FEIG CPR70 Manual

IDENTIFICATION
Manual
ID CPR70
RFID-Reader Module
H30121-2e-ID-B
IDENTIFICATION ID CPR70 NOTE
NOTE
With the edition of this document, all previous editions become void. Indications MifareAppIDe in this manual
may be changed without previous notice.
Copying of this document and giving it to others and the use or communication of the contents thereof are
forbidden without express authority. Offenders are liable to the payment of damages. All rights are reserved
in the event of the grant of a patent or the registration of a utility model or design.
Composition of the information in this document has been done to the best of our knowledge. FEIG
ELECTRONIC GmbH does not guarantee the correctness and completeness of the details given in this
manual and may not be held liable for damages ensuing from incorrect or incomplete information. Since,
despite all our efforts, errors may not be completely avoided, we are always grateful for your useful tips.
The instructions given in this manual are based on advantageous boundary conditions. FEIG ELECTRONIC
GmbH does not give any guarantee promise for perfect function in cross environments and does not give
any guarantee for the functionality of the complete system which incorporates the subject of this document.
FEIG ELECTRONIC GmbH calls explicit attention that devices which are subject of this document are not
designed with components and testing methods for a level of reliability suitable for use in or in connection
with surgical implants or as critical components in any life support systems whose failure to perform can
reasonably be expected to cause significant injury to human health. To avoid damage, injury or death the
user or application designer must take reasonably prudent steps to protect against system failures.
FEIG ELECTRONIC GmbH assumes no responsibility for the use of any information contained in this
document and makes no representation that they are free of patent infringement. FEIG ELECTRONIC GmbH
does not convey any license under its patent rights nor the rights of others.
Manual Page 2 of 231

IDENTIFICATION ID CPR70 General Information
General Information
Notation Description
These bit spaces are reserved for future extensions or for internal testing and
- manufacturing functions. These bit spaces must not be changed, as this may cause faulty
operation of the reader.
0…9: Decimal figures
0x00…0xFF Hexadecimal figures
[0x00] In square brackets “[0x00]” marks a control byte (command).
(0x00) In round brackets “(0x00)” marks a control byte (optional)
b0…1 Binary figures
 NOTE:
• In this document only the REQUEST-PAYLOAD and the RESPONSE-PAYLOAD blocks are documented.
• Optional parameters are documented inside of round brackets "(Optional)"
History of Documentation
Revision Date Chapter Description

December
0e Initial version
2022
Document General bug fix
3.0 Logical View definitions were extended from CFG descriptions
February 3.4.2 Example Scan Mode
1e /March 4.4.1 Example Inventory for ISO15693
2023 4.5.11 Message TAM (MSG) corrected
4.10.3 Block Permalock
12 ANNEX E Labeling of configuration parameter
June 4.4.2 [0x25] Select
2e
2023 CARD_INFO: case FORMAT = 0x05 and case FORMAT = 0x05 added
Supported Documents
Categorie Supported documents
Manual H01110-xe-ID-B)

IDENTIFICATION ID CPR70 Abbreviations
Abbreviations
ADR Address TS Timeslot

Unique Identifier (read-only Serial
AFI Application Family Identifier UID
Number)
ASK Amplitude Shift Keying WR Write
Answer to Request (ISO/IEC 14443-
ATQA WO Write Only Access
4)
ATS Answer to Select (ISO/IEC 14443-4)
CB Config Block
CFG Configuration Parameter Block
CRC Cyclic Redundancy Check
DB Data Block
DIP Dual Inline Plastic
DRM Dense Reader Mode
EAS Electronical article backup
EGT Extra Guard Time (ISO/IEC 14443B)
EOF End of Frame
EPC Electronic Product Code
FIFO First in First out
frq Frequency
FSK Frequency Shift Keying
FWI Frame Waiting Time Integer
FWT Frame Waiting Time
h Hour
Hz Hertz
ID Identification
IDD Identifier Data
IN Input
LEN Length
LOC Location
LSB Least Significant Byte
min Minutes
ms Milliseconds
MSB Most Significant Byte
NTFM Notification Mode
N Number
OUT Output
PUPI Pseudo-Unique PICC Identifier
PICC Proximity integrated circuit card
R/W Read / Write Access
RD Read
REL Relay
RF Radio Frequency
RSSI Received Signal Strength Indicator
RTC Real Time Clock
s / sec Seconds
Select Acknowledge (ISO/IEC
SAK
14443A)
SOF Start of Frame
TAB Table
TR transponder

IDENTIFICATION ID CPR70 Document Structure
Document Structure
Chapter Topics
1 Structure of the document
2 Technical conditions of the CPR70
Reader configuration (logical view)
Operating modes
Host Mode
Scan Mode
3
Configuration- and Control Commands
Interface
Reader protocol
Example for command transmission
4 Commands
5 Supported Host Commands
ANNEX A, B, C, C1, D, E
6
ANNEX E Labeling of configuration parameter (CFG)

IDENTIFICATION ID CPR70 Content
Content
1 Introduction 11
2 Technical conditions of the CPR70 11
2.1 Supported standards....................................................................................................... 11

2.2 Interfaces ......................................................................................................................... 11
2.3 I/O’s .................................................................................................................................. 11
2.4 Antennas on reader module ........................................................................................... 11
2.5 Types of Operating Modes .............................................................................................. 12
2.5.1 Host Mode (default) ............................................................................................... 12
2.5.2 Auto Read Mode “Scan Mode” ............................................................................... 12
2.6 Command for reader configuration and reader control ................................................ 13
2.7 Data Format and Protocol Frames ................................................................................. 13
2.7.1 Standard Protocol Frame ....................................................................................... 14
2.7.2 Advanced Protocol Frame...................................................................................... 15
2.7.3 Timing Conditions .................................................................................................. 16
2.7.4 CRC16 Calculation Algorithm ................................................................................ 17
2.8 Example: Inventory for ISO15693 ................................................................................... 17
3 Configuration (Parameter groups) 18
3.1 Information to the parameter groups (ISOStart) ............................................................ 18

3.2 AccessProtection ............................................................................................................ 19
3.3 HostInterface ................................................................................................................... 20
3.3.1 Serial (Asynchron interface RS232 settings) .......................................................... 20
3.3.2 USB ....................................................................................................................... 22
3.4 Operating Mode ............................................................................................................... 22
3.4.1 Host Mode ............................................................................................................. 22
3.4.2 Scan Mode (Auto Read Mode) ............................................................................... 23
3.5 AirInterface ...................................................................................................................... 43
3.6 Transponder .................................................................................................................... 44
3.6.1 Driver ..................................................................................................................... 44
3.6.2 Anticollision ............................................................................................................ 48
3.6.3 HF.......................................................................................................................... 48
3.6.4 Miscellaneous ........................................................................................................ 53

3.7 Digital I/O.......................................................................................................................... 54
3.7.1 Output .................................................................................................................... 54
3.7.2 Signaler ................................................................................................................. 55
4 Commands 57
4.1 Reader Commands .......................................................................................................... 57

4.1.1 [0x52] Baud Rate Detection ................................................................................... 57
4.1.2 [0x55] Start Flash Loader ....................................................................................... 58
4.1.3 [0x63] CPU Reset .................................................................................................. 59
4.1.4 [0x64] System Reset .............................................................................................. 60
4.1.5 [0x65] Get Software Version .................................................................................. 61
4.1.6 [0x66] Get Reader Info........................................................................................... 62
4.1.7 [0x69] RF Reset ..................................................................................................... 69
4.1.8 [0x6A] RF Output ON/OFF ..................................................................................... 69
4.1.9 [0x72] Set Output ................................................................................................... 70
4.1.10 [0xA0] Reader-Login ............................................................................................ 72
4.1.11 [0xA2] Write Mifare Reader Keys ......................................................................... 72
4.1.12 [0xA3] Write DES / AES Reader Keys .................................................................. 73
4.2 Configuration Commands ............................................................................................... 75
4.2.1 [0x80] Read Configuration ..................................................................................... 75
4.2.2 [0x81] Write Configuration...................................................................................... 76
4.2.3 [0x82] Save Configuration ...................................................................................... 77
4.2.4 [0x83] RESET (Set Default Configuration) ............................................................. 78
4.3 Host commands for transponder communication ........................................................ 79
4.3.1 ISO/IEC 14443 Standard Mode ............................................................................. 79
4.3.2 Transponder Addressing Modes: ........................................................................... 81
4.4 [0xB0] Standard Host Commands .................................................................................. 84
4.4.1 [0x01] Inventory ..................................................................................................... 84
4.4.2 [0x25] Select .......................................................................................................... 98
[0x23] Read Multiple Blocks ............................................................................................ 102
4.4.3 [0x24] Write Multiple Blocks ................................................................................. 104
4.5 [0xB0] ISO 15693 Commands ....................................................................................... 108

4.5.1 [0x02] Stay Quiet ................................................................................................. 108

4.5.3 [0x26] Reset to Ready ......................................................................................... 110
4.5.4 [0x27] Write AFI ................................................................................................... 111
4.5.5 [0x28] Lock AFI .................................................................................................... 112
4.5.6 [0x29] Write DSFID (ISO15693) ........................................................................... 113
4.5.7 [0x2A] Lock DSFID .............................................................................................. 114
4.5.8 [0x2B] Get System Information ............................................................................ 115
4.5.9 [0x2C] Get Multiple Block Security Status ............................................................ 120
4.5.10 [0x35] Authenticate (ICode DNA) ....................................................................... 121
4.5.11 [0x39] Challenge (ICode DNA) ........................................................................... 128
4.5.12 [0x3A] ReadBuffer (ICode DNA) ......................................................................... 131
4.6 [0xB0] ISO 14443 Standard Host Commands .............................................................. 132
4.6.1 [0xC0] Halt - ISO 14443-3 transponder ................................................................ 132
4.7 [0xB2] ISO14443 Special Host Commands .................................................................. 133
4.7.1 [0x2B] ISO14443-4 transponder-Info ................................................................... 134
4.7.2 [0x30] Mifare Value Commands ........................................................................... 135
4.7.3 [0xB0] Authent Mifare classic ............................................................................... 137
4.7.4 [0xB2] Authent Mifare Ultralight C ........................................................................ 139
4.7.5 [0xBB] ISO 14443-B (Innovatron) Data Exchange ............................................... 140
4.7.6 [0xBE] ISO 14443-4 T=CL ................................................................................... 141
4.8 [0xC1] / [0xC3] Host Commands for mifare DESFire Communication ....................... 147
4.9 [0xC2] ISO Host Commands for Mifare Plus Communication .................................... 147
4.10 [0xB3] ISO18000-3M3 Standard Host Commands ....................................................... 148
4.10.1 [0x18] Kill ........................................................................................................... 148
4.10.2 [0xB3] [0x22] Lock .............................................................................................. 149
4.10.3 0xB3] [0x25] Block Permalock ............................................................................ 150
4.10.4 [0xB3] [0x26] Read Permalock Status ................................................................ 153
4.11 Special Commands for transponder Communication................................................. 155
4.11.1 [0xB8] FeliCa Transparent Command ................................................................ 155
4.11.2 [0xB9] Jewel Transparent Command ................................................................. 158
4.11.3 [0xBD] ISO14443A Transparent Command........................................................ 160
4.11.4 [0xBE] ISO14443B Transparent Command ........................................................ 169
4.11.5 [0xBF] ISO15693 Transparent Command .......................................................... 175

4.12 [0xBC] Command Queue .............................................................................................. 181
5 Supported Host Commands 185
5.1 ISO14443A & B Part 4 compliant transponder............................................................. 185

5.1.1 Mifare DESFire .................................................................................................... 186
5.1.2 NXP - Mifare Plus (Security Level 0, 2, 3) ............................................................ 189
5.2 ISO14443A Part 3 compliant transponder .................................................................... 191
5.2.1 Infineon - my-d move SLE66R01P ....................................................................... 191
5.2.2 Infineon - my-d proximity SLE55Rxx .................................................................... 192
5.2.3 NXP - Mifare classic: mini, 1k, 4k / mifare plus (Level 1) ...................................... 193
5.2.4 NXP - Mifare UltraLight ........................................................................................ 194
5.2.5 NXP - Mifare Ultralight C ...................................................................................... 194
5.2.6 NXP – NTAG 210, 212, 213, 215, 216 ................................................................. 195
5.3 ISO14443A Part 2 compliant transponder .................................................................... 196
5.3.1 Innovision – Jewel ............................................................................................... 196
5.4 ISO15693 transponder................................................................................................... 197
5.4.1 EM Microelectronics (EM4034) ............................................................................ 197
5.4.2 EM Microelectronics (EM4135) ............................................................................ 198
5.4.3 Fujitsu (MB89R116) ............................................................................................. 199
5.4.4 Fujitsu (MB89R118) ............................................................................................. 200
5.4.5 Fujitsu (MB89R119) ............................................................................................. 201
5.4.6 Infineon (ISO address mode) 0xE0 ...................................................................... 202
5.4.7 Infineon (My-d Light) ............................................................................................ 203
5.4.8 NXP (I-Code SLI) ................................................................................................. 204
5.4.9 NXP (I-Code SLI-S) ............................................................................................. 205
5.4.10 NXP (I-Code SLI-L) ............................................................................................ 206
5.4.11 NXP (I-Code SLIX-S) ......................................................................................... 207
5.4.12 NXP (I-Code SLIX-L) .......................................................................................... 208
5.4.13 NXP (I-Code SLIX2) ........................................................................................... 209
5.4.14 NXP ICode DNA................................................................................................. 210
5.4.15 STMicroelectronics (LRI64) ................................................................................ 211
5.4.16 STMicroelectronics (LRI2k, LRIS2k)................................................................... 212
5.4.17 STMicroelectronics (M24LR64-R) ...................................................................... 213

5.4.18 Texas Instruments (Tag-it HFI Pro / Standard) ................................................... 214

5.4.19 Texas Instruments (Tag-it HFI Plus) ................................................................... 215
5.5 ISO18000-3M3 Transponders........................................................................................ 216
5.5.1 NXP ICode ILT-M ................................................................................................ 216
6 ANNEX A: Codes of Transponder Types 217
7 ANNEX B: Codes of Reader Types 218
8 ANNEX C: Index of Status Bytes 219
9 ANNEX C1: Crypto Processing Error 221
10 ANNEX C2: Error-Codes 222
11 ANNEX D Examples for Read Data 223
12 ANNEX E Labeling of configuration parameter 224

IDENTIFICATION ID CPR70 Introduction
1 Introduction
2 Technical conditions of the CPR70
2.1 Supported standards

• ISO 14443 Type A und Type B
• ISO 15693
• ISO 18000-3M3
• ISO 18092 (Communication with NFC devices)
2.2 Interfaces
• USB-Interface
• RS232-TTL-Interface
Method of data transmission Asynchronous (RS232) USB

Configuration and Control Commands
Host Commands
Scan-Mode
2.3 I/O’s
• 3 x digital outputs for control and display purposes (e.g. for the connection of external LEDs)
• 1 x output LED OUT (electrical tap of the red LED)
2.4 Antennas on reader module

• 1 x internal antenna
• 1 x external antenna connector, this can also be used for the multiplexer ID CPR.ANT.MUX
(when using several ext. antennas).

IDENTIFICATION ID CPR70 Technical conditions of the CPR70
2.5 Types of Operating Modes

The CPR70 is using the “Host Commands” and the Auto Read Mode “Scan-Mode” for the data exchange
between transponder and host, whereas the Configuration Commands and the Control Commands are for
adapting the reader parameters to the individual range of applications.
2.5.1 Host Mode (default)

• The Host mode is the default operating mode of the reader.
• With this mode the reader operates fully host controlled.
• Reader Commands, Configuration Commands and the Host Commands are supported.
• Read and write commands to the transponder are possible
• Without connection to the host, the reader is in standby and waits for commands.
• Manual multiplexing function
2.5.2 Auto Read Mode “Scan Mode”

• The reader sends out data autonomously, as soon as a transponder is within the detection range
and valid data could be read.
• Scan mode is available via the

- Asynchronous Interface (RS232) and
- USB Interface
• Via USB, the reader sends data automatically over the HID interface of the operating system.
The reader works like a keyboard.
• The reader starts the output of the protocol block (IDD, data block) as soon as all required data have
been read correctly from the transponder.
• If the number of transmitted user data is too large, only the maximum number of transmitted data will
be sent.

2.6 Command for reader configuration and reader control

This method of data transmission is used for reader configuration and the diagnosis via the asynchronous
interface.
The reader configuration parameters will be stored in the reader memory. To store the current configuration
during a power down of the reader, configuration must be stored in the EEPROM. After power up the reader
reads the configuration out of the EEPROM.
The reader control is immediately processed and the answer from the reader contains status or data
information of the control command.
2.7 Data Format and Protocol Frames

The communication between reader and connected host executed by means of fixed protocols. The used
protocol is intended for data bus use and offers an address byte for addressing devices within one data bus.
During data transfer the reader supplies the required data or a status byte. The response contains the
transmitted command byte.
There is no reply from the reader in case of a protocol frame failure.
Supported protocol frames

• Standard Protocol Frame
• Advanced Protocol Frame

2.7.1 Standard Protocol Frame

• The reader supports this frame to ensure the backward compatibility to older RFID reader devices.
• The readers response will depend on the length of the response data
• It is limited to a 255 byte protocol length and is not recommended for new applications.
Description of Standard Protocol Elements

Parameter Description / Value
Standard Protocol Frame (6…255);
Length (n)
Number of protocols byte including Length and CRC16
0...254 address of device in bus mode.
COM-ADR
The reader can be addressed via COM-ADR 255 at any time
COMMAND Defines the Command which the reader should operate.
Includes the status message or protocol data from or to the reader.
STATUS
ANNEX C: Index of Status Bytes
Cyclic redundancy check of the protocol byte from 1 to n-2, as specified by CCITT-CRC16.
In case of USB communication the CRC16 value is not checked by the reader.
CRC16
Polynominal 0x8408 (x16 + x12 + x5 + 1 reversed)
Start Value 0xFFFF

2.7.2 Advanced Protocol Frame

• This frame is recommended for all new applications
• The Advanced Protocol Frame can transfer up to 65535 Byte per frame
• It uses a defined STX character.

Description of advanced Protocol Elements

STX The STX sign (0x02) at the start of protocol indicates an Advanced Protocol-Frame.
Advanced Protocol Frame (7...65535)
Length
Number of protocol bytes including STX, LENGTH and CRC16
0...254 address of device in bus mode. The reader can be addressed via COM-ADR 255 at any
COM-ADR time. For non-serial communication the COM-ADR is not necessary and can be set to 0 in each
command.
COMMAND Defines the Command which the reader should operate.
The status message from the reader see
STATUS
DATA is an optional data Parameter with variable length. The number of DATA byte depends on
DATA
the command. All multibyte values are in big-endian byte order (MSB first, LSB last).
Is the checksum of the protocol frame (LSB first, MSB last).
CRC16 Polynomial: x16 + x12 + x5 + 1 CRC_POLYNOM = 0x8408;
Start Value: 0xFFFF CRC_PRESET = 0xFFFF;
2.7.3 Timing Conditions

Transponder Response-Time (TR-Time):
1) TR-Time defines the time within the reader expects a response by the transponder.
2) When the TR-Time > max. TR-Time, the reader sends a timeout command to the host and interrupts the
data transmission.
Character timeout:
Within one protocol, the characters must follow each other in intervals of maximum 12 ms.

2.7.4 CRC16 Calculation Algorithm

Polynom: x16 + x12 + x5 + 1 → CRC_POLYNOM = 0x8408;
Start Value: 0xFFFF → CRC_PRESET = 0xFFFF;
C-Example:
unsigned int crc = CRC_PRESET;
for (i = 0; i < cnt; i++) // cnt = number of protocol bytes without CRC
{
crc ^= DATA[i];
for (j = 0; j < 8; j++)
{
if (crc & 0x0001)
crc = (crc >> 1) ^ CRC_POLYNOM;
else
crc = (crc >> 1);
}
}
2.8 Example: Inventory for ISO15693

Protocol View from ISOStart
>> 02 00 09 FF B0 01 00 18 43
<< 02 00 13 00 B0 00 01 03 D1 E0 04 02 00 00 01 AA 76 B1 94 OK
REQUEST
1 2 1 1 1 1 2
BUS- SUB-
STX LENGTH COMMAND MODE CRC16
ADR COMMAND
0x02 0x00 09 0xFF 0xB0 0x01 0x00 0x18 43
REQUEST-DATA
RESPONSE
1 2 1 1 1 1 2
BUS- COM- DATA- TR-
STX LENGTH STATUS DSFID IDD CRC16
ADR MAND SETS TYPE
0xE0 04 02 00
0x02 0x00 13 0x00 0xB0 0x00 0x01 0x03 0xD1 0xB1 94
00 01 AA 76
RESPONSE-DATA

IDENTIFICATION ID CPR70 Configuration (Parameter groups)
3 Configuration (Parameter groups)
3.1 Information to the parameter groups (ISOStart)

Parameter groups
Parameter groups Summary
AccessProtection Settings for access rights
Hostinterface Settings of connection to a host
OperatingMode Setting the operating mode and related parameters
AirInterface Settings for the RFID air interface
Transponder Transponder specific settings
Digital I/O Settings for the inputs and outputs of the reader
 NOTE
For each parameter group and subgroups, a table with the related parameters is given. This information is
provided for experienced users.
Structure of „Logical name“

The logical name of the individual parameters is done via a “namespace + parameter name”.
The namespace consists of the parameter groups and if necessary further subgroups.
The individual parts of the logical name are separated by dots.
Parameter table structure

Logical Name
Namespace
Possible Values Default Value Factor / Unit Reset
None, Soft, Hard

or Reconnect(1)
Description
Parameter description (ISOStart+)

Details
(1) Explanation Reset description “None”, “Soft”, “Hard” or “Reconnect”

Type Description
None Parameter will become effective immediately. No reset is needed
Soft Parameter will become effective after [0x63] Soft Reset
Hard Parameter will become effective after [0x64] Hard Reset
Reconnect Parameter will become effective after reconnecting or [0x64] Hard Reset

3.2 AccessProtection
AccessProtection offers the possibility to lock memory blocks in different ways.
Use a Password with length 4 byte.
0x00000000 = no password defined.
There are 16 memory blocks available.
Logical Name
AccessProtection.Password
0x00000000 – 0xFFFFFFFF 0x00000000 - Soft

Description
Define a password: Length = 4 byte
Logical Name
AccessProtection.Lock_CFG0 AccessProtection.Lock_CFG8
b00: Unprotected b00: Unprotected - Soft

b01: Read protected
b10: Write protected
b11: Read and Write protected
Description
AccessProtection offers the possibility to lock memory blocks in different ways.

There are 16 memory blocks available.

3.3 HostInterface
The “HostInterface” settings relate to the connection between the reader and the host.
The individual interfaces can be disabled, only USB is always enabled as the standard interface.
3.3.1 Serial (Asynchron interface RS232 settings)

Logical Name
HostInterface.Serial.BusAddress
0...254 0 - Soft
Description
Bus address of the reader (0…254) for communication via the asynchronous interface
 NOTE:
• Do not configure address 255!

• Via the bus address 255 in the send protocol, the reader is able to be addressed at any time. It answers
then with its configured address.
Logical Name
HostInterface.Serial.Baudrate
0x05: 4800 baud 0x08: 38400 baud - Soft

0x06: 9600 baud
0x07: 19200 baud
0x08: 38400 baud
0x09: 57600 baud
0x0B 115200 baud
0x0D: 230.400 baud
Description
Defines the baud rate of the RS232.
 NOTE:
• Make sure that your host system supports the selected baud rate. If not it's impossible to communicate
with the reader any longer after the baud rate was changed!
• A plausibility check is performed by writing this parameter to the reader. If an error occurs the reader
answers with STATUS = 0x11.

Logical Name
HostInterface.Serial.Parity
b00: no parity b01: even parity - Soft

b01: even parity
b10: odd parity
Description
Defines the parity for the transmission.
Logical Name
HostInterface.Serial.Databits
b0 = 8 data bits b0 = 8 data bits - Soft

Description
Defines the number of data bits for the serial transmission.
Logical Name
HostInterface.Serial.StopBits
b0 = 1 stop bit b0 = 1 stop bit - Soft

Description
Defines the number of start bits for the serial transmission.
Logical Name
HostInterface.Serial.ProtocolStartSynchronizationTime
0...5 5 ms Soft
Description
The duration of the minimum communication gap between the reception of the last byte of the response protocol and
the first byte of a new protocol can be defined in 1 ms steps.
The parameter could be used to speed up the communication via the asynchronous interface.
0 = The reader response starts as soon as possible
5 = Maximum value for PSST (5 ms)

3.3.2 USB
HID
Logical Name
HostInterface.USB.HID.KeyStroke_Delay
0x00 = 1 ms 0x00: 1 ms - Soft

0x40 = 5 ms
0x80 = 10 ms
0xC0 = 30 ms
Description
Keystroke delay for Scan Mode Interface
3.4 Operating Mode

Mode
Logical Name
OperatingMode.Mode
0x00: Host Mode 0x00: Host Mode - Soft

0x01: Scan Mode
Description
Setting operating mode of the reader.

3.4.1 Host Mode (default)
3.4.2 Scan Mode (Auto Read Mode)
3.4.1 Host Mode

The application is host controlled. Components have to be sent step by step from the host, neither automated
multiplexing nor triggering.
Logical Name
OperatingMode.HostMode.InventoryAbortCondition
b0 = disabled b0 = disabled - -
b1 = enabled
Description
This parameter defines the abort conditions of the Inventory Command [0x01] for ISO14443 transponders if the
ISO14443A and ISO14443B transponders drivers are enabled.
b0 = disabled
The inventory command runs while not all UIDs of ISO14443A and ISO14443B transponders in the detection
range are read.
b1 = enabled
The inventory command stops if the UID of all ISO14443A or of all ISO14443B transponders in the detection
range are read. So, the Inventory Command returns either the presence of ISO14443A or ISO14443B
transponders.

3.4.1.1 Filter
Logical Name
OperatingMode.HostMode.Filter.ResponseMode
b0 = Response of all detected transponder b1 = Response of new

- -
b1 = Response of new detected transponder detected transponder
Description
Response mode of detected transponder

This parameter configures the reply behavior of the Inventory Command [0x01]. It defines which transponder will reply
to the host.
b0 = All transponder in reader field

The response of the Inventory Command [0x01] includes the UID of all detected transponders in the detection
range of the reader. The reader performs a RF-Reset before any command reads a UID.
b1 = Only new transponder in reader field
The response of the Inventory Command [0x01] includes only the UID of new detected transponders. If the reader
has detected a new transponder, the transponder will be automatically set to the halt state by the reader
(not Jewel). In this state the transponder does not send back a response for the next Inventory Command.
The UID of a transponder will replied only after the transponder reenters into the detection range of the reader.
Otherwise, the reader replies the status "No transponder" (0x01).
3.4.2 Scan Mode (Auto Read Mode)

Read data is sent without buffering to host immediately.
For communication the RS232 or USB interface are available.
In this operation mode the reader autonomously sends out data to the host as soon as a transponder is within the
detection range and valid data could be read.
The contents of the message block (UID, data block) can be adapted to each user-application.
The reader starts the output of the protocol block as soon as all required data have been read correctly from the
transponder.
Scan-Mode via asynchronous interface (RS232):

The data will be sent out depending on their configuration according to the following scheme, the sequence of which
cannot be changed.
Depending to the configuration and the number of transponders in the detection range of the reader the transmitted
protocols have a different format.

Example 1:
One transponder in detection range and UID and data block should be read:
Example 2:
3 transponder in detection range only UID should be read:
Example 3:
3 transponder in detection range only data block should be read:
Example 4:
2 transponder in detection range UID and data block should be read:
BAP BusAdressPrefix (optional) EC End character (optional)

UID: Identifier Data VT transponderValidTime
data: data blocks (free programmable) tr time to the next new transponder reading
SC Separation character (optional)
Scan-Mode via USB-Interface (HID-Mode):

If the Scan Mode is used via USB interface, the reader works like a keyboard. The data will be transferred as
USB Key Code or as hex values.
The user defined Sep- and End- Character will be transferred as USB Key Code.
If the number of transmitted user data is too large, only the maximal number of transmitted data will be sent
plus the end character.
 NOTE:
• If configuration protocols shall be sent to the reader, while the Scan Mode is enabled, no transponder
should be within the detection range of the reader during this time.
• Only read operations are available with the Scan Mode.

Settings:
3.4.2.1 Data Selector

Logical Name
OperatingMode.ScanMode.DataSelector.UID
b0 = disabled b1 = enabled - Soft

b1 = enabled
Description
UID: = Serial No
Setting of this bit activates the output of the UID
b0 = Output of the UID inactive
b1 = Output of the UID active
Logical Name
OperatingMode.ScanMode.DataSelector.Data
b0 = disabled b0 = disabled - Soft

b1 = enabled
Description
Setting of this bit activates the output of a specified data field

b0 = Output of a data field inactive
b1 = Output of a data field active
The reader internally uses commands equivalent to the ISO-Host command Read-Multiple Block [0x23] the parameters
FirstDataBlock, FirstByte and NoOfBytes become to relevant to define the data which shall be read.
In case of mifare classic data block shall be read see also the parameter
OperatingMode.ScanMode.DataSelector.MifareAppID,
OperatingMode.ScanMode.DataSource.Mifare.Classic.AppID,
OperatingMode.ScanMode.DataSource.Mifare.Classic.KeyAdress,
OperatingMode.ScanMode.DataSource.Mifare.Classic.KeyType
Logical Name
OperatingMode.ScanMode.DataSelector.MifareAppID
b0 = MifareAppID = disabled b0 = disabled - Soft

b1 = MifareAppID = enabled
Description
This bit activates the MifareAppID function for reading data blocks of mifare classic transponders. It becomes only
effect if the Data bit is set to 1.
b0 = MifareAppID function is inactive
b1 = MifareAppID function is active
If active, the parameter OperatingMode.ScanMode.DataSource.MifareClassic.AppID becomes effect.
 NOTE:
Further details about the MifareAppID functionality are described in
Mifare Application Directory documentation issued by NXP Semiconductors.

