Home

TAGnology_UserManual_HF_Dual ISO_RFID_Reader

1. pr None pw State of user port 1 Byte Answer Data State of user port 1 Byte IC Error Error correction fails F Error Transmission Error No answer received Example pr Reads user port pw01 Sets user port state to high November 4 2008 Page 57 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 15 1 Read port The port read command returns the current state of the USER port Table 27 Read USER port return values eas L 00h USER port is low 01h USER port is high 4 3 24 15 2 Write port If user port is used as an output a 1kQ resistor has to be integrated into the wire Otherwise the reader device can be damaged Table 28 Write User port a 00h Sets USER port to low 01h Sets USER port to high 02h 7Fh RFU 80h FFh Sends a serial data frame and checks the received frame Sending a Data Frame If the highest bit MSB is set in the State of the User Port the command sends a serial data frame out the USER port The frame includes a start bit 8 data bits parity bit and a stop bit Table 29 Sending Serial Data Frame Low Start bit Low RFU Data Bit 6 State of the User Port Bit 6 Data Bit 5 State of the User Port Bit 5 Data Bit 4 State of the User Port Bit 4 Data Bit 3 State of the User Port Bit 3 Data Bit 2 State of the
2. 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 6 2 Answer from 8xh The lower nibble contains the baud rate used for the air interface The value for the baud rate is XORed with the used up and downlink speed Table 23 Baud Rate values Baud Rate Description x1 106kBaud x2 212kBaud x4 424kBaud x8 848kBaud The higher nibble contains the frame size used for the air interface Table 24 Frame Size Frame Size Description Ox 16 Bytes 1x 24 Bytes 2x 32 Bytes 3x 40 Bytes 4x 48 Bytes 5x 64 Bytes 6x 96 Bytes 7X 128 Bytes 8x 256 Bytes 4 3 24 6 3 Answer from 2xh 3xh 9xh Axh and Bxh Returned is the option byte as the answer 4 3 24 6 4 Select a single tag No previous continuous read is required The command executes an automatic field reset 4 3 24 6 5 Extended ID See above for more information on Extended ID The RATS answer is inserted between the serial number and baud rate frame size byte for IS014443 A tags 4 3 24 6 6 Multiple tags This command with parameter 1xh prepares the next multi select command as a high speed select Any other command will disable the preparation November 4 2008 Page 47 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 6 7 RATS Guar
3. 5 1 5 Using a MIFARE card This example demonstrates the detection of a card in the antenna field with continuous read and the reading of a page Table 31 Using a MIFARE card Command Answer c Activate continuous read mode B2197B58 a card responds with its serial number S abort continuous read mode s B2197B58 select card I101AAFFFFFFFFFFFF L login into sector 1 with key FFFFFFFFFFFFh key type A rb04 0011223344556677889AABBCCDDEEFF read block 04 c Activate continuous read mode to detect a new card 5 2 Using a DESFire card 5 2 1 Create a plain standard data file After activation application 0 is selected automatically Default access rights of application 0 require a login to create an application The following example illustrates the successful creation of a plain standard data file Command Answer Sd 04E10E00000000 activate card f1200000000000000000000000000 0000000000 L login to application O f06050000100F01 00 create application with ID 000010 10408000010 00 select application with ID 000010 fO80FO0000eeee 10000000 00 create plain standard data file with ID 00 Page 80 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 5 2 2 Use a plain standard data file The next example demonstrates the use of a plain standard data file such as that created in the prev
4. The following table describes the communication settings Table 14 Communication settings Description 8 data bits No parity bit 1 stop bit No flow control 4 3 6 4 3 7 Command Guard Time ODh The Command Guard Time ensures that commands are not sent too fast consecutively Following Commande are sent after the guard time is elapsed One time slice is around 37 8us The longest timeout value is 9 6ms FFh The default value is 20h 1 2ms OPMODE operating mode register OEh The operation mode register defines which tag types the reader supports This register enables fast tag recognition because only defined tag types are requested Table 15 Operation mode register Operation mode register Bit 7 MSB Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit O LSB a lt mM Y Y Y g S T T T T T X o O 12 x 12 X Ke EZ EZ Innovision Jewel tag Innovision Jewel tag is part of ISO 14443 Type A It can not be separately switched on off 4 3 8 Single Shot Time out OFh The time out value defines the delay time between two responses of the reader It only has effect in continuous read mode To enable the time out the single shot flag has to be set See the protocol configuration register above One time out slice is around 100ms Exact timing depends on the protocol used Value 00h indicates no delay time Default value is OAh 1 secona November 4 20
5. User Manual Firmware V2 4 5 Frequently Asked Questions 5 1 1 Getting Started To test and interface the Dual ISO Module you do not need a sophisticated uP development system All you need is a PC a connection cable and a power supply for the reader If you are using Microsoft Windows 95 98 NT take the following steps e Make sure that your reader has an RS232 interface e Start HyperTerminal e Create a new connection FILE NEW CONNECTION e Enter a name for the connection i e MIFARE e Select connect COM2 COM1 direct connection e Connection setup 9600 8 n 1 no handshake e Connect your reader to COM2 COM1 of the PC and apply appropriate supply voltage The reader transmits a string Dual 2 2 to the PC e This string denotes the firmware provided with your reader module e Puta tag to your reader Serial numbers should be displayed properly e Enter commands via keyboard They should be transmitted to the reader and the reader should reply If using an operating system different from Microsoft Windows you may use any other terminal program that is capable of receiving transmitting data via the serial port of your PC 5 1 2 How should the Dual ISO Reader be personalized In ASCII protocol applications no personalization is necessary In applications that are using the binary protocol mode personalization is required Use the Utility program to set up your reader correctly Ask the reseller or t
6. The LED stays green as long as a tag was found and goes dark if the tag is removed from the field November 4 2008 Page 39 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 3 Set LED This command controls the LED activity If the LED flag is set the automatic LED function is switched off The user can set the state of the LED manually Command dg None dr None dn None Answer DG String of LED state DR DN Example dg DG Switch on LED green LED red off dr DR Switch on LED red LED green off dn DN Switch off both LEDs Page 40 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 4 DES encryption decryption of data This command returns 8 bytes of encrypted decrypted data Command ds Options 1 byte Key 8 16 bytes Key Number 1 byte Data 8 byte Answer Data Encrypted Decrypted data 8 bytes Option byte Option be Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 RFU RFU RFU RFU RFU Encode Key Length Key Index Key Index If the Key Index is set the command only needs the key number 1 byte instead of the key 8 16 bytes The key number corresponds to the key number used in the k
7. 2008 Page 71 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 25 3 Copy value block backup Copies a value block to another block of the same sector A read is done automatically after the write to ensure data integrity Used for backup and error recovery A previous login is needed to access a block Command Source block 1 byte Target block 1 byte Data l New value of target block 4 bytes T Error value block failure F Error copy failure N Error No tag in field O Error Operation mode failure Example 0405 Copy value block 4 to block 5 0506 Copy value block 5 to block 6 4 3 25 3 1 Target block The target block does not need to be a valid value block If the source block is not in value format the command fails 4 3 25 3 2 No value block T Source value block is not in a valid value block The value block is corrupted A backup block can be used to restore the correct value 4 3 25 3 3 Copy failure F The Copy failure indicates a general failure during the copy procedure or inability to read after the write process 4 3 25 3 4 No tag error N The reader does not detect a response of the tag There is either no tag present or the tag does not respond to the request 4 3 25 3 5 Operation mode failure O The tag is not 15014443 type A compliant Page
8. Select v Get version w wb Write block wd Write data multiple blocks wp Write EEPROM register Xx Reset y Field reset ISO 14443 Type A MIFARE only commands Increment value block credit a Decrement value block debit Copy value block backup T Login authenticate tag rv Read value block wv Write value block SR176 only commands K Lock block Table 19 DESFire Command Set DESFire command set OFh Create Standard Data File 10h Create Backup Data File 11h Create Value File 12h Create Linear Record File 13h Create Cyclic Record File 14h Delete File 15h Read Data Records 16h Write Data Record 17h Get Value 18h Credit 19h Debit 1Ah Limited Credit 1Bh Clear Record File 1Ch Commit Transaction 1Dh Abort Transaction OFh Create Standard Data File 10h Create Backup Data File 11h Create Value File 12h Create Linear Record File Page 36 of 89 2008 HID Global Corporation All rights reserved November 4 2008 HF Dual ISO RFID Reader User Manual Firmware V2 4 1502 USM 00 0 02 DESFire command set 13h Create Cyclic Record File 14h Delete File 15h Read Data Records 16h Write Data Record 17h Get Value 18h Credit 19h Debit 1Ah Limited Credit 1Bh Clear Record File 1Ch Commit Transaction 1Dh Ab
9. 4 20h The protocol configuration register PCON4 specifies general behavior of the reader device Default value is OOh Table 17 Protocol configuration register Protocol configuration register Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Internal CID Disable RFU RFU RFU RFU use do Extended WupA B Read after not change ID Write 4 3 18 1 Disable Read after Write default 0 If set the reader device will not make a read after write for the block write commands w wb wd and wv If the read after write is deactivated acknowledge from the write commands is a 00h byte instead of the written data Page 34 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 18 2 WupA B default 0 If set the reader device will use WupA B instead of RegA B during selection of an ISO 14443 tag Supported commands are select high speed select and multi select 4 3 18 3 CID Extended ID default 0 If set the extended ID information for ISO 14443 A B tags will be extended with the CID information only for the high speed select The CID byte will be appended on the end of the output 4 3 19 CID 21h The Card Identifier CID is used to activate multiple ISO 14443 4 cards at the same time If only one tag at the same time is used this value should be left 0 Default value is OOh
