DL920 UHF RFID Reader User's Manual

V2.3
 Content
1. COMMUNICATION INTERFACE SPECIFICATION ........................................................................................ 4
2. PROTOCOL DESCRIPTION ............................................................................................................................... 4
3. DATA BLOCK FORMAT ..................................................................................................................................... 5
3.1 COMMAND DATA BLOCK ...................................................................................................................... 5
3.2 RESPONSE DATA BLOCK ........................................................................................................................ 5
4. OPERATION COMMAND (CMD) SUMMARY ................................................................................................. 6
4.1 EPC C1 G2（ISO18000-6C）COMMAND ............................................................................................... 6
4.2 18000-6B COMMAND ............................................................................................................................... 8
4.3 READER DEFINED COMMAND ............................................................................................................. 8
5. LIST OF COMMAND EXECUTION RESULT STATUS .................................................................................... 9
6. TAG ERROR CODES ......................................................................................................................................... 13
7. TAG MEMORY AND ISSUES REQUIRING ATTENTION ............................................................................. 13
8. DETAILED DESCRIPTION OF OPERATION COMMAND............................................................................ 14
8.1 COMMAND OVERVIEV ......................................................................................................................... 14
8.2 EPC C1G2 COMMAND ........................................................................................................................... 14
8.2.1 Inventory ......................................................................................................................................... 14
8.2.2 Read Data........................................................................................................................................ 15
8.2.3 Write Data ....................................................................................................................................... 16
8.2.4 Write EPC ....................................................................................................................................... 17
8.2.5 Kill Tag ........................................................................................................................................... 18
8.2.6 Lock ................................................................................................................................................ 19
8.2.7 BlockErase ...................................................................................................................................... 20
8.2.8 ReadProtect (With EPC) ................................................................................................................. 22
8.2.9 ReadProtect (Without EPC) ............................................................................................................ 22
8.2.10 Reset ReadProtect ......................................................................................................................... 23
8.2.11 Check ReadProtect ........................................................................................................................ 23
8.2.12 EAS Alarm .................................................................................................................................... 24
8.2.13 Check EAS Alarm......................................................................................................................... 25
8.2.14 User Block Lock ........................................................................................................................... 25
8.2.15 Inventory (Single) ......................................................................................................................... 26
8.2.16 Block Write ................................................................................................................................... 26
8.2.17 Read Data with mask extended ..................................................................................................... 28
8.2.18 Write Data with mask extended .................................................................................................... 29
8.2.19 Write EPC with mask extended .................................................................................................... 30
8.2.20 Lock with mask extended ............................................................................................................. 31
8.3 18000-6B COMMAND ............................................................................................................................. 33
8.3.1Inventory Signal 6B ......................................................................................................................... 33
8.3.2 Inventory Multiple 6B .................................................................................................................... 33
8.3.3 Read Data 6B .................................................................................................................................. 34
8.3.4 Write Data 6B ................................................................................................................................. 35
8.3.5 Check Lock 6B ............................................................................................................................... 35
8.3.6 Lock 6B .......................................................................................................................................... 36
8.4 READ-DEFINED COMMAND ................................................................................................................ 36
8.4.1 Get Reader Information .................................................................................................................. 36
8.4.2 Set Region....................................................................................................................................... 37
8.4.3 Set Address ..................................................................................................................................... 38
8.4.4 Set Scan Time ................................................................................................................................. 38
8.4.5 Set Band Rate ................................................................................................................................. 39
8.4.6 Set Power ........................................................................................................................................ 39
8.4.7 Acousto-optic Control ..................................................................................................................... 40
8.4.8 Set Wiegand .................................................................................................................................... 40
8.4.9 Set WorkMode ................................................................................................................................ 41
8.4.10 Get WorkMode.............................................................................................................................. 43
8.4.11 SetEasAccuracy ............................................................................................................................ 44
8.4.12 Syris Response Offset ................................................................................................................... 44
8.4.13 Trigger Offset................................................................................................................................ 45
8.4.14 SetRelayStatus .............................................................................................................................. 45
 DL920 UHF RFID Reader User's Manual V2.3

1. COMMUNICATION INTERFACE SPECIFICATION

The reader communicates with host (MCU，MPU，Controller) using serial communication interface RS232 or
RS485 and complete corresponding operation according to the host command. The communication parameter is
57600bps 1 start bit, 8 data bits, 1 stop bit without parity check bit. In the process of serial communication, the
least significant bit of one byte is transmitted first and the least significant byte of command data sequence is
transmitted first.

2. PROTOCOL DESCRIPTION

A communication procedure is sponsored by the host sending commands and data to the reader and the
reader returns the result status and data to host after command execution.
Reader receives a command executes a command, only the reader complete the implementation of a
command, to receive the next command. During the implementation of the command in the reader, if sending
commands to the reader, the command will be lost.
The following table shows the process of the host computer command:
HOST DIRECTION READER
Command Data Block →
The interval between two consecutive bytes in the command data block should be less than 15ms. During
command data block sending, synchronization will lost if the host receives any data from the reader and the host
should stop command sending and restart the communication after 15ms.
The reader completes command execution in inventory ScanTime (not including host sending data time)
except inventory command after receiving host command and returns the results. During the period, it doesn’t
process any host data. The feedback of command execution results is as follows:
READER DIRECTION HOST
Command Data Block →
The interval between two consecutive bytes in the response data block should be less than 15ms.

4
 DL920 UHF RFID Reader User's Manual V2.3

3. DATA BLOCK FORMAT

3.1 COMMAND DATA BLOCK

Len Adr Cmd Data[] LSB-CRC16 MSB-CRC16

COMMENT：
LENGTH(Byte) COMMENT
Len 1 Command data block length 1 byte (not including itself). Value
range is 4~96. The number of Len equals the length of Data []
plus 4.
Adr 1 Reader address, 1 byte. Value range is 0~254. Only will the
reader conforming to the address response the command data
block. Value 255 is broadcasting address. All the readers will
response to the command data block with a broadcasting
address. The default value shall be zero.
Cmd 1 Operation command symbol, 1 byte.
Data[] Variable Operation command parameters. There is no parameter if the
LEN item equals 4.
LSB-CRC16 1 CRC-16 LSB. CRC-16 checksum, 2 bytes with least
significant byte first.
MSB-CRC16 1 CRC-16 MSB.

3.2 RESPONSE DATA BLOCK

Len Adr reCmd Status Data[] LSB-CRC16 MSB-CRC16

COMMENT：
LENGTH(Byte) COMMENT
Len 1 Response data block length 1 byte (not including itself). The
number of Len equals the length of Data [] plus 5.
Adr 1 Reader address, 1 byte. Value rang is 0~254.
reCmd 1 Response command symbol, 1 byte. If the command is
unrecognized, the reCmd is 0x00.
Status 1 Result status value, 1byte. Refer to following table for details.
Data[] Variable Response data. There is no this item if Len equals 5.
LSB-CRC16 1 CRC16 LSB .CRC-16 checksum, 2 bytes with least significant
byte first.
MSB-CRC16 1 CRC16 MSB

The default value of the reader address is 0x00. The host may change it by using reader-defined command

5
 DL920 UHF RFID Reader User's Manual V2.3

“Write Adr”.
Cyclic Redundancy Check (CRC) computation includes all data from Len. A reference CRC computation
program is presented as follow:
C-Example:
#define PRESET_VALUE 0xFFFF
#define POLYNOMIAL 0x8408
unsigned int uiCrc16Cal(unsigned char const * pucY, unsigned char ucX)
{
unsigned char ucI,ucJ;
unsigned short int uiCrcValue = PRESET_VALUE;

for(ucI = 0; ucI < ucX; ucI++)

{
uiCrcValue = uiCrcValue ^ *(pucY + ucI);
for(ucJ = 0; ucJ < 8; ucJ++)
{
if(uiCrcValue & 0x0001)
{
uiCrcValue = (uiCrcValue >> 1) ^ POLYNOMIAL;
}
else
{
uiCrcValue = (uiCrcValue >> 1);
}
}
}
return uiCrcValue;
}

4. OPERATION COMMAND (CMD) SUMMARY

4.1 EPC C1 G2（ISO18000-6C）COMMAND

NUM COMMAND CODE COMMENT

The function is used to inventory tags in the effective field and
1 Inventory 0x01
get their EPC values.
The function is used to read part or all of a Tag’s Password,
2 Read Data 0x02 EPC, TID, or User memory. To the word as a unit, start to read
data from the designated address.
The function is used to write several words in a Tag’s
3 Write Data 0x03
Reserved, EPC, TID, or User memory.

