W Ommunication Protocol

COMMUNICATION PROTOCOL Model No.
WBSR-1000
Date 2018/12/18
WB R-1000 Ver. V21
Page 2
W ommunication protocol
Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

COMMUNICATION PROTOCOL Model No. WBSR-1000
Date 2018/12/18
WBSR-1000 Ver. V21
Page 2

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
1.RS-232 COMMUNICATION DATA FORMAT

Baud rate(BPS)：Can be set by controller (default 9600BPS) (9600/192000/38400/115200BPS)
Communication mode： Asynchronous communication
Transport type ： half-duplex
data-frame structure ：
Starting bit：1 bit
Data bit：8 bits
Checking bit：none
Stop bit：1 bit
2.Communication control method：

The device is driven by the host, after reception of host command, then the device could do
some operation.
3. Communication control character
STX（0X02） Beginning of the command frame

ETX（0X03） End of the command frame
ENQ（0X05） Request of get valid response(Host->Reader)
ACK（0X06） Positive response(Reader->Host)
NAK（0X15） Negative response(Reader->Host)
EOT（0X04） Cancel command(Host->Reader)
4. Communication command structure

Packet format of command and response
STX(0x02) Command packet ETX(0x03) BCC
BCC is XOR checksum, like BCC= STX ^ Command packet ^ ETX ( ^ is XOR operator)
e.g.：Reset command
0x02 0x00 0x02 0x30 0x30 0x03 BCC

BCC = 0x02 ^ 0x00 ^ 0x02 ^ 0x30 ^ 0x30 ^ 0x03

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
5. Control the control command structure
A N E E
C A N O
K K Q T

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
6. Communication procedure
6.1 Normal communication process(command operation)
HOST send command, device(READER) receive the command and check the BCC checksum, if the check
is right, response ACK, then HOST send ENQ, device(READER) will do the operation according to the
command, and last response the relevant operation data to HOST.
6.2 Incorrect communication process
eg: BCC checksum error of request command:
If device(READER ) receive an command which the BCC checksum is Incorrect, then response NAK to
HOST which mean the BCC checksum of command is not correct. Host should check the BCC checksum of
the request command. When device(Reader) receive the correct command which with right BCC
checksum, then response ACK to HOST.

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
7. Communication packet format

7.1 Communication command packet format of sending
STX Communication Command code Command Data packet ETX(0X03) BCC

(0X02) packet length CM(1 byte) parameter (n bytes) (1 byte)
PM(1 byte)
length
Calculation range of communication packet
Range of BCC XOR checkout
Note:
a. The “n bytes” of data packet : the max is 264 byte, the min is 0 byte.
b. Communication packet length is the length of “Command code” + “Command parameter” +
“Data packet” and has two bytes, the first is high byte, second is low byte.
eg: length: 257(dec) eg: length: 255(dec)
length: 0x01 0x01(hex) length: 0x00 0xFF(hex)
7.2 Communication response packet format

Positive response :
a. The “n bytes” of Data Packet :the max is 264 byte, the min is 0 byte.
b. Command word and Command parameter are HOST to READER that need to do
operation.
Negative response :
STX Communication ‘N’(0x4E) Error code ETX BCC

Command
(0x02) packet length code E(1 byte ) (0x03) (1byte)
(1 byte )
(2 byte ） CM (1byte )
Calculation range of communication packet
Range of BCC XOR checkout

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
7.3 Error code E meaning：
Error code E Explanation

0x00 Command has error
0x01 Command parameter has error
0x02 Command can’t be sent
0x04 Command data packet has error
8. Command list
Command Command Command Explanation

code CM parameter PM
0x30 Reset reader, response the firmware version
Reset 0x30
0x31 Reset reader, response the firmware version
Get device status 0x31 0x30 Device status(has card or not)
Check the IC card 0x31 0x31 Check the card type
IC card power 0x33 0x30 IC card power on
on/off 0x31 IC card power off
Check the version 0xDC 0x31 Check the version no
The rest of the command which about the card operation should reference to the info below.
9. Device operation
9.1 Reset
Host send:
0x02 0x00 0x02 0x30 0x30 / 0x31 0x03 BCC
Reader response：
0x02 0x00 0x12 0x30 0x30 / 0x31 Device version info SV 0x03 BCC
Reader version info： SV=“WBSR-1000 V1.0”
9.2 Get device status

Host send:
0x02 0x00 0x02 0x31 0x30 0x03 BCC
Reader response：
0x02 0x00 0x03 0x31 0x30 Device status S 0x03 bcc
S=‘N’（0X4E） No card
S=‘Y’（0X59） Has card ,card is in the reader

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
9.3 Check the IC card type automatically：

Host send:
0x02 0x00 0x02 0x31 0x31 0x03 BCC
Reader response：
0x02 0x00 0x04 0x31 0x31 Card type status code S1 S2 0x03 BCC
Card type status code：
Status code S1 Status code S2 Card type explanation
‘N’ ‘0’ No card

