H11020-3e-ID-B

IDENTIFICATION
=== Ende der Liste für T extm arke Deckbl att ===
Manual
ID CPR30+
RFID Reader for ISO/IEC14443-A & -B,

NFC and ISO/IEC15693
Firmware Version 2.00.00
H11020-3e-ID-B
IDENTIFICATION
Note
Note
© Copyright by
FEIG ELECTRONIC GmbH

Industriestraße 1a
D-35781 Weilburg (Germany)
Tel.: +49 6471 3109-0
https://www.feig.de/en/
https://www.feig.de/en/service/
With the edition of this document, all previous editions become void. Indications made in this manual may be
changed without previous notice.
Copying of this document and giving it to others and the use or communication of the contents thereof are
forbidden without express authority. Offenders are liable to the payment of damages. All rights are reserved
in the event of the grant of a patent or the registration of a utility model or design.
Composition of the information in this document has been done to the best of our knowledge.
FEIG ELECTRONIC GmbH does not guarantee the correctness and completeness of the details given in this
manual and may not be held liable for damages ensuing from incorrect or incomplete information. Since,
despite all our efforts, errors may not be completely avoided, we are always grateful for your useful tips.
The instructions given in this manual are based on advantageous boundary conditions.
FEIG ELECTRONIC GmbH does not give any guarantee promise for perfect function in cross environments
and does not give any guarantee for the functionality of the complete system which incorporates the subject
of this document.
FEIG ELECTRONIC GmbH calls explicit attention that devices which are subject of this document are not
designed with components and testing methods for a level of reliability suitable for use in or in connection
with surgical implants or as critical components in any life support systems whose failure to perform can
reasonably be expected to cause significant injury to human health. To avoid damage, injury, or death the
user or application designer must take reasonably prudent steps to protect against system failures.
FEIG ELECTRONIC GmbH assumes no responsibility for the use of any information contained in this
document and makes no representation that they are free of patent infringement. FEIG ELECTRONIC GmbH
does not convey any license under its patent rights nor the rights of others.
Page 2 of 136
IDENTIFICATION ID CPR30+
General information
• If bits within one byte are filled with “-“ these bit spaces are reserved for future extensions or for
internal testing and manufacturing functions. These bit spaces must not be changed, as this may
cause faulty operation of the reader.
• The following figure formats are used:

0…9: for decimal figures,
0x00…0xFF for hexadecimal figures,
b0…1 for binary figures.
• The hexadecimal value in brackets “[ ]” marks a control byte (command)
Page 3 of 136
Content
Contents
1 Revision History of this documentation 8
2 Abbreviation 9
3 Introduction 10
4 Data Transmission between Reader and Host 11
4.1 Configuration and Control Commands (Host to Reader).............................................. 11

4.2 ISO Host Commands ....................................................................................................... 11
4.3 Protocol Frames .............................................................................................................. 14
4.3.1 Standard Protocol Frame ..................................................................................... 14
4.3.2 Advanced Protocol Frame (recommended to use) ............................................... 15
4.3.3 Protocol Elements ................................................................................................ 15
4.3.4 CRC16 Calculation Algorithm for Protocol Frames ............................................... 16
5 Configuration Parameters (CFG) 17
5.1 Structure of configuration parameter description......................................................... 18

5.2 CFG0: RFU (Reserved for Future Use) ........................................................................... 19
5.3 CFG1: Interface ................................................................................................................ 20
5.4 CFG2: Inputs / Outputs general ...................................................................................... 21
5.5 CFG3: RF-Interface .......................................................................................................... 23
5.6 CFG4: Transponder Parameters ..................................................................................... 26
5.7 CFG5: Anticollision ......................................................................................................... 28
5.8 CFG6 to CFG15: Reserved: ............................................................................................. 29
5.9 CFG16: Persistence Reset .............................................................................................. 30
6 Commands for Reader Configuration 31
6.1 [0x80] Read Configuration .............................................................................................. 31

6.2 [0x81] Write Configuration .............................................................................................. 32
6.3 [0x83] Set Default Configuration (Configuration RESET) ............................................. 33
7 Command for Reader Control 34

Page 4 of 136
7.1 [0x52] Baud Rate Detection ............................................................................................ 34

7.2 [0x63] CPU Reset ............................................................................................................. 35
7.3 [0x64] System Reset ........................................................................................................ 36
7.4 [x65] Get Software Version ............................................................................................. 37
7.5 [0x66] Get Reader Info..................................................................................................... 38
7.5.1 Mode = 0x00 (RF Controller Firmware) ................................................................ 39
7.5.2 Mode = 0x03 (RF-decoder information's) ............................................................. 40
7.5.3 Mode = 0x04 (Additional firmware functionality) ................................................... 41
7.5.4 Mode = 0x05 (Bootloader Version Information) .................................................... 42
7.5.5 Mode = 0x10 (Hardware Information) ................................................................... 43
7.5.6 Mode = 0x12 (CPU-Information)........................................................................... 44
7.5.7 Mode = 0x40 (CFG info for read permission)........................................................ 45
7.5.8 Mode = 0x41 (CFG info for write permission) ....................................................... 46
7.5.9 Mode = 0x80 (Device ID)...................................................................................... 47
7.5.10 Mode = 0xFF (Read all info modes) .................................................................. 48
7.6 [0x69] RF Reset................................................................................................................ 49
7.7 [0x6A] RF Output ON/OFF ............................................................................................... 50
7.8 [0x72] Set Output ............................................................................................................. 51
7.8.1 [0x72] Set Output Examples ................................................................................. 53
8 ISO Host Commands for Transponder Communication 54
8.1 [0xB0] ISO Standard Host Commands ........................................................................... 54

8.1.1 [0x01] Inventory.................................................................................................... 55
8.1.2 [0x25] Select ........................................................................................................ 62
8.1.3 [0x23] Read Multiple Blocks (extended Address Mode)........................................ 67
8.1.4 [0x23] Read Multiple Blocks ................................................................................. 69
8.1.5 [0x24] Write Multiple Blocks (extended Address Mode) ........................................ 71
8.1.6 [0x24] Write Multiple Blocks ................................................................................. 73
8.2 [0xB0] ISO 15693 Standard Host Commands ................................................................ 75
8.2.1 [0x02] Stay Quiet.................................................................................................. 75
8.2.2 [0x22] Lock Multiple Blocks .................................................................................. 76
8.2.3 [0x22] Lock Multiple Blocks (extended Address Mode) ......................................... 77
8.2.4 [0x26] Reset to Ready .......................................................................................... 79
Page 5 of 136
8.2.5 [0x27] Write AFI ................................................................................................... 80

8.2.6 [0x28] Lock AFI .................................................................................................... 81
8.2.7 [0x29] Write DSFI (ISO15693) .............................................................................. 82
8.2.8 [0x2A] Lock DSFID ............................................................................................... 83
8.2.9 [0x2B] Get System Information ............................................................................. 84
8.2.10 [0x2C] Get Multiple Block Security Status ......................................................... 89
8.3 [0xB0] ISO 14443 Standard Host Commands ................................................................ 90
8.3.1 [0xC0] Halt ........................................................................................................... 90
8.4 [0xB2] ISO14443 Special Host Commands .................................................................... 91
8.4.1 [0xBE] ISO 14443-4 T=CL.................................................................................... 92
8.4.2 [0xBF] ISO 14443-4 Container Command ............................................................ 96
8.4.3 [0x2B] ISO14443-4 Transponder-Info................................................................... 98
8.5 Special Commands for Transponder Communication .................................................. 99
8.5.1 [0xBD] ISO14443A Transparent Command.......................................................... 99
8.5.2 [0xBE] ISO14443B Transparent Command ........................................................ 107
8.5.3 [0xBF] ISO15693 Transparent Command .......................................................... 114
9 Supported ISO Host commands 116
9.1 ISO14443-A/B Part 4 compatible Transponder ............................................................ 116

9.1.1 Common Processorcards ................................................................................... 116
9.2 ISO15693 compatible Transponder .............................................................................. 117
9.2.1 Infineon (ISO Address mode) 0xE0 .................................................................... 117
9.2.2 Infineon (NLM0010/NLM0011) ........................................................................... 118
9.2.3 NXP (I-Code SLI) ............................................................................................... 119
9.2.4 NXP (ICODE SLIX2) .......................................................................................... 120
9.2.5 STMicroelectronics (LRI512) .............................................................................. 121
9.2.6 STMicroelectronics (LRI64) ................................................................................ 122
9.2.7 STMicroelectronics (M24LR16E-R) .................................................................... 123
9.2.8 STMicroelectronics (ST25DVxxK-IE/JF) ............................................................. 124
9.2.9 Texas Instruments (Tag-itTM HF-I Standard, Tag-itTM HF-I Pro) .......................... 126
10 ANNEX 127
10.1 ANNEX A: Codes of Transponder Types ..................................................................... 127
Page 6 of 136
10.2 ANNEX B: Codes of Reader Types ............................................................................... 128

10.3 ANNEX C: Index of Status byte .................................................................................... 129
10.4 ANNEX C2: Crypto Processing Error - ERROR-CODE ................................................ 131
10.5 ANNEX C3: Crypto Processing Error - ERROR-CODE ................................................ 132
10.6 ANNEX C4: Error-Code for ISO15693 Transponders .................................................. 133
10.7 ANNEX D: Examples for Read Data.............................................................................. 134
10.7.1 ISO-Host Command (DB-Size of the transponder = 4byte) ............................. 134
10.7.2 ISO-Host Command (DB-Size of the transponder = 8byte) ............................. 135
Page 7 of 136
1 Revision History of this documentation
Document
Revision Date Description
Version
0 2021-12-01 H11020-0e-ID-B Firmware Version: V1.09.00
1 2022-03-02 H11020-1e-ID-B Firmware Version: V2.00.00
Addition: [0x66] Get reader Info (Mode (0x03), (0x40), (0x41)
S.54 / Chapter 7-8.2 [0xA2] Write Mifare reader Keys
S. 56 / Chapter 8.1.2: [0xB0] ISO 15693 Standard Host Commands
S. 80 / Chapter 8.2: [0x26], [0x27], [0x28], [0x29], [0x2A], [0x2B], [0x2C],
[0x30] Mifare Value Commands
S. 94 / Chapter 8.4.1 [0xB0] Authent Mifare Classic
S. 96 / Chapter 8.4.2 NXP - Mifare classic: mini
S. 125 / Chapter
9.2.3:
Page 8 of 136
2 Abbreviation
ADR Address
AFI Application Family Identifier
ASK Amplitude Shift Keying
CB Config Block
CFG Configuration Parameter Block
CRC Cyclic Redundancy Check
DB Data Block
DIP Dual Inline Plastic
DRM Dense Reader Mode
EOF End of Frame
FIFO First in First out
frq Frequency
FSK Frequency Shift Keying
FWI Frame Waiting Time Integer
FWT Frame Waiting Time
h Hour
Hz Hertz
ID Identification
IDD Identifier Data
IN Input
LEN Length
LOC Location
LSB Least Significant byte
min Minutes
ms Milliseconds
MSB Most Significant byte
N Number
OUT Output
R/W Read / Write Access
RD Read
REL Relay
RF Radio Frequency
RSSI Received Signal Strength Indicator
RTC Real Time Clock
s / sec Seconds
SOF Start of Frame
TAB Table
TR Transponder
TS Timeslot
UID Unique Identifier (read-only Serial Number)
WO Write Only Access
WR Write
Table 1: Abbreviation
Page 9 of 136
3 Introduction
• The reader ID CPR30+ is a member of the ID CPR-reader family and is supporting passive
transponder IC’s according ISO/IEC 14443 type A and type B as well as transponder IC’s according
ISO/IEC 15693 and is able to communicate with NFC devices according ISO/IEC 18092.
• The ID CPR30+ can be used as a replacement for identical readers.
• Beneath the mentioned transponder ICs the firmware gives access to ISO14443 part 4 compliant
contactless smart cards as well as to a couple of different ISO 14443 Type B memory IC’s.
• Additional some reader models are available with 2 sockets for attachable Security Access Module
(SAM), which makes it even suitable for applications with high security requirements.
• This manual describes the functionality of the ID CPR30+.
• The ID CPR30+ can work in polling mode.
• The use of ISO-Host commands guarantees an easy creation of user software as well as the
module's compatibility with the other HF-reader.
• Beside the ISOStart+ software for demonstration and configuration the reader capabilities and the
Firmware Update Tool a lot of different Software Development Kits (SDK) and drivers are available
to support an easy integration into the customer’s application.
Page 10 of 136
4 Data Transmission between Reader and Host

Different ways of data transmission between FEIG-readers and host (terminal, PC) are possible. The ISO
Host Commands are used for the data exchange between transponder and host, whereas the Configuration
and Control Commands are for adapting the reader parameters to the individual requirements of the
applications.
4.1 Configuration and Control Commands (Host to Reader)

This method of data transmission is used for reader configuration and diagnostics.
The reader-configuration parameters will be stored in the reader memory. To store the current configuration
during a power down of the reader the reader configuration is stored in the EEPROM. After the reader was
powered up the configuration out of the EEPROM is used.
Figure 4-1: Configuration step and Control Commands (Host to Reader)
4.2 ISO Host Commands

The ISO Host Commands provide the exchange of data between a host and transponders via the reader if
the transponder remains in the detection range of the reader.
 NOTE:
During the writing of data on a transponder, it must be ensured that the transponder is located within the
detection range of the reader during the entire process. If the transponder is removed from detection range
of the reader during a writing process, this will cause a loss of data.
Page 11 of 136
The reader distinguishes between the following different addressing modes:

Addressed mode:
• Before reading or writing data in addressed mode, the UID of the transponder must be known. This
is executed by sending the Inventory command.
[0x01] Inventory.
If a transponder is located within the detection range of the reader at that time, it answers with its
UID. For all following read- / write orders the transponder must be addressed with its correct UID.
• The following flow diagram will show the necessary steps for the communication with a transponder
in “Addressed mode”:
Figure 4-2: Communication steps with a transponder in “Addressed mode”
Page 12 of 136
Select mode:
In this mode the reader communicates only with the one, selected transponder.
• Before reading or writing data in selected mode, the UID of the transponder should be known. This is
executed by sending at first the protocol. [0x01] Inventory
In a second step the transponder must be selected with the select command which must include its
UID. [0x25] Select
• The following flow diagram will show the necessary steps for the communication with a transponder
in selected mode:
Figure 4-3: Communication steps with a transponder in “Select mode”
Page 13 of 136
4.3 Protocol Frames

The communication between reader and connected host (terminal, PC, etc.) is executed by means of fixed
protocols. During data transfer the reader supplies the required data or a status byte. The reply contains the
transmitted command byte. There is no reply from the reader in case of a protocol frame failure.
The reader supports two different Protocol frames which are the standard and the advanced protocol frame.
The Host Application can choose which protocol frame is used.
• If the host application choses advanced protocol frame the reader will always response with
advanced protocol frame.
• If the host application choses the standard protocol frame the reader’s response will depend on the
Length of the response data.
• If the response contains more than 255 byte the reader chose the advanced protocol frame
otherwise the reader chose the standard protocol frame.
 NOTE:
• In this document only the REQUEST-PAYLOAD and the RESPONSE-PAYLOAD blocks without the
protocol frame are documented for each command.
• Optional parameters are documented in round brackets: “(optional)”.
4.3.1 Standard Protocol Frame
REQUEST PROTOCOL (Host)

REQUEST-PAYLOAD
1 1 1 (n) 2
Length COM-ADR COMMAND REQUEST- LSB / MSB
(n) DATA CRC16
RESPONSE PROTOCOL (READER)

RESPONSE-PAYLOAD
1 1 1 1 (n) 2
Length COM-ADR COMMAND STATUS REQUEST- LSB / MSB
(n) DATA CRC16
Figure 4-4: Standard Protocol Frame
Page 14 of 136
 NOTE:
For compatibility reasons, this frame is still supported. However, no new applications should use this frame
anymore. In SDK Gen3, the standard protocol frame is no longer supported.
4.3.2 Advanced Protocol Frame (recommended to use)
REQUEST PROTOCOL (HOST)

REQUEST-PAYLOAD
1 2 1 1 (n) 2
STX LSB / MSB COM- COMMAND REQUEST- LSB / MSB
(0x02) ALength ADR DATA CRC16
RESPONSE PROTOCOL (READER)

RESPONSE-PAYLOAD
1 2 1 1 1 (n) 2
STX LSB / MSB COM- COMMAND STATUS REQUEST- LSB / MSB
(0x02) ALength ADR DATA CRC16
Figure 4-5: Advanced Protocol Frame (recommended to use)
4.3.3 Protocol Elements
Field Description / Value
Length Number of bytes including Length and CRC16; (n = 6...255)
ALength Number of bytes including STX, ALength and CRC16; (n = 7...65535)
STX The STX sign (0x02) at the start of protocol indicates an Advanced Protocol-Frame.
0...254 address of device in bus mode

COM-ADR The reader can be addressed via COM-ADR 255 at any time if a RS232/485 interface is
available.
COMMAND Defines the Command which the reader should operate.
Page 15 of 136
Includes the status message or protocol data from or to the reader.