10. ASK GTML2 ISO ASK y y ASK GTML ASK y y extended setup needed Sharp B Sharp y y TOSMART P0032 64 Toshiba y y Dual Interface ISO 14443 A compliant various y y ISO 14443 B compliant various y y 1 Performance varies Performance varies November 4 2008 Page 9 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 1 The MIFARE Transponder Family The MIFARE transponder family consists of various 13 56 MHz transponder ICs all compliant to the ISO 14443 standard 1 1 MIFARE Standard The MIFARE Standard card consists of 16 sectors A sector includes four blocks of 16 bytes each Sector 0 Block 0 3 Y Block 8 Data or value 16 bytes Sector 1 Block 4 7 Block 9 Data or value 16 bytes Sector 2 Block 8 11 Block 10 Data or value 16 bytes Block 11 Access Conditions 4 bytes Key A Key B 16 bytes Sector 15 Block 60 63 Figure 1 MIFARE Standard sector diagram 1 1 1 Sector 0 Block O Block 0 is read only Serial Number 4 bytes Check byte 1 byte Manufacturer data 11 bytes Figure 2 MIFARE Standard sector 0 block 0 1 1 2 Blocks 3 7 11 15 Transport keys are set on delivery Key A 6 bytes Access Conditions 4 bytes Key B 6 bytes Figure 3 MIFARE Standard block 3 7 11 15 Key A AO A1 A2 A3 A4 A5 Infineon or FF FF FF FF FF
11. Page 73 of 89 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 Example Command Description 102AA lt CR gt Authenticate for sector 2 using the transport key A AOA1A2A3A4A5h key type A I3FBB lt CR gt Authenticate for sector 63 using the transport key 2 BOB1B2B3B4B5h key type B 104FF lt CR gt Authenticate for sector 4 using the transport key 3 FFFFFFFFFFFFh key type A IOFAAFFFFFFFFFFFF Authenticate for sector 15 using key FFFFFFFFFFFFh key type A 10E14 Authenticate for sector 14 using EEPROM key 4 key type A 10530 Authenticate for sector 5 using EEPROM key 0 key type B 10732 Authenticate for sector 7 using EEPROM key 2 key type B 10110 Authenticate for sector 1 using EEPROM key 0 key type A IOABBFF12FFFFFF35 Authenticate for sector 10 using key FF12FFFFFF35h key type B 4 3 25 4 1 No tag error N The reader does not detect a response from the tag There is either no tag present or the tag does not respond to the request 4 3 25 4 2 Operation mode failure O The tag is not 15014443 type A compliant 4 3 25 4 3 Out of range failure R The entered key type or the sector is out of range 4 3 25 4 4 lt CR gt Three transport keys are implemented to access cards quickly By transmitting lt CR gt instead of the key the reader module uses the transport keys for the login procedure Command Description LxxAA lt CR gt Authenticate
12. User Port Bit 2 Data Bit 1 State of the User Port Bit 1 Data Bit 0 State of the User Port Bit 0 Parity Bit Even Parity Bit High Stop Bit Page 58 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 After 2ms Guard Time the answer should be received on the User Port otherwise an error is returned Table 30 Receiving Serial Data Frame Low Start bit Error Bit If set an error was detected Data Bit 6 State of the User Port Bit 6 Data Bit 5 State of the User Port Bit 5 Data Bit 4 State of the User Port Bit 4 Data Bit 3 State of the User Port Bit 3 Data Bit 2 State of the User Port Bit 2 Data Bit 1 State of the User Port Bit 1 Data Bit 0 State of the User Port Bit 0 Parity Bit Even Parity Bit High Stop Bit If the Error bit is set or the Parity Bit is not correct the Write User Port command returns an error code 4 3 24 16 Quiet This command sets a selected tag into halt state Only S014443 A B and SR176 tags are supported Command q None IO Halt state successfully set N Error No Tag in the field 4 3 24 16 1 ISO 14443 Type A With IS014443 3 Type A tags the Quiet command always answers with Q because the halt command does not send any acknowledge In Part 4 a Deselect command will be performed 4 3 24 16 2 ISO 14443 Type B Some 15014443 Type B ta
13. and Parameter Selection RATS Request for Answer to Select R block Receive ready block REQA Request ISO Type A REQB Request ISO Type B RFU Reserved for Future Use November 4 2008 O 2008 HID Global Corporation All rights reserved Page 7 of 89 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 S block Supervisory block Sector For the Mifare Standard one sector contains 4 blocks SID Station ID SFGT Guard time after RATS SN Serial Number of a tag a 32 bit number SOF Start of frame TDES Triple DES Value block 32 bit data block format Used in ticketing application lt CR gt Carriage return ODh lt LF gt Line feed OAh Supported tags ISO 14443 A MIFARE Standard NXP y y y MIFARE 4k NXP y y y MIFARE Ultralight NXP y y y MIFARE ProX NXP y y y MIFARE DESFire NXP y y MIFARE Mini NXP d y y SLE66CLX320P Infineon y y encryption not included SLE 55R04 08 Infineon y y encryption included Smart MX NXP y y Jewel Innovision y y y Topaz Innovision y y y ISO 14443 B SLE6666CL160S Infineon y y SR176 STM y y Page 8 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 SLIX 4K STM y y y
14. for sector xx using the transport key 1 AOA1A2A3A4A5h key type A LxxBB lt CR gt Authenticate for sector xx using the transport key 2 BOB1B2B3B4B5h key type B LxxFF lt CR gt Authenticate for sector xx using the transport key 3 FFFFFFFFFFFFh key type A 4 3 25 4 5 Login with key data from EEPROM Each key stored in the reader EEPROM can be used as type A or type B key To use a key as type A the value 10h must be added to the key index 30h must be added to use a key as type B Page 74 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 25 4 6 4 3 25 5 Usage of key A key B MIFARE cards support two different crypto keys for each sector Each key is 32 bits long and is stored in the sector trailer last block of the sector on the card It is possible to set different access rights for each key Read value block Reads a value block The command checks if data is in value block format The read value block command needs a successful login Command Value block 1 byte Answer Read value 4 bytes P Error General failure II Error value block failure IN Error No tag in field IO Error Operation mode failure Example rv04 Reads value of block 4 4 3 25 5 1 No value block I The value read back after the write value command is not a value block Data was written corr
15. of an unintentional command execution To reduce this probability only one character out of 255 is chosen to be interpreted as the continuous read stop command Reset Recovery Time Multiplier default 0 Multiplies the Reset Recovery Time including the recovery time of the field reset command Reset Recovery Time Multiplier Reset Recovery Time 0 1x 1 2x 2 3x 3 4x Enable 18014443 B Anti collision default 0 If set the anti collision algorithm for ISO 14443 B tags is enabled Disable ISO 14443 4 Error Handling default 0 If Disable ISO 14443 4 Error Handling is set IS014443 4 Error Handling is disabled The error handling always uses the TMR time out Page 32 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 10 Reset Off Time 14h The Reset Off Time register represents the field off time in ms This register is used for the select continuous read and multi tag commands Default value is OAh 4 3 11 Reset Recovery Time 15h The Reset Recovery Time register represents the recovery time in ms after the field is turned on This register is used for the select continuous read and multi tag commands Default value is 25h 4 3 12 Application Family Identifier 16h The AFI Application Family Identifier is only supported for IS014443B and 15015693 tags If the set value is d
16. tag B8h forces reader to 848kBaud from reader to tag Answer Data n bytes Serial number frame size used and baud rate frame size and baud rate 1byte P Error General failure N Error No Tag in the field Note If the tag does not support ISO 14443 part 4 FOh will return after serial number instead of used frame size baud rate Examples High speed select h08 1234567890ABCD84 Select the card with UID 1234567890SABCD The card supports a 256 byte frame size and 424kBaud on the air interface High speed multi select h18 Prepare next multi select for 848kBd m1234567890ABCD lt CR gt 1234567890ABCD84 Select the card with UID 1234567890SABCD The card supports a 256 byte frame size and 424kBaud on the air interface November 4 2008 Page 45 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 6 1 Answer from Oxh and 1xh The lower nibble contains the baud rate used for the air interface Table 21 Baud Rate Values x0 106kBaud x2 212kBaud x4 424kBaud x8 848kBaud The higher nibble contains the frame size used for the air interface Table 22 Frame Size 16 Bytes 1x 24 Bytes 2x 32 Bytes 3x 40 Bytes 4x 48 Bytes 5x 64 Bytes 6x 96 Bytes 7x 128 Bytes 8x 256 Bytes Page 46 of 89 November 4 2008
17. type A only MIFARE tags are supported 4 3 24 20 Read reader EEPROM This command reads the internal reader EEPROM lt contains all start up parameters and the device ID Changes in the start up settings will only go into effect after a reset of the device Command rp EEPROM address 1 byte 00h EFh Answer Data EEPROM data 1 byte R Error Out of range failure Example rp0B Reads protocol configuration register 4 3 24 20 1 Out of range failure R The entered EEPROM address is not valid Page 62 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 21 Select This command selects a single card in the antenna field It can only be used in single tag mode If successfully executed the command returns the UID of the selected card The reader detects the length of the UID automatically Command s None Answer Answer Description IO Data serial number IN Error No Tag in the field Example s 1234567890ABCD Select the card with UID 1234567890SABCD 4 3 24 21 1 Select a single tag No previous continuous read is required The command executes an automatic field reset 4 3 24 21 2 Extended ID See above for more information on Extended ID 4 3 24 21 3 Multiple tags This command is designed for fast access of a single tag in the field If multiple cards are us
18. 08 Page 31 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 9 Protocol configuration 2 13h The protocol configuration register 2 PCON2 further specifies the general behavior of the reader device Default value is OOh Protocol configuration 2 register Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Disable Enable ISO i ISO 14443 14443B Reset Recovery Noisy e Disable start See A Error Anti Time Multiplier Environment FER up message eset Handling collision 4 3 9 1 Disable multi tag reset default 0 4 3 9 2 4 3 9 3 4 3 9 4 4 3 9 5 4 3 9 6 4 3 9 7 If set the reader does not reset before the multi tag list and multi select command have been performed Disable start up message default 0 If Disable start up message is set the reader suppresses the start up message in ASCII mode This flag is ignored in binary protocol mode Enable binary frame v2 default 0 If Enable binary frame v2 is set the reader sends version 2 binary frames The get station ID command always sends version 1 binary frames Noisy Environment default 0 If Noisy Environment is set the continuous read mode can only be aborted with the character When working in a noisy environment the probability for a reception of an arbitrary stochastic signal is quite high This implies a high probability