‘1’ Unknown card
‘0’ ‘0’ Contactless RFID card S50
‘1’ Contactless RFID card S70
‘2’ Contactless RFID card UL card
‘4’ ISO1443 TYPEA CPU card
‘5’ ISO1443 TYPEB CPU card
‘6’ ISO 15693 card
‘9’ Unknown contactless RFID card
‘1’ ‘0’ Contact CPU card T=0
‘1’ Contact CPU card T=1
‘2’ ‘0’ 24C01 card
‘1’ 24C02 card
‘2’ 24C04 card
‘3’ 24C08 card
‘4’ 24C16 card
‘5’ 24C32 card
‘6’ 24C64 card
‘3’ ‘0’ SL4442 card
‘1’ SL4428 card
9.4 Contact IC card power on/off

Host send:
0x02 0x00 0x02 0x33 0x30 / 0x31 0x03 BCC
Reader response：
0x02 0x00 0x03 0x33 0x30/ 0x31 Operation status code P 0x03 BCC
P=‘Y’（0X59） Operation ok
P=‘N’（0X4E） Operation fail

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
9.5 Get firmware version information

Host send:
0x02 0x00 0x02 0xDC 0x31 0x03 BCC
Reader response：
0x02 0x00 0x12 0xDC 0x31 Version info code SV 0x03 BCC
Firmware version info： SV=“WBSR-1000 V1.0 ”
9.6 Setting baud rate

HOST send：
0x02 0x00 0x02 0x34 Code N 0x03 BCC
N=0x30 baud rate 1200

Reader response：
0x02 0x00 0x03 0x34 Code N Operation status code P 0x03 BCC
Operation status code P=‘N’（0x4E） OK

P=‘Y’（0x59） Fail
9.7 Set buzzer

Host send:
0x02 0x00 0x02 0x2C Buzzer time T 0x03 BCC
eg: T= 10(Dec), 10 * 10 = 100ms
Reader response：
0x02 0x00 0x03 0x2C T Device status code S 0x03 BCC
S=‘N’（0X4E）set fail
S=‘Y’（0X59）set ok

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
Appendix I Contact IC card command operation

1. Contact CPU card command operation
1.1 CPU card cold reset：（ISO7816/EMV reset mode）
HOST send：
0x02 Communication 0x37 0x30 Mode 0x03 BCC

packet length
2 byte
Mode=0x30 EMV mode(If there have not the mode parameter, still use according to the EMV reset mode.)
Mode=0x31 ISO7816 mode
Positive response： T=0 CPU card reset successfully response P=‘Y’（0x59）

0x02 Communication 0x37 0x30 Operate status Reset data packet Reset data 0x03 BCC
packet length code P length 2 byte n byte
2 byte
Communication packet length=5+ Reset data packet length n
Positive response ：T=1 CPU card reset successfully response P=‘Z’（0X5A）
0x02 Communication 0x37 0x30 Operate status Reset data packet Reset data 0x03 BCC
2 byte
Negative response：
0x02 0x00 0x04 0x37 0x30 Operate status code P 0x03 BCC
Operate status code P=‘N’（0x4E） Reset fail

P=‘E’（0x45） No card
1.2 CPU card warm reset

HOST send：
0x02 0x00 0x02 0x37 0X2F 0x03 BCC
Positive response ： T=0 CPU card reset successfully response P=‘Y’（0x59）
0x02 Communication 0x37 0x2F Operate status Reset data packet Reset data 0x03 BCC
2 byte
Positive response： T=1 CPU card reset successfully response P=‘Z’（0X5A）

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
0x02 Communication 0x37 0x2F Operate status Reset data packet Reset data 0x03 BCC
2 byte
0x02 0x00 0x03 0x37 0x2F Operate status code P 0x03 BCC
Operate status code P=‘N’（0x4E） Reset fail

1.3 T=0 CPU card C-APDU command

HOST send：
0x02 Communication packet 0x37 0x31 C-APDU packet C-APDU packet data 0x03 BCC
length 2 byte length 2 byte n byte
Communication packet length=4+ C-APDU packet length n (The max is 262byte)
Positive response：operate status code P=‘Y’（0x59）
0x02 Communication 0x37 0x31 Operate status C-APDU response C-APDU response 0x03 BCC
packet length 2 code P packet length 2 byte packet n byte
byte
Communication packet length=5+ C-APDU response packet length n (the max is 257byte)
0x02 0x00 0x03 0x37 0x31 Operate response code P 0x03 BCC
Operate response code P=‘N’（0x4E） operate fail

P=‘E’（0x45） no card
Note:
When operate the command C-APDU of CPU card, you should according to the CPU reset card
response T=0,T=1 card type to choose the T=0,T=1 C-APDU command to operating.

