Frame Examples¶
Interrogator Module Configuration¶
0x03 Get Interrogator module information¶
Get module information: hardware version, software version or manufacturer information.
Instruction Code: 0x03
Command Parameter:
Hardware version: 0x00
Software version: 0x01
Manufacturer: 0x02
Response Parameter:
First byte will be the same as the command parameter.
Next bytes will be the hardware module name and version in ASCII encoding.
Command to get the hardware version¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
03 |
00 01 |
00 |
04 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
03 |
00 0B |
00 4D 31 30 30 20 56 31 2E 30 30 |
22 |
7E |
The response parameter starts with 0x00, corresponding to the command parameter. The next bytes are 4D 31 30 30 20 56 31 2E 30 30, which is ASCII code of “M100 V1.00”
0x11 Set communication baud rate¶
The baud rate in the parameter is the actual baud rate divided by 100. For this example, the target baud rate is 19200, so the value is 19200 / 100 = 192 = 0xC0.
Command¶
H |
Type |
CMD |
PL |
Baud rate |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
11 |
00 02 |
00 C0 |
D3 |
7E |
No Response Frame¶
There is no response frame for this instruction. After the Interrogator has changed the communication baud rate, the Host Computer will need to reconnect to the Interrogator with the new baud rate.
0x17 Module Sleep¶
The module sleep command allows the Interrogator to maintain a low-power sleep mode. The Host Computer can wake the Interrogator up by sending any byte through the serial port, but the data will be discarded.
The first command received after the module sleeps will not respond because the first character of the first command will Was abandoned. This command will reset the M100/QM100 chip after power-off. After the module wakes up, it will re-download the firmware to the M100/QM100 chip and reset some parameters to the module (these parameters include the power, frequency, and frequency hopping configured before sleep Mode, sleep time, receiver demodulator parameters, excluding Select mode, Select parameters, etc.), so some parameters may need to be reset. The instructions are as follows:
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
17 |
00 00 |
17 |
7E |
Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
17 |
00 01 |
00 |
19 |
7E |
0x1D Module Idle sleep time¶
This command can set how long the module will automatically enter the sleep state after no operation. After the module sleeps, it can wake up by sending any character through the serial port. After the module sleeps, the first command received will not respond because the first character of the first command will be discarded. This command will reset the M100/QM100 chip. After the module wakes up, it will re-download the firmware to the M100/QM100 chip and reset some parameters to the module (these parameters include the power, frequency, and frequency hopping mode configured before sleep. Sleep time, receiver demodulator parameters, excluding Select mode, Select parameters, etc.), so some parameters may need to be reset.
The parameter define number of minutes of inactivity before sleep. The range is 1 to 30 minutes. 0x00 means no sleep.
Command¶
To set the idle sleep time to two minutes:
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
1D |
00 01 |
02 |
20 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
1D |
00 01 |
02 |
21 |
7E |
0x04 Module Idle mode¶
This command allows the module to enter IDLE working mode. In IDLE mode, except for the digital part and communication interface, all other analog and RF parts of the power supply are turned off to reduce power consumption when not working. After the module enters the IDLE mode, it can still communicate with the module normally, the set parameters are still saved, and the module can normally respond to the instructions of the Host Computer. After entering IDLE mode, the first inventory (or instructions that require interaction with tags such as reading or writing tag data) will restore the module to its normal state, but the first inventory may be successful due to the unstable power state of the RF part The rate drops, and subsequent inventory and other operations can return to normal.
First parameter: 0x00: Exit Idle Mode, 0x01: Enter Idle Mode
Second Parameter: Reserved as 0x01
Idle Mode Time: Number of minutes before entering Idle mode. The value ranges from 0x00 to 0x1E (30 Minutes). 0x00 means never enter Idle mode.