19. 26 Write data multiple blocks This command writes multiple blocks to a card Command wd Start block address 1 byte Number of blocks 1 byte Data n bytes Answer Data Data block depends on tag type F Error Write failure N Error No tag in field O Error Operation mode failure Example wd050211223344556 Writes data 11223344 on block 05 and 55667788 on block 06 67788 4 3 24 26 1 Write failure F This error is displayed if bad transmission conditions are given If the block address exceeds the physical number of blocks of a tag this error is shown 4 3 24 26 2 No tag error N This error is returned if no tag is present or the card does not respond 4 3 24 26 3 Operation mode failure O The presented tag is not 15014443 type A SR 176 compliant For ISO 14443 type A only MIFARE tags are supported November 4 2008 Page 67 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 26 4 Disable Read after Write A read is done automatically after every write to ensure correct writing If the disable Read after Write flag is set no read is done and the returned data is a OOh byte in case of successfully written data 4 3 24 27 Write EEPROM Writes to the internal reader EEPROM It contains all start up parameters and the device ID Changes to the start up settings will only go into eff
20. 4 3 20 User data 80h EFh These registers are for free use 4 3 21 Instruction Set Following table describes all the commands of the reader device Each command returns an answer to the host Exceptions are mentioned explicitly The green LED acknowledges a successfully executed command The red LED indicates an error 4 3 22 Common Commands Overview Table 18 Command overview Command Description dk Test continuous read Check KTT upload status c Continuous read me Abort continuous read refer to continuous read dg dn dr Set LED dei DES encryption decryption of data g Get ID h High speed select k Lock block m MultiTag select tag list o a o b o d o e Include tag type ont o s o v o a o b o d Exclude tag type o e o i o s bag oa ob od oe oi ot Set tag type os ov of Set configuration flags og Set configuration register ox Reread all register poff pon Antenna power off on November 4 2008 Page 35 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 Command Description pr pw Read write user port q Quiet ra Resend last answer r rb Read block rd Read data multiple blocks rp Read EEPROM register s
21. 72 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader User Manual Firmware V2 4 1502 USM 00 0 02 4 3 25 4 Login authenticate tag Performs an authentication in order to access one sector of a MIFARE card Only one sector can be accessed at a time Optionally the command can be used to transmit the key data to the reader stored keys in the reader EEPROM To store keys in the EEPROM the write master key command is used It is possible to store up to 32 master keys in the reader EEPROM The login requires a successful select Command Sector 1 byte valid range 00h 3Fh Key type 1 byte AAh authenticate with key type A FFh authenticate with key type A transport key FFFFFFFFFFFFh BBh authenticate with key type B 10h 2Fh authenticate with key type A using stored key 00h 1Fh 30h 4Fh authenticate with key type B using stored key 00h 1Fh Key 6 bytes lt CR gt 1 byte optional By transmitting lt CR gt instead of the key data authentication is done with manufacturer s transport keys ADA1A2A3A4A5h BOB1B2B3B4B5h FFFFFFFFFFFFh Answer Login status 1 byte data L Login success E Error General failure IN Error No tag IO Error Operation mode failure R Error Out of range Ka Error Authentication failed November 4 2008 2008 HID Global Corporation All rights reserved
22. Antenna Design or to the HID GLOBAL Antenna Design Guide Appendix B SAM Please note that the power supply of the SAM adapter must be turned off during the entire card insertion period otherwise SAM card damage might occur For proper usage of the SAM a 100nF capacitor between V and GND is necessary Page 82 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 Appendix C Short Range Plug amp Play Module RDHS 0404N0 03 November 4 2008 Page 83 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 Dimensions Top view All dimensions are listed in mm ai O T 4 1 21 mm 29 70 00 mm 67 00 mm 62 00 mm 58 26 mm 4106mm B gt L a mm 4083mm 42 00 mm rg 43 00 mm November 4 2008 Page 84 of 89 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 Appendix D Timings tres lt Response PC Reader Table 32 Timings comment Jet Common commands Cont read locked tag 2 8 22 6 Reset Off and Recovery Time CO Cont read worst case 3x Reset Off and Recovery Time DES en decrypti
23. Description VDD 20 5 V DC 4 5VDC to 5 5VDC GND 19 Ground LEDg 18 LED green reading LED LEDr 17 LED red EN 16 Enable reader open or logic high MCLR 15 Master clear USER 14 User Port DIR 13 Direction of RS 485 TX 12 TX to PC RX 11 RX from PC 3 1 3 Electrical characteristics of PINs PIN PIN No Voltage Current Description max RX 11 USART To RS232 RS485 or RS422 TX 12 device driver USER 14 az Be 25 mA User sets logic state MCLR 15 TIL Master clear Leave unconnected Low will reset the register and the key management to default values EN 16 SE 25 mA Low will disable the reader device LEDr 17 TTL 25 mA Logic Low used for LED LEDg 18 TTL 25 mA With 330 Q internal serial resistor ARX 1 depends on 200 mApp Antenna input ATX1 2 antenna tuning Antenna output ATX2 5 Antenna output GND TGND 6 RF Output approx 150mW at 50 Ohms SAM CLK 7 TTL Clock for SAM 3 39MHz With 560 Q internal serial resistor SAM IO 8 TTL SAM IO for input and output With a 3 3 kQ internal pull up resistor and a 3300 serial resistor Universal Synchronous Asynchronous Receiver Transmitter TTL buffer output input TTL buffer output input Schmitt trigger buffer output Page 20 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 SAM RESET 9 TTL SAM r
24. ESFire tags using a specific command set see Table 19 DESFire Command Set 1 5 1 Memory organization The memory of a DESFire card can be personalized to specific requirements The card can be seen as data storage device like a hard disk in a PC The memory is divided into a maximum of 28 different applications directories with 16 files each An application has up to 14 keys Depending on keys and access conditions a file can be accessed in four different ways Plain data is never secured Data is secured using a MAC single DES or triple DES enciphers The following figure describes the memory organization of a DESFire card DESFire card Application 0 Application 1 Application 2 Figure 5 DESFire Memory November 4 2008 Page 13 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 Activate DESFire card GG ae XZ Select Application SZ Login to Application E Select File with ID Z Change File C E 23 Raw E MA MY E Commit Abort Transaction CR Sy Figure 6 DESFire state diagram Page 14 of 89 O 2008 HID Global Corporation All rights reserved November 4 2008 HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 1 5 1 1 Activate PICC Before accessing a DESFire card select the card A DESFire ca
25. FF new Philips cards Key B BO B1 B2 B3 B4 B5 Infineon or FF FF FF FF FF FF new Philips cards Access Conditions FF 07 80 xx key A is used to read or write key A itself is not readable key B is data only For further information refer to the MIFARE card manual Page 10 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 Remarks Enabled keys are always read as 00 00 00 00 00 00 Using key B as a data area will cause a security gap due to the fact that it is necessary to rewrite key A and the access conditions at each write process It is not recommended to use key Bas a data storage area All MIFARE cards use the following state diagram MZ Idle Reader Instruction Set f a NA ISO 14443 Commands 5 a 2 Ready Halt a Wake Up oor Halt Active b y Anticollision Loop E Authenticate aaa Tag interfacin read write Authenticated gt a 9 Figure 4 State diagram November 4 2008 Page 11 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 1 2 1 3 MIFARE Ultralight MIFARE Ultralight cards have no encryption included They only support plain text data transmission MIFARE Ultralight only supports 4 bytes per sector but the comm
26. Manual Firmware V2 4 2 ISO 14443 Type B ISO 14443 type B cards are supported 2 1 SR176 The SR176 label contains only 30 bytes of data organized in two bytes per page 2 1 1 Memory organization OFh Lock byte RFU Chip ID OEh User data 04h User data 03h Serial number 02h Serial number 01h Serial number 00h Serial number 2 1 2 Serial number UID The UID is stored in the first 4 pages Page 00h contains the LSB of the UID Page 03h Page 02h Page 01h Page 00h Byte 1h Byte 0 Byte 1 Byte 0 Byte 1 Byte 0 Byte 1 Byte 0 Page 16 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 2 1 3 Lock byte The lock byte defines the write access condition of a pair of pages Each bit can only be set once This procedure is irreversible This byte is implemented as an OTP Page OCh Page 0Dh Page OAh Page OBh cc W L oo oo DO D o oad Page 08h Page 09h Page 06h Page 07h Page 04h Page 05h Page 02h Page 03h Page 00h Page 01h 2 1 4 Chip ID The Chip ID is defined in the low nibble of page OFh It is manufacturer set and is used internally to select and separate single tags 2 2 SRIX4K The SRIX4K label contains 512 bytes of data organized into four byte pages Memory organization FFh OTP Lock Reg ST Rese
27. OT Intelligent Contactless Identification L TAGnology RFID GmbH Grazer Vorstadt 142 8570 Voitsberg AUSTRIA phone 43 0 3142 28 9 28 10 fax 43 0 3142 28 9 28 20 office tagnology com www tagnology com HF Dual ISO RFID Reader 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 Firmware Version 2 4 November 4 2008 Doc Number 1502 USM 00 Rev A 0 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 Warning Read before start up e The product may only be used for the intended purpose designed by for the manufacturer The operation manual should be conveniently kept available at all times for each user e Unauthorized changes that have not been sold or recommended by the manufacturer may have a negative influence on the system the program has been installed or copied on Such unauthorized measures shall exclude any liability by the manufacturer e The liability prescriptions of the manufacturer in the issue valid at the time of purchase are valid for the device The manufacturer shall not be held legally responsible for inaccuracies errors or omissions in the manual or automatically set parameters for a device or for an incorrect application of a device e Only qualified personnel should carry out installation operation and maintenance procedures e Use of the program and its installation must be in accordance with national legal requirements e When working on d
28. Off time in milliseconds 1 byte Field recovery time in milliseconds 1 byte Answer E After the field reset the reader sends back a Y to acknowledge the command November 4 2008 Page 69 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 25 ISO 14443 Type A MIFARE only commands 4 3 25 1 Increment value block credit Increments a value block with a defined value A read is done automatically after a write to verify data integrity The command fails if the source block is not in value block format A previous login is needed to access a block Command Block 1 byte Value 4 bytes Answer Data Value 4 bytes T Error value block failure E Error increment failure IN Error No tag in field IO Error Operation mode failure Example p S Con 0400000001 Adds 1 to value block 4 0500000100 Adds 256 to value block 5 4 3 25 1 1 No value block I Specified block does not match the value format The value block is corrupted A backup block can be used to restore the correct value 4 3 25 1 2 Increment failure F This indicates a general failure during the increment procedure or an inability to read after the write process 4 3 25 1 3 No tag error N The reader does not detect a response from the tag There is either no tag present or the tag does not respond
