset the read index to 0. A Multi-Protocol Tag Read or Read Tag Multiple command must be issued to load new tags into the buffer. FF 00 2A SOH Length OpCode 1D 25 CRC If Clear Tag Buffer or Get Tag Buffer is not used after a Multi-Protocol Tag Read to remove all tags, old tags will be left in the buffer.
Multi-Protocol Tag Commands Field Search Flags Value [2 bytes - bitwise setting] Bit 0 = Enable end on tags found Note: Least Significant Bit = bit 0 Description Indicates search options. When bit is set = 1 the option will be enabled. • Bit 0 = 1 (0x01) the search will stop after the first tag is found, after completing that protocols entire timeout. i.e.
Multi-Protocol Tag Commands Examples TM Option = 0x00 Request FF ?? 2F ?? SOH Length OpCode ?? Timeout 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? TM Options Cmd Opcode Search Flags Protocol Bitmask Enables CRC Response FF ?? 2F SO H Length OpCod e ?? ?? Status 00 ?? ?? ?? TM Option Cmd Opcode Search Flags ?? ?? Protocol Id1 Protocol Response Length ?? ?? Protocol Id2 Protocol Response Length ?? ?? ?? .... Protocol Response Data (Includes Status word) ?? ?? ?? ....
Allegro/Title-21 Tag Commands Allegro/Title-21 Tag Commands The Allego/Title-21 tag commands are used to operate on Allegro/Title-21 tags and perform operations specific to those tags. These commands can only be used when the Tag Protocol of the reader is set to Allegro/Title-21 (0x001E) using Set Current Tag Protocol (93h). These commands cannot be run when in Bootloader mode, only in Application mode.
Allegro/Title-21 Tag Commands Command Syntax All Allegro/Title-21 tag commands, except Read Tag ID Single, follow the same standard syntax. The commands are grouped into three ThingMagic M6e-TC OpCodes, as defined in the Allegro/Title-21 Tag Commands table, indicating their general operation type.
Allegro/Title-21 Tag Commands Read Tag ID Single (21h) The Read Tag ID Single/Tag Detect command performs a search operation and returns the first Allegro/Title-21 tag it finds. Read Tag ID Single Request Fields Field Value Description TM OpCode 0x21 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds.
Allegro/Title-21 Tag Commands ACK Response FF 04 21 SOH Length OpCode 00 00 ?? ?? Status ?? ?? Tag ID CRC NACK Response FF 00 21 SOH Length OpCode ?? ?? Status ?? ?? CRC No Response FF SOH 64 00 Length 21 TM OpCode 04 00 Status B4 CRC ?? 83 ??
Allegro/Title-21 Tag Commands Write Request (24h; A003h) The Write Request command writes data to the specified area of the specified tag. A nonacknowledge (NACK) error response shall be returned if an invalid password was included in the request.
Allegro/Title-21 Tag Commands ACK Response FF 0C + (N+1) SOH Length 24 00 00 00 A0 03 ?? ?? TM OpCode Status TM Option Transaction Type Code Options ?? ?? ?? Tag ID ?? ?? ?? NN Page Number Page Data Count (if requested) NN ?? Page Data NACK Response ? ? FF 0B 24 04 0A 00 A0 03 ?? SOH Length TM OpCode Status TM Option Transaction Type Code Options ? ? ? ? Tag ID ? ? ?? ?? CRC No Response FF 00 24 04 00 SOH Length TM OpCode Status E4 26 CRC Title-21 A
Allegro/Title-21 Tag Commands Title-21 ACK Request Fields Field Value Description TM OpCode 0x24 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xC000 Allegro/Title-21 code indicating operation to perform. Tag ID [4 bytes] Indicates the ID of the tag to operate on.
Allegro/Title-21 Tag Commands No Response FF 00 24 04 00 SOH Length TM OpCode Status E4 26 CRC General ACK Request (24h; F00Fh) The General ACK Request, or Sign Off Request, command informs the tag that it should not respond to any commands from the reader for the specified time period.
Allegro/Title-21 Tag Commands Examples An example command requesting an ACK from tag XXX from reader XXX is: FF 0C 24 ?? ?? 00 F0 0F ?? SOH Length OpCode Timeout (ms) TM Option Transaction Type Code Option ?? ?? ?? ?? Tag ID ?? ?? ?? Time Out Condition Code LCD Page Ptr ?? ?? CRC ACK Response FF 03 24 ?? ?? 00 F0 0F ?? SOH Length TM OpCode Status TM Option Transaction Type Code ?? CRC NACK Response ? ? FF 0A 24 ?? ?? 00 F0 0F ?? SOH Length TM OpCode Statu
Allegro/Title-21 Tag Commands Title-21 Read Request Fields Field Value Description TM OpCode 0x28 TM OpCode for Read operations Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0x8000 Allegro/Title-21 code indicating operation to perform. Agency Code [2 byte] Agency operating the reader installation.
Allegro/Title-21 Tag Commands Read Request (28h; C003h) The Read Request command reads data from the specified area of the specified tag. This command contains the following request fields: Read Request Fields Field Value Description TM OpCode 0x28 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use.
Allegro/Title-21 Tag Commands ACK Response FF ?? + N 28 00 00 00 C0 03 ?? ?? SOH Length TM OpCode Status TM Option Transaction Type Code Options ?? ?? ?? Tag ID ?? ?? ?? .. ..
Allegro/Title-21 Tag Commands Random Number Request Fields Field Value Description TM OpCode 0x28 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds. TM Options 0x00 Reserved for Future Use. Transaction Type Code 0xD001 Allegro/Title-21 code indicating operation to perform. Options [1 byte] Command specific options Tag ID [4 bytes] Indicates the ID of the tag to operate on.
Allegro/Title-21 Tag Commands No Response FF 00 28 04 00 SOH Length TM OpCode Status 25 AA CRC TDMA Read Request (28h; E003h) The TDMA Read Request command returns the tag ID from the first tag to respond only. This command contains the following request fields: TDMA Read Request Fields Field Value Description TM OpCode 0x28 TM OpCode for tag modification operations Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds.
Allegro/Title-21 Tag Commands NACK Response FF 0B 28 04 0A 00 E0 03 ?? ?? SOH Length TM OpCode Status TM Option Transaction Type Code Options ?? ?? ?? Tag ID ?? ?? CRC No Response FF 00 28 04 00 SOH Length TM OpCode Status 25 AA CRC Jump to Reset Request (2Ch; D203h) The Jump to Reset Request command requests the tag perform a hard reset.