Command¶
To set the idle mode time to three minutes:
H |
Type |
CMD |
PL |
Enter |
Reserved |
Idle Time |
CRC |
End |
|---|---|---|---|---|---|---|---|---|
BB |
00 |
04 |
00 03 |
01 |
01 |
03 |
20 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
04 |
00 01 |
00 |
06 |
7E |
Inventory Commands¶
0x22 Single Inventory¶
Complete an inventory operation in the EPC Class1 Gen2 protocol. The instruction does not include the Select operation. The power amplifier will be turned on and off automatically before and after each inventory command is executed. In the single inventory command, the Query operation parameter is configured by another command, and the initial value is already in the firmware.
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
22 |
00 00 |
22 |
7E |
Notification¶
After the Interrogator receives a single inventory command, if it can read the tag with the correct CRC check, the Interrogator will return the data including RSSI, PC, EPC and CRC.
The Interrogator will return one notification frame for each of the successfully read Tag.
H |
Type |
CMD |
PL |
RSSI |
PC |
EPC |
CRC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
02 |
22 |
00 11 |
C9 |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
3A 76 |
EF |
7E |
The RSSI value reflects the size of the signal at the input of the chip, excluding antenna gain and directional coupler attenuation. RSSI is the signal strength at the input end of the chip, signed in hexadecimal, and the unit is dBm. In the above example, the RSSI is 0xC9, which means the signal strength at the input of the chip is -55dBm.input end of the chipinput end of the chip
0x15 Error Response¶
If no tag is detected or the data CRC error is detected, the parameter value will be error code 0x15:
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
15 |
16 |
7E |
0x27 Multiple Inventory¶
Command¶
Inventory multiple times, and the number of polling times is limited to 0-65535. If the number of polling is 10000 times, the command is as follows:
H |
Type |
CMD |
PL |
Reserved |
CNT |
CRC |
End |
|---|---|---|---|---|---|---|---|
BB |
00 |
27 |
00 03 |
22 |
27 10 |
83 |
7E |
0x2710 = 10,000.
Notification¶
The multiple inventory response frame is the same as the single inventory response frame:
H |
Type |
CMD |
PL |
RSSI |
PC |
EPC |
CRC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
02 |
22 |
00 11 |
C9 |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
3A 76 |
EF |
7E |
0x15 Error Response¶
If no tag is detected or the data CRC error is detected, the parameter value will be error code 0x15:
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
15 |
16 |
7E |
Select Commands¶
The parameters of this select commands are explained in 6.3.2.12.1 Select commands.
0x0C Set Select¶
Command:¶
Set the Select parameter and set the Select mode to 0x02 at the same time (Send the Select command before inventory the label). In the case of multiple tags, you can only inventory, read and write operations for specific tags based on the Select parameter. E.g:
H |
Type |
CMD |
PL |
SelParam |
Pointer |
MaskLen |
Truncate |
Mask |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|---|
BB |
00 |
0C |
00 13 |
01 |
00 00 00 20 |
60 |
00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
AD |
7E |
- TargetRefer to EPC Gen2 Protocol
- ActionRefer to EPC Gen2 Protocol
- MembankThe meaning of MemBank is as follows:
0b00: Reserved Memory Bank
0b01: EPC Memory Bank
0b10: TID Memory Bank
0b11: User Memory Bank
Pointer: 0x00000020 (in bits, not words) Starting from the EPC Memory Bank
MaskLen: 0x60 (6 words, 96 bits) )
Whether Truncate: 0x00 (0x00 is Disable truncation, 0x80 is Enable truncation)
When the Select Mask length is greater than 80 bits (5 words), sending the Select command will first set all tags in the field to Inventoried Flag as A and SL Flag as ~SL, and then operate according to the selected Action. When the Select Mask length is less than 80 bits (5 words), the label status will not be set to Inventoried Flag A and SL Flag ~SL through the Select command in advance.