29. Serial Data Frame 58 Table 30 Receiving Serial Data Frame ooocoononccccnnoccccnononcncnononcncnnnnnnncnnnonnn cnn no nn arca rn rra rra 59 Table 31 Using a MIFARE Carr dd 80 Table 32 TIMINOS TER 85 November 4 2008 Page 5 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 Scope The HF Dual ISO Reader Module supports a broad range of tags compliant with ISO 14443 type A and B standards including SR176 tags and tags that belong to the Philips MIFARE family An open command structure allows the device to communicate with tags that use an operating system The read write unit supports automatic chaining 256 byte buffer and frame length extended time framing and up to 848kBaud transmission rates over the air interface Additionally this unit implements a DES cipher that enables to use MIFARE DESFire tags These tags are designed for use in high security algorithms A SAM interface is also available Major applications are e Access control identification using high security cards e Ticketing using standard MIFARE cards e Data storage e Multi applications using operating systems Extended Documentation Please note that all confidential material is excluded from this documentation in order to comply with NDA requirements of our suppliers as well as prevention from unauthorized copies of the reader modules for increasing the security in the appli
30. and set uses 16 bytes per sector Only the 4 least significant bytes are valid when using MIFARE Ultralight Ensure that the other bytes match with the tag content when using the write command otherwise the read back will fail MIFARE 4k MIFARE 4k cards have an increased memory Beginning from sector 32 20h sectors have 16 blocks Due to compatibility reasons the sector indices have changed according to the following table The login sector has to be used to access the corresponding sector on the card Table 1 MIFARE 4k sector index table Sector Login sector 00h 03h 04h 07h 7Ch 7Fh 80h 8Fh 90h 9Fh AOh AFh BOh BFh COh CFh DOh DFh E0h EFh FOh FEN 1 4 MIFAREO ProX MIFARE ProX tags have an operating system onboard Data organization depends on the operating system installed on the card These cards can include additional functionalities such as DES or a proprietary encipher algorithm Before accessing the operating system the card must be selected Customized commands are issued using the transfer command Page 12 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 1 5 MIFARE DESFire This tag supports additional security algorithms DES Triple DES and MAC for security sensitive applications Addressed are D
31. ard to most serial interface types by using the right interface converter circuit In order to optimize the communication quality the specific application note of the interface converter circuit needs to be taken into consideration Interface Converter Host Interface OEM Board onve Circuit Page 22 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 3 1 4 4 Function Control LEDs Connect two external LEDs to the OEM Board There are two alternatives possible Option 1 OEM Board Option 2 In both cases the LED supply voltage levels are TTL levels November 4 2008 Page 23 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 Software By default data is transmitted at 9600 n 8 1 no handshaking Two protocol modes are supported The protocol mode is configured in the reader EEPROM As factory default the ASCII protocol is used 4 1 ASCII Protocol This protocol is designed for easy handling The commands are issued using a terminal program Data is transmitted as ASCII hexadecimal that can be displayed on any terminal program i e HyperTerminal Table 2 ASCII protocol frame Variable length Variable length 4 2 Binary Protocol This protocol is designed for industrial applications
32. be performed addressing only this card All other tags remain silent Page 48 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 7 4 Multi tag reset The antenna field reset can be deactivated with the Protocol configuration 2 register By suppressing the antenna field reset it is possible to detect only new tags in the antenna field 4 3 24 7 5 Maximum number of tags The maximum number of tags in the antenna field is limited to 64 and by the physical characteristics of the antenna 4 3 24 7 6 LED activity The LED stays green as long as a tag was found and goes dark if the command is finished 4 3 24 8 Include tag type This command includes a specific tag type to those addressed by the reader device Command or Tag type 1 byte Answer O tag type 1 byte Command code String of tag type Tag type character Refer to Set tag type Example ota Include 1S014443 A to the tag types addressed by the reader device November 4 2008 Page 49 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 9 Exclude tag type This command excludes a specific tag type from being addressed by the reader device Command o Tag type 1 byte Answer O tag type 1 byte Command code String of tag
33. ble to use every stored key for key A as well as key B authentication Each key is 6 bytes long and stored redundantly for data security 4 3 24 25 Write block This command writes data to a block A read is done automatically after every write to ensure correct writing Command w Block address 1 byte valid range 00h 40h Data n bytes wb Block address 1 byte Data n bytes Answer Data Data block depends on tag type P Error Write failure IN Error No tag in field O Error Operation mode failure R Error Out of range Example wb0511223344 Writes data 11223344 on block 05 4 3 24 25 1 Write failure F This error is displayed if bad transmission conditions are given If the block address exceeds the physical number of blocks of a tag this error is shown 4 3 24 25 2 No tag error Ni This error is returned if no tag is present or the card does not respond 4 3 24 25 3 Operation mode failure O The tag is not 15014443 type A compliant Page 66 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 25 4 Out of range failure R The block address of the w command is higher than 40h The block address of the wi command conflicts with other commands therefore the block address has to be limited to 40h Use the wb command instead 4 3 24
34. cation of the DESFire key can only be done using an appropriate card and following successful login 4 3 24 23 3 Using DESFire keys for authentication DESFire keys may be used for DESFire tag authentication or DES TDES encryption decryption Each key is 16 bytes long and stored redundantly for data security 4 3 24 24 Write master key This command stores a MIFARE Standard key into the master key memory of the reader The reader can store up to 32 keys Command wm Key number 1 byte 00h 1Fh Key 6 bytes Answer data Written key 6 bytes F Error Write failure R Error Out of range Example Cor io wm001 12233445566 Store key 112233445566h in EEPROM key number 0 wm02A0A1A2A3A4A5 Store transport key 1 in EEPROM key 2 4 3 24 24 1 Out of range failure R The entered key index exceeds the address range 4 3 24 24 2 Writing master keys Keys are Write Only It is not possible to read the keys Nevertheless the reader returns correct error messages if the writing process fails A verification of the master key can only be done using an appropriate card and following successful login November 4 2008 Page 65 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 24 3 Using master keys for authentication Master keys may be used for ISO 14443 A tag authentication It is possi
35. cations You can obtain the extended documentation containing the confidential information after signing a NDA Page 6 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader User Manual Firmware V2 4 1502 USM 00 0 02 Overview Definitions Anti collision loop An algorithm used to identify and handle a dialogue between a reader and one or more tags in its antenna field Hex notation A hexadecimal value is marked with the suffix h i e A1h has the value A1 hexadecimal ASCII notation ASCII characters are listed within apostrophes i e x means a single x Abbreviations Abbreviation Description AID Application ID ASCII American Standard Code for Information Interchange ATR Answer to Reset ATS Answer to Select Block For the Mifare Standard one block contains 16 bytes CID Card Identifier logical card address ISO 14443 4 CRC Cyclic Redundancy Check DES Data Encryption Standard for more details about DES refer to 3 EDC Error Detection Code EOF End of Frame Hex xxh Value in Hexadecimal notation I block Information block LSB Least Significant Bit or Byte MSB Most Significant Bit or Byte NAD Node Address ISO 14443 4 OSI Open System Interconnection OTP One time programmable PCB Protocol Control Byte ISO 14443 4 PCON Protocol Configuration byte of the reader PPS Protocol
36. d Time SFGT A high speed select with parameters Oxh and 1xh automatically waits the SFGT guard time received from the tag before sending the PPS command 4 3 24 7 Multi Tag Selection List This command detects several tags at the same time It replaces the fast select command s in multiple tag surroundings The Multi Tag List command lists all tags with their serial numbers Use the Multi Tag Select command to select a single tag Each tag has to be selected separately Command m Serial number n bytes lt CR gt 1 byte _ Des dd ic A Data o serial number IN Error No Tag in the field Example m lt CR gt 04E9E700000000 gt first card 34030F07 gt second card 02 gt number of detected tags m04E9E700000000 lt CR gt Select card with its serial number 4 3 24 7 1 Multi tag list Sending a lt CR gt as the first parameter the reader returns a list of all tags present in the antenna field In the end the total number of tags detected is returned 4 3 24 7 2 Reading distance Each card needs a specific amount of power The reader always provides the same power level Therefore the reading distance will decrease if more tags are present Basically the reading distance depends on the tag the antenna and the tuning of the antenna 4 3 24 7 3 Multi tag select Using the serial number with lt CR gt as parameter the corresponding tag will be selected High level interactions can
37. d in the EMC Directive 89 336 EEC If the HID GLOBAL HF Dual ISO Reader Module is operated with other components all power connections and additional components of the final device must comply with the European EMC directive Additional connections may have a length of up to 2 m maximum or in fixed installations up to 1 m maximum European customers must themselves make sure that the final device conforms to the European EMC Directive MIFARE Certificate The HID Global HF Dual ISO USB Plug amp Play Board and the HID Global HF Dual ISO USB Desktop Unit comply with the Philips MIFARE requirements The units have shown their compliance during extensive tests at the Arsenal Research Institute located in Vienna Austria Arsenal Research is the official MIFARE certification institute November 4 2008 Page 89 of 89 2008 HID Global Corporation All rights reserved
38. data frames over User Port Automatic ISO 14443 4 timeouts can be switched on off Request A information within ISO 14443 A Extended ID answer can be switched on off Command Guard Time added of and og commands get new parameters November 4 2008 Page 87 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 5 3 5 Chaining of 256 byte frame support Support of ASK GTML tag Page read functionality added Additional protocol register PCON3 Some bug fixes Dual 2 1 High speed select supports anti collision and the forcing of the air interface transmission rate and the frame size Automatic ISO 14443 4 error handling can be switched on off RATS answer is returned with high speed select command for 15014443 A tags and with Extended ID flag set Support for the 15014443 B anti collision algorithm Extended Protocol flag now switches on off complete 1S014443 4 handling 15014443 4 chaining and WTX improved of and og commands get new parameters Selection time out for 5014443 4 A tags is set to 10h Dual 2 0 Initial Release Page 88 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 Appendix F Approvals Certificates CE Declaration The HID GLOBAL HF Dual ISO Reader Module complies with the European CE requirements specifie