STATUS
ANNEX C: Index of Status byte
DATA is an optional data field with variable length. The number of DATA byte depends on the
DATA command. The data will be sent always as MSB first if the reader is in the ISO-Host Command
Mode.
Cyclic redundancy check of the protocol byte from 1 to n-2, as specified by CCITT-CRC16.
In case of USB communication the CRC16 value is not checked by the reader.
CRC16
Polynomial 0x8408 (x16 + x12 + x5 + 1 reversed)
Start Value 0xFFFF
4.3.4 CRC16 Calculation Algorithm for Protocol Frames
Polynomial x16 + x12 + x5 + 1 (reversed)  CRC_POLYNOM = 0x8408
Start Value 0xFFFF  CRC_PRESET = 0xFFFF
unsigned int crc = CRC_PRESET;
for (i = 0; i < cnt; i++) // cnt = number of protocol

byte without CRC
{
crc ^= DATA[i];
for (j = 0; j < 8; j++)
C-Example: {
if (crc & 0x0001)
crc = (crc >> 1) ^ CRC_POLYNOM;
else
crc = (crc >> 1);
}
}
Page 16 of 136
5 Configuration Parameters (CFG)

The configuration memory of the reader is organized in configuration blocks of 16 byte each. These are
divided into 14-byte configuration parameters and a 2-byte CRC16 checksum. Each of these configuration
blocks takes a number (CFG 0...CFG n).
Structure of a configuration block in reader configuration memory and reader EEPROM (CFG):
Byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Contents PARAMETER CRC16
Multiple configuration memory locations can be addressed by the value of the parameter CFG-ADR.
Commands for Reader Configuration
The parameters can be stored in two memory locations:
• RAM
• EEPROM (used for storing parameter over power down)
The EEPROM configuration blocks are protected by a 16-bit CRC-checksum. The examination of these
checksums is executed after each reset of the reader. If a faulty checksum is found, the reader goes into an
error status "EE-Init-Mode" and sets the configuration block which is faulty to the default values.
While the EE-Init-Mode is active, the LED blinks alternately red and green and the reader answers external
commands with the status "0x10 EEPROM Failure". The "EE-Init-Mode" can be exited now by a new reset
(cold start or 5.2. [0x63] CPU Reset command). If afterwards the checksums of all data records are correct,
the reader switches to the configured operation mode.
 NOTE:
Malfunctions may occur if parameters are configured outside their described range or if unspecified
parameters have been changed!
A firmware update resets the EEPROM to default settings and the reader goes into the
error status “EE-Init-mode”.
Page 17 of 136
5.1 Structure of configuration parameter description
Byte 0 1 2 ......n
Contents RAM-eff. EEPROM-eff. 00 res .....
not marked
Changing of this parameter becomes immediately effective after writing / saving this configuration
block to RAM
Grey marked
Changing of this parameter only becomes effective after writing / saving this configuration block to
EEPROM and a reader reset
marked with “00“

these bit or byte is reserved for future extensions or for internal testing and manufacturing-functions.
These bits or byte and any not described bits and byte must not be changed, as this may cause
faulty operation of the reader.
Page 18 of 136
5.2 CFG0: RFU (Reserved for Future Use)

The configuration block CFG0 is RFU.
Byte 0 1 2 3 4 5 6
Contents 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Default 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Byte 7 8 9 10 11 12 13
Default 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Page 19 of 136
5.3 CFG1: Interface

The parameters of the CFG1 configuration block contain the data communication settings.
Byte 0 1 2 3 4 5 6
TR-
Contents 0x00 0x00 0x00 0x00 0x00 0x00 RESPONSE-
TIME
Default 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Byte 7 8 9 10 11 12 13
TR-
READER -
Contents RESPONSE- 0x00 0x00 0x00 0x00 0x00
MODE
TIME
Default 0x3C 0x00 0x00 0x00 0x00 0x00 0x00
6 sec.
PARAMETER Description / Value Length

By means of this parameter the maximum duration for the transponder command can
be defined.
The TR-RESPONSE-TIME starts after the reader has received a new command. At
the latest after the TR-RESPONSE-TIME elapsed the reader will be sent an answer
protocol. In this case, the current commands between reader and transponder are
aborted.
max. response duration
TR-RESPONSE-
TR-RESPONSE-TIME 0...65535 * 100 ms 2
TIME
 NOTE:
• TR-RESPONSE-TIME has no effect on commands for reader configuration and
reader control.
• The block receive timeout of host computer must set to a value ≥ TR-
RESPONSE-TIME.
By means of this byte, the reader mode can be defined.

Only ISO Host mode is available
READER -MODE Bit 7 6 5 4 3 2 1 0 1
Function - - - - - - - -
Page 20 of 136
5.4 CFG2: Inputs / Outputs general

Via the following parameters the operation mode of the LED and the Buzzer can be configured individual
separate for offline / online conditions and tag-detect conditions.
Byte 0 1 2 3 4 5 6
Contents 0x00 0x00 ONLINE-MODE 0x00 0x00 0x00
Default 0x00 0x00 0x0001 0x00 0x00 0x00
Byte 7 8 9 10 11 12 13
TAGDETECT
OFFLINE-
Contents OFFLINE-MODE TAG DETECT-MODE ACTIVATION 0x00
DELAY
TIME
Default 0x0002 0x14 0x0005 0x04 0x00
2 sec. 400 ms
Parameter Description / Value Length

This Parameter defines the behaviour of the signal transmitters, if they are not
activated by any other event.
GRN / YEL / BUZZER:

Operation mode LED and Buzzer
15 14 13 12 11 10 9 8
Function - - - -
ONLINE-MODE Bit 7 6 5 4 3 2 1 0 2
Function - Yellow Green

Buzzer
The bit combination defines the behavior of the signal transmitter

b00: OFF
b01: ON
b10: FLASHING SLOW
This parameter defines the behavior of the signal transmitter, in case the reader has
detected an offline state. The following cases are possible:
Polling-Mode:
In case of polling mode the reader starts to signalize the offline state, if it has received
no command from the host for more than the time defined by the parameter
OFFLINE- OFFLINE-DELAY. 2
MODE
Page 21 of 136

GRN / YEL / BUZZER:
15 14 13 12 11 10 9 8
Function - - - -
Bit 7 6 5 4 3 2 1 0

Buzzer

b00: OFF
b01: ON
b10: FLASHING SLOW
This parameter defines the delay in 100 ms increments, after the reader will signalize
OFFLINE- the offline state if he had not received a command via his
1
DELAY asynchronous interface.
0 ... 255 x 100 ms → (0 ... 25,5 sec)
This parameter defines the behavior of the signal transmitter if a new transponder was
detected by the reader.
GRN / YEL / BUZZER:

15 14 13 12 11 10 9 8
Function: - - - -
TAGDETECT-
Bit 7 6 5 4 3 2 1 0 2
STATE

Buzzer

b00: OFF
b01: ON
b10: FLASHING SLOW
TAGDETECT- This parameter defines the duration in 100 ms increments, the reader signalizes a
ACTIVATION- transponder was detected. 1
TIME: 0 ... 255 x 100 ms → 0 ... 25,5 sec
Page 22 of 136
5.5 CFG3: RF-Interface

The parameters of the CFG3 configuration block contain global transponder driver and reader settings.
Byte 0 1 2 3 4 5 6
Contents TAG-DRV ISO14443-DRV 0x00 0x00 0x00
Default 0x0038 0x000E 0x00 0x00 0x00
Byte 7 8 9 10 11 12 13
Contents ISO14443 RF- 0x00 0x00 0x00 ISO14443 ISO14443
BIT RATE POWER STUPT FTUR
Default 0x00 0x00 0x00 0x00 0x00 0x03 0x1A
15 ms
TAG-DRV defines the transponder types that are operated by the reader.
Only those transponder drivers should be active that are used in the current
application. Thus, the reaction time of the reader for transponder read- / write-
operations is reduced and the danger of a parasitic transponder access is minimized.
A plausibility check is performed by writing this parameter to the reader. If an error

occurs the reader answers with STATUS = 0x11.
Byte 0 1
TAG-DRV 2
Bit 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Driver 0 0 0 0 0 0 0 0 0 0 F E D 0 0 0
Default 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0
b0: Driver for the transponder type is disabled
b1: Driver for the transponder type is activated
D: Driver for ISO15693
E: Driver for ISO14443A
F: Driver for ISO14443B
It defines the ISO 14443 transponder types that are read/write operated by the reader.
Reading of the UID is also possible if the driver is inactive, because of the
standardized ISO14443 access conditions.
If more than one transponder driver is activated The reader attempted by means of
some indications to decide about the transponder type.
To guarantee that the reader only processes the correct transponder type the not
required drivers should be disabled.
ISO14443- Byte 2 3
2
DRV Bit 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Driver 0 0 0 0 0 0 0 0 0 0 0 0 L4 C B 0
b0: Driver for the transponder type is disabled
b1: Driver for the transponder type is activated
B: Driver for my-d proximity SLE55Rxx
C: Driver for NFC Tag-Type 2 (e.g. Mifare Ultralight, my-d move, etc.)
L4: Driver for ISO14443A, Part 4 compatible transponders
ISO14443 This parameter defines the highest Bit Rate which should be used by the reader. The 1
BIT RATE actual used Bit Rate depends on the capabilities of the present transponder. If the
Page 23 of 136

adjusted Bit Rate is not support by the transponder the reader selects the highest
supported Bit Rate of the transponder.
Bit 7 6 5 4 3 2 1 0
Function TX-BIT RATE RX-BIT RATE - - - -
RX-BIT RATE:
Used for bit rate selection from transponder to reader
b00: 106 kbit / s
TX-BIT RATE:
Used for bit rate selection from reader to transponder
b00: 106 kbit / s
Defines the RF output power.

RF-POWER 0x00 = Standard power 1
0x01 = High power
The Startup Time defines a delay-time which is required by a ISO14443 transponder

for
startup after the RF-Field was switched on (e. g. after a command [0x69] RF Reset).
(1 ... 255 * 5 ms → (5 ms ... 1,275 sec)
ISO14443
1
STUPT  NOTE:
The value of ISO14443 STUPT must be considered for calculating the TR-
RESPONSE-TIME
CFG1: Interface
In this parameter byte are some special features combined.

Bit 7 6 5 4 3 2 1 0
Function UID- ORDER OPTI ERROR_RETRY PLIC BSLCT
BSLCT: (only ISO 14443B transponder)

This bit selects the response behavior for ISO 14443B transponder with Bit Rates
above 106 kBit / s.
The reader principally uses 106 kBit / for the first communication cycle. If the
transponder supports a higher Bit Rate and this is configured by the parameter
ISO14443 ISO14443 Bit Rate the reader selects the highest possible Bit Rate. The reception
from the transponder could be on 106 kBit/s or on the new higher Bit Rate. 1
FTUR
b0: The first reception after a Bit Rate change is expected with 106 kBit/s.
b1: The first reception after a Bit Rate change is expected with the selected
higher Bit Rate.
PLIC: (only ISO 14443-4 transponder)

This bit enables the power level indicator check function of the reader.
b0: Power level check is disabled
b1: Power level check is enabled. The power level indicator of ISO 14443-4
transponders will be interpret-ed by the reader if it is supported by the
transponder. If a transponder response indicates insufficient power the
reader breaks the present command and sends an error status.
Page 24 of 136
ERROR_RETRY: (only ISO 14443-4 transponder)

This parameter defines the maximum number of automatic retry loops in case of
transmission or protocol errors as described in ISO 14443-4.
b00: disables retry loop
b01: 1 retry loop
b10. 2 retry loops
b11: 3 retry loops
OPTI: (only ISO14443A transponder)

By means of this bit some optional information could be displayed for ISO14443A in
the [0x01] inventory response byte OPT_INFO.
[0x01] Inventory.
b0: The OPT_INFO byte in [0x01] inventory response is always set to 0.

b1: The OPT_INFO byte in [0x01] inventory response includes further
Information.
UID_ORDER: (only ISO14443A transponder)

By means of this bit the byte order of the UID of ISO14443A transponder can be
swapped.
b0: The UID will be transferred as described in

Response-Data - ISO 14443A (TR-TYPE = 0x04)
b1: The byte order of the transferred UID will be swapped (UID transfer will
be carried out like described in ISO14443).
Page 25 of 136
5.6 CFG4: Transponder Parameters

The parameters of the CFG4 configuration block contain general transponder settings.
byte 0 1 2 3 4 5 6
ISO15693- ISO15693- ISO15693-
Contents 0x00 0x00 0x00 0x00
MODE AFI OPTION
Default 0x00 0x00 0x00 0x00 0x10 0x00 0x00
byte 7 8 9 10 11 12 13
ISO14443B- ISO15693
Contents 0x00 0x00 0x00 0x00 0x00
AFI BLOCK SIZE
Default 0x00 0x00 0x00 0x00 0x00 0x00 0x04
(only ISO15693 Transponders)

Bit 7 6 5 4 3 2 1 0
Function 0 0 AFI NO-TS 0 0 RF-MOD 0
RF-MOD:
b0: 100% modulation
ISO15693- b1: 20% modulation 1
MODE
NO-TS:
b0: 16 timeslots
b1: 1 timeslot
Anticollision is only possible if NO-TS=16.
AFI:
b0: disabled
b1: enabled
ISO15693- (only ISO15693 Transponders)

1
AFI Application Family Identifier to select a transponder
(only ISO15693 Transponder)

Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 WR-OPTION 0 0
WR-OPTION:
ISO15693- b00: automatically set 1
OPTION b10: Tag Option = 0
b11: Tag Option = 1
 NOTE:
If WR-OPTION is automatically set, the reader sets the WR-OPTION t= 0,
if the ISO-Host Command is in “non-addressed mode”.
ISO14443B- (only ISO14443B Transponders)

1
AFI
Page 26 of 136

Application Family Identifier for ISO14443 type B transponder. For more information's re-fer
to ISO14443-3.
Bit 7 6 5 4 3 2 1 0
Function Read Mode Block size DB-Block size
DB-Block size:
Defines the block size of an ISO-transponder which is not listed in the MFR or if the
transponder is used in the non-addressed mode.
ISO15693- Range: 0x01 ... 0x1F
1
BLOCK SIZE A value of 0x00 will be automatically set to a block size of 4 byte.
Block size:
b0: Automatic (If transponder is known)
b1: Manuel (As specified in DB-Block size)
Read Mode:
b00: Automatic Mode (If transponder is known)
b01 Single Read
b10 Multiple Read
Page 27 of 136
5.7 CFG5: Anticollision

The parameters of the CFG5 configuration block contain anticollision settings.
byte 0 1 2 3 4 5 6
Default 0x00 0x00 0x00 0x00 0x00 0x00 0x00
byte 7 8 9 10 11 12 13
Contents 0x00 0x00 0x00 0x00 ONT 0x00 0x00
Default 0x00 0x00 0x00 0x00 0x0D 0x00 0x00
Parameter Description / Value