6
 DL920 UHF RFID Reader User's Manual V2.3

The function is used to write EPC value in a Tag’s EPC

4 Write EPC 0x04
memory. Random write one tag in the effective field.
The function is used to kill tag. After the tag killed, it never
5 Kill Tag 0x05
process command.
The function is used to set Password area as readable and
writeable from any state, readable and writeable from the
secured state, permanently readable and writeable, never
6 Lock 0x06
readable and writeable. It used to set EPC, TID or User as
writeable from any state, writeable from the secured state,
permanently writeable, never writeable.
The function is used to erase multiple words in a Tag’s
7 Block Erase 0x07
Password, EPC, TID, or User memory.
The function is used to set designated tag read protection. After
the tag protected, it never process command. Even if inventory
8 ReadProtect 0x08 tag, reader can not get the EPC number. The read protection
can be removed by executing Reset ReadProtect. Only NXP's
UCODE EPC G2X tags valid.
The function is used to random set one tag read protection in
Read Protect
9 0x09 the effective field. The tag must be having the same access
(without EPC)
password. Only NXP's UCODE EPC G2X tags valid.
The function is used to remove only one tag read protection in
10 Reset ReadProtect 0x0a the effective field. The tag must be having the same access
password. Only NXP's UCODE EPC G2X tags valid.
The function is used to check only one tag in the effective field,
whether the tag is protected. It can not check the tag whether
11 Check ReadProtect 0x0b
the tag support protection setting. Only NXP's UCODE EPC
G2X tags valid.
The function is used to set or reset the EAS status bit of
12 EAS Alarm 0x0c
designated tag. Only NXP's UCODE EPC G2X tags valid.
Check The function is used to check EAS status bit of any tag in the
13 0x0d
EAS Alarm effective field. Only NXP's UCODE EPC G2X tags valid.
The function is used to permanently lock the designated data in
designated tag’s user memory. The locked data can be read
14 Block Lock 0x0e
only, but not written and not erased. Only NXP's UCODE EPC
G2X tags valid.
The function is used to inventory one tag in the effective field
15 Inventory(Single) 0x0f
and get their EPC values.
The function is used to write multiple words in a Tag’s
16 Block Write 0x10
Reserved, EPC, TID, or User memory.
The function is used to read part or all of a Tag’s Password,
Read Data with mask
17 0x11 EPC, TID, or User memory. It utilize flexible mask pattern for
extended
selecting one tag to operate.

7
 DL920 UHF RFID Reader User's Manual V2.3

The function is used to write several words in a Tag’s

Write Data with mask
18 0x12 Reserved, EPC, TID, or User memory. It utilize flexible mask
extended
pattern for selecting one tag to operate.
The function is used to write EPC value in a Tag’s EPC
Write EPC with mask
19 0x13 memory. It utilize flexible mask pattern for selecting one tag to
extended
operate.
Lock with mask The function is almost the same as Lock command but utilizes
20 0x14
extended flexible mask pattern for selecting one tag to operate.

4.2 18000-6B COMMAND

NUM COMMAND CODE CONNECT

The function is used to Inventory only one tag in the effective
1 Inventory signal 6B 0x50 field and get their ID values. If more than one tag in the
effective field at the same time, reader may be get nothing.
The function is used to according to the given conditions
2 Inventory multiple 6B 0x51
Inventory tags in the effective field and get their ID values.
The function is used to start to read several bytes from the
3 Read Data 6B 0x52
designated address.
The function is used to start to write several bytes from the
4 Write Data 6B 0x53
designated address.
The function is used to check whether the designated byte is
5 Check Lock 6B 0x54
locked.
6 Lock 6B 0x55 The function is used to lock the designated byte.

4.3 READER DEFINED COMMAND

NUM COMMAND CODE CONNECT

This function is used to get reader-related information such as
GetReader
1 0x21 reader address (Adr), firmware version, supported protocol
Information
type, Inventory ScanTime, power and frequency.
Sets the current region. The function is used to set the reader
2 Set Region 0x22
working of the lower limit and the upper limit of frequency.
This function is used to set a new address of the reader. The
address value will store in reader’s inner nonvolatile memory.
Default address value is 0x00. The value range is 0x00~0xFE.
3 Set Address 0x24
The address 0xFF is reserved as the broadcasting address.
When user tries to write a 0xFF to Adr, the reader will set the
value to 0x00 automatically.
This function is used to set a new value to Inventory ScanTime
of an appointed reader. The range is 3~255 corresponding to
4 Set ScanTime 0x25
3*100ms~255*100ms Inventory ScanTime. The default value
of Inventory ScanTime is 10*100ms.

8
 DL920 UHF RFID Reader User's Manual V2.3

5 Set Baud Rate 0x28 The function is used to change the serial port baud rate.
6 Set Power 0x2F The function is used to set the power of reader.
7 Acousto-optic Control 0x33 Acousto-optic Control
8 Set Wiegand 0x34 The function is used to set Wiegand parameter.
9 Set WorkMode 0x35 The function is used to set work mode parameter.
10 Get WorkMode 0x36 The function is used to get work mode parameter.
11 SetEasAccuracy 0x37 The function is used to set EasAlarm Accuracy.
12 Syris Response Offset 0x38 The function is used to set Syris485 response offset time.
13 Trigger Offset 0x3b The function is used to set Trigger Offset time.
14 SetRelayStatus 0x3c The function is used to set built-in relay status

5. LIST OF COMMAND EXECUTION RESULT STATUS

RESPONSE DATA BLOCK

STATES CONNECT
Len Adr reCmd Status Data[] CRC16
Length Return status 0x00 to host
of after command is executed
0xXX 0xXX 0x00 …….. LSB+MSB Success
Data[] successfully. Data block
+5 contains result data.
Return status 0x01 to host
when the reader executes
Length an Inventory command and
Return before
of gets some complete G2
0xXX 0x01 0x01 …….. LSB+MSB Inventory
Data[] tags’ EPC before
finished
+5 user-defined
Inventory-ScanTime
finished.
Return status 0x02 when
the reader executes an
Length the
Inventory command and
of Inventory-sca
0xXX 0x01 0x02 …….. LSB+MSB does not get all G2 tags’
Data[] n-time
EPC before user-defined
+5 overflow
Inventory-ScanTime
overflows.
Return status 0x03 when
the reader executes an
Length
Inventory command and
of
0xXX 0x01 0x03 …….. LSB+MSB More Data gets many G2 tags’ EPC,
Data[]
Data can not be completed
+5
within in a message, and
then send in multiple.

9
 DL920 UHF RFID Reader User's Manual V2.3

Return status 0x04 when

Length the reader executes an
Reader
of Inventory command and
0xXX 0x01 0x04 …….. LSB+MSB module flash
Data[] gets G2 tags’ EPC too
is Full
+5 much, more than the
storage capacity of reader.
Return status 0x05 when
Access the reader implements a
5 0xXX 0xXX 0x05 __ LSB+MSB Password command whit password,
error while the password is
wrong.
Return status 0x09 when
the reader implement a
Kill command, while the
5 0xXX 0x05 0x09 __ LSB+MSB Kill Tag error
kill password error, or poor
communication reader and
tag.
Kill Password
Return status 0x0a when
5 0xXX 0x05 0x0a __ LSB+MSB error can’t be
the Kill Password is zero.
zero
Tag Not Return status 0x0b when
5 0xXX 0xXX 0x0b __ LSB+MSB Support the the G2 Tag dose not
command supports the command.
Return status 0x0c when
Use the
the NXP UCODE EPC
command,
G2X Tag is set read
5 0xXX 0xXX 0x0c __ LSB+MSB Access
protection or EAS Alarm,
Password
the access password is
Can’t be Zero
zero.
Tag is
Return status 0x0d when
protected,
5 0xXX 0x0a 0x0d __ LSB+MSB the NXP UCODE EPC
cannot set it
G2X Tag is protected.
again
Return status 0x0e when
Tag is
the NXP UCODE EPC
unprotected,
5 0xXX 0x0a 0x0e __ LSB+MSB G2X Tag is unprotected or
no need to
the tag does not support
reset it
the command.
Return status 0x10 when
There is some
the 6B Tag is written data,
5 0xXX 0x53 0x10 __ LSB+MSB locked bytes,
while there are some
write fail
locked bytes, write fail.

10
 DL920 UHF RFID Reader User's Manual V2.3

Return status 0x11 when

5 0xXX 0x55 0x11 __ LSB+MSB can not lock it the 6B Tag can’t be
locked.
Be locked, Return status 0x12 when
5 0xXX 0x55 0x12 __ LSB+MSB cannot lock it the 6B Tag has been
again locked.
Save Fail,
Return status 0x13 when
5 0xXX 0xXX 0x13 __ LSB+MSB Can Use
the parameter is save fail.
Before Power
Return status 0x14 when
5 0xXX 0xXX 0x14 __ LSB+MSB Cannot adjust the power can not be
adjusted.
Return status 0x15 to host
when the reader executes
Length an Inventory command and
Return before
of gets some complete 6B
0xXX 0x51 0X15 …….. LSB+MSB Inventory
Data[] tags’ UID before
finished
+5 user-defined
Inventory-ScanTime
finished.
Return status 0x16 when
the reader executes an
Length
Inventory-Sca Inventory command and
of
0xXX 0x51 0x16 …….. LSB+MSB n-Time does not get all 6B tags’
Data[]
overflow UID before user-defined
+5
Inventory-ScanTime
overflows.
Return status 0x17 when
the reader executes an
Length
Inventory command and
of
0xXX 0x51 0x17 …….. LSB+MSB More Data gets many 6B tags’ UID,
Data[]
Data can not be completed
+5
within in a message, and
then send in multiple.
Return status 0x18 when
Length the reader executes an
Reader
of Inventory command and
0xXX 0x51 0x18 …….. LSB+MSB module flash
Data[] gets 6B tags’ UID too
is Full
+5 much, more than the
storage capacity of reader.