Allegro/Title-21 Tag Commands NACK Response 76 FF 00 2C 04 00 SOH Length TM OpCode Status 65 2E CRC
eGo/SeGo Tag Command Set eGo/SeGo Tag Command Set The eGo/SeGo tag commands are used to operate oneGo/SeGo tags and perform operations specific to those tags. These commands can only be used when the Tag Protocol of the reader is set to eGo/SeGo (0x001B or 0x001C) using Set Current Tag Protocol (93h). These commands cannot be run when in Bootloader mode, only in Application mode.
eGo/SeGo Tag Command Set Command Syntax All eGo/SeGo tag commands follow the same standard syntax. Each command has the following common fields followed by additional fields required for the specific operation being performed: Standard Request Fields Field Value TM OpCode 0xXX Description TM OpCode as defined in eGo/SeGo Tag Com- mands Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds.
eGo/SeGo Tag Command Set Command Type Value Group Select Option Tag Selection Behavior 0X03 GROUP_SELECT_LT All tags in the field whose data is LESS THAN the specified Select Fields will respond. 0X04 GROUP_UNSELECT_EQ All tags except those in the field whose data EQUALS the specified Select Fields will respond. 0X05 GROUP_UNSELECT_NE All tags except those in the field whose data does NOT EQUAL the specified Select Fields will respond.
eGo/SeGo Tag Command Set Read Tag ID Single (21h) The Read Tag ID Single command executes a query for tags matching the criteria specified by the Command Type and subsequent fields and returns the first tag found. Read Tag ID Single Request Fields Field Value Description TM OpCode 0x21 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds. TM Options Bit 0 • 1 - Indicates Command Type and additional fields to follow.
eGo/SeGo Tag Command Set Examples An example command: FF 0E 21 SOH Length OpCode ?? ?? 01 00 ?? Timeout (ms) TM Option Command Type Byte Address ?? ?? Byte Mask ?? ?? ?? ?? ?? ?? ?? Word Data ?? CRC ACK Response FF 0C 21 SOH Length OpCode ?? ?? Status 01 ?? TM Option Command Type ?? ?? ?? ?? ?? ?? ?? Tag Data ?? ?? ?? ?? ?? CRC NACK Response FF 02 21 SOH Length OpCode FF 00 ?? ?? Status 01 ?? ?? TM Option Command Type CRC ?? No Response SO
eGo/SeGo Tag Command Set Read Tag ID Multiple Request Fields Field Value Description TM OpCode 0x22 TM OpCode TM Options 0x01 Indicates Command Type and additional fields to follow. Search Flags 0x0000 Reserved for Future Use. Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds. Command Type [1 byte] Indicates the Group Select criteria to apply as defined in Group Select Options.
eGo/SeGo Tag Command Set No Response FF 00 SOH 22 Length 04 00 TM OpCode 84 Status E0 CRC Minimal Syntax The Read Tag ID Multiple command can also be used in a reduced syntax format. In this case only the Timeout is specified. This syntax performs a search for the specified period of time with no selection criteria, returning the number of tags that have been found.
eGo/SeGo Tag Command Set Write Tag Data Request Fields Field Value Description TM OpCode 0x24 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds. TM Options [1 byte] excluding bits 5&6 (LSB = bit 0) Note: TM Options field combines bits 0-4 indicating the verification method and bits 5 & 6 for authentication information. For the final TM Options setting, the two “fields” should be OR’d.
eGo/SeGo Tag Command Set Field Lock Value [1 byte] Description • 0x00 = no lock • 0x01 = lock the data specified by Write Data Write by Page won’t lock if authentication information is not specified. Write multiple won’t lock Write Address [1|4byte] Indicates the start address of tag memory to be written: • 4 Byte Address when TM Option = 0xX0 • 1 Byte Address otherwise Select Command Type [1 byte] Indicates the Group Select criteria to apply as defined in Group Select Options.
eGo/SeGo Tag Command Set Field Value Key Description [0-N bytes] Only passed when authentication enabled in TM Options. Note: Value passed with MSB first.
eGo/SeGo Tag Command Set NACK Response FF 02 24 SOH Length OpCode ?? ?? Status 01 TM Option 0D ?? Command Type ?? CRC No Response FF 00 SOH Length 24 TM OpCode 04 00 Status E4 26 CRC Lock Tag Data (25h) The Lock Tag Data command locks and unlocks a tag’s memory locations.
eGo/SeGo Tag Command Set Field Value Command Type Description 0x00 Performs a QueryLock, immediate followed by an UnLock 0x01 Performs a QueryLock, immediate followed by a Lock 0x0F LockByte operation. Performs QLock/Lock/QLock 0x10 UnLock Byte. Performs QLock/UnLock/QLock 0x11 QueryLock 0x8F Lock Page. Performs QLock/Lock/QLock 0x90 UnLock Page. Performs QLock/UnLock/QLock Lock Address [1 byte] Indicates the address of tag memory to be (un)locked.
eGo/SeGo Tag Command Set ACK Response When Command Type = 0x00 or 0x01 FF 03 25 ?? ?? SOH Length OpCode ?? Status 00 | 01 TM Option ?? Command Type ?? (Un)Lock Response ?? CRC When Command Type = all others FF 04 25 ?? ?? SOH Length OpCode Status ?? ?? TM Option ?? Command Type Lock Response ?? ?? Query Lock Response CRC ?? NACK Response FF SOH 03 Length 25 ?? ?? OpCode Status ?? TM Option ?? ?? Command Type Lock Response ?? ?? CRC No Response FF SOH 00 Le
eGo/SeGo Tag Command Set Read Tag Data Request Fields Field Value Description TM OpCode 0x28 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds. TM Options [1 byte] Indicates Command Type and additional fields to follow: • 0x01 = For Standard Read Operations bits 5 & 6 (LSB = bit 0) Specify authentication method to use: • 0x00 = authentication is disabled and Key values must not be passed.
eGo/SeGo Tag Command Set Field Value Tag ID | Select Data Description [8 bytes] When: • Command Type = 0x0B, 0x0C, 0x12 or 0x92: 8 bytes = Tag ID • Command Type = 0x80 [1 byte] = Select Address [1 byte] = Select Data [6 bytes] = RFU Key Address [1 byte] Only passed when authentication enabled by TM Options. Key Length in Bytes [1 byte] Only passed when authentication enabled by TM Options. Key [0-N bytes] Only passed when authentication enabled by TM Options.
eGo/SeGo Tag Command Set NACK Response FF 02 28 SOH Length OpCode ?? ?? Status 01 TM Option 0C ?? Command Type ?? CRC No Response FF SOH 00 28 Length TM OpCode 04 00 Status 25 AA CRC Custom Tag Operations (2Dh) The Custom Tag Operations command provides access to several eGo/SeGo tag specific operations including: Fail, Success, Initialize, Resend, Read_All_Data, Read_All_Lock, and RN_Request.
eGo/SeGo Tag Command Set Field Value Description Key Address [1 byte] Only passed when Command=0x82 or 0x83. Key Length in Bytes [1 byte] Only passed when Command=0x82 or 0x83. Key [0-N bytes] Only passed when Command=0x82 or 0x83. Note: Value passed with MSB first.
eGo/SeGo Tag Command Set 94
ATA Tag Command Set ATA Tag Command Set The ATA tag commands are used to perform operations specific to ATA tags. These commands can only be used when the Tag Protocol of the reader is set to ATA (0x001D) using Set Current Tag Protocol (93h). These commands cannot be run when in Bootloader mode, only in Application mode.