3.4.2.2 Mode
Logical Name
OperatingMode.ScanMode.DataSelector.Mode.Enable_IndependentTransmission
b0 = The reader transmits UID and Data b0 = The reader transmits - -

b1 = The reader transmits the UID independent from Data UID and Data
Description
Via this bit an independent transmission of the UID can be configured if the reading of UID and Data is enabled.
b0 = Reader starts the output of the UID and Data block as soon as all required data (UID and Data) have
been read from the transponder successful. If the reader cannot read the data, no UID will be transmitted.
b1 = Reader transmits the UID independent form a successful reading of data.
3.4.2.3 Data Source

Logical Name
OperatingMode.ScanMode.DataSource.ByteOrderofData
b0 = MSB first b0 = MSB first - -

b1 = LSB first
Description
Defines the byte order within frame
Logical Name
OperatingMode.ScanMode.DataSource.ByteOrderofData_ProcessorCards
b0 = MSB first b0 = MSB first - -

b1 = LSB first
Description
Defines the byte order within frame of ProcessorCards
Mifare
Classic
Logical Name
OperatingMode.ScanMode.DataSource.MifareClassic.AppID
0x0000 – 0xFFFF 0x0000 - -

Description
Parameter to configure the 2 byte AID (Application Identifier) of the MAD function.

Logical Name
OperatingMode.ScanMode.DataSource.MifareClassic.KeyAdress
0x00 - 0x0F 0x00 - -

Description
Defines the mifare key address to be used for authentication at the mifare block which shall be read in scan mode.
This parameter is designed to be used if the mifare block is directly addressed via FirstDataBlock or indirect addressed
via MAD function.
Logical Name
OperatingMode.ScanMode.DataSource.MifareClassic.KeyType
0x00: Key-A 0x00: Key-A - -

0x01: Key-B
Description
Defines which key will be used in authentication process.
DESFire
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.AppID
0x000000 - 0xFFFFFF 0x000000 - -

Description
DESFire Application ID in which the requested file is stored.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.KeyNumber
0x00 - 0x0D 0x00 - -

0x0E = Free Access
Description
Defines the number of the key to which the authentication shall be processed on the DESFire to get access to the data.
The KEY-No on DESFire is specified in the access rights for each file.

0x00....0x0D:
DESFire Key no for enciphered access. If a data exchange with an enciphered or MACed file shall be processed the
respective KEY-NO has to used here.
0x0E
DESFire Key no for free access. This setting is possible for "read", "write" and "read & write" access rights for each file
on the card. If this setting is used for "read & write" access rights a different key setting for "read" access rights or
"write" access rights becomes obsolete.
 NOTE:
Depending on the DESFire KeyNumber and FileCommSettings different security conditions can be
configured. The following table shows the possible combinations and how the security functions are
influenced by these settings.
file access conditions

FileComm
KeyNumber valid authentication
Settings data exchange
required
0x00 plain
0x00...0x0D 0x01 yes plain + MAC
0x03 enciphered
0x00
0x0E 0x01 no plain
0x03
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.ReaderKeyIndex
0x00 - 0x03 0x00 - -

Description
Index of the key which is stored in the reader, and which shall be used for authentication for the current command.
 NOTE:
The key which is addressed with ReaderKeyIndex defines the authentication command and method. The
addressed application has to configure in the same way.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.FileType
0x00 = Standard Data or Backup Data File 0x00 = Standard Data or - -

0x01 = Cyclic or Linear Record File Backup Data File
Description
Coding of the file type of the dedicated file.

Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.FileNumber
0x00 - 0x1F 0x00 - -

Description
This parameter defines which file from a DESFire shall be read.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.FileCommSettings
0x00 = Plain communication 0x00 = Plain communication - -

0x01 = Plain communication secured by MACing
0x03 = Fully encyphered communication
Description
Coding of the communication mode of the dedicated file.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.FileOffset
0 - 16777215 0 - -
Description
Defines the position within a DESFire file where the read process shall start.
FileType File FileOffset

Standard Data File
Defines the byte position within a DESFire Data
0x00 or
file where the read process shall start.
Backup Data File
Cyclic Record File
Defines the record no. which shall be read out.
0x01 or 0x00 00 00 defines the latest written record
0x01 00 00 defines next the latest written record
Linear Record File
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.FileLength
0 - 128 0 - -
Description
Defines the number of bytes and the size of the record which shall be read.

FileType FILE- FileLength

Standard Data File
0x00 or Defines the number of bytes which shall be read.
Backup Data File
Cyclic Record File Defines the size of the record (in bytes) which
shall be read. Data are only transmitted if
0x01 or
parameter FileLength is equal to the
Linear Record File DESFire record length.
 Note:
If parameter OperatingMode.ScanMode.DataSource.ISO_14443_3.NoOfBytes < FileLength superfluous
data are truncated.
If parameter OperatingMode.ScanMode.DataSource.ISO_14443_3.NoOfBytes > FileLength remaining data
are filled with 0.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.DESFire.EnableAuthentication
b1 = enabled
Description
Via the bit the support of transponder types with proprietary security functions can be enabled and disabled for scan
mode if data blocks should be read.
b0 = Data reading of mifare DESFire is disabled.
b1 = Data reading of mifare DESFire is enabled.
transponder.Driver.HF.I
transponder type transponder.Driver.HF EnableAuthentication
SO_14443_TypeA
mifare DESFire ISO_14443A_TypeA = 1 Part4 = 1 DF = 1
 NOTE:
It is recommended to enabled only transponder types which are used in the application.

Mifare.PLUS.SecurityLevel1
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel1.ReaderKeyIndex
0x00 - 0x03 0x00 - -

Description
To perform an additional AES Authent for a mifare PLUS SL1 in scan mode the reading of data blocks and the
parameter Mifare.PLUS.SecurityLevel1.EnableAuthentication must be enabled.
Index of the key which is stored in the reader (see: manual H01110-xe-ID-B) and which shall be used for mifare PLUS
SL1 authentication.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel1.EnableAuthentication
b1 = enabled
Description
This setting can be used to enable the additional security functions of mifare PLUS SL1 in scan mode which enables
an easy migration from mifare classic to mifare PLUS SL1.
b0 = Data reading of mifare Classic and mifare PLUS SL1 are enabled. There-fore additional settings for mifare classic
must be considered.
b1 = This setting enables the additional AES authent for mifare PLUS SL1 which is not supported by mifare classic
chips.
SO_14443_TypeA
mifare classic and
ISO_14443A_TypeA = 1 MifareStandard = 1 MFP_SL1 = 0
mifare PLUS (SL1)
mifare PLUS (SL1) only ISO_14443A_TypeA = 1 MifareStandard = 1 MFP_SL1 = 1
 NOTE:
It is recommended to enable only transponder types which are used in the application.

Mifare.PLUS.SecurityLevel3
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel3.KeyType
0x00 = Key-A 0x00: Key-A - -

0x01 = Key-B
Description
Defines the key type for the authentication with mifare PLUS SL3.
To read data blocks from a mifare PLUS SL3 in scan mode the reading of data blocks and the parameter
Mifare.PLUS.SecurityLevel3.EnableAuthentication must be enabled. Please consider that the Driver for ISO14443-A
and also parameter transponder.Driver.HF.ISO_14443.TypeA.Part4 has to be enabled.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel3.ReaderKeyIndex
0x00 - 0x03 0x00 - -

Description
Index of the key which is stored in the reader (see: manual H01110-xe-ID-B) and which shall be used for mifare PLUS
SL3 authentication before the read command.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel3.ReadCommand
0x30 = Read Encrypted 0x30 - -

0x31 = Read Encrypted Maced
0x32 = Read Plain
0x33 = Read Plain Maced
0x34 = Read Encrypted Unmaced
0x35 = Read Encrypted Unmaced Resp. Maced
0x36 = Read Plain Unmaced
0x37 = Read Plain Unmaced Resp. Maced
Description
Defines the [0xC2] SoftCrypto read command for mifare PLUS SL3 (see manual H01110-xe-ID-B)

 NOTE:
Depending on the mifare PLUS SL3 Read-Command different security conditions can be configured. The
following table shows how the security functions are influenced by the command.
ReadCommand MAC on Command Data Encrypted MAC on Response
0x30 yes yes no

0x31 yes yes yes
0x32 yes no no
0x33 yes no yes
0x34 no yes no
0x35 no yes yes
0x36 no no no
0x37 no no yes
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel3.FirstDataBlock
0 - 255 0 - -
Description
Block number of the first block to be read from mifare PLUS SL3.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel3.NoOfDataBlocks
1-8 1 - -
Description
Number of blocks to be read.

The internal buffer is limited to 128 bytes of data.
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel3.AppID
0x0000 - 0xFFFF 0x0000 - -

Description
Parameter to configure the 2 byte AID (Application Identifier) of the mifare plus SL3 MAD function.
= 0x0000: Disables MAD function for mifare plus SL3.
> 0x0000: Enables MAD function for mifare plus SL3.

Logical Name
OperatingMode.ScanMode.DataSource.Mifare.PLUS.SecurityLevel3.EnableAuthentication
b0 = Data reading of mifare PLUS SL3 is disabled. b0 = disabled - -

b1 = Data reading of mifare PLUS SL3 is enabled.
Description
 NOTE:
transponder.Driver.HF.ISO_14443A_TypeA = 1
transponder.Driver.HF.ISO_14443_TypeA.Part4 = 1
Mifare.UltralightC
Logical Name
OperatingMode.ScanMode.DataSource.Mifare.UltralightC.KeyAddress
0x00 - 0x03 0x00 - -

Description
Defines the ultralight C key address which will be used for authentication at the secured block which should be read in
scan mode.
The key for authentication used by the reader can be stored into the readers EEPROM or RAM
(see manual: H01110-xe-ID-B.pdf “Manual SoftCrypto Functions”).
 NOTE:
To read data blocks from a mifare UltralightC in Scan Mode the reading of data blocks and the parameter
Mifare.UltralightC.EnableAuthentication must be enabled. Please consider that the Driver for ISO14443-A
and also parameter transponder.Driver.HF.ISO_14443.TypeA.MifareUltraLight has to be enabled.

Logical Name
OperatingMode.ScanMode.DataSource.Mifare.UltralightC.EnableAuthentication
b1 = enabled
Description
Via the bit, the support of transponder types with proprietary security functions, can be enabled and disabled for scan
mode, if data blocks should be read.
This setting can be used to enable the additional security functions of mifare Ultralight C in scan mode.
b0 = Standard mifare Ultralight / mifare Ultralight C (plain) / NFC Card Type 2 / my-d move (plain) are enabled.
b1 = Only mifare Ultralight C (secured) supported. The following table shows the dependency with Tag-Driver
configuration block for different transponder types and reading of data blocks:
SO_14443_TypeA
mifare Ultralight,
mifare Ultralight C (plain),
ISO14443A = 1 MifareUltraLight = 1 0
NFC Tag Type 2 and
and my-d move (plain)
mifare Ultralight C
ISO14443A = 1 MifareUltraLight = 1 1
(secured) only
 NOTE:

ISO_14443_3
Logical Name
OperatingMode.ScanMode.DataSource.ISO_14443_3.FirstDataBlock
0 - 255 5 - -
Description
OperatingMode.ScanMode.DataSelector.MifareAppID = 0
FirstDataBlock defines the absolute transponder address of the first data block which will be transferred in scan mode.
The maximum address depends on the memory size and organization of the respective transponder.
OperatingMode.ScanMode.DataSelector.MifareAppID = 1
FirstDataBlock defines the relative data block address within one mifare sector which will be transferred in scan mode
in MAD function, if a mifare classic transponder is currently detected by the reader. The maximum address range
depends on the memory size and organization of the respective mifare transponder as displayed in the following table.
Values in brackets () includes the mifare sector trailer block.
Sector 0...15 Sector 16...31 Sector 32...39
mifare 1k 0...2(3)
mifare 4k 0...2(3) 0...14(15)
see Supported Host Commands
Logical Name
OperatingMode.ScanMode.DataSource.ISO_14443_3.FirstByte
0 - 255 0 - -
Description
This parameter defines the starting byte in the raw data on which ISO_14443_3.NoOfBytes starts. The Parameter
ISO_14443_3.FirstByte has only effect to the transmission of a data block, defined by ISO_14443_3.FirstDataBlock.

Logical Name
OperatingMode.ScanMode.DataSource.ISO_14443_3.NoOfBytes
0 - 255 4 - -
Description
Defines the length of raw data in bytes which are transmitted in the scan mode.
The parameter has only effect to the transmission of a data block, defined by ISO_14443_3.FirstDataBlock.
 NOTE:
In case of a mifare classic transponder the maximum range of ISO_14443_3.NoOfBytes and

ISO_14443_3.FirstByte are limited by the end of the mifare sector.
NoOfBytes must be less than 128 bytes. Otherwise the reader cuts the supernumerary bytes.
Example:
ISO_15693_18000
Logical Name
OperatingMode.ScanMode.DataSource.ISO_15693_18000.FirstDataBlock
0 - 65535 0 - -
Description
FirstDataBlock defines the absolute transponder address of the first data block which will be transferred in scan mode.
The maximum address depends on the memory size and organization of the respective transponder.
Logical Name
OperatingMode.ScanMode.DataSource.ISO_15693_18000.FirstByte
0 - 255 0 - -
Description
This parameter defines the starting byte in the raw data on which ISO_15693_18000.NoOfByte starts. The Parameter
ISO_15693_18000.FirstByte has only effect to the transmission of a data block, defined by
ISO_15693_18000.FirstDataBlock.

Logical Name
OperatingMode.ScanMode.DataSource.ISO_15693_18000.NoOfBytes
0 - 255 0 - -
Description
NoOfBytes defines the length of raw data in bytes which are transmitted in the scan mode.
NoOfBytes has only effect to the transmission of a data block, defined by ISO_15693_18000.FirstDataBlock.
 NOTE:
NoOfBytes must be less than 128 bytes. Otherwise the reader truncates the supernumerary bytes.
Example: Data Block
ISO_18000_3M3
Logical Name
OperatingMode.ScanMode.DataSource.ISO_15693_18000_3M3.BankNo
0x00 = Reserved memory bank 0x03 = User memory bank - -

0x01 = EPC memory bank
0x02 = TID memory bank
0x03 = User memory bank
Description
Memory bank of the transponder which will be accessed by the reader.

3.4.2.4 DataFormat
Logical Name
OperatingMode.ScanMode.DataFormat.BusAddressPrefix
b1 = enabled
Description
When this option is on (BusAddressPrefix), the reader will transmit the bus address before each data set.
b0 = Bus address of the reader will not transmit
b1 = Bus address of the reader will transmit
 NOTE:
If the BusAddressPrefix is enabled the bus address will be send in front of the header.
Logical Name
OperatingMode.ScanMode.DataFormat.Format
0x00 = Unformatted hex data 0x02 = ASCII formatted - -

0x02 = ASCII formatted hex data hex data
Description
Defines the output data format for scan mode data (only for data blocks).
0x00 = Unformatted hex data
In this case the raw data bytes from the transponder first are separated into their nibbles and then changed into
ASCII chars.
This setting is recommended for numeric information's
0x02 = ASCII formatted hex data
In this case each raw data byte is interpreted as an ASCII char and is transformed UNICODE format.
This setting is recommended for alpha-numeric information's
 NOTE:
The serial number is always output as unformatted hex data.

Hex data to ASCII conversion table:
raw data ASCII data
(hex / binary) (ASCII / hex)
0x0 b0000 '0' 0x30
0x1 b0001 '1' 0x31
0x2 b0010 '2' 0x32
0x3 b0011 '3' 0x33
0x4 b0100 '4' 0x34
0x5 b0101 '5' 0x35
0x6 b0110 '6' 0x36
0x7 b0111 '7' 0x37
0x8 b1000 '8' 0x38
0x9 b1001 '9' 0x39
0xA b1010 'A' 0x41
0xB b1011 'B' 0x42
0xC b1100 'C' 0x43

0xD b1101 'D' 0x44

0xE b1110 'E' 0x45
0xF b1111 'F' 0x46
ogical Name
OperatingMode.ScanMode.DataFormat.NoOfUserHeaderChars
0 = no HEADER byte 0 = no HEADER byte - -

1 = HEADER-USR1
2 = HEADER-USR1 + 2
3 = HEADER-USR1 + 2 + 3
4 = HEADER-USR1 + 2 + 3 + 4
Description
Defines the length of the header
Example of scan data:

BUS- Separation Separation Data-
Header UID END Character
ADR Character Character Blocks
BUS- SEP-
USR 1 USR 2 USR 3 USR 4 UID SEP-CHAR DB USR 1 USR 2 USR 3
ADR CHAR
Logical Name
OperatingMode.ScanMode.DataFormat.UserHeaderChar1
0x00 - 0xFF 0x00 -

Description
User defined header character 1 - 4
Logical Name
OperatingMode.ScanMode.DataFormat.SeparationChar
SeparationChar ASCII hex 0x20 = ‘,’ - -

0x00 none
0x01 CR+LF 0x0D and 0x0A
0x02 LF 0x0A
0x04 CR 0x0D
0x08 TAB 0x07
0x10 ‘;’ 0x3B
0x20 ‘,’ 0x2C
0x40 ‘ ‘ (space) 0x20
0x80 User defined defined in
UserSeparationChar
Description

Selects the separation character between two data types for the send data. Only one option can be selected.
Logical Name
OperatingMode.ScanMode.DataFormat.UserSeparationChar
0x00 - 0x FF 0x00 -
Description
User defined separation character.
Logical Name
OperatingMode.ScanMode.DataFormat.EndChar
EndChar ASCII hex 0x01 = CR+LF - -

0x00 none
0x01 CR+LF 0x0D and 0x0A
0x02 LF 0x0A
0x04 CR 0x0D
0x08 TAB 0x07
0x10 ‘;’ 0x3B
0x20 ‘,’ 0x2C
0x40 ‘ ‘ (space) 0x20
0x80 User defined defined in
UserEndChar 1/2/3
Description
Selects the end character for the send data.
Logical Name
OperatingMode.ScanMode.DataFormat.NoOfUserEndChars
0x00 = END-USR1 0x00 - -

0x01 = END-USR1
0x02 = END-USR1 + 2
0x03 = END-USR1 + 2 + 3
Description
Defines the length of the END character.

Example of scan data:
BUS- Separation Separation Data-
Header UID END Character
ADR Character Character Blocks
BUS-
SEP-CHAR USR 1 USR 2 USR 3 USR 4 UID SEP-CHAR DATA USR 1 USR 2 USR 3
ADR
Logical Name
OperatingMode.ScanMode.DataFormat.UserEndChar1/2/3
0x00 - 0xFF 0x00 - -

Description
User defined end character.

Logical Name
OperatingMode.ScanMode.DataFormat.UidInBcd
b1 = enabled
Description
Setting of this bit activates the output of the UID in BCD format if the “OperatingMode.ScanMode.DataSelector.UID” Bit
set. In this case the least significant 4 hexadecimal bytes of the UID are transformed into their 10 digit decimal
equivalent value.
b0 = Output of the UID in BCD disabled
b1 = Output of the UID in BCD enabled
Example:
The hexadecimal UID is = 0x38 F3 7B 29
The decimal value = 0955480873
ASCII formatted hex data
Output: 0x09 0x55 0x48 0x08 0x73
3.4.2.5 Filter
Logical Name
OperatingMode.ScanMode.Filter.ResponseMode
b0 = Response of all detected transponder b1 = Response of new - -

b1 = Response of new detected transponder detected transponder
Description
This parameter configures the reply behavior of the [0x01] Inventory Command It defines which transponder will reply
to the host.
b0 = All transponders in reader field
The response of the [0x01] Inventory Command includes the UID of all detected transponders in the detection
range of the reader. The reader performs a RF-Reset before any command reads a UID.
b1 = Only new transponders in reader field

The response of the [0x01] Inventory Command includes only the UID of new detect transponders. If the reader
has detected a new transponder, the transponder will be automatically set into the halt state (ISO14443, but not
Jewel) by the reader. In this state the transponder does not send back a response for the next Inventory
Command.
The UID of a transponder will replied only after the transponder reenters into the detection range of the reader.
Otherwise, the reader replies with status "No transponder" (0x01).

Logical Name
OperatingMode.ScanMode.Filter.transponderValidTime
0 - 65535 10 x 100 ms -
Description
The transponderValidTime defines the period in which the reader does not transmit the transponder data a second
time, after the reader had transmitted it in the first time. The transponderValidTime starts after the data transmission
from the transponder to the reader.
3.5 AirInterface
Logical Name
AirInterface.TimeLimit
0 - 65535 250 × 100 ms -

Description
Defines the maximum duration for inventory and read/write commands in Host Mode. It starts after the reader has
received a new command. At the latest after the AirInterface.TimeLimit has elapsed the reader will send an answer
protocol.

3.6 Transponder
3.6.1 Driver
HF
Logical Name
Transponder.Driver.HF.Selector
b0 = Select drivers with fixed call order from CFG3 b0 - -

b1 = Select drivers with fixed call order from CFG11
Description
TAG-DRV defines the transponder types that are operated by the reader
This parameter offers the option to define the call order of the enabled transponder drivers.
 NOTE:
Only those transponder drivers should be active that are used in the current application. Thus, the reaction
time of the reader for transponder read- / write-operations is reduced and the danger of a parasitic
transponder access is minimized.
Logical Name
Transponder.Driver.HF.ISO_15693
b0 = disabled b1 = enabled - -
b1 = enabled
Description
Enabled / disabled transponder driver for ISO15693
Logical Name
Transponder.Driver.HF.ISO_14443_TypeA
b1 = enabled
Description
Enabled / disabled driver for ISO14443A
Logical Name
Transponder.Driver.HF.ISO_14443_TypeB
b1 = enabled
Description
Enabled / disabled driver for ISO14443B

Logical Name
Transponder.Driver.HF.Jewel
b1 = enabled
Description
Enabled / disabled driver for Jewel
Logical Name
Transponder.Driver.HF.SR176
b1 = enabled
Description
Enabled / disabled driver for SR176
Logical Name
Transponder.Driver.HF.SRIxx
b1 = enabled
Description
Enabled / disabled driver for SRIxx
Logical Name
Transponder.Driver.HF.ISO_18000_3M3
b1 = enabled
Description
Enabled / disabled driver for ISO18000-3M3 (need to be released by an upgrade code)
Logical Name
Transponder.Driver.HF.FeliCa
b1 = enabled
Description
Enabled / disabled driver for FeliCa

3.6.1.1 HF / UserSequenced
Logical Name
Transponder.Driver.HF.UserSequenced.No1
0xFF = not selected 0xFF - -

0x03 = ISO 15693
0x04 = ISO 14443 Type A
0x05 = ISO 14443 Type B
0x08 = Jewel
0x09 = ISO 18000-3M3
0x0A = STMicroelectronics SR176
0x0B = STMicroelectronics SRIxx (SRI512, SRIX512,
SRI4K, SRIX4K)
0x0D = Sony FeliCa
0x10 = Calypso Innovatron (14443-B')
Description
It is a user definable call order of the tag drivers during the command "[0x01] Inventory".
A list of supported tag drivers can be found in ANNEX A: Codes of Transponder Types.
3.6.1.2 HF / ISO_14443
TypeA
Logical Name
Transponder.Driver.HF.ISO_14443_TypeA.MifareStandard
b0 = Driver for Mifare Standard is disabled b0 = disabled - -

b1 = Driver for Mifare Standard is enabled
Description
Enabled / Disabled driver for Mifare Standard for read/write operations by the reader. Reading of the UID is also
possible if the driver is disabled, because of the standardized ISO14443 access conditions.

If more than one transponder driver is enabled, the reader attempted by means of some indications to decide about the
transponder type. To guarantee that the reader only processes the correct transponder type, the not required drivers
should be disabled.
Logical Name
Transponder.Driver.HF.ISO_14443_TypeA.my_d_Proximity_SLE55Rxx
b0 = Driver for my_d_Proximity_SLE55Rxx is disabled b1 = enabled - -

b1 = Driver for my_d_Proximity_SLE55Rxx is enabled
Description
Enabled / Disabled driver for my-d proximity SLE55Rxx for read/write operations by the reader. Reading of the UID is
also possible if the driver is disabled, because of the standardized ISO14443 access conditions.
transponder type. To guarantee that the reader only processes the correct transponder type the not required drivers
should be disabled.
Logical Name
Transponder.Driver.HF.ISO_14443_TypeA.MifareUltraLight
b0 = Driver for MifareUltraLight is disabled b1 = enabled - -

b1 = Driver for MifareUltraLight is enabled
Description
Enabled / Disabled driver for Mifare Ultra Light (NFC Card Type 2) for read/write operations by the reader. Reading of
the UID is also possible if the driver is inactive, because of the standardized ISO14443 access conditions.
should be disabled.
Logical Name
Transponder.Driver.HF.ISO_14443_TypeA.Part4
b0 = Driver for Part4 is disabled b1 = enabled - -

b1 = Driver for Part4 is enabled
Description
Enabled / Disabled driver for ISO 14443-A Part 4 for read/write operations by the reader. Reading of the UID is also
possible if the driver is inactive, because of the standardized ISO14443 access conditions.
should be disabled.

3.6.2 Anticollision
Logical Name
Transponder.Anticollision.Enable
b1 = enabled
Description
This bit activates Anticollision Mode. In Anticollision Mode the reader automatically sets transponder specific
communication parameters.
b0 = disabled
In this case the reader doesn’t process any anticollision procedure with the transponder inside the antenna field.
If anticollision is disabled, the reader automatically selects the transponder. The Select command [0x25] is not
necessary for further communication with the transponder.
If more than one transponder of the same type is in the detection range the reader replies with an error status.
b1 = enabled
In this case the reader processes the anticollision procedure with the transponders inside of the antenna field and
replies the UID of all detected transponders.
3.6.3 HF
3.6.3.1 ISO_15693
Logical Name
Transponder.HF.ISO_15693.Anticollision.NoOfTimeslots
b0: 16 timeslots b1: 1 timeslot - -

b1: 1 timeslot
Description
No of timeslots for Anticollision procedure
SelectionMask
Logical Name
Transponder.HF.ISO_15693.SelectionMask.Enable_AFI
b0: disabled b0: disabled - -

b1: enabled
Description
Enabled / Disabled the application family identifier.
Logical Name
Transponder.HF.ISO_15693.SelectionMask.AFI1
0x00 - 0xFF 0x00 - -

Description
Application family identifier to select a transponder

Miscellaneous
WriteOption
Logical Name
Transponder.HF.ISO_15693.Miscellaneous.WriteOption
0x00 = automatically set 0x00 = automatically set - -

0x02 = Tag option 0
0x03 = Tag option 1
Description
Sets the write option for each ISO 15693 transponder. If WriteOption = 0x00, the reader selects the write option
automatically, if the transponder is known. If the transponder supports 0 and 1, option 0 is used. In non-addressed
mode option 0 is used. If the transponder is unknown for the reader, the write option must be set manually.
 NOTE:
Some transponders support only commands with write option 0 or 1.
Logical Name
Transponder.HF.ISO_15693.Miscellaneous.Modulation
0x00 = 100 % 0x01 = 20 % - -

0x01 = 20 %
Description
Modulation for the 15693 RF Communication in [%]
ReadOption
Logical Name
Transponder.HF.ISO_15693.Miscellaneous.ReadOption.ReadMode
b00: Automatic Mode b00 - -

b01: Single Read
b10: Multiple Read
Description
Sets the read mode for each ISO 15693 transponder. The reader selects the read mode automatically if the
transponder is known (default). If the transponder supports both, read multiple blocks is used for more than one block.
If the transponder is unknown, the read mode must be set manually.

Logical Name
Transponder.HF.ISO_15693.Miscellaneous.ReadOption.BlockSizeSelection
b0: Automatic Mode (transponder is known) b0: Automatic Mode - -

b1: Manual, as specified in BlockSize
Description
Select, if the block size should be set automatically by the reader or if the block size should be set manually.
Logical Name
Transponder.HF.ISO_15693.Miscellaneous.ReadOption.BlockSize
1...32 4 - -
Description
Sets the block size of an ISO 15693 transponder which is not listed in the manufacturer table or if the transponder is
used in the non-addressed mode.
3.6.3.2 ISO_14443
Bitrate
Logical Name
Transponder.HF.ISO_14443.Bitrate.Transmit
b00 = 106 kbit/s b00 = 106 kbit/s - -

b01 = 212 kbit/s
b10 = 424 kbit/s
b11 = 848 kbit/s
Description
Used for bit rate selection from reader to transponder (TX BIT RATE).
This parameter defines the highest bit rate which shall be used by the reader. The actual used bit rate depends on the
capabilities of the present transponder. If the adjusted bit rate is not support by the transponder the reader selects the
highest supported bitrate of the transponder.
Logical Name
Transponder.HF.ISO_14443.Bitrate.Receive
b00 = 106 kbit/s b00 = 106 kbit/s - -

b01 = 212 kbit/s
b10 = 424 kbit/s
b11 = 848 kbit/s
Description
Used for bit rate selection from transponder to reader (RX BIT RATE).
This parameter defines the highest bit rate which shall be used by the reader. The actual used bit rate depends on the
capabilities of the present transponder. If the adjusted bit rate is not support by the transponder the reader selects the
highest supported bitrate of the transponder.

