UHF RFID Reader AsReader Box
Command Reference Ver.1.14

Asterisk, Inc.

Contents
1

Interface specification ........................................................................................................................ 1

2

Protocol Description ........................................................................................................................... 1

3

Formats of data frames ...................................................................................................................... 2

4

3.1

Command Frame Format (From HOST) ............................................................................. 2

3.2

Response Frame Format (From READER) ......................................................................... 2

Command summary ........................................................................................................................... 4
4.1

EPC C1 G2（ISO18000-6C）Commands .......................................................................... 4

4.2

18000-6B Commands .......................................................................................................... 4

4.3

Reader customised command ............................................................................................. 55

List of the response status ................................................................................................................. 6

6

RFID tag error code ......................................................................................................................... 13

7

Tag memory and access instructions .............................................................................................. 13

8

Command detail description ............................................................................................................ 14
8.1

Overview ............................................................................................................................ 148.2

EPC C1G2 commands ...................................................................................................... 14

8.3

8.2.1

Tags inventory ............................................................................................................ 14

8.2.2

Read data ................................................................................................................... 19

8.2.3

Write data ................................................................................................................... 21

8.2.4

Write EPC number ..................................................................................................... 22

8.2.5

Kill tag ......................................................................................................................... 23

8.2.6

Set read/write protection for specific memory ............................................................ 25

8.2.7

Block erase ................................................................................................................. 27

8.2.8

Read protection configuration (according to EPC number) ........................................ 29

8.2.9

Read protection configuration (Without EPC number) ............................................... 30

8.2.10Unlock read protection ............................................................................................... 31

8.2.11

Read protection status check ..................................................................................... 32

8.2.12

EAS configuration ....................................................................................................... 32

8.2.13

EAS alert detection ..................................................................................................... 34

8.2.14Single tag inventory .................................................................................................... 34

8.2.15Block writing command .............................................................................................. 34

8.2.16

Obtain Monza4QT working parameters ..................................................................... 36

8.2.17

Modify Monza4QT working parameters ..................................................................... 38

8.2.18Extended data reading with assigned mask ............................................................... 39

8.2.19Extended data reading with assigned mask ............................................................... 41

8.2.20Inventory with memory buffer ..................................................................................... 43

8.2.21

Mix inventory .............................................................................................................. 46

8.2.22Inventory with EPC number ........................................................................................ 50

8.2.23

QT inventory ............................................................................................................... 52

18000-6B Commands ........................................................................................................ 55
8.3.1

Single tag inventory .................................................................................................... 55

8.3.2

Inquire tags according specified condition ................................................................. 55

8.3.3

Reader data ................................................................................................................ 56

I

8.4

8.3.4

Write data ................................................................................................................... 57

8.3.5

Obtain lock status ....................................................................................................... 58

8.3.6

Lock byte .................................................................................................................... 58

Reader customised commands ......................................................................................... 59
8.4.1

Obtain reader information ........................................................................................... 59

8.4.2

Modify working frequency ........................................................................................... 60

8.4.3

Modify reader address ................................................................................................ 62

8.4.4

Modify reader inventory time ...................................................................................... 62

8.4.5

Modify serial baud rate ............................................................................................... 63

8.4.6

Modify RF power ........................................................................................................ 63

8.4.7

Buzzer/LED control .................................................................................................... 64

8.4.8

Setup antenna multiplexing ........................................................................................ 64

8.4.9

Enable/disable buzzer ................................................................................................ 65

8.4.10GPIO control ............................................................................................................... 66

8.4.11

Obtain GPIO state ...................................................................................................... 66

8.4.12

Obtain the reader unique serial number ..................................................................... 67

8.4.13Modify tag customised function .................................................................................. 67

8.4.14

Enable antenna check ................................................................................................ 68

8.4.15Modify communication interface ................................................................................. 68

8.4.16

Modify or load Antenna return loss threshold configuration ....................................... 69

8.4.17

Modify maximum EPC/TID length configuration for memory buffer ........................... 69

8.4.18Load the maximum EPC/TID length configuration ..................................................... 70

8.4.19Obtain data from memory buffer ................................................................................ 70

8.4.20

Clear memory buffer ................................................................................................... 71

8.4.21

Obtain the total tag amount from memory buffer ........................................................ 72

8.4.22Modify parameters of real time inventory mode ......................................................... 72

8.4.23Modify reader working mode ...................................................................................... 74

8.4.24

Obtain reader working mode ...................................................................................... 76

8.4.25

Load/modify heartbeat packet time break of real time inventory ................................ 77

8.4.26

Modify RF power configuration separately for write operations ................................. 78

8.4.27

Load the RF power configuration of write operations ................................................. 79

8.4.28

Modify or load maximum write retry time configuration .............................................. 79

8.4.29Modify password of tag customised functions ............................................................ 80

8.4.30Obtain password of tag customised functions ............................................................ 81

8.4.31

Load/modify reader profile .......................................................................................... 81

8.4.32Synchronise EM4325 timestamp ................................................................................ 82

8.4.33

Obtain EM4325 temperature data .............................................................................. 83

8.4.34

Obtain external data via EM4325 SPI ........................................................................ 85

8.4.35

Reset EM4325 alert .................................................................................................... 87

8.4.36

Modify or load DRM configuration .............................................................................. 89

8.4.37

Measure antenna return loss...................................................................................... 90

8.4.38

Measure current reader temperature ......................................................................... 90

IIUHF RFID Reader UHFReader288MP User Manual v1.14

1 Interface specification
Communication between host and reader is based on UART or USB. Host delivers
commands on these interfaces and reader will produces response and execute thedelivered commands.
Data Frame Format
1 start bit, 8 data bits, 1 stop bit
ParityNONE
Default Baud Rate
57600 bps
Transmission order
Least-significant bit first

2 Protocol Description
In a typical communication, host delivers command and parameters to reader, reader
should execute the command and provide result or data response. Reader will receive andexecute ONE command in every communication cycle. Reader will not able to receive newcommand before the last execution and response delivery is completed. Any command
which is transmitted during command execution will be ignored by the reader.
Command delivery from host:
Host
Command frame

Direction→

ReaderDescription:
Once a command is received by reader, the reader will produce a response to host within
the predefined inventory time. Data communication time is negligible here.
During communication, the transmitting time gap between every two consecutive bytes
should be less than 15ms. If the time gap exceeds 15ms, all the received data should bediscarded and a normal receiving process restarts from the next byte.
Response delivery from reader:
ReaderDirection
Host
Response frame→
Description:
During communication, the transmitting time gap between every two consecutive bytes
should be less than 15ms.
A typical communication process is stated below:
1. Host delivers command to reader and wait for response;
2. Reader receives command, starts specific operation according to the received frame andproduce response (of operation status and/or data) to host;
3. Host receives response from reader.
1

UHF RFID Reader UHFReader288MP User Manual v1.14

3 Formats of data frames
3.1

Command Frame Format (From HOST)

Len

Adr

Cmd

Format definition:
Length (in
byte)
Len
1

Adr

1

Cmd
Data[]

1
Variable

LSB-CRC16

1

MSB-CRC16

1

3.2

Data[]

LSB-CRC16 MSB-CRC16

Description
Length of the command frame, defined by the amountof bytes between Adr and MSB_CRC16, i.e. the lengthof Data[] + 4. The minimum and maximum values of
Len are 4 and 255.
Reader device address, the valid range of device
address is 0x00 ~ 0xFE. 0xFF is the broadcast
address.
Reader will only response to command frame statedwith a identical address or 0xFF.
Default device address: 0x00.
Command code.
Parameter field, host may or may not provides
parameters according to different commands formats.
Low byte of CRC16.
These 2 bytes are the CRC16 calculation of Len toData[].
High byte of CRC16

Response Frame Format (From READER)

Len

Adr

reCmd Status

Format description：
Length (in
byte)
Len
1

Adr
reCmd

1
1

Data[]

LSB-CRC16 MSB-CRC16

Description
Length of the response frame, defined by the amount ofbytes between Adr and MSB_CRC16), i.e. the length ofData[] + 5.
Reader address.
reCmd indicates which command this frame is
responding to. For unrecognised command, reCmd
2

UHF RFID Reader UHFReader288MP User Manual v1.14

StatusData[]

1
Variable

LSB-CRC16

1

MSB-CRC16

1should be 0x00.
Command execution status/result
Data field, reader may or may not provide parameters
according to actual commands.
Low byte of CRC16.
These 2 bytes are the CRC16 calculation of Len toData[].。
High byte of CRC16

C language algorithm of CRC16:#define PRESET_VALUE 0xFFFF#define POLYNOMIAL 0x8408
unsigned int uiCrc16Cal(unsigned char const * pucY, unsigned char ucX){
unsigned char ucI,ucJ;
unsigned short int uiCrcValue = PRESET_VALUE;
for(ucI = 0; ucI < ucX; ucI++){
uiCrcValue = uiCrcValue ^ *(pucY + ucI);for(ucJ = 0; ucJ < 8; ucJ++){if(uiCrcValue & 0x0001){
uiCrcValue = (uiCrcValue >> 1) ^ POLYNOMIAL;}
else{
uiCrcValue = (uiCrcValue >> 1);}}}
return uiCrcValue;}
pucY is the pointer of the array entry for CRC16 calculation, ucX is the amount of bytes
included in this calculation. A 0x0000 return value indicates the input data had passed the
CRC16 verification.
Whenever the host receive a data frame from reader, the host should always verify theframe by calling this CRC16 algorithm.

3

UHF RFID Reader UHFReader288MP User Manual v1.14

4 Command summary
4.1

EPC C1 G2（ISO18000-6C）Commands
No.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

4.2

Command
code
0x01
0x02
0x03
0x04
0x05
0x06
0x07
0x08
0x09
0x0a
0x0b
0x0c
0x0d
0x0f
0x10
0x11
0x12
0x15
0x16
0x18
0x19
0x1a
0x1b

Function
Tag Inventory
Read data command
Write data command
Write EPC number
Kill tag
Set memory read/write protection for specific memory
Block erase
Read protection configuration (according to EPC number)
Read protection configuration (Without EPC number)
Unlock read protection
Read protection status check
EAS configuration
EAS alert detection
Single tag inventory
Write blocks
Obtain Monza4QT working parameters
Modify Monza4QT working parameters
Extended data reading with assigned mask
Extended data writing with assigned mask
Inventory with memory buffer
Mix inventory
Inventory with EPC number
QT inventory

18000-6B Commands
No.
1
2

CommandFunctioncode
0x50
Inventory command for SINGLE tag. This command will only
inquire one tag in every cycle, with NO inventory condition.
0x51
Inventory command for MULTIPLE tags. Inquire tags according
predefined condition and only return UIDs of the corresponding
4UHF RFID Reader UHFReader288MP User Manual v1.14

3

0x52

4

0x53

5

0x54

6

0x55

4.3

tags.
Read data command.
Read data from tag, maximum 32 bytes in every command cycle.
Write data command.
Write data to tag, maximum 32 bytes in every command cycle.
Obtain lock status command.
Check the lock status of a particular memory unit.
Byte locking command.
Lock a particular (unlocked) byte in a tag.

Reader customised command
No.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

Command
code
0x21
0x22
0x24
0x25
0x28
0x2f
0x33
0x3f
0x40
0x46
0x47
0x4c
0x3a
0x66
0x6a
0x6e
0x70
0x71
0x72
0x73
0x74
0x75
0x76
0x77
0x78
0x79
0x7a

Function
Obtain reader information
Modify working frequency
Modify reader address
Modify reader inventory time
Modify serial baud rate
Modify RF power
LED/Buzzer control
Setup antenna multiplexing
Enable/disable buzzer
GPIO control
Obtain GPIO stateObtain the reader unique serial number
Modify tag customised function
Enable antenna check
Modify communication interface
Modify or load Antenna return loss threshold configuration
Modify maximum EPC/TID length configuration for memory buffer
Load the maximum EPC/TID length configuration
Obtain data from memory buffer
Clear memory buffer
Obtain the total tag amount from memory buffer
Modify parameters of real time inventory mode
Modify working mode
Load real time inventory mode parameters
Load/modify heartbeat packet time break of real time inventory
Modify RF power configuration separately for write operations
Load the RF power configuration of write operations
5

UHF RFID Reader UHFReader288MP User Manual v1.14

28
29
30
31
32
33
34
35
36
37
38

0x7b
0x7d
0x7e
0x7f
0x85
0x86
0x87
0x88
0x90
0x91
0x92

Modify or load maximum write retry time configuration
Modify password of tag customised functions
Obtain password of tag customised functions
Load/modify reader profile
Synchronise EM4325 timestamp
Obtain EM4325 temperature data
Obtain external data via EM4325 SPI
Reset EM4325 alert
Modify or load DRM configuration
Measure antenna return loss
Measure current reader temperature

5 List of the response status
Response frameLen5+
the lengthof Data[]
field

5
+
the lengthof Data[]
field

Adr

0xXX

0xXX

reCmd

0xXX

0x01

Status0x00

0x01

Data[]

CRC1
6

Statusdefinition

...

LSB
+
MSB

Operation
succeed

...

LSB
+
MSB

Inventory
succeed6

Description
Command is
successfully
executed, all therequested data is
included in theData[] field ofresponse frame.
Host delivered G2
tag inventorycommand, taginventory wascompletedsuccessfully andreader is able todeliver data
response within
the predefinedinventory time.

UHF RFID Reader UHFReader288MP User Manual v1.14

5+
the lengthof Data[]
field

5
+
the lengthof Data[]
field

5
+
the lengthof Data[]
field

5

0xXX

0xXX

0xXX

0xXX

0x01

0x01

0x01

0xXX

0x02

0x03

0x04

0x05

LSB
+
MSB

Inventory
timeout

...

LSB
+
MSB

Furtherdata iswaiting tobedelivered

...

LSB
+
MSB

Readermemory is
full

N/A

LSB
+
MSB

Accesspassword
error

...

7

Host delivered G2
tag inventorycommand, reader
fails to complete
the inventory
within thepredefinedinventory time.
Host delivered G2
tag inventorycommand, reader
is not able toresponse all thedata in a single
frame, further data
will be transmitted
in the following
frames.
Host delivered G2
tag inventorycommand, reader
has completedparts of theinventory and runout of memory
space due to theamount of tags.
Reader will
response theinquired EPC
number.
Host delivered anincorrect accesspassword toreader.

UHF RFID Reader UHFReader288MP User Manual v1.14

5

5

5

5

5

0xXX

0xXX

0xXX

0xXX

0xXX

0x05

0x05

0xXX

0xXX

0x0a

0x09

0x0a

0x0b

0x0c

0x0d

N/A

LSB
+
MSB

N/A

LSB
+
MSB

N/A

LSB
+
MSB

N/A

LSB
+
MSB

N/A

LSB
+
MSB

8

Host delivered a
G2 tag killingcommand, but thekill operation is
failed due to
Tag killingincorrect tag
failedkilling password orpoor
communication
between reader
and tag.
It is not possible toAll-zero tag
kill a Tag with allkillingzero tag killing
password
password.
Some optionalcommands statedin G2 protocol andCommandsomeis notmanufacturers'
support bycustomised
the tagcommand may not
be supported by
the tags.
For NXP UCODEEPC G2X tag, it is
not possible toAll-zeroenable reader
accessprotection or
password enable EAS alert if
the tag accesspassword isall-zero.
The readprotection isenabled for the
Fail totarget NXP
enableUCODE EPC
read
G2X tag. It is notprotection
possible to lock a
protection enabledtag.