ATA Tag Command Set Command Syntax All ATA tag commands follow the same standard syntax. Each command has the following common fields followed by additional fields required for the specific operation being performed: Standard Request Fields Field 96 Value Description TM OpCode 0xXX TM OpCode as defined in ATA Tag Commands Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds.
ATA Tag Command Set Read Tag ID Single (21h) The Read Tag ID Single/Tag Detect command performs a search operation and returns the first ATA tag it finds. Read Tag ID Single Request Fields Field Value Description TM OpCode 0x21 TM OpCode Timeout [2 bytes] Indicates how long the command should spend attempting the operation, in milliseconds.
ATA Tag Command Set ACK Response FF 0A 21 ?? ?? SOH Length OpCode ?? ?? ?? ?? Status ?? ?? Tag ID 00 21 SOH Length OpCode ?? ?? Status ?? ?? CRC No Response FF SOH 00 Length 21 TM OpCode Read Tag ID Multiple (22h) [Not yet implemented] 98 04 00 Status B4 CRC ?? ?? CRC NACK Response FF ?? 83 ??
Gen2 Tag Commands Gen2 Tag Commands The Gen2 tag commands are used to operate on Gen2 tags and perform operations specific to those tags. These commands can only be used when the Tag Protocol of the reader is set to Gen2 (0x0005) using Set Current Tag Protocol (93h). These commands cannot be run when in Bootloader mode, only in Application mode.
Gen2 Tag Commands Tag Singulation/Select Functionality Many of the Gen2 tag commands now support the ability to singulate a specific tag or inventory only tags matching a defined criteria, i.e. matching on values in the EPC, TID and User Memory banks.
Gen2 Tag Commands 0 - Assert (or put in state “A” for inventory flags) the target flag if there IS a match; de-assert (or put in state “B” for inventory flags) the target flag if there IS NOT a match.
Gen2 Tag Commands 1. The Reader issues a Select containing the desired tag memory values and instructions for the tag to assert if its contents matches that specified in the request (and, conversely, de-assert the SL flag if it does not match) as defined by the Tag Singulation Fields. The de-assert will generally have no effect because the deasserted state is the default, but is helpful if tags still have their SL flag asserted from a previous Select.
Gen2 Tag Commands Returns to default state as soon as the tag is no longer energized Its state will often get reset during the course of executing a single command, for example, between inventory rounds, or when there is a frequency hop, or when a new antenna is selected during a Read Tag Multiple search. the result is that when the session is set to ‘0’, all tags will respond to every appropriate Query, considerably lengthening the time to inventory a large population of tags.
Gen2 Tag Commands Read Tag Data (28h) The following fields apply to all the specified commands. Please check each command for exact order, and any exceptions, as they may not all correspond with the order below. Tag Singulation Fields Field Select Option Select Address Values Description 0x00 Select functionality is disabled. First tag found will be the tag operated on. No other Tag Singulation Fields should be specified. Option field must always be specified. 0x01 Select on the value of the EPC.
Gen2 Tag Commands Read Tag Single (21h) The Read Tag Single command will search for a tag for the specified timeout or a single tag is found, whichever comes first. The search criteria is specified using the Tag Singulation Fields. If Option=0x00 is specified it will return with the first tag it finds, otherwise it will only return Success and the found EPC if a tag matching the specified criteria is found. If no tag is read, a fault code is returned.
Gen2 Tag Commands FF M+3 21 SOH Length OpCode 00 00 Status 03 M bytes Option EPC ?? ?? TagCRC ?? ?? CRC Get Tag EPC and Meta Data In addition to getting the tag EPC value returned you can also get Tag Read Meta Data for the found tag. This version of Read Tag Single requires bit 4 of the Option flag to be set and takes an additional Metadata Flags field which defines what metadata will be returned The following table lists the supported values for these fields.
Gen2 Tag Commands Read Tag Single Get EPC and Metadata Request Fields Field Option Value Description Bit 4=0 (0x0X) No Metadata flags are specified and Meta Data will not be returned. This is the Get Tag EPC syntax. The lower bits (X) are specified as defined by Tag Singulation/Select Functionality. Bit 4=1 (0x1X) Indicates that Metadata flags are to follow and the corresponding Metadata shall be returned with the tag EPC.
Gen2 Tag Commands Read Tag Single Get EPC and Metadata Response Fields Field Length Value SOH 1 byte 0xFF Length 1 byte Based on data returned OpCode 1 byte 0x21 Options 1 byte As sent in request Metadata Flags 2 bytes Metadata contained in response Read Count1 1 byte Tag EPC/Antenna Read Count RSSI1 1 byte Return Signal Strength Indicator Antenna ID1 1 byte Antenna ID, 4 MSBs for TX and 4 LSBs for RX Frequency1 3 bytes Frequency in kHz Timestamp1 4 bytes RTC Timestamp RFU1
Gen2 Tag Commands Metadata Flags = 0x0004 OR 0x0010 = 0x0014 with no tag singulation criteria, just return the first tag found, is as follows: FF 05 21 01 SOH Length OpCode E8 10 Timeout 00 Options 14 2F Metadata Flags 6D CRC Here is an example response to the example request specified above.
Gen2 Tag Commands updating the Option field to set the appropriate flag for the tag singulation based on EPC value FF 12 21 SOH Length OpCode 60 11 01 E8 11 Timeout 11 22 22 Options 33 Select Data Length 00 33 44 14 Metadata Flags 44 55 55 66 C E 9F 66 Select Data (EPC) CRC The response contains the requested metadata and the tag EPC matching the requested tag EPC: 22 Ant ID FF 16 21 SOH Length OpCode 0F C8 CD B7 00 00 Status 11 11 00 Options 11 Timestamp
Gen2 Tag Commands Basic Tag Inventory The Read Tag Multiple command performs a search for the specified period of time then returns the number of tags that have been found. Afterwards, multiple Get Tag Buffer commands can be sent to receive the found tag EPCs along with tag read metadata, including the antenna the tag was read on. The command allows the user to specify the method to use when multiple monostatic antennas are connected.
Gen2 Tag Commands Read Tag Multiple Search Flags 2Flag Antenna Usage Value 0x0000 Use single antenna as configured by the most recent Set Antenna command. 1 Automatically search on both monostatic antennas, starting with Antenna 1. The search cycles through antennas moving to the next antenna when no more tags are found on the current antenna. It stops when the search timeout expires. 1 Automatically search on both monostatic antennas, starting with Antenna 2.
Gen2 Tag Commands Tag Inventory with Select If you want to inventory only tags meeting a specific criteria this syntax should be used. The search criteria is specified using the Tag Singulation Fields. If Option=0x00 is specified it will perform the same search as the Basic Tag Inventory syntax. Otherwise, it will return the number of tags found matching the specified criteria. The tag EPCs and Meta Data will be available in the Tag Buffer. If no tags are found, a fault code is returned.