Part4 / Miscellaneous
Logical Name
Transponder.HF.ISO_14443.Part4.Miscellaneous.PowerLevelCheck
b0 = Power level check is disabled. b0 = disabled - -

b1 = Power level check is enabled.
Description
This bit enables / disables the power level indicator check function of the reader.
Enable:
The power level indicator of ISO 14443-4 transponders will be monitored by the reader.
If a transponder response indicates insufficient power, the reader breaks the present command and sends an error.
Logical Name
Transponder.HF.ISO_14443.Part4.Miscellaneous.ErrorRetry
0x00 = disables retry loop 0x00 = disable - -

0x01 = 1 retry loop
0x02 = 2 retry loops
0x03 = 3 retry loops
Description
This parameter defines the maximum number of automatic retry loops in case of transmission or protocol errors as
described in ISO 14443-4.
TypeA
Logical Name
Transponder.HF.ISO_14443.TypeA.OptionalInventoryInfo
b0 = OPT_INFO byte in [0x01] inventory response is always set to 0. b0 - -

b1 = OPT_INFO byte in [0x01] inventory response includes further information
Description
By means of this bit some optional information could be displayed for ISO14443A in the [0x01] inventory response byte
OPT_INFO
Logical Name
Transponder.HF.ISO_14443. TypeA.UID_Order
b0 = UID byte order is not swapped b0 = UID byte order is not swapped - -
b1 = UID byte order is swapped for ISO14443 compliance
Description
By means of this bit the byte order of the UID of ISO14443A transponder can be swapped.

TypeB
SelectionMask
Logical Name
Transponder.HF.ISO_14443.TypeB.SelectionMask.AFI
0x00 - 0xFF 0x00 - -

Description
Application Family Identifier for ISO14443 type B transponder.
Miscellaneous
Logical Name
Transponder.HF.ISO_14443.TypeB.Miscellaneous.BitrateSelect
b0 = The first reception after a Bit-Rate change is b0 - -

expected with 106 kbit/s.
b1 = The first reception after a Bit-Rate change is
expected with the selected higher bit rate.
Description
This bit selects the response behavior for ISO 14443B transponder with bit rates above 106 kbit/s.
The reader principally uses 106 kbit/s for the first communication cycle. If the transponder supports a higher bit rate
and this is configured by the parameter transponder.HF.ISO_14443.Bitrate.Receive the reader selects the highest
possible bit rate.
Unfortunately, the reception from the transponder could be on 106 kbit/s ore on the new higher bit rate.
Miscellaneous
Logical Name
Transponder.HF.ISO_14443.Miscellaneous.StartupTime
0...255 0 × 5 ms -
Description
The StartupTime defines a delay-time which is required by a ISO14443 transponder for startup after the RF field was
switched on (1 ... 255 * 5 ms = 5 ms ... 1,275 sec).

3.6.4 Miscellaneous
Logical Name
Transponder.Miscellaneous.IdentifierInterpretationMode
0x00: automatic Mode 0x00 - -

0x02: EPC and TID
Description
Defines in which way the reader interprets and display the identifier data read during inventory process by using the
inventory command for ISO18000-3M3 transponders.
 NOTE:
If IdentifierInterpretationMode = 0x02 (EPC and TID) then only the TID must be used to address a tag for
read/ write commands.

3.7 Digital I/O
3.7.1 Output
Logical Name
DigitalIO.Output.OfflineDelay
0 - 255 100 x 100 ms -

Description
This parameter defines the duration in 100 ms increments, after the reader will signalize the offline state, if it had not
received a command via the host interface.
0 ... 255 x 100 ms = 0 ... 25,5 s
Logical Name
DigitalIO.Output.TagDetectActiveTime
0 - 255 4 x 100 ms -
Description
This parameter defines the duration in 100 ms increments, the reader signalize a transponder was detected.
0 ... 255 x 100 ms = 0 ... 25,5 s
3.7.1.1 Output.No1/2/3
Via the following parameters the operation mode of the outputs can be configured at any time.
Different behaviors can be set for the Offline, Online and Tag Detect operating modes according to the schedule below.
In addition to this, different flashing frequencies of the outputs may be defined.
Logical Name
DigitalIO.Output.No1.OnlineState
0x00 = OFF 0x00 = OFF -

0x01 = ON
0x02 = Flashing slow
0x03 = Flashing fast
Description
This parameter defines the behavior of the outputs in online state.
Logical Name
DigitalIO.Output.No1.OfflineState
0x00 = OFF 0x00 = OFF - -

0x01 = ON
Description

This parameter defines the behavior of the outputs in offline state.
Polling-Mode:
In case of polling mode the reader starts to signalize the offline state, if it has received no command from the host for
more than the time defined by the parameter OfflineDelay.
Logical Name
DigitalIO.Output.No1.TagDetectState
0x00 = OFF ox00: OFF - -

0x01 = ON
0x02 = Flashing Slow
0x03 = Flashing Fast
Description
This parameter defines the behavior of the outputs if a transponder was detected by the reader.
3.7.2 Signaler
Logical Name
DigitalIO.Signaler.OfflineDelay
0 - 255 20 x 100 ms -
Description
This parameter defines the duration in 100 ms increments, after the reader will signalize the offline state, if it had not
received a command via the host interface.
0 ... 255 x 100 ms = 0 ... 25,5 s
Logical Name
DigitalIO.Signaler.TagDetectActiveTime
0 - 255 4 x 100 ms -
Description
This parameter defines the duration in 100 ms increments, the reader signalizes a transponder was detected.
0 ... 255 x 100 ms = 0 ... 25,5 s

3.7.2.1 LED
Green / Red
Logical Name
DigitalIO.Signaler.LED.Green.OfflineState
DigitalIO.Signaler.LED.Red.OfflineState
0x00 = OFF 0x00 = OFF - -

0x01 = ON
Description
This parameter defines the behavior of the LEDs in offline state.

Polling-Mode:
In case of polling mode the reader starts to signalize the offline state, if it has received no command from the host for
more than the time defined by the parameter OfflineDelay.
Logical Name
DigitalIO.Signaler.LED.Green.OnlineState
DigitalIO.Signaler.LED.Red.OnlineState
0x00 = OFF 0x00 = OFF - -

0x01 = ON
Description
This parameter defines the behavior of the LEDs in online state.
Logical Name
DigitalIO.Signaler.LED.Green.TagDetectState
DigitalIO.Signaler.LED.Red.TagDetectState
0x00 = OFF 0x00 = OFF - -

0x01 = ON
Description
This parameter defines the behavior of the LEDs, if a transponder was detected by the reader.

IDENTIFICATION ID CPR70 Commands
4 Commands
4.1 Reader Commands

These commands are used to control by host and login into the reader.
They can be used for individual conditions of applications.
They read information and diagnostic data
Control of :
• digital inputs/outputs,
• System time
• RF Parameter
• Status
• etc.
4.1.1 [0x52] Baud Rate Detection

This command serves to determine the actual baud rate of the reader’s asynchronous interface.
 NOTE:
The return protocol will be sent only, if the inquiry is executed with the baud rate and actual parity of the reader.
REQUEST-PAYLOAD
1 1
0x00
0x52
Reserved
RESPONSE-PAYLOAD
1 1
0x00
0x52
Reserved

4.1.2 [0x55] Start Flash Loader

This command starts the flash loader for executing a firmware update. After the reader has received the
command, it switches into the flash loader mode. For leaving the flash loader mode the power supply of the
reader must be interrupted.
 NOTE:
COM-ADR = 255 will be ignored by the Reader.
REQUEST-PAYLOAD
1 1
0x00
0x55
Reserved
RESPONSE-PAYLOAD
1 1
0x00
0x55
Reserved

4.1.3 [0x63] CPU Reset

Reset of the CPU on the Reader.
 NOTE:
• While a CPU Reset the RF-Parameter will be switched off.

• After a CPU-Reset the reader selects the ANT1 (internal) again.
REQUEST-PAYLOAD
1 1
0x00
0x63
Reserved
RESPONSE-PAYLOAD
1 1
0x00
0x63
Reserved

4.1.4 [0x64] System Reset

Reset of the RF-decoder and the RF controller
RF-decoder and the RF controller are in standby after reset.
REQUEST-PAYLOAD
1 1
0x64 MODE
RESPONSE-PAYLOAD
1 1
0x64 STATUS
REQUEST-PAYLOAD
Command [0x64] System Reset
Defines Controller which will be reset
0x00 = RF Controller Reset
executes a hardware reset of the reader CPU.
In case of a USB connection the reader executes a new
enumeration after receiving this command.
0x03 = RF Decoder Reset
MODE
executes a hardware reset of the RF Decoder.
 NOTE:
• The RF-Parameter will be switched off while a System Reset.

• After a CPU-Reset the reader selects the ANT1 (internal) again.
RESPONSE-PAYLOAD
COMMAND [0x64] System Reset
STATUS Status message from the reader

4.1.5 [0x65] Get Software Version
REQUEST-PAYLOAD
1 1
0x65 MODE
RESPONSE-PAYLOAD
1 1 2 1 1 1 2
0x65 STATUS SW-REV D-REV HW-TYPE SW-TYPE TR-TYPE
Details REQUEST-PAYLOAD
Command [0x65] Get Software Version
Defines Controller which will be reset.

MODE Controller
MODE
RF-
0
Controller
Details RESPONSE-PAYLOAD
Command [0x65] Get Software Version
SW-REV Firmware version
D-REV Revision status of the firmware
Displays options which are supported by the Reader hardware.
Bit 7 6 5 4 3 2 1 0
Function HWE
HW-TYPE
HWE
Config-Pin Output
SW-TYPE Displays the type / model of the reader
Displays the transponders supported by the reader

Bit 15 14 13 12 11 10 9 8
SRIx SR176 ISO Jewel
Function 18000-
TR-TYPE 3M3
Bit 7 6 5 4 3 2 1 0
ISO ISO ISO
Function
14443B 14443A 15693

4.1.6 [0x66] Get Reader Info

This protocol determine, a lot of firmware, hardware options and version from the reader.
Most information required for service and support questions only.
REQUEST-PAYLOAD
1 1
0x66 MODE
RESPONSE-PAYLOAD
1 1
according to
0x66 the MODE
setting
Command [0x66] Get Reader Info
Via the Parameter MODE different information could be requested from the reader.
0x00 = General hard- and firmware information's

0x03 = RF-decoder information's for factory diagnostic.
0x04 = Additional firmware functionality.
0x05 = Bootloader version information.
0x08 = Supported Tag Drivers information.
0x12 = CPU Information
MODE
0x15 = RF- and ISO7816 Stack Firmware
0x16 = IDT stack version
0x40 = CFG info for read permission
0x41 = CFG info for write permission
0x80 = Device-ID: Necessary Information's for firmware updates and firmware
upgrades.
0xFF = Read all info modes
see below:

4.1.6.1 Mode = 0x00 (RF Controller Firmware)
RESPONSE-PAYLOAD
1 1 2 1 1 1 2 2 2
0x00 STATUS SW-REV D-REV HW-TYPE SW-TYPE TR-Type RX-BUF TX-BUF
Parameter Description / Value Length
Command Mode = 0x00 (RF Controller Firmware) 1
Status message from the reader
STATUS 1
Version of the firmware. Forms the first two digits of the three digits firmware number
SW-REV 2
(e.g. 02.10.00).
Revision status of the firmware. Forms the last digit of the three digits firmware number. “00”
D-REV indicates that the firmware is released, whereas ≥ “129” indicates that the firmware is a release 1
candidate (e.g. 02.10.00).
HW-TYPE Displays options configuration pin value (internal use) 1
Displays the type / model of the reader
SW-TYPE 1
ANNEX B: Codes of Reader Types
TR-Type Displays the transponders supported by the reader. 2
RX-BUF is the maximum receive buffer size of the reader. If a protocol from the host exceed the
RX-BUF RX-BUF size the reader response with error code. 2
ANNEX C2: Error-Codes
TX-BUF is the maximum transmit buffer size of the reader. The host must check whether the
TX-BUF 2
length of the response protocol corresponds to the permitted length.
4.1.6.2 Mode = 0x03 (RF-decoder information)
RESPONSE-PAYLOAD
1 1 1 4 5
0x03 STATUS DEC_TYPE RFU RFU
Command 0x03 (RF-decoder information) 1
STATUS Status message from the reader 1
DEC_TYPE Information's about the functionality and revision of the RF-decoder for service and support. 1
RFU Reserved 4
RFU Reserved 5

4.1.6.3 Mode = 0x04 (Additional firmware functionality)
RESPONSE-PAYLOAD
1 1 1 1 1
0x04 STATUS TEMPLATE FNC_LST0 FW_IDENT
Command 0x04 (Additional firmware functionality) 1
Indicates how to interpret the following content depending on the reader type.
TEMPLATE 1
0x01 = ID CPR-Family
Each bit represents a firmware functionality.
Bit 7 6 5 4 3 2 1 0
Function MFP MFD MifareAppID TCL
TCL:
Indicates the support of the T=CL Function (Command [0xB2], [0xBE])
b0 = T (CL function is not supported)
b1 = T (CL function is supported)
MifareAppID:
Indicates the support of MifareAppID (Mifare Application Directory) in Scan-Mode
FNC_LST0 b0 = MifareAppID is not supported 1
b1 = MifareAppID is supported
MFD (Mifare DESFire high level crypto function):
Indicates the support of crypto functions with DESFire Commands [0xC1][0x##] and
[0xC3][0x##].
b0 = Crypto functions are not supported
b1 = Crypto functions are supported
MFP (Mifare PLUS high level crypto function):
Indicates the support of crypto functions with mifare Plus Commands [0xC2][0x##].
b0 = Crypto functions are not supported
b1 = Crypto functions are supported
FW_IDENT Identification code of special firmware version. 1

4.1.6.4 Mode = 0x05 (Bootloader Version Information)
RESPONSE-PAYLOAD
1 1 1 1 9
0x05 STATUS BL_VERSION BL_REF RFU
Parameter Description / Value LENGTH
Command 0x05 (Bootloader Version Information) 1
BL_VERSION Bootloader Version 1
BL_REF Revision of Bootloader Version 1
RFU Reserved 9
4.1.6.5 Mode = 0x08 (Supported Tag Drivers)
RESPONSE-PAYLOAD
1 1 30
0x08 STATUS TAG DRIVERS
Command 0x08 (Supported Tag Drivers) 1
List of supported Tag Drivers by the reader [starting with lowest number]
TAG DRIVERS 30
ANNEX A: Codes of Transponder Types
4.1.6.6 Mode = 0x12 (CPU Information)
RESPONSE-PAYLOAD
1 1 4 4
0x12 STATUS RFU CPU-FLASH

Command 0x12 (CPU-Information) 1
RFU Reserved 4
CPU-FLASH Memory size in Kbytes 4
4.1.6.7 Mode = 0x15 (RF- and ISO7816 Stack Firmware)
RESPONSE-PAYLOAD
1 1 2 2
0x15 STATUS SW-Rev RF-Stack SW-Rev ISO7816 Stack
Command 0x15 (RF- and ISO7816 Stack Firmware) 1
SW-Rev
Version of the RFID Firmware part 2
RF-Stack
SW-Rev
ISO7816 Version of the ISO7816 Firmware part 2
Stack
4.1.6.8 Mode = 0x16 (IDT Stack Information)

For internal use only!
4.1.6.9 Mode = 0x40 (CFG info for read permission)

Every bit marks the permission to read. The flag fields are independent of configurable password protection.
RESPONSE-PAYLOAD
1 1 2 x
0x40 STATUS NO_OF_PAGES PERMISSION

Command 0x40 (CFG info for read permission) 1
NO_OF_
No of available CFG pages. 2
PAGES
Byte 7
Bit 7 6 5 4 3 2 1 0
CFG_NO 7 6 5 4 3 2 1 0
Byte 8
PERMISSION Bit 7 6 5 4 3 2 1 0 x
CFG_NO 15 14 13 12 11 10 9 8
Byte 9
Bit 7 6 5 4 3 2 1 0
CFG_NO 23 22 21 20 19 18 17 16
4.1.6.10 Mode = 0x41 (CFG info for write permission)

Every bit marks the permission to write. The flag fields are independent of configurable password protection.
RESPONSE-PAYLOAD
1 1 2 x
0x41 STATUS NO_OF_PAGES PERMISSION
Command 0x41 (CFG info for write permission) 1
NO_OF_PAGES No of available CFG pages. 2
Byte 7
Bit 7 6 5 4 3 2 1 0
CFG_NO 7 6 5 4 3 2 1 0
Byte 8
PERMISSION Bit 7 6 5 4 3 2 1 0 x
CFG_NO 15 14 13 12 11 10 9 8
Byte 9
Bit 7 6 5 4 3 2 1 0
CFG_NO 23 22 21 20 19 18 17 16

4.1.6.11 Mode = 0x80 (Device_ID)
RESPONSE-PAYLOAD
1 1 4 4 2 2 2
0x80 STATUS DEV_ID CUSTOM_L FW_L TR_DRV_L FNC_L
Command 0x80 (Device_ID) 1
DEV_ID Individual device identifier of the reader. 4
CUSTOM_L Indicates which customer firmware is licensed on the reader. 4
FW_L Indicates which Firmware version is licensed on the reader. 2
TR_DRV_L Indicates which transponder drivers are licensed on the reader. 2

FNC_L Indicates which optional functions are licensed on the reader 2
4.1.6.12 Mode = 0xFF (Read all info modes)
RESPONSE-PAYLOAD
1 1 30 1 30
0xFF STATUS DATASETS MODE DATA
Command 0xFF (Read all info modes) 1
Number of data sets to be transferred from the reader to the host
DATASETS 30
(each with a length of 30 byte).
MODE Mode byte (Length 1 byte) 1
DATASETS
Repeated
times
Data record according to the definition in previous sections.

DATA The data record is always 30 byte long. 30
Unused byte must be filled with 0x00 (Length 30 byte)

4.1.7 [0x69] RF Reset

The RF-Parameter of the reader antenna can be switched off for trf = 6 ms by the command RF Reset. Thus,
all transponders which are within the antenna Parameter of the reader will be reset to their reset state.
REQUEST-PAYLOAD
1 1
0x69 0x00
RESPONSE-PAYLOAD
1 1 1
0x69 STATUS 0x00
 NOTE:
• After the RF reset command is set, the reader is not able to receive any new transponder before
expiration of trf.
• After a RF reset a transponder which is located within the parameter must be reselected.
• The response of this command will be sent after the RF reset was completed.
4.1.8 [0x6A] RF Output ON/OFF

The command RF ON/OFF switches the RF Parameter of the reader antenna ON or OFF.
If the reader works in Scan Mode the RF communication can be interrupted by transmitting RF OFF and
continued with RF ON. After RF OFF, the reader accepts every Host command and the RF communication is
handled on the last selected antenna.
REQUEST-PAYLOAD
1 1
0x6A RD-OUTPUT
RESPONSE-PAYLOAD
1 1
0x6A STATUS

COMMAND [0x6A] RF Output ON/OFF 1
Set one of the antenna outputs.
Bit 7 6 5 4 3 2 1 0
Function ANT_OUT
ANT_OUT
RF-OUTPUT 1
This parameter could be used to select one antenna.
b00 = Switches off RF power at all antennas.
b01 = Switches on the RF Power output 1 (internal antenna).
This setting is to use, if the reader has only one internal or one external antenna.
4.1.9 [0x72] Set Output

The command serves temporary limited or unlimited activation of the digital reader outputs.
Each output takes on the state defined by the byte OUTx-mode for the period of time (OUT-TIME) defined in
this command. If the Reader receives a Set Output command, all times that have been active until then are
being overwritten by the new times if they are > 0.
REQUEST-PAYLOAD
1 1 1 1 1 2
MODE
0x72 OUT-N OUT-NR OUT-S OUT-Time
0x01
Repeated OUT-N times
RESPONSE-PAYLOAD
1 1
0x72 STATUS
COMMAND [0x72] Set Output
MODE Always 0x01
OUT-N Defines the number of output records.


Defines the Type and the number of the output
Bit: 7 6 5 4 3 2 1 0
Function: OUT-Type 0 OUT-Number
OUT-Type
b 001 LED
b 010 OUT
Any other bit configuration is reserved.
OUT-NR
OUT NUMBER
Number of the output which shall be changed.
b 001 LED green
b 010 LED red
b 001 OUT1
b 010 OUT2
b 011 OUT3
OUT-S (Output State)
Defines the status of the output during the time defined in OUT-TIME and provides
the possibility to allocate its own flashing-frequency to each output.
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 OUTx-mode
OUT-S
OUTx-mode
b00 = OFF
b01 = ON
b10 = Flasching slow
b11 = Flashing fast
By the values defined by “OUT-TIME”, the outputs can be enabled temporary limited or unlimited.
An exception are the time values 0 and 65535 (0xFFFF).
0x0001 1 x 100ms 100ms

… … …
0xFFFE 65534 x 100ms 1:49:13 h
OUT-TIME 0xFFFF continuously active
 NOTE:
• To reset a continuously active time, OUT-TIME = 1 has to be sent to the reader, which
effects a change to the idle status after 100 ms.
• The continuous activation is being set back after a reset or a power failure.

4.1.10 [0xA0] Reader-Login

The Reader-Login must be executed after every power up or, if an access to the configuration parameters is
desired.
REQUEST-PAYLOAD
1 4
0xA0 READER-ID
RESPONSE-PAYLOAD
1 1
0xA0 STATUS
COMMAND [0xA0] Reader-Login 1
The READER-ID is a password which protects the configuration parameters from any read and
READER- write access.
4
ID The READER-ID can be changed in the configuration block.
[0x63] CPU Reset[0x63] CPU Reset
COMMAND [0xA0] Reader-Login
 NOTE:
• A Reader-Login with wrong READER-ID causes a "Logout".

• A "Logout" can be executed via the command.
4.1.11 [0xA2] Write Mifare Reader Keys

The keys which are required by the reader to authentify itself to a Mifare classic transponder (mifare classic
mini, 1k, 4k) can be stored by this command. Only if the keys of the reader and of the transponder match,
the data exchange between reader and transponder can be executed.
REQUEST-PAYLOAD
1 1 1 6
0xA2 Key-Type KEY-ADR KEY

RESPONSE-PAYLOAD
1 1
0xA2 STATUS
COMMAND [0xA2] Write Mifare Reader Keys 1
Defines the key for the authentication.
KEY-TYPE 0x00 = KEY-A 1
0x01 = KEY-B
(0x00 .... 0x07) Address where the key is stored in the reader. The address can be any value
KEY-ADR 1
between 0 and 7.
KEY Mifare: 6 byte key 6
 NOTE
• It is not possible to read back the keys off the reader. After having changed the keys, these should be
stored at a secured place.
• The factory setting of the keys on KEY-ADR 0x00:
KEY-A: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
KEY-B: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
4.1.12 [0xA3] Write DES / AES Reader Keys

The keys which are required by the reader in order to authenticate itself to an DES / AES encrypted
transponder (e.g. Mifare Desfire) will be stored in the reader by this command. Only if the keys of the reader
and the transponder correspond, the data exchange between reader and transponder can be successful
executed.
REQUEST-PAYLOAD
1 1 1 1 1 KEY-LEN
READER-
0xA3 MODE AUTH-MODE KEY-LEN KEY
KEY-IDX

COMMAND [0xA3] Write AES reader Keys 1
Bit 7 6 5 4 3 2 1 0
Function LOC
LOC
Specifies the location where the KEY should be stored in the reader
b0: RAM
The KEY will be stored only temporary in the RAM of the reader. After the supply
power was interrupted the keys has to be loaded once again into the RAM. This option
MODE 1
is recommended, if the reader is used on a public place, if anybody can take the
reader away easily.
b1: EEPROM
The KEY will be stored in the EEPROM and in the RAM of the reader. The key can be
used also after the supply power was interrupted. This option can be used, if the
reader is used on a secured place.
 NOTE:
The keys in the :EEPROM are not strong protected against hacking its content.
READER-
Address where the key is stored in the reader. 1
KEY-IDX
This parameter defines the authentication mode which will be performed by the reader with
this key
Auth-MODE Authentication Method KEY-LEN
0 DESFire Native TDES 16 bytes
AUTH- 1 Standard TDES 16 bytes
1
MODE 2 DESFire Native DES 8 bytes
3 Standard DES 8 bytes
4 3KTDES 24 bytes
5 AES 16 bytes
KEY-LEN This parameter defines the length of the following key (fix 16 bytes). 1
KEY-
KEY Key which has to be used for authentication.
LEN

4.2 Configuration Commands
4.2.1 [0x80] Read Configuration

Command “Read Configuration” detects the current configuration of the reader.
Configuration is read in blocks of 14 byte each and addressed by CFGn in the byte CFG-ADR.
REQUEST-PAYLOAD
1 1
0x80 CFG-ADR
RESPONSE-PAYLOAD
1 1 14
0x80 STATUS CFG-REC
COMMAND [0x80] Read Configuration 1
Bit 7 6 5 4 3 2 1 0
Function LOC CFGn: Address of Configuration Block
CFGn
Memory-address of the required configuration block.
LOC
Specifies the location of the configuration block.
CFG-ADR 1
b0 = RAM
b1 = EEPROM
 NOTE:
A read configuration from EEPROM with reserved configuration blocks will cause an
0x15 error code.
COMMAND [0x80] Read Configuration 1
CFG-REC 14-byte configuration block read from address CFGn in CFG-ADR. 14

4.2.2 [0x81] Write Configuration

Via the command Write Configuration the configuration of the reader can be stored. The configuration
memory organized in 14 bytes long blocks and addressed by CFGn in the byte CFG-ADR. The description of
parameters can be taken from Information to the parameter groups (ISOStart).
REQUEST-PAYLOAD
1 1 14
0x81 CFG-ADR CFG-REC
RESPONSE-PAYLOAD
1 1
0x81 STATUS
COMMAND [0x81] Write Configuration 1
Bit 7 6 5 4 3 2 1 0
Function LOC CFGn: Address of Configuration Block
CFGn
CFG-ADR 1
LOC
b0 = RAM
b1 =EEPROM and RAM
14-byte configuration block stored in the configuration memory of the reader at address CFGn in
CFG-REC 14
CFG-ADR.
COMMAND [0x81] Write Configuration 1

4.2.3 [0x82] Save Configuration

By the command RESET Configuration each configuration block of the RAM can be stored in EEPROM.
REQUEST-PAYLOAD
1 1
0x82 CFG-ADR
RESPONSE-PAYLOAD
1 1
0x81 STATUS
COMMAND [0x82] Safe Configuration 1
Bit 7 6 5 4 3 2 1 0
Function MODE CFGn: Address of Configuration Block
CFGn
CFG-ADR Memory-address of the required configuration block. 1
MODE
Specifies one or all configuration blocks.
b0 = configuration block specified by CFGn
b1 = all configuration blocks
3.1 Information to the parameter groups (ISOStart)
 NOTE:
A write configuration to EEPROM with reserved configuration blocks will cause an 0x16 error code.
COMMAND [0x82] Safe Configuration 1

4.2.4 [0x83] RESET (Set Default Configuration)

Using the command Set Default Configuration each configuration block can be reset to the manufacturer's
setting.
REQUEST-PAYLOAD
1 1
0x83 CFG-ADR
RESPONSE-PAYLOAD
1 1
0x83 STATUS
COMMAND [0x83] Set Default Configuration 1
Bit 7 6 5 4 3 2 1 0
Function LOC MODE CFGn: Address of Configuration Block
CFGn
MODE
Specifies one or all configuration blocks.
b0 = configuration block specified by CFGn
CFG-ADR b1 = all configuration blocks 1
LOC
b0 = RAM
b1 = EEPROM
 NOTE:
To store RAM configuration over power down ANNEX C: Index of Status Bytes.
A default configuration with reserved configuration blocks will cause an error code.
COMMAND [0x83] Set Default Configuration 1

4.3 Host commands for transponder communication

The ISO Host Commands provide the exchange of data between a host and transponders via the reader if
the transponder remains in the detection range of the reader.
Notice that not all commands are available for each transponder type. Detailed information about the
supported Host commands are described in each transponder type separate
see Supported Host Commands.
 NOTE:
During the writing of data on a transponder, it must be ensured that the transponder is located within the
detection range of the reader during the entire process. If the transponder is removed from detection range
of the reader during a writing process, this will cause a loss of data.
4.3.1 ISO/IEC 14443 Standard Mode
The standard mode is intended for all common applications like ticketing, access- control or document
verification.
The reader handles timeout control and error handling for RFID transponder chips in conformance with
ISO/IEC .
In ISO/IEC 14443 Standard Mode the reader RFID interface can be adapted to the application requirements
by various parameters.
RF-Interface (see page 35)

Anticollision (see page 41)
[0x01] Inventory (see page 93)
Inventory Command
The Inventory Command must be used to check if a transponder is in the detection range of the reader.
Beside the UID/PUPI the transponder provides information about the ISO 14443 layer.
[0x01] Inventory
Select Command
The Select command must be used for most common ISO/IEC 14443 transponders.
The response contains information about the selected transponder type.
The Select command offers the option of an automatic type identification or to explicitly select a transponder
driver.

Data Exchange
Depending on the ISO 14443 layer supported by the transponder, different commands are offered for data
exchange.
Process for a transponder in ISO/IEC 14443 Standard Mode:

4.3.2 Transponder Addressing Modes:

The reader supports three different transponder addressing modes which are specified by the relevant
technical standards or the transponder manufacturer.
No. Addressing modes

1 Select Mode
2 Addressed Mode
3 Non-addressed Mode
4.3.2.1 Select Mode:

In this mode the reader communicates only with the one, selected transponder.
Before reading or writing data in selected mode, the UID of the transponder must be known. This is done by
sending the [0x01] Inventory Command [0x01] Inventory (see page 93)
In the next step the transponder must be selected with the select command [0x25] Select (see page 107)
which must include its UID.
Communication with a transponder in selected mode:

4.3.2.2 Addressed Mode

Before reading or writing data in addressed mode, the UID of the transponder must be known. This is done
by sending the command [0x01] Inventory.
If a transponder is located within the detection range of the reader at that time, it answers with its UID. For all
following read- / write commands the transponder must be addressed with its UID.
Communication with a transponder in Addressed Mode:
Figure 1: Addressed Mode

4.3.2.3 Non-Addressed Mode:

In Non-Addressed Mode, it is not necessary to know the UID of the transponder. This mode is useful, if only
one transponder is located within the range of the reader, or all transponders shall process the command.
Figure 2: Non-Addressed Mode

4.4 [0xB0] Standard Host Commands

This command sends standard RF commands to the transponder.
REQUEST-PAYLOAD
1 1
0xB0 SUB-COMMAND
RESPONSE-PAYLOAD
1 1 n
0xB0 STATUS RESPONSE-DATA
 NOTE:
• Data are only transferred, if STATUS = 0x00, 0x83, 0x94, 0x95.

