SL500 Communication Protocol

1. Master and Slave The reader is slave device, not active send data until received command form host 2. Communication Protocol 2.1 Host Command Format Command head + Length + Device ID + Command code + Parameter + verification Command head: 2 bytes, 0xAABB Length: 2 bytes, designate continuous bytes, from the Device ID to verification In this reader, the first byte is effective, the second byte remain 0 Deveice ID: 2 bytes Command code: 2 bytes Parameter: n bytes (maybe blank) Verification: 1 byte, each byte is XOR from Equipment ID to the last byte of the Parameter Notice: If any byte from Length to Verification equals to AA, add one byte 00 to distinguish the Command head, but the Length byte do not change Example: write data (0x00112233445566778899AABBCCDDEEFF) into block 1 Host send: AABB1600000009020100112233445566778899AA00BBCCDDEEFF0A 2.2 Reader answer format Command head + Length + Equipment ID + Command code + Status + Data Range + verification Command head: 2 bytes, 0xAABB Length: 2 bytes, designate continuous bytes, from the Device ID to verification In this reader, the first byte is effective, the second byte remain 0 Deveice ID: 2 bytes Command code: 2 bytes Status: 1 byte, 00 = success, Not 0 = fail Data Range: return date (maybe blank) Verification: 1 byte, each byte is XOR from Equipment ID to the last byte of the Data Range Notice: If any byte from Length to Verification equals to AA, add one byte 00 to distinguish the Command head, but the Length byte do not change Example: read data (0x00112233445566778899AABBCCDDEEFF) from block 1 SL500 return: AABB1600000009020000112233445566778899AA00BBCCDDEEFF0B

3. Command Explanation The reader will respond each correspondingly command, Respond date: none as below means the only Data Range is blank. 3.1 System Function 3.1.1 rf_init_com Function: Set baud rate Command code: 0x0101 Parameter: 00=4800 01=9600 02=14400 03=19200 04=28800 05=38400 06=57600 07=115200 Remark: default baud rate is 19200 bps after power on Respond date: none Example: Host send: AABB0600000001010303 SL500 return: AA BB 06 00 11 12 01 01 00 03 3.1.2 rf_get_model Function: Read the reader model and product number Command code: 0x0401 Parameter: 2 bytes device ID Respond date: reader model Example: Host send: AABB05000000040105 SL500 return: AA BB 11 00 11 12 04 01 00 53 4C 35 30 30 4C 2D 30 36 30 38 43 3.1.3 rf_init_device_number Function: Set device ID Command code: 0x0201 Parameter: 2 bytes device ID Remark: the reader only respond to the command that device ID is in accord with itself or equals to 0x0000 Respond date: none 3.1.4 rf_get_device_number Function: Read Equipment ID Command code: 0x0301 Parameter: none Respond date: 2 bytes device ID
2

3.1.5 int WINAPI rf_beep Function: Set buzz Command code: 0x0601 Parameter: 1byte buzz time, unit 10MS Respond date: none 3.1.6 rf_light Function: Set LED color Command code: 0x0701 Parameter: 00 = off 01 = red 02 = green 03 = yellow Respond date: none 3.1.7 rf_init_type Function: Set reader RF working mode Command code: 0x0801 Parameter: 1byte 'A': set TYPE_A mode 'B': set TYPE_B mode '1': set ISO15693 mode Respond date: none 3.1.8 rf_antenna_sta Function: Manage RF transmit Command code: 0x0C01 Parameter: 00 = off Not 0 = on Respond date: none