39. e Table 5 Protocol configuration register to detect incomplete binary frames 4 2 9 Examples 02h 64h 01h 78h 1Dh 03h STX Station ID Length x BCC ETX This instruction frame will reset the reader module with the station ID 64h 4 3 Register Set The reader has several system flags used for customization purposes The flags are stored in its non volatile EEPROM The reader accepts changes to these settings only during the start up phase Clearing all RFU bits is recommended in order to guarantee compatibility with future releases The reader can store up to 32 authentication keys internally to login standard MIFARE cards An additional 32 keys can be stored for DESFire authentication All keys are read only and cannot be accessed via the interface lines Page 26 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 1 EEPROM memory organization Register Description 00h 04h Unique device ID read only 05h 09h Administrative data read only OAh Station ID OBh Protocol configuration OCh Baud rate ODh Command Guard Time OEh Operation Mode OFh Single shot time out value 10h Internal use Do not change 11h Internal use Do not change 12h Internal use Do not change 13h Protocol configuratio
40. e response data length depends on the tag type Command ei None Answer 0 T Data Serial number n bytes N Error No Tag in the field only binary protocol 4 3 24 2 1 Multitag continuous read mode If the Multitag flag is set in the Protocol Configuration PCON register the reader reads multiple tags continuously Page 38 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 2 2 4 3 24 2 3 4 3 24 2 4 4 3 24 2 5 4 3 24 2 6 Auto start The continuous read mode is started automatically in ASCII mode The auto start flag must be set in the PCON register Noisy Environment If the Noisy Environment flag is set the continuous read mode can only be aborted with the character Binary mode This command is not fully supported in binary protocol mode Continuous Read in binary mode does not start up automatically at boot time even if the corresponding EEPROM flag is set Within the single shot time out only one response is sent Simple access control applications Serial numbers are always sent plain Data encryption is activated after a successful login For simple access control applications the use read only blocks for the identification of the tag is recommended Reading any block even the manufacturer block of the transponder will increase your security LED activity
41. ect a single card with 106kBaud 02h select a single card with 212kBaud 04h select a single card with 424kBaud 08h select a single card with 848kBaud 10h prepare next multi select for 106kbaud 12h prepare next multi select for 212kbaud 14h prepare next multi select for 424kbaud 18h prepare next multi select for 848kbaud 20h forces reader to 106kBaud 22h forces reader to 212kBaud 24h forces reader to 424kBaud 28h forces reader to 848kBaud tag size 30h 38h force tag frame size asynchronous mode 80h select a single card with 106kBaud 82h select a single card with 212kBaud 84h select a single card with 424kBaud 88h select a single card with 848kBaud 90h prepare next multi select for 106kbaud 92h prepare next multi select for 212kbaud 94h prepare next multi select for 424kbaud 98h prepare next multi select for 848kbaud Page 44 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 AOh forces reader to 106kBaud from tag to reader A2h forces reader to 212kBaud from tag to reader A4h forces reader to 424kBaud from tag to reader A8h forces reader to 848kBaud from tag to reader BOh forces reader to 106kBaud from reader to tag B2h forces reader to 212kBaud from reader to tag B4h forces reader to 424kBaud from reader to
42. ect after a reset of the device Command wp Address 1 byte valid range OAh EFh Data 1 byte Answer Data EEPROM data 1 byte E Error Read after write failure R Error Out of range failure Example wp0A01 Set EEPROM address 0A Station ID to 01h 4 3 24 27 1 Out of range failure R The entered address exceeds the address range Page 68 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 28 Reset This command executes a power on software reset New configuration settings will be loaded It resets all tags in the antenna field Command Ka None Answer Answer Description A Dual 2 2 lt CR gt lt LF gt ASCII Mode None Binary Mode 4 3 24 28 1 Disable Start up Message If the start up message is disabled in the protocol configuration register 2 the ASCII mode does not respond with the version of the reader 4 3 24 28 2 Reset Timing The power up timing depends on environmental conditions such as voltage ramp up For handheld devices the timing can vary based on the charge state of the battery 4 3 24 28 3 Field Reset The field reset switches off the antenna field for the specified duration All tags need a certain amount of time to initialize before a command can be processed The second byte specifies the field recovery time Command y
43. ed the m instruction has to be used instead November 4 2008 Page 63 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 22 Get Version This command returns the current version of the reader module Command IW None Answer Dual 2 2 lt CR gt lt LF gt ASCII Mode 02 00 08 44 75 61 6C 20 32 2E 32 32 03 Binary Mode Example v Dual 2 2 Version of the reader module 4 3 24 23 Write DESFire key This command is used to store a key into the DESFire key memory of the reader The reader can store up to 32 keys DESFire keys can be used for fast access to applications on a card Command wh Key number 1 byte 00h 1Fh Key 16 bytes Answer data Written key 16 bytes F Error Write failure R Error Out of range Example wf0000112233445566778899AABBCC Store key 00112233445566778899AABBCCDDEEFFh in DDEEFF EEPROM key number 0 Page 64 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 23 1 Out of range failure R The entered key number exceeds the permitted range 4 3 24 23 2 Writing DESFire Keys Keys are write only It is not possible to read the keys Nevertheless the reader returns correct error messages if the writing process fails A verifi
44. eset RFU 10 Not connected GND 4 19 GND Supply Ground VDD 3 20 5 VDC 150 mA Supply Voltage 4 5V DC to 5 5 VDC DIR 13 TTL 25 mA RS485 direction 3 1 4 External Connections 3 1 4 1 Power Supply If the supply voltage and any noise modulated on the supply voltage remains within the specified limits no further filtering is required It is recommended in some cases to use additional filtering for the power supply line Insufficient power line filtering could cause unexpected or irregular performance drops Option 1 5V DC OEM Board 20 19 ol Option 2 5V DC OEM Board 3 4 Connect the board as shown above Both alternatives are possible and can be used as they fit best into the layout of the carrier board The two VCC PINs and the two GND PINs are connected internally November 4 2008 Page 21 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 3 1 4 2 Antenna The external antenna needs to have the right inductance and a certain resistor and capacitor combination for optimized frequency tuning and antenna matching OEM Board More Details about the antenna design are available in the Antenna Design Guide Download his Document from www hidglobal com omnikey 3 1 4 3 Serial Interface Connect the OEM Board directly with a micro controller Alternatively connect the OEM Bo
45. evices the valid safety regulations must be observed e International copyrights are applicable to this program Unauthorized copying distribution or resale of this program or of parts of this program is a violation of applicable laws and will be prosecuted Page 2 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 Read Me First About This Guide This manual describes the HF Dual ISO Reader Its goal is to describe the reader how it works how to integrate it and how to use it Contacts HID Global Corporation Ltd Haverhill UK email eusupport hidglobal com main 44 0 1440 714 850 support 44 0 1440 711 822 fax 44 0 1440 714 840 November 4 2008 Page 3 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 Contents Warning Read before start up ccseecccesseeeeeeeeeeeeeeeeeseeeseeeseeeseeeseeeseaeseseseaeseseseaaeseseseaeseseseanseseseanseeenaes 2 ReadMe OC E A SCOPE EE 6 Extended Documentation euee fue dee SEENEN NEESS esc teianei 6 epuer deed EES Ee 7 1 The MIFARE Transponder Family cccccesseeeeeseeeeeeeeeeeeeeneeeeeeeeeseeeeeeaseeeeeeeseeeeeeessseeeeesseeeneeseeeenees 10 2 19014443 Type EE 16 Bi De UE 18 Ai LS EE 24 5 Frequently Asked Questions cccseescseseeeeeeeseeeeeeeeeeesese
46. ey management Key Length If the Key Length is set the command uses the TDES algorithm with 16 byte key If cleared the command uses the DES algorithm with 8 byte key Encode Setting this flag encodes the data Clearing this flag decodes the data November 4 2008 Page 41 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 5 Get ID This command returns the station ID of the reader device The answer is time slotted to enable the detection of all devices in party line mode The station ID has only effect in binary mode Command g None Answer Data Station ID of the reader device 1 byte Page 42 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 5 1 Time slotted answer In party line mode more than one reader can be used simultaneously The time slotted answer allows separating in time the answers from all connected devices The station ID is used to determine the correct time slot The reader supports up to 254 unique time slots The following formula calculates the duration of one time slot only one baud rate is supported per party line 10 de Baudrate T s Figure 7 Time slot formula The following figure shows the timing diagram of time slotted answers Timeslot 0 1 2 3 4 5 E 252 253 254 To
47. gs do not support this command or do not respond Quiet is an ISO 14443 4 command so it will work only if the Deselect command is supported by the corresponding transponder November 4 2008 Page 59 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 16 3 SR176 With SR176 tags the Quiet command always answer with Q because the completion command does not send any acknowledge 4 3 24 17 Resend Last Answer This command resends the last answer from the internal serial buffer of the reader Command ra Resend last answer 4 3 24 18 Read block This command reads a data block on a card The size of the returned data depends on the tag used The block address range depends on the tag as well Command Block address 1 byte valid range 00h 40h rb Block address 1 byte Answer Data Es block depends on tag type F Error read failure N Error No tag in field O Error Operation mode failure H Error Out of range Example rb05 Reads block 05 4 3 24 18 1 Read failure E This error is returned if either the reader receives bad data or the block address exceeds the block address range of the sector 4 3 24 18 2 No tag in field N The tag does not respond There is either no tag present or addressed Page 60 of 89 November 4 2008 O 2008 HID Global Corporation All right