11
 DL920 UHF RFID Reader User's Manual V2.3

Return status 0x19 when

Not Support the tag can’t set EAS
Command Or Alarm. There may be the
5 0xXX 0xXX 0x19 __ LSB+MSB
Access tag does not support the
Password command, or the tag’s
access password be zero.
Command Return status 0xF9 when
5 0xXX 0xXX 0xF9 __ LSB+MSB
execute error Command execute error
Return status 0xFA when
Get Tag, Poor there are some tags in the
5 0xXX 0xXX 0xFA __ LSB+MSB Communicati effective field, but Poor
on, Inoperable Communication between
reader and tag.
Return status 0xFB when
No Tag
5 0xXX 0xXX 0xFB __ LSB+MSB there is no tag in the
Operable
effective field.
Err_cod Tag Return Return status 0xFC when
6 0xXX 0xXX 0xFC LSB+MSB
e Error Code the tag returns Error Code.
Return status 0xFD when
Command the length of command
5 0xXX 0xXX 0xFD __ LSB+MSB
length wrong operands doesn’t conform
to the command request.
Return status 0xFE when
Illegal the command is an
5 0xXX 0x00 0xFE __ LSB+MSB
command unrecognized command or
CRC error.
Return status 0xFF when
Parameter
5 0xXX 0xXX 0xFF __ LSB+MSB the command parameter
Error
is invalid.

12
 DL920 UHF RFID Reader User's Manual V2.3

6. TAG ERROR CODES

EPC C1G2（ISO18000-6C）Tag error codes：

Error-Code Support Error-Code Error-Code Name Error Description
Catch-all for errors not covered by other
0x00 Other error
codes.
The specified memory location does not
0x03 Memory overrun exist or the EPC length field is not
supported by the Tag.
Error-specific
The specified memory location is locked
0x04 Memory locked and/or perm locked and is either not
writeable or not readable.
The Tag has insufficient power to
0x0b Insufficient power
perform the memory-write operation
The Tag does not support error-specific
Non-specific 0x0f Non-specific error
codes

7. TAG MEMORY AND ISSUES REQUIRING ATTENTION

A. EPC C1G2 TAG（G2 TAG）

Tag memory shall be logically separated into four distinct banks, each of which may comprise zero or more
memory words. The four storage areas:
Reserved memory (password memory) shall contain the kill and and/or access passwords, if passwords are
implemented on the Tag. The kill password shall be stored at memory addresses 00h to 1Fh; the access password
shall be stored at memory addresses 20h to 3Fh.
EPC memory shall contain a Stored CRC at memory addresses 00h to 0Fh, a Stored PC at addresses 10h to
1Fh, a code (such as an EPC, and hereafter referred to as an EPC) that identifies the object to which the Tag is or
will be attached beginning at address 20h, and if the Tag implements Extended Protocol Control (XPC) then either
one or two XPC word(s) beginning at address 210h.
TID memory shall contain an 8-bit ISO/IEC 15963 allocation class identifier at memory locations 00h to
07h. TID memory shall contain sufficient identifying information above 07h for an Interrogator to uniquely
identify the custom commands and/or optional features that a Tag supports.
User memory is optional. This area of different manufacturers is different. There is no user area in G2 tag of
Inpinj Company. There are 28 words in Philips Company.
Can write protect in four distinct banks. It means this memory is never writeable or not writeable under the
non-safe state; only password area can set unreadable.

B. 18000-6B TAG
6B tag has a memory space, the minimum 8 bytes (byte 0- 7) is UID of the tag, and can't be rewritten.
Following byte all can be rewritten, can be locked too, but once locking, can't rewrite and unblock again.

13
 DL920 UHF RFID Reader User's Manual V2.3

8. DETAILED DESCRIPTION OF OPERATION COMMAND

8.1 COMMAND OVERVIEV

The reader supports three kinds of command, one kind is the ISO/IEC 18000-6 protocol command, another
kind is reader-defined command, and also one kind is the transparent command.
If the host input of the command is an unrecognized command, such as the command does not support, or
CRC error in the command, then the return value is as follows:
Len Adr reCmd Status CRC-16
0x05 0xXX 0x00 0xFE LSB MSB

If the length of command operands doesn’t conform to the command request, the return value is as follows:
Len Adr reCmd Status CRC-16
0x05 0xXX 0xXX 0xFD LSB MSB
Two kinds of command reader cannot respond:
1. The reader’s address error.
2. The command is incomplete, namely the command Len is longer than the actual command length.

8.2 EPC C1G2 COMMAND

8.2.1 Inventory

The command function is used to inventory tags in the effective field and get their EPC or TID values. The
reader executes an Inventory command and gets tag’s EPC before any other operation.
The user may accord need to establish this command the first biggest running time (Inventory scan time),
before the command enquires. The reader completes command execution in inventory ScanTime (not including
host sending data time) except inventory command after receiving host command and returns the results.
The default value is 0x0A (corresponding to 10*100ms=1s). The value range is 0x03~0xFF (corresponding to
3*100ms~255*100ms). In various environments, the actual inventory scan time may be 0~75ms longer than the
InventoryScanTime defined.
If the inventory scan time establishes excessively short, possibly will inventory no tag appear in inventory
scan time.
Command:
Data[]
Len Adr Cmd CRC-16
AdrTID LenTID
0xXX 0xXX 0x01 0xXX 0xXX LSB MSB
Parameter Connect:
AdrTID: One byte. It specifies the starting word address for the TID memory read. For example, AdrTID =
00h specifies the first 16-bit memory word, AdrTID = 01h specifies the second 16-bit memory word, etc.

LenTID: One byte. It specifies the number of 16-bit words to be read. The value is less then 16, otherwise, it

14
 DL920 UHF RFID Reader User's Manual V2.3

returns the parameters error message.

Notes: It will get tags’ EPC values when the AdrTID and LenTID vacant. Otherwise, get tags’ TID values.
TID-inventory function is only available for reader with firmware version V2.36 and above.

Respond:
Data[]
Len Adr reCmd Status CRC-16
Num EPC ID

0xXX 0xXX 0x01 0xXX 0xXX EPC-1, EPC-2, EPC-3… LSB MSB
Parameter Connect:
Status Table:
Status Connect
0x01 Command over, and return inventoried tag’s EPC (TID).
The reader does not get all G2 tags’ EPC/TID before user-defined Inventory-ScanTime
0x02
overflows. Command force quit, and returns inventoried tags’ EPC (TID).
The reader executes an Inventory command and gets many G2 tags’ EPC (TID). Data
0x03
can not be completed within in a message, and then send in multiple.
The reader executes an Inventory command and gets G2 tags’ EPC (TID) too much,
0x04
more than the storage capacity of reader, and returns inventoried tags’ EPC (TID).
Num: The number of tag detected.

EPC ID: Inventoried tag’s EPC (TID) data, EPC-1 is the first tag EPC Len + EPC Data (TID Len + TID
Data), etc. The most significant word (EPC C1 G2 data in word units) of EPC is transmitted first and the most
significant byte of word is transmitted first. EPC (TID) Len is one byte.

8.2.2 Read Data

The command is used to read part or all of a Tag’s Password, EPC, TID, or User memory. To the word as a
unit, start to read data from the designated address.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x02 —— LSB MSB
Data as follows:
Data[]
ENum EPC Mem WordPtr Num Pwd MaskAdr MaskLen
0xXX Variable 0xXX 0xXX 0xXX 4Byte 0xXX 0xXX
Parameter Connect:
ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.

EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC
numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.

15
 DL920 UHF RFID Reader User's Manual V2.3

Requirement given here is a complete EPC number.

Mem: One byte. It specifies whether the Read accesses Password, EPC, TID, or User memory. 0x00:
Password memory; 0x01: EPC memory; 0x02; TID memory; 0x03: User memory. Other values reserved. Other
value when error occurred.

WordPtr: One byte. It specifies the starting word address for the memory read. For example, WordPtr = 00h
specifies the first 16-bit memory word, WordPtr = 01h specifies the second 16-bit memory word, etc.

Num: One byte. It specifies the number of 16-bit words to be read. The value is less then 120, can not be 0.
Otherwise, it returns the parameters error message.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Only done the memory set to lock and the Tag’s Access Password is not zero, it needs right Pwd.
In other cases, Pwd can be zero.

MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.

MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.

Respond:
Len Adr reCmd Status Data[] CRC-16
0xXX 0xXX 0x02 0x00 Word1，Word2,… LSB MSB

Parameter Connect:
Word1, Word2….: In word units, one word is two bytes. High byte is first. Word1 is the word which
reads from the start address, Word2 is the word which reads from the second address, etc.