This parameter configures the reply behavior of the Inventory command [0x01]. It defines which
transponder will reply to the host.
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 AORB_REQ ACOLL 0 0
ACOLL:
This bit activates Anticollision Mode. In Anticollision Mode the reader automatically sets transponder-
specific communication parameters.
If more than one transponder of the same type is in the detection range the reader replies an error
status.
b0: disabled
In this case the reader doesn’t process any anticollision procedure with the transponders
inside the antenna field. If anticollision is disabled, the reader automatically selects the
ONT transponder. The Select command [0x25] is not necessary for further communication with
the transponder.
b1: enabled (default)

In this case the reader processes the anticollision procedure with the
transponders inside of the antenna field and replies the UID of all detected
transponders.
AORB_REQ:
This parameter defines the abort conditions of the Inventory command [0x01] for ISO14443
Transponder if the ISO14443A and ISO14443B Transponder drivers are activated.
b0: disabled (default)

The Inventory command runs while not all UIDs of ISO14443A and ISO14443B
Transponders in the detection range are read.
b1: The Inventory command stops if the UID of all ISO14443A or ISO14443B
Transponders have been detected.
Page 28 of 136
5.8 CFG6 to CFG15: Reserved:
Page 29 of 136
5.9 CFG16: Persistence Reset

The parameters in CFG16 are used to configure the timing conditions when the reader performs
self-initiated a reset of the RF antenna field.
byte 0 1 2 3 4 5 6
Contents 0x00 0x00 PER-RESET-TIME-ANT 0x00 0x00 0x00
Default 0x00 0x00 0x0000 0x00 0x00 0x00
0 x 5ms = 0ms
byte 7 8 9 10 11 12 13
Default 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Parameter Description / Value

The timer value specifies a time which determines the reset of the RF field by the reader. The timer PER-
RESET-TIME-ANT starts after the reader gets a response at the antenna. After this time has expired the
PER-RESET- reader resets the RF-Field.
TIME-ANT Timer ticks = 5ms
Maximum timer value = 5ms x 65534 / [0xFFFE] = 5,46125 min.
The value 65535 [0xFFFF] indicates that no RF-Reset is performed by the reader
Page 30 of 136
6 Commands for Reader Configuration

Via the command protocols for the reader configuration, the reader may be adapted to individual conditions
of application within wide limits.
6.1 [0x80] Read Configuration

Command “Read Configuration” detects the current configuration of the reader.
Configuration is read in blocks of 14 byte each and addressed by CFGn in the byte CFG-ADR.
Summary REQUEST-PAYLOAD
Field Description / Value Length
COMMAND 0x80 Read Configuration 1
LOC, Specifies the location of the configuration block.
CFG-ADR 1
CFGn: Memory address of the required configuration block.
Summary RESPONSE-PAYLOAD
COMMAND 0x80 Read Configuration 1
STATUS Includes the status message or protocol data from or to the reader. 1
ANNEX C: Index of Status byte
CFG-REC 14-byte configuration block read from address CFGn in CFG-ADR. 14
Details REQUEST-PAYLOAD
COMMAND 0x80 Read Configuration
Bit 7 6 5 4 3 2 1 0
Function LOC 0 CFGn: Address of Configuration Block
CFGn:
Memory-address of the required configuration block.
CFG-ADR LOC:
Specifies the location of the configuration block.
b0: RAM
b1: EEPROM
 NOTE:
A read configuration from EEPROM with reserved configuration blocks will cause an
0x15 error code.
Details RESPONSE PAYLOAD

COMMAND 0x80 Read Configuration
STATUS Status message from the reader. ANNEX C: Index of Status byte
CFG-REC: 14-byte configuration block read from address CFGn in CFG-ADR.
Page 31 of 136
6.2 [0x81] Write Configuration

Command “Write Configuration” changes the current reader configuration. The configuration memory is
written with 14 byte blocks and addressed by CFGn in the byte CFG-ADR.
Configuration Parameters (CFG)
COMMAND 0x81 Write Configuration 1
CFG-ADR LOC: Specifies the location of the configuration block. 1

CFGn: Memory-address of the required configuration block.
CFG-REC: 14-byte configuration block read from address CFGn in CFG-ADR. 14
COMMAND 0x81 Write Configuration 1
STATUS Status message from the reader. ANNEX C: Index of Status byte 1
COMMAND 0x81 Write Configuration
Bit 7 6 5 4 3 2 1 0
Function LOC 0 CFGn: Address of Configuration Block
CFG-ADR CFGn:
LOC:
b0: RAM
b1: EEPROM
CFG-REC 14-byte configuration block stored in the configuration memory of the reader at address CFGn in
CFG-ADR.
Details RESPONSE-Payload
COMMAND 0x81 Write Configuration
 NOTE:
A write configuration to EEPROM with reserved configuration blocks will cause an 0x16 error code.
Page 32 of 136
6.3 [0x83] Set Default Configuration (Configuration RESET)

Using the command Set Default Configuration. Each configuration block can be reset to the default setting.
COMMAND 0x83 Set Default Configuration (Configuration RESET) 1
CFG-ADR See Details REQUEST-PAYLOAD 1
COMMAND 0x83 Set Default Configuration (Configuration RESET) 1
COMMAND 0x83 Set Default Configuration (Configuration RESET)
Bit 7 6 5 4 3 2 1 0
Function LOC MODE CFGn
CFGn:
MODE:
Specifies one or all configuration blocks.
CFG-ADR b0: configuration block specified by CFGn
b1: all configuration blocks
LOC:
b0: RAM
b1: EEPROM
 NOTE:
A set default configuration with reserved configuration blocks will cause an error code.
Details RESPONSE-PAYLOAD
COMMAND 0x83 Set Default Configuration (Configuration RESET)
Page 33 of 136
7 Command for Reader Control

7.1 [0x52] Baud Rate Detection
This protocol serves to determine the actual baud rate of the reader's asynchronous interface.
COMMAND 0x52 Baud Rate Detection 1
0x00 Reserve 1
COMMAND 0x52 Baud Rate Detection 1
0x00 Reserve 1
Page 34 of 136
7.2 [0x63] CPU Reset

This protocol allows you to reset the CPU on the reader.
COMMAND 0x63 CPU Reset 1
COMMAND 0x63 CPU Reset 1
 NOTE:
The RF-field will be switched off while a CPU Reset.
Page 35 of 136
7.3 [0x64] System Reset

This protocol allows you to reset the RF-Decoder and the RF Controller.
COMMAND 0x64 System Reset 1
MODE Defines Controller which will be reset. 1
COMMAND 0x64 system Reset 1
COMMAND 0x64 System Reset
Defines Controller which will be reset.

MODE MODE Controller
0 RF-Controller
COMMAND 0x64 System Reset
Page 36 of 136
7.4 [x65] Get Software Version

This protocol allows you to determine the software version of the reader, its type and the types of the
transponders which are supported by the software.
COMMAND 0x65 Get Software Version 1
COMMAND 0x65 System Reset 1
SW-REV Version of the firmware 2
D-REV Revision status of the firmware 1
HW-TYPE Displays options configuration pin value (internal use) 1
SW-TYPE Displays the type / model of the reader. ANNEX B: Codes of Reader Types 1
Displays the transponders supported by the reader

Bit 15 14 13 12 11 10 9 8
Function: - - - - - - - -
TR-TYPE 2
Bit 7 6 5 4 3 2 1 0
ISO ISO ISO
Function: - - - - -
14443B 14443A 15693
RX-BUF is the maximum receive buffer size of the reader. If a protocol from the host
RX-BUF exceed the RX-BUF size the reader response with error code 2
0x81 PROTOCOL Length ERROR.
TX-BUF is the maximum transmit buffer size of the reader. The host have to check
TX-BUF 2
whether the length of the response protokol corresponds to the permitted length.
No entry!
Page 37 of 136
7.5 [0x66] Get Reader Info

This protocol allows you to determine, a lot of Firmware and hardware options and version from the reader.
Most information's are only required for service and support questions.
COMMAND 0x66 Get Reader Info 1
Via the Parameter MODE different information could be requested from the
MODE 1
reader.
Data record according to the definition in previous sections.

DATA The data record is always 30 byte long. 30
Unused byte must be filled with 0x00.
COMMAND 0x66 Get Reader Info
Via the Parameter MODE different information could be requested from the reader.
0x00: General hard- and firmware information
0x03: RF-decoder information's for factory diagnostic
0x04: Additional firmware functionality
0x05: Bootloader version information.
0x10: Hardware Information

MODE
0x12: CPU Information
0x15: RF-Stack firmware version
0x40: CFG info for read permission
0x41: CFG info for write permission
0x80: Device-ID: Information's for firmware updates and firmware upgrades.
0xFF: Read all info modes
Page 38 of 136
7.5.1 Mode = 0x00 (RF Controller Firmware)

Version of the firmware. Forms the first two digits of the three digits firmware
SW-REV 2
number (e.g. 02.10.00).
Revision status of the firmware. Forms the last digit of the three digits firmware
D-REV number. “00” indicates that the firmware is released, whereas ≥ “129” indicates that 1
the firmware is a release candidate (e.g. 02.10.00).
HW-TYPE Displays options configuration pin value (internal use) 1
SW-TYPE Displays the type / model of the reader. ANNEX B: Codes of Reader Types 1
TR-Type Displays the transponders supported by the reader. 2
RX-BUF is the maximum receive buffer size of the reader. If a protocol from the
RX-BUF host exceed the RX-BUF size the reader response with error code 0x81 2
PROTOCOL Length ERROR.
TX-BUF is the maximum transmit buffer size of the reader. The host have to check
TX-BUF 2
whether the length of the response protocol corresponds to the permitted length.
reserved Always 0x0000 2
RDR- Revision of the reader.
1
REVISION
RDR- Assembly of the reader.
1
ASSEMBLY
Page 39 of 136
7.5.2 Mode = 0x03 (RF-decoder information's)

Information's about the functionality and revision of the RF-decoder for service and
DEC_TYPE 2
support.
This byte gives information about the self-test result, which is performed
automatically by the reader after a power on reset.
SELF_TST 0x00: Self-test not OK 1
The reader has detected an internal failure.
0x01: Self-test OK.
<RFU>
Page 40 of 136
7.5.3 Mode = 0x04 (Additional firmware functionality)

COMMAND 0x04 (Additional firmware functionality) 1
TEMPLATE
Indicates how to interpret the following content depending on the 1
reader type 0x01 (ID CPR-Family)
Each bit represents a firmware functionality.
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 0 0 0 TCL
FNC_LST0 1
TCL:
Indicates the support of the T=CL Function (Command [0xB2], [0xBE])
b0: T=CL function is not supported
b1: T=CL function is supported
Page 41 of 136
7.5.4 Mode = 0x05 (Bootloader Version Information)

COMMAND 0x05 (Bootloader Version Information) 1
BL_VERSION Bootloader Version 1
BL_REF Revision of Bootloader Version 1
Page 42 of 136
7.5.5 Mode = 0x10 (Hardware Information)

COMMAND 0x05 (Bootloader version information) 1
HW INFO Information on the hardware 2
D-HW internal use 2
A-HW internal use 2
FREQUENCY Flags for supported frequencies. See FREQUENCY 1
PORT TYPE Flags for supported communication ports. See PORT-TYPE 1
Reserved - 3
Bit 7 6 5 4 3 2 1 0
Function HF 0 0 0 0 0 0 EU
FREQUENCY EU: 1
b0: EU frequencies not supported
b1: EU frequencies supported
HF:
b0: HF not supported
b1: HF supported
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 USB 0 0 0 0
PORT-TYPE 1
USB:
b0: USB not supported
b1: USB supported
Page 43 of 136
7.5.6 Mode = 0x12 (CPU-Information)

COMMAND 0x12 (CPU-Information) 1
MANU-
CPU manufacturer code 1
FACTURER
CPU-TYPE Type of CPU. Depends on the manufacturer 2
REVISION Revision of the CPU 1
FLASH-SIZE Size of the flash memory of the CPU in kilobytes 4
Page 44 of 136
7.5.7 Mode = 0x40 (CFG info for read permission)

Every bit marks the permission to read.
The flag fields are independent of configurable password protection
NO_OF_
No. of available CFG pages. 2
PAGES
PERMISSION x
NO_OF_
PAGES
Byte 7
Bit 7 6 5 4 3 2 1 0
CFG_NO 0 1 2 3 4 5 6 7
Byte 8
PERMISSION Bit 7 6 5 4 3 2 1 0
x
CFG_NO 8 9 10 11 12 13 14 15
Byte 9
Bit 7 6 5 4 3 2 1 0
CFG_NO 16 17 18 19 20 21 22 23
Page 45 of 136
7.5.8 Mode = 0x41 (CFG info for write permission)

Every bit marks the permission to write.
The flag fields are independent of configurable password protection
NO_OF_
PAGES
PERMISSION x
NO_OF_
PAGES
Byte 7
Bit 7 6 5 4 3 2 1 0
CFG_NO 0 1 2 3 4 5 6 7
Byte 8
PERMISSION Bit 7 6 5 4 3 2 1 0
x
CFG_NO 8 9 10 11 12 13 14 15
Byte 9
Bit 7 6 5 4 3 2 1 0
CFG_NO 16 17 18 19 20 21 22 23
Page 46 of 136
7.5.9 Mode = 0x80 (Device ID)

COMMAND 0X80 (Device ID) 1
DEV_ID Individual device identifier of the reader. 4
CUSTOM_L Indicates which customer firmware is licensed on the reader. 4
FW_L Indicates which Firmware version is licensed on the reader. 2
TR_DRV_L Indicates which transponder drivers are licensed on the reader. 2
FNC_L Indicates which optional functions are licensed on the reader 2
Page 47 of 136
7.5.10 Mode = 0xFF (Read all info modes)

Return of all Info records in one response.
COMMAND 0xFF (Read all info modes) 1
DATASETS Number of data sets to be transferred from the reader to the host 1
MODE Mode byte (Length 1 byte) 1
DATASETS
Repeated
times
Data record according to the definition in previous sections.
DATA The data record is always 30 byte long. 30
Unused byte must be filled with 0x00 (Length 30 byte)
Page 48 of 136
7.6 [0x69] RF Reset

The RF-field of the reader antenna can be switched off for trf = 15 ms by the command RF Reset. Thus, all
transponders which are within the antenna field of the reader will be reset to their base setting.
COMMAND 0x69 RF Reset 1
COMMAND 0x69 RF Reset 1
 NOTE:
• After the RF Reset command the reader is not able to receive any new transponder before
expiration of trf.
• After a RF Reset a transponder which is located within the field must be reselected.
Page 49 of 136
7.7 [0x6A] RF Output ON/OFF

The command RF ON/OFF switches the RF field of the reader antenna ON or OFF.
COMMAND 0x6A RF Output ON/OFF 1
RF_OUTPUT Set one of the antenna outputs. 1
COMMAND 0x6A Write Configuration 1
Set one of the antenna outputs.

Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 0 ANT
ANT:
RF_OUTPUT 1
This parameter could be used to select one antenna.
b000: switches off RF power at all antennas.
b001: switches on the RF power at antenna 1.
This setting is to use, if the reader has only one internal or one external
antenna.
Page 50 of 136
7.8 [0x72] Set Output

The command Set Output serves temporary limited or unlimited activation of the outputs of the reader.
Each output takes on the state defined by the byte OUTx-mode for the period of time (OUT-TIME) included
in the protocol. Via this protocol the outputs can be switched on or off for the indicated period of time. If the
reader receives a command Set Output, all times that have been active until then are being overwritten by
the new times included in the protocol if they are > 0.
COMMAND 0x72 Set Output 1
MODE Shoul1 always be 0x01. 1
OUT-N Defines the number of output records. 1
OUT-NR Defines type and number of the output. 1
OUT-N times
OUT-S (Output State) defines the status of the output during the time
Repeated
OUT-S defined in OUT-TIME and provides the possibility to allocate its own 1
flashing-frequency to each output.
By the values defined by “OUT-TIME” the outputs can be activated
OUT-TIME 2
temporary limited or unlimited.
COMMAND 0x72: Set Output 1
MODE 0x01
OUT-N Defines the number of output records.