UHF RFID Reader UHFReader288MP User Manual v1.14

5

5

5

5

5

5

5
+
the lengthof Data[]
field

0xXX

0xXX

0xXX

0xXX

0xXX

0xXX

0xXX

0x0a

0x53

0x55

0x55

0xXX

0xXX

0x51

0x0e

0x10

0x11

0x12

0x13

0x14

0X15

N/A

LSB
+
MSB

N/A

LSB
+
MSB

N/A

LSB
+
MSB

N/A

LSB
+
MSB

Fail tounlock thetag

Fail toperform
write
operation
Fail toperform
lock
operation
Fail toperform
lock
operation

The target NXPUCODE EPC
G2X tag is alreadyunlocked or the
tag locking
function is notsupport by thetarget tag.
Some bytes
stored in thetarget 6B tag arelocked.
Fail to perform
lock operation on
a 6B tag.
The target 6B tag
is locked.

N/A

LSB
+
MSB

Fail tostored theparameter
value

Fail to store thevalue of somepreserved
parameters.
Configuration will
still valid before
reader shut down

N/A

LSB
+
MSB

Modification failed

Fail to adjust the
RF power.

response
within thepredefinedinventorytime

Host delivered 6B
tag inventorycommand, taginventory wascompletedsuccessfully andreader is able todeliver data
response within
the predefinedinventory time.

...

9

LSB
+
MSB

UHF RFID Reader UHFReader288MP User Manual v1.14

5+
the lengthof Data[]
field

5
+
the lengthof Data[]
field

5
+
the lengthof Data[]
field

5

0xXX

0xXX

0xXX

0xXX

0x51

0x51

0x51

0xXX

0x16

0x17

0x18

0x19

LSB
+
MSB

Inventory
timeout

...

LSB
+
MSB

Furtherdata iswaiting tobedelivered

...

LSB
+
MSB

Readermemory is
full

LSB
+
MSB

All-zeroaccesspassword
orfunction is
notsupported

...

N/A

10

Host delivered 6B
tag inventorycommand, reader
fails to complete
the inventory
within thepredefinedinventory time.
Host delivered 6B
tag inventorycommand, reader
is not able toresponse all thedata in a single
frame, further data
will be transmitted
in the following
frames.
Host delivered 6B
tag inventorycommand, reader
has completedparts of theinventory and runout of memory
space due to theamount of tags.
Reader will
response theinquired EPC
number.
Fail to enable EAS
alert. It may
caused by an
all-zero tag
access password
or the EAS alert is
not supported by
the target tag.

UHF RFID Reader UHFReader288MP User Manual v1.14

5

5+
the lengthof Data[]
field

5
+
the lengthof Data[]
field

0xXX

0xXX

0xXX

0xXX

0x01

0xee

0x1A

0x26

0x28

N/A

LSB
+
MSB

...

LSB
+
MSB

...

LSB
+
MSB

5

0xXX

0xXX

0xF8

N/A

LSB
+
MSB

5

0xXX

0xXX

0xF9

N/A

LSB
+
MSB

N/A

LSB
+
MSB

N/A

LSB
+
MSB

5

5

0xXX

0xXX

0xXX

0xXX

0xFA

0xFB

11

Fail toexecutetagcustomisedcommandSome special tag
functions areenabled, but fail to
execute somecommands.

Host delivered G2
tag inventory
This frame command, tag
contains
inventory wasstatistic
completeddata
successfully andpacketreader is now
delivering statistic
data packet.
In real timeinventory mode,This frame no tag is detectedcontains
within theheartbeat heartbeat packet
packettime break, reader
will upload
heartbeat data.
Antenna
Antennaconnection connection error
check
detected before
failuretag operation.
Fail toCommandexecuteexecution error.
command
Tags are detected
within the effective
field, but failed tocomplete the
Operation
operation due tofailedpoor
communication
between reader
and tags.
No
No operatable tag
operatable is detected in thetags
effective range.

UHF RFID Reader UHFReader288MP User Manual v1.14

6

5

5

5

0xXX

0xXX

0xXX

0xXX

0xXX

0xXX

0x00

0xXX

0xFC

0xFD

0xFE

0xFF

Err_cod
e

LSB
+
MSB

Error code
returnedfrom tags

N/A

LSB
+
MSB

Commandlength
error

N/A

LSB
+
MSB

Illegalcommand

N/A

LSB
+
MSB

Parameter
error

12

RFID tag reported
an error to reader,reader will present
this code in the"Err_code" field in
the response.
Host delivered acommand framewith incorrectframe length
Host delivered aincorrect
command frame,e.g. unrecognisedcommand code or
a command framewith CRC error(failed to pass
CRC16 check)
Host delivered
unrecognised
parameters in acommand frame.

UHF RFID Reader UHFReader288MP User Manual v1.14

6 RFID tag error code
EPC C1G2（ISO18000 -6C）RFID tag error code
Error code
Error
Error code definition
Error description
type
code
Specified
0x00
All other errors supported
Other errors
error codeby the tag.
0x03
Memory location is not
Memory full, or illegal PC
found or unsupported PC
value
value.
0x04
Memoryisbeing
temporarily / permanently
Memory locked
locked, unable to performwrite operation.
0x0b
Unable to perform write
operationduetoInsufficient power supply
insufficient power supply
to tag.
Non-specified
0x0f
Tag unsupported errors.
Undefined error
error code

7 Tag memory and access instructions
A. EPC C1G2 tags (G2 tags)
There are 4 memory areas in a G2 tags, reserved memory (also known as password
memory), EPC memory, EID memory and user memory.
Reserved memory: 4 bytes, the first 2 bytes are the kill tag password, and the other 2
bytes are the access password. This memory is readable and writeable by default. The
read/write protection configurations of the two password blocks are isolated, they can be
modified separately.
EPC memory: the EPC number of tag is stored in this memory. Word0 is CRC16 of PC
value and EPC number. Word1 is PC value, indicates the length of EPC number. Actual
EPC number stars from Word2. This memory is readable and writable by default.
TID memory: the inlay manufacturer predefined tag ID is stored in this memory. It isreadable by default but unwritable.
User memory: user data is stored in this memory. It is readable and writable by default.

13

UHF RFID Reader UHFReader288MP User Manual v1.14

NOTE:• Data length is required in many G2 commands, the unit of data length is either word orbyte. The length of 1 word is equal to length of 2 bytes.
•

Some commands may require access password, if access password is not setup in thetarget tag, fill the password field with 0. The password field cannot be empty.

8 Command detail description
8.1

Overview

There are 2 types of commands:• protocol related commands;• reader related commands;
If an incorrect command frame is delivered from host, e.g. unrecognised command code orcommand frame with CRC error (failed to pass CRC16 check). A similar frame as shown
below will be responded from reader.
Len
Adr
reCmd Status
CRC-16
0x05
0xXX
0x00
0xFE
LSB
0x05
For incorrect command frame length, the response will be similar to the following frame,
Len
Adr
reCmd Status
CRC-16
0x05
0xXX
0xXX
0xFD
LSB
MSB
There are 2 situations which commands will be ignored by reader:• Incorrect address (neither broadcasting address 0xff, nor corresponding reader
address)• Incomplete command frame, i.e. the actual command frame length is less than thevalue indicated in the "Len" field
Reader will not provide any response for the situations stated above.

8.2

EPC C1G2 commands

8.2.1

Tags inventory

Inventory command is used for inquire RFID tags with corresponding protocol and obtain
tag information within the effective field. In order to process further operation on a new tagwith unknown EPC, user should firstly obtain tag EPC number by using inventorycommand.
14

UHF RFID Reader UHFReader288MP User Manual v1.14

According to different circumstances, user can modify the setting of maximum operation
time (inventory time). Reader will return an inventory result within the predefined inventory
time. If the reader fails to complete inventory processes for all the tags in the effective fieldwithin the predefined inventory time, the reader will not perform further inventory after
inventory time is exceed. Reader will report all the already inquired tags information, as wellas the current (uncompleted) inventory status to host. Reader will then wait for the next
command from host.
Default inventory time is 2s, it can be modified by using reader customised command"modify reader inventory time" (refer to chapter 8.4.4). The valid range of inventory time isfrom 3*100ms to 255*100ms (the actual responding time may slightly larger than the setting
value and this difference will varies from 0 up to 75ms).
Note: an unreasonable short inventory time setting may cause tag inventory failure.
Command frame:
Len
Adr
Cmd

Data[]

0xXX

——

0xXX

0x01

CRC-16LSB

MSBParameters of Data[]:
Data[]
QValu
e

Session

MaskMem

MaskAdr

MaskLen

MaskData

AdrTID

LenTI
D

0xXX

0xXX

0xXX

2 bytes

0xXX

Variable

0xXX

0xXX

Target0xXX

Data[]Ant
0xXX

Scantime
0xXX

Parameters definition
QValue: 1 byte.
bit7: Statistic data packet flag.
0 – after inventory，DO NOT deliver statistic data packet of inventory process;1 – after inventory，deliver statistic data packet of inventory process
bit6: strategy indicator.
0 – general strategy;
1 – special strategy.
bit5: FastID inventory indicator.
0 – disable Impinj FastID function;
1 – enable Impinj FastID function.
bit4 ~ bit0: the original Q-value of the EPC tag inventory, the setting of Q-value should
follow the rule: 2Q ≈ total amount of tags within the effective field. The range of
Q-value is 0 ~ 15, if other value is delivered in this field, reader will return a15

UHF RFID Reader UHFReader288MP User Manual v1.14

parameter error status in the response frame.
Session: 1 byte, the Session-value of the EPC tag inventory.
0x00 – apply S0 as Session value;
0x01 – apply S1 as Session value;
0x02 – apply S2 as Session value;
0x03 – apply S3 as Session value;
0xff – apply reader smart configuration (only valid in EPC inventory).
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
AdrTID: entry address of inventory TID memory. If command delivered this parameter and
LenTID at the same frame, the mode of inventory should be TID, not EPC.
LenTID: data length for TID inventory operation, the valid range of LenTID is 0 ~ 15.
All other values are reserved, and reader will return a parameter error status in the
response frame if other value is delivered in this field. If command delivered this parameterand AdrTID, the mode of inventory should be TID, not EPC.
Target (optional parameter): 1 byte, the Target value of EPC tag inventory.
0x00 – apply A as Target value;
0x01 – apply B as Target value.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Ant (optional parameter): 1 byte, antenna selection for the current inventory.
0x80 – antenna 1;0x81 – antenna 2;0x82 – antenna 3;0x83 – antenna 4.
All other values are reserved, and reader will return a parameter error status in the16UHF RFID Reader UHFReader288MP User Manual v1.14

response frame if other value is delivered in this field.
ScanTime (optional parameter): 1 byte, the inventory time configuration for the current
inventory. Reader will set the maximum operation time as ScanTime*100ms.
NOTE:
1. When MaskMem, MaskAdr, MaskLen and MaskData are not provided, no mask pattern
will be involved in inventory
2. Target, Ant and ScanTime are optional parameters, all three parameters must be
delivered in one command frame. Reader will apply default setting for these parameter,
until all three parameters setting are being properly deliver from host, the new settings willthen become effective for following inventory.
3. FastID function only valid on FastID supported inlay from Impinj.
(1) Response status is 0x26, the response should be as following:
Len

Adr

0xXX 0xXX

reCmd Status
0x01

0x26

Data[]
Ant

ReadRate TotalCount

0xXX

2 bytes

4 bytes

CRC-16LSB MSB

Parameters definition
Status: the status of response, detail description is shown in the following table
StatusDescription
0x26
After inventory, deliver statistic data of the last inventory process
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,
this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
ReadRate: tag identification rate for the current inventory (time of successful identification /sec), a tag being indentified multiple times will also increase the time of successful
identification.
TotalCount: the total amount of tag detected in the current inventory, a tag being accessed
multiple times will also increase the total amount.
(2) Response status is not 0x26, the response should be as following:
Len

Adr

0xXX 0xXX

reCmd Status
0x01

0xXX

Data[]AntNum

EPC ID

CRC-160xXX 0xXX EPC-1, EPC-2, EPC-3… LSB MSBParameters definition
Status: the status of response, detail description is shown in the following table
17

UHF RFID Reader UHFReader288MP User Manual v1.14

Status
0x01
0x02
0x03
0x04
0xF8

Description
Operation completed, reader will report all inquired tags information
to hostInventory timeout, operation is aborted. reader will report all thealready inquired tags to hostFor status = 0x03, reader is not able to response all the data in asingle frame, further data will be transmitted in the following frames.
Reader only completed parts of the inventory but run out of memory
space due to the amount of tags. Reader will report all the alreadyinquired tags as well as this status value to host.
Antenna error detected, the current antenna might be disconnected.

Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,
this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
Num: the amount of RFID EPC/TID included in this response.
EPC ID: inquired EPC/TID data. For instance, EPC-1 is the EPC/TID length + EPC
number/TID data + RSSI value of the first tag etc. The RSSI and EPC length values are one
byte parameters. The unit of EPC C1 G2 data is word. During communication, themost-significant word and the most-significant byte in a word will be transmitted first.
In the situation when FastID function is enabled, every EPC ID data block follows thisformat:Total length of EPC plus TID (1 byte) + tag EPC number + 12 bytes TID data + tag RSSIvalue
The most-significant bit of total length of EPC and TID indicates whether TID is included inthis block.
Detail structure of EPC ID
EPC ID
EPC-1
EPC-2
…
Data length
Data
RSSI Data length
Data
RSSI
1 byteN byte1
1 byteN byte
1
byte
byte
bit7:
0 – data block contains EPC
or TID;
1 – data block contains EPC
plus TID (FastID enabled).
bit 6 ~ bit 0: length of dataN
NOTE: FastID function only valid on FastID supported inlay from Impinj.

18

UHF RFID Reader UHFReader288MP User Manual v1.14

8.2.2

Read data

The function of this command is to read data from reserved memory, EPC memory, TID
memory, user memory of tag. Read operation starts from a defined address. The unit ofdata is word.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x02——

CRC-16LSB

MSBParameters of Data[]:
Data[]
ENum
0xXX

EPC

Mem WordPtr

variable 0xXX

0xXX

Num

Pwd

0xXX

4
bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number, and the length value must be an integer. The unit of EPC number is word. Duringcommunication, the most-significant word and the most-significant byte in a word will betransmitted first. It is essential to provide FULL EPC in this command.
Mem: 1 byte, the type of target memory.
0x00 – reserved memory
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved. Reader will return a parameter error status in the response
frame if other value is delivered in this field.
WordPtr: 1 byte, the initial word address of target. For instance, 0x00 represent the read
operation starts from 1st word (the first 16-bit memory area), 0x01 represents operation
19

UHF RFID Reader UHFReader288MP User Manual v1.14

starts from the 2nd word, etc.
Num: 1 byte, the amount of words will be read in this operation. Hence 0x00 is not a valid
value for this parameter. Furthermore the value of Num should not exceed 120, i.e. themaximum reading amount is 120 words. Reader will return a parameter error status in the
response frame if a 0 or a larger than 120 value is delivered in this field.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password will only be usedfor verification during reserved memory reading operation, when the associated target
memory is password protected and the tag access password is non-zero. Otherwise Psw
should be set to all-zero or set to the correct access password.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len
Adr
0xXX
0xXX

reCmd Status
0x02
0x00

Data[]
Word1，Word2,…

CRC-16
LSB 0xXXParameters definition
Word1, Word2...: the unit of data in this field is word. Every word contains 2 bytes,
most-significant byte first. Word1 is the 1st word from the starting address and the 2nd word
is Word 2 etc.

