Reader Protocol Specification Revision 1.0.

3M TRACK AND TRACE SOLUTIONS

3M RFID Reader
Model 210
Protocol Specification

Specification Version 1.0.0

June 1, 2009

Firmware version(s): 5.0.2 and greater

Reader platforms: USB Powered Pad

10/17/2012 © 3M 2009. All rights reserved. Page 1

Reader Protocol Specification Revision 1.0.0

Table of Contents

1 Introduction and Scope .................................................................................. 3

1.1 Introduction ......................................................................................................... 3
1.2 Scope ................................................................................................................... 3
2 Communication Scheme................................................................................ 3
3 Overview of the Protocol ................................................................................ 4
3.1 Reading the Hierarchy Tables ............................................................................. 4
3.2 Hierarchy for Requests from the Host to the Reader .......................................... 4
3.3 Hierarchy Responses from the Reader to the Host ............................................. 5
4 BCC ............................................................................................................... 6
5 3M™ Reader Error(s) .................................................................................... 6
6 Format of the Data ......................................................................................... 7
7 Normal Commands ........................................................................................ 8
7.1 Read Block UID .................................................................................................. 9
7.2 Reader Version.................................................................................................. 11
7.3 ISO Pass thru..................................................................................................... 12
7.4 Quiet .................................................................................................................. 15
7.5 Read Multiblock................................................................................................ 16
7.6 Write Multiblock............................................................................................... 18
7.7 Write Block ....................................................................................................... 20
7.8 Write & Lock Block.......................................................................................... 22
7.9 Lock Block ........................................................................................................ 24
7.10 Get AFI ............................................................................................................. 25
7.11 Write AFI .......................................................................................................... 26
7.12 Lock AFI ........................................................................................................... 27
7.13 Check EAS ........................................................................................................ 28
7.14 EAS Control ...................................................................................................... 30
7.15 Get DSFID ........................................................................................................ 32
7.16 Write DSFID ..................................................................................................... 33
7.17 Lock DSFID ...................................................................................................... 34
7.18 Tag Info ............................................................................................................. 35
Appendix A: Error Codes .................................................................................... 37
Appendix B: ISO Manufacturer Codes ................................................................ 38
Appendix C: CRC Calculations ........................................................................... 39
Appendix E: Revisions History ............................................................................ 40

10/17/2012 © 3M 2009. All rights reserved. Page 2

Reader Protocol Specification Revision 1.0.0

1 Introduction and Scope

1.1 Introduction
The purpose of this document is to define the communication protocol used by the 3M™
RFID Reader USB powered pad Model 210.

This reader protocol was designed for use with a variety of tag types including ISO
15693 tags and TI Tag-It™ tags. This document will explain how to use the RS-232
Serial Protocol.

The basic operation of the reader is as follows. The reader will wait until it receives a
valid command on the RS232 Port. Upon receiving a command the reader will complete
the requested task and send a response to the host. This can be any device capable of
sending and receiving RS232 data, such as a computer or PDA. The host should take
care to not send another command until a complete response has been received from the
RFID Reader. The reader will ignore a command sent while it is processing another
command.

1.2 Scope
The intended audience of this document is programmers creating software to interface
with 3M RFID Readers. The user should have general knowledge of what an RFID
Reader does and its basic functions. The reader should also have extensive knowledge of
RS232 communications.

Values prefaced with x or 0x are in hex. Example values in the left column of tables are
in hex.

2 Communication Scheme
The reader uses a standard USB to serial converter interface. Which means the reader
will appear and operate as a COM port to the host. The communication with the 3M
Reader shall be at 19200 baud, 8N1 (8 Data Bits, 1 Stop Bit, No Parity Bits).

Further detail on RS-232 communication is outside the scope of this document.

10/17/2012 © 3M 2009. All rights reserved. Page 3

Reader Protocol Specification Revision 1.0.0

3 Overview of the Protocol

The protocol consists of two types of field. The mandatory fields are in every command
of the protocol. Examples of mandatory fields are start byte, length, command code and
BCC. The Conditional Fields are only implemented in some commands. The conditional
parts will be described in the detailed section of each command. When a conditional
field is not used it will be absent from the command being sent.

All messages to and from the reader contain the following parts.

Start Byte 1 Byte in Length This is a 0xD6 hex number that is sent at the
beginning of all messages.
Length 2 Bytes in Length This is the total of all bytes that will be sent
following the transmission of the length
bytes themselves.
Command Code 1 Byte in Length Every Command has a unique identifier that
is placed at this point in the message.
Conditional Fields Variable in Length This is defined in each of the command
descriptions. There may not be any data at
all for a command.
BCC 2 Bytes in Length This is a CRC calculated on all of the bytes
proceeding with the exception of the Start
Byte.

3.1 Reading the Hierarchy Tables

The following tables show the layout of the different fields in a command. For a user
creating a command this table should be used as a reference as to where a field should be
placed relative to other fields. If a command only has one conditional field, for example,
serial number, then serial number would be placed after the command code and before
the BCC. If a command uses more than one conditional field then the fields are placed
according to their order on the following charts. Address comes before Block Number
and so on.

3.2 Hierarchy for Requests from the Host to the Reader

This is the Field Hierarchy. In the individual command description Other Fields will be
described and their use will be explained.