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
1.4.T=1 CPU card C-APDU command

HOST send：
0x02 Communication 0x37 0x32 C-APDU packet C-APDU packet n 0x03 BCC
packet length 2 byte length 2 byte byte
Communication packet length=4+ C-APDU packet length n (the max is 262byte)

Positive response： P=‘Y’（0x59）
0x02 Communication 0x37 0x32 Operate C-APDU C-APDU 0x03 BCC

packet length status code P response response
2 byte packet length 2 packet n byte
Communication packet length=5+ C-APDU response packet length n (the max is 256byte)
Operate status code P=‘N’（0x4E） operating fail

Note:
When operate the command C-APDU of CPU card, you should according to the CPU reset card response
T=0,T=1 card type to choose the T=1 C-APDU command to operating. receive the C-APDU packet link.
2. SIM card operation：（which have the SIM card slot）

2.1 reset SIM card：(3.0V ，5.0V ) ISO7816/EMV mode reset：
HOST send：
0x02 communication 0x3D Pm SIM card No Mode 0x03 BCC

packet length
2 byte
Pm= 0x2F Reset the SIM card with 3.0V

Pm= 0x30 Reset the SIM card with 5.0V
Mode =0x30 EMV mode(If there have no mode PM, still according to the EMV reset mode to operating.)
Mode=0x31 ISO7816 mode
Positive response：
T=0 SIM card :Operate status code P=‘Y’（0x59）
0x02 communication 0x3 Pm SIM card Operate Reset data packet Reset data 0x03 BCC
packet length D No status code P length 2 byte n byte
2 byte
communication packet length=6+ reset data n

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
T=1 SIM card :Operate status code P=‘Z’（0X5A）
0x02 communication 0x3D Pm SIM card Operate Reset data Reset data 0x03 BCC
packet length No status code P packet length n byte
2 byte 2 byte
communication packet length=6+ reset data n

SIM card No=0x30 Operating SIM 1
=0x31 Operating SIM 2(Spare)
=0x32 Operating SIM 3
=0x33 Operating SIM 4
0x02 0x00 0x04 0x3D Pm SIM card No Operate 0x03 BCC

status code P
Operate status code P=‘N’（0x4E） reset fail

Note：Regarding the SIM card, only when the reset is ok then can do the C-APDU command. Pls check the voltage
when operating the SIM card, otherwise it will damage the SIM card.

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
2.2 T=0 SIM card C-APDU command

HOST send：
0x02 communication 0x3D 0x31 SIM card No C-APDU packet length C-APDU packet 0x03 BCC
packet length 2 byte n byte
2 byte
communication packet length=5+ C-APDU packet n (n=4—263byte)
Positive response： Operate status code P=‘Y’（0x59）
0x02 communication 0x3D 0x31 SIM card Operate C-APDU response C-APDU 0x03 BCC
packet length No status code P packet length 2 byte response
2 byte packet n byte
communication packet length=6+ C-APDU response packet n (n=4--263byte)
0x02 0x00 0x04 0x3D 0x31 SIM card No Operate 0x03 BCC
status code P
Operate status code P=‘N’（0x4E） Operating fail
2.3 T=1 SIM card C-APDU command

HOST send：
0x02 communication 0x3D 0x32 SIM card C-APDU packet length C-APDU packet 0x03 BCC
packet length 2 byte No 2 byte n byte
communication packet length=5+ C-APDU packet n (n=4--262byte)
0x02 communication 0x3D 0x32 SIM card Operate C-APDU C-APDU 0x03 BCC
packet length 2 No status code P response response
byte packet length packet n byte
2 byte
communication packet length=6+ C-APDU response packet n (n=4—262byte)
0x02 0x00 0x04 0x3D 0x32 SIM card No Operate 0x03 BCC
status code P
Operate status code P=‘N’（0x4E） operating fai

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
Appendix II Sychron-Card read/write command

1. 24CXX list card：（24C01、24C02、24C04、24C08、24C16、24C32、24C64）
1.1 setting card type
HOST send：
0x02 0x00 0x03 0x36 0X30 Card type 0x03 BCC
N=0x30 24C01 card 128BYTE ADR=0x0000—0x007F

N=0x31 24C02 card 256BYTE ADR=0x0000—0x00FF
N=0x32 24C04 card 512BYTE ADR=0x0000—0x01FF
N=0x33 24C08 card 1K BYTE ADR=0x0000—0x03FF
N=0x34 24C16 card 2K BYTE ADR=0x0000—0x07FF
N=0x35 24C32 card 4K BYTE ADR=0x0000—0x0FFF
N=0x36 24C64 card 8K BYTE ADR=0x0000—0x1FFF
Reader response：
0x02 0x00 0x04 0x36 0X30 Card type N Operate 0x03 BCC
status code P
Operate status code P=‘N’（0x4E） Set card fail
P=‘Y’（0x59） Set card success
1.2 Read card

HOST send：
0x02 0x00 0x06 0x36 0x31 Card type Operate start address Operate length 0x03 BCC
N 2byte L
Operate length L=0X01—0X80 ，the min length is 1 BYTE，the max is 128 BYTE ,start address 2BYTE：
The valid address is decided by the card capacity.