20

UHF RFID Reader UHFReader288MP User Manual v1.14

8.2.3

Write data

The function of this command is to write multiple words to reserved memory, TID memory
or user memory in one communication cycle.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

CRC-16

0x03

——

LSB

MSB

Parameters of Data[]:
Data[]
WNum

ENum

EPC

Mem

WordPtr

Wdt

0xXX

0xXX

variable

0xXX

0xXX

variablePwd
4 bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
WNum: the amount of words to be written. Every word contains 2 bytes. The value of
WNum must be larger than 0, and less or equal to 32, as well as identical to the actual
amount of word to be written. Reader will return a parameter error status in the response
frame if a 0 or an incorrect value of WNum is delivered in this field.
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Mem: 1 byte, the type of target memory.
0x00 – reserved memory
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved. Reader will return a parameter error status in the response
frame if other value is delivered in this field.

21

UHF RFID Reader UHFReader288MP User Manual v1.14

WordPtr: 1 byte, the initial word address of target.
Wdt: words to be written to tag memory. The amount of words in Wdt must be identical tothe value of WNum. The most-significant byte comes first in a word. Words will be written to
tag from lower address to higher address according to the order in Data[]. For instance,
WordPtr is 0x02, the 1st word in Data[](from left to right) will be written to the address 0x02
in the memory specified by Mem, the 2nd word will then be written to 0x03 etc.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password must be properly
provided and will be verified before write operations. If target memory is not password
protected, Pwd can be set to all-zero.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len
Adr
reCmd
0x05
0xXX
0x03

8.2.4

Status0x00

Data[]——

CRC-16LSB
MSB

Write EPC number

The function of this command is to write EPC number to a tag. During this write EPC
operation, only one tag is allowed to be place in the antenna effective area.
Command frame:22

UHF RFID Reader UHFReader288MP User Manual v1.14

Len

Adr

Cmd

0xXX

0xXX

0x04

Data[]
Pwd
4 bytes

ENum
0xXX

CRC-16

WEPC
variable

LSB

MSB

Parameters definition
ENum: 1 byte, the length of EPC number. The unit of ENum is word, and the length of EPC
can be 0, but it should be less than 15 words. Reader will return a parameter error status in
the response frame if other value is delivered in this field.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password will only be usedfor verification during reserved memory reading operation, when the associated target
memory is password protected and the tag access password is non-zero. Otherwise Psw
should be set to all-zero or set to the correct access password.
WEPC: the EPC number to be written to tag. The amount of words in WEPC must be
identical to the value of ENum. The minimum and maximum length of WEPC is 1 and 31.
Reader will return a parameter error status in the response frame if data with inappropriate
length is delivered in this field.
Response frame:
Len
Adr reCmd
0x05
0xXX 0x04

8.2.5

Status0x00

Data[]——

CRC-16LSB
MSB

Kill tag

The function of this command is to kill tags. After the kill operation, the tags will no longer
process any command from reader.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x05——

CRC-16LSB

MSBParameters of Data[]:
Data[]
ENum
0xXX

EPC

Killpwd MaskMem MaskAdr MaskLen MaskData

variable 4 bytes

0xXX

2 bytesParameters definition
ENum:
23

0xXX

variableUHF RFID Reader UHFReader288MP User Manual v1.14

0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Killpwd: 4 bytes, it is the 4 bytes kill password of a tag. From left to right, the first two bytes
are the high bytes of kill password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit kill password is the most-significant bit in the 1st byte of
Killpwd (from left to right). Likewise, the least-significant bit of a tag 32-bit kill password is
the least-significant bit in the 4th (last) byte of Killpwd. In order to kill a tag, the kill passwordof this tag must be non-zero. It is not possible to kill a tag with zero kill password, hence
reader will return a parameter error status in the response frame if all-zero are delivered inthis field.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len
Adr reCmd
0x05
0xXX 0x05

Status0x00

Data[]——

24

CRC-16LSB
MSBUHF RFID Reader UHFReader288MP User Manual v1.14

8.2.6

Set read/write protection for specific memory

The function of this command is to set the read/write protection status for the following
memory• Reserved memory
Readable/writablewithout
protection,
permanently
readable/writable,readable/writeable with password protected or permanently unreadable/ un-writable;• EPC memory /user reserved memory
Writable without protection, permanently writable, writeable with password protected or
permanently un-writable;
EPC memory, user reserved memory and TID memory are permanently readable.
Furthermore TID memory is readable only.
Once the protection status of reserved memory is set to permanently readable/ writable orpermanently unreadable/ un-writable, the status configuration will not able to accept any
future modification. Likewise, if the protection status of EPC memory, user reserved
memory or TID memory is set to permanently writable/ un-writable, the status configuration
will not able to accept any future modification. Tag will return an error status in the response
frame if user attempted to perform future modification.
Access password must be provided to set a specific memory to password protectedreadable/writable, or change the status from password protected to no protection. Hence, itis essential to ensure access password is already setup for the RFID tag before thisoperation.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x06——

CRC-16LSB

MSBParameters of Data[]:
ENu
m

EPC

Selec
t

SetProtec
t

0xXX

variabl
e

0xXX

0xXX

Data[]
MaskMe
Pwd
m
4
byte
0xXX
s

MaskAdr

MaskLen

MaskData

2 bytes

0xXX

variable

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
25

UHF RFID Reader UHFReader288MP User Manual v1.14

Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Select: 1 byte.
0x00 – modify kill password read/write protection;
0x01 – modify access password read/write protection;
0x02 – modify EPC memory read/write protection;
0x03 – modify TID memory read/write protection;
0x04 – modify user memory read/write protection.
All other values are reserved, reader will not execute the command and will return aparameter error status in the response frame if other value is delivered in this field.
SetProtect: the value of SetProtect depends on the value of Select.
• For Select = 0x00 or 0x01, i.e. the kill password or access password protection setting,the value of SetProtect can be the following,
0x00 – set to readable/ writable without protection;
0x01 – set to permanently readable/ writable;
0x02 – set to readable/writeable with password protected;
0x03 – set to permanently unreadable/ un-writable.
• For Select = 0x02, 0x03, 0x04, i.e. the EPC, TID and user memory protection setting,the value of SetProtect can be the following,
0x00 – set to writable without protection;
0x01 – set to permanently writable;
0x02 – set to writeable with password protected;
0x03 – set to permanently un-writable.
All other values of Select and SetProtect are reserved, reader will not execute thecommand and will return a parameter error status in the response frame if other value isdelivered in this field.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. A correct access password must be
provided to start the operation.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
26

UHF RFID Reader UHFReader288MP User Manual v1.14

All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len

Adr

0x05

0xXX

8.2.7

reCm
d
0x06

StatusData[]

0x00——

CRC-16LSB

MSB

Block erase

The function of this command is to erase multiple words in reserved, EPC, TID or user
memory.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x07——

CRC-16LSB

MSBParameters of Data[]:
Data[]
ENum
0xXX

EPC

Mem WordPtr

variable 0xXX

0xXX

Num

Pwd

0xXX

4
bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
27

UHF RFID Reader UHFReader288MP User Manual v1.14

0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Mem: 1 byte, the type of target memory.
0x00 – reserved memory
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved. Reader will return a parameter error status in the response
frame if other value is delivered in this field.
WordPtr: 1 byte, the initial word address of target. For instance, 0x01 represents erase
operation starts from the 2nd word (the second 16-bit memory area), etc. For EPC memory
erase operation, the minimum value of WordPtr should be 0x01. Reader will return aparameter error status in the response frame if inappropriate value is delivered in this field.
Num: 1 byte, the amount of words to be erased in this operation. Erase will start from theaddres stated in WordPtr and will erase amount of words stated in Num. 0x00 is not a valid
value for this parameter. Reader will return a parameter error status in the response frame
if a 0 or a larger than 120 value is delivered in this field.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password will only be usedfor verification if the associated memory is password protected. Psw should be set toall-zero or set to the correct access password.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.

28

UHF RFID Reader UHFReader288MP User Manual v1.14

MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len

Adr

0x05

0xXX

8.2.8

reCm
d
0x07

StatusData[]

0x00——

CRC-16LSB

MSB

Read protection configuration (according to EPC number)

The function of this command is to setup read protection for a tag with particular EPC
number; hence the tag will be unreadable by device. Device will not able to inquire EPC
number of this tag via inventory operation. This command only valid for NXP UCODE EPC
G2X tags.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x08——

CRC-16LSB

MSBParameters of Data[]:
Data[]
ENum
0xXX

EPC

Pwd

variable 4 bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
29

UHF RFID Reader UHFReader288MP User Manual v1.14

FULL EPC in this command.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. It is not possible to setup the readprotection status if the tag has all-zero access password, hence reader will return aparameter error status in the response frame if zeros or incorrect access password aredelivered in this field.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len

Adr

0x05

0xXX

8.2.9

reCm
d
0x08

StatusData[]

0x00——

CRC-16LSB

MSB

Read protection configuration (Without EPC number)

The function of this command is to setup read protection for tags within the effective field.
Unlike the pervious command in chapter 8.2.8, this command will perform operation on
multiple inquired tags without tag identification. In order to perform operation on multiple
tags, it is vital to keep access password consistent on those tags. This command only valid
for NXP UCODE EPC G2X tags.
Command frame:
Len
Adr
Cmd

Data[]

CRC-1630

UHF RFID Reader UHFReader288MP User Manual v1.14

0x08

0xXX

0x09

Pwd
4Byte

LSB

MSB

Parameter definition
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. It is not possible to setup the readprotection status if the tag has all-zero access password, hence reader will return aparameter error status in the response frame if zeros or incorrect access password aredelivered in this field.
Response frame:
Len

Adr

0x05

0xXX

reCm
d
0x09

StatusData[]

0x00——

CRC-16LSB

MSB

8.2.10 Unlock read protection
The function of this command is to unlock read protection of a tag. Only one tag is allowed
to be place in the antenna effective area. This command only valid for NXP UCODE EPC
G2X tags.
Command frame:
Len

Adr

Cmd

0x08

0xXX

0x0a

Data[]
Pwd
4Byte

CRC-16LSB

MSBParameter definition
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. It is essential to provide a correctaccess password in this command, reader will return a parameter error status in the
response frame if incorrect access password is delivered in this field.
Response frame:
Len

Adr

reCm
d
0x0a

StatusData[]

CRC-16

0x05
0xXX
0x00
——
LSB
MSB
NOTE:
For tags with no read protection function, the default status will be unlocked.
31

UHF RFID Reader UHFReader288MP User Manual v1.14

8.2.11 Read protection status check
This command is NOT ABLE TO identify if a specific tag supports the read protection
function, the command ONLY inquire the read protection status of the tag. For tags with noread protection function, the default status will be unlocked. Only one tag is allowed to beplace in the antenna effective area. This command only valid for NXP UCODE EPC G2X
tags.
Command frame:
Len
Adr
Cmd
0x04 0xXX 0x0b

Data[]——

CRC-16LSB
MSB

Response frame:
Len

Adr

0x06

0xXX

reCm
d
0x0b

StatusData[]

CRC-160x00

ReadProLSB

MSBParameter definition
ReadPro: 0x00 – read protection is disabled for the tag;
0x01 – read protection is enabled for the tag.
For tags with no read protection function, the default status will be unlocked.

8.2.12 EAS configuration
The function of this command is to modify or reset EAS status. This command only valid for
NXP UCODE EPC G2 tags.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x0c——

CRC-16LSB

MSBParameters of Data[]:
Data[]
ENum
0xXX

EPC

Pwd

EAS

variable 4 bytes 0xXX

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
32

UHF RFID Reader UHFReader288MP User Manual v1.14

Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. It is not possible to setup EAS if the
tag has all-zero access password, hence reader will return a parameter error status in the
response frame if zeros or incorrect access password are delivered in this field.
EAS: 1 byte.
bit0 = 0, EAS alert is disabled;
bit0 = 1, EAS alert is enabled.
bit1 ~ bit7 are reserved, with 0 as default value.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len

Adr

0xXX

0xXX

reCm
d
0x0c

StatusData[]

0x00

——

33

CRC-16LSB

MSBUHF RFID Reader UHFReader288MP User Manual v1.14

8.2.13 EAS alert detection
The function of this command is to detect EAS alert, only valid for NXP UCODE EPC G2
tags.
Command frame:
Len
Adr
Cmd
0x04 0xXX 0x0d

Data[]——

CRC-16LSB
MSB

Response frame:
reCm
StatusData[]
CRC-16d
0x05
0xXX 0x0d
0x00
——
LSB
MSB
Return "no operatable tag" if EAS alert is not detected.
Len

Adr

8.2.14 Single tag inventory
Command frame:
Len
Adr
0x04

0xXX

Cmd

Data[]

0x0f——

CRC-16LSB

MSB

Response frame:
Data[]

Adr

reCm
d

Statu
s

Ant

Num

EPC ID

0xXX 0xXX

0x0f

0x01

0xXX

0x01

EPC-1

Len

CRC-16LSB

MSBParameters definition
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,
this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
Num: 0x01 (constant)
EPC ID: inquired tag EPC data. For instance, EPC-1 is the EPC length + EPC number +RSSI value of the first tag etc. The RSSI and EPC length values are one byte parameters.
The unit of EPC C1 G2 data is word. During communication, the most-significant word andthe most-significant byte in a word will be transmitted first.

