RE40 RFID - RE40 Binary Interface Protocol
Introduction
RE40 is Zebra UFH RFID module. Any host system can integrate this RE40 RFID module and perform RFID related operations using directly RE40 binary interface protocol. Zebra RFID SDK is available for x86/x64/ARM32 based CPU architecture. If the target host uses different CPU architecture or does not run OS, RE40 Binary interface protocol is a ideal choice.
RE40 Binary Interface is communication interface protocol between Host and RE40 RFID Module. This document describes the details of the protocol.
RE40 is Zebra Next Gen Radio which implements GS1 protocol EPC Global UHF Class 1 Gen2/ ISO 18000-63.
The binary interface protocol is based on the client/server model. The Host acts as client and Radio acts as the server. Radio waits for the host to issue a command. When the host issues a command, the Radio services the request and responds with one or more responses. The final response to every command is an ACK. The ACK contains the command ID that the host requested and a success or failure of command. In other words, ACK indicates to the host that the processing for the command has completed.
The communication between host and the RE40 is based on a "Command/Response" paradigm. The format of this document will follow this paradigm.
Communication Interface
RE40 RFID Module supports both RS-232 Serial and USB CDC communication port.
UART - RS-232 Serial Port
| Parameter | Value |
|---|---|
| Baud Rate | 921600 (Default) |
| Data Bits | 8 |
| Stop Bit | 1 |
| Parity | None |
| Flow Control | None |
USB 2.0 (Full Speed) CDC Serial
RE40 supports USB CDC serial communication port to interface with host.
Packet Overview
All the command and response uses the following packet format.
Packet Format
| SOF | Header | Payload | CRC |
|---|---|---|---|
| 2 bytes | 4 bytes | Variable | 2 byte |
Command Packet
The structure of command packet is described below.
SOF
Each packet begins with a SOF. The value of the field is 0xAAAB
Header
Each packet contains the header. The format of the header is as below:
| Command Type | Payload Length |
|---|---|
| 2 bytes | 2 bytes |
Payload
This contains parameter as variable
CRC
The CRC will be calculated using CRC-16 encoder method as specified in the EPC Gen2 Protocol specification (Annex F2).
Response Packet
SOF
Each packet begins with a SOF. The value of the field is 0xAAAB
Header
The response packet contains the header. The format of the header is as below:
| Response Type | Payload Length |
|---|---|
| 2 bytes | 2 bytes |
Payload
This contains Command Type acknowledged (ACK) and Error Code.
| Parameter ID | Response Value |
|---|---|
| 2 bytes | Data in variable length |
CRC
The CRC will be calculated using CRC-16 encoder method as specified in the EPC Gen2 Protocol specification (Annex F2)
ACK Packet
The final packet that responds to any command is the ACK packet. Therefore, it is the most common response packet.
SOF
Each packet begins with a SOF. The value of the field is 0xAAAB
Header
The response packet contains the header. The format of the header is as below:
| Response Type | Payload Length |
|---|---|
| 2 bytes | 2 bytes |
Payload
This contains Command Type acknowledged (ACK) and Error Code.
| Command Type Acknowledged | Error Code |
|---|---|
| 2 bytes | 1 byte |
Non-negative value (>=0) of Error Code indicates successful completion of the command.
Negative value of Error Code indicates an error. The meaning of the error depends on the type of command that was used.
General Error Codes
| Error Code | Description |
|---|---|
| 0xff (-1) | When the command packet has less than 6 bytes |
| 0xfe (-2) | When the command packet has fewer bytes than the value in the length field + 6 bytes |
| 0xfd (-3) | When the command packet CRC is incorrect |
| 0xfc (-4) | When the expected length of a command packet type does not match the value in the length field |
| 0xfb (-5) | When the command packet type is not supported |
| 0xf4 (-12) | Non-specific error |
CRC
The CRC will be calculated using CRC-16 encoder method as specified in the EPC Gen2 Protocol specification (Annex F2)
CRC-16 Sample Code Snippet
The sample code snippet shows on how to compute CRC-16. Exclude SOF from the packet to compute CRC-16.
x// Generate CRC-16 CCITT tablevoid generateCRCTable(){ const uint16_t polynomial = 0x1021; uint16_t initialValue = 0xffff; uint16_t result, temp; uint16_t crc = initialValue; for (int tableIndex = 0; tableIndex < sizeof(crc16_ccitt_table)/sizeof(uint16_t); ++tableIndex) { result = 0; temp = (uint16_t)(tableIndex << 8); for (int index = 0; index < 8; ++index) { if (((result ^ temp) & 0x8000) != 0) result = (uint16_t)((result << 1) ^ polynomial); else result <<= 1; temp <<= 1; } crc16_ccitt_table[tableIndex] = result; }}// Compute CRC-16uint16_t computeCRC16(uint8_t* pData, uint32_t dataLength){ uint16_t crc; uint32_t index; crc = 0xffffU; for (index = 0; index < dataLength; index++) { crc = (crc << 8) ^ crc16_ccitt_table[((crc >> 8) ^ pData[index])]; } crc ^= 0xffffU; return crc;}static uint16_t crc16_ccitt_table[256];int main(){ uint8_t data[] = { 0x08, 0x08, 0x00, 0x00 }; // stop command packet // Initialize CRC-16 CCITT table once generateCRCTable(); // Compute CRC-16 uint16_t crc; crc = computeCRC16(data, sizeof(data)); printf("crc = 0x%04x\n", crc); return 0;}
Command/Response Model
Get commands
The typical command exchange flow for get commands are shown below. This is applicable for get or getnvm commands.
start command
The following diagram shows the typical flow of start command and responses. If there are many response packets are enabled, those packet will be reported as and when the event occur.
other commands
The diagram below shows the flow of command and ACK packet as a response. This is applicable for all the commands except get, getnvm or start command.
Commands
set
This command allows to set the host to configure a parameter in Radio.