0x02 communication 0x36 0x31 Card Operate Operate start Operate Read data 0x03 BCC
packet length (2 type N status code P address length L n byte
byte) 2byte
communication packet length = 7 + Operate length L
0x02 0x00 0x04 0x36 0x31 Card type N Operate status code P 0x03 BCC
Operate status code P=‘N’（0x4E） read fail

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
1.3 Write card

1.3.1 Write card without checking
HOST send：
0x02 communication 0x36 0x32 Card type Operate start Operate Write data 0x03 BCC
packet length (2 N address 2byte length L n byte
byte)
communication packet length = 6 + operate length L
operate length L=0X01—0X80，the min is 1 BYTE，the max is 128 BYTE
Reader response：
0x02 0x00 0x04 0x36 0x32 Card type N Operate status code P 0x03 BCC
Operate status code P=‘Y’（0x59） write success
P=‘N’（0x4E） write fail
1.3.2 write card with checking
HOST send：
0x02 communication 0x36 0x33 Card type Operate start Operate Write data 0x03 BCC
packet length (2 N address 2byte length L n byte
byte)
Note：communication packet length = 6 + Operate length L
operate length L=0X01—0X80，the min is 1 BYTE，the max is 128 BYTE
Positive response:
0x02 communication 0x36 0x33 Card Operate Operate start Operate Read the Written 0x03 BCC
packet length type N status address 2byte length L data n byte
(2 byte) code P
communication packet length = 7 + Operate length L Negative

response：
0x02 0x00 0x04 0x36 0x33 Card type Operate status code 0x03 BCC
N P
Operate status code P=‘N’（0x4E） write fail

2. SLE4442 card
2.1 SLE4442 CARD reset
HOST send：
0x02 0x00 0x02 0x38 0X30 0x03 BCC

0x02 0x00 0x07 0x38 0x30 Operate Reset data packet 0x03 BCC
status code P 4 byte

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
0x02 0x00 0x03 0x38 0x30 Operate 0x03 BCC

status code P

2.2 Read 4442 main storage area

HOST send：
0x02 0x00 0x04 0x38 0X31 Read start 1 byte Read 1 byte 0x03 BCC
address ADR length L
ADR=0X00-0XFF
L=0x01—0x80
Operate length L=0X01--0X80 ，the min 1 BYTE，the max is 128 BYTE ,4442 will be used only in 256 bytes.
0x02 Communication 0x38 0x31 Operate Read start Read length Read data L byte 0x03 BCC
packet length 2 status code P address ADR L
Communication packet length =5+ Read length L
0x02 0x00 0x05 0x38 0x31 Operate status Read start Read length L 0x0 BCC
code P address ADR 3
P=‘N’（0x4E） read fail

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
2.3 Read 4442 protection bit

HOST send：
0x02 0x00 0x02 0x38 0x32 0x03 BCC
Positive response：Operate status code P=‘Y’（0x59）
0x02 0x00 0x23 0x38 0x32 Operate status protection status bit 32 byte 0x03 BCC
code P
Every protection status bit is corresponding to every unit write protection status in one main storage
area, the address is from low to high.
protection status bit = 0x00 means this bit can’t be written since it has been protected valid.
= 0x01 means the protection bit is invalid ,you can write it.
Read 4442 protection bit, read the 32bytes in one time.
0x02 0x00 0x03 0x38 0x32 Operate status 0x BCC
code P 03
2.4 Read 4442 PSC area

HOST send：
0x02 0x00 0x02 0x38 0X33 0x03 BCC
0x02 0x00 0x07 0x38 0x33 Operate Safety area data 4 0x03 BCC
status code P byte
The first byte of safety are： the wrong password counter data
The second byte of safety are： password 1
The third byte of safety are： password 2
The fourth byte of safety are： password 3
wrong password counter data=0X07（verify wrong counter data is 0），0X06（counter data is 1）， 0X04（
counter data is 2），0X00（counter data is 1，the card scraped）
0x02 0x00 0x03 0x38 0x33 Operate status 0x03 BCC
code P

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
2.5 Verify password

HOST send：
0x02 0x00 0x05 0x38 0x34 Password data 3 byte 0x03 BCC
Reader response：
0x02 0x00 0x03 0x38 0x34 Operate status code 0x03 BCC
P
Operate status code P=‘Y’（0x59） Verify password right

P=‘N’（0x4E） Verify password error
2.6 write main storage area：(00H-FFH)