Mask: 0x30751FEB705C5904E3D50D70
Success Response:
H |
Type |
CMD |
PL |
Data |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
0C |
00 01 |
00 |
0E |
7E |
0x0B Get Select¶
Command:¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
0B |
00 00 |
0B |
7E |
Response:¶
H |
Type |
CMD |
PL |
Se lParam |
P ointer |
M askLen |
Tr uncate |
Mask |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
0B |
00 13 |
01 |
00 00 00 20 |
60 |
00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
AD |
7E |
SelParam: 0x01 (Target: 3’b000, Action: 3’b000, MemBank: 2’b01)
Pointer: 0x00000020 (in bits, not words) Starting from the EPC Memory Bank
MaskLen: 0x60 (6 words, 96 bits) )
Whether Truncate: 0x00 (0x00 is Disable truncation, 0x80 is Enable truncation)
0x12 Set Select mode¶
Command:¶
If the Select parameter has been set, execute this command to set the Select mode. For example, if you want to cancel the Select command:
H |
Type |
CMD |
PL |
Mode |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
12 |
00 01 |
01 |
14 |
7E |
Success Response:¶
H |
Type |
CMD |
PL |
Data |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
0C |
00 01 |
00 |
0E |
7E |
RFID Tag Commands¶
0x39 Read Tag memory¶
Read the data of the specified address and length in the memory Bank of a tag. This instruction takes four parameters:
Access Password
MemBank
WordPtr
WordCount
Before this instruction, the Select parameter should be set to select the specified tag to read the tag data area. If the Access Password is all zeros, no Access command is sent.
Command¶
This command reads from 2 words (4 bytes) starting from address 0x00 of User Memory Bank using 0x0000FFFF as Access Password.
H |
Type |
CMD |
PL |
Access Password |
MemBank |
WordPtr |
WordCount |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
00 |
39 |
00 09 |
00 00 FF FF |
03 |
00 00 |
00 02 |
45 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Read Data |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
39 |
00 13 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
12 34 56 78 |
B0 |
7E |
0x09 Read Fail Response¶
H |
Type |
CMD |
PL |
Error Code |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
09 |
0A |
7E |
0x09 error code means the tag is not in range, or there is an error of the EPC code.
0x16 Wrong Access Password Error¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
16 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
75 |
7E |
0xA3 EPC Gen2 Error Response:¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
A3 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
02 |
7E |
Error Code 0xA3 means that this is an EPC Gen2 error code 0x03: Memory Overrun.
0x49 Write Tag memory¶
Before this instruction, the Select parameter should be set first to select the specific tag to write to. If the Access Password is all zeros, no Access command is sent.
The WordCount should not exceed 32 words (64 Bytes = 512 bits).
Command¶
H |
Type |
CMD |
PL |
Access Password |
MemBank |
WordPtr |
WordCount |
Data |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|---|
BB |
00 |
49 |
00 0D |
00 00 FF FF |
03 |
00 00 |
00 02 |
12 34 56 78 |
6D |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Pa rameter |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
49 |
00 10 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 |
A9 |
7E |
Parameter 0x00 means that the instruction is executed successfully.
0x10 Error Response¶
H |
Type |
CMD |
PL |
Error |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
10 |
0A |
7E |
0x10 error code means the tag is not in range, or there is an error of the EPC code.
0x16 Wrong Access Password Error¶
H |
Type |
CMD |
PL |
Error |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
16 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
75 |
7E |
0xB3 EPC Gen2 Error Response¶
H |
Type |
CMD |
PL |
Error |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
B3 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
12 |
7E |
Error code 0xB3 means that this is an EPC Gen2 error code 0x03: Memory Overrun.
0x82 Lock Tag Memory¶
Change lock status of a memory bank of the specified tag. Before this instruction, the Select parameter should be set to target the specified tag.
Command¶
H |
Type |
CMD |
PL |
Access Password |
LD |
CRC |
End |
|---|---|---|---|---|---|---|---|
BB |
00 |
82 |
00 07 |
00 00 FF FF |
02 00 80 |
09 |
7E |
In this command, the LD is 0x020008.
0x020080 = 0b0000 0b0010 0b0000 0b0000 0b1000 0b0000
The upper 4 bits of the LD is reserved to 0b0000 because the EPC Gen2 Lock-Command Payload only requires 20 bits of data. (Refer to section 6.3.2.11.3.5 of EPC Gen2 Protocol v2.0.1)
Only actions whose mask bits are 1 are going to be executed.