Command
| SOF | Command Type | Payload length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0801 | xx xx | Variable | xx xx |
Payload
| Field Name | Length (bytes) | Notes |
|---|---|---|
| Parameter ID | 2 | Parameter section contains more details |
| Value | Variable | Depends on the data type of the parameter |
Response (ACK Packet)
| SOF | Response Type | Payload Length | Command Type | Error Code | CRC |
|---|---|---|---|---|---|
| 0xAAAB | 0x0801 | 0x0003 | 0x0801 | xx | xx xx |
Error Codes
Non-negative value (>=0) of Error Code indicates successful completion of the command.
| Error Code | Description |
|---|---|
| -7 | When the Parameter ID to set is not supported |
| -8 | When the value to set the parameter ID is not allowed |
| -9 | When the access type to set is not supported |
Parameters
Response Packet Type
Sets the Response packet type to enable / disable. The enabled response packets will be reported when "start" command issued
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0004 | |
| enable | uint8_t | 0x01 | 0: Disable 1: Enable |
| response packet type | uint16_t | enable or disable the required response packets. Refer the packets table below. |
Response Packets
| Response Packet | Response Packet Type | Description |
|---|---|---|
| Antenna info timed | 0x030E | Antenna currently being used with timestamp |
| LBT info | 0x0289 | LBT determination |
| Carrier on Timed | 0x030F | Carrier Channel, Frequency, Power Level currently being used |
| Antenna Disconnect Alarm | 0x0381 | Antenna has been disconnected |
| Antenna Connect Alarm | 0x0391 | Antenna has been connected |
| Channel Power Limit Info | 0x0313 | Channel Power was limited from requested power level |
| PA Temperature High Alarm | 0x0385 | PA Temperature higher than high limit |
| PA Temperature Critical Alarm | 0x0386 | PA Temperature higher than critical limit |
| PA Temperature Low Alarm | 0x0387 | PA Temperature lower than low limit |
| Over-Temperature Protection | 0x0390 | Over temperature protection was turned on/off |
| Forward Power High Alarm | 0x0388 | Forward Power was higher than requested |
| Forward Power Low Alarm | 0x0389 | Forward Power was lower than requested |
| Reverse Power High Alarm | 0x038A | Reverse Power was higher than threshold |
| Tag Info custom | 0x0005 | Tag information with custom meta-data |
| Access Info | 0x030C | Access operation success/failure and data |
| Inventory Round End | 0x030A | Statistics of just complete inventory round |
| Carrier Off Timed | 0x0306 | Carrier just turned off with timestamp |
| Enhanced Start Info | 0x0291 | Enhanced Statistics of just completed start command with end code |
| Echo Threshold Alarm | 0x038B | Whether echo cancellation passed threshold |
| GPI Info | 0x0308 | GPI information when GPI start or GPI stop are enabled |
| LMAC Error | 0x038C | LMAC error |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Tag Info fields
This parameter allows to select the tag fields reported as part of Tag info packets.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0009 | Enable the tag fields |
| Tag field bit mask | uint32_t |
Tag field bit mask
| Bit Position | Tag Data Field |
|---|---|
| 0 | EPC Data |
| 1 | RFU |
| 2 | RFU |
| 3 | RFU |
| 4 | Antenna ID |
| 5 | RSSI |
| 6 | Channel ID |
| 7 | RFU |
| 8 | Last Seen Uptime |
| 9 | Tag Seen Count |
| 10 | PC Bits |
| 11 | XPC1 Bits |
| 12 | XPC2 Bits |
| 13 | CRC Bits |
| 14 | RFU |
| 15 | Phase |
| 16 - 31 | RFU |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Radio Stop Conditions
Sets the Radio Stop conditions. When any of the conditions met, the on going "start" command will stop.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0005 | Sets radio stop conditions |
| time in milliseconds | uint32_t | ||
| Antenna loops | uint16_t | ||
| Tag count | uint16_t | ||
| GPIO bit mask | uint8_t | ||
| GPIO1 hold time in milliseconds | uint16_t | minimal amount of time that the GPIO needs to be matching the condition to trigger the stop | |
| GPIO2 hold time in milliseconds | uint16_t | minimal amount of time that the GPIO needs to be matching the condition to trigger the stop |
GPIO bit mask
| Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
|---|---|---|---|---|---|---|---|
| N/A | N/A | Enable Stop Trigger on GPIO2 | Enable Stop Trigger on GPIO1 | N/A | N/A | Stop Condition for GPIO 2 | Stop Condition for GPIO 1 |
| Ignored | Ignored | 1: use value in bit 1 to set the stop condition of GPIO2 0: disable GPIO2 stop trigger | 1: use value in bit 0 to set the stop condition of GPIO1 0: disable GPIO1 stop trigger | Ignored | Ignored | 1: High 0: Low | 1: High 0: Low |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Select
Sets the Select Parameters. Please refer C1G2 Specification for more details on the command.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0101 | |
| enable | uint8_t | 0: Disable 1: Enable | |
| target | uint8_t | 0: Inventoried (S0) 1: Inventoried (S1) 2: Inventoried (S2) 3: Inventoried (S3) 4: SL | |
| action | uint8_t | Refer Action parameter Table | |
| memory bank | uint8_t | 1: EPC 2: TID 3: User | |
| pointer | uint16_t | starting bit address | |
| length | uint8_t | Mask length in bits | |
| mask | uint8_t[] | Mask value | |
| truncate | uint16_t | 0: Disable 1: Enable |
Action Parameter
If target is set to 4 (SL), the tag response to action parameter
| Action | Matching | Non-Matching |
|---|---|---|
| 000 | assert SL | deassert SL |
| 001 | assert SL | do nothing |
| 010 | do nothing | deassert SL |
| 011 | negate SL | do nothing |
| 100 | deassert SL | assert SL |
| 101 | deassert SL | do nothing |
| 110 | do nothing | assert SL |
| 111 | do nothing | negate SL |
If target is set to 0 - 3 (Session S0-S3), the tag response to action parameter
| Action | Matching | Non-Matching |
|---|---|---|
| 000 | Inventoried -> A | Inventoried -> B |
| 001 | Inventoried -> A | do nothing |
| 010 | do nothing | Inventoried -> B |
| 011 | (A->B, B->A) | do nothing |
| 100 | Inventoried -> B | Inventoried -> A |
| 101 | Inventoried -> B | do nothing |
| 110 | do nothing | Inventoried -> A |
| 111 | do nothing | (A->B, B->A) |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Query
Sets the Query Parameters. Please refer C1G2 Specification for more details on the command.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0201 | 0x0201 - 0x0204 (4 Query Parameter are allowed) |
| enable | uint8_t | 0x01 | 0: Disable 1: Enable |
| uint8_t | 0x01 | 1: C1G2 | |
| sel | uint8_t | 0x00 | Chooses which Tags respond to the query 1: All 2: ~SL 3: SL |
| session | uint8_t | 0x00 | Session for the inventory round 0: S0 1: S1 2: S2 3: S3 |
| target | uint8_t | 0x00 | Selects whether Tags whose inventoried flag is A or B participate in the inventory round 0: A 1: B |
| Q | uint16_t | 0x06 | Sets the number of slots in the round. Tags pick a random value in the range (0, 2Q - 1). The possible values of Q are 0-15. |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Antenna
Sets the Antenna Parameters
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0401 | 0x0401 - 0x0404 (4 antenna allowed) 0x0401-Antenna 1 0x0402-Antenna 2 0x0403-Antenna 3 0x0404-Antenna 4 |
| enable | uint8_t | 0x01 | 0: Disable 1: Enable |
| transmit port | uint16_t | 0x0001 | Antenna port id. Both transmit and receipt port should be same |
| receive port | uint16_t | 0x0001 | Antenna port id. Both transmit and receipt port should be same |
| stop condition type | uint8_t | 0x00 | 1: inventory cycle 2: dwell time (millisecond) |
| stop value | uint16_t | 0x01 | |
| transmit power | uint16_t | 0x010E | in 0.1 dBm (270 = 27dBm) |
| select bit mask | uint32_t | 0xffffffff | RFU. This must be set to 0xffffffff. |
| query index | uint8_t | 0x01 | Index to the query parameter to be used. For each antenna, there should be separate query parameter respectively. |
| access bit mask | uint64_t | 0xffffffffffffffff | RFU. This must be set to 0xffffffffffffffff |
| link profile index | uint16_t | 0x0328 | 202: M=4/240, PIE=2, Tari=25us 808: M=2/320, PIE=2, Tari=18.8us 908: M=4/320, PIE=2, Tari=18.8us |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Access
Sets C1G2 access command. The set of access commands includes read, write, kill and lock operation.