3.2 ISO14443A : Mifare Function

3.2.1 rf_request Function: ReqA Command code: 0x0102 Parameter: 0x26 = REQ_STD 0x52 = REQ_ALL Respond date: 2 bytes card type code 3.2.2 rf_anticoll Function: Anticollision Command code: 0x0202 Parameter: none Respond date: 4 bytes card serial number 3.2.3 rf_select Function: Select card Command code: 0x0302 Parameter: 4 bytes card serial number Respond date: 1 byte card capacity code 3.2.4 rf_halt Function: Halt Command code: 0x0402 Parameter: none Respond date: none 3.2.5 rf_M1_authentication2 Function: validate Mifare card key Command code: 0x0702 Parameter: 1BYTE code validate mode(MODEL) + 1BYTE absolute block number + 6 bytes key MODEL = 0x60: validate KeyA MODEL = 0x61: validate KeyB Respond date: none 3.2.6 rf_M1_read Function: Read block Command code: 0x0802 Parameter: 1 byte absolute block address Respond date: 16 bytes date 3.2.7 rf_M1_write Function: write block Command code: 0x0902 Parameter: 1 byte absolute block address + 16 bytes written date Respond date: none 3.2.8 rf_M1_initval Function: initialize purse Command code: 0x0A02
4

Parameter: 1 byte absolute block address + 4 bytes initial value(low bytes in the former) Respond date: none 3.2.9 rf_M1_readval Function: read purse value Command code: 0x0B02 Parameter: 1 byte absolute block address Respond date: 4 bytes value(low bytes in the former) 3.2.10 rf_M1_decrement Function: decrement Command code: 0x0C02 Parameter: 1 byte absolute block address + 4 bytes decrement value(low bytes in the Former) Respond date: none 3.2.11 rf_M1_increment Function: increment Command code: 0x0D02 Parameter: 1 byte absolute block address + 4 bytes increase value Respond date: none 3.2.12 rf_M1_restore Function: transfer a certain block date into card buffer Command code: 0x0E02 Parameter: 1 byte absolute block address Respond date: none 3.2.13 rf_M1_transfer Function: write the date in the card buffer into certain block of card Command code: 0x0F02 Parameter: 1 byte absolute block address Respond date: none 3.2.14 rf_ul_select Function: Ultralight card Anticoll and Select Command code: 0x1202 Parameter: none Respond date: 7 bytes ultralight UID 3.2.15 rf_ul_write Function: Write a page of data into ultra light card Command code: 0x1302 Parameter: 1 byte page address + 4 bytes written date Respond date: none 3.2.15 rf_typea_rst Function: Request MifareProX and reset Command code: 0x1002 Parameter: 0x26 = REQ_STD 0x52 = REQ_ALL Respond date: 4 bytes CSN + ATS information
5

3.2.16 rf_cos_command Exchange transparent data according with T = CL protocol Function: Command code: 0x1102 Parameter: COS command Respond date:

3.3 ISO14443B Function

3.3.1 rf_atqb Function: RTQB and Attrib Command code: 0x0103 Parameter: RTQB mode code, 0=REQB, 1=WUPB Respond date: ATQB Response 3.3.2 rf_at020_check Function: rf_at020_check Command code: 0x0104 Parameter: 8 bytes password Respond date: none 3.3.3 rf_at020_read Function: Read a page of data from AT88RF020 Command code: 0x0204 Parameter: 1 byte page address Respond date: 8 bytes read data 3.3.4 rf_at020_write Function: Write a page of data into AT88RF020 Command code: 0x0304 Parameter: 1 byte page address + 8 bytes written data Respond date: none 3.3.5 rf_at020_lock Function: AT88RF020 LOCK operation Command code: 0x0404 Parameter: 4 bytes Respond date: none 3.3.6 rf_at020_count Function: AT88RF020 take count Command code: 0x0504 Parameter: 6 bytes signature Respond date: none 3.3.7 rf_at020_count Function: AT88RF020 take count Command code: 0x0504 Parameter: 6 bytes signature Respond date: none 3.3.8 rf_st_select Function: Req ST card (SR176/SRIX4K) Command code: 0x0105 Parameter: none Respond date: 1 byte chip ID number