In this 0x020080 example, the mask bits of Access Password is 01 and the action of Access Password is 01. Thus, the access password will be permanently readable and writable.
Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Pa rameter |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
82 |
00 10 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 |
E2 |
7E |
0x13 Error Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
13 |
14 |
7E |
0x13 error code means the tag is not in range, or there is an error of the EPC code.
0x16 Wrong Access Password Error¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
16 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
75 |
7E |
0xC4 EPC Gen2 Error Response¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
C4 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
23 |
7E |
Error Code 0xC4 means that this is an EPC Gen2 error code 0x04: Memory Locked.
0x65 Kill Tag¶
Before this instruction, the Select parameter should be set first to select the specific tag to kill.
Command¶
H |
Type |
CMD |
PL |
Kill Password |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
65 |
00 04 |
00 00 FF FF |
67 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Pa rameter |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
65 |
00 10 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 |
C5 |
7E |
0x12 Error Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
12 |
13 |
7E |
0x12 error code means the tag is not in range, or there is an error of the EPC code.
0xD0 EPC Gen2 Error Response¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
D0 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
2F |
7E |
Error Code 0xD0 means that this is an EPC Gen2 error code 0x00: Other error. This may be because the kill password of the tag hasn’t been set.
0xD3 BlockPermalock / 0xD4 Read Permalock Status¶
This instruction can permanently lock certain blocks in the user area, or read the lock status of the block. Before this instruction, the Select parameter should be set to the targeted tag.
According to section 6.3.2.12.3.9 of EPCglobal Gen2 Specification v2.0.1:
A BlockPermalock may permalock between zero and 4080 memory blocks. The block size, which is predefined by the Tag manufacturer, is fixed at between one and 1024 words, is the same for all files, and is the same for block permalocking and file allocation. The memory blocks specified by a BlockPermalock need not be contiguous.
A Tag shall only execute a BlockPermalock in the secured state.
A BlockPermalock differs from a Lock in that BlockPermalock permanently locks individual blocks of FileN, N>0 of User memory in an unwriteable state whereas Lock reversibly or permanently locks the kill and/or access password, the EPC memory bank, the TID memory bank, and/or File0 of User memory in a writeable or un-writeable state. Table 6.55 specifies how a Tag shall behave upon receiving a BlockPermalock targeting File_0 that follows a prior Lock, or vice versa (assuming Read/Lock=1).
Parameter |
Length |
Explanation |
|---|---|---|
Access Password |
4 Bytes |
Access password of the tag |
Read / Lock |
1 Byte |
0x00: Read<br />0x01: Write |
MemBank |
1 Byte |
Should be 0x03 (User memory) |
BlockPtr |
2 Byte |
BlockPtr specifies the starting address for Mask, in units of 16 blocks |
BlockRange |
1 Byte |
BlockRange specifies the range of Mask, starting at BlockPtr and ending (16×BlockRange)–1 blocks later. |
Mask |
0 / 2 Byte |
If the instruction is to read (0x00 for Read/Lock Parameter), this parameter is omitted |
Command¶
To permanently lock the blocks 5, 6, 7:
H |
Type |
CMD |
PL |
Access Pa ssword |
Read / Lock |
M emBank |
Bl ockPtr |
Bloc kRange |
Mask |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|---|---|
BB |
00 |
D3 |
00 0B |
00 00 FF FF |
01 |
03 |
00 00 |
01 |
07 00 |
E8 |
7E |
0xD3 Read Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Bloc kRange |
Block Per malock |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
D3 |
00 12 |
0E |
30 00 |
E2 00 30 16 66 06 00 69 11 60 9F 94 |
01 |
07 00 |
CD |
7E |
0xD4 Write Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Pa rameter |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
D4 |
00 10 |
0E |
30 00 |
E2 00 30 16 66 06 00 69 11 60 9F 94 |
00 |
C4 |
7E |
0x14 Tag Not Found Error¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
14 |
15 |
7E |
0xE3 EPC Gen2 Error Response¶
H |
Type |
CMD |
PL |
Error |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
E3 |
0E |
30 00 |
E2 00 30 16 66 06 00 69 11 60 9F 94 |
D2 |
7E |
Error Code 0xE3 means that this is an EPC Gen2 error code 0x03: Memory Overrun.