8.2.3 Write Data

The command is used to write several words in a Tag’s Reserved, EPC, TID, or User memory.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x03 —— LSB MSB
Data as follows:
Data[]

16
 DL920 UHF RFID Reader User's Manual V2.3

WNum ENum EPC Mem WordPtr Wdt Pwd MaskAdr MaskLen

0xXX 0xXX Variable 0xXX 0xXX Variable 4Byte 0xXX 0xXX
Parameter Connect:
WNum: One byte. It specifies the number of 16-bit words to be written. The value can not be 0. Otherwise, it
returns the parameters error message.

ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.

EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC
numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.
Requirement given here is a complete EPC number.

Mem: One byte. It specifies whether the Write accesses Password, EPC, TID, or User memory. 0x00:
Password memory; 0x01: EPC memory; 0x02; TID memory; 0x03: User memory. Other values reserved. Other
value when error occurred.

WordPtr: One byte. It specifies the starting word address for the memory write. For example, WordPtr = 00h
specifies the first 16-bit memory word, WordPtr = 01h specifies the second 16-bit memory word, etc.

Wdt: Be written words. The most significant byte of each word is first. Wdt specifies the array of the word
to be written. For example, WordPtr equal 0x02, then the first word in Data write in the address 0x02 of
designated Mem, the second word write in 0x03, etc.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Only done the memory set to lock and the Access Password is not zero, it needs Pwd. In other
cases, Pwd can be zero.

MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.
MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x03 0x00 —— LSB MSB

8.2.4 Write EPC

The command is used to write EPC number in a Tag’s EPC memory. Random write one tag in the effective

17
 DL920 UHF RFID Reader User's Manual V2.3

field.
Command:
Data[]
Len Adr Cmd CRC-16
ENum Pwd WEPC
0xXX 0xXX 0x04 0xXX 4Byte Variable LSB MSB
Parameter Connect:
ENum: One byte, it specifies the array of the word to be written EPC length，in word units. The length of
EPC is not more than 15 words, can’t be 0. Otherwise, it returns the parameters error message.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Only done the memory set to lock and the Access Password is not zero, it needs Pwd. In other
cases, Pwd can be zero.

WEPC: Be written EPC value. WEPC is not more than 15 words, can’t be 0. Otherwise, it returns the
parameters error message.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x04 0x00 —— LSB MSB

8.2.5 Kill Tag

The command is used to kill tag. After the tag killed, it never process command.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x05 —— LSB MSB

Data as follows:
Data[]
ENum EPC Killpwd MaskAdr MaskLen
0xXX Variable 4Byte 0xXX 0xXX
Parameter Connect:
ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.

EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC
numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.
Requirement given here is a complete EPC number.

Killpwd: Four bytes, they are Kill Password. The most significant word of Kill Password is first, the most

18
 DL920 UHF RFID Reader User's Manual V2.3

significant byte of word is first. The first bit of 32-bit Kill Password is left, and the last bit of 32-bit Kill Password
is right. Tag’s whose Kill Password is zero do not execute a kill operation; if such a Tag receives a Kill command
it ignores the command and backscatters an error code

MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.

MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.
Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x05 0x00 —— LSB MSB

8.2.6 Lock

The Lock command Lock reversibly or permanently locks a password or an entire EPC, TID, or User memory
bank in a readable/writeable or unreadable/unwriteable state.
Once tag’s password memory establishes to forever may be readable and writable or unreadable and
unwriteable, then later cannot change its read-write protection again. Tag’s EPC memory, TID memory or user
memory, if establishes to forever may be writeable or unwriteable, then later cannot change its read-write
protection again. If sends the command to want forcefully to change the above several states, then the tag will
return to the error code.
When the tag’s memory established in a readable/writeable state, the command must give the Access
Password, so tag’s Access Password is not zero.

Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x06 —— LSB MSB
Data as follows:
Data[]
ENum EPC Select SetProtect Pwd MaskAdr MaskLen
0xXX Variable 0xXX 0xXX 4Byte 0xXX 0xXX
Parameter Connect:
ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.

EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC

19
 DL920 UHF RFID Reader User's Manual V2.3

numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.
Requirement given here is a complete EPC number.

Select: One byte, defined as follows:

0x00: Control Kill Password protection setting.
0x01: Control Access password protection setting.
0x02: Control EPC memory protection setting.
0x03: Control TID memory protection setting.
0x04: Control User memory protection setting.
Other value when error occurred.

SetProtect:
When Select is 0x00 or 0x01, SetProtect means as follows:
0x00: readable and writeable from any state.
0x01: permanently readable and writeable.
0x02: readable and writeable from the secured state.
0x03: never readable and writeable
When Select is 0x02, 0x03 or 0x04, SetProtect means as follows:
0x00: writeable from any state.
0x01: permanently writeable.
0x02: writeable from the secured state.
0x03: never writeable.
Other value when error occurred.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Pwd must be right Access Password.

MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.

MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x06 0x00 —— LSB MSB

8.2.7 BlockErase

The command is used to erase multiple words in a Tag’s Password, EPC, TID, or User memory.

20
 DL920 UHF RFID Reader User's Manual V2.3

Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x07 —— LSB MSB
Data as follows:
Data[]
ENum EPC Mem WordPtr Num Pwd MaskAdr MaskLen
0xXX Variable 0xXX 0xXX 0xXX 4Byte 0xXX 0xXX
Parameter Connect:
ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.
EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC
numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.
Requirement given here is a complete EPC number.

Mem: One byte. It specifies whether the Erase accesses Password, EPC, TID, or User memory. 0x00:
Password memory; 0x01: EPC memory; 0x02; TID memory; 0x03: User memory. Other values reserved. Other
value when error occurred.

WordPtr: One byte. It specifies the starting word address for the memory block erase. For example, WordPtr
= 00h specifies the first 16-bit memory word, WordPtr = 01h specifies the second 16-bit memory word, etc.
WordPtr must be bigger than 0x00 when it erases EPC memory.

Num: One byte. It specifies the number of 16-bit words to be erased. If Num = 0x00, it returns the
parameters error message.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Only done the memory set to lock and the Access Password is not zero, it needs Pwd. In other
cases, Pwd can be zero.
MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.

MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x07 0x00 —— LSB MSB

21
 DL920 UHF RFID Reader User's Manual V2.3

8.2.8 ReadProtect (With EPC)

The command is used to set designated tag read protection. After the tag protected, it never process command.
Even if inventory tag, reader can not get the EPC number. The read protection can be removed by executing Reset
ReadProtect. Only NXP's UCODE EPC G2X tags valid.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x08 —— LSB MSB

Data as follows:
Data[]
ENum EPC Pwd MaskAdr MaskLen
0xXX Variable 4Byte 0xXX 0xXX
Parameter Connect:
ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.

EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC
numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.
Requirement given here is a complete EPC number.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Tags’ Access Password can not be zero.

MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.

MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x08 0x00 —— LSB MSB

8.2.9 ReadProtect (Without EPC)

The command is used to random set random one tag read protection in the effective field. The tag must be
having the same access password. Only NXP's UCODE EPC G2X tags valid.

22
 DL920 UHF RFID Reader User's Manual V2.3

Command:
Data[]
Len Adr Cmd CRC-16
Pwd
0x08 0xXX 0x09 4Byte LSB MSB
Parameter Connect:
Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Tags’ Access Password can not be zero.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x09 0x00 —— LSB MSB

8.2.10 Reset ReadProtect

The command is used to remove only one tag read protection in the effective field. The tag must be having
the same access password. Only NXP's UCODE EPC G2X tags valid.
Command:
Data[]
Len Adr Cmd CRC-16
Pwd
0x08 0xXX 0x0a 4Byte LSB MSB
Parameter Connect:
Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Pwd must be right tag’s Access Password.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x0a 0x00 —— LSB MSB
Notes: If a tag does not support the command, is unlocked.

8.2.11 Check ReadProtect

The command is used to check only one tag in the effective field, whether the tag is protected. It can not
check the tag whether the tag support protection setting. Only NXP's UCODE EPC G2X tags valid.
Command:
Len Adr Cmd Data[] CRC-16
0x04 0xXX 0x0b —— LSB MSB

Respond:
Len Adr reCmd Status Data[] CRC-16
0x06 0xXX 0x0b 0x00 ReadPro LSB MSB
Parameter Connect:
ReadPro Connect

23
 DL920 UHF RFID Reader User's Manual V2.3

0x00 Tag is protected.

0x01 Tag is unprotected.
Notes: If a tag does not support the command, is unprotected.

8.2.12 EAS Alarm

The function is used to set or reset the EAS status bit of designated tag. Only NXP's UCODE EPC G2X tags
valid.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x0c —— LSB MSB
Data as follows:
Data[]
ENum EPC Pwd EAS MaskAdr MaskLen
0xXX Variable 4Byte 0xXX 0xXX 0xXX
Parameter Connect:
ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.

EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC
numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.
Requirement given here is a complete EPC number.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Tags’ Access Password can not be zero.

EAS: One byte. Bit0=0 means reset the EAS state, Bit0=1 means set the EAS state.Bit1~Bit7 default 0.

MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.

MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.
Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x0c 0x00 —— LSB MSB

24
 DL920 UHF RFID Reader User's Manual V2.3

8.2.13 Check EAS Alarm

The function is used to check EAS status bit of any tag in the effective field. Only NXP's UCODE EPC G2X
tags valid.
Command:
Len Adr Cmd Data[] CRC-16
0x04 0xXX 0x0d —— LSB MSB

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x0d 0x00 —— LSB MSB
It returns "no tag actionable" message when No EAS alarm

8.2.14 User Block Lock

The command is used to permanently lock the designated data in designated tag’s user memory. Block Lock
command supports an additional locking mechanism, which allows the locking of individual 32 bit blocks (rows)
in the 224 bit User Memory. Once locked these locks cannot be unlocked. Only NXP's UCODE EPC G2X tags
valid.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x0e —— LSB MSB
Data as follows:
Data[]
ENum EPC pwd WrdPointer MaskAdr MaskLen
0xXX Variable 4Byte 0xXX 0xXX 0xXX
Parameter Connect:
ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.

EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC
numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.
Requirement given here is a complete EPC number.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Pwd must be right tag’s Access Password.

WrdPointer: Each EEPROM row can be addressed by either of the two related WordPointers:
Either of two WordPointers can address one single User Memory row
WrdPointer User EEPROM row
0 or 1 0
2 or 3 1

25
 DL920 UHF RFID Reader User's Manual V2.3

4 or 5 2
6 or 7 3
8 or 9 4
10 or 11 5
12 or 13 6

MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.

MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x0e 0x00 —— LSB MSB

8.2.15 Inventory (Single)

Command:
Len Adr Cmd Data[] CRC-16
0x04 0xXX 0x0f —— LSB MSB

Respond:
Data[]
Len Adr reCmd Status CRC-16
Num EPC ID

0xXX 0xXX 0x0f 0x01 0x01 EPC-1 LSB MSB

Num: The number of tag detected.

EPC ID: Inventoried tag’s EPC data, EPC-1 is the first tag EPC Len + EPC data. The most significant word
(EPC C1 G2 data in word units) of EPC is transmitted first and the most significant byte of word is transmitted
first. EPC Len is one byte.

8.2.16 Block Write

The command is used to write multiple words in a Tag’s Reserved, EPC, TID, or User memory.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x10 —— LSB MSB
Data as follows:

26
 DL920 UHF RFID Reader User's Manual V2.3

Data[]
WNum ENum EPC Mem WordPtr Wdt Pwd MaskAdr MaskLen
0xXX 0xXX Variable 0xXX 0xXX Variable 4Byte 0xXX 0xXX
Parameter Connect:
WNum: One byte. It specifies the number of 16-bit words to be written. The value can not be 0. Otherwise, it
returns the parameters error message.

ENum: EPC length，in word units. The length of EPC is less than 15 words, can be 0 or 15. Otherwise, it
returns the parameters error message.

EPC: Be operated tag’s EPC number. EPC length according to the decision of the EPC number, EPC
numbers in word units, and must be an integer number of lengths. High word first, the high byte of each word first.
Requirement given here is a complete EPC number.

Mem: One byte. It specifies whether the Write accesses Password, EPC, TID, or User memory. 0x00:
Password memory; 0x01: EPC memory; 0x02; TID memory; 0x03: User memory. Other values reserved. Other
value when error occurred.

WordPtr: One byte. It specifies the starting word address for the memory write. For example, WordPtr = 00h
specifies the first 16-bit memory word, WordPtr = 01h specifies the second 16-bit memory word, etc.

Wdt: Be written words. The most significant byte of each word is first. Wdt specifies the array of the word
to be written. For example, WordPtr equal 0x02, then the first word in Data write in the address 0x02 of
designated Mem, the second word write in 0x03, etc.

Pwd: Four bytes, they are Access Password. The most significant word of Access Password is first, the most
significant byte of word is first. The first bit of 32-bit access password is left, and the last bit of 32-bit access
password is right. Only done the memory set to lock and the Access Password is not zero, it needs Pwd. In other
cases, Pwd can be zero.
MaskAdr: One byte, it specifies the starting byte address for the memory mask. For example, MaskAdr =
0x00 specifies the first EPC bytes, MaskAdr = 0x01 specifies the second EPC bytes, etc.

MaskLen: One byte, it is the mask length. That a Tag compares against the memory location that begins at
MaskAdr and ends MaskLen bytes later. MaskAdr + MaskLen must be less the length of ECP number.
Otherwise, it returns the parameters error message.

Notes: That a tag compares against complete EPC number when the MaskAdr and MaskLen vacant.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x10 0x00 —— LSB MSB

27
 DL920 UHF RFID Reader User's Manual V2.3

8.2.17 Read Data with mask extended

The command is used to read part or all of a Tag’s Password, EPC, TID, or User memory. It utilize flexible
mask pattern for selecting one tag to operate.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x11 - LSB MSB
Data as follows:
Data[]
ENum EPC Mem WordPtr Num Pwd MaskMem MaskAdr MaskLen MaskData
0xXX Variable 0xXX 0xXX 0xXX 4Byte 0xXX 2Bytes 0xXX Variable
Parameter explanation:
ENum: one byte length indicator in word unit (1 word = 2 bytes).
When ENum’s value is in 0~15, it represents the EPC length. And in this case, the MaskMem , MaskAdr,
MaskLen and MaskData shall all be absent.
When ENum is 0xff, there shall be MaskMem, MaskAdr, MaskLen and MaskData and no EPC presented.
The MaskMem, MaskAdr, MaskLen and MaskData construct a mask pattern for the operation.
Other value for ENum is prohibited and will incur a parameter error.

EPC: tag’s whole EPC code. Its word length is defined by ENum with most significant word first and most
significant byte in a word first.

Mem: One byte. It specifies the target memory of the operation with 0x00 for Password memory, 0x01 for
EPC memory, 0x02 for TID memory and 0x03 for User memory. Other values are reserved.

WordPtr: One byte. It specifies the starting word address for the operation with 0x00 for the first word, 0x01
for the second word and so on.

Num: One byte. It specifies the number of words to read. The value range is from 1 to 120. Other value will
incur a parameters error.

Pwd: Four bytes access password. The most significant byte (MSB) of access password is the MSB of Pwd.
Please remember to set Pwd the correct password if operation needed or set Pwd all 0s.

MaskMem: One byte. It specifies the target memory when applying mask pattern with 0x01 for EPC memory,
0x02 for TID memory and 0x03 for User memory. Other values are reserved.

MaskAdr: Two bytes. It specifies the start bit address in target memory when applying mask pattern. The
value range is from 0 to 16383.

MaskLen: One byte. It specifies the bit length of the mask pattern.

MaskData: mask pattern data. The length of MaskData is MaskLen/8. If MaskLen can not be divided exactly

28
 DL920 UHF RFID Reader User's Manual V2.3

by 8, the length of MaskData is int(MaskLen/8)+1 with 0 padding in the least significant bit of last byte of
MaskData.

Notes: The operation actually uses the tag’s whole EPC code as the mask pattern when the MaskMem,
MaskAdr, MaskLen and MaskData are vacant.

Response:
Len Adr reCmd Status Data[] CRC-16
0xXX 0xXX 0x11 0x00 Word1，Word2,… LSB MSB
Parameter explanation:
Word1, Word2….: read out data in word units with most significant byte of a word first. Word1 is the
content of the start-address-defined word in target memory and so on.

8.2.18 Write Data with mask extended

The command is used to write several words into a Tag’s Reserved, EPC, TID or User memory. It utilize
flexible mask pattern for selecting one tag to operate.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x12 - LSB MSB
Data as follows:
Data[]
WNum ENum EPC Mem WordPtr Wdt
0xXX 0xXX Variable 0xXX 0xXX Variable
Pwd MaskMem MaskAdr MaskLen MaskData
4Bytes 0xXX 2Bytes 0xXX Variable
Parameter explanation:
WNum: One byte. It specifies the number of words to be written into a tag. The value can not be 0 and
should be equal to the word length of Wdt.

ENum: one byte length indicator in word unit (1 word = 2 bytes).

When ENum’s value is in 0~15, it represents the EPC length. And in this case, the MaskMem , MaskAdr,
MaskLen and MaskData shall all be absent.
When ENum is 0xff, there shall be MaskMem, MaskAdr, MaskLen and MaskData and no EPC presented.
The MaskMem, MaskAdr, MaskLen and MaskData construct a mask pattern for the operation.
Other value for ENum is prohibited and will incur a parameter error.

EPC: tag’s whole EPC code. Its word length is defined by ENum with most significant word first and most
significant byte in a word first.

Mem: One byte. It specifies the target memory of the operation with 0x00 for Password memory, 0x01 for
EPC memory, 0x02 for TID memory and 0x03 for User memory. Other values are reserved.

29
 DL920 UHF RFID Reader User's Manual V2.3

WordPtr: One byte. It specifies the starting word address for the operation with 0x00 for the first word, 0x01
for the second word and so on.

