OSDP® - UHF

MIFARE GLOBAL ®

OSDP UHF
READER
Communication Protocol

Available for: SMA-Wx3-A-U04-7OS (x = 4/5)

SLA-Wx3-A-U04-7OS (x = 4/5)

All rights reserved- This document is the exclusive property of STid. No unauthorised reproduction or disclosure of any part of this
document in any form or by any means. STid reserves the right to amend this document without prior notice, with the aim of improving
the product.

19/11/2019 Version 1.0 Page 1 of 44

 OSDP® - UHF
MIFARE GLOBAL ®
Table of Contents

I. INTRODUCTION ................................................................................................................................... 4
II. MESSAGE STRUCTURE ..................................................................................................................... 5
II.1 Packet Format ............................................................................................................................ 5
II.2 CTRL details .............................................................................................................................. 6
II.3 SQN Values: .............................................................................................................................. 6
II.4 CKSUM ...................................................................................................................................... 6
II.5 CRC ........................................................................................................................................... 7
II.6 Security Block: ........................................................................................................................... 9
III. READER COMMUNICATION SETTINGS ......................................................................................... 10
III.1 Serial Interface ........................................................................................................................ 10
III.2 Change address and Baudrate readers .................................................................................. 10
III.2.1. [COMMAND]: osdp_COMSET – 6Eh .......................................................................... 11
III.2.2. [REPLY]: osdp_COM – 54h ........................................................................................ 11
III.3 Command frames examples ................................................................................................... 12
IV. CONNECTION .................................................................................................................................... 13
IV.1- Wiring reader to Control Panel .............................................................................................. 13
IV.2- Bus RS485 ............................................................................................................................ 13
V. COMMUNICATION MODE ................................................................................................................. 14
V.1 Secure chanel session connection sequence (SCS-CS) ........................................................ 14
V.2 Secure chanel session connection: commands and replies ................................................... 15
V.2.1. [COMMAND]: osdp_CHLNG – 76h ............................................................................. 15
V.2.2. [REPLY]: osdp_CCRYPT – 76h .................................................................................. 15
V.2.3. [COMMAND]: osdp_SCRYPT – 77h ........................................................................... 16
V.2.4. [REPLY]: osdp_RMAC-I – 78h .................................................................................... 16
V.2.5. Example: ...................................................................................................................... 17
V.3 Secure chanel: change the secure communication key SCBK ............................................... 18
V.3.1. [COMMAND]: osdp_KEYSET – 75h ............................................................................ 18
V.3.2. [REPLY]: osdp_ACK – 40h .......................................................................................... 18
V.3.3. Exemple: ...................................................................................................................... 19
VI. READER SETTINGS .......................................................................................................................... 20
VII. IMPLEMENTED OSDP COMMANDS AND REPLIES ....................................................................... 21
VII.1 osdp_ID - Identification Device ............................................................................................. 22
VII.1.1. [COMMAND]: osdp_ID – 61h..................................................................................... 22
VII.1.2. [REPLY]: osdp_PDID – 45h ....................................................................................... 22
VII.2 osdp_CAP - Capabilities ........................................................................................................ 24
VII.2.1. [COMMAND]: osdp_CAP – 62h ................................................................................. 24
VII.2.2. [REPLY]: osdp_PDCAP – 46h ................................................................................... 24
VII.2.3. Function code list ....................................................................................................... 25
VII.2.3. Example: SMA + 4 LANES ........................................................................................ 27
VII.3 osdp_LSTAT - Local status report ........................................................................................ 28
VII.3.1. [COMMAND]: osdp_LSTAT – 64h ............................................................................. 28
VII.3.2. [REPLY]: osdp_LSTATR – 48h ................................................................................. 28
VII.3.3. Example ..................................................................................................................... 28
VII.4 osdp_OUT - Output Control ................................................................................................... 29
VII.4.1. [COMMAND]: osdp_OUT – 68h ................................................................................ 29
VII.4.2. [REPLY]: osdp_ACK – 40h ........................................................................................ 29
VII.4.3 [REPLY]: osdp_NAK – 41h ......................................................................................... 29
VII.4.4. [REPLY]: osdp_NAK – 41h Multirecord reply ............................................................ 30
VII.4.5. Example: .................................................................................................................... 30
VII.5 osdp_LED - LED .................................................................................................................... 31
VII.5.1. [COMMAND]: osdp_LED – 69h ................................................................................. 31
VII.5.2. [REPLY]: osdp_ACK – 40h ........................................................................................ 33
VII.5.3 [REPLY]: osdp_NAK – 41h ......................................................................................... 33
VII.5.4. [REPLY]: osdp_NAK – 41h Multirecord reply ............................................................ 33
VII.5.4. Example: .................................................................................................................... 34
VII.6 osdp_ISTAT - Input status report .......................................................................................... 36
VII.6.1. [COMMAND]: osdp_ISTAT – 65h .............................................................................. 36
VII.6.2. [REPLY]: osdp_ISTATR – 49h .................................................................................. 36
VII.6.3. Example: .................................................................................................................... 36

19/11/2019 Version 1.0 Page 2 of 44

 OSDP® - UHF
MIFARE GLOBAL ®
VII.7 osdp_OSTAT – Output status report ..................................................................................... 37
VII.7.1. [COMMAND]: osdp_OSTAT – 66h ............................................................................ 37
VII.7.2. [REPLY]: osdp_OSTATR – 4Ah ................................................................................ 37
VII.7.3. Example: .................................................................................................................... 37
VIII. POLLING ............................................................................................................................................ 38
VIII.1 COMMAND: osdp_POLL – Polling ....................................................................................... 38
VIII.2 REPLIES ............................................................................................................................... 38
VIII.2.1. osdp_ACK - Acknowledge ........................................................................................ 39
VIII.2.2. osdp_NAK - Negative Acknowledge ......................................................................... 39
VIII.2.3. osdp_LSTATR - Local status report ......................................................................... 40
VIII.2.4. osdp_RAW - Card Data Report, Raw Bit Array ........................................................ 41
VIII.2.5. osdp_BUSY - Reader Busy Reply ............................................................................ 42
IX. OSDP MANUFACTURER SPECIFIC COMMANDS .......................................................................... 43
IX.1. List of Manufacturer Commands ........................................................................................... 43
IX.2 osdp_MFG – 80h: Structure command .................................................................................. 43
IX.3- MFG_TIMEOUT_BUSY ........................................................................................................ 43
X. REVISION HISTORY .......................................................................................................................... 44

19/11/2019 Version 1.0 Page 3 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

I. Introduction

This document describes the communication protocol for interfacing one or more UHF STid OSDP compatible Reader(s)
to a Control Panel (CP).

The communication channel is used in the “command/reply” mode (master/slave mode). Only the CP may spontaneously
send a message. The communication can be done in plain or encrypted (secure chanel).

This document specifies the protocol implementation over a two-wire RS-485 multi-drop serial communication channel.
Most of the parameters (e.g.: led color, baudrate, reader address ...) are transmitted via OSDP frames.

The following parameters are configured with OCB UHF badges or serial configuration:
- Installation configuration parameters (lane / antenna number, LED color on detection user ID, baudrate…)
- User Card information: data size, encryption of EPC, encryption key.

The 7OS protocol is developed according to the Open Supervised Device Protocol (OSDP v2.1.7).
https://www.securityindustry.org/industry-standards/open-supervised-device-protocol/

19/11/2019 Version 1.0 Page 4 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

II. Message Structure

II.1 Packet Format

Character SEC_BLK_EN SEC_BLK_TYPE SEC_BLK_DATA DATA

SOM ADDR LEN CTRL CMND/REPLY
time (optional) (optional) (optional) (optional)
Start Of Physical Message Length of
Security Block Security Block Command or
FFh Message Reader LenLSB LenMSB control Security Data Block
Type Data reply code
53h Address Information Control Block
N bytes based
1 byte 1 byte 1 byte 1 byte 1 byte 1 byte 1 byte 1 byte 1 byte 1 byte on
CMND/REPLY

MAC[0] MAC[1] MAC[2] MAC[3] CKSUM

(optional) (optional) (optional) (optional) CRC
Present for secured messages. CRC LSB CRC MSB
Dependent on SEC_BLK_TYPE 2 bytes
CKSUM
1 byte 1 byte 1 byte 1 byte
1 byte

The transmitting device shall drive the line to a marking state for a minimum of 1
Character time character time before starting to send the first character of a message. (This can be
achieved by sending a character with all bits set to '1'.). Constant value FFh
SOM Start Of Message. Constant value 53h.
Defines the RS485 reader address. 00h – 7Eh.
ADDR - 7Fh : Broadcast address.
- The reader replies with the same address but bit 7 is forced to 1.
Total number of bytes contained in the message, including the SOM through the CKSUM or
LEN
CRC characters.
b7 b6 b5 b4 b3 b2 b1 b0
CTRL RFU
0: no SCB 0: CKSUM
SQN: 0->1->2->3->1->…
1: SCB 1: CRC

SEC_BLK_EN Length of Security Control Block.