8.2.15 Block writing command
The function of this command is to write multiple words to reserved memory, EPC, TID and
34

UHF RFID Reader UHFReader288MP User Manual v1.14

user memory.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

CRC-16

0x10

——

LSB

MSB

Parameters of Data[]:
Data[]
WNum

ENum

EPC

Mem

WordPtr

Wdt

0xXX

0xXX

variable

0xXX

0xXX

variablePwd
4 bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
WNum: the amount of words to be written. Every word contains 2 bytes. The value of
WNum must be larger than 0, as well as identical to the actual amount of words to be
written. Reader will return a parameter error status in the response frame if a 0 or an
incorrect value of WNum is delivered in this field.
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value is deliveredin this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Mem: 1 byte, the type of target memory.
0x00 – reserved memory
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved. Reader will return a parameter error status in the response
frame if other value is delivered in this field.
WordPtr: 1 byte, the initial word address address of target.
35

UHF RFID Reader UHFReader288MP User Manual v1.14

Wdt: words to be written to tag memory. The amount of words in Wdt must be identical tothe value of WNum. The most-significant byte comes first in a word. Words will be written to
tag from lower address to higher address according to the order in Data[]. For instance,
WordPtr is 0x02, the 1st word in Data[](from left to right) will be written to the address 0x02
in the memory specified by Mem, the 2nd word will then be written to 0x03 etc.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password must be properly
provided and will be verified before the write operation. If target memory is not password
protected, Pwd can be set to all-zero.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len
Adr
reCmd
0x05
0xXX
0x10

Status0x00

Data[]——

CRC-16LSB
MSB

8.2.16 Obtain Monza4QT working parameters
This command is used to obtain the current working parameters of a tag, only valid for
Monza 4QT tags from Impinj.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x11——

CRC-16LSB
36MSBUHF RFID Reader UHFReader288MP User Manual v1.14

Parameters of Data[]:
ENum
0xXX

EPC

Pwd

variable 4 bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value is deliveredin this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password must be properly
provided in the command.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:37

UHF RFID Reader UHFReader288MP User Manual v1.14

Len

Adr

reCm
d

Status

0x07

0xXX

0x11

0x00

Data[]
NC
0x00

CRC-16

QTcontrol
1Byte

LSB

MSB

Parameter definition
QTcontrol: Working parameters of tag.
bit0: The current mirror page setting.
0 – private;
1 – public.
bit1: distance protection setting.
0 – disabled;
1 – enabled.
All other values are reserved.

8.2.17 Modify Monza4QT working parameters
The function of this command is to modify the current working parameters of a tag, only valid
for Monza 4QT tags from Impinj.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x12——

CRC-16LSB

MSBParameters of Data[]:
ENum

EPC

0xXX

variable

QTcontrol1 QTcontrol0
0x00

0xXX

Pwd
4
bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameter definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
QTcontrol1: 0x00 (Constnat), reserved.
38

UHF RFID Reader UHFReader288MP User Manual v1.14

QTcontrol0: working parameters of tag.
bit0: the current mirror page setting.
0 – private;
1 – public.
bit1: distance protection setting.
0 – disabled;
1 – enabled.
All other values are reserved.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password must be properly
provided in the command.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len

Adr

0x05

0xXX

reCm
d
0x12

StatusData[]

0x00——

CRC-16LSB

MSB

8.2.18 Extended data reading with assigned mask
The function of this command is to read data from reserved memory, EPC memory, TID
memory, user memory of tag. Read operation starts from a defined address, and the unit ofdata is word.
39

UHF RFID Reader UHFReader288MP User Manual v1.14

Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x15——

CRC-16LSB

MSBParameters of Data[]:
Data[]
ENum
0xXX

EPC

Mem WordPtr

variable 0xXX

2 bytes

Num

Pwd

0xXX

4
bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Mem: 1 byte, the type of target memory.
0x00 – reserved memory
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved. Reader will return a parameter error status in the response
frame if other value is delivered in this field.
WordPtr: 2 bytes, the initial word address of target. For instance, 0x0000 represent theread operation starts from 1st word (the first 16-bit memory area), 0x0001 represents
operation starts from the 2nd word, etc.
Num: 1 byte, the amount of words to be read in this operation, hence 0x00 is not a valid
value for this parameter. Furthermore the value of Num should not exceed 120, i.e. themaximum reading amount is 120 words. Reader will return a parameter error status in the
response frame if a 0 or a larger than 120 value is delivered in this field.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byte40

UHF RFID Reader UHFReader288MP User Manual v1.14

of Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password will only be usedfor verification during reserved memory reading operation, when the associated target
memory is password protected and the tag access password is non-zero. Otherwise Psw
should be set to all-zero or set to the correct access password.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len
Adr
0xXX
0xXX

reCmd Status
0x15
0x00

Data[]
Word1，Word2,…

CRC-16LSB MSB

Parameter definition
Word1, Word2...: the unit of this field is word. Every word contains 2 bytes, most-significant
byte first. Word1 is the 1st word from the starting address and the 2nd word is Word 2 etc.

8.2.19 Extended data reading with assigned mask
The function of this command is to write multiple words to reserved memory, TID memory
or user memory in one communication cycle.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x16——

CRC-16LSB

Parameters of Data[]:
Data[]

41

MSB

UHF RFID Reader UHFReader288MP User Manual v1.14

WNum

ENum

EPC

Mem

WordPtr

Wdt

0xXX

0xXX

variable

0xXX

2 bytesvariablePwd
4 bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameter definition
WNum: the amount of words to be written. Every word contains 2 bytes. The value of
WNum must be larger than 0 and less or equal to 32, as well as identical to the actual
amount of words to be written. Reader will return a parameter error status in the response
frame if a 0 or an incorrect value of WNum is delivered in this field.
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
WordPtr: 2 byte, most-significant byte first, the initial word address of target.
Wdt: words to be written to tag memory. The amount of words in Wdt must be identical tothe value of WNum. The most-significant byte comes first in a word. Words will be written to
tag from lower address to higher address according to the order in Data[]. For instance,
WordPtr is 0x02, the 1st word in Data[](from left to right) will be written to the address 0x02
in the memory specified by Mem, the 2nd word will then be written to 0x03 etc.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low byte. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password must be properly
42

UHF RFID Reader UHFReader288MP User Manual v1.14

provided and will be verified before the write operation. If target memory is not password
protected, Pwd can be set to all-zero.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Command frame:
Len
Adr
reCmd
0x05
0xXX
0x16

Status0x00

Data[]——

CRC-16LSB
MSB

8.2.20 Inventory with memory buffer
Inventory command is used for inquiring/identifying RFID tags, and stored the inquired tag
data into reader memory buffer.
The main distinction between Inventory with or without memory buffer (refer to Chapter
8.2.1) is by using the internal memory buffer, reader can continuously inquired tags during
the inventory time. At the end of every inventory time, reader will report the total amount oftags stored in the memory buffer (a tag being accessed multiple times will also increase theamount) as well as the amount of tags inquired in the current inventory. User can accessdata from the memory buffer via obtain tag data, obtain tag amount or clear memory buffer
commands.
Default inventory time is 2s, it can be modified by using reader customised command,"Modify reader inventory time"(refer to Chapter 8.4.4) or perform temporary configuration
via optional parameter in the inventory. The valid range of inventory time is from 3*100ms
to 255*100ms (the actual responding time may slightly larger than the setting value and thisdifference will varies from 0 up to 75ms).
NOTE
43

UHF RFID Reader UHFReader288MP User Manual v1.14••

An unreasonable short inventory time setting may causes tag inventory failure.
Buffer will be cleared if an "inventory without memory buffer" command is deliveredfrom host.

Command frame:
Len
Adr
Cmd

Data[]

0xXX

——

0xXX

0x18

CRC-16LSB

MSBParameters of Data[]:
Data[]
QValu
e

Session

MaskMem

MaskAdr

MaskLen

MaskData

AdrTID

LenTI
D

0xXX

0xXX

0xXX

2 bytes

0xXX

variable

0xXX

0xXX

Data[]
Target
0xXX

Ant
0xXX

Scantime
0xXX

Parameters definition
QValue: 1 byte.
bit7: reserved, set to 0.
bit6: strategy indicator.
0 – general strategy;
1 – special strategy.
bit5 ~ bit0: the original Q-value of the EPC tag inventory, the setting of Q-value should
follow the rule: 2Q ≈ total amount of tags within the effective field. The range of
Q-value is 0 ~ 15, if other value is delivered in this field, reader will return aparameter error status in the response frame.
Session: 1 byte, the Session-value of the EPC tag inventory.
0x00 – apply S0 as Session value;
0x01 – apply S1 as Session value;
0x02 – apply S2 as Session value;
0x03 – apply S3 as Session value;
0xff – apply reader smart configuration (only valid in EPC inventory).
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
44

UHF RFID Reader UHFReader288MP User Manual v1.14

All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
AdrTID: entry address of inventory TID memory. If command delivered this parameter and
LenTID at the same frame, the mode of inventory should be TID, not EPC.
LenTID: data length for TID inventory operation, the valid range of LenTID is 0 ~ 15.
All other values are reserved, and reader will return a parameter error status in the
response frame if other value is delivered in this field. If command delivered this parameterand AdrTID, the mode of inventory should be TID, not EPC.
Target (optional parameter): 1 byte, the Target value of EPC tag inventory.
0x00 – apply A as Target value;
0x01 – apply B as Target value.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Ant (optional parameter): 1 byte, antenna selection for the current inventory.
0x80 – antenna 1;0x81 – antenna 2;0x82 – antenna 3;0x83 – antenna 4.
ScanTime (optional parameter): 1 byte, the inventory time configuration for the current
inventory. Reader will set the maximum operation time as ScanTime*100ms.
NOTE:
1. When MaskMem, MaskAdr, MaskLen and MaskData are not provided, no mask pattern
will be involved in inventory
2. Target, Ant and ScanTime are optional parameters, all three parameters must be
delivered in one command frame. Reader will apply default setting for these parameters,
until all three parameters setting are being properly deliver from host, the new settings willthen become effective for following inventory.
Response frame:
Len

Adr

reCmd

StatusData[]
BufferCount
45

TagNum

CRC-16

UHF RFID Reader UHFReader288MP User Manual v1.14

0x09

0xXX

0x18

0x00

2 bytes

2 bytesLSB

MSB

Parameter definition
BufferCount: 2 bytes, the total amount of tag stored in the memory buffer, tags withidentical EPC/TID data will be treated as one tag. BufferCount is the sum of tag amountfrom multiple inventories, until the memory buffer is being cleared.
TagNum: 2 bytes, the amount of tag inquired in the current inventory, a tag being accessed
multiple times will also increase the amount.

8.2.21 Mix inventory
Inventory command is used for inquire RFID tags with corresponding protocol within theeffective field, and obtain specific tag information once the tag EPC number is inquired.
According to different circumstances, user can modify the setting of maximum operation
time (inventory time). Reader will return an inventory result within the predefined inventory
time. If the reader fails to complete inventory processes for all the tags in the effective fieldwithin the predefined inventory time, reader will not perform further inventory after inventory
time is exceed. Reader will report all the already inquired tags, as well as the current(uncompleted) inventory status to host. Reader will then wait for the next command fromhost.
Default inventory time is 2s, it can be modified by using reader customised command"modify reader inventory time" (refer to chapter 8.4.4). The valid range of inventory time isfrom 3*100ms to 255*100ms (the actual responding time may slightly larger than the setting
value and this difference will varies from 0 up to 75ms).
NOTE:
An unreasonable short inventory time setting may cause tag inventory failure.
Command frame:
Len
Adr
Cmd

Data[]

0xXX

——

0xXX

0x19

CRC-16LSB

MSBParameters of Data[]:
QValu
e

Session

MaskMemData[]
MaskAd
r

0xXX

0xXX

0xXX

2 bytes

MaskLen

MaskData

0xXX

variable

TargetAnt

Data[]
ReadMem ReadAdr ReadLen

Pwd

46

Scantime

UHF RFID Reader UHFReader288MP User Manual v1.14

0xXX

2 bytes

0xXX

4 bytes

0xXX

0xXX

0xXX

Parameters definition
QValue: 1 byte.
bit7: Statistic data packet flag.
0 – After inventory，DO NOT deliver statistic data packet of inventory process;
1 – After inventory，deliver statistic data packet of inventory process
bit6 ~ bit0: the original Q-value of the EPC tag inventory, the setting of Q-value should
follow the rule: 2Q ≈ total amount of tags within the effective field. The range of
Q-value is 0 ~ 15, if other value is delivered in this field, reader will return aparameter error status in the response frame.
Session: 1 byte, the Session-value of the EPC tag inventory.
0x00 – apply S0 as Session value;
0x01 – apply S1 as Session value;
0x02 – apply S2 as Session value;
0x03 – apply S3 as Session value;
0xff – apply reader smart configuration (only valid in EPC inventory).
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskMem (optional parameter): 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr (optional parameter): 2 bytes, entry bit address of the mask, the valid range of
MaskAdr is 0 ~ 16383.
MaskLen (optional parameter): 1 byte, bit length of mask (unit: bits).
MaskData (optional parameter): mask data. The length of MaskData equals to
MaskLen/8. If MaskLen is not a multiple of 8 integer, the length of MaskData is equal to theint[MaskLen/8]+1. Non-specified lower significant figures should be filled up with 0.
ReadAdr: 2 bytes, the entry address of target, most-significant byte first. For instance,
0x0000 represent the read operation starts from 1st word (the first 16-bit memory area),
0x0001 represents operation starts from the 2nd word, etc.
ReadLen: 1 byte, the amount of words to be read in this operation, the minimum length is 1
word and the maximum is 120 words. 0x00 is not a valid value for this parameter;
furthermore the value of Num should not exceed 120. Reader will return a parameter error
status in the response frame if a 0 or a larger than 120 value is delivered in this field.

47

UHF RFID Reader UHFReader288MP User Manual v1.14

Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Access password will only be usedfor verification during reserved memory reading operation, when the associated target
memory is password protected and the tag access password is non-zero. Otherwise Psw
should be set to all zero or set to the correct access password.
Target (optional parameter): 1 byte, the Target value of EPC tag inventory.
0x00 – apply A as Target value;
0x01 – apply B as Target value.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Ant (optional parameter): 1 byte, antenna selection for the current inventory.
0x80 – antenna 1;0x81 – antenna 2;0x82 – antenna 3;0x83 – antenna 4.
ScanTime (optional parameter): 1 byte, the inventory time configuration for the current
inventory. Reader will set the maximum operation time as ScanTime*100ms.
NOTE:
1. When MaskMem, MaskAdr, MaskLen and MaskData are not provided, no mask pattern
will be involved in inventory
2. Target, Ant and ScanTime are optional parameters, all three parameters must be
delivered in one command frame. Reader will apply default setting for these parameters,
until all three parameters setting are being properly deliver from host, the new settings willthen become effective for following inventory.
(1) Response status is 0x26, the response should be as following:
Len

Adr

0xXX 0xXX

reCmd Status
0x19

0xXX

Data[]
Ant

ReadRate TotalCount

0xXX

2 bytes

4 bytes

CRC-16LSB MSB

Parameters definition
Status: the status of response, detail description is shown in the following table
StatusDescription
0x26 After inventory, deliver statistic data of the current inventory process
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,48

UHF RFID Reader UHFReader288MP User Manual v1.14

this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
ReadRate: tag identification rate for the current inventory (time of successful identification /sec), a tag being indentified multiple times will also increase the time of successful
identification.
TotalCount: the total amount of tag detected in the current inventory, a tag being accessed
multiple times will also increase the total amount.
(2) Response status is not 0x26, the response should be as following:
Len

Adr

0xXX 0xXX

reCmd Status
0x19

0xXX

Data[]Ant

Num

0xXX 0xXX

Data Packet
Packet-1, Packet-2,
Packet-3…

CRC-16LSB MSB

Parameters definition
Status: the status of response, detail description is shown in the following table
StatusDescription
Operation completed, reader will report all inquired tags information
0x01
to hostInventory timeout, operation is aborted. reader will report all the
0x02
already inquired tags to host
Reader is not able to response all the data in a single frame, further
0x03
data will be transmitted in the following frames.
Reader only completed parts of the inventory but run out of memory
0x04 space due to the amount of tags. Reader will report all the alreadyinquired tags as well as this status value to host.
0xF8 Antenna error detected, the current antenna might be disconnected.
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,
this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
Num: the amount of tag information data packets included in this response.
Data Packet: inquired tag data, Packet-1 is data of the first packet, Packet-2 is data of thesecond packet etc. The format of a typical packet is shown below:
PacketPacketParam
Len
Data
RSSI
0xXX
0xXX
variable
0xXX
Parameters data packet:
PacketParam: 1 byte, parameters of this packet.
bit7: the type indicator of this data packet.
0 – this data packet contains tag EPC number;
49

UHF RFID Reader UHFReader288MP User Manual v1.14

1 – this data packet contains inquired tag data (the EPC number of this tag isdelivered in the last data packet).
bit6 ~ bit0: the serial number of the data packet. The range of the serial number is 0 ~ 127.
At the beginning of ever mix inventory, the packet serial number will restart from 0, andincrease for ever uploaded data packet. Once serial number reaches the maximum value
127, it will recount again from 0.
Len: 1 byte, the length of data in this packet.
Data: the EPC number or the inquired data from a specific area of a tag. The unit of EPC
C1 G2 tag data is word. During communication, the most-significant word and themost-significant byte in a word will be transmitted first.
RSSI: 1 byte, the reader signal strength at the time when the tag is inquired.
NOTE:
Data packet will be uploaded according to EPC inquired order. For every tag, reader will
firstly upload the tag EPC in the initial data packet, further tag data will be uploaded in thesecond data packet. These two packets will have sequential serial number.
In the case when reader fails to read data of a tag after uploaded the EPC packet, reader
will not upload any tag data packet. Reader will continue to inquire the next tag and restart
the normal mix inventory process.