Defines type and number of the output.
Bit 7 6 5 4 3 2 1 0
Function: OUT-Typ 0 OUT-Number
OUT-TYP:
OUT-NR b 001 LED
b 010 Buzzer
OUT-NUMBER:
b 001 LED green
b 010 LED yellow
OUT-S (Output State) defines the status of the output during the time defined in OUT-
TIME and provides the
OUT-S possibility to allocate its own flashing-frequency to each output.
Bit 7 6 5 4 3 2 1 0
Function: 0 0 0 0 0 0 OUTx-mode
Page 51 of 136

OUTx-mode:
b 00: OFF
b 01: ON
b 10: FLASHING SLOW
b 11: FLASHING FAST
By the values defined by “OUT-TIME” the outputs can be activated temporary limited or
unlimited.
Accepted are the time values 0 and 65535 (0xFFFF)
0x0001 1 x 100ms -> 100ms
OUT-TIME
...
...
0xFFFE 65534 x 100ms -> 1:49:13 h
0xFFFF continuously active
 NOTE:
• To reset a continuously active time, OUT-TIME = 1 has to be sent to the reader, which effects a change
to the idle status after 100 ms.
• The continuous activation is being set back after a reset or a power failure.
Page 52 of 136
7.8.1 [0x72] Set Output Examples

Example No. 1:
LED1 is alternating fast for 500 ms.
LED2 is not activated for 200 ms.
LED3 and RELAY are unchanged
BUZZER is activated for 1000ms
OUT-N OUT-NR OUT-S OUT-TIME

0x0003 0x21 0x03 0x0005
 OUT-NR OUT-S OUT-TIME
0x22 0x00 0x0002
 OUT-NR OUT-S OUT-TIME
0x41 0x01 0x000A
Page 53 of 136
8 ISO Host Commands for Transponder Communication

In the following chapters the Host commands for communication with a transponder are described. Notice
that not all commands are available for each transponder type. Detailed information about the supported ISO
Host commands are described for each transponder type separate, in chapter 9 Supported ISO Host
commands.
8.1 [0xB0] ISO Standard Host Commands

This command sends standard RF commands to the transponder.
COMMAND 0xB0 ISO Standard Host Commands 1
REQUEST-DATA Command specific request n
COMMAND 0xB0 ISO Standard Host Commands 1
RESPONSE-DATA Command specific response n
 NOTE:
Data are only transferred if STATUS = 0x00, 0x83, 0x94, 0x95
Page 54 of 136
8.1.1 [0x01] Inventory

This command reads the UID of all transponders inside the detection range. The reply behavior of this
command can be configured by the Anticollision parameter of configuration block 5.7
CFG5: Anticollision
COMMAND 0x01 Inventory 1
Bit 7 6 5 4 3 2 1 0
Function MORE - - - - - - -
MORE:
this bit can be used, to read out the whole UIDs, after the reader had signalized more
MODE data sets with status 0x94 (see: ANNEX C: Index of Status byte). 1
b0: new Inventory requested
The reader carries out a new inquiry, which transponder are in it
detection range.
b1: more data requested
The reader response contain the UIDs which are not transferred with the
last response because of the status 0x94.
Details RESPONSE-DATA:
Depending on the transponder type the response data of the reader is different as described in the following
chapters.
Response-Data - ISO 14443A (TR-TYPE = 0x04)
Response-Data - ISO 14443B (TR-TYPE = 0x05)
Response-Data – ISO15693 (TR-TYPE = 0x03)
Page 55 of 136
8.1.1.1 Response-Data - ISO 14443A (TR-TYPE = 0x04)

Response data of ISO 14443 Type A compliant transponder
Details RESPONSE-DATA
Case CFG3. ISO14443 FTUR.OPTI = b0 → OPT_INFO is disabled

DATA- Number of transponder data sets to be transferred in this reader response.
SETS
TR-TYPE Displays the transponder type of the present transponder. 1
only ISO 14443 A transponder:
This byte includes some information from the SAK byte as described in ISO14443-3.
In case of NXP Mifare IC’s this byte also indicates the chip type. Further information are given in the
NXP Application "Mifare Interface Platform, Type Identification Procedure" M018412.
Bit 7 6 5 4 3 2 1 0
Function - - L4 - - CL3 - -
TR_INFO CL3: 1
Displays the UID Length of the present transponder.
b0: The UID is transmitted as a 7 byte field (transponder with Cascade Level 1 or 2)
b1: The UID is transmitted as a 10 byte field (transponder with Cascade Level 3)
Repeated DATA-SETS times

L4:
Displays the compliance of the transponder with ISO 14443-4 according ISO 14443-3,
SAK, b6
b0 Not compliant with ISO 14443-4
b1 Compliant with ISO 14443-4
14443A UID could have different lengths. This depends on the Cascade Level of the
transponder (see also TR_INFO byte). It is transmitted by the reader with a Length of 7 or 10 byte.
transmitted byte 9 10 11 12 13 14 15 16 17 18
Cascade-Level 1 0 0 0 UID3 UID2 UID1 UID0 - - -
Cascade-Level 2 UID6 UID5 UID4 UID3 UID2 UID1 UID0(* - - -
Cascade-Level 3 UID9 UID8 UID7 UID6 UID5 UID4 UID3 UID2 UID1 *
UID UID0 8/10
* UID0: Manufacturer ID according ISO/IEC7816-6/AM1
In case of a shorter UID the redundant bytes are filled with 0 at the most significant digits.
 NOTE:
The UID byte order can be swapped by using the
parameter CFG3.ISO14443 FTUR.UID_ORDER
Page 56 of 136
Case CFG3. ISO14443 FTUR.OPTI = b1  OPT_INFO is enabled

DATA- Number of transponder data sets to be transferred in this reader response.
1
SETS
only ISO 14443A Transponder):
This byte include some information from the SAK byte as described in ISO14443-3.
In case of NXP Mifare IC’s this byte also indicates the chip type. Further information's are given in
the NXP Application NOTE: "Mifare Interface Platform, Type Identification Procedure" M018412.
Bit 7 6 5 4 3 2 1 0
Function - - L4 - - CL3 - -
TR_INFO CL3: 1
Displays the UID Length of the present transponder.
b0: The UID is transmitted as a 7 byte field (transponder with Cascade Level 1 or 2)
b1: The UID is transmitted as a 10 byte field (transponder with Cascade Level 3)
L4:

Displays the compliance of the transponder with ISO 14443-4 according ISO 14443-3,
SAK, b6
b0 Not compliant with ISO 14443-4
b1 Compliant with ISO 14443-4
(only ISO 14443A Transponder):
Depending on the setting of CFG3.ISO14443 FTUR.OPTI this byte could optional display
further information's about the present transponder.
It's recommend to use this information if ISO14443-4 Transponder or transponder with more the 4
byte UID Length should be handled by the reader.
Bit 7 6 5 4 3 2 1 0
Function - - - - - L4_SLCT C_LEVEL
OPT_INFO C_LEVEL: 1
This two bits displays the Cascade Level of the transponder UID
b00: Cascade Level 1 (4 byte UID)
L4_SLCT:
This bit displays the select status of the present transponder.
b0: The transponder is not selected in ISO14443-4 level.
b1: The transponder is selected on ISO14443-4 level by the reader now. A further
select command is not necessary for data exchange with this transponder.
Page 57 of 136

14443A UID could have different engths. This depends on the Cascade Level of the
transponder (see also TR_INFO byte). It is transmitted by the reader with a Length of 7 or 10 byte.
transmitted byte 9 10 11 12 13 14 15 16 17 18
Cascade-Level 1 0 0 0 UID3 UID2 UID1 UID0 - - -
Cascade-Level 2 UID6 UID5 UID4 UID3 UID2 UID1 UID0(* - - -
UID
Cascade-Level 3 UID9 UID8 UID7 UID6 UID5 UID4 UID3 UID2 UID1 UID0* 7or10
* UID0: Manufacturer ID according ISO/IEC7816-6/AM1
In case of a shorter UID the redundant bytes are filled with 0 at the most significant digits.
 NOTE:
The UID byte order can be swapped by using the
parameter CFG3.ISO14443 FTUR.UID_ORDER
Page 58 of 136
8.1.1.2 RESPONSE-DATA - ISO 14443B (TR-TYPE = 0x05)

Details RESPONSE-DATA of ISO 14443 Type B compliant transponder:
DATA-SETS Number of transponder data sets to be transferred in this reader response. 1
This parameter is extracted from the protocol Info byte as described in ISO14443-3
Bit 7 6 5 4 3 2 1 0
Function Max Frame Size Protocol Type
Protocol Type:
According ISO14443-3:2001)

7 6 5 4 Meaning
0 0 0 1 PICC compliant with ISO/IEC 14443-4
PROTO INFO 1
0 0 0 0 PICC not compliant with ISO/IEC 14443-4
Max Frame Size:

According ISO14443-3:2001)
Value 0 1 2 3 4 5 6 7 8 9-F
Frame Size 16 24 32 40 48 64 96 128 256 RFU > 256
(byte)
4 byte Application Date according ISO 14443-3:2001

1 2 3 4
APP DATA 4
AFI CRC_B (AID) Number of Applications
4 byte Pseudo-Unique PICC Identifier, according ISO 14443-3:2001. This information is required
PUPI: 4
to select the transponder.
Page 59 of 136
8.1.1.3 Response-Data – ISO15693 (TR-TYPE = 0x03)

Response data of ISO 15693 compliant transponder:
Details RESPONSE-DATA (standard)
DATA-SETS Number of transponder data sets to be transferred in this reader response.
Bit 7 6 5 4 3 2 1 0
Function RF_TEC - - TYPE_NO

TYPE_NO:
TR-TYPE Displays the transponder type of the present transponder 1
ANNEX A: Codes of transponder Types
RF_TEC:
Indicates the RFID - Technology of the present transponder:
b00: 13,56 MHz transponder
DSFID (only ISO15693Transponders), Data Storage Family Identifier. 1
UID ISO 156963 UID. It is transmitted by the reader with a Length of 8 byte 8
Page 60 of 136
8.1.1.4 Sequences of Inventory Command and ISO14443 Transponder

The following chart displays the sequences and effects after an Inventory command depending on the
transponder type and the reader configurations.
[0x01] inventory
no
Anticollision disabled
Response 1
(CFG5.ONT.ACOLL)
yes
ISO14443-A yes
Transponder
no
yes driver for no

ISO 14443-B
ISO14443A-4 enabled?
Transponder
(CFG3.ISO14443A_DRV.L4)
yes
ISO14443-4 no
suppored by Response 2
Transponder
yes
Response 3
Transponder(s) No of announced
next possible commands
are selected transponder
Response 1 no > 1 (possibly) [0x25] Select
yes Proprietary or standard commands for
Response 2 one transponder 1 ISO14443 Transponders
on ISO14443-3 level [0xB2] ISO14443 Special Host Commands
yes
ISO14443-4 Commands
Response 3 one transponder 1
[0x2B] ISO14443-4 Transponder-Info
on ISO14443-4 level
Page 61 of 136
8.1.2 [0x25] Select

This command sets one transponder to the Select State. Only one ISO transponder can be selected at once.
The supported ISO Host commands depends on the transponder types.
Supported ISO Host commands
Details REQUEST-DATA

COMMAND 0x25 Select 1
Bit 7 6 5 4 3 2 1 0
Function 0 DRV_SEL CINF UID_LF 0 ADR
ADR:
b 001 addressed
UID_LF:
If this bit is set the parameter UID_LEN must inserted into the command.
MODE b0: The protocol UID_LEN doesn't include the UID_LEN byte and the UID field 1
has a fixed Length of 8 byte, from byte6 to byte 13.
b1: The protocol includes the parameter UID_LEN. The UID has a variable
Length as defined in UID_LEN.
CINF:
b0: don't return card-information
b1: return the card-information within the select response.
DRV_SEL:
b0: No extra byte TR-DRV included in request data
b1: Extra byte TR-DRV included in request data
Page 62 of 136

This optional extra byte offers the possibility to select explicit a transponder driver for
the
current select command.
This option may be helpful in such cases when the reader cannot detect the correct
type of the transponder e.g. if a processor card emulates any kind of memory card or if
NFC devices are presented.
 NOTE:
Make sure that the relevant TAG-DRV and ISO14443-DRV is enabled in
CFG3
Bit 7 6 5 4 3 2 1 0
Function TR-DRIVER-SELECTION
TR-DRIVER-SELECTION:
TR_DRV By means of this parameter the host application explicit selects an internal driver to 1
handle the data exchange with the addressed transponder
TR-DRIVER-
Selected transponder driver
SELECTION
0x01 ISO 14443-4
0x02 -
0x03 NFC Card Type 2, Mifare Ultralight, my-d move, etc.
0x04 -
0x05 Mifare plus SL1 - ISO14443-4
0x06 -
0x07 Mifare plus SL2 - ISO14443-4
0x08 Mifare plus SL3
0x09 Mifare DESFire
0x0A my-d proximity
my-d move (use this if proprietary my-d move command
0x0B
shall be used)
Is an optional parameter and depends on the setting of UID_LF
 NOTE:
UID_LEN 1
The maximum UID_LEN is limited depending on the reader type. If UID_LEN
exceeds the internal buffer size the reader responses an error massage.
Page 63 of 136

UID, Serial-Number or pseudo unique identifier of the transponder. Depending on the
UID_LF and UID_LEN the UID field could have a fixed ore a variable Length and a
variable position in the protocol.
case UID_LF = 0
If UID_LEN not used, the following definitions are mandatory depending on the
transponder type.
ISO 14443A
6 7 8 9...16
[0x25] b000 0001 0x00 UID
SO 14443B
6 7 8...11 12...15 (UID_LEN)
UID
[0x25] b000 0001 0x00 PUPI /(8)
case UID_LF = 1
If UID_LEN is activated the specific UID Length of the transponder should be used in
the protocol.
6 7 8 9... 9+UID_LEN
[0x25] MODE UID_LEN UID
Details RESPONSE-DATA (only if STATUS = 0x95)

ISO-ERROR Additional error code if STATUS = 0x95 1
Details RESPONSE-DATA (only if the MODE-bit CINF was set in the request and STATUS = 0x00)

Indicates the format of the CARD_INFO field:
0x00: No further CARD_INFO field available.
AT 0x01: CARD_INFO of an ISO14443-4 Type-A transponder. 1
0x02: CARD_INFO of an ISO14443-4 Type-B transponder.
0x03: CARD_INFO of an ISO14443-3 Type-A transponder.
Page 64 of 136

Depending on the FORMAT parameter this data field contains different data's
case FORMAT = 0x01:

CARD_INFO contains the ATQA and SAK and parts of the Answer to select (ATS) of the
ISO14443 Type-A transponder as defined in ISO14443-4. The Length of CARD_INFO
depends on the TL parameter. The response Length depends on the TL parameter of
the
transponder ATS.
8 9 10 11 (12....12+TL-2)
ATQA
RFU Proprietary UID RFU Bit frame SAK TL T0, TA(1), TB(1), TC(1) T1, Tk
coding size anticollision
case FORMAT = 0x02:

CARD_INFO contains parts of the answer ATQB response ATTRIB response of the
ISO14443 Type-B transponder as defined in ISO14443-3.
8 9 11
ATQB Response Protocol Info
1 byte of Answer to ATTRIB
Bit_Rate_ Max_Frame_
Protocol_Type FWI ADC F0 MBLI CID
capability Size
case FORMAT = 0x3:

CARD_INFO CARD_INFO contains the ATQA and SAK parameter after the anticollision loop
has finished of ISO14443 Type-A transponder as defined in ISO14443-3.
8 9
ATQA
RFU Proprietary UID size RFU Bit frame anticollision SAK
coding
Page 65 of 136
Details RESPONSE-DATA (STATUS = 0x03)