Wdt: the data to be written into a tag. The word length of Wdt should be equal to WNum and the data
should be arranged as most significant word first and most significant byte in a word first.

Pwd: Four bytes access password. The most significant byte (MSB) of access password is the MSB of Pwd.
Please remember to set Pwd the correct password if operation needed or set Pwd all 0s.

MaskMem: One byte. It specifies the target memory when applying mask pattern with 0x01 for EPC memory,
0x02 for TID memory and 0x03 for User memory. Other values are reserved.

MaskAdr: Two bytes. It specifies the start bit address in target memory when applying mask pattern. The
value range is from 0 to 16383.

MaskLen: One byte. It specifies the bit length of the mask pattern.

MaskData: mask pattern data. The length of MaskData is MaskLen/8. If MaskLen can not be divided exactly
by 8, the length of MaskData is int(MaskLen/8)+1 with 0 padding in the least significant bit of last byte of
MaskData.

Notes: The operation actually uses the tag’s whole EPC code as the mask pattern when the MaskMem,
MaskAdr, MaskLen and MaskData are vacant.

Response:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x12 0x00 - LSB MSB

8.2.19 Write EPC with mask extended

The command is used to write EPC code in a Tag’s EPC memory. This command is useful to change one tag’s
EPC code when more than one tag in the effective field since it utilize flexible mask pattern for selecting one tag
to operate.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x13 - LSB MSB
Data as follows:
Data[]
WNum ENum EPC Pwd WEPC MaskMem MaskAdr MaskLen MaskData
0xXX 0xXX Variable 4Bytes Variable 0xXX 2Bytes 0xXX Variable
Parameter explanation:
WNum: One byte. It specifies the length of EPC code to be written in word unit. The value range is from 0 to

30
 DL920 UHF RFID Reader User's Manual V2.3

15.

ENum: one byte length indicator in word unit (1 word = 2 bytes).

When ENum’s value is in 0~15, it represents the EPC length. And in this case, the MaskMem , MaskAdr,
MaskLen and MaskData shall all be absent.
When ENum is 0xff, there shall be MaskMem, MaskAdr, MaskLen and MaskData and no EPC presented.
The MaskMem, MaskAdr, MaskLen and MaskData construct a mask pattern for the operation.
Other value for ENum is prohibited and will incur a parameter error.

EPC: tag’s whole EPC code. Its word length is defined by ENum with most significant word first and most
significant byte in a word first.

Pwd: Four bytes access password. The most significant byte (MSB) of access password is the MSB of Pwd.
Please remember to set Pwd the correct password if operation needed or set Pwd all 0s.

WEPC: The EPC code to be written. The word length of EPC should be equal to WNum and the data should
be arranged as most significant word first and most significant byte in a word first.

MaskMem: One byte. It specifies the target memory when applying mask pattern with 0x01 for EPC memory,
0x02 for TID memory and 0x03 for User memory. Other values are reserved.

MaskAdr: Two bytes. It specifies the start bit address in target memory when applying mask pattern. The
value range is from 0 to 16383.

MaskLen: One byte. It specifies the bit length of the mask pattern.

MaskData: mask pattern data. The length of MaskData is MaskLen/8. If MaskLen can not be divided exactly
by 8, the length of MaskData is int(MaskLen/8)+1 with 0 padding in the least significant bit of last byte of
MaskData.

Notes: The operation actually uses the tag’s whole EPC code as the mask pattern when the MaskMem,
MaskAdr, MaskLen and MaskData are vacant.

Response:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x13 0x00 - LSB MSB

8.2.20 Lock with mask extended

The command is used to set protection strategy of Reserved, EPC, TID and User memory. It utilize flexible
mask pattern for selecting one tag to operate.
Reserved memory can be set as unprotected readable/writable, permanent readable/writable,
password-protected readable/writable and permanent unreadable/unwritable;
EPC and User memory can be set as unprotected writable, permanent writable, password-protected writable
and permanent writable. These two memories are always readable;

31
 DL920 UHF RFID Reader User's Manual V2.3

TID memory is always readable and unwritable.

If the Reserved memory is set to permanent readable/writable or permanent unreadable/unwritable, it can not
be set to other state any more.
If EPC or TID memory is set to permanent writable or permanent unwritable, it can not be changed to other
state any more.
If a memory is set to password protected state, any access to this memory should be carried out with a correct
password.
Command:
Len Adr Cmd Data[] CRC-16
0xXX 0xXX 0x14 - LSB MSB
Data as follows:
Data[]
ENum EPC Select SetProtect Pwd MaskMem MaskAdr MaskLen MaskData
0xXX Variable 0xXX 0xXX 4Bytes 0xXX 2Bytes 0xXX Variable
Parameter explanation:
ENum: one byte length indicator in word unit (1 word = 2 bytes).
When ENum’s value is in 0~15, it represents the EPC length. And in this case, the MaskMem , MaskAdr,
MaskLen and MaskData shall all be absent.
When ENum is 0xff, there shall be MaskMem, MaskAdr, MaskLen and MaskData and no EPC presented.
The MaskMem, MaskAdr, MaskLen and MaskData construct a mask pattern for the operation.
Other value for ENum is prohibited and will incur a parameter error.

EPC: tag’s whole EPC code. Its word length is defined by ENum with most significant word first and most
significant byte in a word first.

Select: One byte. It specifies the operation target as follows:

0x00: Kill Password section. Kill Password section is the first half of the Reserved memory;
0x01: Access Password section. Access Password section is the second half of the Reserved memory;
0x02: EPC memory;
0x03: TID memory;
0x04: User memory.
Other values are reserved.

SetProtect: one byte. It specifies the protection strategy of the Select defined target memory.
When Select is 0x00 or 0x01, SetProtect has the following meaning::
0x00: unprotected readable/writable;.
0x01: permanent readable/writable;
0x02: password-protected readable/writable;
0x03: permanent unreadable/unwritable.
When Select is 0x02, 0x03 or 0x04, SetProtect has the following meaning:
0x00: unprotected writable;.
0x01: permanent writable;
0x02: password-protected writable;

32
 DL920 UHF RFID Reader User's Manual V2.3

0x03: permanent unwritable.

Other values are reserved.

Pwd: Four bytes access password. The most significant byte (MSB) of access password is the MSB of Pwd.
Please remember to set Pwd the correct password.

MaskMem: One byte. It specifies the target memory when applying mask pattern with 0x01 for EPC memory,
0x02 for TID memory and 0x03 for User memory. Other values are reserved.

MaskAdr: Two bytes. It specifies the start bit address in target memory when applying mask pattern. The
value range is from 0 to 16383.

MaskLen: One byte. It specifies the bit length of the mask pattern.

MaskData: mask pattern data. The length of MaskData is MaskLen/8. If MaskLen can not be divided exactly
by 8, the length of MaskData is int(MaskLen/8)+1 with 0 padding in the least significant bit of last byte of
MaskData.

Notes: The operation actually uses the tag’s whole EPC code as the mask pattern when the MaskMem,
MaskAdr, MaskLen and MaskData are vacant.

Response:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x14 0x00 - LSB MSB

8.3 18000-6B COMMAND

8.3.1Inventory Signal 6B

The command is used to Inventory only one tag in the effective field and get their ID values. If more than
one tag in the effective field at the same time, reader may be get nothing.
Command:
Len Adr Cmd CRC-16
0x04 0xXX 0x50 LSB MSB
Respond:
Len Adr reCmd Status Data[] CRC-16
0x0d 0xXX 0x50 0x00 ID LSB MSB
Parameter Connect:
ID: 8 bytes, it is 6B tag’s UID. The low byte is fist.

8.3.2 Inventory Multiple 6B

The command is used to according to the given conditions Inventory tags in the effective field and get their

33
 DL920 UHF RFID Reader User's Manual V2.3

ID values.
Command:
Data[]
Len Adr Cmd CRC-16
Condition Address Mask Word_data
0x0f 0xXX 0x51 0xXX 0xXX 0xXX 8 Bytes LSB MSB
Parameter Connect:
Condition: The condition of detecting tags.
0x00: equal condition.
0x01: unequal condition.
0x02: greater than condition.
0x03: lower than condition.
Address: The tag’s start address to compare.

Mask: It pointed to the data is used to compare. Highest bit in the mask correspond with the far-left byte in
the Condition Content. The corresponding bit in the mask is 1 to compare the bit in the Condition Content with the
corresponding byte in the tag. The corresponding bit in the mask is 0, not compare.

Word_data: 8 bytes. It pointed to the array is used to compare.

Respond:
Len Adr reCmd Status Num Data[] CRC-16
0xXX 0xXX 0x51 0xXX 0xXX UID1, UID2… LSB MSB
Parameter Connect:
Status Table:
Status Connect
0x15 Command over, and return inventoried tag’s UID.
The reader does not get all 6B tags’ UID before user-defined Inventory-ScanTime
0x16
overflows. Command force quit, and returns inventoried tags’ UID.
The reader executes an Inventory command and gets many 6B tags’ UID. Data can not
0x17
be completed within in a message, and then send in multiple.
The reader executes an Inventory command and gets 6B tags’ UID too much, more
0x18
than the storage capacity of reader, and returns inventoried tags’ UID.
Num: The number of tag detected.
Data []: UID. Each UID length is 8 bytes. The least significant byte of UID is transmitted first.