Command Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0301 - 0x0305 (5 Access Parameter are allowed) |
| enable | uint8_t | 0: Disable 1: Enable |
| operation type | uint8_t | 0x01: Read 0x02: Write 0x03: Kill 0x04: Lock 0x05: Access Password 0x0B: Multi-word Write |
| access parameter | variable | Refer the respective table for the operation type Read, Write, Lock, Kill & Access Password |
| criteria | uint8_t | Not supported. Set this value to 0 |
| stop count | unt16_t | Not supported. Set this value to 0 |
For more details on access parameters, please refer https://www.gs1.org/sites/default/files/docs/epc/uhfc1g2_1_2_0-standard-20080511.pdf 6.3.2 Tag Selection, Inventory, and access
Read
| Field | Data Type | Notes |
|---|---|---|
| memory bank | uint8_t | 0: Reserved 1: EPC 2: TID 3: User |
| word pointer | uint16_t | starting address pointer |
| word count | uint8_t | No of words to read |
| word count expected | uint8_t | Should be set to word count until word count is 0. if Word count is 0, the number of expected words should be included |
Write
| Field | Data Type | Notes |
|---|---|---|
| memory bank | uint8_t | 0: Reserved 1: EPC 2: TID 3: User |
| word pointer | uint16_t | starting address pointer |
| data | uint16_t | word to be written |
Kill
| Field | Data Type | Notes |
|---|---|---|
| password | uint32_t | |
| Recommissioning bits | uint8_t |
Lock
| Field | Data Type | Notes |
|---|---|---|
| mask action fields | uint32_t | Refer Mark and Action table below |
Mask
| Kill Password(Bits 19, 18) | Kill Password(Bits 17, 16) | EPC Memory(Bits 15, 14) | TID Memory(Bits 13, 12) | User Memory (Bits 11, 10) |
|---|---|---|---|---|
| skip/write | skip/write | skip/write | skip/write | skip/write |
Action
| Kill Password(Bits 9, 8) | Kill Password(Bits 7, 6) | EPC Memory(Bits 5, 4) | TID Memory(Bits 3, 2) | User Memory (Bits 1, 0) |
|---|---|---|---|---|
| Password read/write, permalock | Password read/write, permalock | Password Write, permalock | Password Write, permalock | Password Write, permalock |
Access Password
This parameter needs to be set if there is non-zero access password set in the tag
| Field | Data Type | Notes |
|---|---|---|
| password | uint32_t | Access password set the tag |
Multi-word Write
| Field | Data Type | Notes |
|---|---|---|
| memory bank | uint8_t | 0: Reserved 1: EPC 2: TID 3: User |
| word pointer | uint16_t | starting address pointer |
| word count | uint8_t | word count |
| data | uint16_t[] | word to be written |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Regulatory Channel
Sets Regulatory Channel. Channel must be set based on the local regulatory guidelines with the respect to the country where the device is operating.
Command Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0801 - 0x0832 (50 channels allowed) |
| enable | uint8_t | 0: Disable 1: Enable |
| frequency in KHz | uint32_t | Specifies the frequency in KHz of this channel |
| max power value | uint16_t | Maximum allowed transmit power in tenths of dB |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Regulatory Timing
Sets Regulatory Timing. This timings are reset when stop/start command issued.
Command Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0883 |
| max on time | uint16_t | CW On time in milliseconds |
| max off time | uint16_t | CW Off time in milliseconds |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Regulatory LBT
Sets Regulatory Listen Before Talk (LBT)
Command Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0884 |
| enable | uint8_t | 0: Disable 1: Enable |
| Threshold | int16_t | in tenths of dB (i.e. -90dBm is -900 [0xFC7C]) |
| bandwidth index | uint8_t | |
| measurement time | uint8_t | Indicates duration of time in milliseconds to "listen". only the value of 5 will be accepted |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
Hop Per Round
Sets Hop per round enabled or not. Specifies hop frequency only after regulatory dwell time expires or hop every inventory round
Command Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0885 |
| enable | uint8_t | 0: Disable 1: Enable |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
GPIO Direction
Set the GPIO direction of the GPIO pin.
Command Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0xD001 |
| gpio direction bit mask | uint8_t | GPIO direction |
GPIO direction bit mask
| Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
|---|---|---|---|---|---|---|---|
| N/A | N/A | Set GPIO2 | Set GPIO1 | N/A | N/A | Direction for GPIO 2 | Direction for GPIO 1 |
| Ignored | Ignored | 1: use value in bit 1 to set the direction of GPIO2 0: maintain gpio direction | 1: use value in bit 0 to set the direction of GPIO1 0: maintain gpio direction | Ignored | Ignored | 1: Input 0: Output | 1: Input 0: Output |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
GPIO Value
Sets the GPIO value of the GPIO pin.
Command Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0xD001 |
| gpio value bit mask | uint8_t | GPIO value |
GPIO Value bit mask
| Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
|---|---|---|---|---|---|---|---|
| Set GPIO4 | Set GPIO3 | Set GPIO2 | Set GPIO1 | Value for GPIO 4 | Value for GPIO 3 | Value for GPIO 2 | Value for GPIO 1 |
| 1: use value in bit 1 to set the value of GPIO2 0: maintain gpio value | 1: use value in bit 1 to set the value of GPIO2 0: maintain gpio value | 1: use value in bit 1 to set the value of GPIO2 0: maintain gpio value | 1: use value in bit 0 to set the value of GPIO1 0: maintain gpio value | 1:High 0: Low | 1:High 0: Low | 1:High 0: Low | 1:High 0: Low |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
GPIO Start Trigger
Set the GPIO start Trigger settings. This parameter configures the start triggering the radio. When GPIOs are enabled, after a "start" command has been issued, the Radio will wait until the start condition is met before starting the operations. Issuing a "stop" command will exit the "start" command as usual.