DB-ADR-E Block number where the error occurred. 1

ISO15693 ISO15693 ERROR code of transponder response. This byte is only available if
1
ERROR STATUS = 0x95.
Page 66 of 136
8.1.3 [0x23] Read Multiple Blocks (extended Address Mode)

This command reads one or more data blocks. The supported ISO15693 Host commands depend on the
different ISO15693Transponder types.
COMMAND 0x23 Read Multiple Blocks (extended Address Mode) 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 EXT_ADR UID_LF SEC ADR
ADR:
b000 non-addressed
b001 addressed
b010 selected
SEC:
b0 SEC-STATUS always = 0x00
b1 security status of following data block in SEC-STATUS
MODE 1
UID_LF:
If this bit is set the parameter UID_LNG must be inserted into the protocol.
b0: The protocol UID_LNG doesn't include the UID_LNG byte and the UID field has a
fixed length of 8 byte.
b1: The protocol includes the parameter UID_LNG. The UID has a variable length as
defined in UID_LNG.
EXT_ADR:
If this bit is set the command includes extended address fields.
b0: Transponder memory addressing is done by the 1 byte DB ADR
Field.
b1: Transponder memory addressing is done by BANK and 2
byte DB-ADR Field
Is an optional parameter and depends on the setting of UID_LF (see MODE). UID_LNG
UID_LEN (1)
defines the length of the following UID field.
Read-only serial number of the transponder. The UID is required only in the addressed (UID_LEN)
UID
mode. /(8)
Memory bank of the transponder which will be accessed by the reader.
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 0 0 BANK_NR
BANK BANK_NR: (1)

Defines the memory area on the transponder.
b00 reserved
b01 reserved
b10 reserved
b11 User memory bank
First block number to be read. Depending on EXT_ADR. First block can be any value be- 1 or 2 bytes
DB-ADR tween 0 and 255 or 0 and 65535. (def. by
EXT_ADR)
Page 67 of 136

Number of data blocks to be locked, starting at DB-ADR. The maximum number of DB-N
depends on DB-Size and the interface
transmit buffer size TX-BUF.
DB-N 1
The maximum number of DB-N is:
(TX-BUF - 10) / (DB-Size+1) → Standard Protocol
(TX-BUF - 12) / (DB-Size+1) → Advanced Protocol

ISO15693 ERROR code of transponder response. This byte is only
ISO15693 ERROR 1
available if STATUS = 0x95.
Number of data blocks to be locked, starting at DB-ADR. The maximum
number of DB-N depends on DB-Size and the interface
transmit buffer size TX-BUF.
DB-N 1
Number of byte of one data block. This value depends on the
DB-SIZE specification of the transponder manufacturer. 1
ISO Host Commands for Transponder Communication
Block security status of following data block. If supported by the
SEC-STATUS ISO15693 transponder I-Code 1 transponder doesn’t support this 1 Repeated
function. DB-N
Requested data block. The block size is defined by DB-SIZE. DB- times
DB
SIZE
 NOTE:
• A read from 1 block uses a Read Single Block command to the transponder.
• If a transponder does not support Read Multiple Blocks commands several Read Single Block
commands are used for this transponder.
• Only one transponder can be read in the non-addressed mode.
Page 68 of 136
8.1.4 [0x23] Read Multiple Blocks

This command reads one or more data blocks. The supported ISO Host commands depends on the different
transponder types, they are de-scribed in chapter.
COMMAND 0x23 Read Lock Multiple Blocks 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 UID_LF SEC ADR
ADR:
b000 non-addressed
b001 addressed
b010 selected
MODE UID_LF: 1
If this bit is set the parameter UID_LNG must be inserted into the protocol.
b0: The protocol UID_LNG doesn't include the UID_LNG byte and the UID field
has afixed length of 8 byte.
b1: The protocol includes the parameter UID_LNG. The UID has a variable length
as defined in UID_LNG.
SEC:
b0 SEC-STATUS always = 0x00
b1 security status of following data block in SEC-STATUS
Is an optional parameter and depends on the setting of UID_LF (see MODE).
UID_LEN (1)
UID_LNG defines the length of the following UID field.
Read-only UID of the transponder. The UID is required only in the addressed (UID_LEN)
UID
mode. /(8)
DB-ADR First block number to be read. First block can be any value between 0 and 255. 1
Number of data blocks to be read from the transponder, starting at

DB_ADR. maximum number of DB-N, depends on DB-Size.
The maximum number of byte is 128 byte.
DB-Size Max. DB-N

DB-N 1
1 128
4 32
8 16
x = 128 / x
Page 69 of 136

ISO ERROR Additional error code if STATUS = 0x95. 1

DB_ADR. Maximum number of DB-N, depends on DB-Size.
DB-N DB-Size Max. DB-N 1

1 128
4 32
8 16
x = 128 / x

ISO Host Commands for Transponder Communication
Block security status of followed data block.
Repeated
SEC-STATUS If SEC-STATUS is not requested or not supported, this value will 1
DB-N
return 0x00.
times
DB Requested data block. The block size is defined by DB-SIZE. DB-SIZE
 NOTE:
• A read from 1 block uses a Read Single Block command to the transponder.
• If a transponder does not support Read Multiple Blocks commands several Read Single Block
• Only one transponder can be read in the non-addressed mode.
Page 70 of 136
8.1.5 [0x24] Write Multiple Blocks (extended Address Mode)

This command writes one or more data blocks. Supported ISO15693 Host commands depend on different
ISO15693 Transponder types. ISO15693 compatible Transponder
COMMAND 0x24 Write Multiple Blocks (extended Address Mode) 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 EXT_ADR UID_LF ADR
ADR:
b000 non-addressed
b001 addressed
b010 selected
UID_LF:
If this bit is set the parameter UID_LNG must be inserted into the
MODE protocol. 1
b0: The protocol UID_LNG doesn't include the UID_LNG byte and the
UID field has afixed length of 8 byte.
b1: The protocol includes the parameter UID_LNG. The UID has a
variable length as defined in UID_LNG.
EXT_ADR:
b0: Transponder memory addressing is done by the
1 byte DB ADR Field.
b1: Transponder memory addressing is done by BANK and
2 byte DB-ADR Field
Is an optional parameter and depends on the setting of UID_LF (see
UID_LEN (1)
MODE). UID_LNG defines the length of the following UID field.
Read-only serial number of the transponder. The UID is required only in (UID_LEN)
UID
the addressed mode. /(8)
Bit 7 6 5 4 3 2 1 0
BANK (1)
BANK_NR:
b00 reserved
b01 reserved
b10 reserved
First block number to be read. Depending on EXT_ADR First block can 1 or 2 bytes
DB-ADR be any value be-tween 0 and 255 or 0 and 65535. ( def. by
EXT_ADR)
Page 71 of 136

Number of data blocks to be written to the transponder, starting at DB-
ADR. Maximum number of DB-N, depends on DB-Size and the interface
DB-N receiver buffer size RX-BUF. The maximum number of DB-N is: 1
(RX-BUF - 10) / (DB-Size) Standard Protocol
(RX-BUF - 12) / (DB-Size) Advanced Protocol
Number of bytes of one data block. This value depends on the
ISO15693 compatible Transponder
Data of the data block to be written to the transponder. The required
Repeated
DB block size is defined by DB-SIZE. The number of the expected byte is DB-SIZE
DB-N times
DB-N * DB-SIZE.

1 or 2 bytes
DB-ADR-E Block number where the error occurred. ( def. by
EXT_ADR)
 NOTE:
• A write to 1 block uses a Write Single Block command to the transponder. This will be managed by the
reader internally.
• If a transponder does not support Write Multiple Blocks commands several Write Single Block
• A write command on I-Code 1 transponders can only be performed in the addressed mode.
• If an error occurred during a write command, the number of the block where the error occurred will be
send to host.
1
DB-ADR-E Block number where the error occurred 1
Page 72 of 136
8.1.6 [0x24] Write Multiple Blocks

This command writes one or more data blocks. The supported ISO Host commands depends on the different
transponder types, which are de-scribed in chapter 8. Supported ISO Host commands.
COMMAND 0x24 Write Multiple Blocks 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 UID_LF WR-NE ADR
ADR:
b000 non-addressed
b001 addressed
MODE b010 selected 1
UID_LF:
If this bit is set the parameter UID_LNG must be inserted into the
protocol.
b0: The protocol UID_LNG doesn't include the UID_LNG byte and the
UID field has a fixed length of 8 byte.
b1: The protocol includes the parameter UID_LNG. The UID has a
variable length as defined in UID_LNG.
CFG3: RF-Interface
Is an optional parameter and depends on the setting of UID_LF (see
UID_LEN (1)
MODE). UID_LNG defines the length of the following UID field.
Read-only UID of the transponder. The UID is required only in the (UID_LEN)
UID
addressed mode. /(8)
Address of the first data block to be written to the transponder. First
DB-ADR (1)
block can be any value between 0 and 255.
DB_ADR. Maximum number of DB-N, depends on DB-Size.
DB-Size Max. DB-N

DB-N 1
1 128
4 32
8 16
x = 128 / x

DB-SIZE specification of the transponder manufacturer 1
ISO15693 compatible Transponder
Data of the data block to be written to the transponder. The required
Repeated
DB block size is defined by DB-SIZE. The number of the expected byte DB-SIZE
DB-N times
are DB-N * DB-SIZE.
Page 73 of 136

DB_ADR-E Block number where the error occurred. 1

ISO-ERROR Additional error code if STATUS = 0x95. 1
DB_ADR-E Block number where the error occurred. 1
 NOTE:
• If a transponder does not support Write Multiple Blocks commands several Write Single Block
• If an error occurred during a write command, the number of the block were the error occurred will be
send to host.
Page 74 of 136
8.2 [0xB0] ISO 15693 Standard Host Commands

8.2.1 [0x02] Stay Quiet
This command sets one transponder to Quiet State.
COMMAND 0x02 Stay Quiet 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 0 0 0 ADR
MODE 1
ADR:
b001 addressed
Read-only serial number of the transponder.
UID  NOTE: 8
This command is only available for ISO15693 Transponders.
Page 75 of 136
8.2.2 [0x22] Lock Multiple Blocks

This command locks one or more data blocks.
The supported ISO15693Host commands depend on the different ISO15693 Transponder types,
COMMAND 0x22 Lock Multiple Blocks (extended Address Mode) 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b000 non-addressed
b001 addressed
b010 selected
Read-only serial number of the transponder. The UID is required only in the addressed
UID (8)
mode.

Bit 7 6 5 4 3 2 1 0
Bank BANK_NR: 1
b00 reserved
b01 reserved
b10 reserved
DB-ADR First block number to be locked. First block can be any value between 0 and 255. 1
Number of data blocks to be locked, starting at DB-ADR. The maximum number of DB-N
depends on DB-Size and the interface
DB-N transmit buffer size TX-BUF. 1
(TX-BUF - 10) / (DB-Size+1).


ISO15693 ISO15693 ERROR code of transponder response. This byte is only available if STATUS =
1
ERROR 0x95.
Page 76 of 136
8.2.3 [0x22] Lock Multiple Blocks (extended Address Mode)

This command locks one or more data blocks.
The supported ISO15693 Host commands depend on the different ISO15693 Transponder types.
 NOTE:
This command is only available for ISO15693Transponders.
COMMAND 0x22 Lock Multiple Blocks (extended Address Mode) 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 EXT_ADR 0 0 ADR
ADR:
b000 non-addressed
MODE b001 addressed 1
b010 selected
EXT_ADR:
b0: Transponder memory addressing is done by 1 byte DB ADR
Field.
b1: Transponder memory addressing is done by BANK and 2
byte DB ADR Field
Read-only serial number of the transponder. The UID is required only in the addressed
UID (8)
mode.

Bit 7 6 5 4 3 2 1 0
BANK BANK_NR: (1)

b00 reserved
b01 reserved
b10 reserved
First block number to be locked. Depending on EXT_ADR. First block can be any value 1 or 2 byte
DB-ADR between 0 and 255 or 0 and 65535. ( def. by
EXT_ADR)
Number of data blocks to be locked from the transponder, starting at DB-ADR.
The maximum number of DB-N, depends on the interface transmit buffer size TX BUF.
DB-N 1
Page 77 of 136


1
Page 78 of 136
8.2.4 [0x26] Reset to Ready

This command sets one transponder to Ready State.
COMMAND 0x26 Reset to Ready 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b000 non-addressed
b001 addressed
b010 selected
Read-only serial number of the transponder. The UID is required only in the
UID (8)
addressed mode.
ISO- ERROR Additional error code if STATUS = 0x95. 1
RESPONSE-DATA (STATUS = 0x00)

- 0

Page 79 of 136
8.2.5 [0x27] Write AFI

This command writes a new AFI code to one or more transponders.
The supported ISO15693 Host commands depend on the different ISO15693 transponder Types, which are
described in chapter 7.2 ISO15693 compatible Transponder.
COMMAND 0x27 Write AFI 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b000 non-addressed
b001 addressed
b010 selected
UID (8)
addressed mode.
AFI Application Family Identifier of the transponder. 1

- 0

Page 80 of 136
8.2.6 [0x28] Lock AFI

This command locks the AFI register in one or more transponders.
The supported ISO15693 Host commands depend on the different ISO15693 transponder types, which are
COMMAND 0x28 Lock AFI 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b000 non-addressed
b001 addressed
b010 selected
(UID) (8)
addressed mode.

- 0

Page 81 of 136
8.2.7 [0x29] Write DSFI (ISO15693)

This command writes the DSFID to one or more transponders.
The supported ISO15693 Host commands depend on the different ISO15693 Transponder types, which are
COMMAND 0x29 Write DSFI (ISO15693) 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b000 non-addressed
b001 addressed
b010 selected
(UID) (8)
addressed mode.
DSFID Data Storage Format Identifier of the transponder. 1

- 0

Page 82 of 136
8.2.8 [0x2A] Lock DSFID

This command locks the DSFID register in one or more transponders.
The supported ISO15693 Host commands depend on the different ISO15693 Transponder types, which are
COMMAND 0x2A Lock DSFID 1
Bit 7 6 5 4 3 2 1 0
MODE 1
ADR:
b000 non-addressed
b001 addressed
b010 selected
(UID) (8)
addressed mode.

- 0

Page 83 of 136
8.2.9 [0x2B] Get System Information

This command reads the system information from one transponder.
COMMAND 0x2B Get System Information 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 EXT-ADR 0 0 ADR
ADR:
b000 non-addressed
MODE 1
b001 addressed
b010 selected
EXT-ADR:
Defines the command type.
b0: Standard Get System Information
b1: Extended Get System Information
(UID) Read-only serial number of the transponder. The UID is required only in the
(8)
(REQUEST) addressed mode.