3.3.9 rf_st_completion Function: Set ST card into DESACTIVED status Command code: 0x0205 Parameter: none Respond date: none 3.3.10 rf_sr176_readblock Function: Read one block of data from SR176 Command code: 0x0305 Parameter: 1 byte block address Respond date: 1 byte data 3.3.11 rf_sr176_writeblock Function: Write one block of data to SR176 Command code: 0x0405 Parameter: 1 byte block address + 1 byte written data Respond date: none 3.3.12 rf_sr176_protectblock Function: Lock SR176 Command code: 0x0505 Parameter: 1 byte lockreg Respond date: none 3.3.13 rf_srix4k_readblock Function: Read one block of data from SRIX4K Command code: 0x0605 Parameter: 1 byte block address Respond date: 4 bytes data 3.3.14 rf_srix4k_writeblock Function: Write 1 block data to SRIX4K Command code: 0x0705 Parameter: 1 byte block address Respond date: 4 bytes written data 3.3.15 rf_srix4k_getuid Function: Get SRIX4K UID Command code: 0x0905 Parameter: 8 byte UID Respond date: none

3.4 ISO15693 Function

3.4.1. ISO15693_Inventorys (Multi Card) Command code: 0x0010 Parameter: none Respond date: 9 * n bytes, 9 bytes in a stream, the structure of every stream is: 1byte DSFID + 8byte UID 3.4.2. ISO15693_Inventory (Single card) Command code: 0x0110 Parameter: none Respond date: 9 bytes, 1 byte DSFID + 8 bytes UID 3.4.3. ISO15693_Reset_To_Ready Command code: 0x0210 Parameter: 1 byte model + 8 bytes UID Respond date: none 3.4.4. ISO15693_Select Command code: 0x0310 Parameter: 8 bytes UID Respond date: none 3.4.5. ISO15693_Reset_To_Ready Command code: 0x0410 Parameter: 1 byte model + 8 bytes UID Respond date: none model: bit0=Select_flag, bit1=Addres_flag, bit2=Option_flag,below is the same 3.3.6. ISO15693_Read Command code: 0x0510 Parameter: 1 byte model + 8 bytes UID + 1 byte initial block number + 1 byte block number Respond date: read date 3.4.7. ISO15693_Write Command code: 0x0610 Parameter: 1 byte model + 8 bytes UID + 1 byte block number + 4 bytes written date Respond date: none 3.4.8. ISO15693_Lock_Block Command code: 0x0710 Parameter: 1 byte model + 8 bytes UID + 1 bytes block number Respond date: none 3.4.9. ISO15693_Write_AFI Command code: 0x0810 Parameter: 1 byte model + 8 bytes UID + 1 byte written date Respond date: none 3.4.10. ISO15693_Lock_AFI Command code: 0x0910
9

Parameter: 1 byte model + 8 bytes UID Respond date: none 3.4.11. ISO15693_Write_DSFID Command code: 0x0A10 Parameter: 1 byte model + 8 bytes UID + 1 byte written date Respond date: none 3.4.12. ISO15693_Lock_DSFID Command code: 0x0B02 Parameter: 1 byte model + 8 bytes UID Respond date: none 3.4.13. ISO15693_Get_System_Information Command code: 0x0C10 Parameter: 1 byte model + 8 bytes UID Respond date: 8 bytes UID + 1 byte DSFID + 1 byte AFI 3.4.14. ISO15693_Get_Block_Security Command code: 0x0D10 Parameter: 1 byte model + 8 bytes UID + 1 byte initial block number + 1 byte block number Respond date: n bytes lock state, every byte correspond to a block 3.4.15. Srf55vp_Read (Infineon tag special) Command code: 0x1010 Parameter: 8 bytes UID + 1 byte page number Respond date: 8 bytes read date 3.4.16. SRF55V_Inventorys (Infineon tag special) Command code: 0x1410 Parameter: 1 byte AFI Respond date: 9 * n bytes, 9 bytes in a stream, the structure of every stream is: 1byte DSFID + 8byte UID

10