The user should be careful to enable GPIOs that are set to be inputs using GPIO direction parameter. Trying to enable a GPIO that is an output will not result an error. When the GPI trigger happens and the GPIO changes to the value, a GPIO Info Packet will be sent if this packet is enabled.
The hold time is minimal amount of time that the GPIO needs to be matching the condition to trigger the start.
Command Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0xD001 |
| gpio bit mask | uint8_t | GPIO bit mask |
| gpio1 hold time | uint16_t | Hold time in milliseconds |
| gpio2 hold time | uint16_t | Hold time in milliseconds |
GPIO bit mask
| Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
|---|---|---|---|---|---|---|---|
| N/A | N/A | Enable Start Trigger on GPIO2 | Enable Start Trigger on GPIO1 | N/A | N/A | Start Condition for GPIO 2 | Start Condition for GPIO 1 |
| Ignored | Ignored | 1: use value in bit 1 to set the start condition of GPIO2 0: disable GPIO2 start trigger | 1: use value in bit 0 to set the start condition of GPIO1 0: disable GPIO1 start trigger | Ignored | Ignored | 1: High 0: Low | 1: High 0: Low |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0801 |
| error code | uint8_t | 0x00: Success negative value refers to error |
get
This command allows the host to retrieve the value of parameters in the RE40
Command
| SOF | Command Type | Payload length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0802 | 0x0002 | Parameter ID | xx xx |
Payload
| Field Name | Length (bytes) | Notes |
|---|---|---|
| Parameter ID | 2 | Parameter section contains more details |
Response
For the get commands, the Radio will send one response packet and ACK packet.
Response Packet
| SOF | Response Type | Payload Length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0811 | variable | variable | xx xx |
ACK Packet
| SOF | Response Type | Payload Length | Command Type | Error Code | CRC |
|---|---|---|---|---|---|
| 0xAAAB | 0x0801 | 0x0003 | 0x0802 | xx | xx xx |
Error Codes
Non-negative value (>=0) of Error Code indicates successful completion of the command.
| Error Code | Description |
|---|---|
| 0xf6 (-10) | When the Parameter ID to get is not supported |
Parameters
Firmware Version
Gets the firmware version
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0001 | Gets firmware version |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| major version | uint8_v |
| minor version | uint8_t |
| build | uint8_t |
| flag | uint8_t |
Development Version
Gets the development build version string
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0002 | Gets development version |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| development version | ASCII string |
Up Time
Gets the current uptime in microseconds (uS)
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0003 | Gets Current uptime |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| current uptime | uint64_t |
Response Packet Enable Status
Gets the status of a particular response packet type.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0004 | Gets enable or disable status of response packet type |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| Enable | uint64_t |
Radio Stop Conditions
Gets the conditions to end "start" command
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0005 | Gets radio stop conditions |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| time in milliseconds | uint32_t |
| Antenna loops | uint16_t |
| Tag count | uint16_t |
| GPIO bit mask | uint8_t |
| GPIO1 hold time in milliseconds | uint16_t |
| GPIO2 hold time in milliseconds | uint16_t |
GPIO bit mask
| Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
|---|---|---|---|---|---|---|---|
| N/A | N/A | Enable Start Trigger on GPIO2 | Enable Trigger on GPIO1 | N/A | N/A | Start Condition for GPIO 2 | Start Condition for GPIO 1 |
| Ignored | Ignored | 1: use value in bit 1 to set the start condition of GPIO2 0: disable GPIO2 start trigger | 1: use value in bit 0 to set the start condition of GPIO1 0: disable GPIO1 start trigger | Ignored | Ignored | 1: High 0: Low | 1: High 0: Low |
RF Board Version
Gets RF Board Version
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0006 | Gets RF board version |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| parameter id | uint16_t | |
| RF Board Version | uint16_t |
RF Board Version
Gets RF Board Version
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0006 | Gets RF board version |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| parameter id | uint16_t | |
| RF Board Version | uint16_t |
Digital Board Version
Gets Digital Board Version
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0007 | Gets Digital board version |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| parameter id | uint16_t | |
| Digital Board Version | uint16_t |
FPGA Version
Gets FPGA Version
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0008 | Gets FPGA version |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| parameter id | uint16_t | |
| FPGA Version | uint16_t |
Model Info
Gets the Model Info
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x000D | Gets Model Info String |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| model info string | ASCII string |
Model Name
Gets the Model Name
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x000E | Gets Model Name String |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| model name | ASCII string |
Product Revision String
Gets the Product Revision String
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x000F | Gets Product Revision String |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| product revision string | ASCII string |
Product Bootloader String
Gets the Bootloader revision String
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0010 | Gets Bootloader revision |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| product revision string | ASCII string |
Number of Antennas
Gets the Number of Antennas
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0011 | Gets Number of Antennas |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| Number of Antennas | uint32_t |
Manufacture Date
Gets the manufacture date of the device
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0012 | Gets Manufacture date |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| manufacture date | uint32_t |
| Bits 31-16 | Bits 15-8 | Bits 7-0 |
|---|---|---|
| Year | Month | Day |
Serial Number
Gets device serial number
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0013 | Gets device serial number |
Response Payload
| Field | Data Type |
|---|---|
| parameter id | uint16_t |
| device serial number | ASCII string |
Select
Gets C1G2 select command. This parameter selects a particular tag population based on user defined criteria.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0101 | Gets Select command parameters |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0101 |