RESPONSE-DATA (if EXT-ADR = 0)

UID (RESPONSE) Read only Serial Number of the transponder 8
Application Family Identifier. If not supported by the transponder, this
AFI 1
value will return 0x00.
(if EX-ADR = 0)
Memory size of the transponder. If not supported by the transponder,
this value will return 0x0000.
Bytes 1 1
Bit: 7 .. 5 4 .. 0 7 .. 0
Block size in
content res. Number of blocks
Bytes
MEM-SIZE 2
(if EX-ADR == 1)
Memory size of the transponder. If not supported by the transponder,
this value will return 0x000000.
Bytes 1 2
Bit: 7 .. 6 5 .. 0 15 .. 0
Block size in
Bytes
Page 84 of 136

IC reference (version) of the transponder. If not supported by the
IC-REF 1
transponder, this value will return 0x00.
RESPONSE-DATA (if EXT-ADR = 1)

(only for EXT-ADR = 1)
Response information flag.
Bit Flag Name Description
0: DSFID field is not present
0 DSFID
1: DSFID field is present
0: AFI field is not present
1 AFI
1: AFI field is present
0: Data field on VICC memory size is not present
2 VICC memory size
1: Data field on VICC memory size is present
INFO-FLAG 0: Information on IC reference field is not present 0
3 IC reference
1: Information on IC reference field is present
0: 1 byte addressing
4 MOI
1: 2 byte addressing
0: Data field of all supported commands is not present
5 VICC Command list
1: Data field of all supported commands is present
0: CSI list is not present
6 CSI Information
1: CSI list is present
Extended Get System 0: One byte length of Info flag field
7
Info parameter Field 1: Two byte length of Info flag field

UID Read only Serial Number of the transponder
8
(RESPONSE)
AFI Application Family Identifier. If not supported by the transponder, this value will return 0x00. 1
if EX-ADR = 0)
Memory size of the transponder. If not supported by the transponder, this value will return
0x0000.
Bytes 1 1
Bit: 7 .. 5 4 .. 0 7 .. 0
Block size in
Bytes
EXT-MEM-
3
SIZE (if EX-ADR == 1)
Memory size of the transponder. If not supported by the transponder, this value will return
0x000000.
Bytes 1 2
Bit: 7 .. 6 5 .. 0 15 .. 0
Block size in
Bytes
IC reference (version) of the transponder. If not supported by the transponder, this value will
IC-REF 1
return 0x00.
Page 85 of 136

(only for EX-ADR = 1)
CL-LEN 1
Number of bytes for the Command List. Minimum is 4 Byte
Page 86 of 136
(only for EX-ADR = 1)

Command List
Bytes x
content CL Byte 1 CL Byte 2 CL Byte 3 CL Byte 4 CL Byte …
CL Byte 1:
Bit Meaning Comment
0 Read single block is supported
1 Write single block is supported
2 Lock single block is supported
3 Read multiple block is supported
4 Write multiple block is supported
5 Select is supported Including Select state
6 Reset to Ready is supported
7 Get multiple block security status is
supported
CL Byte 2
Bit Meaning Comment
0 Write AFI is supported
1 Lock AFI is supported
2 Write DSFID is supported
3 Lock DSFID is supported
4 Get System Information is supported
CL x
5 Custom commands are supported
6 RFU 0 shall be returned
CL Byte 3
Bit Meaning Comment
0 Extended read single block is supported
1 Extended write single block is supported
2 Extended lock single block is supported
3 Extended read multiple block is
supported
4 Extended write multiple block is
supported
5 Extended Get Multiple Security Status is
supported
Page 87 of 136

CL Byte 4
Bit Meaning Comment
0 Read Buffer is supported Means Response Buffer is
supported
1 Select Secure State is supported Means VCD or Mutual
authentication are supported
2 Final Response always includes crypto Means that flag b3 will be set
result in the Final response
3 AuthComm crypto format is supported
4 SecureComm crypto format is
supported
5 KeyUpdate is supported
6 Challenge is supported
7 If set to 1 a further Byte is transmitted 0 shall be returned
only for EX-ADR = 1)

CS-LEN Number of supported CS supported. 1
If Response information flag CSI Information is not set CS-LEN will be set to 0.
(only for EX-ADR = 1, if CS-LEN not 0)
CSI (X)
Supported Crypto Suite identifiers.
Page 88 of 136
8.2.10 [0x2C] Get Multiple Block Security Status

This command reads the public block security status from one transponder.
COMMAND 0x2C Get Multiple Block Security Status 1
Bit 7 6 5 4 3 2 1 0
Function 0 0 EXT-ADR 0 0 ADR
ADR:
b000 non-addressed
MODE b001 addressed 1
b010 selected
EXT-ADR:
b0: Transponder memory addressing is done by 1 byte DB-ADR Field.
b1: Transponder memory addressing is done by BANK and 2 byte DB-ADR
Field.
(UID) (8)
addressed mode.
Bit 7 6 5 4 3 2 1 0
(BANK) BANK_NR: (1)

b00 reserved
b01 reserved
b10 reserved
First block number from which security status is requested. First block number can
DB-ADR 1 or 2
be any value between 0 and 255 or 0 and 65535.
Number of Security data blocks to be read from the transponder, starting at DB-ADR.
DB-N 1
The maximum number of DB-N is 250.

Number of Security data blocks to be read from the transponder, starting at DB-
DB-N 0
ADR. The maximum number of DB-N is 250.
Repeated
SEC-STATUS Block security status. 1 DB-N
times

Page 89 of 136
8.3 [0xB0] ISO 14443 Standard Host Commands
8.3.1 [0xC0] Halt

This command sets one ISO14443-3 Transponder into Halt State.
The supported ISO Host commands depends on the different transponder types.
COMMAND 0xC0 Halt 1
Bit: 7 6 5 4 3 2 1 0
Function - - - - - ADR
MODE 1
ADR:
b010 selected
 NOTE:
If anticollision is enabled the reader sets the transponder into the Halt status itself.
Page 90 of 136
8.4 [0xB2] ISO14443 Special Host Commands

The [0xB2] commands are supposed to send special ISO14443 defined commands and proprietary
ISO14443 RF commands to the transponder.
COMMAND 0xB2 ISO14443 Special Host Commands 1
REQUEST-DATA Command specific request n
COMMAND 0xB2 ISO14443 Special Host Commands 1
STATUS Includes the status message or protocol data from or to the reader. 1
RESPONSE-DATA Command specific response n
 NOTE:
This command is not available if the notification/max mode is switched on.
Page 91 of 136
8.4.1 [0xBE] ISO 14443-4 T=CL

This command provides the data exchange between a host and the transponder on ISO 14443-4 layer. It is
special designed for easy APDU data exchange
 NOTE:
The maximum buffer size of the reader for data exchange is 256 byte for data sending from Host to Reader
(downlink) 256 byte (FSDI = 8) for data sending from Reader to Host (uplink).
COMMAND 0xBE ISO14443-4 T=CL (#) 1
Bit 7 6 5 4 3 2 1 0
Function FIRST MORE - - PING NAD_E CID_E IN
F
MODE bit setting rules

DATA
MODE
6 7 8...n-2
b1000 0001 (INF) APDU without CID or NAD (single block)
b1100 0001 (INF) APDU without CID or NAD (first chained block)
b0100 0001 (INF) APDU without CID or NAD (further chained block)
b0000 0001 (INF) APDU without CID or NAD (last chained block)
b1000 0011 CID (INF) APDU with CID (single block)
b1100 0011 CID (INF) APDU with CID (first chained block)
b1000 0101 NAD (INF) APDU with NAD (single block)
b1100 0101 NAD (INF) APDU with NAD (first chained block)
b1000 0111 CID NAD (INF) APDU with CID and NAD (single block)
MODE b1100 0111 CID NAD (INF) APDU with CID and NAD (first chained block) 1
b1000 0000 - DESLECT without CID or NAD

b1000 0010 CID - DESLECT with CID
b1000 100x - PING without CID or NAD

b1000 101x CID - PING with CID
INF:
b0 "DESELECT": Sends the S-block command "DESELECT" to the present
transponder.
b1 "APDU" Instructs the reader to send the INF Block (APDU) which is included in
the DATA Block to the transponder.
Page 92 of 136
CID_E:
b0 The DATA Block includes no CID
b1: The DATA Block includes an optional 1 byte CID Parameter.
The CID must be placed in DATA directly behind the MODE Parameter
 NOTE:
In case of command chaining (see Bit "MORE") only the CID in the first command
block is accepted by the reader.
NAD_E:
b0 The DATA Block includes no NAD
b1: The DATA Block includes an optional 1 byte NAD Parameter
The NAD parameter is only supported in conjunction with INF = b1
 NOTE:
In case of command chaining (see Bit "MORE") only the NAD in the first command
block is accepted by the reader.
PING:
By means of this bit a presence check to the current transponder can be operated by the host.
The response includes only a status message.
b0: PING will not be operated
b1: PING will be operated by the reader.
 NOTE:
PING is an exclusive function and cannot combined with an APDU command. It can
used with or without CID.
MORE:
This bit can be used to generate a data chain if the number of data bytes to be sent exceeds
the input buffer size of the reader.
b0 No downlink chaining (Host → Reader). The present protocol block includes the
complete command.
b1 downlink chaining (Host → Reader). The present protocol block includes not the
complete command. After the reader has acknowledged the protocol block the
host can send further parts of the command.
 NOTE:
• If an error status is responded by the reader the downlink chaining should

stopped by the host.
• If a MORE status (0x94) is responded by the reader the host must handle this
message.
Page 93 of 136
Protocol examples for Error-free operation with 3 blocks and 1 MORE response
DATA
MODE: (CID), (NAD), INF Host  Reader (1. protocol block)
b11xx 0xx1
STATUS: 0x94 Host  Reader
(MORE)
STATUS: 0x00 Host  Reader
(OK)
b01xx 0001 INF Host  Reader (2. protocol block)
STATUS: Host  Reader
0x00 (OK)
b00xx 0001 INF Host  Reader (last protocol block)
STATUS: Host  Reader
0x00 (OK)
DATA:
The DATA Field could be used to transfer the optional CID, NAD and
INF Field of the ISO14443-4 communication protocol. In most cases
the INF Field carries an APDU to the transponder.
FIRST:
This bit indicates the first protocol of a new command. It is necessary for single commands
and chained commands.
b0: The present protocol block is the second or further part of a chained command.
b1: The present protocol block is a single command or the first part of a chained
command.
The DATA Field could be used to transfer the optional CID-, NAD- and INF field of the
(DATA) ISO14443-4 communication protocol. In most cases the INF Field carries an APDU to the n
transponder.
Page 94 of 136

COMMAND 0xBE ISO14443-4 T=CL (#) n
This parameter represents the processing status of the present command. PSTAT must be
evaluated in conjunction with the STATUS byte of the reader response.
Depending on PSTAT and STATUS the response data of the reader is different.
0x01 WTXM
This response is given by the reader if the transponder needs more time than defined in
parameter TR-RESPONSE-TIME (CFG1: Interface) to proceed the present command.
After receiving this response the host shall align his receive timeout to a value greater than
indicated by WTXM.
6 7 8 9 10 11
STATUS PSTAT BLK_CNT WTXM FWI
0x94 0x01 0xXX 0xXX 0xXX
WTXM and FWI:

refer to ISO 14443-4
The minimum receive timeout could calculated by the following formula:
TIMEOUT = 302µsec * 2FWI * WTXM
FWI = 0...14,
WTXM = 1...59
0x02 INF:
This response is given by the reader if the protocol includes data from the transponder.
(PSTAT) 6 7 8 9 10…n-2 1
STATUS PSTAT BLK_CNT DATA
0x94 0x01 0xXX 0xXX
0x00 0x02 0xXX 0xXX
0xFF BUSY:
This response is given by the reader to re-trigger the receive timeout of the host. This response
could occur if an error in data exchange between transponder and reader had happened and
the reader retries the process by itself.
6 7 8 9
STATUS PSTAT BLK_CNT
0x94 0xFF 0xXX
STATUS = ERROR (STATUS not 0x00 or 0x94)

This response is given by the reader if the present command could not be finished, because of
transmission errors.
6 7
STATUS (ISO14443-ERROR)
ANNEX C: Index of Additional error code if STATUS = 0x96
Status byte ANNEX C2: Crypto Processing Error - ERROR-CODE
The BLK_CNT is a block counter which indexes each transmission from the reader to the Host.
(BLK_CNT) 2
On basis of the BLK_CNT the host could proof and sort the received protocols.
The DATA Field could be used to transfer the optional CID-, NAD- and INF field of the
(DATA) ISO14443-4 communication protocol. n
In most cases the INF Field carries an APDU to the transponder.
Page 95 of 136
8.4.2 [0xBF] ISO 14443-4 Container Command

This command encapsulates and transports the ISO 14443-4 commands to the transponder. The Command
enables the transparent data exchange between host and transponder as described in ISO 14443-4.
COMMAND 0xBF ISO 14443-4 Container Command (#) 1
= 0: The reader will send the command to the transponder but do not
wait for any response from the transponder. Is option should only
use if the command doesn’t have any response.
RSP 1
> 0: The reader will send the command and is waiting for a response
form the transponder while the time period defined in TIMEOUT is
running or the transponder had sent a response.
With this parameter the Frame waiting time (FWT) according ISO14443-4 could be select by
the user:
TIMEOUT (FWI) approx. Frame waiting time (FWT)
0 1 ms
1 1 ms
2 2 ms
3 3 ms
4 5 ms
5 10 ms
6 20 ms
7 39 ms
8 78 ms
9 155 ms
TIMEOUT
10 310 ms 1
(FWI)
11 619 ms
12 1237 ms
13 2474 ms
14 4948 ms
15..254 - not allowed -
255 automatically
 NOTE:
• TIMEOUT = 255: The reader used the FWI as transmitted from the
transponder.
• The value of TIMEOUT must be considered for calculating the
TR-RESPONSE-TIME
This Parameter with variable Length is provided for the transparent data transfer to the
transponder. Refer to ISO 14443-4, chapter "Block Format".
REQUEST- Prologue filed Information field Epilogue field

n
BLOCK PCB [CID] [NAD] [INF] EDC
1 byte 1 byte 1 byte x byte 2 byte
Page 96 of 136
 NOTE:
PCB is mandatory for each command whereas the parameters in [ ] brackets are
optional. For further Information please see ISO/IEC ISO14443-4
COMMAND 0xBF ISO 14443-4 Container Command (#) 1
RESPONSE-
n
DATA
 NOTE:
The maximum buffer for the RESPOSE-DATA is 256 byte (FSDI = 8).
Page 97 of 136
8.4.3 [0x2B] ISO14443-4 Transponder-Info

This command could be helpful to get further information's about the capabilities of the present ISO14443-4
transponder. The included information is transferred from the transponder. (For further Information please
see ISO/IEC ISO14443-4)
 NOTE:
This command could be used only after the transponder was selected. [0x25] Select
Command 0x2B ISO14443-4 transponder-Info 1
Transponder Frame-Size
FSCI FSCI 0 1 2 3 4 5 6 7 8 9..255 1

byte 16 24 32 40 48 64 96 128 256 RFU
Frame Waiting Time Integer of the transponder Frame Waiting Time

FWI (FWT) = 302 µsec * 2FWI 1
FWImax = 14 → 4949 ms
Displays the present supported data transfer rate from reader to transponder.
(Divisor send Integer):
DSI 1
DSI b00 b01 b10 b11
kBit / s 106 212 424 847
Displays the present supported data transfer rate from transponder to reader.
(Divisor receive Integer):
DRI 1
DRI b00 b01 b10 b11
kBit / s 106 212 424 847
NAD b1: NAD (Node Address) supported if bit is set to 1. 1

CID b1: CID (Card Identifier) supported if bit is set to 1. 1
Page 98 of 136
8.5 Special Commands for Transponder Communication
8.5.1 [0xBD] ISO14443A Transparent Command

This command sends user transparent commands to ISO14443A transponder.
Details REQUEST-DATA (MODE 0+1)
Command 0xBD ISO14443A Transparent Command 1
Options for frame format request.
The following frame types are defined:
- short frames for commands like REQA, WUPA, ...
- standard frames for regular commands
- bit oriented anticollision frame for anticollision command
- bit oriented frame with variable bitrates
0 = short frame
A short frame is used to initiate communication and consists of, in the following order:
- start of communication.
MODE 0+1 - 7 data bits transmitted LSB first 1
- end of communication.
- No parity bit is added.
1 = standard frame
Standard frames are used for data exchange and consist of:
- start of communication.
- n * (8 data bits + odd parity bit), with n _ 1. The LSB of each byte is transmitted first.
Each byte is followed by an odd parity bit. The parity bit P is set such that the number
of 1s is odd in (b1 to b8, P).
- end of communication.
If RSP-Length is set to “0” the reader will send the command but not wait for any
RSP-Length response. If RSP-Length is not equal to “0” the reader will send the command and 1
return the response data of the transponder without SOF and EOF.
The TIMEOUT value defines the time for receiving the whole transponder response.
If the TIMEOUT it exceeded the command will be abort and the Status
“NO TRANSPONDER” is returned.
Bit 7 6 5 4 3 2 1 0
Function FWI-VALUE Timeout-Value
TIMEOUT 1
FWI-Value:
b0: The Timeout-Value can be adjusted in 1ms steps (0ms ...127ms).