8.2.22 Inventory with EPC number
The function of this command is to inquire tag with specific EPC. Reader will only response
data from the tag with corresponding EPC. All other tags with different EPC will be ignored.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x1a——

CRC-16LSB

MSBParameters of Data[]:
Data[]
MatchType

MatchLen

MatchOffset

EPCData

0xXX

2 bytes

2 bytesvariable

Parameter definition
MatchType: EPC number matching type.
0 – inquire tag with corresponding EPC;
1 – inquire all other tags with different EPC.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
50

UHF RFID Reader UHFReader288MP User Manual v1.14

MatchLen: 2 bytes, most-significant byte first, the bit length of the defined EPC number.
The range of MatchLen is 1 ~ 196 bits.
MatchOffset: 2 bytes, most-significant byte first. The entry address of the defined EPC(unit: bits). The range of MatchOffset is 0 ~ 495 bits.
NOTE:
The sum of MatchLen and MatchOffset should not exceed 496 bits. Reader will return aparameter error status in the response frame if incorrect value is delivered in this field.
EPCData: the defined EPC number data. The length of EPCData equals to MatchLen/8. If
MatchLen is not a multiple of 8 integer, the length of EPCData is equal to the int[MatchLen/8]+1. Non-specified lower significant figures should be filled up with 0.
Response frame:
Data[]

Adr

reCm
d

Statu
s

Ant

Num

EPC ID

0xXX 0xXX

0x1a

0xXX

0xXX

0xXX

EPC-1

Len

CRC-16LSB

MSBParameters definition
Status: the status of response, detail description is shown in the following table
StatusDescription
Operation completed, reader will report all inquired tags information
0x01
to hostInventory timeout, operation is aborted. reader will report all the
0x02
already inquired tags to host
Reader is not able to response all the data in a single frame, further
0x03
data will be transmitted in the following frames.
0xF8 Antenna error detected, the current antenna might be disconnected.
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,
this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
Num：the amount of tag EPC included in this response.
EPC ID: inquired EPC/TID data. For instance, EPC-1 is the EPC/TID length + EPC
number/TID data + RSSI value of the first tag etc. The RSSI and EPC length values are one
byte parameters. The unit of EPC C1 G2 data is word. During communication, themost-significant word and the most-significant byte in a word will be transmitted first.
51

UHF RFID Reader UHFReader288MP User Manual v1.14

8.2.23 QT inventory
This command is used to inquiry the private EPC number of a Monza4QT tag with public
mirroring. The command seeks RFID tags with corresponding protocol. In order to processfurther operation on a new tag with unknown EPC, user should firstly obtain tag EPC
number by using inventory command.
According to different circumstances, user can modify the setting of maximum operation
time (inventory time). Reader will return an inventory result within the predefined inventory
time. If the reader fails to complete inventory processes for all the tags in the effective fieldwithin the predefined inventory time, reader will not perform further inventory after inventory
time is exceed. Reader will report all the already inquired tags, as well as the current(uncompleted) inventory status to host. Reader will then wait for the next command fromhost.
Default inventory time is 1s, it can be modified by using reader customised command"modify reader inventory time" (refer to chapter 8.4.4). The valid range of inventory time isfrom 3*100ms to 255*100ms (the actual responding time may slightly larger than the setting
value and this difference will varies from 0 up to 75ms).
Note: an unreasonable short inventory time setting may cause tag inventory failure.

Command frame:
Len
Adr
0x0XX

0xXX

Cmd

Data[]

0x1b——

CRC-16LSB

MSBParameters of Data[]:
Data[]
QValu
e

SessionTargetAnt

Scantime

0xXX

0xXX

0xXX

0xXX

0xXX

Parameters definition
QValue: 1 byte.
bit7: Statistic data packet flag.
0 – After inventory，DO NOT deliver statistic data packet of inventory process;
1 – After inventory，deliver statistic data packet of inventory process
bit6 ~ bit0: the original Q-value of the EPC tag inventory, the setting of Q-value should
follow the rule: 2Q ≈ total amount of tags within the effective field. The range of
Q-value is 0 ~ 15, if other value is delivered in this field, reader will return a52UHF RFID Reader UHFReader288MP User Manual v1.14

parameter error status in the response frame.
Session: 1 byte, the Session-value of the EPC tag inventory.
0x00 – apply S0 as Session value;
0x01 – apply S1 as Session value;
0x02 – apply S2 as Session value;
0x03 – apply S3 as Session value;
0xff – apply reader smart configuration (only valid in EPC inventory).
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Target (optional parameter): 1 byte, the Target value of EPC tag inventory.
0x00 – apply A as Target value;
0x01 – apply B as Target value.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Ant (optional parameter): 1 byte, antenna selection for the current inventory.
0x80 – antenna 1;0x81 – antenna 2;0x82 – antenna 3;0x83 – antenna 4.
All other values are reserved, and reader will return a parameter error status in the
response frame if other value is delivered in this field.
ScanTime (optional parameter): 1 byte, the inventory time configuration for the current
inventory. Reader will set the maximum operation time as ScanTime*100ms.
NOTE:
1. Target, Ant and ScanTime are optional parameters, all three parameters must be
delivered in one command frame. Reader will apply default setting for these parameter,
until all three parameters setting are being properly deliver from host, the new settings willthen become effective for following inventory.
(1) Response status is 0x26, the response should be as following:
Len

Adr

0xXX 0xXX

reCmd Status
0x1b

0xXX

Data[]
Ant

ReadRate TotalCount

0xXX

2 bytes

4 bytes

CRC-16LSB MSB

Parameters definition
Status: the status of response, detail description is shown in the following table,
StatusDescription
0x26 After inventory, deliver statistic data of the last inventory process
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,53

UHF RFID Reader UHFReader288MP User Manual v1.14

this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
ReadRate: tag identification rate for the current inventory (time of successful identification /sec), a tag being indentified multiple times will also increase the time of successful
identification.
TotalCount: the total amount of tag detected in the current inventory, a tag being accessed
multiple times will also increase the total amount.
(2) Response status is not 0x26, the response should be as following:
Len

Adr

0xXX 0xXX

reCmd Status
0x1b

0xXX

Data[]AntNum

EPC ID

CRC-160xXX 0xXX EPC-1, EPC-2, EPC-3… LSB MSBParameters definition
Status: the status of response, detail description is shown in the following table,
StatusDescription
Operation completed, reader will report all inquired tags information
0x01
to hostInventory timeout, operation is aborted. reader will report all the
0x02
already inquired tags to host
Reader is not able to response all the data in a single frame, further
0x03
data will be transmitted in the following frames.
Reader only completed parts of the inventory but run out of memory
0x04 space due to the amount of tags. Reader will report all the alreadyinquired tags as well as this status value to host.
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,
this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
Num: the amount of EPC/TID included in this response.
EPC ID: inquired EPC/TID data. For instance, EPC-1 is the EPC/TID length + EPC
number/TID data + RSSI value of the first tag etc. The RSSI and EPC length values are
one byte parameters. The unit of EPC C1 G2 data is word. During communication, themost-significant word and the most-significant byte in a word will be transmitted first.

54

UHF RFID Reader UHFReader288MP User Manual v1.14

8.318000-6B Commands

8.3.1

Single tag inventory

The function of this command is to inquire a single tag. If multiple tags are placed within theeffective field, reader may fail to inquire any tag.
Command frame:
Len
Adr
0x04

0xXX

Cmd

CRC-16

0x50

LSB

MSB

Response frame:
Len

Adr

reCm
d

Status

0x10

0xXX

0x50

0x00

Data[]

CRC-16

Ant

ID

0Xxx

10 bytes

LSB

MSB

Parameters definition
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,
this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
ID: 10 bytes, the 1st byte is the length of UID, 0x08. The 2nd ~ 9th byte is the tag UID
number, least-significant byte first. The 10th byte is RSSI.

8.3.2

Inquire tags according specified condition

The function of this command is to inquire tags according to specified condition.
Command frame:
Len

Adr

Cmd

0x0f

0xXX

0x51

Condition
0xXX

Data[]
Address Mask
0xXX

0xXX

Parameters definition
Condition: the condition for inventory;
0x00 – equal to the reference;
0x01 – no equal to the reference;
0x02 – larger than the reference
0x03 – smaller than the reference
Address: address of the comparing data55

Word_data
8 bytes

CRC-16LSB

MSBUHF RFID Reader UHFReader288MP User Manual v1.14

Mask: mask, specify the data for comparison.
Word_data: the value of reference. Every bit in mask is corresponds to a byte in
Word_data. The most-significant bit (bit7) corresponds to the 1st byte in Word_data (fromleft to right). Consequently, the least- significant bit (bit0) corresponds to the last byte in
Word_data (from left to right). Word_data is the reference data for comparison with data in
tag starts from the location stated in Address. The 1st byte of Word_data will be comparewith the data store in Address, the last byte of Word_data will be compare with the datastore in Address+7. Set the byte corresponding bit of Mask to 1, reader will perform
comparison on that particular byte. Set the bit to 0, no comparison will be performed on thatparticular byte.
Response frame:
Len

Adr

0xXX

0xXX

reCm
d
0x51

Status
0xXX

Ant
0xXX

Num

Data[]

0xXX

UID1, UID2…

CRC-16LSB

MSBParameters definition
Status: the status of response, detail description is shown in the following table
StatusDescription
Operation completed, reader will report all inquired tags information to
0x15
host.
Inventory timeout, operation is aborted. Reader will report all the
0x16
already inquired tags to host.
Reader is not able to response all the data in a single frame, further
0x17
data will be transmitted in the following frames.
Reader only completed parts of the inventory but run out of memory
0x18 space due to the amount of tags. Reader will report all the alreadyinquired tags as well as this status value to host..
0xF8 Antenna error detected, the current antenna might be disconnected.
Ant: indicates which antenna had inquired a tag. For example, 0x04 is 0000 0100 in binary,
this indicates Antenna 3 had inquired this specific tag. For 0x08, it is 0000 1000 in binary,then it indicates Antenna 4 had inquired tag information.
Num: the amount of UID included in this response.
Data[]: UID of the tag. The length of every UID data block is 10 bytes. The 1st byte is thelength value of UID number, i.e. 0x08. The 2nd ~ 9th bytes are the tag UID number,least-significant byte first. The 10th byte is the RSSI value. For Num = 0, i.e. no UID data isprovided, Data[] is empty.

8.3.3

Reader data

The function of this command is to read multiple bytes from a specific address.
56

UHF RFID Reader UHFReader288MP User Manual v1.14

Command frame:
Len

Adr

Cmd

0x0e

0xXX

0x52

Address

Data[]
ID

Num

0xXX

8 bytes

0xXX

CRC-16LSB

MSBParameters definition
Address: the entry address of target. The valid value range of Address is 0 ~ 223. Reader
will return a parameter error status in the response frame if incorrect address is delivered.
Num: the amount of words will be read in this operation. The valid value range of Num is 1
~ 32. If the sum of Address and Num is larger than 224, Num is equal to 0 or larger than 32,
return a parameter error status in the response frame.
ID: the ID of the target tag, 8 bytes, least significant byte first.
Response frame:
Len

Adr

0xXX

0xXX

reCm
d
0x52

StatusData[]

0x00

Data

CRC-16LSB

MSBParameter definition
Data: inquired data from tag, least-significant byte first.

8.3.4

Write data

The function of this command is to write multiple bytes to a specific tag.
Command frame:
Len

Adr

Cmd

0xXX

0xXX

0x53

Address

Data[]
ID

Wdata

0xXX

8 bytesvariable

CRC-16LSB

MSBParameter definition
Address: 1 byte, the address of the target byte. The range of address is 8 ~ 223. Reader
will return a parameter error status in the response frame if other value is delivered in thisfield.
ID: 8 bytes, the ID number of the target tag, the least-significant byte first.
Wdata: the data to be written to the tag. The length of Wdata should not exceed 32 bytes.
The most-significant byte will be written to the lowest byte from entry stated in Address. If
the length of Wdata is 0 (no data) or exceed 32, reader will return a parameter error status
in the response frame. Besides, if the sum of Address and Wdata exceeds 224, reader will
also return parameter error.

57

UHF RFID Reader UHFReader288MP User Manual v1.14

Command frame:
Len

Adr

0x05

0xXX

8.3.5

reCm
d
0x53

StatusData[]

0x00——

CRC-16LSB

MSB

Obtain lock status

The function of this command is to obtain the lock status of a specific byte.
Command frame:
Len

Adr

Cmd

Data[]
Address
ID

0x0d

0xXX

0x54

0xXX

CRC-16

8 bytesLSB

MSB

Parameters definition
Address: 1 byte, the address of the target byte. The range of address is 0 ~ 223. Reader
will return a parameter error status in the response frame if other value is delivered in thisfield.
ID: 8 bytes, the ID number of the target tag. The least-significant byte should be transmitted
first.
Command frame:
Len

Adr

reCm
d

StatusData[]

0x06

0xXX

0x54

0x00

LockState

CRC-16LSB

MS
BParameter definition
LockState: 0x00: the byte is unlocked;
0x01: the byte is locked.