• These commands are not available, if Scan-Mode is active.
4.4.1 [0x01] Inventory

This command reads the UID of transponders which is located in the detection range of the reader. The
response behavior of this command can be configured by the anticollision parameter of configuration block
The operating behavior of the Inventory Command depends on settings in Anticollision.Parameter ONT and
“On Settings” in Mode byte.
OperatingMode.HostMode.Filter.ResponseMode
b0 = A RF-Reset is performed to read the UID of all transponders inside the antenna parameter.
b1 = Only the response of those transponders are read,
which came into the antenna parameter since the last Inventory Command.
In this case the reader response includes an UID only, if:
• the transponder has left the antenna parameter and reentered the antenna parameter or
• the command see [0x69] RF Reset was sent to the reader meanwhile or
• the transponder in the antenna parameter is a jewel
Transponder.Anticollision.Enable
b0 = disabled anticollision (default)
b1 = enabled anticollision

COMMAND [0xB0] Standard Host Commands 1
SUB-
0x01 Inventory 1
COMMAND
Bit 7 6 5 4 3 2 1 0
Function MORE NTFC PRESC
PRESC (presence check mode)

“Settling of” bit activates the presence check mode of the Inventory Command. This setting is
suitable to perform a presence check of all transponders in detection range of the reader
without influencing the UID of transponder with a random UID
b0 = Presence check is disabled
b1 = The response of the Inventory Command [0x01] includes the UID of all detected
transponders in the reader detection range.
 NOTE:
The PRESC = b1 can only be used if ONT bit and ACOLL bit is set to b1
ANNEX A: Codes of Transponder Types
NTFC
Activates the Inventory Notification Mode of the Inventory Command.
b0 = Standard Inventory Command
MODE b1 = Inventory in notification mode: 1
The response includes the transponder UIDs without performing a RF-Reset.
In this case the optional parameter NTFC_TIME must send to the reader.
In Inventory Notification Mode the Inventory Command runs internally, while one or more
transponders are detected by the reader or while the time defined by NTFC_TIME elapsed.
MORE
This bit can be used, to read out the whole UIDs, after the reader had signalized more data
sets with status. ANNEX C: Index of Status Bytes
b0 = New Inventory requested

The reader carries out a new inquiry, which transponder is in its detection range.
b1 = more data requested
The reader response contain the UID’s which are not transferred with the last response
because of the status 0x94.
 NOTE:
The MORE and NTFC function can be used only exclusive.

An Inventory Command without a mode selection will be performed only on the selected
antenna by using the [0x6A] RF Output ON/OFF command.
This optional parameter defines the maximum duration of the Inventory Command in
Notification Mode (see NTFC bit in MODE Byte).
NTFC_TIME 1
Max. Response Duration
NTFC_TIME 0...255 * 100 ms

 NOTE:
The NTFC_TIME overwrites the TR-RESPONSE-TIME which is defined in CFG1.

The receive block timeout of the host computer must set to a value NTFC_TIME.
A running Inventory Command with NTFC option couldn't be interrupted by any other command
while NTFC_TIME.
Details RESPONSE-DATA
COMMAND [0xB0] Standard Host Commands 1
SUB-
0x01 Inventory 1
COMMAND
DATA-SETS Number of transponder data sets to be transferred in this reader response. 1
Bit 7 6 5 4 3 2 1 0
Function RF_TEC TYPE_NO
TR-Type RF_TEC 1
Indicates the RFID - Technology of the present transponder:
b00 = 13,56 MHz transponder
b10 = UHF transponder
TYPE_NO
Displays the transponder type of the present transponder
RESPONSE- Depending on the transponder type the response data of the reader are different as
x
DATA described in the following chapters.

4.4.1.1 Response-Data – ISO 14443 A (TR-TYPE = 0x04)
RESPONSE-PAYLOAD
1 1 8/10
DATA-SETS TR-Type UID
Case CFG3. ISO14443 FTUR.OPTI = b0 = OPT_INFO is disabled
DATA-
Number of transponder data sets to be transferred in this reader response. 1
SETS
TR-Type Displays the transponder type of the present transponder. 1
Only ISO 14443 A transponder:
This byte includes some information from the SAK byte as described in ISO14443-3.
In case of NXP mifare chips this byte also indicates the chip type. Further information's are
given in the NXP Application "mifare Interface Platform, Type Identification Procedure"
M018412.
Repeated DATA-SETS times

Bit 7 6 5 4 3 2 1 0
Function L4 CL3
TR_INFO CL3 1
Displays the UID Length of the present transponder.
b0 = The UID is transmitted as a 7 byte Parameter (transponder with Cascade Level 1 or 2)
b1 = The UID is transmitted as a 10 byte Parameter (transponder with Cascade Level 3)
L4
Displays the compliance of the transponder with ISO 14443-4 according ISO 14443-3,
SAK, b6
b0 = Not compliant with ISO 14443-4
b1 = Compliant with ISO 14443-4

ISO 14443A UID could have different Lengths. This depends on the Cascade Level of the
transponder (see also TR_INFO byte). It is transmitted by the reader with a Length of 7 or
10 byte.
Transmitted 9 10 11 12 13 14 15 16 17 18
Byte
Cascade- 0 0 0 UID3 UID2 UID1 UID0 - - -
Level 1
Cascade- UID6 UID5 UID4 UID3 UID2 UID1 UID0(* - - -
Level 2
UID 8/10
Cascade- UID9 UID8 UID7 UID6 UID5 UID4 UID3 UID2 UID1 UID0*
Level 3
* UID0: Manufacturer ID accords ISO/IEC7816-6/AM1
In case of a shorter UID the redundant bytes are filled with 0 at the most significant digits.
 NOTE:
The UID byte order can be swapped by using the parameter
transponder.HF.ISO_14443.TypeA.UID_Order
RESPONSE-PAYLOAD
1 1 1 1 7 or 10
DATA-SETS TR-Type TR_INFO OPT_INFO UID

Case CFG3 ISO14443 FTUR.OPTI = b1 = OPT_INFO is enabled
DATA-
SETS
TR-TYPE Displays the transponder type of the present transponder. 1
(Only ISO 14443A transponder):
This byte includes some information from the SAK byte as described in ISO14443-3.
In case of NXP mifare chips this byte also indicates the chip type. Further information's
are given in the NXP Application NOTE: "mifare Interface Platform, Type Identification
Procedure" M018412.
Bit 7 6 5 4 3 2 1 0
Function L4 CL3
CL3
TR_INFO Displays the UID Length of the present transponder. 1
b0 = The UID is transmitted as a 7 byte Parameter (transponder with Cascade Level 1 or
2)
b1 = The UID is transmitted as a 10 byte Parameter (transponder with Cascade Level 3)
L4
Displays the compliance of the transponder with ISO 14443-4 according ISO 14443-3,

SAK, b6
b0 = Not compliant with ISO 14443-4
b1 = Compliant with ISO 14443-4
(Only ISO 14443A transponder):

Depending on the setting of CFG3.ISO14443 FTUR.OPTI this byte could optional display
further information's about the present transponder.
It's recommended to use this information if ISO14443-4 transponder or transponder with
more the 4 byte UID Length should be handled by the reader.
Bit 7 6 5 4 3 2 1 0
Function L4_SLCT C_LEVEL
C_LEVEL
OPT_INFO These two bits displays the Cascade Level of the transponder UID 1
b00 = Cascade Level 1 (4 byte UID)
L4_SLCT
This bit displays the select status of the present transponder.
b0 = The transponder is not selected in ISO14443-4 level.
b1 = The transponder is selected on ISO14443-4 level by the reader now. A further
select command is not necessary for data exchange with this transponder.

ISO 14443A UID could have different Lengths. This depends on the Cascade Level of the
transponder (see also TR_INFO byte). It is transmitted by the reader with a Length of 7 or
10 byte.
Transmitted 9 10 11 12 13 14 15 16 17 18
Byte
Cascade- 0 0 0 UID3 UID2 UID1 UID0 - - -
UID Level 1 7or10
Cascade- UID6 UID5 UID4 UID3 UID2 UID1 UID0 - - -
Level 2 *
Cascade- UID9 UID8 UID7 UID6 UID5 UID4 UID3 UID2 UID1 UID0*
Level 3
* UID0: Manufacturer ID according ISO/IEC7816-6/AM1. In case of a shorter UID the
redundant bytes are filled with 0 at the most significant digits.
4.4.1.2 Response-Data – ISO 14443B (TR-TYPE = 0x05)
RESPONSE-PAYLOAD
1 1 1 4 4
DATA-SETS TR-Type TR_INFO APP-DATA PUPI
DATA-
SETS
This parameter is extracted from the protocol Info byte as described in ISO14443-3
Bit 7 6 5 4 3 2 1 0
Function Max_Frame_Size Protocol_Type
Protocol_Type
According ISO14443-3:2001)
7 6 5 4 Meaning
1 PICC compliant with ISO/IEC 14443-4
TR_INFO 1
PICC not compliant with ISO/IEC 14443-4
Max_Frame_Size
According ISO14443-3:2001)
Value 0 1 2 3 4 5 6 7 8 9-F
Frame 16 24 32 40 48 64 96 128 256 RFU
Size > 256
(Byte)
4 byte Application Date accords ISO 14443-3:2001

APP-DATA 1 2 3 4 4
AFI CRC_B (AID) Number of Applications

4 byte Pseudo-Unique PICC Identifier, accords ISO 14443-3:2001. This information is

PUPI 4
required to select the transponder.
4.4.1.3 Response-Data – Innovatron [14443-B] (TR-TYPE = 0x10)
RESPONSE-PAYLOAD
1 1 1 1 7 or 10
DATA-SETS TR-Type TR_INFO OPT_INFO UID
Details RESPONSE-DATA of a transponder, that supports the Innovatron radio protocol:

DATA-
SETS
UID 4 LSBytes of card´s serial number (filled with leading zeros). 8
Bit 7 6 5 4 3 2 1 0
Function TYPE 1 1 SW-Version 1
VERLOG Type 1
b0 = “Short REPGEN” (No additional bytes following)
b1 = “Long REPGEN” (Additional bytes following)

SW-Version
Software version of the tag (0…14)
Bit 7 6 5 4 3 2 1 0
Function WE TAB RFU = 0
WE (Wait enble)
CONFIG b0 = Tag doesn´t accept WAIT command frames (useless in batteryless mode) 1
b1 = Tag accepts WAIT command frames (useless in batteryless mode)
TAB
b0 = no tag ATR bytes are present
b1 = tag ATR bytes are present
ATR-LEN Length of the following ATR 1
ATR-
ATR ATR (according to ISO7816-3) of the transponder
LEN

4.4.1.4 Response-Data – Jewel (TR-TYPE = 0x08)
RESPONSE-PAYLOAD
1 1 1
DATA-SETS TR-Type UID
Details RESPONSE-DATA of a transponder, that supports the Innovatron radio protocol:

DATA-
SETS
DATA-SETS
Repeated
Read-only UID of the transponder
times
In case of a shorter UID the redundant bytes are filled with 0 at the most significant digits.
UID 6
HR0, HR1
Metal-mask data selected. 0x01 for IRT5001W and 0x3C for IRT5001E
4.4.1.5 Response-Data – SR176 (TR-TYPE = 0x0A)
RESPONSE-PAYLOAD
1 1 1 8
DATA-SETS TR-Type CHIP_ID UID
Details RESPONSE-DATA of SR176 (TR-TYPE = 0x0A)

DATA-
SETS
Repeated DATA-
CHIP_ID Optional fixed Chip_ID from block address 15. 1

times
SETS
64 Bit UID of the transponder. It is transmitted by the reader with a Length of 8 byte.
UID Bit 7 6 5 4 3 2 1 0 8
Function UID7 UID6 UID5 UID4 UID3 UID2 UID1 UID0

4.4.1.6 Response-Data – SRIx (TR-TYPE = 0x0B)

Response data of STM SRI512, SRI4K SRIX4k transponder:
RESPONSE-PAYLOAD
1 1 1 8
DATA-SETS TR-Type CHIP_ID UID
Details RESPONSE-DATA of Response-Data – SRIx (TR-TYPE = 0x0B)

DATA-
SETS
Repeated DATA-
CHIP_ID Optional fixed Chip_ID from block address 15. 1
times
SETS
64Bit UID of the transponder. It is transmitted by the reader with a Length of 8 byte.
UID Bit 7 6 5 4 3 2 1 0 8
Function UID7 UID6 UID5 UID4 UID3 UID2 UID1 UID0
4.4.1.7 Response-Data – FeliCa (TR-TYPE = 0x0D)
RESPONSE-PAYLOAD
1 1 1 8 8
DATA-SETS TR-Type Length IDm PMm
RESPONSE-DATA of STM SR176 transponder

DATA-
SETS
Repeated
DATA-
Length of ID – data
times
SETS
Length 1
IDm Manufacture ID 8
PMm Manufacture Parameter 8

4.4.1.8 Response-Data – ISO15693 (TR-TYPE = 0x03)
RESPONSE-PAYLOAD
1 1 1 8
DATA-SETS TR-Type DSFID UID
RESPONSE-DATA of ISO15693 (TR-TYPE = 0y03)

DATA-
SETS
Repeat
DATA-
times
SETS
ed
DSFID Data Storage Family Identifier. If not used this value will return 0x00 1
UID Read-only serial number of the transponder 8
4.4.1.9 Response-Data – ISO18000-3M3 (TR-TYPE = 0x09)
RESPONSE-PAYLOAD
1 1 1 1 n
DATA-SETS TR-Type IDDT IDD_LEN IDD
RESPONSE-DATA
DATA-
SETS
DATA-SETS
Identifier Data Type Repeated
times
IDDT 1
Defines the type of IDD
IDD_LEN Identifier Data Length defines the length of the IDD in Byte. 1
IDD Identifier Data of the transponder n

4.4.1.10 Response-Data with antenna request

If ANT Flag is set in the MODE Byte, the reader starts an inventory round over all antennas.
RESPONSE-PAYLOAD
1 1 1 1 1 x
DATA-SETS FLAGS TR-Type DSFID UID_LEN UID
1 1 1 1 4
ANT_CNT ANT_NR ANT_STATUS RESERVE RESERVE
Details RESPONSE-DATA if ANT = 1 for ISO15693 transponder

DATA-SETS Number of transponder data sets to be transferred in this reader response. 1
Bit 7 6 5 4 3 2 1 0
Function ANT IDD
IDD
b0 = No IDD will be send
FLAGS 1
b1 = IDD will be send
ANT
b0 = No antenna information will be send
b1 = Antenna information (ANT_CNT, ANT_NR, ANT_STATUS) will be send
only 15693 transponder)
Repeated DATA-SETS
DSFID
Data Storage Family Identifier. If not used this value will return 0x00.
(only 15693 transponder)
UID-LEN
times
Unique Identifier Data Length defines the length of the UID (serial number) in Byte.
(only 15693 transponder)
UID
Read-only serial number of the transponder.
ANT_CNT Number of antennas where transponder was read
ANT_NR Number of the antenna (1...2)
The ANT_STATUS can be 0x00 (OK) or 0x83 (RF communication error)
 NOTE:
• This command supports all transponders.

ANT_STATUS • For reading pseudo unique identifiers only one antenna should be
selected
• The reader remains on the last antenna. If antennas 1 and 2 are
selected, the reader remains on antenna 2 if no transponder was
detected.
reserved 1
reserved 4

RESPONSE-PAYLOAD
1 1 1 1 1 x
DATA- FLAGS RESPONSE DATA ANT_CNT ANT_NR ANT_STATUS RESERVED RESERVED
SETS if ANT = 0
Details RESPONSE-DATA if ANT = 1 for all other transponder

Number of transponder data sets to be transferred in this reader
DATA-SETS 1
response.
FLAGS see above 1
Repeated DATA-SETS
RESPONSE
DATA if ANT x
=0
times
ANT_CNT Number of antennas where transponder was read 1
ANT_NR Number of the antenna (1...2) 1
ANT_CNT
Repeated
times
ANT_STATUS The ANT_STATUS can be 0x00 (OK) or 0x83 (RF communication error) 1
reserved 1
reserved 4

4.4.1.11 Sequences of Inventory Command and ISO14443 transponder

The following chart displays the sequences and effects after an inventory command depending on the
transponder type and the Reader configurations.
No of
Selected
announced next possible commands
transponder
transponder
Response 1 no > 1 (possibly) 4.4.2 [0x25] Select
yes Proprietary or standard commands for
Response 2 one transponder 1 ISO14443 transponders
on ISO14443-3 level 4.3 Host commands for transponder communication
yes
ISO14443-4 Commands
Response 3 one transponder 1
4.3 Host commands for transponder communication
on ISO14443-4 level

4.4.2 [0x25] Select

This command sets one transponder to the Select State. Only one ISO transponder can be selected at once.
The supported ISO Host commands depends on the transponder types.
REQUEST-PAYLOAD
1 1 1 1 1
0x25 MODE TR_DRV UID_LEN UID
RESPONSE-PAYLOAD (STATUS = 0x95)

1 1 1
0x25 STATUS = 0x95 ISO-ERROR

1 1 1 1
0x25 STATUS = 0x00 FORMAT CARD_INFO
Details Request-Payload
COMMAND [0x25] Select 1
Bit 7 6 5 4 3 2 1 0
Function DRV_SEL CINF UID_LF ADR
ADR
b 001 addressed
UID_LF
If this bit is set the parameter UID_LEN must insert into the command.
b0 = The request data doesn't include the UID_LEN byte and the UID Parameter has a
fixed
MODE 1
Length of 8 byte, from byte6 to byte 13.
b1 = The request data includes the parameter UID_LEN. The UID has a variable
Length as defined in UID_LEN.
CINF
b0 = response data doesn’t include optional CARD_INFO
b1 = response data includes optional CARD_INFO
DRV_SEL
b0 = No extra byte TR-DRV included in request data
b1 = Extra byte TR-DRV included in request data

This optional extra byte offers the possibility to select explicit a transponder driver for the
current select command.
This option may be helpful in such cases when the reader cannot detect the correct type
of the transponder e.g. if a processor card emulates any kind of memory card or if NFC
devices are presented.
1
 NOTE:
Make sure that the relevant TAG-DRV and ISO14443-DRV is enabled in CFG3
Bit 7 6 5 4 3 2 1 0
Function TR-DRIVER-SELECTION
TR-DRIVER-SELECTION
By means of this parameter the host application explicit selects an internal driver to
handle the data exchange with the addressed transponder.
TR_DRV TR-DRIVER-
Selected transponder driver
SELECTION
0x01 ISO 14443-4
0x02
0x03 NFC Card Type 2, mifare Ultralight, my-d move, etc.
0x04 1
0x05 mifare plus SL1 - ISO14443-4
0x06
0x07 mifare plus SL2 - ISO14443-4
0x08 mifare plus SL3
0x09 mifare DESFire
0x0A my-d proximity
my-d move
0x0B
(use this if proprietary my-d move command shall be used)
Is an optional parameter and depends on the setting of UID_LF
 NOTE:
UID_LEN 1
The maximum UID_LEN is limited depending on the reader type. If UID_LEN
exceeds the internal buffer size the reader responses an error massage.

UID, Serial-Number or pseudo unique identifier of the transponder. Depending on the

UID_LF and UID_LEN the UID Parameter could have a fixed ore a variable Length and a
variable position in the protocol.
case UID_LF = 0
If UID_LEN is not used, the following definitions are mandatory depending on the
transponder type:
ISO 14443 A
6 7 8 9…16
[0x25] b000 0001 0x00 UID
UID
ISO 14443 B
6 7 8…11 12…15
[0x25] b000 0001 0x00 PUPI
case UID_LF = 1
If UID_LEN is enabled the specific UID Length of the transponder should be used in the
protocol.
6 7 8 9…9+UID_LEN
[0x25] MODE UID_LEN UID
RESPONSE-DATA (only if STATUS = 0x95)

ISO-ERROR Additional error code if STATUS = 0x95 1

Details RESPONSE-DATA if STATUS = 0x00 and REQEST-DATA bit MODE.CINF = 1

Indicates the format of the CARD_INFO Parameter:
0x00 = No further CARD_INFO Parameter available
0x01 = CARD_INFO of an ISO14443-4 Type-A transponder
0x02 = CARD_INFO of an ISO14443-4 Type-B transponder
FORMAT 1
0x03 = CARD_INFO of an ISO14443-3 Type-A transponder
0x04 = CARD_INFO of an Innovatron radio protocol (ISO14443B’) transponder
0x05 = CARD_INFO of an ISO14443-4 Type-A transponder (0x01) + Get Version
0x06 = CARD_INFO of an ISO14443-3 Type-A transponder (0x03) + Get Version
Depending on the FORMAT parameter this data Parameter contains different data:
case FORMAT = 0x01:
CARD_INFO contains the ATQA and SAK and parts of the Answer to select (ATS) of
the ISO14443 Type-A transponder as defined in ISO14443-4. The Length of
CARD_INFO depends on the TL parameter. The response Length depends on the
TL parameter of the transponder ATS.
1 1
ATQA
RFU Proprietary coding UID size RFU Bit frame anticollision
1 1 TL-1
SAK TL T0, TA(1), TB(1), TC(1) T1, Tk
case FORMAT = 0x02:

CARD_INFO contains parts of the answer ATQB response ATTRIB response of the
ISO14443 Type-B transponder as defined in ISO14443-3.
1 1 1
ATQB Response Protocol Info
CARD_INFO Bit_Rate_capability Max_Frame_ Protocol_Type FWI ADC F0
Size
1
1 byte of Answer to ATTRIB
MBLI CID
case FORMAT = 0x03

CARD_INFO contains the ATQA and SAK parameter after the anticollision loop has
finished of ISO14443 Type-A transponder as defined in ISO14443-3.
1 1
ATQA
RFU Proprietary coding UID size RFU Bit frame anticollision
1
SAK

case FORMAT = 0x04

CARD_INFO contains the transponder address and the validator address of
Innovatron radio protocol transponder.
1
TAG ADDRESS VALIDATOR ADDRESS
case FORMAT = 0x05

CARD_INFO contains LEN_GET_VERSION = Length of Get Version and
Get Version = Manufactoring related data of the transponder.
n 1 n
CARD_INFO x
LEN_
Card Info Format 1 Get Version
Get_Version
case FORMAT = 0x06

CARD_INFO contains LEN_GET_VERSION = Length of Get Version and
Get Version = Manufactoring related data of the transponder.
n 1 n
LEN_
Card Info Format 3 Get Version
Get_Version
[0x23] Read Multiple Blocks

This command reads one or more data blocks from memory cards.
The supported Host commands depends on different transponder types, they are described in
REQUEST-PAYLOAD
1 1 1 8 1 1 1
0x23 MODE UID_LNG UID BANK A_PW_LNG A_PW
1 or 2 bytes 1 1 DB-Size
DB-ADR DB-N DB-SIZE DB
RESPONSE-PAYLOAD
1 1 1
STATUS = ISO15693
0x23
0x95 ERROR
Details REQUEST-DATA
COMMAND [0x23] Read Multiple Blocks 1

Bit 7 6 5 4 3 2 1 0
Function 0 0 EXT_ADR 0 SEC ADR
ADR
b000 = Non addressed
b001 = Addressed
b010 = Selected
SEC
b0 = SEC-STATUS always = 0x00
b1 = Security status of following data block in SEC-STATUS
MODE 1
ID_LF
If this bit is set the parameter UID_LNG must insert into the protocol.
b0 = The protocol UID_LNG doesn't include the UID_LNG byte and the UID
Parameter has a fixed length of 8 byte.
b1 = The protocol includes the parameter UID_LNG. The UID has a
variable length as defined in UID_LNG.
EXT_ADR
If this bit is set the command includes extended address fields.
b0 = transponder memory addressing is done by the 1 byte DB ADR
Parameter.
b1 = transponder memory addressing is done by BANK and 2 byte DB-ADR
Parameter
Is an optional parameter and depends on the setting of UID_LF.
UID_LNG 1
UID_LNG defines the length of the following UID Parameter.
Read-only serial number of the transponder. The UID is required only in the
UID 8
addressed mode.
Bit 7 6 5 4 3 2 1 0
Function A_FLAG 0 0 0 0 0 BANK_NR
BANK_NR:
Defines the memory area on the transponder.
b00 = Reserved
b01 = Reserved
BANK b10 = Reserved 1
b11 = User memory bank
A_FLAG:
Indicates whether the reader tries to read an ISO18000-3M3 tag in Secured
State. If A_FLAG is set the protocol contains the access password.
b0 = No access password in protocol
b1 = Access password and access password length in protocol. Reader
execute access command
A_PW_LNG Length of Access Password 1
A_PW Access password which is used to access to the secured state of the Tag. 1


First block number to be read. Depending on EXT_ADR. First block can be
DB-ADR 1 or 2 bytes
any value be-tween 0 and 255 or 0 and 65535.
Number of data blocks to be locked, starting at DB-ADR. The maximum
number of DB-N depends on DB-Size.
DB-Size Max. DB-N
DB-N 2 200 1
4 100
8 50
x = 400 / x
Number of bytes of one data block. This value depends on the specification of
DB-SIZE 1
the transponder manufacturer 5 Supported Host Commands
SEC- Block security status of followed data block.
DB-N times
1
Repeated
STATUS If SEC-STATUS is not requested or not supported, this value will return 0x00.
DB Requested data block. The block size is defined by DB-SIZE DB-SIZE
Details RESPONSE-DATA (STATUS = 0x95)

Description / Value Length
COMMAND [0x23] Read Multiple Blocks 1
ISO15693 ERROR code of transponder response. This byte is only available if
ISO15693 ERROR 1
STATUS = 0x95.
 NOTE:
• If a transponder does not support Read Multiple Blocks commands several Read Single Block commands are used
for this transponder.
• Jewel transponders are only supported in Addressed Mode
• A read of 1 byte from a JEWEL transponder uses the JEWEL READ Instruction
• A read of more than 1 byte from a JEWEL transponder uses the JEWEL READ-ALL instruction
• A read from 1 block uses a Read Single Block command to the ISO15693 transponder.
4.4.3 [0x24] Write Multiple Blocks

This command writes one or more data blocks. The supported ISO Host commands depends on the different
transponder types, which are described in 5 Supported Host Commands
REQUEST-PAYLOAD
1 1 1 8 1 1 1
0x24 MODE UID_LNG UID BANK A_PW_LNG A_PW
1 or 2 bytes 1 1 DB-Size
DB-ADR DB-N DB-SIZE DB


1 or 2 bytes
1 1
( def. by EXT_ADR)1
0x24 STATUS = 0x03 DB-ADR-E

1 1 1 1
0x24 STATUS = 0x95 ISO15693 ERROR DB-ADR-E
REQUEST-DATA
COMMAND [0x24] Write Multiple Blocks 1
EXT_ADR:
b0 = transponder memory addressing is done, by the 1 byte DB ADR Field.
b1 = transponder memory addressing is done, by BANK and 2 byte DB
ADR Field
Bit 7 6 5 4 3 2 1 0
MODE 1
Function 0 0 EXT_ADR UID_LF WR-NE ADR
ADR
b001 = Addressed
b010 = Selected
WR-NE (JEWEL)
b0 = Write-Erase
b1 = Write-No-Erase
This settling is necessary for write operations on OTP Bytes.
UID_LF:
MODE
Parameter has a fixed length of 8 byte.
b1 = The protocol includes the parameter UID_LNG. The UID has a
variable length as defined in UID_LNG.
Is an optional parameter and depends on the setting of UID_LF.

UID_LNG 1
UID_LNG defines the length of the following UID Parameter.
UID 8
addressed mode.


Bit 7 6 5 4 3 2 1 0
Function A_FLAG 0 0 0 0 0 BANK_NR
BANK_NR:
Defines the memory area on the transponder.
b00 = Reserved
BANK b01 = Reserved 1
b10 = Reserved
A_FLAG:
Indicates whether the reader tries to read an ISO18000-3M3 transponder in
Secured State. If A_FLAG is set the protocol contains the access password.
b0 = No access password in protocol
b1 = Access password and access password length in protocol. reader
execute access command
A_PW_LNG: Length of Access Password 1
A_PW Access password which is used to access to the secured state of the tag. 1
First block number to be read. Depending on EXT_ADR. First block can be
DB-ADR 1 or 2 bytes
any value be-tween 0 and 255 or 0 and 65535.
Number of data blocks to be locked, starting at DB-ADR. The maximum
number of DB-N depends on DB-Size.
DB-Size Max. DB-N

DB-N 2 128 1
4 64
8 32
x = 256 / x
Number of bytes of one data block. This value depends on the specification of
DB-SIZE 1
the transponder manufacturer see 5.4 ISO15693 transponder
Data of the data block to be written to the transponder. The required block
DB size is defined by DB-SIZE. The number of the expected byte is DB-SIZE
DB-N * DB-SIZE.
RESPONSE-DATA (STATUS = 0x03)

1 or 2 bytes
DB-ADR-E Block number where the error occurred.
( def. by EXT_ADR)


ISO15693 ISO15693 ERROR code of transponder response. This byte is only available if STATUS
1
ERROR = 0x95.
DB-ADR-E Block number where the error occurred 1
 NOTE:
• If a transponder does not support Write Multiple Blocks commands several Write Single Block commands are used
for this transponder.
• If an error occurred during a write command, the number of the block were the error occurred will be send to host
• A write to 1 block uses a Write Single Block command to the 15693 Transponder. This will be managed by the
Reader internally.

4.5 [0xB0] ISO 15693 Commands
4.5.1 [0x02] Stay Quiet
This command sets one transponder to Quiet State.