SEC_BLK_TYPE Security Block Type.

SEC_BLK_DATA Security Block Data, based on type.

Commands and replies are the actual data block of the communication packets.
- A packet originated by the Control Panel is called a command (CMND).
CMND/REPLY - A packet returned by the reader is called a reply (REPLY).

The purpose and meaning of each message packet are defined by its command or reply code.

DATA Data associated to CMND or REPLY.

MAC[0]
MAC[1]
Present for secured messages, dependent on SEC_BLK_TYPE .
MAC[2]
MAC[3]
OSDP supports two different forms of error detection.
CKSUM/CRC
CRC on 2-byte or CKSUM on 1-byte.

19/11/2019 Version 1.0 Page 5 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

II.2 CTRL details

BIT Name Meaning

The sequence number of the message is used for message delivery
b0-b1 SQN
confirmation and for error recovery.
Set – 16-bit CRC is contained in the last 2 bytes of the message
b2 CKSUM / CRC
Clear – 8-bit CHECKSUM is contained in the last byte of the message
Set – Security Control Block is present in the message
b3 SCB
Clear – No Security Control block in the message

II.3 SQN Values:

The sequence number is incremented by the control panel from one command to the next, skipping zero: 0->1->2->3->1-
>...

Non-zero sequence numbers support error recovery: The Control Panel acknowledges the last reply by sending the next
command with the incremented sequence number, or it repeats the command without changing the sequence number to
request the repeat of the last reply.
This method allows the receiver to properly handle the command: process the command if it did not receive it correctly
last time (error occurred on the command), or to simply repeat the reply it already made without executing the command
again (error occurred in the reply).

SQN zero should be used only for communication startup, at boot time or after a communications loss. Zero forces the
reader to discard its last reply and to accept and process the current command.

II.4 CKSUM

This setting defines the message check character(s) method used to provide error detection.
The CKSUM value is the 8 least significant bits of the 2’s complement value of the sum of all previous characters of the
message.
Note: This mode is supported in order to allow for devices with limited resources, but new devices should use the CRC
method.

http://easyonlineconverter.com/converters/checksum_converter.html

1rst checksum calculation example:

FF 53 00 0C 00 00 6E 01 80 25 00 00

• FF + 53 + 00 + 0C + 00 + 00 + 6E + 01 + 80 + 25 + 00 + 00 = 272
• 8 least significant bits 72 (0111 0010)
• Complement value is 1000 1101 ➔8D
 Checksum = 8D

Frame to send to the reader: FF 53 00 0C 00 00 6E 01 80 25 00 00 8D

2nd checksum calculation example:

FF 53 7F 0C 00 00 6E 00 80 25 00 00

• FF +53 + 7F + 0C + 00+ 00 + 6E + 00 + 80 + 25 + 00 + 00 = 02 F0
• 8 least significant bits F0 (1111 0000)
• Complement value is 0000 1111 ➔ 0F
 Checksum = 0F

Frame to send to the reader: FF 53 7F 0C 00 00 6E 00 80 25 00 00 0F

19/11/2019 Version 1.0 Page 6 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

II.5 CRC

The STid readers should use the CRC method.

The CRC calculation is applied to all previous characters of the message.

There are several well-documented algorithms in the public domain. The implementation selected for this protocol is
commonly referred to as CRC16-CCITT. It is bases on the polynomial of X**16 + X**12 + X**5 + X**0, or more commonly
represented as 0x1021.

A straightforward shift–and–xor algorithm for computing the CRC requires an initial value of the CRC register to be all
ones. The data bytes are passed through the CRC register most significant bit first. The message is always augmented
with 16 zero bits.

Example: Frame 53000E000D021560755D328F

CRC-CCIT (0X1D0F) = E8F0

Frame to send to the reader: 53000E000D021560755D328FF0E8

This CRC algorithm is thoroughly addressed in the public domain. The following references provide a source for
additional information:

The first link to start with should be:

http://en.wikipedia.org/wiki/Cyclic_redundancy_check

This site gives good explanations, as well as several test strings with expected results for verification of specific
implantations.
The following link is an excellent source for theoretical and practical discussion about CRC calculation methods. An
especially valuable section deals with table driven implementations.

https://www.lammertbies.nl/comm/info/crc-calculation.html

19/11/2019 Version 1.0 Page 7 of 44

 OSDP® - UHF
MIFARE GLOBAL ®
A faster alternative to the shift-and-xor algorithm is the direct table lookup algorithm, which is illustrated in the following C
code:

/* preset: CRC Table not initialized */

static uint16 nCrcTblValid = 0;
/* CRC table ; working copy */
static uint16 cCrcTable[256];

/* generate the table forPOLY == 0x1012 */

static int fCrcTblInit( uint16 * pTbl )
{
int ii, jj;
uint16 ww;

for (ii = 0; ii < 256; ii++)

{
ww = (uint16)(ii << 8);
for (jj = 0; jj < 8; jj++)
{
if ( ww & 0x8000)
{
ww = (ww << 1) ^ 0x1021;
}
else
{
ww = (ww << 1);
}
}
pTbl[ii] = ww;
}
return 1;
}

/* table based CRC ; this is the "direct table" mode */

uint16fCrcBlk( uint08 * pData, uint16nLength)
{
uint16 nCrc;
int ii;

if ( nCrcTblValid == 0)
{
nCrcTblValid = fCrcTblInit(&cCrcTable[0]);
}
for ( ii = 0, nCrc = 0x1D0F; ii < nLength; ii++ )
{
nCrc = (nCrc<<8) ^ cCrcTable[ ((nCrc>>8) ^ pData[ii]) & 0xFF];
}
return nCrc;
}

19/11/2019 Version 1.0 Page 8 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

II.6 Security Block:

The Security Block (SB) is optional. Its presence is indicated by setting the CTRL::SCB flag.
The purpose of the SB is to facilitate the implementation of data security within the OSDP framework. By itself, the SB
does not define or specify the nature of the security methods used. Rather, the SB is available to support the use of
various security methods as OSDP device capabilities and client security requirements change.

Byte Name Meaning

0 SEC_BLK_EN Length of Security Control Block.

1 SEC_BLK_TYPE Security Block Type.

2-n SEC_BLK_DATA Security Block Data, based on type.

SEC_BLOCK_LEN
This field is set to the total byte count of the SB, including itself.

SEC_BLK_TYPE
This field defines the manner in which the security block applies to the rest of message (the optional
sec_blk_data[] array , the command/reply, the optional data[] array, MAC[] array, and the message check
characters).

Name Value Meaning Direction

SCS_11 11h Begin new Secure Connection Sequence CP to Reader
SCS_12 12h Secure Connection Sequence step 2 Reader to CP
SCS_13 13h Secure Connection Sequence step 3 CP to Reader
SCS_14 14h Secure Connection Sequence step 4 Reader to CP
SCS_15 15h Secure Session msg. w. MAC, no Data Security CP to Reader
SCS_16 16h Secure Session msg. w. MAC, no Data Security Reader to CP
SCS_17 17h Secure Session msg. with MAC & Data Security CP to Reader
SCS_18 18h Secure Session msg. with MAC & Data Security Reader to CP

SEC_BLK_DATA
This section is an array whose size is (sec_blk_length-2). The data content is separately defined for each
SEC_BLK_TYPE.

A reader that receives an SB, but does not support the processing of the SB should return an osdp_NAK
response, error code set to 05h.