8.3.3 Read Data 6B

The command is used to start to read several bytes from the designated address.
Command：
Data[]
Len Adr Cmd CRC-16
Address ID Num
0x0e 0xXX 0x52 0xXX 8 Bytes 0xXX LSB MSB
Parameter Connect:

34
 DL920 UHF RFID Reader User's Manual V2.3

Address: The tag’s start byte address to read. The range is 0~223. Otherwise, it returns the parameters error
message.

Num: In byte units. It specifies the number of 8-bit bytes to be read. The value range is 1~32, and Address +
Num must be less than 224. Otherwise, it returns the parameters error message.

ID: 8 bytes, it is 6B tag’s UID. The low byte is fist.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x52 0x00 Data LSB MSB
Data: It is read data, the low byte is fist.

8.3.4 Write Data 6B

The command is used to start to write several bytes from the designated address.
Command:
Data[]
Len Adr Cmd CRC-16
Address ID Wdata
0xXX 0xXX 0x53 0xXX 8 Bytes Variable LSB MSB
Parameter Connect:
Address: The tag’s start byte address to write. The range is 8~223. Otherwise, it returns the parameters error
message.

ID: 8 bytes, it is 6B tag’s UID. The low byte is fist.

Wdata: It pointed to the array to write, range is 1~32. If Address + WriteDataLen greater than 224, or
Wdata greater than 32 or is zero, reader will return parameter error message. The high bytes of Wdata write in
the low address in tag.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x53 0x00 Data LSB MSB

8.3.5 Check Lock 6B

The command is used to check whether the designated byte is locked.

Command:
Data[]
Len Adr Cmd CRC-16
Address ID
0x0d 0xXX 0x54 0xXX 8 Bytes LSB MSB
Parameter Connect:
Address: The tag’s byte address to check lock. The range is 0~223. Otherwise, it returns the parameters error
message.

35
 DL920 UHF RFID Reader User's Manual V2.3

ID: 8 bytes, it is 6B tag’s UID. The low byte is fist.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x06 0xXX 0x54 0x00 LockState LSB MSB
LockState:
0x00: Unlocked
0x01: locked

8.3.6 Lock 6B

The command is used to lock the designated byte.

Command:
Data[]
Len Adr Cmd CRC-16
Address ID
0x0d 0xXX 0x55 0xXX 8 Bytes LSB MSB
Parameter Connect:
Address: The tag’s byte address to lock. The range is 8~223. Otherwise, it returns the parameters error
message.

ID: 8 bytes, it is 6B tag’s UID. The low byte is fist.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x55 0x00 —— LSB MSB

8.4 READ-DEFINED COMMAND

8.4.1 Get Reader Information

The host sends this command to get the reader’s information including reader’s address (Adr), firmware
version, reader’s type (Type), supported protocol (Tr_Type), reader power, work frequency, and
InventoryScanTime value.
Command:
Len Adr Cmd Data[] CRC-16
0x04 0xXX 0x21 —— LSB MSB

Respond:
Len Adr reCmd Status Data[] CRC-16
Version，Type，Tr_Type，DMaxFre，
0x0d 0xXX 0x21 0x00 LSB MSB
DMinFre，Power，Scntm
Parameter Connect:

36
 DL920 UHF RFID Reader User's Manual V2.3

Parameter Length(Byte) Connect

The first byte is version number; the second byte is sub-version
Version 2
number.
Type 1 The reader type byte. 0x09 lines on DL920.
One byte supported protocol information. Bit1 is 1 for18000-6C
Tr_Type 1
protocol; Bit0 is 1 for 18000-6B protocol.
Bit7-Bit6 indicates Frequency Band and Bit5-Bit0 indicates the
DMaxFre 1
reader current maximum frequency.
Bit7-Bit6 indicates Frequency Band and Bit5-Bit0 indicates the
DMinFre 1
reader current minimum frequency.
The output power of reader. Range is 0 to 30, when Power is 0xFF,
Power 1
it means the output power of reader unknown.
Inventory Scan Time, the value of time limit for inventory
Scntm 1
command.
Frequency Band:
MaxFre(Bit7) MaxFre(Bit6) MinFre(Bit7) MinFre(Bit6) FreqBand
0 0 0 0 User band
0 0 0 1 Chinese band2
0 0 1 0 US band
0 0 1 1 Korean band
0 1 0 0 RFU
0 1 0 1 RFU
… … … … …
1 1 1 1 RFU

8.4.2 Set Region

The host sends this command to change the current region of the reader. The value is stored in the reader’s
inner EEPROM and is nonvolatile after reader powered off.
Command:
Data[]
Len Adr Cmd CRC-16
MaxFre MinFre
0x06 0xXX 0x22 0xXX 0xXX LSB MSB
Parameter Connect:
MaxFre: One byte, Bit7-Bit6 indicates Frequency Band and Bit5-Bit0 indicates the reader current maximum
frequency.

MinFre: One byte, Bit7-Bit6 indicates Frequency Band and Bit5-Bit0 indicates the reader current minimum
frequency (maximum frequency >= minimum frequency).

Frequency Band:
MaxFre(Bit7) MaxFre(Bit6) MinFre(Bit7) MinFre(Bit6) FreqBand
0 0 0 0 User band

37
 DL920 UHF RFID Reader User's Manual V2.3

0 0 0 1 Chinese band2
0 0 1 0 US band
0 0 1 1 Korean band
0 1 0 0 RFU
0 1 0 1 RFU
… … … … …
1 1 1 1 RFU

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x22 0x00 —— LSB MSB
Various frequency bands formula:
User band: Fs = 902.6 + N * 0.4 (MHz), N∈ [0, 62].
Chinese band2: Fs = 920.125 + N * 0.25 (MHz), N∈ [0, 19].
US band: Fs = 902.75 + N * 0.5 (MHz), N∈ [0, 49].
Korean band: Fs = 917.1 + N * 0.2 (MHz), N∈ [0, 31].

8.4.3 Set Address

The host sends this command to change the address (Adr) of the reader. The address data is stored in the
reader’s inner EEPROM and is nonvolatile after reader powered off. The default value of Adr is 0x00. The range
of Adr is 0x00~0xFE. When the host tries to write 0xFF to Adr, the reader will set the value to 0x00
automatically.
Command:
Data[]
Len Adr Cmd CRC-16
Address
0x05 0xXX 0x24 0xXX LSB MSB

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x24 0x00 —— LSB MSB
Notes: The Adr is old address, not new address.

8.4.4 Set Scan Time

The host sends this command to change the value of InventoryScanTime of the reader. The value is stored in
the reader’s inner EEPROM and is nonvolatile after reader powered off.
Command:
Data[]
Len Adr Cmd CRC-16
Scantime
0x05 0xXX 0x25 0xXX LSB MSB
Parameter Connect:
Scantime: Inventory Scan Time. The default value is 0x0A (corresponding to 10*100ms=1s). The value
range is 0x03~0xFF (corresponding to 3*100ms~255*100ms). When the host tries to set value 0x00~0x02 to

38
 DL920 UHF RFID Reader User's Manual V2.3

InventoryScanTime, the reader will set it to 0x0A automatically. In various environments, the actual inventory
scan time may be 0~75ms longer than the InventoryScanTime defined.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x25 0x00 —— LSB MSB

8.4.5 Set Band Rate

The host sends this command to change the value of band rate of the reader. The value is stored in the
reader’s inner EEPROM and is nonvolatile after reader powered off.
Command:
Data[]
Len Adr Cmd CRC-16
BaudRate
0x05 0xXX 0x28 0xXX LSB MSB
Parameter Connect:
BaudRate: The serial port baud rate default value is 57600 bps. Defined as follows:
BaudRate Bps
0 9600bps
1 19200 bps
2 38400 bps
5 57600 bps
6 115200 bps

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x28 0x00 —— LSB MSB
Notes: The response of the baud rate for the original baud rate, and next command uses the new band rate.

8.4.6 Set Power

The host sends this command to change the power of the reader. The value is stored in the reader’s inner
EEPROM and is nonvolatile after reader powered off.
Command:
Data[]
Len Adr Cmd CRC-16
Pwr
0x05 0xXX 0x2F 0xXX LSB MSB
Parameter Connect:

Pwr: New power. The default value is 30(about 30dBm), it range is 0~30.

Respond:
Len Adr reCmd Status Data[] CRC-16

39
 DL920 UHF RFID Reader User's Manual V2.3

0x05 0xXX 0x2F 0x00 —— LSB MSB

8.4.7 Acousto-optic Control

The host sends this command to control the LED lights flash and buzzer tweet.
Command:
Data[]
Len Adr Cmd CRC-16
ActiveT SilentT Times

0x07 0xXX 0x33 0xXX 0xXX 0xXX LSB MSB

Parameter Connect:
ActiveT: LED flash and buzzer tweet time. (ActiveT*50ms), the default value is 0. 0<=ActiveT<=255.