HOST send：
0x02 Communication 0x38 0x35 Write start address Write length Write data L 0x03 BCC
packet length 2 byte ADR(1byte) L byte
Communication packet length= 4+ Write length L
Operate length L=0x01—0x80 ，the min is 1 Byte，the max is 128 Byte.
Reader response：
0x02 0x00 0x05 0x38 0x35 Operate Write start address Write length 0x03 BCC
status code ADR L
Operate status code P=‘Y’（0x59） Write success

P=‘N’（0x4E） Write error
2.7 Write protection bit：（ADR：0x00-0x1f total 32 bytes have the write protection function,)
HOST send：
0x02 communication 0x38 0x36 Adr Len Len byte write protection 0x03 BCC
packet length L data
Note： communication packet length L= 4 + Len
Adr : The start address of the write protection bit Adr:0x00---0x1F
Len : The length of the write protection bit 0x01---0x20
S byte : The unit status byte packet of write protection bit
Len byte write protection data：the data need to be written protection. When the data is same as the

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
previous storage unit ,the write protection will be success, otherwise the write protection will be fail.
Modify write protection area: Only can modify in 00H-31H storage unit, the write protection will be
valid forever and can’t be canceled if it write protection success. you need to sure the Adr, Len in the
range. you can operate write protection to single byte.
Reader response：
0x02 0x00 0x03 0x38 0x36 Operate status code 0x03 BCC
P
2.8 Modify password

HOST send：
Reader response：
Operate status code P=‘Y’（0x59） Modify success

P=‘N’（0x4E） Modify fail
3. SLE4428 card
3.1 reset
HOST send：
0x02 0x00 0x02 0x39 0X30 0x03 BCC

0x02 0x00 0x07 0x39 0x30 Operate Reset data packet 0x03 BCC
status code P 4 byte
3.2 Read 4428 storage area：（without protection bit）

HOST send：

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
0x02 0x00 0x05 0x39 0X31 Read start 2 byte Read length 1 byte 0x03 BCC
address ADR L
ADR=0000-03FF
L =0x01—0x80
Operate length L=0X01—0X80 ，the min is 1 BYTE，the max is 128 BYTE ,
4428 storage only 1k byte, pls note the address and length are in the range.
0x02 Communication 0x39 0x31 Operate Read start Read length Read data 0x03 BCC
length 2 byte status code P address 2byte L 1bye L byte
Communication length=6+ read length L
0x02 0x00 0x06 0x39 0x31 Operate Read start address Read length L 0x03 BCC
status code P 2byte 1bye

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
3.3 Read 4428 protection bit

HOST send：
0x02 0x00 0x05 0x39 0X32 Read start 2 byte Read length 1 byte 0x03 BCC
address ADR L
ADR=0000-03FF
L =0x01—0x80
Operate length L=0X01—0X80 ，the min is 1 BYTE，the max is 128 BYTE ,
4428 storage only 1K byte, pls note the address and length are in the range.
Every protection status bit is corresponding to every unit write protection status in one main storage area, the
address is from low to high.
protection status bit = 0x00 means this bit can’t be written since it has been protected valid.
= 0x01 means the protection bit is invalid ,you can write it.
0x02 Communication 0x39 0x32 Operate Read start Read length Protection bit 0x03 BCC
length 2 byte status code address 2byte L 1bye data L byte
P
Communication length=6+ Read length L
0x02 0x00 0x06 0x39 0x32 Operate Read start Read length L 0x03 BCC
status code P address 2byte 1bye
P=‘E’（0x45） No card．
3.4 Verify password

HOST send：
Reader response：
Operate status code P=‘Y’（0x59） Verify success

P=‘N’（0x4E） Verify error

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
3.5 Write data（without protection bit）

HOST send：
0x02 Communication 0x39 0x34 Write start address Write length L Write data L 0x03 BCC
length 2 byte ADR 2byte 1byte byte
Communication length= 5+ Write length L ,Address range=0x0000—0x03FF;

Operate length L=0X01—0X80 ，the min is 1 BYTE，the max is 128 BYTE
Note：The last three storage units (0x03FD,0x3FE,0x03FF) of 4428 is wrong password counter, pls operate it
take care in case the card will scraped.
Reader response：
0x02 0x00 0x06 0x39 0x34 Operate status Write start Write length 0x03 BC C
code P address ADR L1byte
Operate status code P=‘Y’（0x59） Write success

P=‘N’（0x4E） Write error
3.6 Write data（with protection bit）

HOST send：
0x02 Communication 0x39 0x35 Write start address Write length L Write data 0x03 BCC
length 2 byte ADR 2byte 1byte L byte
Communication length= 5+ Write length L