Name Bytes Description Mandatory

or Optional
Start Byte (0xD6) 1 Start byte for all commands Mandatory
Length 2 The number of bytes that will follow Mandatory
this section
Command Code 1 Unique Code for each command Mandatory
Address 8 The Serial Number of the tag being Conditional
communicated with for this command
Other Fields X Any number of other variables that Conditional

10/17/2012 © 3M 2009. All rights reserved. Page 4

Reader Protocol Specification Revision 1.0.0

need to be passed for a command will

go here
BCC 2 This is a checksum for the command. It Mandatory
is calculated on all bytes preceding this
excluding the start byte

3.3 Hierarchy Responses from the Reader to the Host

These are all of the fields that can be included in a response and which order they are
returned. In the individual command descriptions the Other Fields will be described.

Name Bytes Description Mandatory

or Optional
Start Byte (0xD6) 1 Start byte for all commands Mandatory
Length 2 The number of bytes that will follow Mandatory
this section
Command Code 1 Unique Code for each command Mandatory
Error Code 1 If an error occurred during the Mandatory
command
Address 8 If an address was sent during the Conditional
command then it will be returned to the
host here
Other Fields X Any number of other variables that Conditional
need to be passed for a command will
go here
BCC 2 This is a checksum for the command. It Mandatory
is calculated on all bytes preceding this
excluding the start byte

10/17/2012 © 3M 2009. All rights reserved. Page 5

Reader Protocol Specification Revision 1.0.0

4 BCC
The BCC is a CRC checksum found at the end of every message sent to, and received
from, the RFID reader. The BCC is calculated on all of the bytes in the message with the
exception of the Start Byte.

CRC Type Length Polynomial Direction Preset Residue

CRC-CCITT 16 bits X16 + X12 + X5 + 1 Forward FFFF16 1D0F16

Example:

Outgoing Message: D6 00 09 03 00 02 00 00 00 03
Calculate CRC on all bytes but D6, resulting CRC = 12 E6

See Appendix B for sample code on how to calculate the CRC.

A more detailed explanation of BCC is outside the scope of this document.

5 3M™ Reader Error(s)

The reader will send a general error when a command is received that has not been
implemented in the firmware. This could occur because the wrong value was inserted
into the command code field, or this could occur because an old version of firmware does
not have a certain command implemented. When the reader receives a message for a
command that is not supported, the response will look exactly as follows except the CC
in Command Code will be the same value that was passed to the reader from the host.

Example of a Reader Error Response for an unimplemented command:

Example Value Name Description Values
D6 Start Start Byte Fixed
00 04 Length Bytes after this field Variable
CC Command Code Command Code of the Variable
Request sent to the reader.
02 Error Code Command Not Implemented Fixed
XX XX BCC CRC checksum Calculated

For a description of the other error code values, see the appendix.

10/17/2012 © 3M 2009. All rights reserved. Page 6

Reader Protocol Specification Revision 1.0.0

6 Format of the Data

Numeric data (serial numbers, 16 bit integers, etc.) being transmitted to and sent from the
reader shall be sent in the Big-Endian format. Meaning the MSB is transmitted first and
the LSB is transmitted last. When reading a number in the documentation the number on
the left represents the MSB and shall be transmitted first.

Example- a 500 needs to be sent for a 16bit integer field:

500 = 1F4 hex so the following would be transmitted in 2 bytes: 01 F4.

Serial Numbers:

When transmitting a serial number of an ISO tag use the following manner:

MSB-LSB

E0 07 00 00 06 71 53 99

When transmitting the serial number of a TI tag fill the first 32 bits with 0’s

0’s -----------MSB---LSB
00 00 00 00 1A 23 B5 9F

This format is consistent with the 32-bit TI format of transmitting and receiving data.

10/17/2012 © 3M 2009. All rights reserved. Page 7

Reader Protocol Specification Revision 1.0.0

7 Normal Commands
This section has detailed examples of all the standard commands implemented in the
protocol. Each section will have a description of what the purpose of the command is
and then will have an explanation of all the conditional fields used in this command.

Non-addressed commands (from the standpoint of the serial protocol):

Command Name Description Command Code

Read Block UID Poll (inventory) for tags 0xFE
Reader Version Get firmware version 0x11
ISO Pass thru Send raw ISO air commands 0x14

Addressed commands (commands that require a specific tag serial number):

Command Name Description Command Code

Quiet Quiet a specific tag 0x01
Read Multiblock Read block(s) data from a specific tag 0x02
Write Multiblock Write block(s) data to a specific tag 0x04
Write Block Write 1 block of data to a specific tag 0x05
Write and Lock Block Write/lock 1 block of data to a specific tag 0x07
Lock Block Lock 1 block of data on a specific tag 0x08

Get AFI Read AFI from a specific tag 0x0A

Write AFI Write AFI to a specific tag 0x09
Lock AFI Lock AFI on a specific tag 0x06

Check EAS Read EAS from a specific tag 0x03

EAS Control Write EAS to a specific tag 0x0C

Get DSFID Read DSFID from a specific tag 0x0F

Write DSFID Write DSFID to a specific tag 0x0B
Lock DSFID Lock DSFID on a specific tag 0x0E

Tag Info Get many things from a specific tag 0x0D

10/17/2012 © 3M 2009. All rights reserved. Page 8

Reader Protocol Specification Revision 1.0.0

7.1 Read Block UID

Description: The primary purpose of this command is to identify all of the transponders
in the field. For each transponder found, various optional data will be returned given by
the Response Options Field. The operation of this command is affected by the Set Air
Interface command unless protocols are specific in the request fields. Depending on the
options set this command will return ISO tags, Tag-It tags or both.