REQUEST-PAYLOAD
1 1 1 1
0xB0 0x02 MODE UID
COMMAND 0x02 Stay Quiet 1
Bit 7 6 5 4 3 2 1 0
Function ADR
MODE 1
ADR
b001 = Addressed
UID Read-only serial number of the transponder 1
4.5.2 [0x22] Lock Multiple Blocks

This command locks one or more data blocks.
REQUEST-PAYLOAD
1 1 1 (8) 1 1
0xB0 0x22 MODE (IDD) DB-ADR DB-N

1 1 1
0xB0 STATUS = 0x00 (ERROR INFO)

1 1 1

1 1 1


COMMAND [0xB0] ISO 15693 Commands)
SUB-COMMAND [0x22] Lock Multiple Blocks
Defines the mode of the command.
Bit 7 6 5 4 3 2 1 0
Function - - - - - ADR
MODE
b000: non-addressed mode
ADR b001: addressed mode
b010: selected mode
(IDD) Read-only serial number of the transponder. The IDD is required only in the addressed mode.
First block number from which the security status is requested. First block number can be any value
DB-ADR
between 0 and 255.
Number of data blocks to be read from the transponder, starting at DB-ADR. The maximum number
DB-N
of DB-N is 100 blocks.
STATUS = 0x00
(ERROR INFO) ERROR INFO depending on STATUS
STATUS = 0x03
DB-ADDRESS-
1 byte block number where the error occurred
ERROR
STATUS = 0x95
TAG-ERROR 10. ANNEX C2: Error-Codes
DB-ADDRESS-
1 byte block number where the error occurred
ERROR

4.5.3 [0x26] Reset to Ready

This command sets one transponder to Ready State.
REQUEST-PAYLOAD
1 1 (8)
0x26 MODE UID
RESPONSE-PAYLOAD
1 1 1
0x26 STATUS ISO-ERROR
Command [0x26] Reset to Ready 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 0 ADR
MODE 1
ADR
b001 = Addressed
b010 = Selected
(UID) 8
addressed mode.
Details RESPONSE-DATA if STATUS = 0x95

Command 0x26 Reset to Ready 1

4.5.4 [0x27] Write AFI

This command writes a new AFI code to one or more transponders.
The supported ISO15693 Host commands depend on the different ISO15693 transponder types, which are
described in
5. Supported Host Commands
REQUEST-PAYLOAD
1 1 (8) 1
0x27 MODE (UID) AFI
RESPONSE-PAYLOAD
1 1 1
COMMAND [0x27] Write AFI 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR
b001 = Addressed
b010 = Selected
Read-only serial number of the transponder. The UID is required only in the addressed
(UID) (8)
mode.
AFI Application Family Identifier of the transponder 1
Details RESPONSE-DATA -if STATUS = 0x00


ISO-ERROR Additional error code if STATUS = 0x95. 1

4.5.5 [0x28] Lock AFI

This command locks the AFI register in one or more transponders.
The supported ISO15693 Host commands depend on the different ISO15693 transponder types,
see 5.4 ISO15693 transponder.
REQUEST-PAYLOAD
1 1 (8)
0x28 MODE (UID)
RESPONSE-PAYLOAD
1 1 1
REQUEST-DATA
COMMAND [0x28] Lock AFI 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b001 = Addressed
b010 = Selected
(UID) 1
mode.
Details RESPONSE-if STATUS = 0x00



4.5.6 [0x29] Write DSFID (ISO15693)

This command writes the DSFID to one or more transponders. The supported ISO15693 Host commands
depend on the different ISO15693 transponder types see 5.4 ISO15693 transponder.
REQUEST-PAYLOAD
1 1 1 1
0x29 MODE (UID) DSFID
RESPONSE-PAYLOAD
1 1 1
COMMAND [0x29] Write DSFID (ISO15693) 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b001 = Addressed
b010 = Selected
(UID) 1
mode.
DSFID Data storage format identifier of the transponder 1
Details RESPONSE-if STATUS = 0x00



4.5.7 [0x2A] Lock DSFID

This command locks the DSFID register in one or more transponders.
The supported ISO15693 Host commands depend on the different ISO15693 transponder types.
see 5.4 ISO15693 transponder.
REQUEST-PAYLOAD
1 1 1
0x2A MODE (UID)
RESPONSE-PAYLOAD
1 1 1
0x2A STATUS ISO-ERROR
COMMAND [0x2A] Lock DSFID 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b001 = Addressed
b010 = Selected
(UID) 1
mode.



4.5.8 [0x2B] Get System Information

This command reads the system information from one transponder.
REQUEST-PAYLOAD
1 1 8
0x2B MODE UID
RESPONSE-PAYLOAD
1 1 1
0x2B STATUS = 0x95 ISO-ERROR
RESPONSE-PAYLOAD Ext. Adr. = 0

1 1 1 8 1 2 1
0x2B STATUS DSFID UID AFI MEM-SIZE IC-REF
RESPONSE-PAYLOAD Ext. Adr. = 1

1 1 1 or 2 1 8 1 3 1
INFO-
0x2B STATUS DSDID UID AFI Ext. MEM-SIZE IC-REF
FLAG
1 1 1 (X)
CL-LEN CL CS-LEN CSI
COMMAND [0x2B] Get System Information 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 EXT-ADR 0 0 ADR
ADR
MODE b000 = Non addressed 1
b001 = Addressed
b010 = Selected
EXT-ADR
Defines the command type.
b0 = Standard Get System Information
b1 = Extended Get System Information
UID Read-only UID of the transponder. The UID is required only in the addressed mode. 8

Command [0x2B] Get System Information 1

ISO15693 error code of transponder response. This byte is only available if STATUS =
ISO-
0x95. 1
ERROR
see 5.4 ISO15693 transponder
Details RESPONSE-DATA (EXT-ADR = 0)

UID 8
mode.
AFI Application family identifier. If not supported by the transponder, this value will return 0x00 1
(if EX-ADR = 0)
Memory size of the transponder. If not supported by the transponder, this value will return
0x0000.
Byte 1 1
Bit 7... 5 4... 0 7... 0
content res. Block size in Bytes Number of blocks
MEM-SIZE 2
MEM-SIZE
(if EX-ADR = 1)
Memory size of the transponder. If not supported by the transponder, this value will return
0x000000.
Bytes 1 2
Bit: 7...6 5...0 15...0
Block size
content res. Number of blocks
in Bytes
IC reference (version) of the transponder. If not supported by the transponder, this value
IC-REF 1
will return 0x00.

Details RESPONSE-DATA (EXT-ADR = 1)

(Only for EXT-ADR = 1)
Response information flag.
Bit Flag Name Description

0: DSFID Parameter is not present
0 DSFID
1: DSFID Parameter is present
0: AFI Parameter is not present
1 AFI
1: AFI Parameter is present
VICC memory 0: Data Parameter on VICC memory size is not present
2
size 1: Data Parameter on VICC memory size is present
INFO-FLAG 0: Information on IC reference Parameter is not present 1or2

3 IC reference
1: Information on IC reference Parameter is present
0: 1 byte addressing
4 MOI
1: 2 byte addressing
VICC 0: Data Parameter of all supported commands is not present
5
Command list 1: Data Parameter of all supported commands is present
0: CSI list is not present
6 CSI Information
1: CSI list is present
Extended Get
System Info 0: One byte length of Info flag Parameter
7
parameter 1: Two byte length of Info flag Parameter
Parameter
UID Read only serial number of the transponder 8
AFI Application Family Identifier. If not supported by the transponder, this value will return 0x00 1
EXT-MEM-
3
SIZE
IC reference (version) of the transponder. If not supported by the transponder, this value will
IC-REF 1
return 0x00
(Only for EX-ADR = 1)
CL-LEN 1
Number of bytes for the Command List. Minimum is 4 Byte


Command List
Bytes x
content CL Byte 1 CL Byte 2 CL Byte 3 CL Byte 4 CL Byte …
CL Byte 1:
Bit Meaning Comment
0 Read single block is supported
1 Write single block is supported
2 Lock single block is supported
3 Read multiple block is supported
4 Write multiple block is supported
CL 5 Select is supported Including Select state 1
6 Reset to Ready is supported
Get multiple block security status is

7
supported
CL Byte 2
Bit Meaning Comment
0 Write AFI is supported
1 Lock AFI is supported
2 Write DSFID is supported
3 Lock DSFID is supported
4 Get System Information is supported
5 Custom commands are supported
6 RFU 0 shall be returned

CL Byte 3
Bit Meaning Comment
0 Extended read single block is supported
1 Extended write single block is supported

2 Extended lock single block is supported
3 Extended read multiple block is supported

4 Extended write multiple block is supported
Extended Get Multiple Security Status is
5
supported
CL 1
CL Byte 4
Bit Meaning Comment
Means Response Buffer is
0 Read Buffer is supported
supported
Means VCD or Mutual
1 Select Secure State is supported
authentication are supported
Means that flag b3 will be set in

2 Final Response always includes crypto result
the Final response
3 AuthComm crypto format is supported
4 SecureComm crypto format is supported
5 KeyUpdate is supported
6 Challenge is supported
7 If set to 1 a further Byte is transmitted 0 shall be returned

CS-LEN Number of supported CS supported. 1
If Response information flag CSI Information is not set CS-LEN will be set to 0.
(Only for EX-ADR = 1, if CS-LEN not 0)
CSI (x)
Supported Crypto Suite identifiers

4.5.9 [0x2C] Get Multiple Block Security Status

This command reads the public block security status from one transponder.
REQUEST-PAYLOAD
1 1 8 1 1 or 2 1
0x2C MODE (UID) (BANK) DB-ADR DB-N
RESPONSE-PAYLOAD
1 1 1 1
SEC-
0x2C STATUS = 00 DB-N
STATUS
RESPONSE-PAYLOAD
1 1 1
ISO-
0x2C STATUS = 0x95
ERROR
COMMAND 0x2C Get Multiple Block Security Status 1
Bit 7 6 5 4 3 2 1 0
ADR
MODE b000 = Non-addressed 1
b001 = Addressed
b010 = Selected
EXT_ADR:
b0 = transponder memory addressing is done by 1 byte DB-ADR Parameter.
b1 = transponder memory addressing is done by BANK and 2 byte DB ADR Parameter.
(UID) 8
mode.
Bit 7 6 5 4 3 2 1 0
(BANK) BANK_NR: 1
Defines the memory area on the transponder:
b00 = Reserved
b01 = Reserved
b10 = Reserved
First block number from which security status is requested. First block number can be any
DB-ADR 1 or 2
value between 0 and 255 or 0 and 65535.

Number of Security data blocks to be read from the transponder, starting at DB-ADR.
DB-N 1
The maximum number of DB-N is 250.

COMMAND [0x2C] Get Multiple Block Security Status 1
Number of Security data blocks to be read from the transponder, starting at DB-ADR.
DB-N 1
The maximum number of DB-N is 250.
SEC- Block security status.
1
STATUS Repeated DB-N times

COMMAND [0x2C] Get Multiple Block Security Status 1
4.5.10 [0x35] Authenticate (ICode DNA)
REQUEST-PAYLOAD
UID_LNG
1 1 1 1 1
Byte
0x35 MODE UID_LNG (UID) AUTH_MODE CSI
1 2 2 n-Byte
CRYPTO_TIME RSP_LEN MSG_LEN MSG
RESPONSE-PAYLOAD (STATUS = 0x00) for Key management in the Host system

1 1 2 9…(9+DATA_LEN/8)
CRYPTOGRAPHIC
0x35 STATUS = 0x00 DATA_LEN
RESPONSE
RESPONSE-PAYLOAD (STATUS = 0x00) for Key management in the reader

1 1 2 1+DATA_LEN
0x35 STATUS = 0x90 DATA_LEN DATA


1 1 2 1
0x35 STATUS = 0x95 DATA_LEN TAG ERROR
COMMAND [0x35] Authenticate (ICode DNA) 1
Bit 7 6 5 4 3 2 1 0
Function UID_LF ADR
ADR
b001 = Addressed
b010 = Selected
MODE 1
UID_LF
b0 = The protocol UID_LNG doesn't include the UID_LNG byte and the UID Parameter
has a
fixed length of 8 byte, from byte 6 to byte 13.
b1 = The protocol includes the parameter UID_LNG. The UID has a variable length as
defined in UID_LNG.
Is an optional parameter and depends on the setting of UID_LF. UID_LNG de-fines the
UID_LNG 1
length of the following UID Parameter.
Read-only serial number of the transponder. The UID is required only in the addressed UID_LNG
(UID)
mode. Byte


Defines the format of the request and the response
Bit 7 6 5 4 3 2 1 0
KEY-
Function RSP_LEN_FLAG CRYPTO_FLAG
LOC
KEY-LOC
Defines the key store
b0 = Keys are stored in the reader. Authentication of the transponder is done by the
reader
b1 = Keys are stored in the host system. Authentication of the transponder is done by the
AUTH_MODE host system 1
CRYPTO_FLAG:
If CRYPTO FLAG is set the protocol contains the crypto exexcution time.
b0 = No crypto execution time in protocol
b1 = Crypto execution time in protocol.
RSP_LEN_FLAG:
If RSP_LEN FLAG is set the protocol contains the length of the response in bits
b0 = 2 Byte for RSP_LEN in protocol
b1 = No RSP_LEN in protocol.
Crypto Suite Identifier

CSI Part Crypto Suite
0x00 ISO/IEC 29167 - 10 AES128
0x01 ISO/IEC 29167 – 11 PRESENT 80
0x02 ISO/IEC 29167 – 12 ECC-DH
0x03 ISO/IEC 29167 - 13 GRAIN 128
CSI 0x04 ISO/IEC 29167 – 14 AES128-OFB 1
0x05 ISO/IEC 29167 – 15 XOR

0x06 ISO/IEC 29167 – 16 ECSDA-ECDH
0x07 ISO/IEC 29167 - 17 GPS
0x08 ISO/IEC 29167 – 18 Humming Bird 2
0x09 ISO/IEC 29167 - 19 RAMON
CRYPTO_
crypto execution time in ms. (Not applicable for ICODE-DNA) 1
TIME
RSP_LEN Length of the response in bits. (Not applicable for ICODE-DNA) 2
MSG_LEN Length of the message in bytes 2
MSG Message defined by the crypto suite specified by the CSI n-Byte


TAG ERROR 1
Details RESPONSE-DATA (STATUS = 0x00) for Key management in the Host system
DATA_LEN Number of bits 2
CRYPTOGRAPHIC
1+DATA_LEN
RESPONSE
Details RESPONSE-DATA (STATUS = 0x00) for Key management in the reader

DATA Requested decrypted data 1+DATA_LEN
4.5.10.1 Message TAM1
REQUEST-PAYLOAD (MSG)
1 1 10
MSG_CMD KEY_ID CHALLENGE
Details REQUEST DATA

Defines authent methode and custom data
Bit 7 6 5 4 3 2 1 0
Function AuthMethode Custom Data TAM1_RFU
Default 00 0 0000
MSG_CMD AuthMethod: 1
00b Specifies the use of TAM
CustomData:
0b = Indicate that no custom data is requested (TAM1)
TAM1_RFU:
00000b = Reserved


Defines which Key is used for TAM1
Bit 7 6 5 4 3 2 1 0
Function KEY-TYPE
KEY_ID 1
KEY-TYPE:
0x00 = Key 0 is used
Random integrator challenge, only necessary when authentication is done by the host
CHALLENGE 10
system
4.5.10.2 Message MAM1 (KEY-LOC = b1)
1 1 10
MSG_CMD KEY_ID CHALLENGE

Bit 7 6 5 4 3 2 1 0
Function AuthMethode Custom Data MAM1_RFU
Default 00 0 0000
MSG_CMD AuthMethod: 1
10b = Specifies the use of mutual authentication
Step
00b = Indicates the step of the mutual authentification (MAM1)
MAM1_RFU:
00000b = Reserved
Bit 7 6 5 4 3 2 1 0
Function KEY-TYPE
KEY_ID 1
KEY-TYPE:

Random integrator challenge, only necessary when authentication is done by the host 10
CHALLENGE
system
4.5.10.3 Message MAM1 (KEY-LOC = b0)
1 1 1
MSG_CMD KEY_ID PURPOSE_MAM2

Bit 7 6 5 4 3 2 1 0
Function AuthMethode Custom Data MAM1_RFU
Default 00 0 0000
MSG_CMD AuthMethod 1
10b = Specifies the use of Mutual Authentication
Step
MAM1_RFU
00000b = Reserved
Bit 7 6 5 4 3 2 1 0
Function KEY-TYPE
KEY_ID 1
KEY-TYPE
Vendorspecific authent methods, only necessary when authentication is done by the
reader. The reader sends the MAM2-message automaticly after the MAM1 response
from the transponder.
b0000 = Standard mutual authentification.
PURPOSE_MAM2 1
b1000 = Disable privacy until HF-Reset (ICODE DNA).
b1001 = Enable privacy (ICODE DNA).
b1010 = Disable privacy (ICODE DNA).
b1011 = Destroy (ICODE DNA).

4.5.10.4 Message MAM2
REQUEST-PAYLOAD
1 1 n (16)
MSG_CMD KEY_ID IRESPONSE
Details REQUEST DATA (MSG)

Message MAM2 format if KEY-LOC = b1
Bit 7 6 5 4 3 2 1 0
Default 00 0 0000
AuthMethod
10b = Specifies the use of Mutual Authentication
MSG_CMD Step: 1
MAM2_RFU
b0000 = Standard mutual authentification.
b1000 = Disable privacy until HF-Reset (ICODE DNA).
b1001 = Enable privacy (ICODE DNA).
b1010 = Disable privacy (ICODE DNA).
b1011 = Destroy (ICODE DNA).
Bit 7 6 5 4 3 2 1 0
Function KEY-TYPE
KEY_ID 1
KEY-TYPE
Only necessary when authentication is done by the host.
IRESPONSE n (16)
This is encrypted Message for the transponder, to authenticate the host

4.5.11 [0x39] Challenge (ICode DNA)

This command allows an interrogator to instruct multiple tags to simultaneously yet independently
precompute and store a cryptographic value.
No response is sent from tag on a challenge command.
REQUEST-PAYLOAD
1 1 1 UID_LNG Byte 1 1
1 2 2 n
CRYPTO_TIME RSP_LEN MSG_LEN MSG
COMMAND [0x39] Challenge (ICode DNA) 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 UID_LF 0 ADR
ADR:
b001 = Addressed
b010 = Selected
MODE EXT_ADR 1
b0 = transponder memory addressing is done by 1 byte DB-ADR Parameter.
b1 = transponder memory addressing is done by BANK and 2 byte DB ADR Parameter.
UID_LF
b0 = The protocol UID_LNG doesn't include the UID_LNG byte and the UID Parameter has
a fixed length of 8 byte, from byte 6 to byte 13.
b1 = The protocol includes the parameter UID_LNG. The UID has a variable length as
defined in UID_LNG.
Is an optional parameter and depends on the setting of UID_LF (see MODE). UID_LNG
UID_LNG 1
defines the length of the following UID Parameter.
mode.
UID_LNG
(UID)
 NOTE: Bytes
NXP ICODE DNA supports only non addressed mode.


Defines the format of the request and the response
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 RSP_LEN_FLAG CRYPTO_FLAG 0 0
CRYPTO_FLAG
If CRYPTO FLAG is set the protocol contains the crypto execution time.
AUTH_MODE b0 = No crypto execution time in protocol 1
b1 = Crypto execution time in protocol.
RSP_LEN_FLAG
If RSP_LEN FLAG is set the protocol contains the length of the response in bits
b0 = 2 Byte for RSP_LEN in protocol
b1 = No RSP_LEN in protocol.
Crypto Suite Identifier

CSI Part Crypto Suite
0x00 ISO/IEC 29167 - 10 AES128
0x01 ISO/IEC 29167 – 11 PRESENT 80
0x02 ISO/IEC 29167 – 12 ECC-DH

0x03 ISO/IEC 29167 - 13 GRAIN 128
CSI 1
0x04 ISO/IEC 29167 – 14 AES128-OFB
0x05 ISO/IEC 29167 – 15 XOR
0x06 ISO/IEC 29167 – 16 ECSDA-ECDH
0x07 ISO/IEC 29167 - 17 GPS
0x08 ISO/IEC 29167 – 18 Humming Bird 2
0x09 ISO/IEC 29167 - 19 RAMON
CRYPTO-
crypto execution time in ms. (for ICODE-DNA the Crypto_TIME = 20 ms). 1
TIME
RSP_LEN Length of the response in bits (For ICODE-DNA the response is 0 bit). 2
MSG_LEN Length of the message in bytes 2
MSG Message defined by the crypto suite specified by the CSI. n

4.5.11.1 Message TAM1 (MSG)

Send Interrogator challenge and request Tag authentication response.
REQUEST-PAYLOAD
1 1 1 UID_LNG Byte 1 1
Details REQUEST-DATA (MSG)

Bit 7 6 5 4 3 2 1 0
Default 00 0 0000
AuthMethod
MSG_CMD 00b = Specifies the use of TAM 1
CustomData
0b = Indicate that no custom data is requested (TAM1)
TAM1_RFU
00000b = Reserved
Bit 7 6 5 4 3 2 1 0
Function KEY-TYPE
KEY_ID 1
KEY-TYPE
CHALLENGE 80-bit random challenge that the Interrogator has generated for use in TAM1. 10

4.5.12 [0x3A] ReadBuffer (ICode DNA)

This command allows to read data stored in a tag response buffer.
COMMAND [0x3A] READBuffer (ICode DNA) 1
Bit 7 6 5 4 3 2 1 0
Function UID_LF ADR
ADR
b000 = Non-addressed
b001 = Addressed
MODE b010 = Selected 1
UID_LF
If this bit is set the parameter UID_LNG must inserted into the protocol.
Parameter has a fixed length of 8 byte, from byte 6 to byte 13.
b1 = The protocol includes the parameter UID_LNG. The UID has a variable length
as defined in UID_LNG.
Is an optional parameter and depends on the setting of UID_LF. UID_LNG defines
UID_LNG 1
the length of the following UID Parameter.
(UID) UID_LNG Byte
addressed mode.

ISO ERROR 1

DATA Requested decrypted data 9…(9+DATA_LEN/8)

4.6 [0xB0] ISO 14443 Standard Host Commands
4.6.1 [0xC0] Halt - ISO 14443-3 transponder

This command sets one ISO14443-3 transponder into the Halt State.
The supported ISO Host commands depends on the different transponder types.
5. Supported Host Commands
REQUEST-PAYLOAD
1 1
(0xB0) MODE
REQUEST-DATA
COMMAND 0xB0 ISO 14443 Standard Host Commands 1
Bit 7 6 5 4 3 2 1 0
Function ADR
ADR
MODE b010 = selected 1
 NOTE:
The reader response is always "OK" independent if the transponder is further

one in the detection Parameter of the reader or not.

4.7 [0xB2] ISO14443 Special Host Commands

The [0xB2] commands are supposed to send special ISO14443 defined commands and proprietary
ISO14443 RF commands to the transponder.
REQUEST-PAYLOAD
0xB2 SUB-COMMAND PARAMETER
RESPONSE-PAYLOAD
1 1 n
RESPONSE-
0xB2 STATUS
DATA
REQUEST-DATA
COMMAND [0xB2] ISO14443 Special Host Commands 1
Command specific request with variable length. More details are described in the next
SUB-COMMAND 1
chapters.
PARAMETER with variable length. More details are described in the next chapters. n
RESPONSE-DATA
COMMAND [0xB2] ISO14443 Special Host Commands 1
RESPONSE- Command specific response with variable length. More details are described in the next
n
DATA chapters.
 Note:
This command is only available in Host mode

4.7.1 [0x2B] ISO14443-4 transponder-Info

This command could be helpful to get further information's about the capabilities of the present ISO14443-4
transponder. The included information is transferred from the transponder.
 NOTE:
This command could be used only after the transponder was selected. 4.4.2[0x25] Select
REQUEST-PAYLOAD
1
0x2B
RESPONSE-PAYLOAD
1 1 1 1 1 1 1
0x2B FSCI FWI DSI DRI NAD CID
COMMAND [0x2B] ISO14443-4 transponder-Info 1
COMMAND [0x2B9 ISO14443-4 transponder-Info 1
transponder Frame-Size
FSCI FSCI 0 1 2 3 4 5 6 7 8 9..255 1

Bytes 16 24 32 40 48 64 96 128 256 RFU
Frame Waiting Time Integer of the transponder.

FWI 1
Frame Waiting Time (FWT) = 302µsec * 2FWI (FWImax = 14 → 4949 ms)
(Divisor send Integer):
Displays the present supported data transfer rate from reader to transponder.
DSI 1
DSI b00 b01 b10 b11
kbit/s 106 212 424 847
(Divisor receive Integer):

Displays the present supported data transfer rate from transponder to reader.
DRI 1
DSI b00 b01 b10 b11
kbit/s 106 212 424 847
NAD b1 = NAD (Node Address) supported, if bit is set to 1. 1

CID b1 = CID (Card Identifier) supported, if bit is set to 1. 1

4.7.2 [0x30] Mifare Value Commands

This command provides the Mifare value functions INCREMENT, DECREMENT, TRANSFER and
RESTORE of a value formated Mifare sector block. The command returns an error if the block is not in value
block format (details about the Mifare value block format are described in Mifare standard data sheet
provided by NXP). The command loads the value from a source address (FirstDataBlock), operates the
value function and stores the result at the destination address (DEST_ADR).
 NOTE:
A previous authentification is needed to process the command. 4.7.3[0xB0] Authent Mifare classic
REQUEST-PAYLOAD
1 1 1 1
0x30 MODE MF_CMD FirstDataBlock
REQUEST-DATA
COMMAND [0x30] Mifare Value Commands 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR
b010 = Selected
This parameter defines the value operation which shall be operated on the Mifare
transponder.
0x01 = INCREMENT
Adds the value OP_VALUE to the value specified by address FirstDataBlock.
0x02 = DECREMENT
MF_CMD Subtracts the value OP_VALUE from the value specified by address 1
FirstDataBlocks.
0x03 = COPY
Transfers the value structure from address FirstDataBlock to address
DESTIN_ADR
without changing the value.
Source Mifare block address of the value formatted data. A formula to calculate
FirstDataBlock could be found in 0
[0x24] Write Multiple Blocks 1k, 4k / mifare plus

NoOfDataBlocks 1
 NOTE:
The specified Mifare block must have been formatted as a Mifare value block.


This parameter contains the 32 bit value which shall be calculated with the value at
FirstDataBlock.
OP_VALUE
4
MSB …LSB  NOTE:
In case of the COPY function the content of OP_VALUE has no effect.
Destination address where the result of the value operation shall be stored.
DEST_ADR  NOTE: 1
DEST_ADR and FirstDataBlock must be in the same Mifare sector.
Example:
Formatting of Mifare Sector 2, Block 1 in Mifare value block format with
Value = 2 and Adr = 5 by using the command [0x24] Write Multiple Blocks.
1 1 1 16
mifare Byte: 15 14 13 12 11 10 9 8 7654 3210
FirstDataBlock DB-N DB-SIZE DB
Value Value Value
Adr. Adr. Adr. Adr.
0x09 0x01 0x10 0x00000 0xFFFFF 0x00000
0xFA 0x05 0xFA 0x05
002 FFD 002
 NOTE:
Make sure that the access conditions in the Mifare Sector Trailer for this block are also configured as value
block.
Formatting of Mifare Sector Trailer by using the command [0x24] Write Multiple Blocks
1 1 1 16
mifare Byte: 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
FirstDataBlock DB-N DB-SIZE Key A Access Bits Key B
0x0B 0x01 0x10 0xFFFFFFFFFFFF 0x69 8F 77 08 0xFFFFFFFFFFFF
Increment Value at Mifare Sector 2, Block 1 with OP_VALUE = 3

1 1 4 1
MF_CMD FirstDataBlock OP_VALUE DEST_ADR
0x01 0x09 0x00000003 0x05
 NOTE:
Authentificate with Key-B (0xFF FF FF FF FF FF) for value commands on sector 2 or change the according
access bits in the corresponding sector trailer!
5.2.3 NXP - Mifare classic: mini, 1k, 4k / mifare plus (Level 1)

4.7.3 [0xB0] Authent Mifare classic

Before access is given to the data stored in the memory of a mifare classic transponder, the user has to
prove his permission for the requested operation. Depending on the MODE.KL bit this com-mand offers to
possibilities for key handling. It is possible to use a key which is stored in the readers EEPROM see M 4.1.11
[0xA2] Write Mifare Reader Keys or a temporary key can be transferred within the request data.
REQUEST-PAYLOAD
1 1 1 1 1
0xB0 MODE FirstDataBlock KEY-TYPE KEY-ADR
case MODE = bxxxx 0010

COMMAND [0xB0] Authent Mifare classic 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 KL ADR
ADR
b010 = Selected
MODE 1
KL
This bit indicates the key location
b0 = EEPROM Key, defined by KEY-TYPE and KEY-ADR is used for authentication
process.
b1 = KEY-TYPE and temporary KEY which are transferred within the request data are
used for authentication process.
Address of the first data block on which an access is requested.
 NOTE:
The Reader uses a linear addressing mode. For calculating the block address
FirstDataBlock 1
(FirstDataBlock) the expected mifare Sector and the mifare Block in this sector
must be known. A formula to calculate FirstDataBlock could be found in see
4.1.11 [0xA2] Write Mifare Reader Keys. An authentication to one mifare Block
inside a sector has effect to the whole sector.