48. h T2 Ts T4 Ts T252 T253 T254 e a q dE HOST g gt Reader 01 lt 01 Reader 03 lt 03 Reader 04 lt 04 Reader 254 Figure 8 Time slotted answers diagram November 4 2008 Page 43 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 5 2 Binary Protocol Version 2 This command never sends version 2 binary frames 4 3 24 6 High speed select This command selects a card in the antenna field according to the selection criteria or prepares a multi select command switches to high baud rates and enables 256 byte frames If execution is successful the command returns the UID of the selected card and the used baud rate The reader automatically detects the maximum frame size of the card The reader also tries to communicate to the transponder with the specified baud rate If no communication is possible the reader will automatically decrease the speed to the next lower value In synchronous mode the up and downlink speed are identical In asynchronous mode the up and downlink speed can be different This command can also force the reader to the communication speed and frame size of the tag to the specified values This is only needed if the high speed select is done manually with the transfer command Command Command Data h Option byte 1 byte synchronous mode 00h sel
49. he HID ID sales representative for the Utility software or download it from http www hidglobal com omnikey Minimum requirements are WIN98SE WIN 2000 WIN XP and a free COM port on the PC 5 1 3 What type of MIFARE card should I use The MIFARE standard is designed for multi application environments It contains 16 sectors each with 2 individual keys access conditions and 3 data or value blocks Some applications use the 1 Kbytes of the MIFARE Standard Card Memory only as storage area MIFARE Ultra light has no crypto unit on chip It only supports 16 blocks MIFARE Standard 4k cards have the same features as MIFARE Standard cards but increased memory capacity Page 78 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 5 1 4 How safe is MIFARE Standard for cashless payment Security is always a feature of the overall system not of the components It requires careful design A properly designed system will require ALL barriers to be hacked in order to be broken For good design start identifying possible attacks and then create barriers to block them MIFARE was specifically designed for cashless payment applications The MIFARE concept provides the following security barriers e Anti collision selection e Atomic value transaction e Ciphered communication e Storage of values and data protected by mutual a
50. ice is around 300us The default value is 20h November 4 2008 Page 33 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 17 Protocol configuration 3 1Bh The protocol configuration register 3 PCON3 further specifies the general behavior of the reader device Default value is OOh Table 16 Protocol configuration register Protocol configuration 3 register Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Disable automatic SAK Extended RegA Internal use do not Page ID Extended ID change Read REY O A timeouts 4 3 17 1 Disable automatic ISO 14443 4 timeouts default 0 If Disable automatic ISO 14443 4 timeouts is set the automatic ISO 14443 4 timeouts are disabled The timeouts specified with TMR registers are used 4 3 17 2 Page read default 0 If set the continuous read mode retrieves the content of the tag instead of the serial number The register Page Start 1Ch defines the start block and the Page Number 1Fh defines the number of blocks to be read 4 3 17 3 ReqA Extended ID default 0 If set the Extended ID information for 15014443 A tags replaces the cascade level information 1 byte with Request A answer 2 bytes 4 3 17 4 SAK Extended ID default 0 If set the Extended ID information for ISO 14443 A tags will include the SAK byte behind the serial number 4 3 18 Protocol configuration
51. ifferent from 00h the AFI is used Only transponders with an identical AFI will answer to the reader Default value is OOh 4 3 13 Selection Time out ISO 14443A 17h The Selection Time out represents the reader card communication time out for the select high speed select continuous read multilist multi select and MIFARE login command with ISO 14443A tags Use low values for a better reaction time between the card and the reader One time slice is around 300us The default value is 10h 4 3 14 Selection Time out ISO 14443B 18h The Selection Time out represents the reader card communication time out for the select high speed select continuous read multilist and multi select commands with ISO 14443B tags For a better reaction time use low values One time slice is around 300us The default value is 10h 4 3 15 Selection Time out SR176 19h The Selection Time out represents the reader card communication time out for the select continuous read multilist and multi select command with SR176 tags For a better reaction time use low values One time slice is around 300us The default value is 10h 4 3 16 Selection Time out ISO 15693 1Ah The Selection Time out represents the reader card communication time out for the select high speed select continuous read multilist multi select and MIFARE login command with ISO 15693 tags Use low values for a better reaction time between the card and the reader One time sl
52. ined at EEPROM register OFh The delay time can be adjusted stepwise in 100ms steps 00h indicates no delay and FFh indicates infinite delay Extended Protocol default 1 If Extended Protocol is set the transfer data telegram command supports 1S014443 4 and automatically process the WTX and chaining for smaller frames If sending ISO 14443 3 commands this flag has to be switched off The transfer data telegram command is only supported in normal mode not in transmit receive mode Extend ID default 0 If Extend ID is set the reader extends the serial number with additional information ISO 14443 A tags Table 6 ISO 14443 A Extended Serial number of part 3 selection 1 byte 2 bytes 4 71 10 bytes 1 byte Table 7 ISO 14443 A Extended Serial number of part 4 selection 1 byte 2 bytes 4 7 10 bytes 1 byte n bytes 1 byte 1 byte The tag type byte indicates the type of cascade level Table 8 ISO 14443 A tag type 00h Cascade level 1 transponder 01h Cascade level 2 transponder 02h Cascade level 3 transponder ISO 14443 B tags Table 9 ISO 14443 B Extended Serial number of part 3 selection 4 bytes 4 bytes 3 bytes 1 byte Table 10 ISO 14443 B Extended Serial number of part 4 selection 4 bytes 4 bytes 3 bytes 1 byte 1 byte 1 byte For detailed description of Application Data Protocol Info and MBLI CID refer to the ISO 14443 documentation 1 November 4 2008 Page 29 of 89 2008 HID G
53. ious example No login needed since the file is plain Command answer 04E10E00000000 activate card f0408000010 00 select application with ID 000010 f020D00 00 select file with ID 00 09160000001 122334455 00 write data to standard data file f051500000010 0011223344550000000000000000000000 read data from standard data file 5 2 3 Use a DES secured value file The next example demonstrates the use of a DES secured value file such as the one created in the previous example After the selection of the application a login with the key of the value file is needed to access the file Modification of the value file is accepted after the commit transaction command is given Command o o November 4 2008 Page 81 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 References 1 2 3 4 5 ISO IEC 14443 Part 1 4 Identification Cards Contact less integrated circuit s cards Proximity cards DESFire Documentation Philips http www semiconductors philips com Data Encryption Standard DES FIPS PUB 46 3 Reaffirmed 1995 October 25 HID Antenna Design Guide Philips Application Note MIFARE amp I Code Micore Reader IC family Directly Matched Antenna Design Appendix A Antenna According to antenna design please refer to the Philips Application Note MIFARE 6 amp I Code Micore Reader IC family Directly Matched
54. lobal Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 5 BAUD Baud rate control register OCh The baud rate register defines the communication speed of the reader device Default value is 00h Table 11 Baud rate register Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 RFU RFU RFU RFU RFU BS2 BS1 BSO This register defines the baud rate of the device Table 12 Baud rate St 9600 baud default 19200 baud 38400 baud 57600 baud 115200 baud 230400 baud depends on the used interface chip 460800 baud depends on the used interface chip aj O O joj o ajojo O O O ja2 O a O a O With the high baud rates 230400 and 460800 baud proper operation depends on the interface chip used Please note that some of the interface chips available do not support these high baud rates The following table describes the exact baud rates used by the reader Table 13 Exact baud rates 9600 baud 9576 baud 0 25 19200 baud 19261 baud 0 32 38400 baud 38523 baud 0 32 57600 baud 58448 baud 1 47 115200 baud 113000 baud 1 91 230400 baud 241545 baud 4 84 460800 baud 483091 baud 4 84 Page 30 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4
55. n 2 14h Reset Off Time 15h Reset Recovery Time 16h Application Family Identifier 17h ISO 14443A Selection Time out 18h ISO 14443B Selection Time out 19h SR176 Selection Time out 1Ah ISO 15693 Selection Time out 1Bh Protocol configuration 3 1Ch Page Start 1Dh Internal use Do not change 1Eh Internal use Do not change 1Fh Page number 20h Protocol configuration 4 21h CID 22h Internal use Do not change 23h Internal use Do not change 24h Internal use Do not change 25h Internal use Do not change 4 3 2 Unique device ID 00h 04h The unique device ID identifies a reader module It is factory programmed and cannot be changed November 4 2008 Page 27 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 3 4 3 4 Station ID OAh The station ID is used in binary mode to address a device in party line set up The station ID can range from 01h to FEh and can be set freely The value OOh is reserved for the bus master All readers send their response to this device The broadcast message FFh forces all readers to response to the command Default value is 01h Protocol configuration OBh The protocol configuration register PCON specifies general behavior of the reader device Default value is 41h Table 5 Protocol configuration register Protocol c
56. of range Example of0101 Answer 01 Enables the New Serial Mode flag Page 52 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader User Manual Firmware V2 4 1502 USM 00 0 02 Flag Types The following table shows the Flag Type with its corresponding flag from the specified Protocol Configuration Register Table 25 Flag Type with corresponding flag Flag Type Corresponding Flag Protocol Configuration Valid Register values 00h Multitag 1 00 01 01h New Serial Mode 1 00 01 02h LED 1 00 01 03h Single Shot 1 00 01 04h Extended Protocol 1 00 01 05h Extended ID 1 00 01 06h Disable Multitag Reset 2 00 01 07h Noisy Environment 2 00 01 08h Reset Recovery Time Multiplier 2 00 03 09h Enable 15014443 B Anti collision 2 00 01 OAh Disable 15014443 4 Error Handling 2 00 01 OBh Disable automatic 3 00 01 15014443 4 timeouts ODh Page Read 3 00 01 11h RegA Extended ID 3 00 01 12h Disable Read after Write 4 00 01 13h SAK Extended ID 3 00 01 14h WupA B 4 00 01 15h CID Extended ID 4 00 01 16h Internal use Do not change 4 3 24 11 1 Out of range failure R The entered flag type is out of range November 4 2008 2008 HID Global Corporation All rights reserved Page 53 of 89 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 12 Set Configuration Regi