Gen2 Tag Commands 00 00 00 Access Password 00 00 00 00 78 Select Address (bits) 08 66 Select Data Length (bits) Select Data D E C0 CRC Note The Select Options field of the Tag Singulation Fields in the request is specified at the beginning of the command followed by the Search Flags, Timeout, Access Password then the rest of the Tag Singulation Fields. This is different than the typical format for Select fields. Also, this syntax always requires an Access Password be specified.
Gen2 Tag Commands Read Tag Multiple Embedded Command Fields Field Value Description Select Options [1 byte] The Options value of the Tag Singulation Fields Search Flags [2 bytes] Bit 3 of the Read Tag Multiple Search Flags must be set indicating this request contains embedded command(s). Timeout [2 bytes] Indicates how long the command should spend searching AND performing the embedded command.
Gen2 Tag Commands password on each using Write Tag Data (24h) as an embedded command: This command will inventory all tags with an EPC value ending in 0x34, which requires adding the appropriate Tag Singulation Fields to the Basic Tag Inventory syntax then will use Write Tag Data (24h) to write 0x12345678 into the Reserved Memory Bank starting at Word address 0x00000002 (Access Password) FF 1E 22 04 00 SOH Length OpCode Options (EPC Mem) 04 Search Flags 03 01 0C 24 Embd Cmd Count Embd Cmd L
Gen2 Tag Commands FF M+4 SOH 23 Length OpCode 03 E8 1 Timeout (ms) 00 00 2 3 RFU M bytes ?? CRC 4 RFU ?? Tag EPC (M bytes) 1.16-bit timeout value in milliseconds. Due to tag difference some tags may require more time to write than others. Experimentation may be required to determine the optimal timeout. 2.Reserved for Future Use, this field is required but ignored. 3.Reserved for Future Use, this field is required but ignored 4.
Gen2 Tag Commands location doesn’t exist or is unwriteable, or the Select criteria cannot be satisfied a fault code is returned. In addition to the Tag Singulation Fields the Write Tag Data command takes several fields which specify the data which will be written to the tag.
Gen2 Tag Commands Write Tag Data Fields Field Value Write Address Description 4 bytes The Address field is the offset in the specified Memory Bank, in 16-bit words, where the contents of the Data field is written. It corresponds to the WordPtr argument in the Gen2 specification. Note: Addresses are always zero-based. Specifying 0x00 indicates starting at the first address location. Write MemBank 1 byte The MemBank field specifies which of the tag’s memory banks the data is to be written to.
Gen2 Tag Commands If Option=0x00 or 0x01 is used then the unused Tag Singulation Fields must be removed from the request. Note If Option=00, the write tag data is performed without any select criteria resulting the first tag found being written. In that case there is no way to determine what tag gets written to unless there is only one tag in the RF field. Lock Tag (25h) The Lock Tag command locks the specified memory bank of a tag.
Gen2 Tag Commands memory bank (Action Bits) and which of those behaviors to apply (Mask Bits).
Gen2 Tag Commands specified, it will attempt to kill the first tag it finds. If no tag is in the field, the kill password is zero, or the Select criteria cannot be satified a fault code is returned. In addition to the Tag Singulation Fields the Kill command takes the tag’s Kill Password and an extra 1 byte field for future use (RFU).
Gen2 Tag Commands Read Tag Data Fields Field Value Description Read MemBank 1 byte The MemBank field specifies which of the tag’s memory banks the data is to be read from. The values correspond to the Memory Bank values as specified in the Gen2 specification. They are: 0x00 = Reserved 0x01 = EPC 0x02= TID 0x03 = User Memory Read Address 4 bytes The Address field is the offset in the specified Memory Bank, in 16-bit words, to start reading from.
Gen2 Tag Commands Get Tag Data The following example will attempt to read the Kill Password (the first 2 words) from Reserved Memory. It will read this data from a tag matching the following criteria for a max timeout of 1000 ms. Memory Bank = User Memory.
Gen2 Tag Commands Read Tag Data Get Data and Metadata Request Fields Field Option Value Description Bit 4=0 (0x0X) No Metadata flags are specified and Meta Data will not be returned. This is the Get Tag Data syntax. The lower bits (X) are specified as defined by Tag Singulation/Select Functionality. Bit 4=1 (0x1X) Indicates that Metadata flags are to follow and the corresponding Metadata shall be returned with the tag EPC.
Gen2 Tag Commands Read Tag Data Get Data and Metadata Response Fields Field Length Value SOH 1 byte 0xFF Length 1 byte Based on data returned OpCode 1 byte 0x21 Options 1 byte As sent in request Metadata Flags 2 bytes Metadata contained in response Read Count1 1 byte Tag EPC/Antenna Read Count RSSI1 1 byte Return Signal Strength Indicator Antenna ID1 1 byte Antenna ID, 4 MSBs for TX and 4 LSBs for RX Frequency1 3 bytes Frequency in kHz Timestamp1 4 bytes RTC Timestamp RFU1
Gen2 Tag Commands The Reserved Memory bank is not locked so the Access Password is zero FF 15 28 03 E8 14 00 14 00 SOH Length OpCode Timeout (ms) Option Meta Data Flags Read MemBank 00 00 00 78 Select Address 00 00 00 02 Read Address 08 34 Select Data Length Select Data 9C 02 00 WordCount 00 00 00 Access Password 0E CRC The response to this Read Data command example is: FF 0C 28 SOH Length OpCode 00 00 Status 14 Option 00 14 Meta Data Flags 22 00 Antenna
Gen2 Tag Commands Alien Higgs Sub Commands Alien Higgs Command Sub Command value 0x01 Partial Load Image 0x03 Full Load Image Partial Load Image Sub Command=0x01 If the first bit of Sub Command is 1 (Sub Command=0x01), the Gen2 Tag Specific command writes an EPC with a length of up to 96-bits, plus the Kill and Access passwords without locking in a single command.
Gen2 Tag Commands Bits) and the Alien Higgs PC Bits.
Gen2 Tag Commands Alien Higgs PC Bits Bit Number 15 14 Field Name 13 12 11 PC Bits Default Values X 5 0 X X 4 3 NSI Bits 0 0 X X 10 9 RFU RFU 0 0 2 1 0 0 0 0 8 7 6 0 0 0 The PC Word in the Write Tag Specific command allows you to specify the NSI Bits and the length of the EPC that you want to write into the tag. The RFU bits are always zero and the PC Bits are determined by the EPC length as specified in the Gen2 Specification and the Higgs Tags Application Notes.