Command Code: 0xFE

Tags Supported: ISO 15693 tag

TI Tag-It™ tag

Request Fields: AFI - Return only tags with this AFI value; 0 for all tags.
Response Options –
Bit 0: Address – return 8 byte serial number for each tag
Bit 1: DSFID – return 1 byte DSFID for each tag
(Note that DSFID is returned BEFORE the address)
Bit 2*: Ignored unless bit4 set
Bit 3*: used when bit4 set otherwise reserved (set 0)
Bit 5: Skip quiet and 2nd poll
Bit 6: Protocol(s) are included
Bit 7: Reserved (set 0)
Protocols – when bit above is set –
Bit0: Tag-It
Bit1: ISO
Bits 2-7: Reserved (set 0)
Response Fields: AFI – Requested AFI
Response Options – Requested response options
Number of Transponders – How many tags were found
[DSFID, Address] – optional data returned for each tag found

Error Codes:
0x31 – Response Option(s) not supported
0x02 – Command not implemented

Remarks: The AFI and the response options fields determine what tags are found and
what data is returned. TI Tag-It tags are NOT returned when a non-zero AFI is specified.
The DSFID byte, when requested, is returned before the 8 byte serial number. A DSFID
of 0 is returned for TI Tag-It tags which mirror what is returned by ISO tags that do not
support a DSFID. Reserved bits in the response options field should be set to 0 (note that
bit 2 has effectively been orphaned because older firmware interpreted 0x01 and 0x05 in
the same manner). Note that it is possible for the same address to be returned more
than once in a single Read Block UID response (e.g. if the tag does not hear the quiet

10/17/2012 © 3M 2009. All rights reserved. Page 9

Reader Protocol Specification Revision 1.0.0

command it will respond in the 2nd poll and the reader does not remove duplicate
addresses).

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 05 Length Bytes after this field Variable
FE Command Read Block UID Fixed
Code
00 AFI Return all tags (0) or tags with a 0-255
specific AFI value
05 Response What to return for each tag See above
Options found.
XX XX BCC CRC checksum Calculated

Example of a Response with no error:

Request: D6 00 05 FE 00 05 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 17 Length Bytes after this field Variable
FE Command Code Read Block UID Fixed
00 Error Code No Error 00 – No Error
00 AFI AFI from request Same as request
05 Response Options What is returned for Same as request
each tag found
02 Num Tags 2 tags were found Variable
00 00 00 00 Address UID of 1st tag Any Legal UID
00 AD 63 02
E0 07 00 00 Address UID of 2nd tag Any Legal UID
00 60 00 AE
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 10

Reader Protocol Specification Revision 1.0.0

7.2 Reader Version

Description: This is the internal firmware version number.

Command Code: 0x11

Request Fields: None

Response Fields: Version Number – this is a 4-byte code as follows:

Byte0: x0A (3M Readers)
Byte1: Major Value
Byte2: Minor Value
Byte3: Build Version

Error Codes:
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 03 Length Bytes after this field Variable
11 Command Code Reader Version Fixed
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 03 11 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 08 Length Bytes after this field Variable
11 Command Code Reader Version Fixed
00 Error Code No Error 00 – No Error
0A 03 02 06 Firmware Version 3M™ Reader Variable
Version 03.02.06
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 11

Reader Protocol Specification Revision 1.0.0

7.3 ISO Pass thru

Description: This command allows low-level ISO air commands to be sent directly. It is
mainly for the use of manufacturer implemented custom ISO commands but it can also be
used to override the reader firmware’s default processing with specific tags. The reader
should be familiar with the ISO/IEC 15693-2 and 15693-3 specifications.

Command Code: 0x14

Request Fields: Send Data Size* – 2Byte size of ISO air command send data
Receive Size* – 2Byte size of air command response
Control Options – 2Bytes as follows:
Bit 0-10 / 11**: number of clock waits for response
Bit 11 set 1***: no intelligence when “raw receive” set
Bit 12 set 1**: override standard clock wait; use above
Bit 13 set 1**: send 100% EOF after wait to get response
Bit 14 set 1***: “raw receive” mode (minimal intelligence)
Bit 15: set 1 if RF Flags is included below
[RF Flags] – if bit15 in control options set, 1 byte as follows:
Bit 3: set 1 to stop receiving if no sof (“raw receive” only)
Bit 4: set 1 for t1 nominal timing, 0 for t1 max
Send Data* – ISO air command data

Response Fields: Result Flags – 1 byte for debugging purposes, low bits as follows:
Bit 0: the SOF was found
Bit 1: the EOF was found
Bit 2: there were code violation(s) in the data
Receive Size* – 2Byte size of air command response data
Receive Data* – ISO air command response data

Error Codes:
0x31 – Control option(s) not supported
0x02 – Command not implemented