KEY-TYPE 0x00 = KEY A 1
0x01 = KEY B
EEPROM Address (0x00 ... 0x0F) where the key is stored in the Reader
KEY-ADR 1
see 4.1.11 [0xA2] Write Mifare Reader Keys.

case MODE = bxxxx 1010

COMMAND [0xB0] Authent Mifare classic 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 KL ADR
ADR
b010 = Selected
MODE 1
KL
This bit indicates the key location
b0 = EEPROM Key, defined by KEY-TYPE and KEY-ADR is used for
authentication process.
b1 = KEY-TYPE and temporary KEY which are transferred within the
request data are used for authentication process.
Address of the first data block on which an access is requested.
 NOTE:
• The Reader uses a linear addressing mode. For calculating the block
FirstDataBlock address (FirstDataBlock) the expected mifare Sector and the mifare Block 1
in this sector must be known. A formula to calculate FirstDataBlock could
be found in see 4.1.11.[0xA2] Write Mifare Reader Keys.
• An authentication to one mifare Block inside a sector has effect to the whole
sector.
KEY-TYPE 0x00: KEY A 1
0x01 KEY B
KEY 6 byte Mifare Key which shall used for the current authentication process. 6

4.7.4 [0xB2] Authent Mifare Ultralight C

Before access is given to the data stored in the secured memory of a mifare ultralight C transponder, the
user has to prove his permission for the requested operation. The key for authentication used by the reader
can be stored into the readers EEPROM or RAM.
The complete description can be found in the separate manual: H01110.pdf
(“Manual SoftCrypto Functions”).
REQUEST-PAYLOAD
1 1 1
[0xB2] MODE READER KEY-NDX
Field Description / Value Length
COMMAND 0xB2 Authent Mifare C 1
Bit 7 6 5 4 3 2 1 0
Function ADR
MODE 1
ADR:
b010 = Select
Index of the key which is stored in the reader and which shall be used for
authentication for the current command.
READER-KEY-
1
NDX (0...3)  NOTE:
Only keys with AUTH-MODE = 1 can be used for mifare Ultralight C.

4.7.5 [0xBB] ISO 14443-B (Innovatron) Data Exchange

This command provides the data exchange between a host and the transponder on
ISO 14443-B’ (Innovatron) layer. It is special designed for easy APDU data exchange.
 NOTE:
The maximum buffer size of the Reader for data exchange has to be considered and can be determined with
command [0x66], Mode = 0x00.
REQUEST-PAYLOAD
1 1 n
0xBB MODE (DATA)
RESPONSE-PAYLOAD
1 1 n
0xBB STATUS (DATA)
COMMAND [0xBB] ISO 14443-B’ (Innovatron) Data Exchange 1
Bit 7 6 5 4 3 2 1 0
Function DISC
MODE DISC 1
b0 = DISCONNECT
Sends the command "DISCONNECT" to the present transponder.
b1 = APDU
Instructs the Reader to send the APDU which is included in the DATA Block to the
transponder.
(DATA) ISO7816 format for commands: CLA/INS/P1/P2/P3/DataIn n

COMMAND [0xBB] ISO 14443-B’ (Innovatron) Data Exchange 1
(DATA) ISO7816 format for commands: CLA/INS/P1/P2/P3/DataIn n

4.7.6 [0xBE] ISO 14443-4 T=CL

This command provides the data exchange between a host and the transponder on ISO 14443-4 layer. It is
special designed for easy APDU data exchange.
 NOTE:
The maximum buffer size of the reader for data exchange must be considered and can be determined with
command [0x66], Mode = 0x00.
REQUEST-PAYLOAD
1 1 (n)
[0xBE] MODE (PARAMETER)
RESPONSE-PAYLOAD
1 1 (1) (n)
[0xBE] STATUS (PSTAT) depends on PSTAT
COMMAND [0xBE] ISO 14443-4 T=CL 1
MODE Bit: 7 6 5 4 3 2 1 0
Function FIRST MORE PING NAD_E CID_E INF

MODE bit setting rules

DATA
MODE
(1) (1) (X)
b1000 0001 (INF) APDU without CID or NAD (single block)

APDU without CID or NAD (first chained
b1100 0001 (INF)
block)
APDU without CID or NAD (further chained
b0100 0001 (INF)
block)
APDU without CID or NAD (last chained
b0000 0001 (INF)
block)
b1000 0011 CID (INF) APDU with CID (single block)
MODE b1100 0011 CID (INF) APDU with CID (first chained block) 1
b1000 0101 NAD (INF) APDU with NAD (single block)
b1100 0101 NAD (INF) APDU with NAD (first chained block)
b1000 0111 CID NAD (INF) APDU with CID and NAD (single block)
b1100 0111 CID NAD (INF) APDU with CID and NAD (first chained block)
b1000 0000 - DESLECT without CID or NAD
b1000 0010 CID - DESLECT with CID
b1000 100x - PING without CID or NAD
b1000 101x CID - PING with CID

INF
b0 = DESELECT
Sends the S-block command "DESELECT" to the present transponder.
b1 = APDU
Instructs the Reader to send the INF Block (APDU) which is included in the DATA Block to
the transponder.
CID_E
MODE 1
b0 = The DATA Block includes no CID
b1 = The DATA Block includes an optional 1 byte CID Parameter.
The CID has to be placed in DATA directly behind the MODE Parameter
 NOTE:
In case of command chaining (see Bit "MORE") only the CID in the first com-mand
block is accepted by the Reader.


NAD_E
b0 = The DATA Block includes no NAD
b1 = The DATA Block includes an optional 1 byte NAD parameter.
The NAD parameter is only supported in conjunction with INF = b1
 NOTE:
In case of command chaining (see Bit "MORE") only the NAD in the first command
block is accepted by the Reader.
PING
By means of this bit a presence check to the current transponder can be operated by the host.
The response includes only a status message.
b0 = PING will not be operated
b1 = PING will be operated by the reader.
 NOTE:
PING is an exclusive function and can not combine with an APDU command. It can
use with or without CID.
MORE
By means of this bit a data chaining from the host to the Reader can realized if the number of
data bytes which shall send exceeds the receive buffer size of the reader.
b0 = No downlink chaining (Host → Reader)
The present protocol block includes the complete command.
b1 = Downlink chaining (Host → Reader)
The present protocol block includes not the complete command. After the reader has
acknowledged the protocol block the host can send further parts of the command.

 NOTE:
• If an error status is responded by the Reader the downlink chaining should

stopped by the host.
• If a MORE status (0x94) is responded by the Reader the host have to handle this
message.
Protocol examples for error-free operation with 3 blocks and 1 MORE response
DATA
MODE:
(CID), (NAD), INF Host  Reader (1. protocol block)
b11xx 0xx1
STATUS: 0x94
Host  Reader
(MORE)
STATUS: 0x00
Host  Reader
(OK)
b01xx 0001 INF Host  Reader (2. protocol block)
STATUS:
Host  Reader
0x00 (OK)
MODE b00xx 0001 INF Host  Reader (last protocol block) 1
STATUS:
Host  Reader
0x00 (OK)
FIRST
This bit indicates the first protocol of a new command. It is necessary for single commands and
chained commands.
b0 = The present protocol block is the second or further part of a chained command.
b1 = The present protocol block is a single command or the first part of a chained command.
DATA
The DATA Parameter could be used to transfer the optional CID, NAD and INF Parameter of
the ISO14443-4 communication protocol. In most cases the INF Parameter carries an APDU to
the transponder.
STATUS
0x00 = OK
This status shows that APDU exchange is completed.

PSTAT and BLK_CNT has to be evaluated
0x94 MORE
This status shows that further exchange cycles has to be executed.
PSTAT and BLK_CNT has to be evaluated

 NOTE:
In case of STATUS = 0x94 the host must continue its receiving procedure without sending any
further request, because the reader transmits further response data later.
0x96 ISO14443-ERROR:
This status shows that an additional ISO14443-ERROR has to be evaluated
RESPONSE-DATA
MODE 1 1
ISO14443-ERROR
ISO14443-ERROR
Additional error code if STATUS = 0x96. see 10 ANNEX C2: Error-Codes
Other
PSTAT and BLK_CNT should not be evaluated. This response indicates that the present
command could not be finished, because of transmission errors.
8 ANNEX C: Index of Status Bytes
(PARAMETER) n
COMMAND [0xBE] ISO 14443-4 T=CL 1
This parameter represents the processing status of the present command. PSTAT
must be evaluated in conjunction with the STATUS byte of the Reader response.
Depending on PSTAT and STATUS the response data of the Reader are different.
0x01 = WTXM
This response is given by the Reader if the transponder needs more time than de-fined
in parameter TR-RESPONSE-TIME to proceed the present command.
After receiving this response the host shall align his receive timeout to a value greater
than indicated by WTXM.
RESPONSE-DATA
1 2 1 1
PSTAT
BLK_CNT WTXM FWI
0x01

WTXM and FWI

refer to ISO 14443-4
The minimum receive timeout could calculated by the following formula:
TIMEOUT = 302µsec * 2FWI * WTXM
WTXM: 1...59
FWI: 0...14
0x02 = INF
This response is given by the Reader if the protocol includes data from the
transponder.
RESPONSE-DATA
1 2 X
PSTAT
BLK_CNT APDU-RESPONSE
0x02
(PSTAT) 1
APDU-RESPONSE
Response to the APDU from the transponder (if any).
0xFF = BUSY
This response is given by the Reader to retrigger the receive timeout of the host. This
response could occur if an error in data exchange between transponder and reader
had happened and the reader retries the process by itself.
RESPONSE-DATA
1 2
PSTAT
BLK_CNT
0xFF
The BLK_CNT is a block counter which indexes each transmission from the reader to
(BLK_CNT) the host. On basis of the BLK_CNT the host could proof and sort the received 2
protocols.

4.8 [0xC1] / [0xC3] Host Commands for mifare DESFire Communication

Mifare DESFire can be operated on APDU command level or with high level commands, implemented in
firmware.
5.1.1Mifare DESFire
4.9 [0xC2] ISO Host Commands for Mifare Plus Communication

Security Level 0, 2 and 3
Mifare Plus in Security Level 0, 2 and 3 can be operated on APDU command level or with high level
commands, implemented in firmware.
5.1.2NXP - Mifare Plus (Security Level 0, 2, 3)
Security Level 1
Mifare Plus in Security Level 1 can be operated with commands for mifare classic.

4.10 [0xB3] ISO18000-3M3 Standard Host Commands
4.10.1 [0x18] Kill

This command will kill an ISO18000-3M3 transponder.
REQUEST-PAYLOAD
1 1 1 EPC_LNG 1 K_PW_LNG 1
0xB3 MODE (EPC_LNG) EPC K_PW_LNG K_PW RECOM_BITS
RESPONSE-PAYLOAD (STATUS = 0=95)

1 1 1
0xB3 STATUS EPC-ERROR
COMMAND [0x18] Kill 1
Bit 7 6 5 4 3 2 1 0
Function EPC_LF RECOM ADR
ADR
b001 = Addressed
MODE 1
EXT-ADR
If this bit is set the parameter EPC_LNG must insert into the protocol.
b1 = The protocol includes the parameter EPC_LNG. The EPC has a
variable length as defined in EPC_LNG.
RECOM
b1 = If this bit is set the Recommissioning Bits will be inserted into the
protocol.
Is an optional parameter, it depends on the setting of EPC_LF (see MODE).
(EPC_LNG) 1
EPC_LNG defines the length of the following EPC Parameter.
EPC EPC of the transponder. The EPC is required only in the addressed mode. EPC_LNG
K_PW_LNG Length of Kill Password (4 byte). 1
K_PW Kill Password K_PW_LNG
Recommissioning Bits according to EPC Global description.
Bit 7 6 5 4 3 2 1 0
RECOM_BITS Asserted 1
Function
3SB 2SB LSB


COMMAND [0x18] Kill 1
EPC-ERROR Additional error code if STATUS = 0x95. 1
4.10.2 [0xB3] [0x22] Lock

This command locks different memory portions of an ISO18000-3M3 transponder.
REQUEST-PAYLOAD
1 1 1 (1) (EPC_LNG)
0xB3 0x22 MODE (EPC_LNG) (EPC)
1 LOCK_LNG 1 A_PW_LNG
LOCK_LNG LOCK_DATA A_PW_LNG A_PW
RESPONSE-PAYLOAD
1 1 1
0xB3 0x22 STATUS
COMMAND [0xB3] [0x22] Lock
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 EPC_LF 0 ADR
ADR
MODE
b001 = Addressed
EPC_LF
b1 = The protocol includes the parameter EPC_LNG. The EPC has a
variable length as defined in EPC_LNG.
Is an optional parameter and depends on the setting of EPC_LF.
(EPC_LNG)
EPC_LNG defines the length of the following EPC Parameter.
EPC Read-only serial number of the transponder. The EPC is required only in the addressed mode.
Type of transponder according
EPC_TYPE
6 ANNEX A: Codes of Transponder Types
LOCK_LNG Length of LOCK_DATA Parameter ( = 3)

Lock data which will be written to the transponder. Contains the kill code which is written to the
LOCK_DATA
transponder.
A_PW_LNG Length of Access Password (4Byte).
A_PW Access password which is used to access to the secured state of the transponder.
 NOTE:
Lock data length Lock_LNG = 3

COMMAND [0xB3] [0x22] Lock
4.10.3 0xB3] [0x25] Block Permalock

The Command Block Permalock is used to define the memory areas for permanent write protection.
The block size of the permalock section is defined by vendor.
Structure of Permalock command:
Permalocks Block section 2-3
REQUEST-PAYLOAD
1 1 1 EPC_LNG 1
0x25 MODE EPC_LNG EPC BANK
1 A_PW_LNG 2 1 2 x BLOCK_RANGE
A_PW_LNG A_PW BLOCK_PTR BLOCK_RANGE MASK


1 1 1
0x25 STATUS A_PW_LNG TAG ERROR
COMMAND [0x25] Block Permalock
Bit 7 6 5 4 3 2 1 0
Function EPC_LF ADR
ADR
b000 = non-addressed
MODE
b001 = addressed
EPC_LF
b1 = The protocol includes the parameter EPC_LNG. The EPC has a variable length as
defined in EPC_LNG.
EPC_LNG EPC_LNG defines the length of the following EPC field.
Memory bank of the transponder which will be accessed by the Reader.
Bit 7 6 5 4 3 2 1 0
Function A_FLAG BANK_NR
BANK_NR
In case of ISO18000-3M3 transponder BANK_NR is defined as follows:
b11 User memory bank
 NOTE:
BANK
The Block Permalock Command is only applicable for the User memory bank!
A_FLAG
Indicates whether the reader tries to read a ISO18000-3M3 tag in Secured State. If A_FLAG is set the
protocol contains the access password.
A_FLAG
b0 = no access password in protocol
b1 = access password and access password length in protocol. Reader executes access command
A_PW_LNG Length of Access Password.
A_PW Access password which is used to access to the secured state of the Tag.
BLOCK_PTR Specifies the starting address for mask, in units of 16 block sections.

Defines which block sections a tag locks permanently.

The tag interprets each bit as follows:
Mask bit = 0: Retain the current permalock setting
MASK
Mask bit = 1: Locks the corresponding memory block section
The mask bits are ordered from lower- order section to higher
(the leading mask bit refers to the first block section)
 NOTE:
Only Tags in the secured state execute a Block Permalock command.

The User Memory bank for ICODE-ILT is defined in 8 blocks of 4 words each block.
Block Section User Memory address

1 0–3
2 4–7
3 8 – 11
4 12 – 15
5 16 – 19
6 20 – 23
7 24 – 27
8 28 – 31
Example Permalock Block Section 2-3
BLOCK_PTR = 0x0000
BLOCK_RANGE = 0x01
Bit 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Mask 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0
Bit 2 = Block Section 2
Description
Bit 3 = Bock Section 3

4.10.4 [0xB3] [0x26] Read Permalock Status

This command reads the permalock status of the user memory of a ISO18000-3M3 transponder.
REQUEST-PAYLOAD
1 1 1 EPC_LNG 1
0xB3 MODE EPC_LNG EPC BANK
1 A_PW_LNG 2 1
A_PW_LNG A_PW BLOCK_PTR BLOCK_RANGE

1 1 1
0xB3 STATUS TAG ERROR
REQUEST-DATA (STATUS = 0x00)

1 1 12 x Block-Range
0xB3 STATUS PERMALOCK_STATUS
COMMAND [0xB3] Read Permalock Status
Bit 7 6 5 4 3 2 1 0
Function 0x01 EPC_LF ADR
ADR
b000 = non-addressed
MODE
b001 = addressed
EPC_LF
b1 = The protocol includes the parameter EPC_LNG. The EPC has a variable length as
defined in EPC_LNG.
EPC_LNG EPC_LNG defines the length of the following EPC field.


Bit 7 6 5 4 3 2 1 0
Function A_FLAG BANK_NR
BANK_NR
In case of ISO18000-3M3 transponder BANK_NR is defined as follows:
b11 User memory bank
BANK  NOTE:
The Read Permalock Status is only applicable for the User memory bank!
A_FLAG
Indicates whether the reader tries to read a ISO18000-3M3 tag in Secured State. If A_FLAG is set the
protocol contains the access password.
A_FLAG
b0 = no access password in protocol
b1 = access password and access password length in protocol. Reader executes access command
COMMAND [0xB3] Read Permalock Status
A_PW_LNG Length of Access Password.
A_PW Access password which is used to access to the secured state of the Tag.
BLOCK_PTR Specifies the starting address for mask, in units of 16 block sections.
BLOCK_RANGE Specifies the range of mask, starting at BLOCK_PTR and ending (16xBLOCK_RANGE)
Defines which block sections a tag locks permanently.
The tag interprets each bit as follows:
Mask bit = 0: Retain the current permalock setting
MASK
Mask bit = 1: Locks the corresponding memory block section
The mask bits are ordered from lower- order section to higher
(the leading mask bit refers to the first block section)
 NOTE:
Only Tags in the secured state execute a Read Permalock Status command.

Example Permalock Status Block Section 1-2-3
BLOCK_PTR = 0x0000
BLOCK_RANGE = 0x01
Response of permalock Status bits:
Bit 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Mask 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0
Description Bit 2 = Block Section 2
4.11 Special Commands for transponder Communication
4.11.1 [0xB8] FeliCa Transparent Command

This command sends user transparent commands to FeliCa transponder.
REQUEST-PAYLOAD
1 1 2 1 x
RSP- TR-
0xB8 MODE TIMEOUT
LENGTH REQUEST
RESPONSE-PAYLOAD
1 1 x
TR-
0xB8 STATUS
RESPONSE
COMMAND [0xB8] FeliCa Transparent Command
MODE
0 = The reader will send the command but not wait for any response
RSP-Length 0 ≠ The reader will send the command and return the response data of the transponder without
preamble, Sync-Code, Len-Byte and CRC.

The TIMEOUT value defines the time for receiving the whole transponder response. If the TIMEOUT it
exceeded the command will be abort and the status “NO TRANSPONDER” is returned.
Bit 7 6 5 4 3 2 1 0
TMO-
Function Timeout Value
BASE
TIMEOUT TMO-BASE:
b0 = The Timeout can be adjusted in 1ms steps. (0ms ...127ms)
b1 = The Timeout can be adjusted in 100ms steps. (0.1s ...12.7s)
 NOTE:
• The value of TIMEOUT must be considered for calculating the HOST-TIMEOUT.

• The value of TIMEOUT must be considered for calculating the TR-RESPONSE-TIME
transponder request with Len byte and Packet data. If “TxCRCEn” is “1” the reader appended a
calculated CRC (X16+X12+X5+1, Initial-Value = 0x0000) to the date stream. If “TxCRCEn” is “0” the
application should send the CRC within the TR-Request if the CRC is needed.
TR-
REQUEST
 NOTE:
The max. size of Packet data is 256 byte

MODE 1
MODE
RSP-Length 0 ≠ The reader will send the command and return the response data of the transponder
without preamble, Sync-Code, Len-Byte and CRC.
Bit 7 6 5 4 3 2 1 0
TMO-
Function Timeout Value
BASE
TIMEOUT
TMO-BASE:
b0 = The Timeout can be adjusted in 1ms steps. (0ms ...127ms)
b1 = The Timeout can be adjusted in 100ms steps. (0.1s ...12.7s)
 NOTE:

Selects kind and mode of transmission settings.

Bit 7 6 5 4 3 2 1 0
Tx Tx
Function
CRCEn BDR
TxBDR
Tx-
SETTINGS b0 = 212 kBaud
b1 = 424 kBaud
TxCRCEn
b0 = No CRC is inserted
b1 = A CRC is calculated over the transmitted data and the CRC byte(s) are appended to
the data stream.
Bit 7 6 5 4 3 2 1 0
Rx Rx
Function
CRCEn BDR
Rx- RxBDR
SETTINGS b0 = 212 kBaud
b1 = 424 kBaud
RxCRCEn
b0 = No CRC is checked
b1 = The last byte(s) of a received frame is/are interpreted as CRC byte/s

transponder request with Len byte and Packet data. If “TxCRCEn” is “1” the reader appended a
calculated CRC (X16+X12+X5+1, Initial-Value = 0x0000) to the date stream. If “TxCRCEn” is “0” the
application should send the CRC within the TR-Request if the CRC is needed.
TR-
REQUEST
 NOTE:
The max. size of Packet data is 256 byte
TR- Complete transponder response wit with Len byte and Packet data. A CRC check is per-formed inside
RESPONSE the reader if “RxCRCEn” = “1”. However if “RxCRCEn” = “0” the transponder CRC is transferred with
the response data.
 NOTE:
• Data is only transferred if STATUS = 0x00, 0x02, 0x83, 0x84, 0x94.

• The tr response data ever contains the in RSP-LENGTH defined number of data bytes.
4.11.2 [0xB9] Jewel Transparent Command

This command sends user transparent commands to Jewel transponder.
REQUEST-PAYLOAD
1 1 2 1 1 x x 2 x
RSP- Tx- Rx- TR-
0xB9 MODE TIMEOUT CRC-Info REQ-BITS
LENGTH SETTINGS SETTINGS REQUEST
RESPONSE-PAYLOAD
1 1 2 x
TR-
0xB9 STATUS RSP-BITS
RESPONSE
COMMAND [0xB9] Jewel Transparent Command
MODE
RSP-Length 0 ≠ It must be set to the number of expected bits including parity bits ! The reader will send the
command and return the response data of the transponder without SOF and EOF.

The Timeout-Value can be adjusted in 1ms steps. (0ms ...255ms)

Bit 7 6 5 4 3 2 1 0
TIMEOUT Function Timeout-Value
 NOTE:

Selects kind and mode of checking the data integrity of the RF-channel.
Bit 7 6 5 4 3 2 1 0
Rx Tx
Function
CRCEn CRCEn
TxCRCEn
CRC-INFO b0 = No CRC is inserted/transmitted
b1 = A CRC is calculated over the transmitted data and the CRC byte(s) are appended to the data
stream
RxCRCEn

Tx-
Bit 7 6 5 4 3 2 1 0
SETTINGS
Function

Rx-
Bit 7 6 5 4 3 2 1 0
SETTINGS
Function
REQ-BITS Reserved
Complete transponder request without SOF and EOF. If “TxCRCEn” = “1” the reader appended a
TR-
calculated CRC to the date stream. If “TxCRCEn” = “0” the application should send the CRC within the
REQUEST
TR-REQUEST, if the CRC is needed.
COMMAND [0xB9] Jewel Transparent Command
RSP-BITS [Number of valid Bits in TR-RESPONSE
Complete transponder response wit with Len byte and Packet data. A CRC check is performed inside
the reader
TR-
if “RxCRCEn” = “1”
RESPONSE
if “RxCRCEn” = “0”
the transponder CRC is transferred with the response data.

4.11.3 [0xBD] ISO14443A Transparent Command

This command sends user transparent commands to ISO14443 A transponder.
REQUEST-PAYLOAD
Mode 0/1
1 1 2 1 1 x
RSP- TR-
0xBD MODE TIMEOUT CRC-Info
LENGTH REQUEST
RESPONSE-PAYLOAD
Mode 0/1
1 1 x
0xBD STATUS TR-RESPONSE
=================================================================================
REQUEST-PAYLOAD
Mode 2
1 1 2 x 1 2 x
TR-
0xBD MODE RSP-Length TIMEOUT CRC-INFO REQ-BITS
REQEST
RESPONSE-PAYLOAD
Mode 2
1 1 1 x
0xBD STATUS RSP-BITS TR-RESPONSE
=================================================================================
REQUEST-PAYLOAD
Mode 3
1 1 2 x 1 x x 2 x
RSP- Tx- Rx- TR-
0xBD MODE TIMEOUT CRC-INFO REQ-BITS
Length SETTINGS SETTINGS REQEST
RESPONSE-PAYLOAD
Mode 3
1 1 1 x
0xBD STATUS RSP-BITS TR-RESPONSE
================================================================================

Details REQUEST-DATA Mode 0/1

COMMAND [0xBD] ISO14443A Transparent Command
Options for frame format request.

The following frame types are defined:
- short frames for commands like REQA, WUPA, ...
- standard frames for regular commands;
- bit oriented anticollision frame for anticollision command
0 = short frame:
A short frame is used to initiate communication and consists of, in the following order:
- start of communication;
- 7 data bits transmitted LSB first
- end of communication.
MODE
- No parity bit is added.
1 = standard frame:
Standard frames are used for data exchange and consist of:
-start of communication;
- n * (8 data bits + odd parity bit), with n_1. The LSB of each byte is transmitted first.
Each byte is followed by an odd parity bit. The parity bit P is set such that the number
of 1s is odd in (b1 to b8, P);
- end of communication.
2 = bit oriented frame:
Bit oriented Frames are used for anticollision.
= 0 The reader will send the command but not wait for any response
RSP-Length ≠ 0 The reader will send the command and return the response data of the
transponder without SOF, EOF and CRC.


Bit 7 6 5 4 3 2 1 0
Function FWI-Value Timeout-Value
FWI-VALUE
b0 = The Timeout-Value can be adjusted in 1ms steps. (0ms ...127ms)
b1 = The Timeout Value is equivalent to the FWI value according to ISO14443-4 (0...14).
With this parameter the Frame waiting time (FWT) according ISO14443-4 could be select by the user.
TIMEOUT approx. Frame waiting time

(FWI) (FWT)
0 1 ms
1 1 ms
2 2 ms
TIMEOUT 3 3 ms
4 5 ms
5 10 ms
6 20 ms
7 39 ms
8 78 ms
9 155 ms
10 310 ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948 ms
15…254 - not allowed -
 NOTE:


Bit 7 6 5 4 3 2 1 0
CRC Rx Tx Parity
Function
MSB First CRCEn CRCEn En
ParityEn
b0 = No parity bit is inserted or expected
b1 = An odd parity bit is inserted in the transmitted data stream after each byte
and expected in the received data stream after each byte (standard ISO14443A)
CRC-INFO TxCRCEn
b0 = No CRC is inserted/transmitted
b1 = A CRC is calculated over the transmitted data and the CRC byte(s) are
appended to the data stream
RxCRCEn
CRCMSBFirst
b0 = CRC-calculation starts with the LSB bit (standard ISO14443A)
b1 = CRC-calculation starts with the MSB bit
TR-
REQUEST
 NOTE:
The max. size of TR-REQUEST is 256 Byte

Mode 2
MODE
≠ 0 It must be set to the number of expected bits including parity bits ! The reader
RSP-Length
will send the command and return the response data of the transponder
without SOF and EOF.

Bit 7 6 5 4 3 2 1 0
FWI-VALUE

(FWI) (FWT)
0 1 ms
1 1 ms
2 2 ms
TIMEOUT 3 3 ms
4 5 ms
5 10 ms
6 20 ms
7 39 ms
8 78 ms
9 155 ms
10 310 ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948 ms
 NOTE:


Bit 7 6 5 4 3 2 1 0
CRC Rx Tx Parity
Function
ParityEn:
CRC-INFO
TxCRCEn:
RxCRCEn:
CRCMSBFirst:
REQ-BITS Number of valid Bits in TR-REQUEST

TR-
REQUEST

Mode 3
MODE
RSP-Length

Bit 7 6 5 4 3 2 1 0
FWI-VALUE

(FWI) (FWT)
0 1 ms
1 1 ms
2 2 ms
TIMEOUT 3 3 ms
4 5 ms
5 10 ms
6 20 ms
7 39 ms
8 78 ms
9 155 ms
10 310 ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948 ms
 NOTE:


Bit 7 6 5 4 3 2 1 0
CRC Rx Tx Parity
Function
ParityEn:
CRC-INFO
TxCRCEn:
RxCRCEn:
CRCMSBFirst:

Tx-
Bit 7 6 5 4 3 2 1 0
SETTINGS
Function

Rx-
Bit 7 6 5 4 3 2 1 0
SETTINGS
Function

TR-
REQUEST

Mode 0/1
Complete transponder response without SOF and EOF. A CRC check is performed inside the reader, if
TR-
“RxCRCEn” = “1”. However if “RxCRCEn” = “0” the transponder CRC is transferred with the response
RESPONSE
data.
Mode 2
RSP-BITS Number of valid Bits in TR-RESPONSE
TR-
RESPONSE
data.
Mode 3
RSP-BITS Number of valid Bits in TR-RESPONSE
TR-
RESPONSE
data.
 NOTE:

• The response data ever contains the in RSP-LENGTH defined number of data bytes.

4.11.4 [0xBE] ISO14443B Transparent Command

This command sends user transparent commands to ISO14443B transponder.
REQUEST-PAYLOAD
Mode 0
1 1 2 1 1 1 2 x
RSP- TR-
0xBE MODE TIMEOUT FRAME CRC-Info REQ-BITS
LENGTH REQUEST
RESPONSE-PAYLOAD
Mode 0
1 1 x
0xBE STATUS TR-RESPONSE
=================================================================================
REQUEST-PAYLOAD
Mode 1
1 1 2 x 1 1 x x 2 x
RSP- CRC- TX- RX- REQ- TR-
0xBE MODE TIMEOUT FRAME
Length INFO SETTINGS SETTINGS BITS REQEST
RESPONSE-PAYLOAD
Mode 1
1 1 x
=================================================================================
Details REQUEST-DATA Mode 0

COMMAND [0xBE] ISO14443B Transparent Command
MODE
RSP-Length ≠ 0 The reader will send the command and return the response data of the
transponder without SOF, EOF and CRC.


Bit 7 6 5 4 3 2 1 0
FWI-VALUE

(FWI) (FWT)
0 1 ms
1 1 ms
2 2 ms
TIMEOUT 3 3 ms
4 5 ms
5 10 ms
6 20 ms
7 39 ms
8 78 ms
9 155 ms
10 310 ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948 ms
 NOTE:


Defines the framing for ISO 14443B transponders.