A reader whose settings require an encrypted connection, and receives a command without the appropriate data
security extension must return an osdp_NAK response, error code set to 06h.

19/11/2019 Version 1.0 Page 9 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

III. Reader communication settings

III.1 Serial Interface

9600, 19200, 38400, 57600 and 115200 bauds.

Baud rate
9600 default

Mode Half duplex asynchronous serial

Number of bits 8

Transfer mode LSB first

Stop bit 1
Broadcast address 7Fh.
RS485
Factory address 00h.

III.2 Change address and Baudrate readers

The readers are delivered with factory settings.

The default settings can be changed in order to communicate with the CP.

Note: the baudrate can be set with osdp command and with configuration (ULTRYSv2).

To set the reader’s communication settings, you need:

- A computer.
- An hyperterminal software to send the command to the reader.
- A RS485 / USB converter (CNV_USB_485).
- The osdp_COMSET command format.

Steps:
1- Connect the reader to the computer with the converter cable.
2- Launch an hyperteminal software.
3- Use the following communication settings: 9600 bauds – 8 bits – Stop bit 1 – Parity none.
4- Send the [COMMAND]: osdp_COMSET – 6Eh command with the correct parameters.

19/11/2019 Version 1.0 Page 10 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

III.2.1. [COMMAND]: osdp_COMSET – 6Eh

Description: Communication Configuration Command

This command is used to change the reader’s communication settings.

The settings will take effect after the reader has completed its response to this command.

CKSUM
SOM ADDR LEN CTRL CMD DATA / CRC

Physical
Reader 0Ch 00h: CKSUM XXh
53h XXh 6Eh osdp_COMSET NewAddress Baudrate
Address 0Dh 00h: CRC / XXh XXh
00h i.e. 7Eh

NewAddress: New reader address.

1 byte Value between 00h i.e. 7Eh

Baudrate: New reader baudrates.

4 bytes [ Byte 1 LSB - Byte 2 - Byte 3 - Byte 4 MSB ]
• 80h 25h 00h 00h → 9600 bauds
• 00h 4Bh 00h 00h → 19200 bauds
• 00h 96h 00h 00h → 38400 bauds
• 00h E1h 00h 00h → 57600 bauds
• 00h C2h 01h 00h → 115200 bauds

III.2.2. [REPLY]: osdp_COM – 54h

Description: Communication Configuration Report

This reply returns the communication parameters the PD will use after sending this reply.

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physical
Reader 0Ch 00h: CKSUM XXh
53h XXh 54h osdp_COM Address Baudrate
Address 0Dh 00h:CRC / XXh XXh
80h i.e. FEh

Address: Reader address value set into the reader.

1 byte Value between 00h i.e. 7Eh

Baudrate: Baud rate set into the reader.

4 bytes [ Byte 1 LSB - Byte 2 - Byte 3 - Byte 4 MSB ]
• 80h 25h 00h 00h → 9600 bauds
• 00h 4Bh 00h 00h → 19200 bauds
• 00h 96h 00h 00h → 38400 bauds
• 00h E1h 00h 00h → 57600 bauds
• 00h C2h 01h 00h → 115200 bauds

19/11/2019 Version 1.0 Page 11 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

III.3 Command frames examples

In order to change the default/current reader address and baudrate, the osdp_COMSET command can be used as
following:

1rst example: Set address to 1 and Baudrate to 9600

osdp_COMSET: FF 53 00 0C 00 00 6E 01 80 25 00 00 8D osdp_COM: FF 53 80 0C 00 00 54 01 80 25 00 00 27
53 SOM 53 SOM
00 Physical address reader 80 Physical address reader
0C00 LEN 0C00 LEN
00 CTRL 00 CTRL
6E CMD 54 REPLY
01 New address 01 New Address
80250000 Baudrate 9600 80250000 Baudrate 9600
8D CKSUM 27 CKSUM

Other examples:
Reader’s Settings Commands Reply

Address 1 – 9600 bauds FF 53 00 0C 00 00 6E 01 80 25 00 00 8D FF 53 80 0C 00 00 54 01 80 25 00 00 27

Address 2 – 9600 bauds FF 53 00 0C 00 00 6E 02 80 25 00 00 8C FF 53 80 0C 00 00 54 02 80 25 00 00 26

Address 3 – 9600 bauds FF 53 00 0C 00 00 6E 03 80 25 00 00 8B FF 53 80 0C 00 00 54 03 80 25 00 00 25

Address 4 – 9600 bauds FF 53 00 0C 00 00 6E 04 80 25 00 00 8A FF 53 80 0C 00 00 54 04 80 25 00 00 24

Address 0 – 115200
FF 53 00 0C 00 00 6E 00 00 C2 01 00 70 FF 53 80 0C 00 00 54 00 00 C2 01 00 0A
bauds

19/11/2019 Version 1.0 Page 12 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

IV. Connection

IV.1- Wiring reader to Control Panel

IV.2- Bus RS485

Wiring resistors R1 and R2 use the extended features of the RS485 Bus: FAIL-SAFE (see RS485-AN-960).

The R1 and R2 resistors are already wired on the reader then there is no need to wire them on the CP.

We recommend to switch the jumper R_End resistor if there is a long cable length and/or if the used baudrate is high.

R1 & R2: 1.5 kΩ resistor (already wiredon the reader).

RT_End: 100 Ω end-of-line resistor J16.

19/11/2019 Version 1.0 Page 13 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

V. Communication mode
Specific commands are used to establish a secure session between the CP and the reader.
Those specific commands use the Secure Channel Base Key (SCBK).
The SCBK is only used by those commands.
This authentication step also makes it possible to exchange session keys in complete security.

By default, STid readers are in “non secure” mode/plain mode.

To switch to a secure session, the SCBK-D (Default “Secure Channel Base Key” value) should be used.
The SCBK-D value is the following : 30h 31h 32h 33h 34h 35h 36h 37h 38h 39h 3Ah 3Bh 3Ch 3Dh 3Eh 3Fh.
The SCBK value can remain unchanged, but we recommend to change it to a custom value by using the osdp_KEYSET
command.

As long as the SCBK value is not changed:

• The reader is not locked in secure mode.
• Both modes, secure and non-secure modes, can be used.
• SCBK-D is used to switch to secure mode using the osdp_CHLNG, osdp_CCRYPT specific commands.

As soon as the SCBK value is changed (by using the osdp_KEYSET command), the reader is locked in secure mode.

V.1 Secure chanel session connection sequence (SCS-CS)

CP Reader
osdp_CHLG
Generates and sends RndA[8]
Generates:
SEC_BLK_TYPE: SCS_11 - RndB[8]
- sessions keys: S-ENC, S-MAC1 & S-MAC2
- Client Cryptogram
Sends: cUID || RndB || Client Cryptogram
osdp_CCRYPT

SEC_BLK_TYPE: SCS_12
Verifies the Client cryptogram
Derives Reader’s SCBK(D)
Computes session keys:
S-ENC, S-MAC1 & S-MAC2
osdp_SCRYPT
Generates and sends server cryptogram Verifies the server cryptogram
SEC_BLK_TYPE: SCS_13

osdp_RMAC_I
If server cryptogram was accepted:
SEC_BLK_TYPE: SCS_14 Generates and sends the initial MAC

Note: successful completion of the first four steps confirms that the SCBK is valid, and that both sides have the full
complement of the keys derived for this session: S-ENC, S-MAC1, and S-MAC2. Also, the R-MAC is the initial ICV
(Initial Chaining Vector) value that will be rolling throughout the session.

19/11/2019 Version 1.0 Page 14 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

V.2 Secure chanel session connection: commands and replies

V.2.1. [COMMAND]: osdp_CHLNG – 76h

Description: Challenge and Secure Session Initialization Rq.

This command is the first in the Secure Channel Session Connection Sequence (SCS-CS). It delivers a random
challenge to the reader and it requests the reader to initialize for the secure session.

Security Block CKSUM

SOM ADDR LEN CTRL CMD DATA / CRC
Length Type data
Physical
Reader 12h 00h: CKSUM 76h XXh
53h XXh XXh 11h XXh RndA
Address 13h 00h: CRC osdp_CHLNG / XXh XXh
00h i.e. 7Eh

RndA: Random Number generated by the CP.