b1: The Timeout Value is equivalent to the FWI value according to
ISO14443-4. (0...14)
With this parameter the Frame waiting time (FWT) according ISO14443-4
could be select by the user
Page 99 of 136

0 1 ms
1 1 ms
2 2 ms
3 3 ms
4 5 ms
5 10 ms
6 20ms
7 39 ms
8 78 ms
9 155 ms
10 310ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948ms
15…254 -Not allowed-
 NOTE:
• The value of TIMEOUT must be considered for calculating the HOST-

TIMEOUT.
• The value of TIMEOUT must be considered for calculating the TR-
RESPONSE-TIME.
CFG1: Interface
Selects kind and mode of checking the data integrity of the RF-Channel.
Bit 7 6 5 4 3 2 1 0
Function - - - - RxCRCEn TXCRCEn - ParityEn
ParityEn:
b0: No parity bit is inserted or expected
b1: A parity bit is inserted in the transmitted data stream after each byte and
expected in the received data stream after each byte
(standard ISO14443A)
CRC-INFO 1
TxCRCEn:
b0: No CRC is inserted/transmitted
b1: A CRC is calculated over the transmitted data and the CRC byte(s) are
appended to the data stream
RxCRCEn:
b0: No CRC is checked
b1: The last byte(s) of a received frame is/are interpreted as CRC byte/s
Page 100 of 136

Examples:
Command CRC-INFO comment
REQA 0x01 Parity, no TxCRC, no RxCRC
HALT 0x0D Parity, TxCRC, RxCRC
Complete transponder request without SOF and EOF. If “TxCRCEn” is “1” the reader
REQUEST-
ap-pended a calculated CRC to the date stream. If “TxCRCEn” is “0” the application n
DATA
should send the CRC within the Request-Data, if the CRC is needed.
Details RESPONSE-DATA (MODE 0+1)

Complete transponder response without SOF and EOF. A CRC check is performed
RESPONSE-
inside the reader if “RxCRCEn” = “1”. n
DATA
“RxCRCEn” = “0” the transponder CRC is transferred with the response data.
Details REQUEST-DATA (MODE 2)

- standard frames for regular commands;
MODE 2 - bit oriented anticollision frame for anticollision command 1
2 = bit oriented frame

Bit oriented Frames are used for anticollision.
Bit 7 6 5 4 3 2 1 0
TIMEOUT 1
Page 101 of 136

FWI-Value:
b0: The Timeout-Value can be adjusted in 1ms steps.(0ms ...127ms)

ISO14443-4 (0...14).
0 1 ms
1 1 ms
2 2 ms
3 3 ms
4 5 ms
5 10 ms
6 20ms
7 39 ms
8 78 ms
9 155 ms
10 310ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948ms
 NOTE:

TIMEOUT.
RESPONSE-TIME.
CFG1: Interface
Page 102 of 136

Bit 7 6 5 4 3 2 1 0
ParityEn:
TxCRCEn:
CRC-INFO 1
RxCRCEn:
Examples:
REQ-BITS Number of valid Bits in REQUEST-DATA 1

REQUEST-
DATA
Details RESPONSE-DATA (MODE 2)

STATUS 1
RSP-BITS Number of valid Bits in RESPONSE-DATA 1
RESPONSE-
DATA
REQUEST-DATA (MODE 3)
MODE 3 1
- bit oriented anticollision frame for anticollision command
with variable bitrates Bit oriented frames with variable Tx- and Rx-Bitrates
Page 103 of 136


Bit 7 6 5 4 3 2 1 0
FWI-Value:

ISO14443-4 (0...14).

0 1 ms
1 1 ms
2 2 ms
3 3 ms
TIMEOUT 1
4 5 ms
5 10 ms
6 20ms
7 39 ms
8 78 ms
9 155 ms
10 310ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948ms
 NOTE:

TIMEOUT.
RESPONSE-TIME.
CFG1: Interface
Page 104 of 136

Bit 7 6 5 4 3 2 1 0
ParityEn:
CRC-INFO TxCRCEn: 1
RxCRCEn:
Examples:
Selects kind and mode of transmission settings.

Bit 7 6 5 4 3 2 1 0
Function - - - - - - BAUDRATE
TX-
1
SETTINGS BAUDRATE:
b00: 106 kBaud
b01: 212 kBaud
b10: 424 kBaud
b11: 848 kBaud
Selects kind and mode of reception settings.

Bit 7 6 5 4 3 2 1 0
RX-
1
SETTINGS BAUDRATE:
b00: 106 kBaud
b01: 212 kBaud
b10: 424 kBaud
b11: 848 kBaud
REQUEST-
DATA
Page 105 of 136


STATUS ANNEX C: Index of Status byte 1
RSP-BITS Number of valid Bits in RESPONSE-DATA 2
RESPONSE-
DATA
 NOTE:
Data is only transferred if STATUS = 0x00, 0x02, 0x83, 0x84, 0x94.
Page 106 of 136

8.5.2 [0xBE] ISO14443B Transparent Command

This command sends user transparent commands to ISO14443B transponder.

Command 0xBE ISO14443B Transparent Command 1
Options for frame format request. The following frame types are defined:
standard frames for regular commands;
- bit oriented frame
MODE 0 0 = standard frame 1

Standard frames are used for data exchange and consist of:
-start of communication
-n * (8 data bits). The LSB of each byte is transmitted first
- end of communication
The TIMEOUT value defines the time for receiving the whole transponder response. If
the TIMEOUT it exceeded the command will be abort and the Status
Bit 7 6 5 4 3 2 1 0
FWI-Value:

ISO14443-4 (0...14).
TIMEOUT TIMEOUT (FWI) approx. Frame waiting time (FWT) 1
0 1 ms
1 1 ms
2 2 ms
3 3 ms
4 5 ms
5 10 ms
6 20ms
7 39 ms
8 78 ms
9 155 ms
10 310ms
11 619 ms
12 1237 ms
13 2474 ms
Page 107 of 136


14 4948ms
 NOTE:

TIMEOUT.
RESPONSE-TIME.
CFG1: Interface
Defines the framing for ISO 14443B transponders.

Bit 7 6 5 4 3 2 1 0
Function Extra Guard Time sof_0 sof_1 eof EGT Setting
Extra Guard time (EGT) Setting:

b0: no EGT after last character
b1: EGT after each character
eof:
EOF, number of etu with logic 0
b0: Set the EOF to a Length of 10 ETU
sof_1:
SOF, number of etu with logic 1
b0: 2 etu
b1: 3 etu
sof_0:
FRAME b0: 10 etu 1
b1: 11 etu
Extra Guard time (EGT):
Number of EGT - Set the Length of the EGT between 0 and 6 ETU.
b000: 0
b001: 1
b010: 2
….
b110: 6
b111: 6
Examples:
Command FRAME comment
SOF: 10 ETU low and 3 ETU high,
REQB 0x2D
EOF-Length = 11 ETU, EGT = 1
Page 108 of 136

Select kind and mode of checking the data integrity of the RF-channel.
Bit 7 6 5 4 3 2 1 0
Function - - - - RxCRCEn TxCRCEn - Parity En
ParityEn:
CRC-INFO
TxCRCEn: 1
RxCRCEn:
Examples:
REQB 0x0C Parity, no TxCRC, no RxCRC
Complete transponder request without SOF and EOF.

TxCRCEn = 1: The reader appended a calculated CRC to the date stream.
TxCRCEn = 0: The application should send the CRC within the Request-Data,
REQUEST- if the CRC is needed.
n
DATA
 NOTE:
The max. size of REQUEST-DATA is 64 byte.

RESPONSE-
DATA

Options for frame format request. The following frame types are defined:
MODE 1 1
- bit oriented frame
Page 109 of 136


with variable bitrates
Bit oriented frames with variable Tx- and Rx-Bitrates
The TIMEOUT value defines the time for receiving the whole transponder response. If
the TIMEOUT it exceeded the command will be abort and the Status
Bit 7 6 5 4 3 2 1 0
FWI-Value:

ISO14443-4 (0...14).

0 1 ms
1 1 ms
2 2 ms
3 3 ms
4 5 ms
TIMEOUT 1
5 10 ms
6 20ms
7 39 ms
8 78 ms
9 155 ms
10 310ms
11 619 ms
12 1237 ms
13 2474 ms
14 4948ms
 NOTE:

TIMEOUT.
RESPONSE-TIME.
CFG1: Interface
Page 110 of 136

Defines the framing for ISO 14443B transponders.

Bit 7 6 5 4 3 2 1 0
Function Extra Guard Time sof_0 sof_1 eof EGT Setting
Extra Guard time (EGT) Setting:

b0: no EGT after last character
b1: EGT after each character
eof:
EOF, number of etu with logic 0
sof_1:
b0: 2 etu
b1: 3 etu
FRAME sof_0:
b0: 10 etu
b1: 11 etu
Extra Guard time (EGT):
Number of EGT - Set the Length of the EGT between 0 and 6 ETU.
b000: 0
b001: 1
b010: 2
….
b110: 6
b111: 6
Examples:
Command FRAME comment
SOF: 10 ETU low and
REQB 0x2D
3 ETU high, EOF-Length = 11 ETU, EGT = 1
Page 111 of 136

Bit 7 6 5 4 3 2 1 0
ParityEn:
CRC-INFO TxCRCEn: 1
RxCRCEn:
Examples:
Selects kind and mode of transmission settings.

Bit 7 6 5 4 3 2 1 0
TX-
1
SETTINGS BAUDRATE:
b00: 106 kBaud
b01: 212 kBaud
b10: 424 kBaud
b11: 848 kBaud
Selects kind and mode of reception settings.

Bit 7 6 5 4 3 2 1 0
RX-
1
SETTINGS BAUDRATE:
b00: 106 kBaud
b01: 212 kBaud
b10: 424 kBaud
b11: 848 kBaud
REQUEST-
DATA
Page 112 of 136


RESPONSE-
DATA
Page 113 of 136

8.5.3 [0xBF] ISO15693 Transparent Command

This command sends user transparent commands to ISO15693 transponder
Details REQUEST-DATA (MODE 1+2)
Command 0xBF ISO15693 Transparent Command 1
Bit 7 6 5 4 3 2 1 0
Function TxCRCEn MODE
Options for request.

b0001(1) = read request
Response is sampled corresponding to ISO15693-3 T1 (318,6ms .... 323,3ms)
b0010(2) = write request with Option “0”
The reader tries to sample the response after ISO15693-3 T1 (318,6 ms....323,3 ms). If
MODE there is no response the reader tries to sample in a multiple of 302 ms. If there is no 1
response within 20 ms the command sends back Status “no. transponder” [0x01].
Depending on the ERROR_Flag in the transponder response the Length of the
sampled data is:
- 4 byte if ERROR_FLAG is “1”.
- RSP-Length if ERROR_FLAG is “0”
TxCRCEn:
b0 A CRC is calculated over the transmitted data and the CRC byte(s) are
b1 No CRC is inserted/transmitted
Length of the transponder response in bit without SOF and EOF. During write
operations REP Length is depending on ERROR_FLAG in the transponder response:
RSP-Length 2
- 4 byte if ERROR_FLAG is “1”.
- REP-Length if ERROR_FLAG is “0”
Reserved Not used. To avoid problems with other FEIG reader value should be value of
(CMD-RSP- response delay for transponder response (ISO15693: t1) 2
DELAY) e.g. ISO15693 average value: 0x021F * 590ns = 320,9µs
Complete transponder request without SOF, CRC16 and EOF
 NOTE:
TR-
n
REQUEST The read and write option FLAGS in the REQUEST-DATA must correspond to
the MODE byte in the request protocol. Reader is always forcing the
command in the way specified by MODE byte in the request protocol.
Command 0xBF ISO15693 Transparent Command 1
STATUS 1
Complete transponder response without SOF and EOF. A CRC16 check is
TR-
performed in-side the reader. However the transponder CRC16 is transferred with the n
RESPONSE
response data.
Page 114 of 136

 NOTE:
Data is only transferred if STATUS = 0x00, 0x83, 0x94, 0x95.
Page 115 of 136

9 Supported ISO Host commands

The command codes listed in the following chapters gives an overview of the various transponder
commands and operations that are available for each transponder type.
 NOTE:
Detailed data sheets and information's about the functions and capabilities of each transponder type are not
supplied by FEIG ELECTRONIC. For detailed information's we refer to the original data sheets of the chip
manufacturer.
9.1 ISO14443-A/B Part 4 compatible Transponder
9.1.1 Common Processorcards

Memory organization: Depends on the type and implementation of the used transponder.
Command Code Function Mode Comment

non-addressed addressed selected
[0xB0] [0x01] Inventory - - - -
[0xB0] [0x25] Select - - -
[0xB2] [0xBE] ISO14443-4 T=CL - - -
[0xB2] [0xBF] ISO14443-4 Container - - -
[0xB2] [0x2B] ISO14443-4 Transponder-Info - - -
Page 116 of 136

9.2 ISO15693 compatible Transponder
9.2.1 Infineon (ISO Address mode) 0xE0

IC manufacturer identifier: 0x05
Memory organization:
SRF55V10P: 256 x 4 byte = 8kBit SRF55V02P: 64 x 4 byte = 2kBit
Number of blocks 256 (user area: 0...247) Number of blocks 64 (user area: 0...55)
Block size 4 byte Block size 4 byte
Command
Function Mode Comment
Code
non-addressed addressed select
0x01 Inventory - -
0x02 Stay Quiet - -
0x22 Lock Multiple Blocks WR-OPTION = 0 *
0x23 Read Multiple Blocks
0x24 Write Multiple Blocks WR-OPTION = 0 *
0x25 Select - -
0x26 Reset to Ready
0x27 Write AFI WR-OPTION = 0 *
0x28 Lock AFI WR-OPTION = 0 *

0x29 Write DSFID - - - -
0x2A Lock DSFID - - - -
0x2B Get System Information - - - -
Get Multiple Block Security
0x2C
Status
Custom specific commands
0x10 Read
0x30 Write WR-OPTION = 0 *
0x90 Write byte WR-OPTION = 0 *

*The WR-OPTION will be set automatically by the FEIG readers if the RW-OPTION parameter in “CFG4 transponder
Parameters” is set to “00: automatically set”.
CFG4: Transponder Parameters
Page 117 of 136

9.2.2 Infineon (NLM0010/NLM0011)

Bit 47 - 40 Product Code Type
10111000b B8h NLM0011 (design steps A11,A12,A13)
10111001b B9h NLM0011 (design step A14)
10110000b B0h NLM0010 (design steps A11, A12, A13)
10110001b B1h NLM0010 (design step A14)
Memory organization: 18 x 4 bytes = 576 bits

Number of blocks 18 (user area: 0-12)
Block size 4 bytes
Command
Code
0x01 Inventory - -
0x02 Stay Quiet - -
0x25 Select - -
0x26 Reset to Ready

0x28 Lock AFI - - - -
0x2B Get System Information - - - -
0x2C - - - -
Status
*The WR-OPTION will be set automatically by the FEIG readers if the RW-OPTION parameter in “CFG4 transponder
Parameters” is set to “00: automatically set”.
Page 118 of 136

9.2.3 NXP (I-Code SLI)

00000001b 1h NXP (I-Code SLI)
Memory organization: 32 x 4 byte = 1kBit

Number of blocks 32 (user area: 0 – 27)
Block size 4 byte
Command
Code
0x01 Inventory - - - -
0x02 Stay Quiet - - -

Security Status is
always 0x00
0x25 Select - - -
0x26 Reset to Ready -
0x29 Write DSFID WR-OPTION = 0 *
0x2A Lock DSFID WR-OPTION = 0 *
0x2B Get System Information

0x2C
Status
*The WR-OPTION will be set automatically by the FEIG readers if the WR-OPTION parameter in “CFG8 General” is
set to “00: automatically set” CFG4: Transponder Parameters.
Page 119 of 136