8.3.6

Lock byte

The function of this command is to lock a specific byte in a tag.
Command frame:
Len

Adr

Cmd

Data[]
Address
ID

0x0d

0xXX

0x55

0xXX

CRC-16

8 bytesParameters definition
58

0x0d 0xXX

UHF RFID Reader UHFReader288MP User Manual v1.14

Address: 1 bytes, the address of the target byte. The range of address is 8 ~ 223. Reader
will return a parameter error status in the response frame if other value is delivered in thisfield.
ID: 8 bytes, the ID number of the target tag. The least-significant byte should be transmitted
first.
Response frame:
Len

Adr

0x05

0xXX

reCm
d
0x55

StatusData[]

0x00——

CRC-16LSB

8.4

Reader customised commands

8.4.1

Obtain reader information

MSB

The function of this command is to obtain reader information, including reader address,
firmware version, reader model code, supported protocols, working frequency band, RF
power, inventory time, buzzer status, GPIO for notification etc.
Command frame:
Len
Adr
0x04
0xXX

Cmd
0x21

Response frame:
reCm
Len
Adr
d
0x0f

0xXX

0x21

2

Type

1

Tr_Type1

CRC-16LSB
MSB

StatusData[]

0x00

Version,Type,
Tr_Type,dmaxfre,dminfre,Power,
Scntm,
Ant,
Reserved,
Reserved, CheckAnt

Parameters of Data[]:Parameters Length (bytes)
VersionData[]——

CRC-16LSB

MSB

Description
Firmware version, the high byte states the main
version number and the low byte states thesubversion number.
Reader model code, 0x0C is AsReader Box
Supported prototypes.
bit1 = 1: supports 18000-6C.
bit0 = 1: supports 18000-6B.
All other bits are reserved.

59

UHF RFID Reader UHFReader288MP User Manual v1.14

dmaxfre1

dminfre

1

Power

1

Scntm

1

Ant
Reserved
Reserved

1
1
1

CheckAnt1

bit7 ~ bit6: frequency band configuration;
bit5 ~ bit0: maximum frequency point.
bit7 ~ bit6: frequency band configuration;
bit5 ~ bit0: minimum frequency point.
Output RF power, range from 0 to 30.
Inventory time.
Reader will respond the inventory command
delivered from host within this specific inventory time.
Antenna configuration.
Reserved.
Reserved.
Antenna check configuration
0: antenna check off;
1: antenna check on.

Frequency band configuration table
MaxFre(bit7) MaxFre(bit6) MinFre(bit7)
0
0
0
0
0
0

MinFre(bit6)
0
1

0
0
0
0
0
0
1

0
0
1
1
1
1
0

1
1
0
0
1
1
0

0
1
0
1
0
1
0

1
1
…
1

0
0
…
1

0
1
…
1

1
0
…
1

8.4.2

FreqBandReserved
Chineseband2
US band
Korean band
EU bandReserved
Ukraine band
Peru band
Chineseband1
EU3 bandTaiwan band…
Reserved

Modify working frequency

The function of this command is to select frequency band, modify maximum and minimum
frequency points. Maximum frequency point must be larger or equal the minimum
frequency point.
Command frame:
Len

Adr

Cmd

0x06

0xXX

0x22

Data[]
MaxFre0xXX

MinFre0xXX
60

CRC-16LSB

MSBUHF RFID Reader UHFReader288MP User Manual v1.14

Parameters definition
MaxFre: 1 byte.
bit7 ~ bit6: frequency band configuration;
bit5 ~ bit0: maximum frequency point.
MinFre: 1 byte.
bit7 ~ bit6: frequency band configuration;
bit5 ~ bit0: minimum frequency point.
NOTE:
Maximum frequency point must be larger or equal the minimum frequency point. Reader
will return a parameter error status in the response frame if other value is delivered in thisfield.
Frequency band configuration table
MaxFre(bit7) MaxFre(bit6) MinFre(bit7)
0
0
0
0
0
0

MinFre(bit6)
0
1

0
0
0
0
0
0
1

0
0
1
1
1
1
0

1
1
0
0
1
1
0

0
1
0
1
0
1
0

1
1
…
1

0
0
…
1

0
1
…
1

1
0
…
1

Response frame:
Len
Adr reCmd Status
0x05 0xXX 0x22
0x00

Data[]——

FreqBandReserved
Chineseband2
US band
Korean band
EU bandReserved
Ukraine band
Peru band
Chineseband1
EU3 bandTaiwan band…
Reserved

CRC-16LSB MSB

Formulae for different frequency bands:
Chinese band2:

Fs = 920.125 + N * 0.25 (MHz) where N ∈ [0, 19].

US band:Fs = 902.75 + N * 0.5 (MHz) where N ∈ [0,49].

Korean band:

Fs = 917.1 + N * 0.2 (MHz) where N ∈ [0, 31].

61

UHF RFID Reader UHFReader288MP User Manual v1.14

EU band:Fs = 865.1 + N*0.2(MHz) where N ∈ [0, 14].

Ukraine band:

Fs = 868.0 + N*0.1(MHz) where N ∈ [0, 6].

Peru band:

Fs = 916.2 + N*0.9(MHz) where N ∈ [0, 11].

Chinese band1:

Fs = 840.125 + N * 0.25 (MHz) where N ∈ [0, 19].

EU3 band：Fs = 865.7 + N * 0.6(MHz) where N ∈ [0, 3].

Taiwan band：

8.4.3

Fs = 922.25 + N * 0.5 (MHz) where N ∈ [0, 11].

Modify reader address

Command frame:
Len

Adr

Cmd

0x05

0xXX

0x24

Data[]
address
0xXX

CRC-16LSB

MSBParameter definition
Adr: new address setting of reader. 0xFF is not a valid address, reader will return aparameter error status in the response frame if 0xFF is delivered in this field.
Response frame:
Len
Adr reCmd Status
Data[]
CRC-160x05 0xXX 0x24
0x00——
LSB MSB
NOTE:
Reader will response this command with the ORIGINAL address.

8.4.4

Modify reader inventory time

Command frame:
Len
Adr
Cmd
0x05

0xXX

0x25

Data[]
Scantime
0xXX

CRC-16LSB

MSBParameter definition
Scantime: inventory time. Reader will modify the maximum response time according touser defined value (0*100ms ~ 255*100ms), and reader will apply this new setting for future
inventories. Default setting of Scantime is 0x14 (corresponding to 20*100ms). Valid settingof Scantime is 0x00 ~ 0xff (corresponding to 3*100ms ~ 255*100ms).
62

UHF RFID Reader UHFReader288MP User Manual v1.14

NOTE: the actual responding time may slightly larger than the setting value and thisdifference will varies from 0 up to 75ms. For Scantime = 0, operation time is not limited until
inventories on all the tags are completed.
Response frame:
Len
Adr
reCmd Status
0x05
0xXX 0x25
0x00

8.4.5

Data[]——

CRC-16LSB
MSB

Modify serial baud rate

The function of this command is to modify baud rate for the serial port.
Command frame:
Len
Adr
Cmd
0x05

0xXX

0x28

Data[]
baudrate
0xXX

CRC-16LSB

MSBParameters definition
baudrate: the new baud rate setting, options of baudrate is 0/1/2/5/6 (refer to the following
table for proper baud rate), all other values are reserved.
baudrate configuration tablebaudrate value Actual baud rate
09600bps1
19200 bps
238400 bps
557600 bps
6115200 bps
Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x28

——

LSB

0x00

MSB

NOTE:
Response will be delivered using the ORITINAL baud rate setting. The new baud ratesetting will take effect in the NEXT COMMUNICATION.

8.4.6

Modify RF power

The function of this command is to modify the RF power of reader. The valid value of thisparameter is 0 ~ 30. For setting of 30, the output power is approximately 1W.
Command frame:
Len
Adr
Cmd

Data[]

CRC-1663

UHF RFID Reader UHFReader288MP User Manual v1.14

0x05

0xXX

Pwr
0xXX

0x2F

LSB

MSB

Parameter definition
Pwr: 1 byte, the RF power parameters.
bit0 ~ bit6: RF power setting, the valid value of this parameter is 0 ~ 30. For setting of 30,
the output power is approximately 1W.
bit7: configuration preservation status during power off.
0 – configuration preserved during reader power off;
1 – configuration is not preserved.
Command frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x2F

——

LSB

8.4.7

0x00

MSB

Buzzer/LED control

The function of this command is to control the TAG LED and buzzer (share with GPO1 pin)
to perform specific actions.
Command frame:
Len

Adr

Cmd

0x07

0xXX

0x33

Data[]
ActiveT

SilentT

Times

0xXX

0xXX

0xXX

CRC-16LSB

MSBParameters definition
ActiveT: TAG LED and buzzer (GPO1 pin low TTL level) switch ON time is ActiveT*50ms.
The range of ActiveT is 0 ~ 255. Default setting is 0.
SilentT: TAG LED and buzzer (GPO1 pin low TTL level) switch OFF time is SilentT *50ms.
The range of SilentT is 0 ~ 255. Default setting is 0.
Times: TAG LED and buzzer action time, the range of Times is 0 ~ 255. Default setting is0.
Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x33

——

LSB

8.4.8

0x00

MSB

Setup antenna multiplexing

The function of this command is to modify reader antenna configuration.
64

UHF RFID Reader UHFReader288MP User Manual v1.14

Command frame:
Len

Adr

Cmd

Data[]
Ant

0x05

0xXX

0x3f

0xXX

CRC-16LSB

MSBParameter definition
Ant: antenna configuration information. 1 antenna is the minimum requirement for
operation.
bit0: antenna 1 configuration bit.
0 – disable antenna 1;
1 – enable antenna 1.
bit1: antenna 2 configuration bit.
0 – disable antenna 2;
1 – enable antenna 2.
bit2: antenna 3 configuration bit.
0 – disable antenna 3;
1 – enable antenna 3.
bit3: antenna 4 configuration bit.
0 – disable antenna 4;
1 – enable antenna 4.
bit4 ~ bit6: reserved, default value is 0.
bit7: configuration preservation status.
0 – configuration preserved during reader power off;
1 – configuration not preserved.
Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x3f

——

LSB

8.4.9

0x00

MSB

Enable/disable buzzer

The function of this command is enable/disable buzzer (share with GPO1 pin).
Command frame:
Len

Adr

Cmd

Data[]
BeepEn

0x05

0xXX

0x40

0Xxx

CRC-16LSB

MSBParameter definition
BeepEn: buzzer working mode selection.
bit0: 0 – disable buzzer;
1 – enable buzzer, the buzzer will beep on every success tag operation(GPO1 pin
output low pulse).
65

UHF RFID Reader UHFReader288MP User Manual v1.14

bit1 ~ bit7 are reserved, default value is 0.
Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x40

——

LSB

0x00

MSB

8.4.10 GPIO control
The function of this command is to control the output of GPIO. The default output is high
TTL level.
Command frame:
Len

Adr

Cmd

Data[]
OutputPin

0x05

0xXX

0x46

0xXX

CRC-16LSB

MSBParameter definition
OutputPin: the output state of GPIO (pin Out1 to Out2). Bit0 ~ bit3 control the Out1 to Out3
respectively. Bit2 ~ bit7 are reserved.

Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x46

——

LSB

0x00

MSB

8.4.11 Obtain GPIO state
The function of this command is to obtain the input and output states of GPIO
Command frame:
Len

Adr

Cmd

Data[]

0x04

0xXX

0x47

——

CRC-16LSB

MSB

Response frame:
Len

Adr

reCmd Status

0x06

0xXX

0x47

0x00

Data[]
OutputPin
0xXX

CRC-16LSB

MSBParameter definition
OutputPin: the input and output states of GPIO. Bit0 represents IN1 pin status, bit4 andbit5 represent Out1 to Out2 status respectively. All other values are reserved.
66

UHF RFID Reader UHFReader288MP User Manual v1.14

8.4.12 Obtain the reader unique serial number
The function of this command is to obtain the unique serial number of a reader.
Command frame:
Len

Adr

Cmd

Data[]

0x04

0xXX

0x4c

——

CRC-16LSB

MSB

Response frame:
Len

Adr

reCmd Status

Data[]
SeriaNo

CRC-16

0x09

0xXX

0x4c

4bytes

LSB

0x00

MSB

Parameter definition
SeriaNo: 4 bytes, the unique serial number of the reader.

8.4.13 Modify tag customised function
The function of this command is to launch the customised utilities of some particular tags,
to achieve specific tag function.
Command frame:
Len

Adr

Cmd

Data[]
InlayType

0x05

0xXX

0x3a

0xXX

CRC-16LSB

MSBParameter definition
InlayType: the type of tag, the valid value of this parameter is 0 ~ 254.
0 – the default value of this parameter, represent tag type is not specified.
1 – launch the Peek function of Monza4QT tag (the status of tag will temporary change
from public to private). Launching this function will make affection on the datareading/writing, block writing, protection word writing and EPC number writing
operation.
Response frame:
Len

Adr

reCmd Status

0x06

0xXX

0x3a

0x00

Data[]

CRC-16

InlayType

LSB

MSB

Parameter definition
InlayType: the type of tag, the valid value of this parameter is 0 ~ 254.

67

UHF RFID Reader UHFReader288MP User Manual v1.14

8.4.14 Enable antenna check
The function of this command is to enable/disable the antenna check during tag
reading/writing operation.
Command frame:
Len

Adr

Cmd

0x05

0xXX

0x66

Data[]
CheckAnt
0xXX

CRC-16LSB

MSBParameter definition
CheckAnt: 1 byte, antenna check switch.
0x00 – disable antenna check;
0x01 – enable antenna check.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Response frame:
Len
Adr reCmd
0x05
0xXX 0x66

Status0x00

Data[]——

CRC-16LSB
MSB

8.4.15 Modify communication interface
The function of this command is to setup communication interface between AsReader Box
and host. The setting of this parameter will be preserved even reader power is down. Only
one type interface can be selected, user should connect the reader according to thisconfiguration.
Command frame:
Len

Adr

Cmd

0x05

0xXX

0x6A

Data[]CommType
0xXX

CRC-16LSB

MSBParameter definition
CommType: 1 byte, communication interface type.
0x00 – enable USB connection;
0x01 – enable UART connection.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
NOTE:
1. When USB connection is enabled, the UART connection will not be available. Likewise,
when UART connection is enabled, USB connection will not be available.
2. After modification on communication interface, the setting will not valid until the reader
68

UHF RFID Reader UHFReader288MP User Manual v1.14

is being properly power off and restart again.
Response frame:
Len
Adr reCmd
0x05
0xXX 0x6A

Status0x00

Data[]——

CRC-16LSB
MSB

8.4.16 Modify or load Antenna return loss threshold configuration
The function of this command is to modify or load the return loss threshold for antenna
check. The default return loss threshold is -6dB. The setting of this parameter will bepreserved even reader power is down.
Command frame:
Len

Adr

Cmd

0x05

0xXX

0x6e

Data[]
ReturnLoss
0xXX

CRC-16LSB

MSBParameter definition
ReturnLoss: action on the Return loss configuration.
bit7: load/modify return loss flag.
0 – load the current return loss configuration;
1 – modify return loss configuration.
bit6 ~ bit0: return loss configuration
For bit7 = 0, bit6 ~ bit0 will be ignored.
For bit7 = 1, bit6 ~ bit0 is the desired return loss configuration. The range of return loss is 0
~ 20, according to 0dB ~ 20dB.
Other values are reserved, reader will return a parameter error status in the response frame
if other value is delivered in this field.
Response frame:
Len

Adr

reCmd Status

0x06

0xXX

0x6e

0x00

Data[]
ReturnLoss
0xXX

CRC-16LSB

MSBParameter definition
ReturnLoss: current return loss configuration.
bit7: reserved, default setting is 0.
bit6 ~ bit0: the current antenna return loss threshold. The range is 0 ~ 20.