Gen2 Tag Commands Bit Number Action 2 1 0 0 0 0 Invalid Value 0 0 1 Gen2 Tag Specific without locking and without NSI bits being overwritten 0 1 0 Invalid Value 0 1 1 Gen2 Tag Specific with locking and without NSI bits being overwritten 1 0 0 Invalid Value 1 0 1 Gen2 Tag Specific without locking and with NSI bits being overwritten by zeros 1 1 0 Invalid Value 1 1 1 Gen2 Tag Specific with locking and with NSI bits being overwritten by values that you specify NXP Silicon
Gen2 Tag Commands NXP Common Fields Field Value Length 1 byte OpCode 0x2D Timeout 2 bytes Option 0x02 for NXP Sub Command NXP Sub Commands Access Password 4 bytes, tag’s access password Note: Must be non-zero for Set/ Reset ReadProtect and Change EAS Note: EAS Alarm does not take the Access Password field. In addition to the common fields some commands have additional required fields as indicated below.
Gen2 Tag Commands Reset ReadProtect The NXP command Reset ReadProtect restores normal operation to a tag which is in ReadProtect mode.
Gen2 Tag Commands Divide Ratio as Per Gen2 (DR) (1 byte: Current fixed to 0x01, M5e and M5e-C only support DR=64/3) Miller Cycles (M) (1 byte: Current fixed to 0x02, M5e and M5e-C only support M=4) TrExt as Per Gen2 (1 byte: Current fixed to 0x01, M5e and M5e-C only support extended Pilot Tone) It is invoked with the following command: FF 07 2D SO H Length 03 OpCode E8 Timeout (ms) ? ? 02 04 01 02 01 Chip Type Sub Command DR M TrEx t ? ? CRC The response to the EAS Alarm comman
Gen2 Tag Commands Note If the tag is a G2XL without User Memory the Calibrate Data response field will contain 64 bytes of ‘00’.
Gen2 Tag Commands Erase Block Tag Specific (2Eh) The Erase Block Tag Specific command is used for Tag specific block erases.
Get Configuration Commands Get Configuration Commands The Get commands listed in the following table are used to get settable parameters from the Mercury Embedded module. All of the commands have a data length of zero, and return data or a fault code. These commands cannot be run in the Bootloader.
Get Configuration Commands Get Hardware Version (10h) The Get Hardware Version command is used to get information about the module it is executed on. Most of the information is not currently user-relavant but will often be required by ThingMagic Support to help diagnose problems. Get Hardware Version Fields Field Value Option Description 0x00 Indicates the Data Flags will following specifying the information to be returned 0x01 M6e-TC Only - Indicates the FPGA TM and TC versions should be returned.
Get Configuration Commands Get Antenna Configuration (61h) The Get Antenna Configuration command returns the current antenna configuration including which antennas are set to transmit and receive, and which ports have antennas attached. Reliable antenna detection requires that an attached antenna pass at least a small amount of DC current. Many antennas do not pass DC current.
Get Configuration Commands FF 05 61 00 SOH Length OpCode 00 Status 01 01 00 ?/ TX Ant Num RX Ant Num Port 1 Not Connected ?? CRC Get Read TX Power (62h) The Get Read TX Power command returns the current TX power and, optionally, the minimum and maximum power levels supported by the module (and region setting) for reading tags, in centi-dBm. The option field allows you to specify what data you want returned: Option Data returned 0x00 Returns only the current TX power.
Get Configuration Commands Tag Protocol IDs Protocol Name 16-bit Code None Selected 0x0000 EPC0 / EPC0+ Matrics 0x0001 EPC1 0x0002 ISO 18000-6B 0x0003 EPC0+ Impinj 0x0004 GEN2 0x0005 UCODE 0x0006 iPico 0x0007 eGo 0x001B SeGo 0x001C ATA 0x001D Allegro/Title-21 0x001E The command format is shown in the following example: FF 00 63 SOH Length OpCode 1D 6C CRC Note The supported protocols vary depending on the hardware and firmware in use.
Get Configuration Commands Get Write TX Power (64h) The Get Write TX Power command returns the current TX power and, optionally, the minimum and maximum power levels supported by the module for reading tags, in centidBm. The option field allows you to specify what data you want returned: Option Data returned 0x00 Returns only the current TX power. 0x01 Returns the current TX power and the maximum and minimum power levels for this module.
Get Configuration Commands FF 00 65 1D SOH Length OpCode 6A CRC The reply format is similar to the Set Frequency Hop Table command. The length must be set to a multiple of four, and a maximum of 62 hop frequencies is returned. The frequencies are returned in kHz.
Get Configuration Commands Region codes Region Code NA 0x01 PRC 0x06 EU3 0x08 KR2 0x09 Open 0xFF To get the current region send the following command: FF 00 67 SOH Length OpCode 1D 68 CRC The command generates the following reply, which indicates that the reader is set to the NA region: FF 01 67 SOH Length OpCode 00 00 Status 01 Region B4 80 CRC Get Power Mode (68h) The Get Power Mode command returns the current Power Mode of the unit.
Get Configuration Commands Note If Set Power Mode (98h) is called using the USB interface and mode 0x03 is specified the module will instead be set to 0x02. In order to set the module to mode 0x03 the command must be called using the RS232 interface.
Get Configuration Commands FF 00 69 1D SOH Length OpCode 66 CRC The example reply shows the current user mode setting: FF 01 69 SOH Length OpCode 00 00 Status 01 97 User Mode 8F CRC Get Reader Configuration(6Ah) The Get Reader Configuration command returns the current reader configuration for the setting specified by the key field as defined in Set Reader Configuration(9Ah) when using Option=0x01. When using Option=0x00 it will use the previous format of the command.
Get Configuration Commands FF 02 6B 05 00 3A SOH Length OpCode Protocol Parameter 6F CRC The example reply shows the Gen2 session is set to S2 (0x02): a FF 03 6B SOH Length OpCode 00 00 Status 05 00 02 Protocol Parameter Value 08 76 CRC Get Reader Statistics (6Ch) The Get Reader Statistics command allows the user to get and reset various statistics on the reader operation.
Get Configuration Commands Available Statistics Statistics Flag Bit Bit 0 (0x01) Statistic RF On Time (ms)- Indicates the aggregate time the transmitter has been on, in milliseconds, since the counter was last reset. Returned value contains 8 bytes (4 on the M5e-Compact), 4 bytes for each antenna. Note: Clock rolls over every 232 milliseconds and must be taken into account by user application.
Get Configuration Commands Get Statistics Response Fields Field Description Status (2 bytes) Standard response status Option (1 byte) Same as the Requested Value Requested Statistics Flag (1 byte) Same as the Requested Value For each individual statistics requested as part of the Requested Statistics Flag the following fields will be repeated according to the Statistics Response value. They will be in bit value order. Statistic Flag (1 byte) The bit corresponding to the requested statistic.
Get Configuration Commands Get Available Protocols (70h) The Get Available Protocols command returns the list of protocols that the reader is capable of reading. The protocol codes are defined in Get Current Tag Protocol (63h). The total number of protocols in the system cannot exceed 32.