SilentT: The LED and the buzzer silent time (SilentT *50ms), the default value is0. 0<= SilentT <=255.

Times: LED flash and buzzer tweet times (0<=Times<=255), the default value is0.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x33 0x00 —— LSB MSB

8.4.8 Set Wiegand

The host sends this command to change Wiegand parameter of the reader. The value is stored in the reader’s
inner EEPROM and is nonvolatile after reader powered off.
Command:
Data[]
Len Adr Cmd Wg_mo Wg_Data_I Wg_Pulse_Wi Wg_Pulse_In CRC-16
de nteval dth teval
0x08 0xXX 0x34 0xXX 0xXX 0xXX 0xXX LSB MSB
Parameter Connect:
Wg_mode: Bit0: Select Wiegand format interface.
=0 Wiegand 26bits format interface.
=1 Wiegand 34bits format interface.
Bit1: High-bit first or Low-bit first.
=0 High-bit first.
=1 Low-bit first.
Bit2~Bit7: RFU. Default value is zero.

40
 DL920 UHF RFID Reader User's Manual V2.3

Wg_Data_Inteval: Sending Data Delay (0 ~255)*10ms, the default value is 30.

Wg_Pulse_Width: Data pulse width (1 ~255)*10us, the default value is 10.

Wg_Pulse_Inteval: Data pulse interval width (1 ~255)*100us, the default value is 15.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x34 0x00 —— LSB MSB

8.4.9 Set WorkMode

The host sends this command to set the reader’s in Scan Mode or Trigger Mode. The host can also use this
command to define the reader’s output data content and format.
In Scan Mode or Trigger Mode, the reader can still accept commands from the host. But it will only respond
to reader-defined commands. Other commands can not be executed when the reader in Scan Mode or Trigger
Mode.
Command:
Data[]
Len Adr Cmd CRC-16
Parameter

0x0a 0xXX 0x35 6Bytes LSB MSB

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x35 0x00 —— LSB MSB

Note: Scan Mode configuration words Parameter will be stored in reader’s EEPROM and be effective until
changed explicitly. Defined as follows:
Byte1 Byte2 Byte3 Byte4 Byte5 Byte6
Read_mode Mode_state Mem_Inven First_Adr Word_Num Tag_Time
Parameter Connect:
Read_mode:
Bit1 Bit0 Work Mode
0 0 Answer Mode
0 1 Scan Mode
1 0 Trigger Mode(Low)
1 1 Trigger Mode(High)
Bit2~Bit7: RFU. Default value is zero.
Notes: Answer mode, the following parameter is invalid.

41
 DL920 UHF RFID Reader User's Manual V2.3

Mode_state: Bit0: Protocol bit.

=0 the reader support 18000-6C protocol.
=1 the reader support 18000-6B protocol.
Bit1: Output mode bit.
=0 Wiegand output.
=1 RS232/RS485 output.
Bit2: Beep Enable.
=0 on
=1 off
Bit3: Wiegand output, 18000-6C protocol. First_Adr is byte address or word address.
=0 word address.
=1 bytes address.
Bit4: Syris485 Enable. It is invalid when Bit1 is zero.
=0 Common 485
=1 Syris 485
When Bit4 = 1:
Validity: 18000-6C protocol: Read accesses Password, EPC, TID, User memory, Inventory
Single.
18000-6B protocol: validity.

Bit5~Bit7: RFU. Default value is zero.

Mem_Inven: It is valid when the reader supports 18000-6C protocol. It specifies whether the Read accesses
Password, EPC, TID, User memory, Inventory multiple, Inventory Single, EAS Alarm. 0x00: Password memory;
0x01: EPC memory; 0x02; TID memory; 0x03: User memory; 0x04 Inventory multiple; 0x05 Inventory Single;
0x06: EAS Alarm. Otherwise, it returns the parameters error message.

First_Adr: It specifies the starting data address for the memory read.
Support 18000-6C: First_Adr = 0x00 specifies the first 16-bit memory word, First_Adr = 0x01
specifies the second 16-bit memory word, etc.
Support 18000-6B: First_Adr = 0x00 specifies the first 8-bit memory byte, First_Adr = 0x01
specifies the second 8-bit memory byte, etc.

Word_Num: Only RS232 RS232/RS485 output, it is valid. It specifies the number of word for the memory
read. The value range is 1~32. Syris 485 Mode, the value range is 1~4.

Tag_Time: Read Single Tag Delay (0 ~255)*1s. The default value is zero.
Validity: 18000-6C protocol: Read accesses Password, EPC, TID, User memory, Inventory Single.
18000-6B protocol: validity.
Output Format Connect In The Scan Mode Or Trigger Mode:

RS232/RS485, serial output format is as follows:

Notes: RS232/RS485 serial output mode, these must be no tag in the effective field when set reader

42
 DL920 UHF RFID Reader User's Manual V2.3

parameter.

1.18000-6C Protocol, Mem_Inven is 0x00~0x03:

Len Adr reCmd Status Data[] CRC-16

0xXX 0xXX 0xee 0x00 Word1，Word2,… LSB MSB

Parameter Connect:
Word1, Word2….: In word units, one word is two bytes. High-byte is first. Word1 is the word which
reads from the start address, Word2 is the word which reads from the second address, etc.

2.18000-6C Protocol, Mem_Inven is 0x04 or 0x05:

Len Adr reCmd Status Data[] CRC-16

0xXX 0xXX 0xee 0x00 EPC ID LSB MSB

Parameter Connect:
EPC ID: G2 tag’s ECP, The most significant word (EPC C1 G2 data in word units) of EPC is
transmitted first and the most significant byte of word is transmitted first.

3.18000-6C Protocol, Mem_Inven is 0x06:

Len Adr reCmd Status Data[] CRC-16

0xXX 0xXX 0xee 0xee —— LSB MSB

4.18000-6B Protocol:
Len Adr reCmd Status Data[] CRC-16

0xXX 0xXX 0xee 0x00 Word1，Word2,… LSB MSB

Parameter Connect:
Data []: 6B tag’s UID. UID length is 8 bytes. The least significant byte of UID is transmitted first.

8.4.10 Get WorkMode

The host sends this command to get the reader’s information including reader’s Wiegand parameter,
WorkMode parameter.
Command:
Len Adr Cmd Data[] CRC-16
0x04 0xXX 0x36 —— LSB MSB

Respond:
Len Adr reCmd Status Data[] CRC-16
Wg_mode，Wg_Data_Inteval，
0x11 0xXX 0x36 0x00 LSB MSB
Wg_Pulse_Width，Wg_Pulse_Inteval，

43
 DL920 UHF RFID Reader User's Manual V2.3

Read_mode，Mode_state，Mem_Inven，
First_Adr，Word_Num，Tag_Time，
accuracy，OffsetTime
Parameter Connect:
Wg_mode, Wg_Data_Inteval, Wg_Pulse_Width, Wg_Pulse_Inteval: Wiegand parameters.

Read_mode, Mode_state, Mem_Inven, First_Adr, Word_Num, Tag_Time: Work Mode parameters.

Accuracy: EAS Alarm accuracy.

OffsetTime: Syris485 response offset time.

8.4.11 SetEasAccuracy

The host sends this command to set EAS Alarm Accuracy.

Command:
Data[]
Len Adr Cmd CRC-16
Accuracy
0x05 0xXX 0x37 0xXX LSB MSB
Accuracy: EAS Alarm Accuracy. The default value is 8, it range is 0~8.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x37 0x00 —— LSB MSB

8.4.12 Syris Response Offset

The host sends this command to set Syris485 response offset time.
Command:
Data[]
Len Adr Cmd CRC-16
OffsetTime
0x05 0xXX 0x38 0xXX LSB MSB
OffsetTime: Syris485 response offset time (0 ~100)*1ms, the default value is 0.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x38 0x00 —— LSB MSB

44
 DL920 UHF RFID Reader User's Manual V2.3

8.4.13 Trigger Offset

The host sends this command to set Trigger offset time. This function is only available for reader with
firmware version V2.36 and above.
Command:
Data[]
Len Adr Cmd CRC-16
TriggerTime
0x05 0xXX 0x3b 0xXX LSB MSB
TriggerTime: Trigger offset time (0 ~254)*1s, the default value is 0. When TriggerTime is 255, means get
the current trigger offset time.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x3b 0x00 TriggerTime LSB MSB
TriggerTime： Current Trigger offset time (0 ~254)*1s.

8.4.14 SetRelayStatus

The host sends this command to set built-in relay status. This function is only available for reader with
firmware version above V2.39.
Command:
Data[]
Len Adr Cmd CRC-16
RelayStatus
0x05 0xXX 0x3c 0xXX LSB MSB
RelayStatus:One byte. Every bit corresponds to one built-in relay. The relay will pick up when corresponding
bit set to 1 and will drop out when corresponding bit set to 0. All relay drop out when the reader is powered up.

Respond:
Len Adr reCmd Status Data[] CRC-16
0x05 0xXX 0x3c 0x00 - LSB MSB

45