Address range=0x0000—0x03FF (Any unit of the card can be written protection)
Operate length L=0X01—0X80 ，the min is 1 BYTE，the max is 128 BYTE
Write data L byte : the data will be written protection。
Note： the storage unit which has been written protection will can’t be write it.
The last three storage units (0x03FD,0x03FE,0x03FF) of 4428 are wrong password counter, password 1,password
2(0x03FD,0x03FE,0x03FF). pls operate it take care in case the card will scraped
Reader response：
0x02 0x00 0x06 0x39 0x35 Operate Write start address ADR Write length 0x03 BCC
status code P 2byte L 1byte
3.7 Modify password
HOST send：
0x02 0x00 0x06 0x39 0x36 Old password 2 byte New password 2 byte 0x03 BCC

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
Reader response：
Operate status code P=‘Y’（0x59） Modify success

P=‘N’（0x4E） Modify fail

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
Appendix III contactless ISO14443 CPU card command

1. Polling command
1.1 :ISO14443 TYPEA CPU card search
HOST send：
0x02 0x00 0x02 0x35 0x60 0x03 BCC
Positive response：: P=‘Y’（0X59） search success
0x02 communication packet 0x35 0x60 Operate status code P ATR data packet 0x03 BCC
length 2 byte
P=‘N’（0X4E） search fail;
P=‘E’（0X45） No card
1.2 :ISO14443 TYPEB CPU search

HOST send：
0x02 0x00 0x02 0x35 0x61 0x03 BCC
Positive response：: P=‘Y’（0X59） search success
0x02 communication 0x35 0x61 Operate status code P ATR data packet 0x03 BCC
packet length 2 byte
Negative response： P=‘N’（0X4E） search fail

2.C-APDU command
HOST send：
0x02 communication 0x35 0x65 C-APDU packet C-APDU packet 0x03 BCC
packet length 2 byte length 2 byte n byte
communication packet length=4+ C-APDU packet ;length n (n=4--262byte)
0x02 Communication 0x35 0x65 Operate C-APDU C-APDU 0x03 BCC

packet length 2 status code P response response
byte packet length 2 packet n byte
communication packet length=5+ C-APDU response packet length n (n=4—262byte)

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
Operate status code P=‘N’（0x4E） operate fail
3. DESELECT command
HOST send：
0x02 0x00 0x02 0x35 0x68 0x03 BCC
Positive response：: P=‘Y’（0X59） power off success
Operate status code P=‘N’（0X4E） power off fail

4. ISO14443 TYPEA CPU card get the serial number

HOST send：
0x02 0x00 0x02 0x35 0x69 0x03 BCC
Positive response：: P=‘Y’（0X59） operate success
0x02 0x00 0x03 0x35 0x69 Operate status Four byte or seven byte card 0x03 BCC
code P serial no
Operate status code

P=‘N’（0X4E） operate fail

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
APPENDIX IV Mifare 1 card command

1. Mifare 1(S50/S70) Mefare1 search
HOST send：
0x02 0x00 0x02 0x35 0x30 0x03 BCC
READER response：
0x02 0x00 0x03 0x35 0x30 P 0x03 BCC
P=‘Y’（0X59） search success

P=‘N’（0X4E） search fail
2．Get Mefare1 card serial no

HOST send：
0x02 0x00 0x02 0x35 0x31 0x03 BCC
READER response：
0x02 0x00 0x06 0x35 0x31 Operate status P 4 byte hex card serial no 0x03 BCC
P=‘Y’（0X59） Get the card serial no success, and response to the serial no
P=‘N’（0X4E）Get the card serial no fail，and response to empty serial no(0X00，0X00，0X00，0X00)
4byte card serial no is send by hexadecimals：e.g.:“ C6B272AE”

e.g.：the upload data packet is：0x02 0x00 0x06 0x35 0x31 0xC6 0xB2 0x72 0xAE 0x03 BCC
3.Verify sector password command A type: Verify the password of specified sector
The operate password of the sector: Verify the Key A or Key B of specified sector to verify the operate
password.
A． Verify Key A ：
HOST send：
0x02 0x00 0x09 0x35 0x32 Sector no 6 byte hex password 0x03 bcc
If S50 card, Sector no= 0x00 0x1 0x02 ……0x0F ,If the card is S70,Sector no= 0x00 0x1 0x02 ……0x27
READER response：
0x02 0x00 0x03 0x35 0x32 Sector no Operate status code P 0x03 bcc
Operate status code P=‘Y’（0X59） Verify success

P=‘3’（0X33） Verify fail
Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
B． verify Key B ：
HOST send：
If S50 card, Sector no= 0x00 0x1 0x02 ……0x0F ,If S70 card, Sector no= 0x00 0x1 0x02 ……0x27
READER response：
Operate status code P=‘Y’（0X59） Verify success