Get Configuration Commands Get Current Temperature (72h) The Get Current Temperature command returns the current board component temperature on the module in degrees Celsius as a signed 8-bit integer. This information can be used to determine if the module is exceeding its recommended operating temperature range. If the returned value exceeds the values specified in the table below an effort should be made to reduce the ambient temperature of the module or reduce the module’s duty cycle.
Set Configuration Commands Set Configuration Commands The Set commands are used to set configurable values in the firmware. Since the values are not stored in flash, these values are reset to the default values whenever the application firmware is restarted. These commands cannot be run in the Bootloader. The application responds with a fault code / ACK to all commands.
Set Configuration Commands Set Antenna Port (91h) The Set Antenna Port command sets the antenna port to the number specified. The transmitter and receiver ports are specified, currently on port 0x01 is supported on the M6e-TC. Each antenna port is an 8-bit value set up as a bit mask. Thus, only one of the eight bits should be set at a time. The example below sets both antennas to bit mask 0x01, which would correspond to the first antenna in the system.
Set Configuration Commands Set Current Tag Protocol (93h) To select a protocol, send the Set Current Tag Protocol code to the reader. A table of valid protocol codes is found in Get Current Tag Protocol (63h). The following example sets the protocol to GEN2: FF 02 93 SOH Length OpCode 00 05 Current Protocol 51 7D CRC Only protocols that are enabled in the reader are available.
Set Configuration Commands Note The data length of this message encodes the number of frequencies to populate into the hop table. The length must be divisible by four for the message to be properly formatted. This example shows a command that sets up a table with only three values: FF 0C 95 00 SOH Length OpCode 0D C3 70 00 0D Freq #1 F6 38 00 Freq #2 0E 26 Freq #3 12 C1 8F CRC The generated hop table has values of 902MHz, 915MHz, and 927.25MHz.
Set Configuration Commands This example sets the GPIO Output #1 to ‘1’ (high). To get the current status of the GPIO output pins, send the same command, with the length set to 0: FF 00 96 1D SOH Length OpCode 99 CRC The response looks similar to the Get User GPIO Inputs command: FF 02 96 SOH Length OpCode 00 00 Status 00 01 Output #1 Output #2 29 E0 CRC Set Current Region (97h) The Set Current Region command sets the current region for use in the reader.
Set Configuration Commands FF 01 97 03 4B SOH Length OpCode Region BE CRC The extended syntax allowing the region code plus LBT Enabled (if supported by Region) to be set. For example, to set the Region to EU3 and Enable LBT: FF 02 97 08 01 SOH Length OpCode Region LBT Enable 19 FD CRC Note When LBT is disabled in the Open region the M6e-TC will implement frequency hopping as implemented for the NA region with a frequency hop interval of 400ms.
Set Configuration Commands Set User Mode (99h) Use the Set User Mode command to set the user mode to the type of application in which the M6e-TC will be configured for the optimal Search Strategy settings for a particular protocol. Send the following to set the user mode to printer: FF 01 99 01 SOH Length OpCode User Mode 45 BC CRC The list of user modes and their corresponding session are found in Available User Modes.
Set Configuration Commands Available Configuration Options Option Key Value Reader Configuration setting 0x00 Indicates the deprecated format of this command will be used. 0x01 Maximum EPC Length = 0x02 0x00 Maximum EPC length of 96 bits (Default) 0x01 Maximum EPC length of 496 bits Record the highest RSSI seen = 0x06 0x00 The RSSI Tag Read Meta Data value is the value for the last read tag for each tag buffer entry when this is Disabled.
Set Configuration Commands Protocol Configuration Settings Protocol Value 0x05 (Gen2) Parameter Option Gen2 Session used for Inventory commands. (0x00) Value N/A 0x00 (S0 - Default) 0x01 (S1) 0x02 (S2) 0x03 (S3) Gen2 Q Value (0x12) 0x1B (eGo) n/a 0x1C (SeGo) n/a 0x1D (ATA) n/a 0x1E(Allegro/Title-21) n/a Dynamic (0x00) Automatically adjust Q value. N/A Static (0x01) - User specified Q Value between 0 and 15.
Set Configuration Commands Set Q Value The Q valued can be set to a static user specified value or to dynamically change based on ThingMagic internal algorithms. When using the dynamic Q setting the Value parameter is dropped in the command.
Regulatory Test Commands Regulatory Test Commands The following OpCodes are used for test purposes including regulatory certification testing. These commands cannot be run in the Bootloader. Note Set Power Mode to Full 0x00 before running regulatory test commands.
Regulatory Test Commands Set Operating Frequency (C1h) The Set Operating Frequency command takes a 32-bit frequency value, expressed in kHz. For instance, to set the frequency to 915.26MHz, send the data value 915260 (0x000D F73C) to the reader. FF 04 C1 SOH Length OpCode 00 0D F7 3C F3 Freq to Set B7 CRC Transmit CW Signal (C3h) The Transmit CW Signal command turns the Continuous Wave (CW) signal On or Off or enables a PRBS signal.
Regulatory Test Commands Get Operating Frequency (C8h) The Get Operating Frequency command returns the currently operating frequency, as set by Set Operating Frequency (C1h) for testing. The operating frequency is returned as a 32-bit value, expressed in kHz. For instance, for the frequency 915.26MHz, the value 0x000D F73C will be returned.
Appendix A: Hardware Details This Appendix details the mechanicals for the M6e-TC including the pin 1 location for the serial connector. Mechanicals The following figures detail the hardware layout of the M6e-TC Module.
Mechanicals M6e-TC Mechanicals Antenna Connector The M6e-TC has one MMCX connector for interfacing to the antenna.
Mechanicals Communications Connector The communications interface on the module provides power, serial communications signals, and access to the GPIO inputs and outputs. The M6e-TC has a 14-pin connector. For the interface pin-out, see M6e-TC Digital Connectors. The following figure shows a diagram of the M6e-TC communications interface as you face the boards.
Mechanicals 168 Appendix A: Hardware Details
Appendix B: Using the ArbSer Application This appendix explains how to use the ArbSer application. This application provides some simple commands for using the Mercury embedded modules to read tags. The ArbSer program is a simple terminal program with which you can communicate with the M4e, M5e, M5e-C, and M6e-TC modules. It provides several pre-formed commands, as well as a raw message interface that can be used to generate any command.
-msg xx xx xx ... – Send properly formatted msg (appends SOH and CRC). -raw xx xx xx ... – Send raw hexadecimal msg (illegal msgs possible). -ver – Returns the version information. When using ArbSer, the serial port and baud rate can be changed from the default of COM1 and 9600 bps. Then, one of the options must be selected. The most useful ones are ‘-go’, ‘-msg’, and ‘-ver’. These commands provide the ability to exercise every feature of the modules.