* In normal use, send and receive sizes/data do NOT include the ISO spec CRC. The CRC is
added/checked automatically by the firmware. Also, the receive size should be the maximum expected
bytes (less may be returned). In “raw receive” mode, however, the receive size becomes the exact number
of bytes you want to receive.
** The override bit must be set for bits 0-11 to be used, otherwise the firmware uses a standard clock wait.
Typically for ISO air commands that read tag data you can pass 0x0000 for the control options. ISO air
commands that write tag data will probably need control options. For example, TI ISO tags required the
send EOF about 10ms after a command that writes data (block, afi, etc). Note that the clock waits are bits
0-10 when “raw receive” is set. “Clock waits” are 9.44uS clocks when using the “send 100% EOF”
method (i.e. TI tags) and 18.88uS clocks when this method is not used (i.e. NXP and ST tags).
*** “Raw receive” mode gives three options. Raw receive with no intelligences reads bits as they are read
over the air and returns exactly receive size bytes of them (so any SOF and EOF will be returned as bits).
No checking on anything is done so the returned Result Flags are undefined. Raw receive mode with
minimal intelligence (no intelligence bit set to 0) checks/discards the first 8 bits and last 8 bits for

10/17/2012 © 3M 2009. All rights reserved. Page 12

Reader Protocol Specification Revision 1.0.0

SOF/EOF and sets the Result Flags appropriately. If RF Flags are included and the “stop if no sof” bit is
clear, then all bits between the expected SOF/EOF are de-manchestered until there are receive size bytes of
them, which are then returned. If the “stop if no sof” bit is set then reading stops if the sof was not found
but receive size bytes (of random values) are still returned so you need to check the returned Result Flags.
If there are code violations anywhere in the data stream, the Result Flag bit is set AND any bytes with code
violation(s) are returned as 0xFF. Note that in raw receive mode the clock waits are limited to bits 0-10.
Some reader platforms do not support the “no intelligence” bit – you can check for the option not
supported error code in this command or use the Extended Info with Reader Platform Flags ID to
find out before-hand.

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 14 Length Bytes after this field Variable
14 Command Code ISO Pass thru Fixed
000B Send Data Size Total bytes in send data Variable
(ISO crc not included)
0006 Max Receive Max bytes we expect to Variable
Size receive (ISO crc not
included)
0000 Control Options Options controlling See above
send/receive
2320 Send Data For example at left… Variable
93697312000007E0 23 – iso flags
00 20 - read single block
[UID in LittleEnd order]
00 – Block number
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 14 41 00 0B 00 06 00 00 23 20 93 69 73 12 00 00 07 E0 00 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
14 Command Code ISO Pass thru Fixed
00 Error Code No Error 00 – No Error
83 Result Flags For debugging see above
0005 Receive Size Bytes received from Variable
tag
00 Receive Data ISO response flags Variable
per ISO spec
55555555 Receive Data 4byte contents of Variable
block 0
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 13

Reader Protocol Specification Revision 1.0.0

10/17/2012 © 3M 2009. All rights reserved. Page 14

Reader Protocol Specification Revision 1.0.0

7.4 Quiet

Description: This function will quiet a specific tag so that it does not respond during a
ReadBlockUID command.

Command Code: 0x01

Tags Supported: ISO 15693

TI-Tag-It

Request Fields: Address – The 64 bit serial number of the tag

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x02 – Command Not Implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0B Length Bytes after this field Variable
01 Command Code Quiet Fixed
E0 07 00 00 Address UID of Tag Any legal UID
01 23 45 67
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0B 01 E0 07 00 00 01 23 45 67 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
01 Command Code Quiet Fixed
00 Error Code No Error 00 – No Error
E0 07 00 00 Address UID of tag Same as request
01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 15

Reader Protocol Specification Revision 1.0.0

7.5 Read Multiblock

Description: This function is used to retrieve data from the memory of a specific tag.

Command Code: 0x02

Tags Supported: ISO 15693

TI-Tag-It

Request Fields: Address – The 64 bit serial number of the tag.

First Block Number – First block to read, 0 based
Number of Blocks – Total blocks to read
(Optional) Response Options – bits as follows
Bit0 set 1*: return all data for each block even if error
Bit1 set 1*: propagate first read error to other blocks
Bit2 set 1: new style response:
1st block, num block, [4 or 5bytes for each block]
Bit3 set 1**: do not return lock information (no_lock)

Response Fields: Address – The Serial Number of the tag

Old style:
Number of Blocks – Total blocks returned
[Number, Lock/Err*, 4B Data] ** – 5 or 6B returned per block
New style:
First Block Number – First block to read, 0 based
Number of Blocks – Total blocks returned
[Lock/Err*, 4B Data] ** – 4 or 5B returned per block

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – at least one block number is invalid
0x15 – Mem Not Read – error reading block data
0x31 – Option Not Supported – probably a bad Response Options byte
0x02 – Command not implemented
** The no_lock bit modifies the returned data to exclude the lock information for each block, reducing the
returned data to 4 or 5 bytes per block. However, see above when used with the return all data bit. Note
also that not all firmware versions support the no_lock bit.