| enable | uint8_t | 0: Disable 1: Enable |
| target | uint8_t | 0: Inventoried (S0) 1: Inventoried (S1) 2: Inventoried (S2) 3: Inventoried (S3) 4: SL |
| action | uint8_t | Refer Action parameter Table |
| memory bank | uint8_t | 1: EPC 2: TID 3: User |
| pointer | uint16_t | starting bit address |
| length | uint8_t | Mask length in bits |
| mask | uint8_t[] | Mask value |
| truncate | uint16_t | 0: Disable 1: Enable |
Action Parameter
If target is set to 4 (SL), the tag response to action parameter
| Action | Matching | Non-Matching |
|---|---|---|
| 000 | assert SL | deassert SL |
| 001 | assert SL | do nothing |
| 010 | do nothing | deassert SL |
| 011 | negate SL | do nothing |
| 100 | deassert SL | assert SL |
| 101 | deassert SL | do nothing |
| 110 | do nothing | assert SL |
| 111 | do nothing | negate SL |
If target is set to 0 - 3 (Session S0-S3), the tag response to action parameter
| Action | Matching | Non-Matching |
|---|---|---|
| 000 | Inventoried -> A | Inventoried -> B |
| 001 | Inventoried -> A | do nothing |
| 010 | do nothing | Inventoried -> B |
| 011 | (A->B, B->A) | do nothing |
| 100 | Inventoried -> B | Inventoried -> A |
| 101 | Inventoried -> B | do nothing |
| 110 | do nothing | Inventoried -> A |
| 111 | do nothing | (A->B, B->A) |
Query
Gets C1G2 query command. Query initiates and specifies an inventory round.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0101-0x0104 | Gets Query command parameter |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0201 - 0x0204 (4 Query Parameter are allowed) |
| enable | uint8_t | 0: Disable 1: Enable |
| protocol | uint8_t | 1: C1G2 |
| sel | uint8_t | Chooses which Tags respond to the query 1: All 2: ~SL 3: SL |
| session | uint8_t | Session for the inventory round 0: S0 1: S1 2: S2 3: S3 |
| target | uint8_t | Selects whether Tags whose inventoried flag is A or B participate in the inventory round 0: A 1: B |
| Q | uint16_t | Sets the number of slots in the round. Tags pick a random value in the range (0, 2Q - 1). The possible values of Q are 0-15. |
Access
Gets C1G2 access command. The set of access commands includes read, write, kill and lock.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0301-0x0305 | Gets Access command parameter |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0301 - 0x0305 (5 Access Parameter are allowed) |
| enable | uint8_t | 0: Disable 1: Enable |
| Operation Type | uint8_t | 0x01: Read 0x02: Write 0x03: Kill 0x04: Lock 0x05: Access Password 0x0B: Multi-word Write |
Read
| Field | Data Type | Notes |
|---|---|---|
| memory bank | uint8_t | 0: Reserved 1: EPC 2: TID 3: User |
| word pointer | uint16_t | starting address pointer |
| word count | uint8_t | No of words to read |
| word count expected | uint8_t | Should be set to word count until word count is 0. if Word count is 0, the number of expected words should be included |
Write
| Field | Data Type | Notes |
|---|---|---|
| memory bank | uint8_t | 0: Reserved 1: EPC 2: TID 3: User |
| word pointer | uint16_t | starting address pointer |
| data | uint16_t | word to be written |
Kill
| Field | Data Type | Notes |
|---|---|---|
| password | uint32_t | |
| Recommissioning bits | uint8_t |
Lock
| Field | Data Type | Notes |
|---|---|---|
| mask action fields | uint32_t | Refer Mark and Action table below |
Mask
| Kill Password(Bits 19, 18) | Kill Password(Bits 17, 16) | EPC Memory(Bits 15, 14) | TID Memory(Bits 13, 12) | User Memory (Bits 11, 10) |
|---|---|---|---|---|
| skip/write | skip/write | skip/write | skip/write | skip/write |
Action
| Kill Password(Bits 9, 8) | Kill Password(Bits 7, 6) | EPC Memory(Bits 5, 4) | TID Memory(Bits 3, 2) | User Memory (Bits 1, 0) |
|---|---|---|---|---|
| Password read/write, permalock | Password read/write, permalock | Password Write, permalock | Password Write, permalock | Password Write, permalock |
Access Password
This parameter needs to be set if there is non-zero access password set in the tag
| Field | Data Type | Notes |
|---|---|---|
| password | uint32_t | Access password set the tag |
Antenna
Gets Antenna parameter
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0401 - 0x0404 (4 antenna allowed) | 0x0401-Antenna 1 0x0402-Antenna 2 0x0403-Antenna 3 0x0404-Antenna 4 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0401 - 0x0404 (4 antenna allowed) |
| enable | uint8_t | 0: Disable 1: Enable |
| transmit port | uint16_t | Antenna port id. Both transmit and receipt port should be same |
| receive port | uint16_t | Antenna port id. Both transmit and receipt port should be same |
| stop condition type | uint8_t | 1: inventory cycle 2: dwell time (millisecond) |
| stop value | uint16_t | |
| transmit power | uint16_t | in 0.1 dBm (270 = 27dBm) |
| select bit mask | uint32_t | RFU. This must be set to 0xffffffff. |
| query index | uint8_t | Index to the query parameter to be used. For each antenna, there should be separate query parameter respectively. |
| access bit mask | uint64_t | RFU. This must be set to 0xffffffffffffffff |
| link profile index | uint16_t | 202: M=4/240, PIE=2, Tari=25us 808: M=2/320, PIE=2, Tari=18.8us 908: M=4/320, PIE=2, Tari=18.8us |
Regulatory Channel
Gets Regulatory Channel
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0801 - 0x0832 (Max of 50 channels) |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0801 - 0x0832 (50 channels allowed) |
| enable | uint8_t | 0: Disable 1: Enable |
| frequency in KHz | uint32_t | Specifies the frequency in KHz of this channel |
| max power value | uint16_t | Maximum allowed transmit power in tenths of dB |
Regulatory Timing
Gets Regulatory Timing. This timings are reset when stop/start command issued.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0883 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0883 |
| max on time | uint16_t | CW On time in milliseconds |
| max off time | uint16_t | CW Off time in milliseconds |
Regulatory LBT
Gets Regulatory Listen Before Talk (LBT)
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0884 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0884 |
| enable | uint8_t | 0: Disable 1: Enable |
| Threshold | int16_t | in tenths of dB (i.e. -90dBm is -900 [0xFC7C]) |
| bandwidth index | uint8_t | |
| measurement time | uint8_t | Indicates duration of time in milliseconds to "listen". only the value of 5 will be accepted |
Hop Per Round
Gets Hop per round enabled or not
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0885 | Specifies hop frequency only after regulatory dwell time expires or hop every inventory round |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0885 |
| enable | uint8_t | 0: Disable 1: Enable |
PA Temperature
Gets PA Temperature sensor measurement in degree Celsius.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x2100 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x2100 |
| PA Temperature | uint16_t | PA temperature measurement in degree Celsius |
GPIO Direction