57. on 9 6 9 7 TDES en decryption 28 7 28 8 High speed select h08 14 4 Reset Off and Recovery Time SFGT locked tag High speed select h08 eo 3x Reset Off and Recovery Time High speed select h08 3x Reset Off and Recovery Time SFGT no tag worst case Multi select locked tag 11 4 Reset Off and Recovery Time Multi select no tag Reset Off and Recovery Time 6 Multi select worst case 6 Reset Off and Recovery Time Antenna on Reset Recovery Time Port read Port write Read block 1 8 2 2 Reset 54 8 9 15 14 5 8 7 7 0 2 0 2 0 1 0 1 8 2 Select locked tag Reset Off and Recovery Time Select no tag 3x Reset Off and Recovery Time Select worst case 3x Reset Off and Recovery Time ISO 14443 Type A only commands Increment value block Decrement value block November 4 2008 Page 85 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 Command Copy value block Read value block Write value block MIFARE Login Power on Does not include rise time of power supply Enable on Default Command Guard Time 20h 1 2ms was used All timing data is advisory application information and does not form part of the specifications It may change in future firmware releases Please also note that all val
58. onditions this error is returned if a sector is addressed which is not located in the authenticated area 4 3 25 6 3 No tag error N This error is returned if no tag is present or the card does not respond 4 3 25 6 4 Operation mode failure O The tag is not 15014443 type A compliant 4 3 25 6 5 Writing values The write value block command is designed to create blocks in value format This command requires write access to the specified block Using this instruction for ticketing operations is not recommended For ticketing applications special instructions Increment Decrement Copy are available Page 76 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 26 SR176 only commands 4 3 26 1 Lock block This command locks a block permanently Command k Block address 1 byte Answer data PK page address P Error Lock failure N Error No tag in field IO Error Operation mode failure only SR176 tags supported Ka Error Block already locked Example k05 K05 Lock block 05 4 3 26 1 1 Operation mode failure O The presented tag is not a SR176 tag 4 3 26 1 2 Apply settings After locking a block permanently the tag needs to be selected for the settings to apply November 4 2008 Page 77 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader
59. onfiguration register Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit O Extend ed Extend ed Single New serial F ID Protocol shot LED mode Multitag Protocol Auto start 4 3 4 1 Auto start default 1 If set the reader device will start up in continuous read mode automatically 4 3 4 2 Protocol default 0 If Protocol is set to 1 then the reader uses binary protocol mode Refer to binary protocol for further information on the binary protocol format Default setting ASCII protocol 0 4 3 4 3 Multitag default 0 The Multitag flag will enable multi tag recognition in continuous read mode All tags are detected and displayed Due to the more complex search algorithm the continuous read command decreases its detection speed 4 3 4 4 New Serial Mode default 0 If New Serial Mode is set to 1 new serial mode is enabled A leading character is added to the serial number Leading Character Description J ISO 14443 A Jewel tag M ISO 14443 A S SR 176 Z ISO 14443 B 4 3 4 5 LED default 0 If set the reader suppresses any LED activity The user manages the state of the LEDs Page 28 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 4 6 4 3 4 7 4 3 4 8 Single Shot default 0 If Single Shot is set the reader displays the serial number of a tag in continuous read mode once within a specified time out The time out is def
60. ort Transaction 4 3 23 Error Codes Following figure shows an overview of all error messages of the reader device Table 20 Error codes Error Code Description Y Unknown command IC Collision or CRC MAC Error E General failure i Invalid value format specified block does not match the value format N No tag in the field O Operation mode failure or file not selected R Command parameter out of range Ka Authentication failed Xxh DESFire error code November 4 2008 2008 HID Global Corporation All rights reserved Page 37 of 89 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 Common commands 4 3 24 1 Test Continuous Read This command tests the state of the continuous read command This command only works in ASCII mode Command T None Answer E Continuous read mode is not active T Continuous read mode is active 4 3 24 2 Continuous Read The reader device reads and displays serial numbers continuously while one or more tags remain in the field This command stops if any character is sent to the reader module The reader module returns the character S 53h The reader supports different tag types at the same time To increase the reading performance switch to a single tag mode If more than one tag of the same type should be detected at the same time the Multitag flag must be activated Th
61. r State If cleared the command was processed successfully If Error State is set an error occurred Leading Character Info Bit 1 amp 2 defines how to interpret the data in the binary frame 0 0 No leading character available all values are hexadecimal 0 1 The data contains one leading character 1 0 All data bytes are characters 1 1 RFU 4 2 5 Data This part contains the command and the data The command values are the same as in ASCII protocol mode xv s whereas data is transmitted in binary mode The length of the command block depends on the instruction November 4 2008 Page 25 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 2 6 Block Check Character BCC The BCC is used to detect transmission errors The BCC is calculated XOR ing each byte of the transmission frame excluding the STX BCC and ETX characters The flags are part of the data BCC StatID XOR Length XOR Command Data XOR XOR Command Data y Station ID Length Data 0 Data 1 XO R BCC Data n 4 2 7 ETX End of transmission 03h 4 2 8 Remarks If the reader device receives an invalid instruction frame i e wrong BCC or the requested station ID does not match the internal ID of the reader the command is not executed The reader waits for the next valid frame Use the automatic binary time out se
62. rd has a 7 byte UID After activation the card is powered up and ready to accept a DESFire command Application 0 is selected automatically 1 5 1 2 Select application To jump into another application select the application An application can be seen as a directory which contains up to 16 files The size of the application depends on the stored files 1 5 1 3 Login to application Specific access rights can be set for each application Login to an application allows changing the organization of the application Login to a file opens a secured file for access A file can be accessed in four different ways without any security or secured with MAC single DES or triple DES 1 5 1 4 Select file Before accessing a file select the file 1 5 1 5 Change file Change a selected file according its access rights If a file is secured a login is required before changes can be made 1 5 1 6 Commit Abort transaction Value files backup files linear record files and cyclic record files only adapt their values after the commit transaction command is given Several files can be changed within an application at the same time The abort transactions command annuls all changes within an application Power loss will cancel all modifications too For more details about application settings and access rights refer to 2 November 4 2008 Page 15 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User
63. rved ST Reserved Fixed Chip ID 7Fh User data 07h User data 06h 32 bits binary counter 05h 32 bits binary counter 04h 32 bits Boolean Area 03h 32 bits Boolean Area 02h 32 bits Boolean Area 01h 32 bits Boolean Area 00h 32 bits Boolean Area 2 2 2 Lock block Locking of blocks is not supported with this tag November 4 2008 Page 17 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 3 Hardware Mi 14443 A B Dual 2 0 umir Page 18 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader User Manual Firmware V2 4 1502 USM 00 0 02 3 1 Pin out of OEM Module RDHO 0401N0 03 Top View 30 48 mm 29 21 mm P 1 27 mm WEAR ST 207 J2 E 3 e O E O O O 25 40mm 5 e 1 27 mm O GI O un 8 O 11 o 2 54 mm 3 1 1 Pin out of Ji PIN PIN No Description ARX 1 Antenna RX ATX1 2 Antenna TX1 VDD 3 5 V DC 4 5VDC to 5 5VDC GND 4 Ground ATX2 5 Antenna TX2 TGND 6 Antenna Ground SAM CLK 7 SAM clock SAM IO 8 SAM IO SAM RESET 9 SAM Reset RFU 10 Reserved for future use November 4 2008 2008 HID Global Corporation All rights reserved Page 19 of 89 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 3 1 2 Pin out of J2 PIN PIN No
64. s reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 18 3 Operation mode failure O The presented tag is not IS014443 type A compliant 4 3 24 18 4 Out of range failure R The block address of the r command is higher than 40h The block address of the r command conflicts with other commands therefore the block address has to be limited to 40h Use the rb command instead 4 3 24 19 Read data multiple blocks This command reads multiple data blocks on a card The size of the returned data depends on the tag used The block address range depends on the tag as well Command rd Start block address 1 byte Number of blocks to read 1 byte Data data block depends on tag type F Error read failure IN Error No tag in field O Error Operation mode failure Example rd0504 Reads 4 blocks starting with block 05 4 3 24 19 1 Read failure E This error is returned if either the reader receives bad data or the block address exceeds the block address range of the sector 4 3 24 19 2 No tag in field N The tag does not respond There is either no tag present or addressed November 4 2008 Page 61 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 19 3 Operation mode failure Or The presented tag is not 15014443 type A SR 176 compliant For ISO 14443
65. seeeeseeeseeeseseseeeseseseeesesesneeseseseeesesesseenseseseanes 78 RETCREN CES iii ii a A dr 82 Appendix En E 82 ee lt B SAM EE 82 Appendix C Short Range Plug Play Module RDHS 0404N0 03 cccccsssseeeesseeeeeeseeteeeeseeeeeennes 83 ell dp KRITT E 85 Appendix E Release NOtes o tica 87 Appendix F Approvals Certificates cccccceeeeeeeeeeeeeeeeeee EENEG 89 List of Figures Figure 1 MIFARE Standard sector dai E A A 10 Figure 2 MIFARE Standard sector 0 block EE 10 Figure 3 MIFARE Standard block GE EN Dn EEN 10 Figure Ee e EE 11 Figure 5 DESFire MOM Oly issc cseesenezsees td these entgeet seduce ees El lion EEN E EENS Ee Eise 13 Figure 6 DESFire State diagram ee EENHEETEN A C 14 Figures Time Slot formula TE 43 Figure 8 Time slotted answers diagram non cn nn arc cnn cnn rra rn 43 Page 4 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 List of Tables Table 1 MIFARE 4k sector index table EE 12 Table 2 AC protocol frame eebe a aa 24 Table 3 Binary Frame Version leerer aE lis 24 Table 4 Binary Frame V6rsion Zacatecano dead vas te dE aA dace NARKA EENEG 24 Table 5 Protocol configuration register esnin AAE AA EAEE SE 28 Table 6 ISO 14443 A Extended Serial number of part 3 selection cccccccecceeceeeeeeeeeeeeceeeeeeeeeeeteteees 29 Table 7 ISO 14443 A Extended Serial number of par