0x16 Wrong Access Password Error¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
16 |
0E |
30 00 |
E2 00 30 16 66 06 00 69 11 60 9F 94 |
05 |
7E |
Query Commands¶
Query command is documented on section 6.3.2.12.2 of EPC Gen2 Protocol v2.0.1.
The parameters for communication between the Host Computer and the Interrogator is documented in the table below with the data represented in binary:
Description |
Length (bit) |
Description |
|---|---|---|
DR |
1 |
0 = 8 |
M |
2 |
00 = 1, 01 = 2, 10 = 4, 11 = 8 |
TRext |
1 |
0 = No pilot tone, 1 = Use pilot tone |
Sel |
2 |
00 = All, 01 = All, 10 = ~SL, 11 = SL |
Session |
2 |
00 = S0, 01 = S1, 10 = S2, 11 = S3 |
Target |
1 |
0 = A, 1 = B |
Q (slot-count) |
4 |
Decimal 0-15 according to the value |
Padding |
3 |
000 |
0x0D Get Query parameters¶
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
0D |
00 00 |
0D |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
0D |
00 02 |
10 20 |
40 |
7E |
The parameter is 2 bytes, and the following specific parameters are spliced bit by bit. The response parameter corresponding to the above response frame is 0x1020 = 0b0001000000100000
Refer to section 6.3.2.12.2.1 EPC Gen2 Protocol v2.0.1
In the table below, the data are reresented in binary.
Description |
Length (bit) |
Data |
Description |
|---|---|---|---|
DR |
1 |
0 |
0 = 8 |
M |
2 |
00 |
00 = 1 |
TRext |
1 |
1 |
1 = Use pilot tone |
Sel |
2 |
00 |
00 = All |
Session |
2 |
00 |
00 = S0 |
Target |
1 |
0 |
0 = A |
Q (slot-count) |
4 |
0100 |
4 |
Padding |
3 |
000 |
DR=8, M=1, TRext=Use pilot tone, Sel=All, Session=S0, Target=A, Q=4
Radio Frequency¶
Radio frequency of the Interrogator is determined by the region and the frequency channel listed below.
Frequency Region |
Region Index |
Frequency Channel in MHz |
CH_INDEX |
|---|---|---|---|
920++ MHz Based |
01 |
(CH_Index * 0.25 + 920.125) MHz |
(Freq_CH - 920.125) / 0.25 |
United States |
02 |
(CH_Index * 0.5 + 902.25) MHz |
(Freq_CH - 902.25) / 0.5 |
Europe |
03 |
(CH_Index * 0.2 + 865.1) MHz |
(Freq_CH - 865.1) / 0.2 |
840++ MHz Based |
04 |
(CH_Index * 0.25 + 840.125) MHz |
(Freq_CH - 840.125) / 0.25 |
Korea |
06 |
(CH_Index * 0.2 + 917.1) MHz |
(Freq_CH - 917.1) / 0.2 |
0x07 Set Frequency Region¶
To set the Frequency Region 920++ MHz Based, set the Region Index to 0x01.
Command¶
H |
Type |
CMD |
PL |
Region Index |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
07 |
00 01 |
01 |
09 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
07 |
00 01 |
00 |
09 |
7E |
0x08 Get Frequency Region¶
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
08 |
00 00 |
08 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Region Index |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
08 |
00 01 |
01 |
09 |
7E |
The region index is 01, so the frequency region is 920++ MHz Based.
0xAB Set Frequency Channel¶
If it is the 900++ MHz Based, to set the frequency channel of the reader to 920.375 MHz, set the CH_Index to: (920.375 - 920.125) / 0.25 = 01.
Command¶
H |
Type |
CMD |
PL |
CH_Index |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
AB |
00 01 |
01 |
AD |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
AB |
00 01 |
00 |
AD |
7E |
0xAA Get Frequency Channel¶
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
AA |
00 00 |
AA |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
CH_Index |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
AA |
00 01 |
00 |
AC |
7E |
If the frequency region is 920++ MHz based, the CH_Index 0x00 means the frequency channel is: (0 * 0.25 + 920.125) MHz = 920.125 MHz.