8 bytes

V.2.2. [REPLY]: osdp_CCRYPT – 76h

Description: Client's ID and Client's Random Number

This reply sends a block of data used for encryption synchronization, sent in response to osdp_CHLNG command.

Security Block CRC

SOM ADDR LEN CTRL REPLY DATA /
Length Type data
CKSUM
Physical
Reader 2Ah00h: Client XXh
76h Client
53h Address CKSUM XXh XXh 12h XXh ID RndB / XXh
osdp_CCRYPT Cryptogram
80h i.e. 2Bh00h:CRC (Cuid) XXh
FEh

Client ID: Cuid, client’s unique identifier. This is an 8-byte number, unique for each reader.
8 bytes

RndB: Random Number generated by the reader.

8 bytes

ClientCryptogram: The Client Cryptogram is computed by encrypting the concatenated Rnd.A[8] and Rnd.B[8]
16 bytes using key S-ENC.
Rnd.A[8] is generated by the CP (server) and Rnd.B[8] is generated by the reader (client).
ClientCryptogram = ENC( Rnd.A[8] || Rnd.B[8], S-ENC )

19/11/2019 Version 1.0 Page 15 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

V.2.3. [COMMAND]: osdp_SCRYPT – 77h

Description: Server's Random Number and Server Cryptogram

This command transfers a block of data used for encryption synchronization.

Security Block CKSUM

SOM ADDR LEN CTRL CMD DATA / CRC
Length Type data
Physical
1Ah 00h:
Reader 77h Server XXh
53h CKSUM XXh XXh 13h XXh
Address osdp_SCRYPT Cryptogram / XXh XXh
1Bh 00h: CRC
00h i.e. 7Eh

ServerCryptogram: The Server Cryptogram is computed by encrypting the concatenated Rnd.B[8] and
16 bytes Rnd.A[8] using the S-ENC key.
Rnd.A[8] is generated by the CP (server) and Rnd.B[8] is generated by the reader
(client).
ServerCryptogram = ENC( Rnd.B[8] || Rnd.A[8], S-ENC )

V.2.4. [REPLY]: osdp_RMAC-I – 78h

Description: Client Cryptogram Packet and the Initial R-MAC.

This command transfers a block of data used for encryption synchronization, send in response to osdp_SCRYPT

Security Block CRC

SOM ADDR LEN CTRL REPLY DATA /
Length Type data
CKSUM
Physical
Reader 1Ah 00h:
78h XXh
53h Address CKSUM XXh XXh 14h XXh MAC-I
osdp_CCRYPT / XXh XXh
80h i.e. 1Bh00h:CRC
FEh

MAC-I: is the initial value for the rolling MAC that is used during the Secure Channel Session.
16 bytes It is computed by encrypting the Server Cryptogram received in osdp_SCRYPT using S-MAC1,
then encrypting the result using S-MAC2 encrypted using SMAC-2.

19/11/2019 Version 1.0 Page 16 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

V.2.5. Example:

SCBK-D = 303132333435363738393A3B3C3D3E3F

CP Reader
osdp_CHLG
FF530013000D0311007640608AFC3368475481D3

osdp_CCRYPT
FF53802B000D03120076F51BC08000653119C2
7730D33E3CD7455322921B6ED14703CAF68060
90F59D235979

FF53001B000E0313007728E9B117C65E4C8E9F74 osdp_SCRYP
T
05BE88C48617991C

FF53801B000E03140178911F1141B9EA648B08
osdp_RMAC 2562875459B89F6D9E
_I

osdp_CHLG: osdp_CCRYPT:
53 SOM 53 SOM
00 Physical address reader 80 Physical address reader
1300 LEN 2B00 LEN
0D CTRL 0D CTRL
03 Security Block Length 03 Security Block Length
11 Security Block type 12 Security Block type
00 Security Block data 00 Security Block data
76 CMD 76 REPLY
40608AFC33684754 RndA F51BC08000653119 cUID
81D3 CRC C27730D33E3CD745 RndB
5322921B6ED14703CAF6806090F59D23 ClientCryptogram
5979 CRC

osdp_SCRYPT:
53 SOM
00 Physical address reader
1B00 LEN
0E CTRL
03 Security Block Length
13 Security Block type
00 Security Block data
77 CMD
28E9B117C65E4C8E9F7405BE88C48617 ServeurCryptogram
991C CRC

osdp_RMAC:
53 SOM
80 Physical address reader
1B00 LEN
0E CTRL
03 Security Block Length
14 Security Block type
01 Security Block data
78 CMD
911F1141B9EA648B082562875459B89F MAC-I
6D9E CRC

19/11/2019 Version 1.0 Page 17 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

V.3 Secure chanel: change the secure communication key SCBK

When in “secure session”, the SCBK value can be changed by using the osdp_KEYSET command .
The STid reader will then be locked in secure mode. Non-secure mode is not available any more.
After powering up the RFID reader, the CP must initiate a secure session (using the new SCBK value) so that the reader
can be controlled by the CP.

V.3.1. [COMMAND]: osdp_KEYSET – 75h

Description: Encryption Key Set Command

This command transfers an encryption key from the Control Panel to a reader.

SOM Security Block

ADDR LEN CTRL CMD
Length Type Data
Physiscal
Reader 2Dh 00h: CKSUM
53h XXh 02h 17h none 75h osdp_KEYSET
Address 2Eh 00h: CRC
00h i.e. 7Eh

CRC
DATA MAC[0] MAC[1] MAC[2] MAC[3] /
CKSUM
XXh
Key_Type Length Key_data XXh XXh XXh XXh
/ XXh XXh

The DATA block of this command is padded and encrypted using S-ENC key.

Key_Type: This byte defines the Encryption method to use with this key.
1 byte 01h – Secure Channel Base Key.

Length: 10h : Number of bytes of key data.

1 byte

Key_Data: Value of the key on 16-bytes.

16 bytes

V.3.2. [REPLY]: osdp_ACK – 40h

Security Block CRC
SOM ADDR LEN CTRL REPLY DATA MAC[0] MAC[1] MAC[2] MAC[3] /
Length Type Data
CKSUM
Physiscal 0Dh
Reader 00h: XXh
40h
53h Address CKSUM XXh 02h 17h none none XXh XXh XXh XXh / XXh
osdp_ACK
80h i.e. 0Eh 00h: XXh
FEh CRC

19/11/2019 Version 1.0 Page 18 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

V.3.3. Exemple:

Keyset avec SCBK=BF1835CCFB9B7021237C99A57F89641E

osdp_KEYSET:
FF53002E000F02177598B4CB38A6CA1FE36613A36D2B262AEED33CD2AB8296556B5D5095561496284810A05992EC36
53 SOM
00 Physical address reader
2E 00 LEN
0F CTRL
02 Security Block Length
17 Secure Session msg. with MAC & Data Security CP to Reader
75 CMD
98B4CB38A6CA1FE36613A36D2B262AEED33CD2AB8296 Key type / length / Key data : 32 bytes data enciphered
556B5D50955614962848

Decipher data Key type 01

01 10 BF1835CCFB9B7021237C99A57F89641E Length : 16 bytes
Key data : BF1835CCFB9B7021237C99A57F89641E
10 A0 59 92 MAC[0] MAC[1] MAC[2] MAC[3]
EC36 CRC

osdp_ACK: FF53800E000F0216409B19E0E950B0
53 SOM
80 Physical address reader
0E00 LEN
0F CTRL
02 Security Block Length
16 Secure Session msg. w. MAC, no Data Security
40 REPLY
9B 19 E0 E9 MAC[0] MAC[1] MAC[2] MAC[3]
50B0 CRC

19/11/2019 Version 1.0 Page 19 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VI. Reader settings

To set the number of lane / antenna, LED color on detection user ID, baudrate, the EPC size.. you need to create a
configuration with Ultrysv2 (v2.1.x minimum).

For more information refer to Ultrys User Manual.