Remarks: The reader will assume the Response Options are zero if the request does not
contain enough data.
Example of a Request (old style with no response options):

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0D Length Bytes after this field Variable
02 Command Code Read Multiblock Fixed

10/17/2012 © 3M 2009. All rights reserved. Page 16

Reader Protocol Specification Revision 1.0.0

00 00 00 00 Address UID of Tag to be read Any legal UID

01 23 45 67
00 First Block Number First block to read 0-255
02 Number of Blocks Read two blocks of data 0-255
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0D 02 00 00 00 00 01 23 45 67 00 02 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 19 Length Bytes after this field Variable
02 Command Code Read Multiblock Fixed
00 Error Code No Error 00 – No Error
00 00 00 00 Address UID of tag Same as request
01 23 45 67
02 Number of Blocks 2 Blocks read Same as request
Read
00 Block Number Block 0 0-255
00 Lock / Error Unlocked 00 – Unlocked
01- User locked
02 – Factory locked
03 – Both locks
> 03 are error codes
00 11 22 33 Block Data Data Variable
01 Block Number Block 1 0-255
00 Lock Status Unlocked See above
00 11 22 33 Block Data Data Variable
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 17

Reader Protocol Specification Revision 1.0.0

7.6 Write Multiblock

Description: This function is used to write data to the memory of a specific tag.

Command Code: 0x04

Tags Supported: ISO 15693

TI-Tag-It

Request Fields: Address – The 64 bit serial number of the tag

First Block Number – First block to write, 0 based
Number of Blocks – Total blocks to write
Flags – reserved; set 0.
[32bit Data] – data to write (for each block)

Response Fields: Address – The Serial Number of the tag

[optional] Block Number – block with error or last written+1

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – at least one block number is invalid
0x16 – Mem Not Put – error writing block data (not enough power?)
0x12 – Mem Locked – at least one block is locked and cannot write new data
0x31 – Option Not Supported – probably a bad reserved byte
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 16 Length Bytes after this field Variable
04 Command Code Write Multiblock Fixed
00 00 00 00 Address UID of Tag to write Any legal UID
01 23 45 67
00 First Block Number First block to write 0-255
02 Number of Blocks Write two blocks of data 0-255
00 Reserved Reserved 0
12 34 AB CD Data Data to be written to block0 Variable
55 66 77 88 Data Data to be written to block1 Variable
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 16 04 00 00 00 00 01 23 45 67 00 02 00 12 34 AB CD 55 66 77 88 XX
XX

10/17/2012 © 3M 2009. All rights reserved. Page 18

Reader Protocol Specification Revision 1.0.0

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
04 Command Code Write Multiblock Fixed
00 Error Code No Error 00 – No Error
00 00 00 00 Address UID of tag Same as request
01 23 45 67
01 Block Number block with error or 0-255
last written+1
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 19

Reader Protocol Specification Revision 1.0.0

7.7 Write Block

Description: This function is used to write data to the memory of one block in a specific
tag. This command is maintained for legacy applications. New applications should use
Write Multiblock for better performance.

Command Code: 0x05

Tags Supported: ISO 15693

TI-Tag-It

Request Fields: Address – The 64 bit serial number of the tag

Block Number – The block to write, 0 based
Data – 32 bits of data to be written to the block

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available –block number is invalid
0x16 – Mem Not Put – error writing block data (not enough power?)
0x12 – Mem Locked – block is locked and cannot write new data
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 10 Length Bytes after this field Variable
05 Command Code Write Block Fixed
00 00 00 00 Address UID of Tag to write Any legal UID
01 23 45 67
00 Block Number The block to write 0-255
12 34 AB CD Data Data to be written to block Variable
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 10 05 00 00 00 00 01 23 45 67 00 12 34 AB CD XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
05 Command Code Write Block Fixed
00 Error Code No Error 00 – No Error
00 00 00 00 Address UID of tag Same as request

10/17/2012 © 3M 2009. All rights reserved. Page 20

Reader Protocol Specification Revision 1.0.0

01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 21

Reader Protocol Specification Revision 1.0.0

7.8 Write & Lock Block

Description: This function is used to write data to the memory of one block in a specific
tag and then lock the data. The block data cannot be changed after this command has
been issued.

Command Code: 0x07

Tags Supported: ISO 15693

TI-Tag-It

Request Fields: Address – The 64 bit serial number of the tag

Block Number – The block to write and then lock, 0 based
Data – 32 bits of data to be written to the block

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available –block number is invalid
0x16 – Mem Not Put – error writing block data (not enough power?)
0x12 – Mem Locked –block is locked and cannot write new data
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 10 Length Bytes after this field Variable
07 Command Code Write & Lock Block Fixed
00 00 00 00 Address UID of Tag to write/lock Any legal UID
01 23 45 67
00 Block Number The block to write/lock 0-255
12 34 AB CD Data Data to be written to block Variable
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 10 07 00 00 00 00 01 23 45 67 00 12 34 AB CD XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
07 Command Code Write & Lock Block Fixed
00 Error Code No Error 00 – No Error
00 00 00 00 Address UID of tag Same as request

10/17/2012 © 3M 2009. All rights reserved. Page 22

Reader Protocol Specification Revision 1.0.0

01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 23

Reader Protocol Specification Revision 1.0.0

7.9 Lock Block

Description: This function is used to lock data within a single block on a specific tag.
The block data cannot be changed after this command has been issued.