Get the GPIO direction of the GPIO pin.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0xD001 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0xD001 |
| gpio direction bit mask | uint8_t | GPIO direction |
GPIO direction bit mask
| Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
|---|---|---|---|---|---|---|---|
| N/A | N/A | N/A | N/A | N/A | N/A | Direction for GPIO 2 | Direction for GPIO 1 |
| Ignored | Ignored | Ignored | Ignored | Ignored | Ignored | 1: Input 0: Output | 1: Input 0: Output |
GPIO Value
Get the GPIO value of the GPIO pin.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0xD002 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0xD001 |
| gpio value bit mask | uint8_t | GPIO value |
GPIO Value bit mask
| Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
|---|---|---|---|---|---|---|---|
| N/A | N/A | N/A | N/A | Value for GPIO 4 | Value for GPIO 3 | Value for GPIO 2 | Value for GPIO 1 |
| Ignored | Ignored | Ignored | Ignored | 1: High 0: Low | 1: High 0: Low | 1: High 0: Low | 1: High 0: Low |
GPIO Start Trigger
Get the GPIO start Trigger settings.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0xD003 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0xD001 |
| gpio bit mask | uint8_t | GPIO bit mask |
| gpio1 hold time | uint16_t | Hold time in milliseconds |
| gpio2 hold time | uint16_t | Hold time in milliseconds |
GPIO bit mask
| Bit 7 | Bit 6 | Bit 5 | Bit 4 | Bit 3 | Bit 2 | Bit 1 | Bit 0 |
|---|---|---|---|---|---|---|---|
| N/A | N/A | Enable Start Trigger on GPIO2 | Enable Trigger on GPIO1 | N/A | N/A | Start Condition for GPIO 2 | Start Condition for GPIO 1 |
| Ignored | Ignored | 1: use value in bit 1 to set the start condition of GPIO2 0: disable GPIO2 start trigger | 1: use value in bit 0 to set the start condition of GPIO1 0: disable GPIO1 start trigger | Ignored | Ignored | 1: High 0: Low | 1: High 0: Low |
Tag Read Count
Get the number of tags read since the last "start" command was issued.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0xE500 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0xD001 |
| tags read count since "start" | uint32_t |
setNVM
This command allows to set the host to configure a NVM (non-volatile) parameter in Radio. This command will not be processed while another command is being processed.
Command
| SOF | Command Type | Payload length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0803 | xx xx | Variable | xx xx |
Payload
| Field Name | Length (bytes) | Notes |
|---|---|---|
| Parameter ID | 2 | Parameter section contains more details |
| Value | Variable | Depends on the data type of the parameter |
Response (ACK Packet)
| SOF | Response Type | Payload Length | Command Type | Error Code | CRC |
|---|---|---|---|---|---|
| 0xAAAB | 0x0801 | 0x0003 | 0x0803 | xx | xx xx |
Error Codes
Non-negative value (>=0) of Error Code indicates successful completion of the command.
| Error Code | Description |
|---|---|
| 0xf9 (-7) | When the Parameter ID to set is not supported |
| 0xf8 (-8) | When the value to set the parameter ID is not allowed |
| 0xf7 (-9) | When the access type to set is not supported |
Parameters
User NVM
Sets the User Configurable NVM.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0201 | 0x040C |
| user nvm | uint32_t | Developer can store for the Host System to use as needed |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0803 |
| error code | uint8_t | 0x00: Success negative value refers to error |
UART settings
Sets the User Configurable NVM.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0201 | 0x0412 |
| user nvm | uint32_t | Developer can store for the Host System to use as needed |
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0412 | |
| baud rate | uint32_t | 921600 | 115200 230400 460800 921600 (default) |
| parity | uint32_t | 0 | 0: None (default) 1: Odd 2: Even |
| Stop bit | uint32_t | 1 | 1: 1 stop bit(default) 2: 2 stop bit |
| Data Bits | uint32_t | 8 | 8 ( default) |
Response Payload
| Field | Data Type | Value |
|---|---|---|
| command type | uint16_t | 0x0803 |
| error code | uint8_t |
getNVM
This command allows the host to retrieve the value of NVM (non-volatile) parameters in the Radio. This command will not be processed while another command is being processed.
Command
| SOF | Command Type | Payload length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0804 | 0x0002 | Parameter ID | xx xx |
Payload
| Field Name | Length (bytes) | Notes |
|---|---|---|
| Parameter ID | 2 | Parameter section contains more details |
Response
For the getnvm commands, the Radio will send one response packet and ACK packet.
Response Packet
| SOF | Response Type | Payload Length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0811 | variable | variable | xx xx |
ACK Packet
| SOF | Response Type | Payload Length | Command Type | Error Code | CRC |
|---|---|---|---|---|---|
| 0xAAAB | 0x0801 | 0x0003 | 0x0804 | xx | xx xx |
Error Codes
Non-negative value (>=0) of Error Code indicates successful completion of the command.
| Error Code | Description |
|---|---|
| -10 | When the Parameter ID to get is not supported |
Parameters
User NVM
Get the user configured NVM data.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x040C |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x040C |
| user configurable NVM | uint32_t | Store 32bit data for the host to use as needed |
UART settings
Get the UART settings.
Command Payload
| Field | Data Type | Value | Notes |
|---|---|---|---|
| parameter id | uint16_t | 0x0412 |
Response Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | 0x0412 |
| baud rate | uint32_t | 115200 230400 460800 921600 (default) |
| parity | uint32_t | 0: None (default) 1: Odd 2: Even |
| Stop bit | uint32_t | 1: 1 stop bit(default) 2: 2 stop bit |
| Data Bits | uint32_t | 8 ( default) |
start
This command starts operation of the radio.
Command
| SOF | Command Type | Payload length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0809 | 0x0000 | N/A | 0x606D |
Payload
Not Applicable
Response (s)
This section contains the details response packets.
The response packets which are enabled as part of set command using Response Packet Type will be reported when the respective event occurs.
| SOF | Response Type | Payload Length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | uint16_t enabled response packet | variable | variable | xx xx |
Antenna Info Timed
Reports when the radio changes antennas
Header
| Field | Value |
|---|---|
| Response Type | 0x0B0E |
| Payload Length | 0x000D |
Payload
| Field | Data Type | Notes |
|---|---|---|
| antenna parameter id | uint16_t | |
| transmit port | uint16_t | refers antenna id |
| receive port | uint16_t | refers antenna id |
| timestamp | uint64_t | current up time of the Radio |
LBT Info
Each time the Radio changes channel when LBT is enabled, it listens on the channel for a duration to determine if the channel is free or not. This packet summarizes the result of listening.