Get Version Command When the unit is first powered up, the boot loader is running. Verify that the module is alive by sending a Get Version command: C:\> ArbSer –ver < Equivalent to: FF 00 03 1D 0c > Valid message received: Data Length = 14 OpCode = 03 Status = 00 00 Data[000] = 03 Data[001] = 01 Data[002] = 00 Data[003] = 05 Data[004] = FF Data[005] = FF Data[006] = FF Data[007] = FF Data[008] = 20 Data[009] = 04 Data[010] = 11 Data[011] = 03 Data[012] = 03 Data[013] = 01 Data[014] = 00 Data[015] = 06 Data
Data[017] = 00 Data[018] = 00 Data[019] = 07 CRC = 42EA The module returns its version information. In the previous example, the version number shows the following: Boot loader version #3.1.5 Application FW build date: 11/03/2004 Application FW version #3.1.6 3 protocols enabled (EPC0, EPC1, ISO18000-6B). Boot Firmware Command Next, send a Boot Firmware command: C:\> ArbSer –go < Equivalent to: FF 00 04 1D 0B > 172 Appendix B: Using the ArbSer Application
Valid message received: Data Length = 14 OpCode = 04 Status = 00 00 Data[000] = 03 Data[001] = 01 Data[002] = 00 Data[003] = 05 Data[004] = FF Data[005] = FF Data[006] = FF Data[007] = FF Data[008] = 20 Data[009] = 04 Data[010] = 11 Data[011] = 03 Data[012] = 03 Data[013] = 01 Data[014] = 00 Data[015] = 06 Data[016] = 00 Data[017] = 00 Data[018] = 00 Data[019] = 07 CRC = 4B6A Appendix B: Using the ArbSer Application 173
This returns the same version information as the -ver command previously documented. Now that the application FW has been started, the reader is ready to accept protocol commands. To read an EPC0 tag, place the tag about one foot away from the antenna. Then send the following series of commands. Set Current Region Command Before you can start reading tags with the M5e, M5e-C and M6e-TC, you must set the region in which the reader resides.
Set Current Tag Protocol Command When the application FW first starts, there is no default protocol loaded. Thus, the protocol to use must be specified. For this example, the protocol is set to EPC0 using the Set Current Tag Protocol command: C:\> ArbSer –msg 02 93 00 01 < Equivalent to: FF 02 93 00 01 51 79 > Valid message received: Data Length = 00 OpCode = 93 Status = 00 00 CRC = 371A Set Read TX Power Command The default read power setting for the modules is 26.5 dBm.
read tags. For example, to use a one-port configuration that uses only port 1, use the Set Antenna Port command: C:\> ArbSer –msg 02 91 01 01 < Equivalent to: FF 02 91 01 01 70 3B > Valid message received: Data Length = 00 OpCode = 91 Status = 00 00 CRC = 1758 Finally, the module is ready to execute a read command. The timeout for the read can be set anywhere from 0 ms to 65,536 ms.
C:\> ArbSer –msg 02 21 03 E8 < Equivalent to: FF 02 21 03 E8 D5 09 > Valid message received: Data Length = 0E OpCode = 21 Status = 00 00 Data[000] = 12 Data[001] = 34 Data[002] = 56 Data[003] = 78 Data[004] = 9A Data[005] = BC Data[006] = DE Data[007] = F0 Data[008] = AA Data[009] = BB Data[010] = CC Data[011] = DD Data[012] = 23 Data[013] = 79 CRC = 2384 The module should now return the tag ID of the tag.
Unexpected Results Sometimes you do not get the results that you expected. The following sections explain some problems that can occur when the previously listed sequence of commands are used. The following sections explain some of the frequently encountered errors. Serial Communication Does Not Work If serial communications fails to work using the ArbSer command, check the following: The baud rate is correct.
Send a Boot Firmware command to verify that the application FW is running. If the boot loader is currently running, then a set command will return a 0x0101 status code, indicating an invalid OpCode. The parameter(s) to the set command are invalid. If an invalid parameter is sent, then a 0x0105 status code is returned, indicating an invalid parameter value. If the wrong number of data elements is used, then a 0x0100 status code (wrong number of data) is returned.
Appendix B: Using the ArbSer Application
Appendix C: Error Messages The following error codes were incorporated into the reader for help in locating errors. Common Error Messages The following table lists the common faults discussed in this section.
Common Error Messages Solution Make sure the number of arguments matches the data length. FAULT_INVALID_OPCODE – (101h) Cause The opCode received is invalid or not supported with the current version of code. Solution Check the documentation for the opCode the host sent and make sure it is supported. FAULT_UNIMPLEMENTED_OPCODE – 102h Cause Some of the reserved commands might return this error code.
Common Error Messages Solution Check the HW specifications for the supported powers and insure that the level is not exceeded. The M5e 1 Watt units support power from 5 dBm to 30 dBm. The M5e-Compact units support power from 10 dBm to 23 dBm. FAULT_MSG_INVALID_FREQ_RECEIVED (104h) Cause A message was received by the reader to set the frequency outside the supported range Solution Make sure the host does not set the frequency outside this range or any other locally supported ranges.
Common Error Messages Solution Check the HW specifications for the supported powers and insure that level is not exceeded. The M5e supports powers between 5 and 30 dBm. The M5e-Compact units support power from 10 dBm to 23 dBm. FAULT_UNIMPLEMENTED_FEATURE - (109h) Cause Attempting to invoke a command not supported on this firmware or hardware. Solution Check the command being invoked against the documentation.
Bootloader Faults Bootloader Faults The following table lists the common faults discussed in this section. Fault Message Code FAULT_BL_INVALID_IMAGE_CRC 200h FAULT_BL_INVALID_APP_END_ADDR 201h FAULT_BL_INVALID_IMAGE_CRC – 200h Cause When a Verify Image CRC (0x08), or Boot Firmware (0x02) command is issued, the reader checks the image stored in flash and returns this error if the calculated CRC is different than the one stored in flash.
FPGA Faults FPGA Faults The following table lists the common faults discussed in this section.
FPGA Faults FAULT_PROGRAM_VERIFY_FAILED – 2E2h Cause When a boot firmware (0x02) is issued during an FPGA image load and the verification of the FPGA FlashROM pages fails. Solution Power cycle the module and reload the FPGA load application and FPGA image. If problem persists try a previous version of the FPGA Load Image application with the same DAT file.
Flash Faults Flash Faults The following table lists the common faults discussed in this section.
Flash Faults Solution Make sure that you have the correct password for the flash sector. Check the Write Flash Sector (0Dh) for more information about the flash passwords and sectors. FAULT_FLASH_UNDEFINED_ERROR – 302h Cause This is an internal error and it is caused by a software problem in module. Solution Contact support at support@thingmagic.com. FAULT_FLASH_ILLEGAL_SECTOR – 303h Cause An erase or write flash command was received with the sector value and password not matching.
Flash Faults FAULT_FLASH_WRITE_TO_ILLEGAL_SECTOR – 305h Cause The module received a write flash command to write across a sector boundary that is prohibited. Solution If the data spans two sectors, separate the data into two messages. FAULT_FLASH_VERIFY_FAILED – 306h Cause The module received a write flash command that was unsuccessful because data being written to flash contained an uneven number of bytes. Solution Verify that the data being sent is an even number of bytes.