Command Code: 0x08

Tags Supported: ISO 15693 tag

TI Tag-It™ tag

Request Fields: Address – The 64 bit serial number of the tag

Block Number – The block to lock, 0 based

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available –block number is invalid
0x16 – Mem Not Put – error locking block (not enough power?)
0x12 – Mem Locked – block is already locked
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
08 Command Code Lock Block Fixed
00 00 00 00 Address UID of Tag Any legal UID
01 23 45 67
00 Block Number The block to lock 0-255
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0C 08 00 00 00 00 01 23 45 67 00 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
08 Command Code Lock Block Fixed
00 Error Code No Error 00 – No Error
00 00 00 00 Address UID of tag Same as request
01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 24

Reader Protocol Specification Revision 1.0.0

7.10 Get AFI

Description: This function will return the value of the application family identifier (AFI)
of a specific tag.

Command Code: 0x0A

Tags Supported: ISO 15693

Request Fields: Address – The 64 bit serial number of the tag

Response Fields: Address – The Serial Number of the tag

AFI – The value of the application family identifier

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – AFI is not available
0x30 – Not Supported
0x02 – Command Not Implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0B Length Bytes after this field Variable
0A Command Code Get AFI Fixed
E0 07 00 00 Address UID of Tag Any legal UID
01 23 45 67
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0B 0A E0 07 00 00 01 23 45 67 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0D Length Bytes after this field Variable
0A Command Code Get AFI Fixed
00 Error Code No Error 00 – No Error
E0 07 00 00 Address UID of tag Same as request
01 23 45 67
DA AFI Value of the AFI 0-255
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 25

Reader Protocol Specification Revision 1.0.0

7.11 Write AFI

Description: This function is used to modify the AFI value in a particular tag.

Command Code: 0x09

Tags Supported: ISO 15693

Request Fields: Address – The 64 bit serial number of the tag

AFI – This is the value for the AFI.

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – AFI is not available
0x16 – Mem Not Put – error writing AFI (not enough power?)
0x12 – Mem Locked – AFI is locked and cannot write new data
0x30 – Not Supported
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
09 Command Code Write AFI Fixed
E0 07 00 00 Address UID of Tag Any legal UID
01 23 45 67
D7 AFI Value for the AFI 0-255
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0C 09 E0 07 00 00 01 23 45 67 D7 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
09 Command Code Write AFI Fixed
00 Error Code No Error 00 – No Error
E0 07 00 00 Address UID of tag Same as request
01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 26

Reader Protocol Specification Revision 1.0.0

7.12 Lock AFI

Description: This function is used to lock the AFI value in a particular tag. The AFI
value cannot be changed after this command has been issued.

Command Code: 0x06

Tags Supported: ISO 15693

Request Fields: Address – The 64 bit serial number of the tag

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – AFI is not available
0x16 – Mem Not Put – error locking AFI (not enough power?)
0x12 – Mem Locked – AFI is already locked
0x30 – Not Supported
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0B Length Bytes after this field Variable
06 Command Code Lock AFI Fixed
E0 07 00 00 Address UID of Tag Any legal UID
01 23 45 67
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0B 06 E0 07 00 00 01 23 45 67 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
06 Command Code Lock AFI Fixed
00 Error Code No Error 00 – No Error
E0 07 00 00 Address UID of tag Same as request
01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 27

Reader Protocol Specification Revision 1.0.0

7.13 Check EAS

Description: This function will return the value of the EAS bit of a specific tag. EAS
functionality is a NXP proprietary function so only certain ISO tags will be able to
respond to an EAS command.

Command Code: 0x03

Tags Supported: ISO 15693 tags that support addressed EAS commands (NXP)

Request Fields: Address – The 64 bit serial number of the tag

Response Fields: Address – The Serial Number of the tag

EAS – 1 or 0
(also assume an EAS of 0 if error code 0x06)

Error Codes:
0x06 – No Transponder
0x30 – Not Supported
0x02 – Command Not Implemented

Remarks: Currently, only tags that have an EAS of 1 will respond to the low-level air
command. This means that there is no way to tell the difference between “tag has an EAS
of 0” and “No Transponder Found.” Therefore you will have to interpret an error code of
0x06 as an EAS value of 0. In addition, the firmware will send the command to tags that
may not support EAS at all. If these tags do not respond, you will receive the No
Transponder Found error.

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0B Length Bytes after this field Variable
03 Command Code Check EAS Fixed
E0 04 00 00 Address UID of Tag Any legal UID
01 23 45 67
XX XX BCC CRC checksum Calculated

Example of a Response when the EAS bit is 1:

Request: D6 00 0B 03 E0 04 00 00 01 23 45 67 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0D Length Bytes after this field Variable

10/17/2012 © 3M 2009. All rights reserved. Page 28

Reader Protocol Specification Revision 1.0.0

03 Command Code Check EAS Fixed

00 Error Code No Error 00 – No Error
E0 04 00 00 Address UID of tag Same as request
01 23 45 67
01 EAS Value of the EAS 1
XX XX BCC CRC checksum Calculated

Example of a Response when the EAS bit is 0:

Request: D6 00 0B 03 E0 04 00 00 01 23 45 67 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0D Length Bytes after this field Variable
03 Command Code Check EAS Fixed
06 Error Code No Transponder 06 – No
Found Transponder Found
E0 04 00 00 Address UID of tag Same as request
01 23 45 67
00 EAS Probable Value of 0
the EAS
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 29

Reader Protocol Specification Revision 1.0.0

7.14 EAS Control

Description: This function is used to modify the EAS bit in a particular tag. EAS
functionality is a NXP proprietary function so only certain ISO tags will be able to
respond to an EAS command. Tags with an EAS set to 1 would typically be considered
tags with security ON (e.g. checked-in items).