9.2.4 NXP (ICODE SLIX2)

00000001b 1h NXP (I-Code SLI)
Type indicator bits

Bit 37 - 36 Type
00b ICODE SLI
10b ICODE SLIX
01b ICODE SLIX2
Memory organization: 80 x 4 byte = 2,5kBit

Number of blocks 32 (user area: 0 – 27)
Block size 4 byte
Command
Code

Security Status is
always 0x00
0x25 Select - - -
0x29 Write DSFID WR-OPTION = 0 *
0x2A Lock DSFID WR-OPTION = 0 *
0x2B Get System Information

0x2C
Status
set to “00: automatically set”. CFG4: Transponder Parameters
Page 120 of 136

9.2.5 STMicroelectronics (LRI512)

Bit 47 - 42 Product Code (UID)
00000100b 04h
00000101b 05h
00000110b 06h
00000111b 07h
Memory organization: 16 x 4 byte = 512Bit

Number of blocks 16 (user area: 0...15)
Block size 4 byte
Command
Code

In non-addressed mode
DB-N must be 1
0x25 Select - - -

0x29 Write DSFID - - - - -
0x2A Lock DSFID - - - - -
0x2B Get System Information - - - - -
0x2C - - - - -
Status
Page 121 of 136

9.2.6 STMicroelectronics (LRI64)

Bit 47 - 42 Product Code (UID)
01000100b 44h
01000101b 45h
01000110b 46h
memory organization: 16 x 1 byte = 128Bit

Block size 1 byte
Command
Code
non addressed addressed select
0x22 Lock Multiple Blocks - - - - WR-OPTION = 0 *

In the unaddressed mode
0x23 Read Multiple Blocks -
DB-N must be 1
0x24 Write Multiple Blocks - WR-OPTION = 0 *

0x25 Select - - - - -
0x26 Reset to Ready - - - - -
0x27 Write AFI - - - - WR-OPTION = 0 *
0x28 Lock AFI - - - - WR-OPTION = 0 *

0x2B Get System Information - -
Get Multiple Block
0x2C - - - -
Security Status
set to “00: automatically set”.
Page 122 of 136

9.2.7 STMicroelectronics (M24LR16E-R)

001011xxb Bh M24LR64-R
010111xxb 17h M24LR64E-R
010011xxb 13h M24LR16E-R
Memory organization for M24LR16E-R: 16 x 32 x 4 Byte = 16 kBit

Number of sectors 16 (0-15)
Number of blocks 512 (user area: 0-511)
32 blocks per sector
Block size 4 bytes
Command
Code
0x25 Select - - -

0x2B Get System Information -
Get Multiple Block
0x2C -
Security Status
 NOTE:
• The WR-OPTION will be set automatically by the FEIG readers if the WR-OPTION parameter in “CFG4
transponder Parameter is set to “00: automatically set”
• Each sector (32 blocks) must be read separately. For reading data from different sectors a Read Multiple
Block command for each sector must be used.
Page 123 of 136

9.2.8 STMicroelectronics (ST25DVxxK-IE/JF)

Product Code: Bit 47-40 of UID
Bit 47 - 42 Product ID Type
00100100b 24h ST25DV04K-IE
00100101b 25h ST25DV04K-JF
ST25DV16K-IE
00100110b 26h
ST25DV64K-IE
ST25DV16K-JF
00100111b 27h
ST25DV64K-JF
memory organization for ST25DV64K: 64 x 32 x 4 Byte = 64kBit

Block size 4 byte

Block size 4 byte

Block size 4 byte
Command
Code
0x25 Select - - -

0x2B Get System Information -
Get Multiple Block
0x2C -
Security Status
Page 124 of 136

 NOTE:
• The WR-OPTION will be set automatically by the FEIG readers if the WR-OPTION parameter in “CFG4
transponder Parameter is set to “00: automatically set”
• Reading / Writing of more than 128 data blocks requires the new extended address mode with 2 bytes
address length.
Page 125 of 136

9.2.9 Texas Instruments (Tag-itTM HF-I Standard, Tag-itTM HF-I Pro)

The command codes listed in the following table support the various transponder commands and operations
that are available for Tag-itTM HF-I Standard and Tag-itTM HF-I Pro transponders.
IC manufacturer identifier: 0x07 Product ID / Config : (xxxx / nnn)
Tag-itTM HF-I Standard = b1100 000
Tag-itTM HF-I Pro = b1100 010
Memory organization: 8 x 4 byte = 256Bit user data
Block size 4 byte
Command
Code
0x22 Lock Block - WR-OPTION = 1 **
0x23 Read Multiple Blocks -
0x24 Write Multiple Blocks - WR-OPTION = 1 **
0x25 Select - - - - -
0x26 Reset to Ready - - - - -
0x27 Write AFI - - - - -
0x28 Lock AFI - - - - -
0x2B Get System Information - - - - -
0x2C Get Multiple Block Security - - - - -
Status
Custom specific commands
0xA4 Kill - - only Pro
0xA5 WriteSingeBlockPwd - - only Pro
**The WR-OPTION will be set automatically by the FEIG readers if the WR-OPTION parameter is
set to “00 = automatically set”. CFG4: Transponder Parameters
 NOTE:
Only one block is allowed for Read Multiple Blocks in “non addressed mode”
Page 126 of 136

10 ANNEX
10.1 ANNEX A: Codes of Transponder Types
TYPE_NO Transponder Type Supported by ID CPR30+

0x00 NXP I-Code1 -
0x01 - -
Transponder according ISO15693 like
0x03 (STM24LRxx ST25DVxx, Infineon: NLM0010 / 0011,
OnSemi: N24L16, I-Code SLIX)
0x04 Transponder according ISO14443A
0x05 Transponder according ISO14443B
0x06 NXP I-Code EPC -

0x08 Innovision Jewel -
0x0A STMicroelectronics SR176 -
0x0B STMicroelectronics SRIxx (SRI512, SRIX512, SRI4K, SRIX4K) -
0x0E Keyboard -
Page 127 of 136

10.2 ANNEX B: Codes of Reader Types

No. Reader Type
11 ID ISC.DAT
12 ID ISC.UMUX
13 ID ISC.GPC
20 ID RW40.30-U
31 ID ISC.M02
33 ID ISC.M02M8
43 ID ISC.LR2500-B
44 ID ISC.LR2500-A
45 ID ISC.LR1002
50 ID ISC.MU02
54 ID ISC.MRU102
61 ID ISC.PRH101-U (USB-Version)
62 ID ISC.PRHD102
63 ID ISC.PRH102
71 ID ISC.PRH100–U (USB-Version)
76 ID ISC.MR101-A
77 ID ISC.MR102
78 ID ISC.MR101-U
80 ID CPR.M02
81 ID CPR.02
82 ID CPR40.30-Ux
83 ID CPR40.0x-Ax / -Cx
86 ID CPR30 / ID CPR30+
87 ID CPR.52
88 ID CPR.04
94 ID ISC.LRU3000
100 ID MAX50
Page 128 of 136

10.3 ANNEX C: Index of Status byte
Hex-value General
0x00 OK:
Data / parameters have been read or stored without error
Control command has been executed
Hex-value Transponder Status

0x01 No transponder:
• No transponder is located within the detection range of the reader.
• The transponder in the detection range has been switched to mute.
• The communication between reader and transponder has been interfered and the reader is not able
to read the transponder anymore.
0x02 Data False:
• CRC, parity or framing error at received data.
0x03 Write-Error:
Negative plausibility check of the written data:
• Attempt to write on a read-only storing-area.
• Too much distance between transponder and reader antenna.
• Attempt to write in a noise area.
0x04 Address-Error:
The required data are outside of the logical or physical transponder-address area:
• The address is beyond the max. address space of the transponder.

• The address is beyond the configured address space of the transponder.
0x05 Wrong Transponder-Type:
This command is not applicable at the transponder:
• Attempt to write on or read from a transponder.

• A special command is not applicable to the transponder.
0x08 Authent-Error
The reader could not identify itself to the transponder as authorized:
• reader- and transponder Keys do not correspond
0x0E General-Error
• The transponder answered with an undefined or general error code
0x83 RF Communication Error:
• Anticollision could not be finished by the reader.
• Corrupted or faulty data exchange between reader and transponder
0x92 No valid Data:
There is no valid data in the buffer.
There is no transponder in the antenna field.
0x93 Data Buffer Overflow:
A data buffer overflow occurred.
0x94 More Data:
• There are more transponder data sets requested than the response protocol can transfer at once.
0x95 ISO15693-Error:
• An additional error code for ISO15693 Transponders is sent with response data.
0x96 ISO14443-Error:
• An additional error code for ISO14443 Transponders is sent with response data.
Page 129 of 136

Hex-value Parameter Status

0x10 EEPROM-failure:
• The EEPROM of the reader is not able to be written on.
• Before writing onto the EEPROM a faulty checksum of parameters has been detected.
0x11 Parameter-Range-Error:
• The value range of the parameters was exceeded.
Hex-value Interface Status

0x80 Unknown Command:
• The reader does not support the selected function.
0x81 Length-Error:
• The received protocol contains not the expected content.
0x82 Command (currently) not available:
• The reader is configured in scan-mode and had received an ISO Host-mode command.
0x12 Reader authent error:
• The host could not identify itself to the reader as authorized. -> False authent key
0x19 Cryptoproccesing error:
• The reader is configured in cryptomode and ignores plain commands
Hex-value Reader Status

0xF1 Hardware Warning:
• The Firmware is incompatible with the hardware.
0xF3 MAX TableUpdate Error:
• The Table Data for ID MAX50.10xE was not correct.
Hex-value SAM Status

0x31 No SAM detected
• The reader get no response from the Smart Card
0x32 Requested SAM is not activated
• The requested SAM is not activated by the SAM Activate command
0x33 Requested SAM is already activated
0x34 Requested protocol is not supported by the SAM
• Check if T=0 or T=1 protocol is supported by the SAM

0x35 SAM communication error
• A data transmission error occurred while communication with the SAM
0x36 Timeout
• The reader got no response from SAM within the defined timeout
0x37 Unsupported SAM Baudrate
• The used parameter of Fi and/or Di are not supported by the reader
Page 130 of 136

10.4 ANNEX C2: Crypto Processing Error - ERROR-CODE

Hex-value Response error code definition
0x01 Low level Error: CRC, Framing or EGT error
0x02 Timeout
0x03 Protocol error
0x04 block-no error (Chaining)
0x05 Insufficient power: The present transponder indicates insufficient power
• Maybe is distance between reader antenna and transponder is high.
• Too many transponders in the detection range of the reader.
• The power consumption of the transponder exceeds the antenna power of the reader.
Page 131 of 136

10.5 ANNEX C3: Crypto Processing Error - ERROR-CODE

ERROR-SOURCE = 1:
ERROR-
Status
CODE
ISO14443-Error:
0x96xx An additional error code for ISO14443 Transponders is sent with response data. (ANNEX C2:
ISO14433-Error, Error-Codes)
0x6581 Buffer Overflow, because the received data volume exceeds the reader internal buffer size
MFP Error
0x00## The ERROR-CODE was received form the Mifare Plus Card (see NXP Mifare Plus functional
specification)
DESFire Error
0x00## The ERROR-CODE was received form the DESFire Card (see NXP Mifare DESFire functional
specification)
ERROR-SOURCE = 3:
ERROR-
Status
CODE
An error occurs while authentication, MAC calculation or CRC calculation. The reason can be a not
0x901E
satisfied security status or any kind of transmission errors.
Page 132 of 136

10.6 ANNEX C4: Error-Code for ISO15693 Transponders
Hex-value Response error code definition

0x01 The command is not supported, i.e. the request code is not recognized
0x02 The command is not recognized, for example: a format error occurred
0x03 The option is not supported
0x0F Unknown error
0x10 The specified block is not available (doesn’t exist)
0x11 The specified block is already locked and thus cannot be locked again
0x12 The specified block is locked and its content cannot be changed
0x13 The specified block was not successfully programmed
0x14 The specified block was not successfully locked
0xA0 - 0xDF Custom command error codes
all others reserved for future use
Page 133 of 136

10.7 ANNEX D: Examples for Read Data

The setting "LSB first" and "MSB first" gives the direction of the received data byte
10.7.1 ISO-Host Command (DB-Size of the transponder = 4byte)
Figure 10-1: ISO-Host Command (DB-Size of the transponder = 4byte)
Page 134 of 136

10.7.2 ISO-Host Command (DB-Size of the transponder = 8byte)
Figure 10-2: ISO-Host Command (DB-Size of the transponder = 8byte)
Page 135 of 136

Document: Manual ID CPR30+

Id-Nr. Document Version: H11020-3e-ID-B
Date: 04.2023
© Copyright
All cited brand names, product names, or trademarks belong to their respective holders.
FEIG ELECTRONIC GmbH

Industriestraße 1a
35781 Weilburg, Germany
Phone: +49 6471 3109-0
Email: info@feig.de
Homepage: https://www.feig.de/en/
Page 136 of 136

H11020-3e-ID-B

Uploaded by

Copyright:

Available Formats

You might also like

H11020-3e-ID-B

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

H11020-3e-ID-B

Uploaded by

Copyright:

Available Formats

IDENTIFICATION

RFID Reader for ISO/IEC14443-A & -B,

Firmware Version 2.00.00

FEIG ELECTRONIC GmbH

• The following figure formats are used:

• The hexadecimal value in brackets “[ ]” marks a control byte (command)

1 Revision History of this documentation 8

4 Data Transmission between Reader and Host 11

4.1 Configuration and Control Commands (Host to Reader).............................................. 11

5 Configuration Parameters (CFG) 17

5.1 Structure of configuration parameter description......................................................... 18

6 Commands for Reader Configuration 31

6.1 [0x80] Read Configuration .............................................................................................. 31

7 Command for Reader Control 34

7.1 [0x52] Baud Rate Detection ............................................................................................ 34

8 ISO Host Commands for Transponder Communication 54

8.1 [0xB0] ISO Standard Host Commands ........................................................................... 54

8.2.5 [0x27] Write AFI ................................................................................................... 80

9 Supported ISO Host commands 116

9.1 ISO14443-A/B Part 4 compatible Transponder ............................................................ 116

10.1 ANNEX A: Codes of Transponder Types ..................................................................... 127

10.2 ANNEX B: Codes of Reader Types ............................................................................... 128

1 Revision History of this documentation

• The ID CPR30+ can be used as a replacement for identical readers.

• This manual describes the functionality of the ID CPR30+.

• The ID CPR30+ can work in polling mode.

4 Data Transmission between Reader and Host

4.1 Configuration and Control Commands (Host to Reader)

Figure 4-1: Configuration step and Control Commands (Host to Reader)

4.2 ISO Host Commands

The reader distinguishes between the following different addressing modes:

Figure 4-2: Communication steps with a transponder in “Addressed mode”

Figure 4-3: Communication steps with a transponder in “Select mode”

4.3 Protocol Frames

4.3.1 Standard Protocol Frame

REQUEST PROTOCOL (Host)

RESPONSE PROTOCOL (READER)

Figure 4-4: Standard Protocol Frame

4.3.2 Advanced Protocol Frame (recommended to use)

REQUEST PROTOCOL (HOST)

RESPONSE PROTOCOL (READER)

Figure 4-5: Advanced Protocol Frame (recommended to use)

4.3.3 Protocol Elements

Field Description / Value

Length Number of bytes including Length and CRC16; (n = 6...255)

ALength Number of bytes including STX, ALength and CRC16; (n = 7...65535)

0...254 address of device in bus mode

COMMAND Defines the Command which the reader should operate.

Field Description / Value

Includes the status message or protocol data from or to the reader.

4.3.4 CRC16 Calculation Algorithm for Protocol Frames

Field Description / Value

Polynomial x16 + x12 + x5 + 1 (reversed)  CRC_POLYNOM = 0x8408

Start Value 0xFFFF  CRC_PRESET = 0xFFFF

unsigned int crc = CRC_PRESET;

for (i = 0; i < cnt; i++) // cnt = number of protocol

5 Configuration Parameters (CFG)

• EEPROM (used for storing parameter over power down)

5.1 Structure of configuration parameter description