Protocol Faults Protocol Faults The following table lists the common faults discussed in this section.
Protocol Faults FAULT_NO_TAGS_FOUND – (400h) Cause A command was received (such as like read, write, or lock) but the operation failed. There are many reasons that can cause this error to occur. Here is a list of possible reasons that could be causing this error: No tag in the RF field Read/write power too low Antenna not connected Tag is weak or dead Solution Make sure there is a good tag in the field and all parameters are set up correctly.
Protocol Faults Solution This value is invalid or this version of SW does not support the protocol value. Check the documentation for the correct values for the protocols in use. FAULT_WRITE_PASSED_LOCK_FAILED – 403h Cause During a Write Tag Data for ISO18000-6B or UCODE, if the lock fails, this error is returned. The write command passed but the lock did not. This could be a bad tag. Solution Try to write a few other tags and make sure that they are placed in the RF field.
Protocol Faults FAULT_PROTOCOL_WRITE_FAILED – 406h Cause This fault can occur when an operation such as write, lock, kill, set password, or initialize, fails. There are many reasons for failure. Solution Check that the tag is good and try another operation on a few more tags. FAULT_NOT_IMPLEMENTED_FOR_THIS_PROTOCOL – 407h Cause A command was received which is not supported by a protocol. Solution Check the documentation for the supported commands and protocols.
Protocol Faults Solution Make sure that the address specified is within the scope of the tag data address space and available for the specific operation. The protocol specifications contain information about the supported addresses. FAULT_GENERAL_TAG_ERROR – 40Ah Cause This error is used by the M5e GEN2 module. This fault can occur if the read, write, lock, or kill command fails. This error can be internal or functional.
Protocol Faults FAULT_PROTOCOL_KILL_FAILED - 40Eh Cause Attempt to kill a tag failed for an unknown reason Solution Check tag is in RF field and the kill password. FAULT_PROTOCOL_BIT_DECODING_FAILED - 40Fh Cause Attempting to operate on a tag with an EPC length greater than the Maximum EPC length setting. Solution Call Set Reader Configuration(9Ah) to set the Max EPC to 496 bits.
Protocol Faults Solution Check the data that is being passed in the command resulting in this error.
Analog Hardware Abstraction Layer Faults Analog Hardware Abstraction Layer Faults FAULT_AHAL_INVALID_FREQ – 500h Cause A command was received to set a frequency outside the specified range. For example, in North America the frequency range is from 902 MHz to 928 MHz. Solution Check the values you are trying to set and be sure that they fall within this range. FAULT_AHAL_INVALID_FREQ – 501h Cause With LBT enabled an attempt was made to set the frequency to an occupied channel.
Analog Hardware Abstraction Layer Faults FAULT_ANTENNA_NOT_CONNECTED – 503h Cause An attempt was made to transmit on an antenna which did not pass the antenna detection when antenna detection was turned on. Solution Connect a detectable antenna (antenna must have some DC resistance). FAULT_TEMPERATURE_EXCEED_LIMITS – 504h Cause The module has exceeded the maximum or minimum operating temperature and will not allow an RF operation until it is back in range.
Tag ID Buffer Faults Tag ID Buffer Faults The following table lists the common faults discussed in this section. Fault Message Code FAULT_TAG_ID_BUFFER_NOT_ENOUGH_TAGS_AVAILABLE – 600h 600h FAULT_TAG_ID_BUFFER_FULL – 601h 601h FAULT_TAG_ID_BUFFER_REPEATED_TAG_ID – 602h 602h FAULT_TAG_ID_BUFFER_NUM_TAG_TOO_LARGE – 603h 603h FAULT_TAG_ID_BUFFER_NOT_ENOUGH_TAGS_AVAIL ABLE – 600h Cause A command was received to get a certain number of tag ids from the tag id buffer.
Tag ID Buffer Faults FAULT_TAG_ID_BUFFER_REPEATED_TAG_ID – 602h Cause The module has an internal error. One of the protocols is trying to add an existing TagID to the buffer. Solution Report this problem to ThingMagic at http://support.thingmagic.com. FAULT_TAG_ID_BUFFER_NUM_TAG_TOO_LARGE – 603h Cause The module received a request to retrieve more tags than is supported by the current version of the software.
System Errors System Errors FAULT_SYSTEM_UNKNOWN_ERROR – 7F00h Cause The error is internal. Solution Make note of the operations you were executing and contact ThingMagic at http:// support.thingmagic.com. FAULT_TM_ASSERT_FAILED – 7F01h Cause An unexpected Internal Error has occurred. Solution This error will cause the module to switch back to Bootloader mode. When this occurs, make note of the operations you were executing, save FULL error response, and contact ThingMagic at support@thingmagic.com.
Appendix D: FPGA Support This appendix explains how to create and update Field Programmable Gate Array (FPGA) images for the M6e-TC. Creating an FPGA Image DAT File Creating an FPGA Image DAT file requires the use of an Actel programming environment. In the following instructions the use of Libero 8.4 is assumed. The process for other Libero versions or Actel programming environments may vary. This process assumes Verilog files have been pre-compiled and you are at the compiling stage.
Creating an FPGA Image DAT File 204 1. Generate the STAPL file - When generating output from Designer make sure to select the STAPL files option for the Output files to be generated as shown below. 2. Generate the DAT file - Once the *.stp file has been generated it can be fed into the datgen.exe utility to generate the .dat file. datgen must be run from the command line.
Creating an FPGA Image DAT File Note: Datgen.exe only seems to run on a local drive; operating datgen.exe from a network mapped drive may fail. Typical output, using the STAPL file: tm_fpga_top.stp file as its input, is shown below: C:\>datgen tm_fpga_top.stp DirectC Version 2.x Copyright (C) 2002 - 2007 Actel Corporation Checking STAPL file CRC value.. Actual CRC = 7D55 Reading STAPL file... Generating .dat files...
Creating an FPGA Image DAT File W A R N I N G ! When loading an FPGA Image onto the M6e-TC, the Verification process checks the 16 most significant bits of the FPGA TM and TC version numbers. To pass, the TM and TC versions must start with 0x1234xxxx and 0x0010xxxx, respectively. When incrementing version numbers in the Verilog/VHDL files be sure to only change the 16 least significant bits.
Loading an FPGA Image Loading an FPGA Image The ArbSer (see Appendix B: Using the ArbSer Application) program can also be used to load FPGA images. In order to load an FPGA image the following files are required: Arbser.exe - minimum version 3.2.0. m6etc_fpga_mod.sim - FPGA load application image to be loaded into the M6e-TC which will be used to update the FPGA image defined by the FPGA Image file. FPGA Image file - FPGA image file in DAT format to be loaded into the M6e-TC FPGA.
Loading an FPGA Image 208 Appendix D: FPGA Support