Command Code: 0x0C

Tags Supported: ISO 15693 tags that support addressed EAS commands
(NXP is supported)

Request Fields: Address – The 64 bit serial number of the tag

EAS Value – Value for the EAS: 1 or 0

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – EAS is not available
0x16 – Mem Not Put – error writing EAS (not enough power?)
0x30 – Not Supported
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
0C Command Code EAS Control Fixed
E0 04 00 00 Address UID of Tag Any legal UID
01 23 45 67
01 EAS Value Value for the EAS 0 – set EAS 0
1 – set EAS 1
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0C 0C E0 04 00 00 01 23 45 67 01 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
0C Command Code EAS Control Fixed
00 Error Code No Error 00 – No Error

10/17/2012 © 3M 2009. All rights reserved. Page 30

Reader Protocol Specification Revision 1.0.0

E0 04 00 00 Address UID of tag Same as request

01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 31

Reader Protocol Specification Revision 1.0.0

7.15 Get DSFID

Description: This function will return the value of the data storage format identifier
(DSFID) of a specific tag.

Command Code: 0x0F

Tags Supported: ISO 15693

Request Fields: Address – The 64 bit serial number of the tag

Response Fields: Address – The Serial Number of the tag

DSFID – The value of the data storage format identifier

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – DSFID is not available
0x30 – Not Supported
0x02 – Command Not Implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0B Length Bytes after this field Variable
0F Command Code Get DSFID Fixed
E0 07 00 00 Address UID of Tag Any legal UID
01 23 45 67
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0B 0F E0 07 00 00 01 23 45 67 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0D Length Bytes after this field Variable
0F Command Code Get DSFID Fixed
00 Error Code No Error 00 – No Error
E0 07 00 00 Address UID of tag Same as request
01 23 45 67
31 DSFID Value of the DSFID 0-255
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 32

Reader Protocol Specification Revision 1.0.0

7.16 Write DSFID

Description: This function is used to modify the DSFID value in a particular tag.

Command Code: 0x0B

Tags Supported: ISO 15693

Request Fields: Address – The 64 bit serial number of the tag

DSFID – This is the value for the DSFID.

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – DSFID is not available
0x16 – Mem Not Put – error writing DSFID (not enough power?)
0x12 – Mem Locked – DSFID is locked and cannot write new data
0x30 – Not Supported
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
0B Command Code Write DSFID Fixed
E0 07 00 00 Address UID of Tag Any legal UID
01 23 45 67
31 DSFID Value for the DSFID 0-255
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0C 0B E0 07 00 00 01 23 45 67 31 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
0B Command Code Write DSFID Fixed
00 Error Code No Error 00 – No Error
E0 07 00 00 Address UID of tag Same as request
01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 33

Reader Protocol Specification Revision 1.0.0

7.17 Lock DSFID

Description: This function is used to lock the DSFID value in a particular tag. The
DSFID value cannot be changed after this command has been issued.

Command Code: 0x0E

Tags Supported: ISO 15693

Request Fields: Address – The 64 bit serial number of the tag

Response Fields: Address – The Serial Number of the tag

Error Codes:
0x06 – No Transponder
0x11 – Mem Not Available – DSFID is not available
0x16 – Mem Not Put – error locking DSFID (not enough power?)
0x12 – Mem Locked – DSFID is already locked
0x30 – Not Supported
0x02 – Command not implemented

Example of a Request:

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0B Length Bytes after this field Variable
0E Command Code Lock DSFID Fixed
E0 07 00 00 Address UID of Tag Any legal UID
01 23 45 67
XX XX BCC CRC checksum Calculated

Example of a Response:

Request: D6 00 0B 0E E0 07 00 00 01 23 45 67 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
0E Command Code Lock DSFID Fixed
00 Error Code No Error 00 – No Error
E0 07 00 00 Address UID of tag Same as request
01 23 45 67
XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 34

Reader Protocol Specification Revision 1.0.0

7.18 Tag Info

Description: This function is used to retrieve multiple pieces of information from a

specific tag. You can’t always get what you want so check the response information
carefully and see the remarks below.

Command Code: 0x0D

Tags Supported: ISO 15693

TI-Tag-It

Request Fields: Address – The 64 bit serial number of the tag

Info Requested – what the caller would like:
Bit 0: DSFID
Bit 1: AFI
Bit 2: Mem Size (block size, block count)
Bit 3: IC Ref / Tag Version (2 bytes)
Bit 4-7: Ignored for now

Response Fields: Address – The Serial Number of the tag

Info Avail – what the reader has for you:
(same bit values as above)
(Note: these fields exist sequentially based on Info Avail)
DSFID – 1byte value (when bit set in Info Avail)
AFI – 1byte value (when bit set in Info Avail)
Mem Size – 2bytes (when bit set in Info Avail):
1byte tag block size –1 (e.g. 3 means 4 bytes)
1byte tag total blocks – 1 (e.g. 7 means 8 blocks)
ICRef – 2 bytes (when bit set in Info Avail), per manufacturer:
->
Error Codes:
0x06 – No Transponder
0x02 – Command not implemented

Remarks: This command attempts to mimic the ISO “get system info” air command in
allowing you to get a lot of things in one air command. For Tag-IT tags, it is less useful
but can return MemSize and ICRef. Unlike other commands, you typically will not get an
error returned when a tag does not support a piece of information. Instead, you must
compare the Info returned with what you requested; if requested information is missing,
then the tag does not support it. The firmware is smart enough to return information for
some ISO tags that do not support “get system info” but other tags that do not support the
air command will result in an error returned (typically No Transponder Found).