0xAD Set automatic frequency hopping¶
In the automatic frequency hopping mode, if the user executes the instruction to insert the working channel, the reader will randomly select the channel frequency hopping from the channel list set by the user, otherwise, the channel frequency hopping will be randomly selected according to the internal preset channel list.
Possible parameter for the command is:
0x00: Disable automatic frequency hopping
0xFF: Enable automatic frequency hopping
Command¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
AD |
00 01 |
FF |
AD |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
AD |
00 01 |
00 |
AF |
7E |
0xA9 Insert working channel¶
Inserting the working channel allows the user to independently set the frequency hopping channel list. After executing this command, the reader will randomly select the channel hopping frequency from the channel list set by the user. The command is defined as follows:
Command¶
H |
Type |
CMD |
PL |
CH Count |
CH List |
CRC |
End |
|---|---|---|---|---|---|---|---|
BB |
00 |
A9 |
00 06 |
05 |
01 02 03 04 05 |
C3 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
A9 |
00 01 |
00 |
AB |
7E |
0xB7 Get transmit power¶
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
B7 |
00 00 |
B7 |
7E |
Response¶
H |
Type |
CMD |
PL |
Power |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
B7 |
00 02 |
07 D0 |
91 |
7E |
Power: 0x07D0 = Decimal 2000 = 20 dBm
0xB6 Set Transmit Power¶
Command¶
H |
Type |
CMD |
PL |
Power |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
B6 |
00 02 |
07 D0 |
8F |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
B6 |
00 01 |
00 |
B8 |
7E |
0xB0 Set to transmit continuous wave¶
Parameter:
0x00: Disable Continuous Wave
0xFF: Enable Continuous Wave
Command¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
00 |
B0 |
00 01 |
FF |
B0 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
B0 |
00 01 |
00 |
B2 |
7E |
0xF1 Get receiver demodulator parameters¶
Includes: Mixer gain, IF AMP gain and signal demodulation threshold.
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
F1 |
00 00 |
F1 |
7E |
Response¶
H |
Type |
CMD |
PL |
Mixer_G |
IF_G |
Threshold |
CRC |
End |
|---|---|---|---|---|---|---|---|---|
BB |
01 |
F1 |
00 04 |
03 |
06 |
01 B0 |
B0 |
7E |
Mixer gain Mixer_G: 0x03 (Mixer gain is 9dB)
IF amplifier gain IF_G: 0x06 (IF AMP gain is 36dB)
Signal demodulation threshold Thrd: 0x01B0 (the smaller the signal demodulation threshold, the lower the return RSSI of the demodulated tag, but the more unstable it is. It cannot be demodulated at all if the value is lower than a certain value; on the contrary, the larger the threshold, the demodulated tag return signal RSSI The larger the distance, the more stable. 0x01B0 is the recommended minimum)
0xF0 Set the receiver demodulator parameters¶
Mixer Gain Index |
Mixer Gain Value (dB) |
|---|---|
0x00 |
0 |
0x01 |
3 |
0x02 |
6 |
0x03 |
9 |
0x04 |
12 |
0x05 |
15 |
0x06 |
16 |
IF AMP Gain Index |
IF AMP Gain Value (dB) |
|---|---|
0x00 |
12 |
0x01 |
18 |
0x02 |
21 |
0x03 |
24 |
0x04 |
27 |
0x05 |
30 |
0x06 |
36 |
0x07 |
40 |
Command¶
H |
Type |
CMD |
PL |
Mixer Gain Index |
IF AMP Gain Index |
Threshold |
CRC |
End |
|---|---|---|---|---|---|---|---|---|
BB |
00 |
F0 |
00 04 |
03 |
06 |
01 B0 |
AE |
7E |
Successful Response¶
H |
Type |
CMD |
PLParameter |
CRC |
End |
|---|---|---|---|---|---|
BB |
01 |
F0 |
00 01 |
F2 |
7E |
0xF2 Test the blocking signal at the RF input¶
Testing the blocking signal at the RF input Scan Jammer is used to detect the magnitude of the blocking signal of each channel of the reader antenna in the current area.