Bit 7 6 5 4 3 2 1 0
RxSOF EOFSOF No No
Function RxEOF Req - TxEGT
Req Width TxSOF TxEOF
TxEGT
These bits define the length of the EGT
b00 = 0 Bit
b01 = 1 Bit
b10 = 2 Bit
b11 = 3 Bit
NoTxEOF
b0 = The frame includes EOF
b1 = TxCoder suppresses the EOF
FRAME NoTxSOF
b0 = The frame includes SOF
b1 = TxCoder suppresses the SOF
EOFSOFWidth
b0 = Set the SOF to a length of 10 ETU Low and 2 ETU High
Set the EOF to a length of 10 ETU
b1 = Set the SOF to a length of 11 ETU Low and 3 ETU High
Set the EOF to a length of 11 ETU
RxEOF Req
b0 = A data stream with and without EOF is accepted
b1 = A EOF is required in data stream
RxSOF Req
b0 = A data stream with and without SOF is accepted
b1 = A SOF is required in data stream

Bit 7 6 5 4 3 2 1 0
CRC Rx Tx Parity
Function
ParityEn
CRC-INFO TxCRCEn
RxCRCEn
CRCMSBFirst
TR-
REQUEST
 NOTE:
The max. size of TR-REQUEST is 256 Byte

Details REQUEST-DATA Mode 1

MODE
RSP-Length

Bit 7 6 5 4 3 2 1 0
FWI-VALUE

(FWI) (FWT)
0 1 ms
1 1 ms
2 2 ms
TIMEOUT 3 3 ms
4 5 ms
5 10 ms
6 20 ms
7 39 ms
8 78 ms
9 155 ms
10 310 ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948 ms
 NOTE:

FRAME

Bit 7 6 5 4 3 2 1 0
CRC Rx Tx Parity
Function
ParityEn:
CRC-INFO
TxCRCEn:
RxCRCEn:
CRCMSBFirst:

Bit 7 6 5 4 3 2 1 0
Function BAUDRATE
Tx-
SETTINGS BAUDRATE
b00 = 106 kBaud
b01 = 212 kBaud
b10 = 424 kBaud
b11 = 848 kBaud
Bit 7 6 5 4 3 2 1 0
Function BAUDRATE
Rx-
SETTINGS BAUDRATE:
b00 = 106 kBaud
b01 = 212 kBaud
b10 = 424 kBaud
b11 = 848 kBaud
TR-
REQUEST
TR-
RESPONSE
data.

 NOTE:

• The tr-response data ever contains the in RSP-LENGTH defined number of data bytes.
4.11.5 [0xBF] ISO15693 Transparent Command

This command sends user transparent commands to ISO15693 transponder.
REQUEST-PAYLOAD
Mode 1/2
1 1 2 1 x
RSP- TR-
0xBF MODE RESERVED
LENGTH REQUEST
RESPONSE-PAYLOAD
Mode 1/2
1 1 x
=================================================================================
REQUEST-PAYLOAD
Mode 3/4
1 1 2 1 2 x
EOF-
RSP- TR-
0xBF MODE RESERVED PULSE-
LENGTH REQUEST
DELAY
RESPONSE-PAYLOAD
Mode 3/4
1 1 x
================================================================================
REQUEST-PAYLOAD
Mode 5
1 1 2 1 2 x
MULTIPLE
RSP- TR-
0xBF MODE RESERVED 302us
LENGTH REQUEST
GRIDS
RESPONSE-PAYLOAD
Mode 5
1 1 x

Mode 1/2
COMMAND [0xBF] ISO15693 Transparent Command
Bit 7 6 5 4 3 2 1 0
Function TxCRCEn MODE
MODE
Options for request.
b0001(1) = read request
Response is sampled corresponding to ISO15693-3 T1 (318,6ms .... 323,3ms).
b0010(2) = write request with Option “0”
The reader tries to sample the response after ISO15693-3 T1 (318,6ms .... 323,3ms). If
there is no response the Reader tries to sample in a multiple of 302ms. If there is no
response within 20ms the command sends back Status “no. transponder” [0x01].
Depending on the ERROR_Flag in
the transponder response the length of the sampled data is:
- 4 Byte if ERROR_FLAG is “1”.
- RSP-LENGTH if ERROR_FLAG is “0”

The Reader tries to sample the response after ISO15693-3 T1 (318,6ms .... 323,3ms), if
there is no response the Reader sends a EOF after EOF-PULSE-DELAY and tries to
MODE sample the response after
ISO15693-3 T1 ( 318,6ms .... 323,3ms)
b0100(4) = inventory request

The Reader tries to sample the response after ISO15693-3 T1 (318,6ms .... 323,3ms).
If ISO15693 “Nb_slot_flag” Flag is:
“0” = the Reader sends an EOF after EOF-PULSE-DELAY and tries again to sample the
response in the next timeslot (after ISO15693-3 T1 (318,6ms .... 323,3ms)).
This is done 16 times. In this case the RSP-LENGTH defines the response length in one
timeslot. transponder responses with other response length will be ignored. If there is a
CRC error in one of the timeslots the protocol status is set to 0x02 [CRC error]. The user
should calculate which transponder data hold the CRC error.
“1” = the Reader sends back the received data.
b0101(5) = write request with Option “0” and grid position of response
The Reader tries to sample the response after ISO15693-3 T1 (318,6ms .... 323,3ms). If
there is no response the Reader tries to sample at the time/grid specified in MULTIPLE
302us GRIDS. If there is no response the command sends back Status “no. transponder”
[0x01].
Depending on the ERROR_Flag in the transponder response the length of the sampled
data is:

b0110(6) = read request without any ISO15693 specific data checks and ISO15693 data interpretation.
Response is sampled corresponding to CMD-RES-DELAY.
Cause by the fact that no data check is performed inside of the Reader all data with
response length same as response length specified in the Host command to the reader will
be transfers with status 0x00. If response length of data from transponder and response
length specified in the Host command to the Reader are un-equal, status 0x01 “No
transponder” will be the response of the reader.
MODE
The user of the command mode 6 has to control the data coding and decoding option of the
reader by setting see 3.6Transponder in the manner the reader should code the data in the
RF forward link and decode the data in the RF return link.
TxCRCEn
stream
Length of the transponder response in bit without SOF and EOF. During write operations
REP-LENGTH is depending on ERROR_FLAG in the transponder response:
RSP-Length
- REP-LENGTH if ERROR_FLAG is “0”
(CMD-RSP-DELAY)
RESERVED Not used. To avoid problems with other i-scan readers value should be value of response delay for
transponder response (ISO15693: t1) e.g. ISO15693 average value: 0x021F * 590ns = 320,9µs
Complete transponder request without SOF, CRC16 and EOF
 NOTE:
TR-
REQUEST The read and write option FLAGS in the REQUEST-DATA must correspond to the MODE Byte in the
request protocol. Reader is always forcing the command in the way specified by MODE Byte in the
request protocol.
Mode 3/4
Bit 7 6 5 4 3 2 1 0
MODE
MODE



sample the response after
ISO15693-3 T1 ( 318,6ms .... 323,3ms)
MODE “1” = the Reader sends back the received data.
[0x01].
data is:
reader by setting see 3.6 Transponder in the manner the reader should code the data in the
TxCRCEn
stream
RSP-Length


(CMD-RSP-DELAY)
EOF Pulse delay is used in write operations with ISO15693 write option “1”. EOF to define the
EOF-PULSE-
response delay for transponder response (ISO15693: t1)
DELAY
e.g. ISO15693 maximum value: 0x846A * 590ns = 20ms
Complete transponder request without SOF, CRC16 and EO
 NOTE:
TR-
REQUEST The read and write option FLAGS in the REQUEST-DATA must correspond to the MODE
Byte in the request protocol. Reader is always forcing the command in the way specified by
MODE Byte in the request protocol.
Mode 5
Bit 7 6 5 4 3 2 1 0
MODE
MODE
sample the response after
ISO15693-3 T1 ( 318,6ms .... 323,3ms)


“1” = the Reader sends back the received data.
[0x01].
MODE data is:
reader by setting see 3.6 Transponder in the manner the reader should code the data in the
TxCRCEn
stream
RSP-Length
(CMD-RSP-DELAY)
MULTIPLE
302us GRIDS
Complete transponder request without SOF, CRC16 and EO
 NOTE:
TR-
REQUEST The read and write option FLAGS in the REQUEST-DATA must correspond to the MODE
Byte in the request protocol. Reader is always forcing the command in the way specified by
MODE Byte in the request protocol.

Complete transponder response without SOF and EOF. A CRC16 check is performed in-side the
reader. However the transponder CRC16 is transferred with the response data.
TR-
RESPONSE  NOTE:
Data is only transferred if STATUS = 0x00, 0x83, 0x94, 0x95.
4.12 [0xBC] Command Queue

This command can be used for sending multiple commands within one protocol frame to the reader to speed
up the total processing time. It is like a container for a queue of different commands which shall be
processed by the reader sequentially.
REQUEST-PAYLOAD
1 1 2 n
0xBC MODE CMD_NO CMD_QUEUE
RESPONSE-PAYLOAD
1 1 1 n
0xBC STATUS CMD_CNT QUEUE_RESPONSE
COMMAND 0xBC Command Queue
MODE
CMD_NO Specifies the number of commands which are included in the queue

This field contains the command queue which shall process by the reader. The structure of a
command in queue is identical with the structure of the not queued command, as described in this
manual, but without the both CRC16 characters.
CMD.1
1 1 1 CMD_LNG - 3
CMD_LNG COMMAND DATA
…
…
…
CMD.CMD_NO
CMD_QUEUE
1 1 1 CMD_LNG - 3
CMD_LNG COMMAND DATA
CMD_LNG
Number of command bytes including CMD_LNG.
COMMAND
Defines the command which shall operated by the reader.
DATA
Optional data field with variable length. The number of DATA byte depends on the command.
COMMAND [0xBC] Command Queue
CMD_CNT Indicates the processing step where the reader had stopped the queue processing.

The QUEUE_RESPONSE field includes the response to the last operated command of the command
queue. This means that the QUEUE_RESPONSE includes the status and/or data of that command
which could be operated at last. If an error occurs while operation of any queued command the queue
proceeding will be interrupt and the error status of this last command is sent back in the
QUEUE_RESPONSE field.
The structure of the QUEUE_RESPONSE is identical with the structure of the not queued
QUEUE_RESPONSE as documented in this manual, but without the CRC16 characters.
1 1 1 1 RSP_LNG - 4
RSP_LNG COM_ADR COMMAND STATUS DATA
QUEUE_
RSP_LNG
RESPONSE
Number of response bytes including RSP_LNG.
COM_ADR
COMMAND
Command which was operated by the reader at least.
STATUS
DATA
Optional data field with variable length. The number of DATA byte depends on the command.
EXAMPLE:
These commands shall be operated within one queue.
1. [0xB0][0x25] select,
2. [0xB2] [0xB0] authent mifare and
3. [0xB0][0x23] read multiple blocks

Summery REQUEST-PAYLOAD
Parameter Value Length
COMMAND 0xBC Command Queue 1
STX 0x02 1
LENGTH 0x002B 2
COM-ADR 0x00 1
COMMAND [0xBC] 3
MODE 0x00 1
CMD_NO 0x03 5
CMD_LNG 0x0D 1
- 0x00 1
COMMAND [0xB0] 1
4 3 2 1 0 SELECT
0x25 0x01 0x00 0x00 0x00
DATA 10
10 9 8 7 6
0x00 0x6C 0x29 0xA7 0x62
CMD_LNG 0x08 1 Authent Mifare,

- 0x00 1 FirstDataBlock: 4,
COMMAND [0xB2] 1 KEY_TYP: A,
DATA [0xB0], 0x02, 0x00, 0x00, 0x00 5 KEY_ADR: 0
CMD_LNG 0x07 1 Read Multiple Blocks,

- 0x00 1 FirstDataBlock: 4,
COMMAND [0xB0] 1 DB_N: 1
DATA [0x23], 0x02, 0x04, 0x01 4
CRC16 2
Summery RESPONSE-PAYLOAD
Parameter Value Length
COMMAND 0xBC Command Queue 1
STX 0x02 1
LENGTH 0x0020 2
COM_ADR 0x00 1
COMMAND [0xBC] 1
STATUS 0x00 1
CMD_CNT 0x03 1
0x17 0x00 0x[B0] 0x00 0x01 0x10
RESPONSE- 0x00 0x74 0x73 0x65 0x54 0x20
23
DATA 0x6E 0x69 0x65 0x20 0x74 0x73
0x69 0x20 0x73 0x61 0x44

IDENTIFICATION ID CPR70 Supported Host Commands

The command codes listed in the following chapters gives an overview of the various transponder
commands and operations that are available for each transponder type.
 NOTE:
Detailed data sheets and information's about the functions and capabilities of each transponder type are not
supplied by FEIG ELECTRONIC. For detailed information's we refer to the original data sheets of the chip
manufacturer.
5.1 ISO14443A & B Part 4 compliant transponder

Memory organization:
Depends on the type and implementation of the used transponder.
Command Code Function Mode Comment

non addressed addressed selected
[0xB0] [0x01] Inventory
[0xB0] [0x25] Select
[0xB0] [0xBE] ISO 14443-4 T=CL
[0xB0] [0x2B] ISO 14443-4 transponder Info

5.1.1 Mifare DESFire
• Mifare DESFire (MF3 IC D40)

• Mifare DESFire EV1 (2k: MF3 IC D21, 4k: MF3 IC D41, 8k: MF3 IC D81)
Standard Commands
non addr. addressed selected
[0xB0] [0xBE] ISO 14443-4 T=CL
[0xB0] [0xBF ISO 14443-4 Container
[0xB0] [0x2B] ISO 14443-4 transponder Info
[0xC1] High-Level Commands

non-addr. addressed selected
[0xC1] [0xFA] DESFire Authent 
[0xC1] [0xBD] DESFire Read Standard Data 
[0xC1] [0x3B] DESFire Write Standard Data 
[0xC1] [0x6C] DESFire Get Value 
[0xC1] [0x0C] DESFire Credit 
[0xC1] [0xDC] DESFire Debit 
[0xC1] [0x1C] DESFire Limited Credit 
[0xC1] [0x3B] DESFire Write Records 
[0xC1] [0xBB] DESFire Read Records 
[0xC1] [0xEB] DESFire Clear Record File 
[0xC1] [0x5F] DESFire Change File Settings 
[0xC1] [0x54] DESFire Change Key Settings 
[0xC1] [0xC4] DESFire Change Key 

 SoftCrypto functions for reader types without SAM (see manual H01110

[0xC3] High-Level Commands

non-addr. addressed selected
[0xC3] [0xFA] DESFire Authent 
[0xC3] [0x54] DESFire Change Key Settings 
[0xC3] [0x45] DESFire Get Key Settings 
[0xC3] [0xC4] DESFire Change Key 
[0xC3] [0x54] DESFire Get Key Version 
[0xC3] [0xCA] DESFire Create Application 
[0xC3] [0xDA] DESFire Delete Application 
[0xC3] [0x6A] DESFire Get Application IDs 
[0xC3] [0x6D] DESFire Get DF Names 
[0xC3] [0x5A] DESFire Select Application 
[0xC3] [0xFC] DESFire Format PICC 
[0xC3] [0x60] DESFire Get Version 
[0xC3] [0x6E] DESFire Free Mem 
[0xC3] [0x5C] DESFire Set Configuration 
[0xC3] [0x51] DESFire Get Card IDD 
[0xC3] [0x6F] DESFire Get File IDs 
[0xC3] [0x61] DESFire Get ISO File IDs 
[0xC3] [0xF5] DESFire Get File Settings 
[0xC3] [0x5F] DESFire Change File Settings 
DESFire Create Standard Data 

[0xC3] [0xCD]
File
[0xC3] [0xCB] DESFire Backup Data File 
[0xC3] [0xCC] DESFire Create Value File 
DESFire Create Linear Record 

[0xC3] [0xC1]
File
DESFire Create Cyclic Record 
[0xC3] [0xC0]
File
[0xC3] [0xDF] DESFire Delete File 
[0xC3] [0xBD] DESFire Read Standard Data 
[0xC3] [0x3B] DESFire Write Standard Data 
[0xC3] [0x6C] DESFire Get Value 
[0xC3] [0x0C] DESFire Credit 
[0xC3] [0xDC] DESFire Debit 
[0xC3] [0x1C] DESFire Limited Credit 


[0xC3] [0x3B] DESFire Write Records 
[0xC3] [0xBB] DESFire Read Records 
[0xC3] [0xEB] DESFire Clear Record File 
[0xC3] [0xC7] DESFire Commit Transaction 
[0xC3] [0xA7] DESFire Abort Transaction 

5.1.2 NXP - Mifare Plus (Security Level 0, 2, 3)

Further information Mifare Plus security level
Memory Organization:
Mifare Plus 2k (MF1SPLUS60, MF1PLUS60)
Number of blocks 64 (user area: 47)
Block size 16 bytes
Mifare Plus 4k (MF1SPLUS80, MF1PLUS80)

Number of blocks 256 (user area: 215)
Block size 16 bytes
Mifare Plus (MF1PLUS60, MFPLUS80)

Command
Function Mode Comment
Code
non addressed addressed Selected
[0xB0] [0x25] Select -
[0xB2] [0xBE] ISO 14443-4 T=CL 4
[0xB2] [0xBF] ISO 14443-4 Container 4
[0xB2] [0x2B] ISO 14443-4 transponder Info 4
[0xC2] [0x77] MFP_SL1_Authent 4 
[0xC2] [0x70] MFP_FirstAuthentication 4 
[0xC2] [0x76] MFP_FollowingAuthentication 4 

[0xC2] [0x75] MFP_SL2_AESandCRYPTO1Authent 4
[0xC2] [0x38] MFP_SL2_MultiBlockRead 4
[0xC2] [0xA8] MFP_SL2_MultiBlockWrite 4
[0xC2] [0x78] MFP_SL3_ResetAuthentication 4 
[0xC2] [0x30] MFP_SL3_ReadEncrypted 4 
[0xC2] [0x31] MFP_SL3_ReadEncryptedMaced 4 
[0xC2] [0x32] MFP_SL3_ReadPlain 4 
[0xC2] [0x33] MFP_SL3_ReadPlainMaced 4 
[0xC2] [0x34] MFP_SL3_ReadEncryptedUnmaced 4 
[0xC2] [0x35] MFP_SL3_ReadEncryptedUnmacedRespMaced 4 
[0xC2] [0x36] MFP_SL3_ReadPlainUnmaced 4 
[0xC2] [0x37] MFP_SL3_ReadPlainUnmacedRespMaced 4 
[0xC2] [0xA0] MFP_SL3_WriteEncrypted 4 
[0xC2] [0xA1] MFP_SL3_WriteEncryptedMaced 4 

Command
Code
[0xC2] [0xA2] MFP_SL3_WritePlain 4 
[0xC2] [0xA3] MFP_SL3_WritePlainMaced 4 
[0xC2] [0xB0] MFP_SL3_IncrementEnrypted 4 
[0xC2] [0xB1] MFP_SL3_IncrementEnryptedMaced 4 
[0xC2] [0xB2] MFP_SL3_DecrementEnrypted 4 
[0xC2] [0xB3] MFP_SL3_DecrementEnryptedMaced 4 
[0xC2] [0xB4] MFP_SL3_Transfer 4 
[0xC2] [0xB5] MFP_SL3_TransferMaced 4 
[0xC2] [0xB6] MFP_SL3_IncrementTransferEncrypted 4 
[0xC2] [0xB7] MFP_SL3_IncrementTransferEncryptedMaced 4 
[0xC2] [0xB8] MFP_SL3_DecrementTransferEncrypted 4 
[0xC2] [0xB9] MFP_SL3_DecrementTransferEncryptedMaced 4 
[0xC2] [0xC1] MFP_SL3_Restore 4 
[0xC2] [0xC2] MFP_SL3_RestoreMaced 4 

To find the AES key to the chosen data block, you have to use the following calculation:
AES sector keys for sector 0 to 39 (50 00h to 40 4Fh)
• Key A = sector number multiplied by 2
• Key B = sector number multiplied by 2 + 1
• e.g. Key A for sector 2 has number 40 04

5.2 ISO14443A Part 3 compliant transponder
5.2.1 Infineon - my-d move SLE66R01P
Memory organization
(SLE66R01P): 38 x 4 byte = 152 byte
Number of blocks 38 / user area: 12 ... 32
Block size 4 bytes

security status is
[0xB0] [0x23] Read Multiple Blocks
always 0x00
[0xB0] [0x24] Write Multiple Blocks
[0xB0] [0xC0] Halt
 NOTE:
Commands for password protected memory and multiple block read/write commands can be carried out by
using
[0xBD] ISO 14443a Transparent Command

5.2.2 Infineon - my-d proximity SLE55Rxx
Memory Organization:
SLE55R04: 616 bytes
82 / max. user area: 5-81
Number of blocks
min. user area: 32-81)
Block size 8 / (10) byte
SLE55R08: 1024 bytes

Number of blocks
min. user area: 32-132
Block size 8 / (10) bytes
SLE55R16: 2048 bytes

Number of blocks
min. user area: 32-260
Block size 8 / (10) bytes

[0xB0] [0x23] Read Multiple Blocks DB-Size = 8
[0xB0] [0x24] Write Multiple Blocks DB-Size = 8
[0xB0] [0xC0] Halt

Memory organization
Mifare mini (MF1 S20)
Number of blocks 20 user area: 14
Block size 16 byte
Mifare standard 1k (MF1 IC S50)

Block size 16 byte
Mifare standard 4k (MF1 IC S70)

Block size 16 byte
Mifare plus 2k (MF1PLUS60)

Block size 16 byte
Mifare plus 4k (MF1PLUS80)

Block size 16 byte

Security Status is
[0xB0] [0x23] Read Multiple Blocks*
always 0x00
[0xB0] [0x24] Write Multiple Blocks*
[0xB0] [0xC0] Halt
[0xB2] [0x30] Mifare value Commands*
[0xB2] [0xB0] Authent Mifare*
* The reader uses a linear addressing mode. To calculate the Data-Block-Address (FirstDataBlock) the
expected Mifare Sector and the mifare block in the sector must be known.
FirstDataBlock calculation method:

MF1 IC S20 Sector 0 ... 4 FirstDataBlock = MIFARE_SECTOR * 4 + MIFARE_BLOCK

MF1 PLUS 80 Sector 32 ... 39 FirstDataBlock = (MIFARE_SECTOR - 32) * 16 + MIFARE_BLOCK + 128
MF1 PLUS 60 Sector 0 ... 31 FirstDataBlock = MIFARE_SECTOR * 4 + MIFARE_BLOCK

5.2.4 NXP - Mifare UltraLight
Memory organization
MF0U10 / MF0U11): 16 x 4 byte = 64 byte
Block size 4 byte
Command
Code
Security Status is
always 0x00
[0xB0] [0xC0] Halt
5.2.5 NXP - Mifare Ultralight C
Mifare Ultralight C (MF0 IC U2): 48 x 4 byte = 192 byte

Block size 4 byte
Command
Code
Security Status is
always 0x00
[0xB0] [0xC0] Halt
[0xB2][0xB2] Authent Mifare Ultralight C 
 See manual H01110-0e-ID-B.doc SoftCrypto functions

5.2.6 NXP – NTAG 210, 212, 213, 215, 216
Memory organization 80 User Memory Bytes

Block size 4 bytes
Memory organization 128User Memory bytes

Block size 4 bytes
Memory organization 144 User Memory Bytes

Block size 4 bytes
Memory organization 504 User Memory bytes

Block size 4 bytes
Memory organization 888 User Memory bytes

Block size 4 bytes
Command
Code
Security Status is
always 0x00
[0xB0] [0xC0] Halt

5.3 ISO14443A Part 2 compliant transponder
5.3.1 Innovision – Jewel
Memory organization
IRT5001W / IRT5001E
Number of blocks 120 user area: 8...104; (113...120)
Block size 1 byte
Command
Code
[0xB0] [0x01] Inventory - - -
[0xB0] [0x23] Read Multiple Blocks - -
WRITE-ERASE and
[0xB0] [0x24] Write Multiple Blocks - -
WRITE-NO-ERASE
 NOTE:
In case of write operations closely to the reader antenna it could be helpful to increase the MIN_LVL.

5.4 ISO15693 transponder

The command codes listed in the following table supports the various transponder commands and
operations that are available for each ISO15693 transponder type.
5.4.1 EM Microelectronics (EM4034)

Chip ID: 1h = x00001xxb (Bit 46 - 42 of UID)
Memory organization
14 x 4 Byte = 448Bit
Number of blocks 14 (user area: 3 – 11)
Block size 4 byte

0x01 Inventory
0x02 Stay Quiet

0x22 Lock Multiple Blocks
0x23 Read Multiple Blocks DB-Size = 4
DB-Size = 4,
0x24 Write Multiple Blocks
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready
0x27 Write AFI
0x28 Lock AFI
0x29 Write DSFID
0x2A Lock DSFID
0x2B Get System Information
Get Multiple Block Security
0x2C
Status
Reading of one block in non addressed mode is only possible, if parameter “Read Mode” in 4.7.1[0x2B]
ISO14443-4 transponder-Info is set to “b10: Multiple Read“.
The WR-OPTION will be set automatically by the FEIG Readers if the WR-OPTION parameter in
4.7.1 [0x2B] ISO14443-4 transponder-Info is set to “00: automatically set”.

5.4.2 EM Microelectronics (EM4135)

Chip ID: 4h = 000100xx (Bit 47 - 42 of UID)
Memory organization: 38 x 8 Byte = 2432Bit
Block size 8 bytes

0x01 Inventory
0x02 Stay Quiet
0x22 Lock Multiple Blocks WR-OPTION = 0

DB-Size = 8,
0x24 Write Multiple Blocks**
WR-OPTION = 0
0x25 Select - -
0x26 Reset to Ready

0x27 Write AFI
0x28 Lock AFI
0x29 Write DSFID
0x2A Lock DSFID
Get System
0x2B
Information
Get Multiple Block
0x2C
Security Status
The WR-OPTION will be set automatically by the FEIG readers if the WR-OPTION parameter in

5.4.3 Fujitsu (MB89R116)

IC manufacturer identifier: 0x08
Chip ID: 0h = 00000000b (Bit 47 - 40 of UID)
Memory organization: 256 x 8 Byte = 16kbit
Block size 8 bytes

0x01 Inventory
0x02 Stay Quiet
0x22 Lock Multiple Blocks WR-OPTION = 0 or 1

Security Status is
0x23 Read Multiple Blocks
always 0x00
0x24 Write Multiple Blocks WR-OPTION = 0 or 1
0x25 Select
0x26 Reset to Ready
0x27 Write AFI WR-OPTION = 0 or 1
0x28 Lock AFI WR-OPTION = 0 or 1
0x29 Write DSFID
0x2A Lock DSFID

Get System
0x2B
Information
Get Multiple Block
0x2C
Security Status
The custom specific commands read multiple blocks unlimited [0xA3] will be used automatically by the
reader. In non addressed mode only one or two blocks can be read and the parameter DB-blocksize in
4.7.1[0x2B] ISO14443-4 transponder-Info should be set to 8.
The WR-OPTION = 0, (automatically) set in 4.7.1[0x2B] ISO14443-4 transponder-Info. Up to two blocks of
data can be written for one request.


Block size 8 bytes

0x01 Inventory
0x02 Stay Quiet

Security Status is
always 0x00
0x25 Select
0x26 Reset to Ready
0x29 Write DSFID
0x2A Lock DSFID

Get System
0x2B
Information
Get Multiple Block
0x2C
Security Status
The custom specific commands read multiple blocks unlimited [0xA3] will be used automatically by the
reader. In non addressed mode only one or two blocks can be read and the parameter DB-blocksize in
4.7.1 [0x2B] ISO14443-4 transponder-Info should be set to 8.
The WR-OPTION = 0 (automatically set) in 4.7.1 [0x2B] ISO14443-4 transponder-Info. Up to two blocks of


Block size 4 bytes

non addr. addressed selected
0x01 Inventory
0x02 Stay Quiet

Security Status is
always 0x00
0x25 Select
0x26 Reset to Ready
0x29 Write DSFID
0x2A Lock DSFID

Get Multiple Block
0x2C
Security Status
The WR-OPTION = 0 (automatically set) in 4.7.1 [0x2B] ISO14443-4 transponder-Info. Up to two blocks of

5.4.6 Infineon (ISO address mode) 0xE0

memory organization:
SRF55V10P: 256 x 4 Byte = 8kbit SRF55V02P: 64 x 4 Byte = 2kbit
Number of blocks 256 (user area: 0...249) Number of blocks 64 (user area: 0...57)
Block size 4 bytes Block size 4 bytes

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready
0x27 Write AFI WR-OPTION = 0
0x28 Lock AFI WR-OPTION = 0

0x29 Write DSFID -
0x2A Lock DSFID -
0x2B Get System Information -
Get Multiple Block
0x2C
Security Status
4.7.1 [0x2B] ISO14443-4 transponder-Info is set to “b00: automatically set”.

5.4.7 Infineon (My-d Light)

Chip ID: A1h = 10100001b (Bit 47 - 40 of UID)
Number of blocks 18 (user area: 0...12)
Block size 4 bytes

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready

0x29 Write DSFID
0x2A Lock DSFID
Get System
0x2B
Information
Get Multiple Block
0x2C
Security Status
4.7.1 [0x2B] ISO14443-4 transponder-Info is set to “b00: automatically set”.
Reading of one block in non addressed mode is only possible, if parameter “Read Mode” in 4.7.1 [0x2B]
ISO14443-4 transponder-Info is set to “b01: Single Read“.