8.4.17 Modify maximum EPC/TID length configuration for memory buffer
The function of this command is to modify the maximum EPC/TID length for inventory withmemory buffer. This modification will clear all the tag data previously stored in the memory
buffer.
69

UHF RFID Reader UHFReader288MP User Manual v1.14

Command frame:
Len

Adr

Cmd

Data[]
SaveLen

0x05

0xXX

0x70

0xXX

CRC-16LSB

MSBParameter definition
SaveLen: 1 byte, the maximum EPC/TID length.
0 – 128bit length, i.e. 16 bytes. The maximum storable tag amount is 528 for thissetting;
1 – 496bit length, i.e. 62 bytes. The maximum storable tag amount is 160 for thissetting.
Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x70

——

LSB

0x00

MSB

8.4.18 Load the maximum EPC/TID length configuration
The function of this command is to load the configuration of maximum EPC/TID length forreader memory buffer
Command frame:
Len

Adr

Cmd

Data[]

CRC-16

0x04

0xXX

0x71

——

LSB

MSB

Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x06

0xXX

0x71

SaveLen

LSB

0x00

MSB

Parameter definition
SaveLen: 1 byte, the maximum EPC/TID length.
0 – 128bit length, i.e. 16 bytes;
1 – 496bit length, i.e. 62 bytes.

8.4.19 Obtain data from memory buffer
The function of this command is to obtain all the tag information from reader memory. This
command will not cause affection on the status of the stored data. Data can be access
multiple times. On the other hand, the tag inventory command (refer to Chapter 8.2.1) willclear all the data from memory buffer.
Command frame:70

UHF RFID Reader UHFReader288MP User Manual v1.14

Len

Adr

Cmd

Data[]

CRC-16

0x04

0xXX

0x72

——

LSB

MSB

Response frame:
Len

Adr

reCmd Status

0xXX 0xXX

0x72

0xXX

Num
0xXX

Data[]EPC Data
EPC-1, EPC-2, …
EPC-n

CRC-16LSB MSB

Parameters definition
Status: the status of response, detail description is shown in the following table
StatusDescription
operation completed, reader will report all inquired tags information to
0x01
host
reader is not able to response all the data in a single frame, further
0x03
data will be transmitted in the following frames.
Num: 1 byte, the amount of EPC/TID included in this response.
EPC Data: tag EPC/TID data stored in the memory buffer.
EPC-n
Ant

Len

0xXX 0xXX

EPC/TID RSSI CountN bytes

0xXX

0xXX

Ant: indicates which antenna had inquired the tag. For example, 0x05 is 0101 in binary, thisindicates Antenna 3 and Antenna 1.
Len: 1 byte, the byte length of the EPC/TID.
EPC/TID: EPC number/TID data of tag, the length of data should identical with Len. Every
tag EPC number or TID data is the most-significant word and the most-significant byte in aword first.
RSSI: 1 byte, the reader signal strength at the time when the tag is inquired.
Count: the total detected times for a particular tag.
0xFF – total detection time is larger or equal to 255.

8.4.20 Clear memory buffer
The function of this command is to clear all the stored tag data from the memory buffer.
Command frame:71

UHF RFID Reader UHFReader288MP User Manual v1.14

Len

Adr

Cmd

Data[]

CRC-16

0x04

0xXX

0x73

——

LSB

MSB

Command frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x73

——

LSB

0x00

MSB

8.4.21 Obtain the total tag amount from memory buffer
The function of this command is to obtain the total tag amount stored in memory buffer.
Command frame:
Len
Adr
Cmd
Data[]
CRC-16
0x04

0xXX

0x74

——

LSB

MSB

Response frame:
Len

Adr

reCmd Status

Data[]
Count

CRC-16

0x07

0xXX

0x74

2 bytes

LSB

0x00

MSB

Parameters definition
Count: 2 bytes, the total amount of tag stored in the memory buffer, most-significant byte
first.

8.4.22 Modify parameters of real time inventory mode
The function of this command is to modify the real time inventory associated parameters.
Command frame:
Len
Adr
Cmd
0xXX

0xXX

Data[]

0x75

CRC-16

——

LSB

MSB

Parameters of Data[]:
Data[]
TagProtoc
ol

ReadPauseTi
me

FliterTime

QValueSessio
n

0xXX

0xXX

0xXX

0xXX

0xXX

Data[]
MaskMem MaskAdr

MaskLen

MaskData
72

AdrTID

LenTID

UHF RFID Reader UHFReader288MP User Manual v1.14

0xXX

2Bytes0xXX

variable

0xXX

0xXX

Parameters definition
TagProtocol: 1 byte, tag type definition for real time inventory.
0 – EPC C1G2 (ISO18000-6C) tags.
1 – ISO18000-6B tags. Configurations of the following parameters will beignored for 6B, QValue, Session, MaskMem, MaskAdr, MaskLen,
MaskData, AdrTID, LenTID.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
ReadPauseTime: 1 byte, time break between 2 real time inventories.
0x00 – 10ms;
0x01 – 20ms;
0x02 – 30ms;
0x03 – 50ms;
0x04 – 100ms.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
FliterTime: 1 byte, tag filtering time. The valid value of this parameter is 0 ~ 255,
corresponds to (0 ~ 255)*1s. In real time inventory, if reader detects a particular tag for
more than 1 time, reader will only upload tag information of this tag once within the
pre-defined filtering time. For FliterTime = 0, disable tag filtering function.
QValue: 1 byte.
bit7: reserved, set to 0.
bit6: strategy indicator.
0 – general strategy;
1 – special strategy.
bit5 ~ bit0: the original Q-value of the EPC tag inventory, the setting of Q-value should
follow the rule: 2Q ≈ total amount of tags within the effective field. The range of
Q-value is 0 ~ 15, if other value is delivered in this field, reader will return aparameter error status in the response frame.
Session: 1 byte, the Session-value of the EPC tag inventory.
0x00 – apply S0 as Session value;
0x01 – apply S1 as Session value;
0x02 – apply S2 as Session value;
0x03 – apply S3 as Session value;
0xff – apply reader smart configuration (only valid in EPC inventory).
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskMem: 1 byte, mask area indication.
73

UHF RFID Reader UHFReader288MP User Manual v1.14

0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
1. When MaskMem, MaskAdr, MaskLen and MaskData are not provided, no mask pattern
will be involved in inventory
2. In real time inventory mode, reader will apply the predefined antenna and inventory timeparameters for inventory.
Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x75

——

LSB

0x00

MSB

8.4.23 Modify reader working mode
The function of this command is to modify reader working mode.

Command frame:
Len

Adr

Cmd

Data[]
ReadMode

0x05

0xXX

0x76

0xXX

CRC-16LSB

MSBParameters definition
ReadMode: 1 byte, the current working mode of reader.
0 – answering mode;
1 – real time inventory mode;2 – real time inventory mode with trigger. For this configuration, reader will only perform
inventory when the TTL level of GPI1 port is low. Once TTL level of GPI1 rise high, reader
will enter standby mode.
74

UHF RFID Reader UHFReader288MP User Manual v1.14

All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x76

——

LSB

0x00

MSB

NOTE:
The setting of this parameter will be preserved even reader power is down, i.e. reader will
apply the previous working mode setting on every restart.
Output format in real time inventory mode:
Once reader is set to real time inventory mode, reader will perform auto inventory according
to predefined configuration.
If a tag is inquired and the tag matches the predefined condition, reader will automaticallyupload data in the following format:
Len

Adr

reCmd Status

Data[]

CRC-16

0xXX

0xXX

0xee

——

LSB MSB

0xXX

Status: the status of response, detail description is shown in the following table
StatusDescription
Detected appropriate tag, reader will also report the detected tag
0x00
data.
No appropriate tag detected within the heartbeat packet time interval,
0x28
reader will upload heartbeat packet.
(1) Response status is 0x00, parameters of Data[] are shown as below,
Data[]Ant

Len

0xXX 0xXX

EPC/TID RSSI
N bytes

0xXX

Parameters definition
Ant: indicates which antenna had inquired the tag. For example, 0x05 is 0101 in binary, thisindicates Antenna 3 and Antenna 1.
Len: 1 byte, the byte length of the EPC/TID.
EPC/TID: EPC number/TID data of tag, the length of data should identical with Len. The
unit of EPC C1 G2 data is word. Every tag EPC number or TID data is the most-significant
word and the most-significant byte in a word first.
RSSI: 1 byte, the reader signal strength at the time when the tag is inquired.

75

UHF RFID Reader UHFReader288MP User Manual v1.14(2) Response status is 0x28, parameters of Data[] are shown as below
Data[]
PacketNo AntStatus TotalCount
4 bytes

4 bytes

4 bytesParameters definition
PacketNo: heartbeat serial number. 4 bytes, most-significant byte first.
Serial number will increase for ever heartbeat packet uploading operation. If heartbeat
serial number exceeds the maximum 4 bytes value, the serial number will recount again
from 0.
AntStatus: the current status of 4 antennas, queued from 1 to 4 according to byte order.
0x00 – target antenna is idle, not a effective inventory antenna
0x01 – target antenna is working properly;
0x02 – target antenna is disconnected.
TotalCount: the total amount of tag inquired since the beginning of the current
auto-inventory. A tag being indentified multiple times will also increase the value of
TotalCount. 4 bytes, with most-significant byte first. If total amount of inquired tag exceeds
maximum 4 bytes value, TotalCount will recount again from 0.
For real time inventory mode, reader will only response to 3 commands:
1. obtain reader information (refer to Chapter 8.4.1);
2. modify reader working mode(refer to Chapter 8.4.22);
3. obtain auto-mode parameters(refer to Chapter 8.4.23).

8.4.24 Obtain reader working mode
The function of this command is to obtain parameters of reader working mode.
Command frame:
Len

Adr

Cmd

Data[]

0x04

0xXX

0x77

——

CRC-16LSB

MSB

Response frame:
Len

0xXX

Adr

0xXX

reCmd Status

0x77

0x00

Data[]
ReadMode,TagProtocol,
ReadPauseTime, FliterTime,
QValue, Session, MaskMem,
MaskAdr, MaskLen, MaskData,
AdrTID, LenTID

Parameters definition76

CRC-16LSB

MSBUHF RFID Reader UHFReader288MP User Manual v1.14

ReadMode: 1 byte, the current working mode of reader.
TagProtocol: 1 byte, tag type definition of real time inventory.
ReadPauseTime: 1 byte, time break between 2 real time inventories.
FliterTime: 1 byte, tag filtering time of real time inventory.
QValue: 1 byte.
bit7: reserved, set to 0.
bit6: strategy indicator.
0 – general strategy;
1 – special strategy.
bit5 ~ bit0: the original Q-value of the EPC tag inventory, the setting of Q-value should
follow the rule: 2Q ≈ total amount of tags within the effective field. The range of
Q-value is 0 ~ 15, if other value is delivered in this field, reader will return aparameter error status in the response frame.
Session: 1 byte, the Session-value of real time mode for EPC inventory.
MaskMem, MaskAdr, MaskLen, MaskData: mask condition for EPC C1G2 tag inventory
in real time mode. MaskMem and MaskLen are 1 byte long respectively. MaskAdr is 2
bytes long, most-significant byte first. MaskData has constant length of 32 bytes, fill theover MaskLen value content with zero.
AdrTID: initial word address of TID memory inventory.
LenTID: data length for TID inventory operation.

8.4.25 Load/modify heartbeat packet time break of real time inventory
The function of this command is to modify the heartbeat packet upload time break for realtime inventory mode. For HeartBeatTime = 0, disable heartbeat packet delivery.

Command frame:
Len

Adr

Cmd

Data[]
HeartBeatTime

0x05

0xXX

0x78

0xXX

CRC-16LSB

MSBParameter definition
HeartBeatTime: time break between 2 heartbeat packets deliveries
77UHF RFID Reader UHFReader288MP User Manual v1.14

bit7: action on heartbeat time break configuration0 – load heartbeat time break configuration;
1 – modify heartbeat time break configuration.
bit6 ~ bit0: heartbeat time break configuration
For bit7 = 0, bit6 ~ bit0 will be ignored.
For bit7 = 1, bit6 ~ bit0 is the configuration of time break between 2 heartbeat packets
deliveries
For HeartBeatTime = 0, disable heartbeat packet delivery.
Response frame:
Len

Adr

reCmd Status

0x06

0xXX

0x78

0x00

Data[]
HeartBeatTime
0xXX

CRC-16LSB

MSBParameter definition
HeartBeatTime: the current configuration of heartbeat packet time break.
bit7: reserved, default value is 0.
bit6 ~ bit0: the current configuration of heartbeat packet time break. The valid value of thisparameter is 0 ~ 127, corresponds to (0 ~ 127)*30s.
NOTE:
Reader will only deliver heartbeat packet if no tag is detected for a consecutive period(longer than the heartbeat time break)8.4.26 Modify RF power configuration separately for write operations
The function of this command is to modify RF power for write operations. The default valueof the power parameter is 0x00. The setting of this parameter will be preserved even reader
power is down.
Command frame:
Len

Adr

Cmd

0x05

0xXX

0x79

Data[]
WritePower
0xXX

CRC-16LSB

MSBParameter definition
WritePower: configuration of the power.
bit7: enable/disable separate RF power configuration for write operation.
0 – disable separate RF power configuration, power will be identical for both read andwrite commands.
1 – enable separate RF power configuration. The valid value of RF power is 0~30, forsetting of 30, the output power is approximately 1W.
Response frame:78

UHF RFID Reader UHFReader288MP User Manual v1.14

Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x79

——

LSB

0x00

MSB

The separate RF power will take effect for the following commands,
EPC C1G2 (ISO18000-6C) commands• write data command;• write EPC number command;• Extended data writing command with assigned mask;• block erase command;• block writing command.
ISO18000-6B command• write data command
8.4.27 Load the RF power configuration of write operations
The function of this command is to load the predefined separate RF power configuration of
write operation.
Command frame:
Len
Adr
Cmd
0x04

0xXX

Data[]

0x7A

CRC-16

——

LSB

MSB

Response frame:
Len

Adr

reCmd Status

0x06

0xXX

0x7A

0x00

Data[]
WritePower
0xXX

CRC-16LSB

MSBParameter definition
WritePower: configuration of the power.
bit7: configuration of separate RF power configuration for write operation.
0 – disabled separate RF power configuration, power will be identical for both read
and write commands.
1 – enabled separate RF power configuration. The valid value of RF power is 0~30,
for setting of 30, the output power is approximately 1W.