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
F2 |
00 00 |
F2 |
7E |
Response¶
H |
Type |
CMD |
PL |
CH_L |
CH_H |
JMR |
CRC |
End |
|---|---|---|---|---|---|---|---|---|
BB |
01 |
F2 |
00 16 |
00 |
13 |
F2 F1 F0 EF EC EA E8 EA EC EE F0 F1 F5 F5 F5 F6 F5 F5 F5 F5 |
EA |
7E |
If there are a total of 20 channels in the 900MHz frequency band in China, and the scanning of the radio frequency input blocking signal Scan Jammer channel is executed correctly
Test start channel CH_L: 0x00 (Test start channel Index is 0)
Test end channel CH_H: 0x13 (Test end channel Index is 19)
0xF3 Test channel RSSI¶
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
F3 |
00 00 |
F3 |
7E |
Response¶
H |
Type |
CMD |
PL |
CH_L |
CH_H |
RSSI |
CRC |
End |
|---|---|---|---|---|---|---|---|---|
BB |
01 |
F3 |
00 16 |
00 |
13 |
BA BA BA BA BA BA BA BA BA BA BA BA BA BA BA BA BA BA BA BA |
A5 |
7E |
If there are 20 channels in 900MHz Based Frequency, this is the returned RSSI for each channel.
Each channel RSSI is represented by a signed Byte, where 0xBA is -70 dBm.
NXP Custom Commands¶
0xE1 NXP ReadProtect/Reset ReadProtect Command¶
NXP G2X tags support ReadProtect/Reset ReadProtect commands. When the tag executes the ReadProtect command successfully, the ProtectEPC and ProtectTID bits of the tag will be set to ‘1’ and the tag will enter the data protection state. If the label returns to the normal state from the data protection state, the Reset ReadProtect command needs to be executed. Before this instruction, the Select parameter should be set to select the specified label for operation.
Parameter |
Length |
Explanation |
|---|---|---|
Access Password |
4 Bytes |
Access Password of the RFID Tag |
Set / Reset |
1 Byte |
0x00: Set Read Protect<br />0x01: Reset Read Protect |
Command¶
To set read protect to the selected tag with 0x0000FFFF access password:
H |
Type |
CMD |
PL |
Access Password |
Set / Reset |
CRC |
End |
|---|---|---|---|---|---|---|---|
BB |
00 |
E1 |
00 05 |
00 00 FF FF |
00 |
E4 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Pa rameter |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
E1 |
00 10 |
0E |
30 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 |
3D |
7E |
Successful Reset Read Protect Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Pa rameter |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
E2 |
00 10 |
0E |
30 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 |
3E |
7E |
0x2A Tag Not Found when Setting Read Protect¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
2A |
2B |
7E |
0x2A error code means the tag is not in range, or there is an error of the EPC code.
0x2B Tag not Detected when Resetting Read Protect¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
2B |
2C |
7E |
0x16 Wrong Access Password Error¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
16 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
75 |
7E |
0xE3 NXP Change EAS¶
NXP G2X tags support the Change EAS command. When the tag executes the Change EAS command successfully, the PSF bit of the tag will change to ‘1’ or ‘0’ accordingly. When the PSF position of the tag is ‘1’, the tag will respond to the EASAlarm instruction, otherwise the tag will not respond to the EASAlarm instruction. Before this instruction, the Select parameter should be set to select the specified label for operation.
Command¶
To set PSF bit to 1 (Tag will response to EAS_Alarm):
H |
Type |
CMD |
PL |
Access Password |
PSF |
CRC |
End |
|---|---|---|---|---|---|---|---|
BB |
00 |
E3 |
00 05 |
00 00 FF FF |
01 |
E7 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Pa rameter |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
E3 |
00 10 |
0E |
30 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 |
3F |
7E |
0x1B Tag Not Found Error¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
1B |
1C |
7E |
0x16 Wrong Access Password Error¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
16 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
75 |
7E |
0xE4 NXP EAS_Alarm¶
Tags with PSF bit set to 1 will respond to this instruction by returning 64-bit EAS Alarm code.