Header
| Field | Value |
|---|---|
| Response Type | 0x0A89 |
| Payload Length | 0x0005 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| time | uint32_t | duration of time for "listening" in microseconds |
| frequency | uint32_t | frequency in KHz at which RF measurement was performed |
| rssi | int8_t | signed 8-bit value representing the RSSI of RF measurement at this frequency (in tenths of dB) |
| result | uint8_t | 0: busy channel 1: free channel |
Carrier On Timed
This packet will be transmitted after the radio turns the carrier on.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B0F |
| Payload Length | 0x0010 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| forward power | uint16_t | In 0.1 dBm measured by the forward power detector |
| reverse power | uint16_t | In -0.1 dBm measured by the reverse power detector. For example, -55.3 dBm reverse power will return 553) |
| frequency | uint32_t | Frequency in KHz |
| timestamp | uint64_t | Current uptime of the RE40 (in uS) |
Antenna Disconnect Alarm
This packet sends notification of an attempt to transmit on a physical antenna that is disconnected.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B81 |
| Payload Length | 0x0002 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | Antenna parameter id |
Antenna Connect Alarm
This packet sends notification of an attempt to transmit on a physical antenna that is connected for the first time or after previously been reported as being disconnected.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B91 |
| Payload Length | 0x0002 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| parameter id | uint16_t | Antenna parameter id |
Channel Power Limit Information
This packet will be transmitted when the antenna target power exceeds the allowable power that is particular to the channel.
The regulatory channel parameters allow power to be limited on per-channel basis. This event indicates that the requested power is higher than this limit.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B13 |
| Payload Length | 0x0001 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| channel number | uint8_t | channel which exceeds the channel power limit |
PA Temperature High Alarm
This packet sends notification of Power Amplifier temperature detected exceeding above limit. This event is due to temperature at the power amplifier
Header
| Field | Value |
|---|---|
| Response Type | 0x0B85 |
| Payload Length | 0x0001 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| temperature | uint8_t | PA temperature measured in degree Celsius |
PA Temperature Critical Alarm
This packet sends notification of Power Amplifier temperature detected exceeding safe limit. This event is due to temperature at the power amplifier
Header
| Field | Value |
|---|---|
| Response Type | 0x0B86 |
| Payload Length | 0x0001 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| temperature | uint8_t | PA temperature measured in degree Celsius |
PA Temperature Low Alarm
This packet sends notification of Power Amplifier temperature detected below the limit. This event is due to temperature at the power amplifier
Header
| Field | Value |
|---|---|
| Response Type | 0x0B87 |
| Payload Length | 0x0001 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| temperature | uint8_t | PA temperature measured in degree Celsius |
Over Temperature Protection
This packet sends the notification that Radio has enabled with temperature protection. If enabled, this packet indicates that the RE40 has started the duty cycle process to protect it from going over temperature.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B90 |
| Payload Length | 0x0001 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| on / off | uint8_t | 0: over temperature protection disabled 1: over temperature protection enabled |
Forward Power High Alarm
This packet sends the notification of Forward Power above tolerance threshold. Detection of Forward Power falling too high outside the acceptable tolerance of the target power level at the antenna port. Radio may trigger this event transiently (overshoot) or inability to achieve power level at all.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B88 |
| Payload Length | 0x0005 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| antenna parameter Id | uint16_t | Antenna parameter ID which causes this event |
| type | uint8_t | Specify transient or final level error |
| power level | uint16_t | power level measurement in tenths of dB |
Forward Power Low Alarm
This packet sends the notification of Forward Power below tolerance threshold. This indicates too low Forward Power.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B89 |
| Payload Length | 0x0003 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| type | uint8_t | Specify transient or final level error |
| power level | uint16_t | power level measurement in tenths of dB |
Reverse Power High Alarm
This packet sends the notification of Reverse Power above tolerance threshold.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B8A |
| Payload Length | 0x0002 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| power level | uint16_t | power level measurement in tenths of dB |
Tag Info (custom)
This packet sends the tag information. The tag fields are reported based on the bit masks set using Tag Info fields parameter
Header
| Field | Value |
|---|---|
| Response Type | 0x0805 |
| Payload Length | Variable |
Payload
| Field | Data Type | Notes |
|---|---|---|
| epc data | variable | First Byte: 0x8D Contains EPC |
| antenna id | uint8_t uint16_t | First Byte: 0x81 Antenna Parameter id |
| rssi | uint8_t int8_t | First Byte: 0x86 Signed representation of the rssi value for this read in dBm |
| channel id | uint8_t uint8_t | First Byte: 0x87 Contains Channel Index |
| last seen up time | uint8_t uint64_t | First Byte: 0x85 Uptime of the RE40 in microseconds for most recent time this was read |
| tag seen count | uint8_t uint16_t | First Byte: 0x88 The subsequent byte will be set to 1 because the tag will only be read once per inventory round |
| pc bits | uint8_t uint16_t | First Byte: 0x8C PC bits of this tag read |
| xpc1 bits | uint8_t uint16_t | First Byte: 0x93 XPC-1 bits of this tag read if it was transmitted |
| xpc2 bits | uint8_t uint16_t | First Byte: 0x94 XPC-2 bits of this tag read if it was transmitted |
| crc bits | uint8_t uint16_t | First Byte: 0x8B CRC bits of this tag read |
| phase | uint8_t uint16_t | First Byte: 0xFF phase value |
Access Info
This packet will be sent out after an access operation is completed.
Header
| Field | Data Type | Value |
|---|---|---|
| Response Type | uint16_t | 0x0B0C |
| Payload Length | uint16_t | variable |
Payload
| Field | Data Type | Notes |
|---|---|---|
| access id | uint8_t | Access parameter id |
| access result | uint8_t | 0x00: Success 0x01: Error, access info contains error code 0x02: No response 0x03: CRC Error 0x04: Error, finding the end of a "zero" length read response 0x06: Other failure 0x07: Barker Error 0x08: Length bit parity error 0x21: Access stopped due to regulatory timeout 0x22: Access stopped due to antenna timeout 0x23: Access stopped due to radio dwell timeout 0x24: Access stopped due to IO stop 0x25: Access stopped due to stop request 0x2F: Access stopped due to unknown issue "in process" response 0x40: Still working 0x48: Successfully stored response without length 0x49: Successfully stored response with length 0x4A: Successfully sent response without length 0x4B: Successfully sent response with length 0x4C: Error code stored response without length 0x4D: Error code stored response with length 0x4E: Error code sent response without length 0x4F: Error code sent response length 0x82: reqRN - no response 0x83: reqRN - CRC failure |
| access info | variable | The data if any from the access operation read data or the error code |
Inventory Round End
After the inventory round completes (before next query), this packet will be reported to the host to give the summary of statistics for the round.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B0A |
| Payload Length | 0x0009 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| empty slots | uint16_t | |
| crc goods | uint16_t | |
| crc bads | uint16_t | |
| collided slots | uint16_t | |
| end code | uint8_t | 0x01: ended normally 0x02: ended prematurely due to regulatory timeout 0x04: antenna timeout 0x08: radio timeout 0x10: IO stop 0x20: tag stop count 0x40: host request 0x80: access or kill failure 0x81: too many bad CRCs |
Carrier Off Timed
After the radio turns carrier off, RE40 will transmit this packet.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B06 |
| Payload Length | 0x0009 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| end condition | uint8_t | 0x01: Normal 0x02: Carrier off due to regulatory timeout 0x04: Carrier off due to antenna stop condition 0x08: Carrier off due to radio timeout 0x10: Carrier off due to I/O activity 0x20: Carrier off due to tag count stop condition 0x40: Carrier off due to host request 0x80: Carrier off due to access or kill operation failure |
| time stamp | uint64_t | current uptime of the RE40 (in microseconds) |
Enhanced Start Info
This packet gives statistics for the activity since the "start" command issued. This packet comes immediately before the ACK packet to the start command.