Available settings:

19/11/2019 Version 1.0 Page 20 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.Implemented OSDP Commands and Replies

Commands Code Description Replies Code Description

osdp_ID 61h ID Report Request osdp_PDID 45h Device Identifaction Report

osdp_CAP 62h PD Capabilities Request osdp_PDCAP 46h Device Capabilities Report

osdp_LSTAT 64h Local Status Report Request osdp_LSTATR 48h Local status report
osdp_ACK 40h
osdp_OUT 68h Output Control Command
osdp_NAK 41h
osdp_ACK 40h
osdp_LED 69h Reader LED Control Command
osdp_NAK 41h
odsp_ISTAT 65h Input Status Report Request osdp_ISTATR 49h Input Status Report

odsp_OSTAT 66h Output Status Report Request osdp_OSTATR 4Ah Output Status Report

19/11/2019 Version 1.0 Page 21 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.1 osdp_ID - Identification Device

VII.1.1. [COMMAND]: osdp_ID – 61h

Description: Identification Report Request

This command requests the return of the reader ID Report.

The ID request code parameter may request the extended form of the reader ID block.

CKSUM
SOM ADDR LEN CTRL CMD DATA
/ CRC
Physical
Reader 08h 00h: CKSUM XXh
53h XXh 61h: osdp_ID 00h: Send standard PD ID Block
Address 09h 00h: CRC / XXh XXh
00h i.e. 7Eh

VII.1.2. [REPLY]: osdp_PDID – 45h

Description: Identification Report

SOM ADDR LEN CTRL REPLY DATA …

Physical Reader Address 13h 00h: CKSUM STid Vendor STid Vendor STid Vendor
53h XXh 45h: osdp_PDID
00h i.e. 7Eh 14h 00h: CRC code 1st code 2nd code 3rd

…DATA CRC/ CKSUM

Serial Number Firmware revision code XXh
Manufacturer's model number
LSB XXh XXh XXh MSB major minor build / XXh XXh

STid Vendor code 1st: F5h

1 byte
STid Vendor code 2nd: 1Bh
1 byte
STid Vendor code 3rd: C0h
1 byte
Manufacturer's model
number: 80h: SMA / SLA
1 byte

Serial Number: 5-byte serial number (LSB xxh xxh xxh MSB).
5 bytes

Firmware revision code: XXh 00h 00h

3 bytes

19/11/2019 Version 1.0 Page 22 of 44

 OSDP® - UHF
MIFARE GLOBAL ®
Note:
The Model Number and Version fields are assigned by and managed by the Vendor. These fields have no direct
operational purpose.
The 32-bit Serial Number field is assigned and managed by the Vendor. This field has no direct operational purpose.
The Firmware Revision fields are assigned and managed by the Vendor. These fields have no direct operational
purpose.

Example:

osdp_ID: FF53000900046100C066 osdp_PDID: FF538014000445F51BC080 0065311953 0800005586

53 SOM 53 SOM
00 Physical address reader 80 Physical address reader
0900 LEN 1400 LEN
04 CTRL 04 CTRL
61 CMD 45 REPLY
00 Data F51BC0 Vendor Code
C066 CRC 80 Model SMA
0065311953 Serial Number S19316500
080000 Firmware version
5586 CRC

19/11/2019 Version 1.0 Page 23 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.2 osdp_CAP - Capabilities

VII.2.1. [COMMAND]: osdp_CAP – 62h

Description: Peripheral Device Capabilities Request

This command requests the reader to return a list of its functional capabilities, such as the type and number of input
points, outputs points, reader ports, etc.

CKSUM
SOM ADDR LEN CTRL CMD DATA / CRC

Physical
Reader 08h 00h: CKSUM XXh
53h XXh 62h: osdp_CAP 00h: Send standard reply
Address 09h 00h: CRC / XXh XXh
00h i.e. 7Eh

.
VII.2.2. [REPLY]: osdp_PDCAP – 46h

Description: Device Capabilities Report

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physical
2Eh 00h: XXh
Reader
53h CKSUM XXh 46h: osdp_PDCAP Function code Compliance Number of / XXh
Address
2Fh 00h: CRC XXh
80h i.e. FEh

Function code: Directly corresponds to a defined operational capability.

1 byte

Compliance: Indicates the extent the reader supports the Function Code.
1 byte

Number of: If applicable, the field indicates that number of objects of this type that are available.
1 byte

The Device Capabilities report message may contain multiple records of this form (3 bytes per record). Use the total
message length to determine the number of records present.

19/11/2019 Version 1.0 Page 24 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.2.3. Function code list

Function code 1: Contact status Monitoring

This function indicates the ability to monitor the status of a switch using a two-wire electrical connection between the
reader and the switch. The on/off position of the switch indicates the state of an external device.
The PD may simply resolve all circuit states to an open/closed status, or it may implement supervision of the monitoring
circuit. A supervised circuit is able to indicate circuit fault status in addition to open/closed status.

Function Code Compliance Number of

Reader monitors and reports the state of the circuit without any supervision.
01h 01h 04h The reader encodes the circuit status per its default interpretation of contact
state to ON/OFF/NC/NO status.

Function code 2: Output control ‘Relay’

This function provides a switched optocoupled output.
The Output has two states: active or inactive. The CP can directly set the Output's state.

Function Code Compliance Number of

- The reader is able to activate and deactivate the Output per direct command
from the CP.
- The reader is able to accept configuration of the Output driver to set the
inactive state of the Output. The typical state of an inactive Output is the state
of the Output when no power is applied to the reader and the Output device
(relay) is not energized. The inverted drive setting causes the reader to
02h 04h 04h
energize the Output during the inactive state and de-energize the Output
during the active state.
- The reader is able to accept timed commands to the Output. A timed
command specifies the state of the Output for the specified duration.
- Normal/inverted drive and timed operation.

Function code 3: Card data format

This capability indicates the form of the card data is presented to the Control Panel.

Function Code Compliance Number of

The reader sends card data to the CP as array of bits, not exceeding 1024
03h 01h 00h
bits.

Function Code 4: Reader LED Control

This capability indicates the presence of and type of LEDs.
Function Code Compliance Number of

04h 04h 01h The reader support on/off control only and tri-color LEDS.

Function Code 5: Reader Audible Output

This capability indicates the presence of and type of an Audible Annunciator (buzzer or similar tone generator).
Function Code Compliance Number of

05h 01h 00h Readers does not have audible output.

Function Code 6: Reader Text Output

This capability indicates that the PD supports a text display emulating character-based display terminals.).
Function Code Compliance Number of

06h 00h 00h The readers has no text display support.

19/11/2019 Version 1.0 Page 25 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

Function Code 8: Check Character Support

All readers must be able to support the checksum mode. This capability indicates if the reader is capable of supporting
CRC mode.
Function Code Compliance Number of

08h 01h 00h The reader supports the 16-bit CRC-16 mode.

Function Code 9: Communication Security

This capability indicates the extent to which the reader supports communication security as defined in.
Function Code Compliance Number of

09h 01h 01h AES128 bits supported.

Function Code 10: Receive BufferSize

This capability indicates the maximum size single message the reader can receive.
Function Code Compliance Number of

0Ah BufferSizeLSB BufferSizeMSB

Function Code 11: Largest Combined Message Size

This capability indicates the maximum size multi-part message which the reader can handle.
Function Code Compliance Number of

0Bh Combined BufferSizeLSB Combined BufferSizeMSB

Function Code 12: Smart Card Support

This capability indicates whether the reader supports the transparent mode used for communicating directly with a smart
card.
Function Code Compliance Number of

0Ch 00h 00h Reader does not support transparent reader mode.

Function Code 13: Readers

This capability indicates the number of credential reader devices (nbre of lane) present. Compliance levels are bit fields
to be assigned as needed.
Function Code Compliance Number of

0Dh 01h 01h One lane by default. The lane number depends on the customer configuration.
0Dh 02h 02h Two lanes configured
0Dh 03h 03h Three lanes configured
0Dh 04h 04h Four lanes configured

Function Code 14: Biometrics

This capability indicates the ability of the reader to handle biometric input.
Function Code Compliance Number of

0Eh 00h 00h No Biometric.