Command¶
H |
Type |
CMD |
PL |
CRC |
End |
|---|---|---|---|---|---|
BB |
00 |
E4 |
00 00 |
E4 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
EAS Alarm Code |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
E4 |
00 08 |
69 0A EC 7C D2 15 D8 F9 |
80 |
7E |
0x1D No Tag Responding¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
1D |
1E |
7E |
0xE0 NXP ChangeConfig¶
Some series of NXP G2X tags (such as G2iM and G2iM+) support the ChangeConfig command, which can be used to read or modify the 16bits Config-Word of NXP G2X tags. The Config-Word of the NXP G2X tag is located at the address 20h (word address) of EPC Memory Bank and can be read by a normal Read command. When the tag is in the Secured state (safe state), the Config-Word of the tag can be rewritten. It should be noted that rewriting Config-Word means flipping the corresponding data bit of Config-Word, that is, writing the corresponding bit of ‘1’ flipping (‘1 ‘Becomes ‘0’, ‘0’ becomes ‘1’), the corresponding bit written in ‘0’ remains unchanged. Before this instruction, the Select parameter should be set to select the specified label for operation.
Config parameter: when 0x0000 means read.
Command¶
H |
Type |
CMD |
PL |
Access Password |
Config |
CRC |
End |
|---|---|---|---|---|---|---|---|
BB |
00 |
E0 |
00 06 |
00 00 FF FF |
00 00 |
E4 |
7E |
Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Config |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
E0 |
00 11 |
0E |
30 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 41 |
7E |
7E |
0x1A No Tag Responding¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
1A |
1B |
7E |
0x16 Wrong Access Password Error¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
16 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
75 |
7E |
Impinj Monza Custom Commands¶
0xE5 Impinj Monza QT Command¶
Impinj Monza 4 QT tags support the QT command, which can modify the QT Control word of the tag. Setting the QTSR bit can shorten the operation distance of the tag in the Open and Secured states or when it is about to enter the Open and Secured states. Modifying the QTMEM bit can switch the label to use Public Memory Map (Public Memory Map) or Private Memory Map (Private Memory Map). Before this instruction, the Select parameter should be set to select the specified label for operation.
Parameter |
Length |
Explanation |
|---|---|---|
Access Password |
4 Bytes |
Access password of the tag |
Read / Write |
1 Byte |
0x00: Read<br />0x01: Write |
Persistence |
1 Byte |
0x00: Write to volatile memory<br />0x01: Write to NVM memory |
Payload |
2 Byte |
QT Control: QTSR and QTMEM |
Command¶
To write to NVM memory with QTSR 0x40 and QTMEM 0x00:
H |
Type |
CMD |
PL |
Access Password |
Read / Write |
Persistence |
Payload |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
00 |
E5 |
00 08 |
00 00 FF FF |
01 |
01 |
40 00 |
2D |
7E |
0xE5 Read Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
QT Control |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
E5 |
00 11 |
0E |
30 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 00 |
42 |
7E |
0xE6 Write Successful Response¶
H |
Type |
CMD |
PL |
PC + EPC Length |
PC |
EPC |
Pa rameter |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
E6 |
00 10 |
0E |
30 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
00 |
42 |
7E |
0x2E Tag Not Found Error¶
H |
Type |
CMD |
PL |
Parameter |
CRC |
End |
|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 01 |
2E |
2F |
7E |
0x16 Wrong Access Password Error¶
H |
Type |
CMD |
PL |
Error Code |
PC + EPC Length |
PC |
EPC |
CRC |
End |
|---|---|---|---|---|---|---|---|---|---|
BB |
01 |
FF |
00 10 |
16 |
0E |
34 00 |
30 75 1F EB 70 5C 59 04 E3 D5 0D 70 |
75 |
7E |