Header
| Field | Value |
|---|---|
| Response Type | 0x0A91 |
| Payload Length | 0x0010 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| total time | uint64_t | duration from the beginning of start command in microseconds |
| total tags read | uint32_t | total number of tags read from the beginning of the start command (included bad crcs) |
| total inventory rounds | uint16_t | total number of inventory rounds run from the beginning of the start command (number of queries transmitted) |
| end cause | uint16_t | 0x0001: Stopped due to host request 0x0002: Stopped due to reaching antenna loop count stop condition 0x0004: Stopped due to reaching dwell time stop condition 0x0008: Stopped due to reaching tag count stop condition 0x0010: Stopped due to GPIO stop condition 0x0020: Stopped due to error 0x0040: Stopped due to no enabled antennas 0x0080: Stopped due to reaching critical temperature 0x0100: Stopped due to antenna disconnect 0x0200: Stopped because transmission failed 0x0400: Stopped due to radio misconfiguration |
Echo Threshold Alarm
This packet sends the notification that the echo canceller was not able to cover the acceptable power levels into the receiver.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B8B |
| Payload Length | 0x0000 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| Not Applicable |
GPI Info
This packet will be sent when GPIO triggering is enabled and the GPIO trigger condition was met.
Header
| Field | Value |
|---|---|
| Response Type | 0x0B08 |
| Payload Length | 0x000A |
Payload
| Field | Data Type | Notes |
|---|---|---|
| gpio number | uint8_t | The GPIO that changed values |
| value | uint8_t | Current value of GPIO 0: Low 1: High |
| timestamp | uint64_t | The current uptime of RE40 in microseconds |
LMAC Alarm
This packet will report when there is an issue in LMAC layer
Header
| Field | Value |
|---|---|
| Response Type | 0x0B8C |
| Payload Length | 0x0004 |
Payload
| Field | Data Type | Notes |
|---|---|---|
| LMAC error line | uint32_t | The line of the code in the LMAC Layer that produced the issue |
Response (ACK Packet)
| SOF | Response Type | Payload Length | Command Type | Error Code | CRC |
|---|---|---|---|---|---|
| 0xAAAB | 0x0801 | 0x0003 | 0x0809 | xx | xx xx |
Error Codes
Non-negative value (>=0) of Error Code indicates successful completion of the command.
stop
This command stops the currently ongoing radio operation (if ongoing)
Command
| SOF | Command Type | Payload length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0808 | 0x0000 | N/A | 0x575D |
Payload
Not Applicable
####
| SOF | Response Type | Payload Length | Command Type | Error Code | CRC |
|---|---|---|---|---|---|
| 0xAAAB | 0x0801 | 0x0003 | 0x0808 | xx | xx xx |
Non-negative value (>=0) of Error Code indicates successful completion of the command.
Error Codes
Generic error codes are applicable
sleep
This command puts the Radio into a low power mode. It can only wake up when the H_WAKE goes high. This command will not be honored while another command is ongoing.
Command
| SOF | Command Type | Payload length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x0815 | 0x0000 | N/A | 0x566F |
Payload
Not Applicable
Response
| SOF | Response Type | Payload Length | Command Type | Error Code | CRC |
|---|---|---|---|---|---|
| 0xAAAB | 0x0801 | 0x0003 | 0x0815 | xx | xx xx |
Error Codes
Non-negative value (>=0) of Error Code indicates successful completion of the command.
reboot
This command reboots RE40.
Command
| SOF | Command Type | Payload length | Payload | CRC |
|---|---|---|---|---|
| 0xAAAB | 0x08D5 | 0x0000 | N/A | 0x7098 |
Payload
Not Applicable
Response
| SOF | Response Type | Payload Length | Command Type | Error Code | CRC |
|---|---|---|---|---|---|
| 0xAAAB | 0x0801 | 0x0003 | 0x08D5 | xx | xx xx |
Error Codes
Non-negative value (>=0) of Error Code indicates successful completion of the command.
Firmware Update
This section covers how to upgrade the RE40 firmware. The following flow chart shows the sequence for firmware update.
1. Firmware Load Program
- Firmware Load will configure RE40 RFID module into firmware update mode.
- Command to be sent : 0xAA, 0xAB, 0x08, 0x10, 0x00, 0x00, 0xBD, 0x9F
- Expected Response: 0xaa 0xab 0x08 0x01 0x00 0x03 0x08 0x10 0x00 0xe9 0x32
- Once device respond back with response it will change its baud rate to 9600.
- Wait for 250ms for device to change its baud rate.
- Configure Host Baud rate to 9600.
2. Flash Program Command
- Flash Program will configure RE40 RFID module into firmware download mode.
- Command to be sent: 0x00,0x00,0x00,0x06,0xEE,0x04,0x00,0x46,0x44,0xFE,0x7E.
- Extra Zeros at the start will wake the device from power saver mode.
- Flash program is expected to work once it is in firmware update mode. So, there is no need to wait for response.
- Sleep for 150ms for device to enter firmware download mode.
3. Baud Rate Negotiation
9600 is minimum baud rate RE40 module supports, is not optimal for downloading larger files. Baud Rate Negotiation step will allow Host and RE40 module to agree on highest possible baud rate for faster downloads over serial
4. SSI Packet Encapsulation
- The DAT file contain a series of firmware update records which need to be downloaded one by one to RE40 RFID module .
- RE40 RFID module uses zebras SSI serial protocol for downloading firmware to device.
- Each parsed record must be encapsulated into SSI packet and response will also be encapsulated into SSI packet as shown below.
Sample Transaction
All contents copyright © 2021 Zebra Technologies Corp.