19/11/2019 Version 1.0 Page 26 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.2.3. Example: SMA + 4 LANES

osdp_CAP: FF530009000462009333
53 SOM
00 Physical address reader
0900 LEN
04 CTRL
62 CMD
00 Data
9333 CRC

osdp_PDCAP: FF53802F0004460101040204040301000404010501000600000801000901010AFA000BFA000C00000D04040E00009347

53 SOM
80 Physical address reader
2F00 LEN
04 CTRL
46 REPLY
01 01 04 Function code 1: 4 inputs
02 04 04 Function code 2: 4 output (all settings available with osdp_OUT)
03 01 00 Function code 3: data to send 1024bits max
04 04 01 Function code 4: 1 LED ( all settings available with osdp_LED) 4 FOIS 1 led
05 01 00 Function code 5: 0 buzzer ( all settings available with osdp_BUZ)
06 00 00 Function code 6: No text display support
08 01 00 Function code 8: CRC-16 support
09 01 01 Function code 9: AES128 support
0A FA 00 Function code 10: buffer size 250
0B FA 00 Function code 11: combined buffer size 250
0C 00 00 Function code 12: transparent mode not support
0D 04 04 Function code 13: 4 lanes
0E 00 00 Function code 14: Fingerprint, Template 2
9347 CKSUM

19/11/2019 Version 1.0 Page 27 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.3 osdp_LSTAT - Local status report

VII.3.1. [COMMAND]: osdp_LSTAT – 64h

Description: Local Status Report Request

This command instructs the reader to reply with a local status report.

CKSUM
SOM ADDR LEN CTRL CMD DATA / CRC

Physical
Reader 07h 00h: CKSUM XXh
53h XXh 64h: osdp_LSTAT none
Address 08h 00h: CRC / XXh XXh
00h i.e. 7Eh

VII.3.2. [REPLY]: osdp_LSTATR – 48h

Description: Local status report

The local status report applies to conditions directly monitored by the reader.
Power monitor status can be derived from the status of the power supply. Normally this reply is sent in response to an
osdp_POLL command if the status has changed since the last POLL

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physical
09h 00h:
Reader 48h: XXh
53h CKSUM XXh 00h Status of power
Address osdp_LSTATR / XXh XXh
0Ah 00h: CRC
80h i.e. FEh

Status of tamper: 00h (no tamper system detection)

1 byte

Status of power: 00h normal

1 byte 01h power failure

VII.3.3. Example

osdp_LSTAT: FF53000700026440 osdp_LSTATR: FF5380090002480000DA

53 SOM 53 SOM
00 Physical address reader 80 Physical address reader
0700 LEN 0900 LEN
02 CTRL 02 CTRL
64 CMD 48 REPLY
40 CKSUM 00 na
00 Power Normal
DA CKSUM

19/11/2019 Version 1.0 Page 28 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.4 osdp_OUT - Output Control

VII.4.1. [COMMAND]: osdp_OUT – 68h

Description: Output Control Command

The Output Control command can alter the permanent state of the optocoupled output, or it can request a timed pulse
output. The permanent command is volatile (does not transcend power cycles).

The Output Control command controls the operation of the optocoupled output associated with a lane. The osdp_OUT is
a multirecord frame.

DATA1*… CKSUM
SOM ADDR LEN CTRL CMD DATA0 for output 0
/ CRC
Physical …
Reader 07h + (4*lane): CKSUM 68h: Output Control Timer Timer XXh
53h XXh
Address 08h + (4*lane): CRC osdp_OUT Number code LSB MSB / XXh XXh
00h i.e. 7Eh

Output Number: 00h First output

1 byte 01h Second output
02h Third output
03h Fourth output

Control code: Requested output code

1 byte 00h NOP – do not alter this output
01h set the permanent state to OFF, abort timed operation (if any)
02h set the permanent state to ON, abort timed operation (if any)
03h set the permanent state to OFF, allow timed operation to complete
04h set the permanent state to ON, allow timed operation to complete
05h set the temporary state to ON, resume perm state on timeout
06h set the temporary state to OFF, resume permanent state on timeout

Timer LSB: The timer value is specified in units of 100 ms.

1 byte Least significant byte.

Timer MSB: Most significant byte, in units of 100 ms.

1 byte

The 16-bit value provided supports a maximum pulse time of 6,553.5 seconds, which is 1 hour, 49 minutes, and
13.5 seconds. A timer value of zero should be interpreted as "forever".

VII.4.2. [REPLY]: osdp_ACK – 40h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 07h 00h: CKSUM XXh
53h XXh 40h osdp_ACK none
80h i.e. FEh 08h 00h: CRC / XXh XXh

VII.4.3 [REPLY]: osdp_NAK – 41h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 07h 00h: CKSUM XXh
53h XXh 41h osdp_NAK 03h
80h i.e. FEh 08h 00h: CRC / XXh XXh

19/11/2019 Version 1.0 Page 29 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.4.4. [REPLY]: osdp_NAK – 41h Multirecord reply

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 08h + (x lane) : CKSUM 09h data0 data1 data2 XXh
53h XXh 41h osdp_NAK
80h i.e. FEh 09h + (x lane) : CRC data3 / XXh XXh

Data 0 FFh: NAK

00h: OK

VII.4.5. Example:

Example 1: Output number 0, Permanent set (02h).

osdp_OUT: FF53000B0002680002000036 osdp_ACK: FF538007000240E4

53 SOM 53 SOM
00 Physical address reader 80 Physical address reader
0B00 LEN 0700 LEN
02 CTRL 02 CTRL
68 CMD 40 REPLY
00 Reader number E4 CKSUM
02 set the permanent state to ON
0000 Timer
36 CKSUM

Example 2: configuration with 2 output

osdp_OUT: FF53000F000068000200000102000031 osdp_ACK: FF538007000040E6

53 SOM 53 SOM
00 Physical address reader 80 Physical address reader
0F00 LEN 0700 LEN
00 CTRL 00 CTRL
68 CMD 40 REPLY
00 Reader number/ lane E6 CKSUM
02 set the permanent state to ON
0000 Timer
01 Reader number / lane
02 set the permanent state to ON
0000 Timer
31 CKSUM

Example 3: command with bad parameters on output1

Osdp_OUT : FF53001000046800020A00010701018b77
Osdp_NAK : FF53800B0004410900FF8D52

19/11/2019 Version 1.0 Page 30 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.5 osdp_LED - LED

VII.5.1. [COMMAND]: osdp_LED – 69h

Description: Reader LED Control Command

The Reader LED Control command controls the operation of the LEDs associated with a lane.
(This command supports the model where multiple LEDs may be associated with a reader)
Color and flash parameters may be specified.
Once the temporary command's timer expires the LED will revert to the last permanent state set.
A timer value of zero specifies zero duration.
The permanent command is volatile (does not transcend power cycles).

SOM ADDR LEN 2 bytes CTRL CMD DATA 0 …

Physical Reader Address 07h +(14*lane): CKSUM
53h XXh 69h: osdp_LED Reader Number LED Number
00h i.e. 7Eh 08h +(14*lane): CRC

…DAT0 DATA1…* CRC/

CKSUM
Temporary Settings Permanent Settings XXh
Control ON OFF ON OFF Timer Timer Control ON OFF ON OFF / XXh
Code Time Time Color Color LSB MSB Code Time Time Color Color XXh

Reader Number: 00h First reader = Lane 1 .

1 byte 01h Second reader = Lane 2
02h Third reader = Lane 3
03h Fourth reader = Lane 4

LED Number: 00h On the osdp STid reader there is only one LED.
1 byte

Control Code: The mode to enter temporarily:

1 byte 00h No change - do not alter this LED's temporary settings.
The remaining values of the temporary settings record are ignored.
01h Cancel any temporary operation and display this LED's permanent state immediately.
02h Set the temporary state as given and start timer immediately.

ON Time: The ON duration of the flash, in units of 100 ms. Minimum 100ms.
1 byte
OFF Time: The OFF duration of the flash, in units of 100 ms. Minimum 100ms
1 byte
ON color: The color value to set during the ON time:
Temporary settings

1 byte 00h Black (off/unlit)

01h Red
02h Green
03h Amber
04h Blue

OFF color: The color value to set during the OFF time:
1 byte 00h Black (off/unlit)
01h Red
02h Green
03h Amber
04h Blue

Timer LSB: Least significant byte, in units of 100 ms. Minimum 100ms.
1 byte
Timer MSB: Most significant byte, in units of 100 ms.
1 byte

19/11/2019 Version 1.0 Page 31 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

Control Code: The mode to return to after the timer expires

1 byte 00h No change - do not alter this LED's permanent settings.
01h Set the permanent state as given.