P=‘N’（0X4E） Verify fail

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
4. Read block data

HOST send：
0x02 0x00 0x04 0x35 0x33 Sector no Block no 0x03 BCC

If S50 card, Sector no= 0x00 0x1 0x02 ……0x0F,If S70 card, Sector no= 0x00 0x1 0x02 ……0x27
Sector no ＜32,Block no＝ 0x00 0x01 0x02 0x03 ,Sector no ≥32,Block no= 0x00 0x1 0x02 ……0x0F
0x02 0x00 0x15 0x35 0x33 Sector no Block no P=0x59 16 byte hex data 0x03 BCC
Operate status code：
P=‘Y’（0X59） Read block data success, and upload the data read from16 byte
0x02 0x00 0x05 0x35 0x33 Sector no Block no Operate status code P 0x03 BCC
Operate status code

P=‘N’（0X34） read fail
5. Write block data

HOST send：
0x02 0x00 0x14 0x35 0x34 Sector no Block no 16 byte hex data 0x03 BCC
If S50 card, Sector no= 0x00 0x1 0x02 ……0x0F, if S70 card, Sector no= 0x00 0x1 0x02 ……0x27
Sector no ＜32,Block no= 0x00 0x01 0x02 0x03 ,Sector no ≥32, Block no= 0x00 0x1 0x02 …0x0F
0x02 0x00 0x15 0x35 0x34 Sector no Block no P 16 byte hex data 0x03 BCC
Operate status code：

P=‘Y’（0X59）write block data success, and upload the read data of 16 byte which has been written
Operate status code

P=‘N’（0X34） read fail
P=‘E’（0X45） no card
Note：The third block of every sector is the storage area of KEY A、control bit、KEY B, the card maybe locked
and scraped of do the write operation, pls take care.

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
6. Modify password：Only can be modified in KEY A, and change the KEY B in :”0xFF, 0xFF,
0xFF,0xFF,0xFF,0xFF”,the control bit write in:”0xFF, 0x07, 0x80, 0x69”
HOST send：
Sector no= 0x00 0x1 0x02 ……0x0F
READER response：
Operate status code P=‘Y’（0X59） Modify success

P=‘N’（0X4E） modify fail
If you need to modify complete of the sector operate password(Key A or Key B) and control bit, pls use the write
block data command in every sector 3 after you verify the password success.
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
6 byte Key A bit 4 byte control bit 6 byte Key B bit

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
7. Value Increment operation:

HOST send：
If S50 card, Sector no= 0x00 0x1 0x02 ……0x0F, If S70 card, Sector no= 0x00 0x1 0x02 ……0x27
Sector no ＜32,block no＝ 0x00 0x01 0x02 0x03 ,Sector no ≥32,block no= 0x00 0x1 0x02 ……0x0F
Note: When do the value operation, password control block(0X03 or 0X0F ) and hardware information block
can’t be operated. 4 byte hex data is the increment value of the specified sector block data,(low byte is after
high byte), unallowed in 0,otherwise will be fail. for example, if the block 0 of fifth sector need to increase
0x10,the value should be of 4byte is “0x10, 0x00, 0x00, 0x00”
READER response：
Operate status code P=‘Y’（0X59） increase success

P=‘N’（0X4E） increase fail
Value decrement operation
HOST send：
If S50 card, Sector no= 0x00 0x1 0x02 ……0x0F ,If S70 card, Sector no= 0x1 0x02 ……0x27
Sector no ＜32,block no＝ 0x00 0x01 0x02 ,Sector no ≥32,block no= 0x00 0x1 0x02 ……0x0E
Note: When do the value operation, password control block(0X03 or 0X0F ) and hardware information block
can’t be operated.4 byte hex data is the decrement value of the specified sector block data,(low byte is after
high byte), unallowed in 0,otherwise will be fail.
READER response：
Operate status code P=‘Y’（0X59） decrease success

P=‘N’（0X4E） decrease fail

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
8. initialization value
Use the write block data command to operate, write the 16byte data according to MIFARE value data
format, as follows:
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Value /Value Value Adr /Adr Adr /Adr
Value: initialize 4 byte value , low byte first, high byte follows.
/Value: initialize 4 byte value, and invert it.
Adr: the block address of initialization value Adr= sector x4 + block no
/Adr: Invert the block address of initialization value
e.g.：initialize block 0 value of sector 5 to 10,the 16byte block data should be written into is:
“ 0x0A, 0x00, 0x00, 0x00, 0xF0, 0xFF,0xFF ,0xFF , 0x0A, 0x00, 0x00, 0x00, 0x14, 0xEB, 0x14, 0xEB ”
Read value：operate by reading block data command, regarding the response 16 byte value ,it should be
verified whether it is MIFARE card data format, it can read out if it is MIFARE data format, otherwise the
value is error(data format is error.)
Note：When do the value operation, the block 3 of every sector can’t storage value data. the sector
block address should be noted when operate initialization value, increase value, decrease value ,read
value
9. Mifare ultralight card

9.1 UL card search
HOST send：
0x02 0x00 0x02 0x35 0x40 0x03 BCC
READER response：
Operate status code P=‘Y’（0x59） search success