66. ster This command allows setting some configuration registers just in time no reset is needed The values are not stored in the EEPROM therefore the changed values are not available after a reset Command og Register type 1 byte data 1 byte Answer I Data 1 byte Current state of changed register R Error Out of range Example 090450 Answer 50 Sets the Reset Recovery Time to 50h Register Types The following table shows the Register Type with its corresponding register Table 26 Register Type with corresponding register 00h Single shot time out value 01h Internal use Do not change 02h Internal use Do not change 03h Reset Off Time 04h Reset Recovery Time 05h ISO 14443A Selection Time out 06h ISO 14443B Selection Time out 07h SR176 Selection Time out 08h AFI OCh Page Read Start ODh Page Read Number OEh Command Guard Time OFh CID 10h Internal use Do not change Page 54 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 12 1 Out of range failure R The entered register type is out of range 4 3 24 13 Reread all register This command rereads and applies all register settings Command ox none Answer Data 3 bytes X new protocol new baud rate Example Ox Answer X0106 binary pro
67. t 4 selection cccccccecsecceceeeeeseeeecteeeeeeeeeeeeteees 29 Table 3 150 14443 A tag type EE 29 Table 9 ISO 14443 B Extended Serial number of part 3 Selection cccccccecsecceceeeeeeeeeeceeeeeeeeeeeeeteees 29 Table 10 ISO 14443 B Extended Serial number of part 4 Selection oooooooccococcnincococcccccccononaononcnoncnnncnanannns 29 Table 11 Baud rate register oireiden ikeyin lee ee ie ed 30 Table T2 Baud rate SOS i 30 Table 19 Exact baud R EC 30 Table 14 Communication due CET 31 Table 15 Operation mode register j 0 c herein tele ences A EEN 31 Table 16 Protocol configuration register oonnnncccnnnnnccnnnnnccccnnonnccnnnannncnn ano nn nc nano nn r cano rn rra rr rr rn 34 Table 17 Protocol configuration register ooonnnnccconnnnccnnnnncccnnnonnccnnnonnncnn nn nn nr nano rca rro rn rra rar 34 Table Command Be ENEE 35 Table 19 DESFire Command Set gek eit ies ates 36 Table 20 Erroricodes ii A A A A 37 Table 21 Baud Rate Values ci ts 46 Table 22 Tu 46 Table 23 Bau Rato valles ici ias aia la ri nida 47 Table 24 Frame Size ENEE UNENEE td dd cd 47 Table 25 Flag Type with Corresponding Tag 53 Table 26 Register Type with corresponding register ooocoonnncccnnnacocccononnncnanoncnnnano conan canon nn rrnnn rra r rana rca 54 Table 27 Read USER port return values cece ee eeseeseceaeaeceeeeeeesecacaeeeeeeeeeseneuaeeeeeeeeeetees 58 Table 28 Write User port SettINgS ivciiiin ii a toa 58 Table 29 Sending
68. to the request 4 3 25 1 4 Operation mode failure Or The tag is not 15014443 type A compliant Page 70 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 25 2 Decrement value block debit Decrements a value block with a defined value A read is done automatically after the write to verify data integrity The command fails if the source block is not in value block format A previous login is needed to access a block Command Block 1 byte Value 4 bytes Answer Descriptio Data Value 4 bytes T Error value block failure F Error decrement failure N Error No tag in field O Error Operation mode failure Example 0400000001 Subtract 1 to value block 4 0500000100 Subtract 256 to value block 5 4 3 25 2 1 No value block I Specified block does not match the value format The value block is corrupted A backup block can be used to restore the correct value 4 3 25 2 2 Decrement failure E The Decrement failure indicates a general failure during the decrement procedure or inability to read after the write process 4 3 25 2 3 No tag error N The reader does not detect a response from the tag There is either no tag present or the tag does not respond to the request 4 3 25 2 4 Operation mode failure O The tag is not 15014443 type A compliant November 4
69. tocol and 460800 baud active New protocol 00h means ASCII and 01h means binary protocol New baud rate Values of 00h 06h are valid For baud rate values refer to baud rate register November 4 2008 Page 55 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 14 Antenna power on off This command controls the antenna power It can be used to decrease the power consumption of the reader Command i pon Switch reader on poff Put reader in standby mode Answer P Positive acknowledge Example poff Put reader in standby mode 4 3 24 14 1 Power off The reader enters standby mode Power consumption is decreased All tags in the antenna field are powered off and reset Standby mode is only entered manually To switch off the whole unit pin 16 Enable has to be set to logic low 4 3 24 14 2 Power on The reader leaves standby mode and is ready for the next command Sending a tag command i e select continuous read the reader is powered up Page 56 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 15 Read Write user port This command sets or reads the state of the user port pin 14 of the OEM reader device The port is set either as output or as input Command
70. type Tag type character Refer to Set tag type Example o a Exclude 15014443 A from the tag types addressed by the reader device Page 50 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 3 24 10 Set tag type This command sets up the reader for a specific tag type The continuous read function will speed up because only this type of tag is addressed After a reset the reader starts as defined in its start up configuration Command o ISO type 1 byte a ISO 14443 Type A b ISO 14443 Type B s SR176 f activate all tags Answer OA String of tag type OB OS OT Example oa Sets the reader device to address IS014443 A type tags Innovision Jewel tag Innovision Jewel tag is part of ISO 14443 Type A It can not be separately switched on off November 4 2008 Page 51 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 24 11 Set Configuration Flags This command allows setting some configuration flags just in time no reset is needed The values are not stored in the EEPROM therefore the changed values are not available after a reset Command of flag type 1 byte data 1 byte Answer Data 1 byte Current state of changed flag R Error Out
71. ues specified in the above table depend on the tag used and Command Guard Time Page 86 of 89 November 4 2008 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 Appendix E Release Notes 5 3 Version History Date Revision number 10 27 2008 Version 2 4 Rev 2 0 HID Format 8 07 2007 Version 2 4 Rev 1 0 08 01 2005 Version 2 2 Rev 1 1 Tag type for cascade level corrected SAM internal pull up corrected to 3 3kQ 05 17 2005 Version 2 2 Rev 1 0 02 18 2005 Version 2 1 Rev 1 0 5 3 1 Dual 2 4 Extended ID supports the ISO 14443 A SAK byte High Level support of the Innovision Jewel tag selection read and write operations Added functionality to switch between RegA B or WupA B usage The Quiet command no supports ISO 14443 part 3 and 4 Improved ISO 14443 4 handling Changed LED behavior in continuous read mode and multilist Increased LED flash duration time New command ox added to reread all register settings Dual 2 3 Master clear pin added MCLR resets the register values to default Resend last answer command added Support of asynchronous baud rates for the high speed select command Register default value changed for Selection Timeout ISO 14443 B Added commands to read and write multiple blocks rd wd Flag added to disable read after write Bug fixes Dual 2 2 Sending serial
72. uptly 4 3 25 5 2 No tag error N This means that the tag does not respond because either there is no tag present or none of the tags in the field are authenticated I instruction 4 3 25 5 3 General failure E In addition to the case of a data read failure caused by bad transmission conditions this error is returned if a sector is addressed which is not located in the authenticated area 4 3 25 5 4 Operation mode failure O The tag is not 15014443 type A compliant November 4 2008 Page 75 of 89 O 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4 4 3 25 6 Write value block This command formats a block as a value block containing a 32 bit value A read is performed automatically after the write Value blocks need a complete 16 byte block due to redundant storage A successful login is required to run the command Command Value block 1 byte Value 4 bytes Data Written value 4 bytes T Error value block failure P Error write failure IN Error No tag in field O Error Operation mode failure Example wv05010055EF Writes value 010055EFh to block 5 4 3 25 6 1 Invalid value T The value read back after the write value command is not a value block Data was written corruptly 4 3 25 6 2 Write failure F In addition to the case of a data read failure caused by bad transmission c
73. uthentication e Weak field keys that allow decrement only e Stored keys in the reader that are not readable e Keys in the card that are not readable e A brute force attack based on trying many different keys is limited by the transaction time several ms of the card and would last virtually forever The Application can and should provide more barriers e Sector access conditions It is possible to assign access conditions in a way that only decrementing of values is allowed with the keys used in the field So even a manipulated field station cannot be used to increment the value on the cards As a general rule key A is used as a field key allowing only to read and decrement values and key B is used to format the card or increment values e Diversified keys To make life even harder for attackers keys can be modified using the serial number and memory content of the card So each card uses different keys and a listening attack on the reader interface would be hopeless e Limiting cash volume stored on a card e Do not use the transport keys keys programmed at the time of delivery for ticketing applications e Ciphered and scrambled data storage e Sabotage alarm e Even higher security with contact less controller cards like DESFire MIFARE ProX MIFARE Smart MX etc November 4 2008 Page 79 of 89 2008 HID Global Corporation All rights reserved 1502 USM 00 0 02 HF Dual ISO RFID Reader User Manual Firmware V2 4
74. with synchronization and frame checking An addressing byte for party line master slave multi drop is also included The protocol usually requires a device driver Data is transmitted in binary mode The reader uses an internal binary watchdog timer to ensure correct framing Table 3 Binary Frame Version 1 1 byte 1 byte 1 byte Variable length 1 byte 1 byte The binary frame version 2 is only sent to the host It is implemented to give extended information to the host Enable version 2 in the Protocol configuration 2 register Table 4 Binary Frame Version 2 1 byte 1 byte 1 byte 1 byte Variable length 1 byte 1 byte 4 2 1 STX Start of transmission 02h 4 2 2 Station ID Unique ID of the station 00h Reserved for the bus master Readers send response to this device ID FFh Broadcast message All devices will execute the command and send their response Page 24 of 89 November 4 2008 O 2008 HID Global Corporation All rights reserved HF Dual ISO RFID Reader 1502 USM 00 0 02 User Manual Firmware V2 4 4 2 3 Length Length defines the length of the data block including the flag byte if binary protocol version 2 is activated If length is set to zero 256 data bytes are transmitted The reader module only can send 256 data bytes but cannot receive commands with 256 bytes 4 2 4 Flags The flag byte gives additional information to the host RFU Leading Character Info Error State Erro

TAGnology_UserManual_HF_Dual ISO_RFID_Reader

Contents

Download Pdf Manuals

Related Search

Related Contents