ON Time: The ON duration of the flash, in units of 100 ms. Minimum 100ms.
1 byte

OFF Time: The OFF duration of the flash, in units of 100 ms. Minimum 100ms.
Permanent settings

1 byte

ON color: The color value to set during the ON time:

1 byte 00h Black (off/unlit)
01h Red
02h Green
03h Amber
04h Blue

OFF color: The color value to set during the OFF time:
1 byte 00h: Black (off/unlit)
01h Red
02h Green
03h Amber
04h Blue

Note:
The LED will flash, alternating between the color specified for ON and color specified for OFF at the rate specified by the
corresponding timers.
Setting both color codes to the same value will produce a steady (non-flashing) output.

The 16-bit timer applies to the temporary LED commands only.

*The LED Control Command message packet may contain multiple 14-byte records. The reader should use the total
message length to determine the number of records present. The number of records should not exceed the number of
LEDs; however the upper limit should not exceed the receive buffer size of the reader.

Records containing an invalid Reader/LED number will result in a 0x09 error reply.
If a CP sets a Temporary Setting and tries to establish another Temporary Setting, then a new Temporary Command
should override a currently active temporary command.

The ON Time OFF Time values cannot both be set to zero.

Warning: LED set to permanent cancel the LED color set by Ultrys configuration.

Warning: osdp_LED command cuts the RF, so there can be be busy responses.
Do not multiply the use of this command. In particular to make the LED flash, use the ON / OFF times of the
command.

19/11/2019 Version 1.0 Page 32 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

Reply in multirecord:

VII.5.2. [REPLY]: osdp_ACK – 40h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 07h 00h: CKSUM XXh
53h XXh 40h osdp_ACK none
80h i.e. FEh 08h 00h: CRC / XXh XXh

VII.5.3 [REPLY]: osdp_NAK – 41h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 07h 00h: CKSUM XXh
53h XXh 41h osdp_NAK 03h
80h i.e. FEh 08h 00h: CRC / XXh XXh

VII.5.4. [REPLY]: osdp_NAK – 41h Multirecord reply

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 08h + (x lane) : CKSUM 09h data0 data1 data2 XXh
53h XXh 41h osdp_NAK
80h i.e. FEh 09h + (x lane) : CRC data3 / XXh XXh

Data 0 FFh: NAK

00h: OK

19/11/2019 Version 1.0 Page 33 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.5.4. Example:

1- To cause the LED on the LANE 0 to blink red (100 ms) / green (200 ms) for 3 seconds, in temporary mode:

osdp_LED: FF530016000469000002010201021E000001010000E97B
53 SOM
00 Physical address reader
1600 LEN
04 CTRL
69 CMD
00 Reader number = lane number = 0
00 Led number 0
02 Control mode temporary: SET
01 01 x 100ms = ON 100ms
02 02 x 100ms = OFF 200ms
01 Red
02 Green
1E00 30 x100ms= 3s
00 Control mode permanent: no change
01 On time: NA
01 Off time: NA
00 On color: NA
00 Off color: NA
E97B CRC

2- To cause the LED on the LANE 0 and 1, to blink red (100 ms) / green (200 ms) for 3 seconds, in temporary mode:

osdp_LED:
FF530024000469000002010201021E000001010000010002010201
021E000001010000362E
53 SOM
00 Physical address reader
2400 LEN
01 CTRL
69 CMD
00 Reader number = lane number = 0
00 Led number 0
02 Control mode temporary: SET
01 01 x 100ms = ON 100ms
02 02 x 100ms = OFF 200ms
01 Red
02 Green
1E00 30 x100ms= 3s
00 Control mode permanent: no change
01 On time: NA
01 Off time: NA
00 On color: NA
00 Off color: NA
01 Reader number = lane number = 1
00 Led number 0
02 Control mode temporary: SET
01 01 x 100ms = ON 100ms
02 02 x 100ms = OFF 200ms
01 Red
02 Green
1E00 30 x100ms= 3s
00 Control mode permanent: no change
01 On time: NA
01 Off time: NA
00 On color: NA
00 Off color: NA
2E36 CRC

19/11/2019 Version 1.0 Page 34 of 44

 OSDP® - UHF
MIFARE GLOBAL ®
3- Example with incorrect parameter on the lane 0

Fait l’action sur la voie 2 et répond NAK FF 53 80 0B00 04 41 09 FF 00 824F OK

osdp_LED:
FF530024000469000002010201021E000301010000010002010201
021E000001010000E370
53 SOM
00 Physical address reader
2400 LEN
04 CTRL
69 CMD
00 Reader number = lane number = 0
00 Led number 0
02 Control mode temporary: SET
01 01 x 100ms = ON 100ms
02 02 x 100ms = OFF 200ms
01 Red
02 Green
1E00 30 x100ms= 3s
03 Bad control mode
01 On time: NA
01 Off time: NA
00 On color: NA
00 Off color: NA
01 Reader number = lane number = 1
00 Led number 0
02 Control mode temporary: SET
01 01 x 100ms = ON 100ms
02 02 x 100ms = OFF 200ms
01 Red
02 Green
1E00 30 x100ms= 3s
00 Control mode permanent: no change
01 On time: NA
01 Off time: NA
00 On color: NA
00 Off color: NA
E370 CRC

osdp_NAK: FF53800B00044109FF00824F
53 SOM
80 Physical address reader
0B00 LEN
04 CTRL
41 NAK
09 Multi record
FF Error on data 0
00 OK on data 1
824F CRC

19/11/2019 Version 1.0 Page 35 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.6 osdp_ISTAT - Input status report

VII.6.1. [COMMAND]: osdp_ISTAT – 65h

Description: Input Status Report Request

Instructs the reader to reply with an optocoupled input status report.

CKSUM
SOM ADDR LEN CTRL CMD DATA
/ CRC
Physical Reader Address 07h 00h: CKSUM XXh
53h XXh 65h: osdp_ISTAT none
00h i.e. 7Eh 08h 00h: CRC / XXh XXh

VII.6.2. [REPLY]: osdp_ISTATR – 49h

Description: Input Status Report

Sent in response to an osdp_ISTAT command.

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physical Reader Address 0Bh 00h: CKSUM XXh
53h XXh 49h: osdp_ISTATR Status
80h i.e. FEh 0Ch 00h: CRC / XXh XXh

Status: 00h inactive

1 byte*input 01h active

The status of all inputs will be returned in this reply. The array size is defined by the total message length. The order of
the Status Bytes corresponds to the numbering of the inputs, e.g. the first Status Byte corresponds to the first input, etc.

VII.6.3. Example:

osdp_ISTAT: FF5300070003653E osdp_ISTATR: FF53800B00034901000000D5

53 SOM 53 SOM
00 Physical address reader 80 Physical address reader
0700 LEN 0B00 LEN
03 CTRL 02 CTRL
65 CMD 49 REPLY
3E CKSUM 01 Active IN0
00 Inactive IN1
00 Inactive IN2
00 Inactive IN3
D5 CKSUM

19/11/2019 Version 1.0 Page 36 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VII.7 osdp_OSTAT – Output status report

VII.7.1. [COMMAND]: osdp_OSTAT – 66h

Description: Output Status Report Request

Instructs the reader to reply with an output status report.

CKSUM
SOM ADDR LEN CTRL CMD DATA
/ CRC
Physical Reader Address 07h 00h: CKSUM XXh
53h XXh 66h: osdp_OSTAT none
00h i.e. 7Eh 08h 00h: CRC / XXh XXh

VII.7.2. [REPLY]: osdp_OSTATR – 4Ah

Description: Output Status Report

Sent in response to an osdp_OSTAT command.

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physical Reader Address 0Bh 00h: CKSUM XXh
53h XXh 4Ah: osdp_OSTATR Status
80h i.e. Feh 0Ch 00h: CRC / XXh XXh

Status: 00h inactive

1 byte*output 01h active

The status of all output will be returned in this reply. The array size is defined by the total message length. The order of
the Status Bytes corresponds to the numbering of the output, e.g. the first Status Byte corresponds to the first output, etc.