Example of a Request asking for DSFID and AFI:

10/17/2012 © 3M 2009. All rights reserved. Page 35

Reader Protocol Specification Revision 1.0.0

Example Value Name Description Values

D6 Start Start Byte Fixed
00 0C Length Bytes after this field Variable
0D Command Code Tag Info Fixed
E0 07 C1 00 Address UID of Tag Any legal UID
01 23 45 67
03 Info Requested What we want See bits above
XX XX BCC CRC checksum Calculated

Example of a Response when the tag has only the AFI:

Request: D6 00 0C 0D E0 07 C1 00 01 23 45 67 03 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0E Length Bytes after this field Variable
0D Command Code Tag Info Fixed
00 Error Code No Error 00 – No Error
E0 07 C1 00 Address UID of tag Same as request
01 23 45 67
02 Info Avail What you got See bits above
DA AFI The AFI value 0-255
XX XX BCC CRC checksum Calculated

Example of a Response when the tag has no DSFID or AFI:

Request: D6 00 0C 0D 00 00 00 00 01 23 45 67 03 XX XX
Example Value Name Description Values
D6 Start Start Byte Fixed
00 0D Length Bytes after this field Variable
0D Command Code Tag Info Fixed
00 Error Code No Error 00 – No Error
00 00 00 00 Address UID of tag Same as request
01 23 45 67
00 Info Avail You got nothing See bits above
XX XX BCC CRC checksum Calculated

XX XX BCC CRC checksum Calculated

10/17/2012 © 3M 2009. All rights reserved. Page 36

Reader Protocol Specification Revision 1.0.0

Appendix A: Error Codes

Error Name Description Code
Command Not Implemented The command code is not implemented in a given 0x02
version of the reader firmware.
No Transponder The most common error you will ever see. Many 0x06
times it means the tag is no longer in the RF field.
Other times it means you passed a bad UID. Still
other times it means the UID is valid, the tag is in
the field, but the tag does not respond to the air
command with an error because it is NOT
required to by the ISO 15693 spec.
Unknown Error Spec’d in both the TI Tag-it™ tag and ISO tag 0x0F
specs. We assume it is a catchall error.
Mem Not Available* Probably an invalid block number. Could be the 0x11
non-existence of an AFI/DSFID on some ISO
tags.
Mem Locked* Block / AFI / DSFID is locked and cannot be 0x12
written to.
Mem Not Read* Probably an error reading a valid block. Maybe 0x15
an error reading AFI/DSFID.
Mem Not Put* An error writing data to a block / AFI / DSFID. 0x16
Tag Command Not ISO error 0x01 0x21
Supported
Tag Command Unknown ISO error 0x02 0x22
Tag Command Option Not ISO error 0x03 0x23
Supported
Not Supported Command is not supported on a particular tag and 0x30
the reader knows it (e.g. AFI operation on a Tag-
it tag). Some commands may not be supported on
a particular tag but the reader does not know it
and the tag won’t tell us (see No Transponder
above).
Option Not Supported The reader understands the command but not the 0x31
option(s) that were sent.
Param Error Developer catchall error – signifies an error in a 0x32
parameter passed to a function by the
programmer or perhaps thru a serial command
User Cancel The host has cancelled an operation. 0xFD
Not Enough Memory The firmware does not have enough memory 0xFE
available in it’s buffer(s), eeprom, etc.

*These used to be Block Not Available, etc. but have been re-used over time for AFI, DSFID and other
things so they are renamed to be more generic.

10/17/2012 © 3M 2009. All rights reserved. Page 37

Reader Protocol Specification Revision 1.0.0

Appendix B: ISO Manufacturer Codes

The manufacturer code is the 2nd byte (after the E0) in an ISO 64bit serial number:

Description Code
ST 0x02
NXP 0x04
Texas Instruments 0x07

10/17/2012 © 3M 2009. All rights reserved. Page 38

Reader Protocol Specification Revision 1.0.0

Appendix C: CRC Calculations

Pseudo Code for a CRC Calculation

POLYNOMIAL = 0x1021
PRESET = 0xFFFF

CRC = PRESET //The CRC starts as the Preset Value

FOR ALL BYTES TO BE CALCULATED

{

BYTE = The next byte to be calculated in the series

A = MSB of CRC
B = MSB of BYTE

CRC = CRC << 1

If [ (A xor B) > 0 ]
{
CRC = CRC xor POLYNOMIAL
}

BYTE = BYTE << 1

}//Repeat for each byte to be calculated

CRC = CRC XOR PRESET

return CRC

10/17/2012 © 3M 2009. All rights reserved. Page 39

Reader Protocol Specification Revision 1.0.0

Appendix E: Revisions History

Rev. Author Description of Changes Date
Number
1.0.0 Tom Mercer Released to General Public 6/1/09

10/17/2012 © 3M 2009. All rights reserved. Page 40