8.4.28 Modify or load maximum write retry time configuration
The function of this command is to modify or load the maximum write retry time
configuration. For tag writing and associated commands, if failure occurred, reader willreattempt the operation until success or reach the maximum write retry time. Default valueof the retry time is 3. The setting of this parameter will be preserved even reader power is
down.
79

UHF RFID Reader UHFReader288MP User Manual v1.14

Command frame:
Len

Adr

Cmd

0x05

0xXX

0x7B

Data[]
RetryTimes
0xXX

CRC-16LSB

MSBParameter definition
RetryTimes: action on maximum write retry time configuration
bit7: load/modify maximum write retry time configuration0 – load maximum write retry time;
1 – modify maximum write retry time;
bit6 ~ bit3: reserved.
bit2 ~ bit0: maximum write retry time
For bit7 = 0, bit6 ~ bit0 will be ignored.
For bit7 = 1, bit2 ~ bit0 is the configuration of maximum retry time. The range of thisparameter is 0 ~ 7.
Response frame:
Len

Adr

reCmd Status

0x06

0xXX

0x7B

0x00

Data[]
RetryTimes
0xXX

CRC-16LSB

MSBParameter definition
RetryTimes: value of maximum write retry time
bit7 ~ bit3: reserved, default value is 0.
bit2 ~ bit0: maximum write retry time setting. The valid range of RetryTimes is 0 ~ 7.
The retry time counter will take effect for the following command,
EPC C1G2 (ISO18000-6C) commands• write data command;• write EPC number command;• Extended data writing command with assigned mask;• block erase command;• block writing command.
ISO18000-6B command• write data command
8.4.29 Modify password of tag customised functions
The function of this command is to modify the access password of tag customised functions.
This password will take effect when the Peek function of Monza4QT tag is launched. The
setting of this parameter will be preserved even reader power is down.
Command frame:
Len
Adr
Cmd

Data[]

CRC-1680

UHF RFID Reader UHFReader288MP User Manual v1.14

UserPwd
0x08

0xXX

0x7D

4 bytesLSB

MSB

Parameter definition
UserPwd: 4 bytes, most-significant byte first. User customised access password.
Response frame:
Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x7D

——

LSB

0x00

MSB

8.4.30 Obtain password of tag customised functions
The function of this command is to obtain the access password of tag customised functions.
Command frame:
Len

Adr

Cmd

Data[]

0x04

0xXX

0x7E

——

CRC-16LSB

MSB

Response frame:
Len

Adr

reCmd Status

Data[]
UserPwd

CRC-16

0x09

0xXX

0x7E

4 bytes

LSB

0x00

MSB

Parameter definition
UserPwd: 4 bytes, most-significant byte first. User customised access password.

8.4.31 Load/modify reader profile
The function of this command is to modify / load the internal profile configuration of reader.
The default value of profile is 1. The setting of this parameter will be preserved even reader
power is down.

Command frame:
Len

Adr

Cmd

Data[]
profile

0x05

0xXX

0x7F

0xXX

CRC-16LSB

Parameter definition
profile: profile number configuration.
81

MSB

UHF RFID Reader UHFReader288MP User Manual v1.14

bit7: action on profile number configuration.
0 – load profile number;
1 – modify profile number.
bit6 ~ bit0: profile number configuration.
For bit7 = 0, bit6 ~ bit0 will be ignored.
For bit7 = 1, bit6 ~ bit0 is the new configuration of profile number. The valid range of thisparameter is 0 ~ 3.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Response frame:
Len

Adr

reCmd Status

Data[]
profileCRC-16

0x06

0xXX

0x7F

0xXX

LSB

0x00

MSB

Parameter definition
profile: current profile number configuration.
bit7: reserved, default value is 0.
bit6 ~ bit0: the current profile number of reader. The valid range of this parameter is 0 ~ 3.
Configuration of different profiles
Profile0: Tari 25uS, FM0 40KHz;
Profile1: Tari 25uS, Miller 4 250KHz (recommend configuration, system default setting)
Profile2: Tari 25uS, Miller 4 300KHz;
Profile3: Tari 6.25uS, FM0 400KHz.

8.4.32 Synchronise EM4325 timestamp
The function of this command is to broadcast the timestamp to all the EM4325 tags within
the effective field.
Command frame:
Len

Adr

Cmd

Data[]
UTC
Time

0x08

0xXX

0x85

4 bytes

CRC-16LSB

MSBParameter definition
UTC Time: 4 bytes, the UTC timestamp to be broadcasted, most-significant byte first. It
represent the second amount since 1970-01-01 00:00:00. Synchronisation will fail if the
MSB of UTC Time is 0.
Response frame:82

UHF RFID Reader UHFReader288MP User Manual v1.14

Len

Adr

reCmd Status

Data[]

CRC-16

0x05

0xXX

0x85

——

LSB

0x00

MSB

NOTE:
1. EM4325 tag must stay in BAP mode to receive and synchronise timestamp.
2. Synchronisation will fail if the delivered MSB of UTC Time is 0.
3. Synchronisation will fail if any alert flag is set. Alert flag can be clear via the “Reset
EM4325 alert” command or temporarily disable alert functions via modifying associatedEM4325 registers.
4. EM4325 tags will no produce response to timestamp synchronisation command. Hencereader will report successful status to host once timestamp synchronisation command isdelivered to tag.
5. Once the EM4325 internal UTC Time register is setup, this register will increase 1 inevery second. This timer will stop if the 4 bytes register overflow 0xFFFFFFFF and backto 0 or the associated system configuration register in user area is modified.

8.4.33 Obtain EM4325 temperature data
The function of this command is to obtain temperature data from EM4325 tag.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x86——

CRC-16LSB

MSBParameters of Data[]:
Data[]ENum

EPC

SendUID

NewSample

Pwd

0xXX

variable

0xXX

0xXX

4 bytes

MaskMem

MaskAdr

MaskLen

MaskData

0xXX

2Bytes0xXX

variable

Parameter definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.

83

UHF RFID Reader UHFReader288MP User Manual v1.14

EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
SendUID: 1 byte, UID response flag.
0x00 – do not response UID;
0x01 – response UID.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
NewSample: 1 byte, new temperature data flag.
0x00 – obtain the previous temperature data;
0x01 – obtain a new temperature data.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Psw should be set to all-zero or set tothe correct access password.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len

Adr

reCmd

StatusUID
84

Data[]
SenserData

UTC

CRC-16

UHF RFID Reader UHFReader288MP User Manual v1.14

0xXX

0xXX

0x86

0x00

variable

4Bytes4Bytes LSB MSBParameters definition
UID: unique identification number of EM4325 tag.
For SendUID = 0, no UID field will be delivered in the response;
For SendUID = 1, UID field will be delivered in the response, the length of the field depends
on the tag, for different tag response, the length of UID may alter between 8 bytes, 10 bytes
of 12 bytes.
SenserData: temperature data returned from EM4325 tag, the length of data is 4 bytes,
most-significant byte first. Refer to Sensor Data register definition in EM4325 datasheet for
detail description.
UTC: 4 bytes, current UTC timestamp of tag, most-significant byte first. It represent thesecond amount since 1970-01-01 00:00:00. If the target tag had not been synchronised or
tag UTC timestamp had not been setup, the return value will be all-zero.

8.4.34 Obtain external data via EM4325 SPI
The function of this command is to use EM4325 tag as SPI master device, and obtain datafrom its connected SPI slave device.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x87——

CRC-16LSB

MSBParameters of Data[]:
Data[]SPICmdSize ENum

EPC

SPIResSize

SPISclk

SPIInitDelay SPIInterval

0xXX

0xXX

variable

0xXX

0xXX

0xXX

SPICmdPwd

MaskMem

MaskAdr

MaskLen

MaskData

variable

4
bytes

0xXX

2 bytes

0xXX

variable

0xXX

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value is deliveredin this field.
85

UHF RFID Reader UHFReader288MP User Manual v1.14

EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
SPICmdSize: 1 byte, the byte length of SPI command. The valid range of SPICmdSize is 1
~ 8.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
SPIResSize: 1 byte, the byte length of response from SPI slave device. The valid range of
SPIResSize is 0 ~ 7. SPIResSize = 0 represents no response will be produced.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
SPISclk: 1 byte, clock of the SPI bus.
0 – 40KHz;
1 – 80KHz;
2 – 160KHz;
3 – 320KHz.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
SPIInitDelay: 1 byte, delay for SPI clock initialisation.
0 – 1 SCLK;
1 – 50us;2 – 500us;3 – 5ms.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
SPIInterval: 1 byte, time break between every SPI data byte.
0 – no delay;
1 – 50us;2 – 100us;3 – 500us.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
SPICmd: SPI command data to be delivered, the length of data must be identical to thevalue stated in SPICmdSize.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
86UHF RFID Reader UHFReader288MP User Manual v1.14

is the least-significant bit in the 4th (last) byte of Pwd. Psw should be set to all-zero or set tothe correct access password.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
Response frame:
Len

Adr

reCmd

StatusData[]SPIResData

0xXX

0xXX

0x87

0x00

variable

CRC-16LSB

MSBParameter definition
SPIResData: data returned from EM4325 SPI slave device, the valid range of data is 0 ~ 7
bytes. The length of SPIResData should be identical with the value stated in SPIResSize.
NOTE:
Before obtaining external data via EM4325 SPI, the EM4325 I/O control byte (I/O ControlWord) register must be firstly configured. User should enable SPI function, setup SPI port
and enable SPI pin pull-up register.

8.4.35 Reset EM4325 alert
The function of this command is to reset all the alert flag of EM4325 tag. UTC clock andmonitoring functions will be clear.
Command frame:
Len
Adr
0xXX

0xXX

Cmd

Data[]

0x88——

CRC-16
LSB

87

MSB

UHF RFID Reader UHFReader288MP User Manual v1.14

Parameters of Data[]:
Data[]
ENum
0xXX

EPC

Pwd

variable 4 bytes

MaskMem MaskAdr MaskLen MaskData
0xXX

2 bytes

0xXX

variable

Parameters definition
ENum:
0x00 ~ 0x0f – ENum represents the length of EPC number. The unit of ENum is word, andthe length of EPC should be less than 15 words. In this situation, parameters
MaskMen, MaskAdr, MaskLen, MaskData should all be left empty.
0xff – MaskMem, MaskAdr, MaskLen, MaskData should be provided instead of EPC
parameters.
Reader will return a parameter error status in the response frame if other value isdelivered in this field.
EPC: EPC number of the target tag. Length of the EPC depends on the provided EPC
number. The unit of EPC number is word. During communication, the most-significant word
and the most-significant byte in a word will be transmitted first. It is essential to provide
FULL EPC in this command.
Pwd: 4 bytes, it is the 4 bytes access password of a tag. From left to right, the first two
bytes are the high bytes of access password, and the last two bytes are the low bytes. The
most-significant bit of a tag 32-bit access password is the most-significant bit in the 1st byteof Pwd (from left to right). Likewise, the least-significant bit of a tag 32-bit access password
is the least-significant bit in the 4th (last) byte of Pwd. Psw should be set to all-zero or set tothe correct access password.
MaskMem: 1 byte, mask area indication.
0x01 – EPC memory;
0x02 – TID memory;
0x03 – User memory.
All other values are reserved, reader will return a parameter error status in the response
frame if other value is delivered in this field.
MaskAdr: 2 bytes, entry bit address of the mask, the valid range of MaskAdr is 0 ~ 16383.
MaskLen: 1 byte, bit length of mask (unit: bits).
MaskData: mask data. The length of MaskData equals to MaskLen/8. If MaskLen is not a
multiple of 8 integer, the length of MaskData is equal to the int[MaskLen/8]+1.
Non-specified lower significant figures should be filled up with 0.
NOTE:
When MaskMem, MaskAdr, MaskLen and MaskData are not provided, full EPC number will
be used as mask pattern in inventory.
88

UHF RFID Reader UHFReader288MP User Manual v1.14

Response frame:
Len
Adr reCmd
0x05
0xXX 0x88

Status0x00

Data[]——

CRC-16
LSB
MSB

NOTE:
Before using the “reset EM4325 alert” command, the temperature sensor control byte of
EM4325I (Temp Sensor Control Word 1) must be firstly configured to enable the EM4325
alert reset function; otherwise the EM4325 tag will not produce any response to thiscommand.

8.4.36 Modify or load DRM configuration
The function of this command is to modify or load DRM switch mode. Setting of theseparameters will lost during power off. DRM will be reset to off state on every reader start-up.
Command frame:
Len

Adr

Cmd

0x05

0xXX

0x90

Data[]
DRMMode
0xXX

CRC-16LSB

MSBParameter definition
DRMMode: action on DRM configuration.
bit7: load/modify DRM flag.
0 – load the current DRM configuration;
1 – modify DRM configuration.
bit6 ~ bit0: DRM configuration
For bit7 = 0, bit6 ~ bit0 will be ignored.
For bit7 = 1, bit6 ~ bit0 is the desired DRM configuration.
0 – Switch OFF DRM;
1 – Switch ON DRM.
Other values are reserved, reader will return a parameter error status in the response frame
if other value is delivered in this field.
Response frame:
Len

Adr

reCmd Status

0x06

0xXX

0x90

0x00

Data[]
DRMMode
0xXX

CRC-16LSB

Parameter definition
DRMMode: action on DRM configuration.
bit7: reserved, the default setting is 0.
bit6 ~ bit0: current DRM configuration
0 –DRM is switch OFF;89

MSB

UHF RFID Reader UHFReader288MP User Manual v1.14

1 – DRM is switch ON.

8.4.37 Measure antenna return loss
The function of this command is to measure antenna return loss on specific frequency
point.
Command frame:
Len

Adr

Cmd

0x09

0xXX

0x91

Data[]
TestFreqAnt
4 bytes
0xXX

CRC-16LSB

MSBParameters definition
TestFreq: target frequency point for the return loss measurement. The unit of TestFreq is
KHz, most-significant byte first. A valid frequency point must be a multiple of either 125KHz
or 100KHz. Reader will return a parameter error status in the response frame if other value
is delivered in this field.
Ant: 1 byte, target antenna for this measurement
0 – antenna 1;
1 – antenna 2;
2 – antenna 3;
3 – antenna 4.
Other values are reserved, reader will return a parameter error status in the response frame
if other value is delivered in this field.
Response frame:
Len

Adr

reCmd

Status

0x06

0xXX

0x91

0x00

Data[]
ReturnLoss
0xXX

CRC-16LSB

MSBParameter definition
ReturnLoss: result of the return loss measurement, the unit of ReturnLoss is dB.

8.4.38 Measure current reader temperature
The function of this command is to obtain reader current temperature.
Command frame:
Len

Adr

Cmd

Data[]

0x04

0xXX

0x92

——

Response frame:
Len
Adr reCmd

StatusCRC-16LSB

MSB

Data[]
90

CRC-16

UHF RFID Reader UHFReader288MP User Manual v1.14

0x07

0xXX

0x92

0x00

PlusMinus
0xXX

Temp
0xXX

LSB

MSB

Parameters definition
PlusMinus: 1 byte, temperature range.
0 – below 0 °c;
1 – above 0 °c.
Temp: 1 byte, temperature value, the unit is °c.
NOTE:This command only supported by temperature sensor embedded reader.

91