5.4.8 NXP (I-Code SLI)

Chip ID: 1h = 00000001b (bit 47 - 40 of UID)
Memory organization: 32 x 4 bytes = 1kbit
Block size 4 bytes

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready
0x29 Write DSFID WR-OPTION = 0
0x2A Lock DSFID WR-OPTION = 0

Get Multiple Block
0x2C
Security Status

5.4.9 NXP (I-Code SLI-S)

Number of blocks 40 (user area: 0 – 39) Number of pages 10 (user area: 0 – 9)
Block size 4 bytes Page size 16 bytes = 4 Blocks

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready

Get Multiple Block
0x2C
Security Status
The WR-OPTION will be set automatically by the FEIG readers if the WR-OPTION parameter
Reading of one block in non addressed mode is only possible, if parameter “Read Mode”
4.7.1 [0x2B] ISO14443-4 transponder-Info is set to “b01: Single Read“.

5.4.10 NXP (I-Code SLI-L)

Memory organization: 16 x 4 bytes = 512Bit

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready

Get Multiple Block
0x2C
Security Status

5.4.11 NXP (I-Code SLIX-S)

Memory organization: 64 x 4 bytes = 2048 bit

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready

Get Multiple Block
0x2C
Security Status

5.4.12 NXP (I-Code SLIX-L)

Memory organization: 16 x 4 bytes= 512 bit

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready

Get Multiple Block
0x2C
Security Status

5.4.13 NXP (I-Code SLIX2)

Type indicator bits: 01b (bit 36 – 35 of UID)
Block size 4 bytes

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready

Get Multiple Block
0x2C
Security Status

5.4.14 NXP ICode DNA

Type indicator bits: 11b (bit 36 – 35 of UID)
Block size 4 bytes

0xB0 0x01 Inventory
0xB0 0x23 Read Multiple Blocks DB-Size = 4

DB-Size = 4,
0xB0 0x24 Write Multiple Blocks
WR-OPTION = 0 *
0xB0 0x39 Challenge
0xB0 0x35 Authenticate
0xB0 0x3A Read Buffer

5.4.15 STMicroelectronics (LRI64)

memory organization: 16 x 1 byte = 128 bit
Block size 1 byte

0x01 Inventory
0x02 Stay Quiet

0x23 Read Multiple Blocks In non addressed
mode DB-N must be 1
0x24 Write Multiple Blocks DB-Size = 1,
WR-OPTION = 0
0x25 Select -
0x26 Reset to Ready -
0x27 Write AFI - WR-OPTION = 0
0x28 Lock AFI - WR-OPTION = 0
0x29 Write DSFID
0x2A Lock DSFID
0x2B Get System
Information
0x2C Get Multiple Block
Security Status

5.4.16 STMicroelectronics (LRI2k, LRIS2k)

Chip ID: 8h = 001000xxb (bit 47 - 42 of UID)
Product Code for LRI2k and LRIS2k:
bit 63-48 = E0 02, bit 47-42: Product ID
LRI2k 0010 00
LRIS2k 0010 10
memory organization: 64 x 4 byte = 2kbit

Block size 4 bytes

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4,
WR-OPTION = 0
0x25 Select
0x26 Reset to Ready
0x29 Write DSFID
0x2A Lock DSFID

Get Multiple Block
0x2C
Security Status

5.4.17 STMicroelectronics (M24LR64-R)

Product Code for M24LR64-R: bit 47-42 of UID
bit 47 - 42 Product ID
001011xxb hex
memory organization: 64 x 32 x 4 bytes = 64 kbit

Number of sectors 64 (0...63)
32 blocks per sector
Block size 4 bytes

0x01 Inventory
0x02 Stay Quiet
0x24 Write Multiple Blocks WR-OPTION = 0
0x25 Select
0x26 Reset to Ready
0x29 Write DSFID
0x2A Lock DSFID

Get Multiple Block
0x2C
Security Status
Each sector (32 blocks) must be read separately. For reading data from different sectors a read multiple
block command for each sector must be used.

5.4.18 Texas Instruments (Tag-it HFI Pro / Standard)

Chip ID: Ch = 1100xxxxb (Bit 47 - 44 of UID)
Standard:
Product ID: 0h = 000b (bit 43 – 41 of UID)
memory organization: 11 x 4 bytes = 48 byte (8 * 4 bytes = 256 bit user data)
Block size 4 bytes
Pro:
Product ID: 0h = 100b (bit 43 – 41 of UID)
memory organization: 12 x 4 byte = 48 byte (8 * 4 bytes = 256 bit user data)
Block size 4 bytes

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4
WR-OPTION = 1
0x25 Select
0x26 Reset to Ready
0x27 Write AFI
0x28 Lock AFI
0x29 Write DSFID
0x2A Lock DSFID
Get Multiple Block
0x2C
Security Status
Reading of more than one block in non addressed mode is only possible, if parameter “Read Mode” in
4.7.1 [0x2B] ISO14443-4 transponder-Info is set to “01: Single Read“.
When using the “non-addressed” mode the WR-OPTION must be set manually to “WR-OPTION = 1”.

5.4.19 Texas Instruments (Tag-it HFI Plus)

Chip ID: 0h = 0000xxxxb or 8h = 1000xxxxb (bit 47 - 44 of UID)
memory organization: 64 x 4 bytes = 2 kbit user data
Block size 4 bytes

0x01 Inventory
0x02 Stay Quiet

DB-Size = 4
WR-OPTION = 1
0x25 Select
0x26 Reset to Ready

Get Multiple Block
0x2C
Security Status
When using the “non-addressed” mode the WR-OPTION must be set manually to “WR-OPTION = 1”.
The “Write_2_Blocks” command and “Lock_2_Blocks” command will be used automatically by the reader.
This will only become an effect if the block address starts with an even-numbered address.

5.5 ISO18000-3M3 Transponders

The command codes listed in the following table supports the various transponder commands and
operations that are available for each ISO18000-3M3 transponder type.
5.5.1 NXP ICode ILT-M

Memory organization:
Reserved memory (32 bit ACCESS and 32 bit KILL password) 64 bit
EPC (excluding 16 bit CRC-16 and 16 bit PC) 240 bit
TID (including unique 48 bit serial number) 96 bit
User memory 512 bit
Command
Code
non addressed addressed
0xB0 0x01 Inventory -
0xB0 0x23 Read Multiple Blocks
0xB0 0x24 Write Multiple Blocks
0xB3 0x18 Kill
0xB3 0x22 Lock
For a detailed description of the mandatory “Kill command” refer to


IDENTIFICATION ANNEX A: Codes of Transponder Types
6 ANNEX A: Codes of Transponder Types
TYPE_NO transponder Type Supported by ID CPR.70

0x00 NXP I-Code1 -
0x03 ISO15693
0x04 transponder according ISO14443A
0x05 transponder according ISO14443B

0x06 NXP I-Code EPC -
0x08 Jewel
0x09 ISO18000-3M3
0x0A STMicroelectronics SR176

STMicroelectronics SRIxx (SRI512,
0x0B
SRIX512, SRI4K, SRIX4K)
0x0D FeliCa
0x10 Calypso Innovatron (14443-B’)

0x11 ASK CTx (CTS256B, CTS512B, CTM512B) -
0xFF “free”

IDENTIFICATION ANNEX B: Codes of Reader Types
7 ANNEX B: Codes of Reader Types

TYPE_NO Tansponder Type
31 ID ISC.M02
80 ID CPR.M02
81 ID CPR.02
82 ID CPR40.xx-U with USB interface
83* ID CPR40.xx- with asynchronous (RS232) interface
84 ID CPR50.xx
85 ID CPR44.0x-xx
86 ID CPR30.xx
89 ID CPR46.xx
114 ID CPR74.xx
116 ID CPR30pro / ID CPR30pro SAM
117 ID CPR70

IDENTIFICATION ANNEX C: Index of Status Bytes

Hex value General
OK:
0x00 • Data / parameters have been read or stored without error
• Control command has been executed
Hex-value transponder Status

No transponder
• No transponder is located within the detection range of the Reader.
0x01 • The transponder in the detection range has been switched to mute.
• The communication between Reader and transponder has been interfered and the
Reader is not able to read the transponder anymore.
Data False
0x02
• CRC, parity or framing error at received data.
Write-Error:
• Negative plausibility check of the written data:
0x03 • Attempt to write on a read-only storing area.
• Too much distance between transponder and Reader antenna.
• Attempt to write in a noise area.
Address-Error:
• The required data are outside of the logical or physical transponder-address area:
0x04
• The address is beyond the max. address space of the transponder.
• The address is beyond the configured address space of the transponder.
Wrong transponder-Type:
• This command is not applicable at the transponder:
0x05
• Attempt to write on or read from a transponder.
• A special command is not applicable to the transponder.
Authent-Error
0x08 • The reader could not identify itself to the transponder as authorized:
• reader- and transponder Keys do not correspond
Collision-Error
0x0B
• More than one transponder was detected by the reader in EMVCo mode
General-Error
0x0E
• The transponder answered with an undefined or general error code
RF Communication Error:
0x83 • Anticollision could not be finished by the reader.
• Corrupted or faulty data exchange between reader and transponder
More Data:
0x94 • There are more transponder data sets requested than the response protocol can transfer
at once.
ISO15693-Error:
0x95
• An additional error code for ISO15693 transponders is sent with response data.
ISO14443-Error:
0x96 • An additional error code for ISO14443 transponders is sent with response data.
10 ANNEX C2: Error-Codes

IDENTIFICATION ANNEX C: Index of Status Bytes
Hex-value transponder Status

Crypto Processing Error
0x97 • An additional code for source and reason of the error is sent with response data
9. ANNEX C1: Crypto Processing Error
Hex-value Parameter Status

EEPROM-failure:
0x10 • The EEPROM of the Reader is not able to be written on.
• Before writing onto the EEPROM a faulty checksum of parameters has been detected.
Parameter-Range-Error:
0x11
• The value range of the parameters was exceeded.
Login-Request:
0x13
• Configuration access without having logged in to the Reader before.
Login-Error:
0x14
• Login attempt with wrong password.
Read Protect:
0x15
• The configuration block is reserved for future use.
Write Protect:
0x16
• The configuration block is reserved for future use.
Firmware activation required:
• The firmware must be enabled first using ISOStart demo program and the command “Set
Firmware Upgrade”.
The update code must be ordered by Feig Electronic.
0x17 1. Read the Device-ID using the command [0x66] Firmware version (Mode 0x80)
2. Send the Device-ID and the serial number of the reader to Feig Electronic’s Customer
Support
3. Write the upgrade code into the reader using the command [0x5F] Set Firmware
Update
Hex-value Interface Status

Unknown Command:
0x80
• The Reader does not support the selected function.
Length-Error:
0x81
• The received protocol contains not the expected content.
Command (currently) not available:
0x82
• The reader is configured in scan-mode and had received an ISO Host-mode command.
Hex-value Reader Status

Hardware Warning:
0xF1
• The Firmware is incompatible with the hardware

IDENTIFICATION ANNEX C1: Crypto Processing Error
9 ANNEX C1: Crypto Processing Error
ERROR-SOURCE = 1
ERROR-CODE Status
ISO14443-Error:
0x96xx • An additional error code for ISO14443 transponders is sent with response data.
9 ANNEX C1: Crypto Processing Error
0x6581 Buffer overflow, because the received data volume exceeds the reader internal buffer size
DESFire Error
0x00 • The ERROR-CODE was received from the DESFire Card.
5.1.2 NXP - Mifare Plus (Security Level 0, 2, 3)
ERROR-SOURCE = 3
ERROR-CODE Status
An error occurs while authentication, MAC calculation or CRC calculation. The reason can be a not
0x901E
satisfied security status or any kind of transmission errors.

IDENTIFICATION ANNEX C2: Error-Codes
10 ANNEX C2: Error-Codes
ISO14443A Transponders
Hex-value Response error code definition
0x01 Lowlevel Error: CRC, Framing or EGT error
0x02 Timeout
0x03 Protocol error
0x04 block-no error (Chaining)
Insufficient power:
• The present transponder indicates insufficient power
0x05 Maybe is distance between reader antenna and transponder is high.
Too many transponders in the detection range of the Reader.
The power consumption of the transponder exceeds the antenna power of the Reader.
ISO15693 Transponders
0x01 The command is not supported, i.e. the request code is not recognized
0x02 The command is not recognized, for example: a format error occurred
0x03 The command option is not supported
0x0F Unknown error
0x10 The specified block is not available (doesn’t exist)
0x11 The specified block is already locked and thus cannot be locked again
0x12 The specified block is locked and its content cannot be changed
0x13 The specified block was not successfully programmed
0x14 The specified block was not successfully locked
0x15 The specified block is protected
0x40 Generic cryptographic error
0xA0 - 0xDF Custom command error codes
all others reserved for future use
ISO18000-3M3 Transponders
0x00 Other error
0x03 Memory overrun or unsupported PC value
0x04 Memory locked
0x0B Insufficient power
0x0F Non-specific error

IDENTIFICATION ANNEX D Examples for Read Data
11 ANNEX D Examples for Read Data

The setting "LSB first" and "MSB first" gives the direction of the received data bytes.
Host Command (DB-Size of the transponder = 4Byte)
Host Command (DB-Size of the transponder = 8Byte)

ANNEX E Labeling of configuration
IDENTIFICATION
parameter
Parameter Filter CFG- Byte- No. of Bit- No. of

Namespace Logical View
Physical View Expert Block No. Bytes No. Bits
AccessProtection
AccessProtection.Lock_CFG0 CFG0-ACCESS E 0 4 1 0 2
CFG10-
AccessProtection.Lock_CFG10 E 0 6 1 4 2
ACCESS
CFG11-
ACCESS
CFG12-
ACCESS
CFG13-
ACCESS
CFG14-
ACCESS
CFG15-
ACCESS
AccessProtection.Lock_Password Password
AccessProtection.Password PASSWORD E 0 0 4
TR-
AirInterface.TimeLimit RESPONSE- 1 6 2
TIME
DigitalIO
OFFLINE-
DigitalIO.Output.No1.OfflineState 2 8 1 0 2
STATE-OUT1
ONLINE-
DigitalIO.Output.No1.OnlineState 2 3 1 0 2
STATE-OUT1
DigitalIO.Output.No1.TagDetectStat TAG-DETECT-
2 11 1 0 2
e STATE-OUT1
OFFLINE-
STATE-OUT2
ONLINE-
STATE-OUT2
2 11 1 2 2
e STATE-OUT1
OFFLINE-
STATE-OUT3

IDENTIFICATION
parameter

ONLINE-
STATE-OUT3
2 11 1 4 2
e STATE-OUT3
OFFLINE-
DigitalIO.Output.OfflineDelay 2 9 1
DELAY
TAG-DETECT-
DigitalIO.Output.TagDetectActiveTi
ACTIVATION- 2 12 1
me
TIME
OFFLINE
DigitalIO.Signaler.LED.Green.Offlin
STATE LED 2 8 1 0 2
eState
Green
DigitalIO.Signaler.LED.Green.Onlin ONLINE STATE
2 3 1 0 2
eState LED Green
Tag Detect
DigitalIO.Signaler.LED.Green.TagD
State LED 2 11 1 0 2
etectState
Green
OFFLINE
DigitalIO.Signaler.LED.Yellow.Offlin
STATE LED 2 8 1 2 2
eState
Yellow
DigitalIO.Signaler.LED.Yellow.Onlin ONLINE STATE
2 3 1 2 2
eState LED Yellow
Tag Detect
DigitalIO.Signaler.LED.Yellow.TagD
State LED 2 11 1 2 2
etectState
Yellow
OFFLINE-
DigitalIO.Signaler.OfflineDelay 2 9 1
DELAY
DigitalIO.Signaler.TagDetectActiveT Tag Detect
2 12 1
ime Activation Time
Hostinterface
HostInterface.Serial.Baudrate Baudrate 1 2 1
HostInterface.Serial.BusAddress Busaddress 1 0 1
Number of
HostInterface.Serial.Databits 1 3 1 2 1
Databits
HostInterface.Serial.Parity Parity 1 3 1 0 2
Protocol Start
HostInterface.Serial.ProtocolStartSy
Synchronization 1 5 1
nchronizationTime
Time (PSST)
Number of
HostInterface.Serial.Stopbits 1 3 1 3 1
Stopbits
HostInterface.USB.HID.KeyStroke_ HID Keystroke
1 11 1
Delay Delay
OperatingMode
OperatingMode.HostMode.Filter.Re RESPONSE-
5 11 1 0 1
sponseMode MODE
OperatingMode.HostMode.Inventor ABORT-
5 11 1 3 1
yAbortCondition CONDITION

IDENTIFICATION
parameter

OperatingMode.HostMode.Inventor
Anticollision 5
yAnticollusion
READER-
OperatingMode.Mode 1 13 1
MODE
OperatingMode.ScanMode.DataFor
COM-PREFIX 6 3 1 6 1
mat.BusAddressPrefix
END-CHAR 7 3 1
mat.EndChar
DB-USE 7 0 1 0 4
mat.Format
END-LEN 7 13 1 0 4
mat.NoOfUserEndChars
HEADER-LEN 7 13 1 4 4
mat.NoOfUserHeaderChars
SEP-User 7 1 1
mat.SeparationChar
IDD-BCD 6 3 1 2 1
mat.UidInBcd
END-USER1 7 4 1
mat.UserEndChar1
END-USER2 7 5 1
mat.UserEndChar2
END-USER3 7 6 1
mat.UserEndChar3
OperatingMode.ScanMode.DataFor HEADER-
7 8 1
mat.UserHeaderChar1 USER1
7 9 1
7 10 1
7 11 1
SEP-USER 7 2 1
mat.UserSeparationChar
OperatingMode.ScanMode.DataSel
DB 6 3 1 1 1
ector.Data
OperatingMode.ScanMode.DataSel MIFARE-APP-
6 3 1 5 1
ector.MifareAppID ID-Value
INDEPENDENT
-
ector.Mode.Enable_IndependentTra 6 4 1 0 1
TRANSMISSIO
nsmission
N
IDD 6 3 1 0 1
ector.UID
OperatingMode.ScanMode.DataSo BYTE-ORDER-
6 3 1 7 1
urce.ByteOrderOfData DB
OperatingMode.ScanMode.DataSo BYTE-ORDER-
urce.ByteOrderOfData_ProcessorC DB [Processor 6 3 1 4 1
ards Cards]

IDENTIFICATION
parameter

OperatingMode.ScanMode.DataSo
D-START 6 13 1
urce.ISO_14443_3.FirstByte
DB-ADR 6 11 1
urce.ISO_14443_3.FirstDataBlock
OperatingMode.ScanMode.DataSo D_LGT
6 12 1
urce.ISO_14443_3.NoOfBytes (ISO14443)
D-START 8 13 1
urce.ISO_15693_18000.FirstByte
urce.ISO_15693_18000.FirstDataBl DB-ADR 8 10 2
ock
OperatingMode.ScanMode.DataSo D_LGT
8 12 1
urce.ISO_15693_18000.NoOfBytes (ISO15693)
OperatingMode.ScanMode.DataSo ISO1800-3M3-
8 9 1
urce.ISO_18000_3M3.BankNo BANK-NR
OperatingMode.ScanMode.DataSo MIFARE-APP-
6 8 2
urce.Mifare.Classic.AppID ID-VALUE
OperatingMode.ScanMode.DataSo MIFARE-KEY-
6 10 1 0 4
urce.Mifare.Classic.KeyAddress ADR
OperatingMode.ScanMode.DataSo MIFARE-KEY-
6 10 1 7 1
urce.Mifare.Classic.KeyType TYPE
OperatingMode.ScanMode.DataSo DESFIRE-APP-
10 0 3
urce.Mifare.DESFire.AppID ID
OperatingMode.ScanMode.DataSo DESFIRE-
urce.Mifare.DESFire.EnableAuthent AUTHENTICATI 6 5 1 0 1
ication ON
OperatingMode.ScanMode.DataSo DESFIRE-FILE-
urce.Mifare.DESFire.FileCommSetti COMM- 10 6 1 0 2
ngs SETTINGS
10 10 1
urce.Mifare.DESFire.FileLength LENGTH
10 5 1 0 5
urce.Mifare.DESFire.FileNumber NR
10 7 3
urce.Mifare.DESFire.FileOffset OFFSET
10 6 1 6 2
urce.Mifare.DESFire.FileType TYPE
OperatingMode.ScanMode.DataSo DESFIRE-KEY-
10 3 1
urce.Mifare.DESFire.KeyNumber NR
urce.Mifare.DESFire.ReaderKeyInd READER-KEY- 10 4 1
ex IDX
MIFARE-PLUS-
SL1-
urce.Mifare.PLUS.SecurityLevel1.E 6 5 1 4 1
AUTHENTICATI
nableAuthentication
ON
urce.Mifare.PLUS.SecurityLevel1.R READER-KEY- 9 7 1 0 4
eaderKeyIndex IDX

IDENTIFICATION
parameter

MIFARE-PLUS-
urce.Mifare.PLUS.SecurityLevel3.A 9 8 2
SL3-APP-ID
ppID
MIFARE-PLUS-
SL3-
urce.Mifare.PLUS.SecurityLevel3.E 6 5 1 1 1
AUTHENTICATI
nableAuthentication
ON
MIFARE-PLUS-
urce.Mifare.PLUS.SecurityLevel3.Fi 9 5 1
SL3-DB-ADR
rstDataBlock
MIFARE-PLUS-
urce.Mifare.PLUS.SecurityLevel3.K 9 1 1
SL3-KEYTYPE
eyType
MIFARE-PLUS-
urce.Mifare.PLUS.SecurityLevel3.N 9 6 1
SL3-DB-ADR
oOfDataBlocks
READ-
urce.Mifare.PLUS.SecurityLevel3.R 9 3 1
COMMAND
eadCommand
OperatingMode.ScanMode.DataSo MIFARE-PLUS-
urce.Mifare.PLUS.SecurityLevel3.R SL3-READER- 9 2 1 0 4
eaderKeyIndex KEY-IDX
OperatingMode.ScanMode.DataSo ULTRALIGHT-
urce.Mifare.UltralightC.EnableAuthe AUTHENTICATI 6 5 1 5 1
ntication ON
OperatingMode.ScanMode.DataSo ULTRALIGHT-
6 0 1
urce.Mifare.UltralightC.KeyAddress KEY-ADR
OperatingMode.ScanMode.Filter.Re RESPONSE-
5 11 1 0 1
sponseMode MODE
OperatingMode.ScanMode.Filter.Tr
VALID-TIME 6 6 2
ansponderValidTime
Transponder
Transponder.Anticollision.AORB_R
EQ
Transponder.Anticollision.Enable ONT (ACOLL) 5 11 1 2 1
Transponder.Anticollision.ONT
Transponder.Driver.HF.Drivers DRIVER-FLAGS
DRIVER-
Transponder.Driver.HF.FeliCa 3 0 1 5 1
FELICA
Transponder.Driver.HF.ISO_14443. ISO14443-
Drivers DRIVER-FLAGS
ISO14443-
Transponder.Driver.HF.ISO_14443. DRIVER-
3 3 1 0 1
TypeA.MifareStandard MIFARE-
STANDARD
ISO14443-
3 3 1 2 1
TypeA.MifareUltraLight MIFARE-
ULTRALIGHT

IDENTIFICATION
parameter

B: ISO14443-
3 3 1 1 1
TypeA.my_d_Proximity_SLE55Rxx MYDPROXI-
SLE55Rxx
ISO14443-
Transponder.Driver.HF.ISO_14443.
DRIVER- 3 3 1 3 1
TypeA.Part4
TYPEA-P4
Transponder.Driver.HF.ISO_14443 ISO14443-
3 1 1 4 1
_TypeA DRIVER-TYPEA
Transponder.Driver.HF.ISO_14443 ISO14443-
3 1 1 5 1
_TypeB DRIVER-TYPEB
DRIVER-
Transponder.Driver.HF.ISO_15693 3 1 1 3 1
ISO15693
Transponder.Driver.HF.ISO_18000 DRIVER-
3 0 1 1 1
_3M3 ISO18000-3M3
Transponder.Driver.HF.Jewel DRIVER-JEWEL 3 0 1 0 1
DRIVER-
Transponder.Driver.HF.Selector 3 0 1 7 1
SELECTOR
DRIVER-STM-
Transponder.Driver.HF.SR176 3 0 1 2 1
SR176
DRIVER-STM-
Transponder.Driver.HF.SRIxx 3 0 1 3 1
SRIxx
Transponder.Driver.HF.UserSequen
DRIVER1 11 0 1
ced.No1
DRIVER10 11 9 1
ced.No10
DRIVER11 11 10 1
ced.No11
DRIVER12
ced.No12
DRIVER12 11 11 1
ced.No12
DRIVER13 11 12 1
ced.No13
DRIVER14 11 13 1
ced.No14
DRIVER02 11 1 1
ced.No2
DRIVER03 11 2 1
ced.No3
DRIVER04 11 3 1
ced.No4
DRIVER05 11 4 1
ced.No5
DRIVER06 11 5 1
ced.No6
DRIVER07 11 6 1
ced.No7

IDENTIFICATION
parameter

DRIVER08 11 7 1
ced.No8
DRIVER9 11 8 1
ced.No9
Transponder.HF.ISO_14443.Bitrate. ISO14443-RX-
3 7 1 4 2
Receive BITRATE
Transponder.HF.ISO_14443.Bitrate. ISO14443-TX-
3 7 1 6 2
Transmit BITRATE
Transponder.HF.ISO_14443.Miscell ISO14443-
E 3 12 1
aneous.StartupTime STARTUP-TIME
Transponder.HF.ISO_14443.Part4. ERROR-
E 3 13 1 2 2
Miscellaneous.ErrorRetry RETRY-LOOPS
POWER-
Transponder.HF.ISO_14443.Part4. LEVEL-
E 3 13 1 1 1
Miscellaneous.PowerLevelCheck INDICATOR-
PLIC
OPTIONAL-
Transponder.HF.ISO_14443.TypeA.
INVENTORY- 3 13 1 4 1
OptionalInventoryInfo
INFO
Transponder.HF.ISO_14443.TypeA.
IDD-ORDER 3 13 1 7 1
UID_Order
Transponder.HF.ISO_14443.TypeB. BITRATE-
E 3 13 1 0 1
Miscellaneous.BitrateSelect SELECT
Transponder.HF.ISO_14443.TypeB.
ISO14443-AFI 4 8 1
SelectionMask.AFI
Transponder.HF.ISO_15693.Anticol Number of
E 4 4 1 4 1
lision.NoOfTimeslots Timeslots
Transponder.HF.ISO_15693.Miscell
Modulation 4 4 1 1 1
aneous.Modulation
BLOCKSIZE E 4 13 1 0 5
aneous.ReadOption.BlockSize
BLOCKSIZE-
aneous.ReadOption.BlockSizeSelec E 4 13 1 5 1
SELECTION
tion
READ-MODE E 4 13 1 6 2
aneous.ReadOption.ReadMode
WR-OPTION 4 6 1 2 2
aneous.WriteOption
Transponder.HF.ISO_15693.Selecti
4 5 1
onMask.AFI1
Transponder.HF.ISO_15693.Selecti
AFI E 4 4 1 5 1
onMask.Enable_AFI
Transponder.Miscellaneous.Identifie
IDDIB E 4 12 1
rInterpretationMode

IDENTIFICATION
Document: ID CPR70
Id-Nr. Document Version: H30121-2e-ID-B
Date: 07.06.2023
© Copyright
All cited brand names, product names, or trademarks belong to their respective holders.
FEIG ELECTRONIC GmbH

Industriestraße 1a
35781 Weilburg, Germany
Phone: +49 6471 3109-0
Homepage: https://www.feig.de/en/
Email: identification-support@feig.de

FEIG CPR70 Manual

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

FEIG CPR70 Manual

Uploaded by

Copyright:

Available Formats

IDENTIFICATION

Manual Page 2 of 231

Revision Date Chapter Description

Categorie Supported documents

Manual Page 3 of 231

ADR Address TS Timeslot

Manual Page 4 of 231

Manual Page 5 of 231

2 Technical conditions of the CPR70 11

2.1 Supported standards....................................................................................................... 11

3 Configuration (Parameter groups) 18

3.1 Information to the parameter groups (ISOStart) ............................................................ 18

3.6.4 Miscellaneous ........................................................................................................ 53

4.1 Reader Commands .......................................................................................................... 57

Manual Page 7 of 231

4.5.1 [0x02] Stay Quiet ................................................................................................. 108

Manual Page 8 of 231

4.12 [0xBC] Command Queue .............................................................................................. 181

5 Supported Host Commands 185

5.1 ISO14443A & B Part 4 compliant transponder............................................................. 185

Manual Page 9 of 231

5.4.18 Texas Instruments (Tag-it HFI Pro / Standard) ................................................... 214

6 ANNEX A: Codes of Transponder Types 217

7 ANNEX B: Codes of Reader Types 218

8 ANNEX C: Index of Status Bytes 219

9 ANNEX C1: Crypto Processing Error 221

10 ANNEX C2: Error-Codes 222

11 ANNEX D Examples for Read Data 223

12 ANNEX E Labeling of configuration parameter 224

Manual Page 10 of 231

2 Technical conditions of the CPR70

2.1 Supported standards

• ISO 18092 (Communication with NFC devices)

Method of data transmission Asynchronous (RS232) USB

• 1 x output LED OUT (electrical tap of the red LED)

2.4 Antennas on reader module

Manual Page 11 of 231

2.5 Types of Operating Modes

2.5.1 Host Mode (default)

• With this mode the reader operates fully host controlled.

• Read and write commands to the transponder are possible

• Manual multiplexing function

2.5.2 Auto Read Mode “Scan Mode”

• Scan mode is available via the

Manual Page 12 of 231

2.6 Command for reader configuration and reader control

2.7 Data Format and Protocol Frames

Supported protocol frames

• Advanced Protocol Frame

Manual Page 13 of 231

2.7.1 Standard Protocol Frame

Description of Standard Protocol Elements

Manual Page 14 of 231

2.7.2 Advanced Protocol Frame

• It uses a defined STX character.

Manual Page 15 of 231

Description of advanced Protocol Elements

2.7.3 Timing Conditions

Manual Page 16 of 231

2.7.4 CRC16 Calculation Algorithm

2.8 Example: Inventory for ISO15693

Manual Page 17 of 231

3 Configuration (Parameter groups)

3.1 Information to the parameter groups (ISOStart)