VII.7.3. Example:

osdp_OSTAT: FF5300070002663E osdp_OSTATR: FF53800B00024A01010101D2

53 SOM 53 SOM
00 Physical address reader 80 Physical address reader
0700 LEN 0B00 LEN
02 CTRL 02 CTRL
66 CMD 4A REPLY
3E CKSUM 01 Output 0 active
01 Output 1 active
01 Output 2 active
01 Output 3 active
D2 CKSUM

19/11/2019 Version 1.0 Page 37 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VIII. Polling

VIII.1 COMMAND: osdp_POLL – Polling

Description: Poll

This command serves as a general inquiry. The reader may return any reply that is marked as a possible “poll response”.
Normally, the reader will return any unreported input data or status change information as a poll response.

SOM ADDR LEN CTRL CMD DATA CKSUM / CRC

Physical Reader Address 08h 00h: CKSUM XXh

53h XXh 60h: osdp_ POLL NONE
00h i.e.7Eh 09h 00h: CRC / XXh XXh

VIII.2 REPLIES

Replies Code Description

osdp_ACK 0x40 General Acknowledge

osdp_NAK 0x41 Negative Acknowledge

osdp_LSTATR 0x48 Local Status report 1

Osdp_ISTATR 0x49 Input Statut Reply

Osdp_OSTATR 0x4A Output Statut Reply

osdp_RAW 0x50 Card data report, Raw bit Array 2

osdp_BUSY 0x79 Reader Busy reply

19/11/2019 Version 1.0 Page 38 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VIII.2.1. osdp_ACK - Acknowledge

Description: General Acknowledge, Nothing to Report (osdp_ACK)

There is no reply structure associated with this reply. Sent in response to all valid commands that do not require a
specific response or will not receive an immediate response.

[REPLY]: osdp_ACK – 40h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 07h 00h: CKSUM XXh
53h XXh 40h osdp_ACK none
80h i.e. FEh 08h 00h: CRC / XXh XXh

VIII.2.2. osdp_NAK - Negative Acknowledge

Description: Negative Acknowledge – SIO Comm Handler Error Response (osdp_NAK)

[REPLY]: osdp_NAK – 41h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 08h 00h: CKSUM XXh
53h XXh 41h osdp_NAK Error code
80h i.e. FEh 09h 00h: CRC / XXh XXh

Error code:
Error Code Error
1 byte
01h Message check character(s) error (bad checksum/CRC)

02h Command length error

03h Unknown Command Code – Command not implemented by reader

04h Unexpected sequence number detected in the header

05h The reader does not support the security block that was received

06h Communication security conditions not met

09h Unable to process command record

Note:
Error Code 09h “Unable to process command record” – indicates that one or more command records had invalid
parameters and was not processed which may be followed by an optional array, where each byte represents the
completion code of the corresponding command record. A zero value indicates no error, and the value FFh indicates a
generic error. The remaining values are reserved for future definition.LSTATR

19/11/2019 Version 1.0 Page 39 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VIII.2.3. osdp_LSTATR - Local status report

Description: Local status report

Sent in response to an osdp_LSTAT command or as a "poll response".

The local status report applies to conditions directly monitored by the reader.
Tamper status is detected by the reader by monitoring the enclosure tamper mechanism. Power monitor status can be
derived from the status of the power supply. Normally this reply is sent in response to an osdp_POLL command if either
status has changed since the last POLL.

[REPLY]: osdp_LSTATR – 48h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physical
Reader 09h 00h: CKSUM 48h: Status of tamper circuit XXh
53h XXh Status of power
Address 0Ah 00h: CRC osdp_LSTATR NA / XXh XXh
80h i.e. FEh

Status of tamper: 0x00: by default

1 byte

Status of power: 0x00: normal

1 byte 0x01: power failure

19/11/2019 Version 1.0 Page 40 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VIII.2.4. osdp_RAW - Card Data Report, Raw Bit Array

Description: Card Data Report, Raw Bit Array

Sent as a "poll response".

This reply is sent in response to an osdp_POLL command after a card was read but the raw data was not decoded into a
character array.
Unreported card data is deleted in case of, or during, a communication loss.

[REPLY]: osdp_RAW – 50h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physical Count
XXh XXh: XXh
Reader Reader Format
53h CKSUM XXh 50h: osdp_RAW Data / XXh
Address number code LSB MSB
XXh XXh: CRC XXh
80h i.e. FEh

Reader Number: 00h First reader = Lane 1 .

1 byte 01h Second reader = Lane 2
02h Third reader = Lane 3
03h Fourth reader = Lane 4

Format code: 00h not specified, raw bit array

1 byte 01h P/data/P (Wiegand) NA

Count: 2-byte size (in bits) of the data at the end of the record
2 bytes

Data: MSB to LSB (left justified)

n bytes

19/11/2019 Version 1.0 Page 41 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

VIII.2.5. osdp_BUSY - Reader Busy Reply

Description: Reader Busy Reply

The reader must begin sending a reply less than REPLY_DELAY after it receives the last character of a valid command.
If it cannot, it should send an osdp_BUSY.

[REPLY]: osdp_BUSY – 79h

CRC
SOM ADDR LEN CTRL REPLY DATA /
CKSUM
Physiscal Reader Address 07h 00h: CKSUM XXh
53h XXh 79h: osdp_BUSY none
80h i.e. FEh 08h 00h: CRC / XXh XXh

This reply will use either checksum or CRC for message integrity even if the secure channel has been established and
commands are exchanged using secure messaging.
In other words, the busy reply is sent outside the secure channel and should not influence the secured messages that
are sent before or after this reply.

The osdp_ACK is the appropriate response if the data requested by the command is not immediately available but will be
returned in response to a subsequent osdp_POLL. Otherwise (meaning that a specific non-ACK response is required
and the data is not available in time to meet the REPLY_TIMEOUT), the reader responds with osdp_BUSY until it is able
to return the requested data. In this case, the CP shall continue to repeat the command in its original form until the PD
returns something other than osdp_BUSY.

Note:
The command MFG_TIMEOUT_BUSY allows to set the duration between a frame received from the CP and the sending
of a busy in the case of the reader is busy (by reading a big data in a badge for example).

The sequence number of this reply will always be set to 0.

19/11/2019 Version 1.0 Page 42 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

IX. OSDP Manufacturer Specific Commands

IX.1. List of Manufacturer Commands

Commands Command_ID SubCommandCode Note

MFG_TIMEOUT_BUSY 04h -

IX.2 osdp_MFG – 80h: Structure command

Description: Manufacturer Specific Command

This command is intended to allow manufacturer specific commands to be embedded within this protocol.

CKSUM
SOM ADDR LEN CTRL CMD DATA
/ CRC
Physical
xxh 00h:
Reader 80h: STid STid STid XXh
CKSUM Command
53h Address XXh osdp_ Vendor Vendor Vendor Command_ID / XXh
xxh xxh: specific data
00h MFG code 1st code 2nd code 3rd XXh
CRC
i.e.7Eh

STid Vendor code 1st: F5h

1 byte
STid Vendor code 2nd: 1Bh
1 byte
STid Vendor code 3rd: C0h
1 byte
Command_ID: Command_ID specific to STid readers:
1 byte 04h MFG_TIMEOUT_BUSY
Command specific data: Defined for each Command_ID
1 byte

IX.3- MFG_TIMEOUT_BUSY

The command MFG_TIMEOUT_BUSY allows to set the duration between a frame received from the CP and the sending
of a busy in the case of the reader is busy (by reading a big data in a badge for example).

SOM ADDR LEN CTRL CMD DATA CKSUM / CRC

Physical Reader Address 0Dh 00h: CKSUM XXh

53h XXh 80h: osdp_ MFG F5h1Bh C0h 04h Delay
00h i.e.7Eh 0Ch 00h: CRC / XXh XXh

Delay: the unit is in hundredths of a millisecond. By default the timeout is set to 02h (200ms).
1 byte [ 02h – FFh]

19/11/2019 Version 1.0 Page 43 of 44

 OSDP® - UHF
MIFARE GLOBAL ®

X. Revision History

Date Version Description

19/11/2019 1.0 Initial version of the document

19/11/2019 Version 1.0 Page 44 of 44