P=‘N’（0x4E） search fail
9.2 Get ID number of UL card

HOST send：
0x02 0x00 0x02 0x35 0x42 0x03 BCC
READER response：
0x02 0x00 0x0A 0x35 0x42 Operate status 7 byte hex card serial no 0x03 BCC
code P
Operate status code P=‘Y’（0x59）Get serial no success, and response to serial no

P=‘N’（0x4E） Get serial no fail, and response to empty serial no(0x00 …)
7 byte card serial no is send by hexadecimal, such as”04B40DC9EF0284”

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2
e.g.：the upload communication packet is：

0x02 0x00 0x0A 0x35 0x31 0x59 0x04 0XB4 0x0D 0XC9 0XEF 0X02 0X84 0x03 BCC
9.3 Read UL card page data

HOST send：
0x02 0x00 0x03 0x35 0x43 Page no 0x03 BCC
UL card page no= 0x00~0x0F (UL card has 16 pages，every page is 4 bytes)
When the page no ＞16，Pages will be back to read in 16 cycle.
0x02 0x00 0x08 0x35 0x43 Page no Operate status code P 4 byte hex data 0x03 BCC
Read page data success, and upload 4byte,it is the data of one page.
0x02 0x00 0x04 0x35 0x43 Page no Operate status code 0x03 BCC
P
Operate status code P=‘N‘（0X4E） search RF card fail
9.4 Write UL card page data

HOST send：
0x02 0x00 0x07 0x35 0x44 Page no 4 byte hex data 0x03 BCC
0x02 0x00 0x08 0x35 0x44 Page no Operate status code P 4 byte hex data 0x03 BCC
Operate status code：P=‘Y’（0x59）Write page data success, and upload the 4byte read data which
has been written success.
0x02 0x00 0x04 0x35 0x44 Page no Operate status code P 0x03 BCC
Operate status code P=‘N‘（0X4E） search RF card fail
Note: Page 1-2 of UL card is hardware code that can’t be use .
10. ISO 15693 card

Date 2018/12/18
WBSR-1000 Ver. V21
Page 2

W Ommunication Protocol

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

W Ommunication Protocol

Uploaded by

Copyright:

Available Formats

COMMUNICATION PROTOCOL Model No.

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

1.RS-232 COMMUNICATION DATA FORMAT

2.Communication control method：

3. Communication control character

STX（0X02） Beginning of the command frame

4. Communication command structure

STX(0x02) Command packet ETX(0x03) BCC

0x02 0x00 0x02 0x30 0x30 0x03 BCC

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

5. Control the control command structure

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

6.2 Incorrect communication process

eg: BCC checksum error of request command:

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

7. Communication packet format

STX Communication Command code Command Data packet ETX(0X03) BCC

Range of BCC XOR checkout

7.2 Communication response packet format

STX Communication ‘N’(0x4E) Error code ETX BCC

Range of BCC XOR checkout

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

7.3 Error code E meaning：

Error code E Explanation

Command Command Command Explanation

9.2 Get device status

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

9.3 Check the IC card type automatically：

Status code S1 Status code S2 Card type explanation

‘N’ ‘0’ No card

9.4 Contact IC card power on/off

0x02 0x00 0x02 0x33 0x30 / 0x31 0x03 BCC

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

9.5 Get firmware version information

0x02 0x00 0x02 0xDC 0x31 0x03 BCC

9.6 Setting baud rate

N=0x30 baud rate 1200

Operation status code P=‘N’（0x4E） OK

9.7 Set buzzer

0x02 0x00 0x02 0x2C Buzzer time T 0x03 BCC

eg: T= 10(Dec), 10 * 10 = 100ms

0x02 0x00 0x03 0x2C T Device status code S 0x03 BCC

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

Appendix I Contact IC card command operation

0x02 Communication 0x37 0x30 Mode 0x03 BCC

Positive response： T=0 CPU card reset successfully response P=‘Y’（0x59）

Communication packet length=5+ Reset data packet length n

Positive response ：T=1 CPU card reset successfully response P=‘Z’（0X5A）

Communication packet length=5+ Reset data packet length n

Operate status code P=‘N’（0x4E） Reset fail

1.2 CPU card warm reset

0x02 0x00 0x02 0x37 0X2F 0x03 BCC

Positive response ： T=0 CPU card reset successfully response P=‘Y’（0x59）

Communication packet length=5+ Reset data packet length n

Positive response： T=1 CPU card reset successfully response P=‘Z’（0X5A）

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com

Communication packet length=5+ Reset data packet length n

Operate status code P=‘N’（0x4E） Reset fail

1.3 T=0 CPU card C-APDU command

Positive response：operate status code P=‘Y’（0x59）

Operate response code P=‘N’（0x4E） operate fail

Shenzhen Fuheng Auto Control Technology Co.,Ltd. http://www.fuhengtech.com