sl-rf800 communication protocol 2

8/10/2019 SL-RF800 Communication Protocol 2

1/14

SL-RF800 COMMUNICATION PROTOCOL

*Versions: RF_X6_V1.0

1.The data communication interface

Communication way: USB2.0 full speed interface, custom HID device communication interface

2. Data packet format

Sending data packet format

STX SELEN CM PM SE_DATAB ETX BCC

SELEN length range

BCC calculation range

Right return packet format

STX RELEN P CM PM RE_DATAB ETX BCC

RELEN length range

Wrong return packet format

STX RELEN N CM PM ERR_CD ETX BCC

Explanation:

[1]CM,The command code.

[2]PM,command parameter.

[3]SE_DATAB,packet sent.

[4]RE_DATAB,packet returned.

[5]ERR_CD,Error code.

[6]BCC,XOR checksum.Calculate way:XOR each data between STXincluding STXand ETXincluding

ETX


2/14

[7]P,=0x50.Indicates that the command executed successfully.[8]N,=0x4E.Indicates that the command

executed successfully.

[9]SELEN,sending data packet length.two bytes length.

[10]RELEN,return data packet length.two bytes length.

[11]STX,A start symbol.Fixed be0X02

[12]ETX,a over symbol. Fixed be0x03

3.Command list

Commandserial No.

Command Name CommandCode

commandparameter

Command function

1

Reset

reader-writer 0X30

0x30 Initialize thecard reader-writer and

upload the version number

2 RFID card S50

operation

0x32

0x30 Find cards

0x31 Read serial number

0x32 Verify password

0x33 Read data

0x34 Write data

0x35 Value operation Initialization

0x36 Value added operations

0x37 Decrease value operation

0x38 stop

3 RFID card S70

operation

0x33

0x30 Find cards


0x32 Verify password

0x33 Read data

0x34 Write data

0x35 Value operation Initialization0x36 Value added operations

0x37 Decrease value operation

0x38 stop

4

RFID card UL

Card operation

0x34

0x30 Find cards


0x32 Read card

0x33 Write card

0x34 stop

0x31 Verify password0x32 Read data


3/14

0x33 Write data

0x34 Read the state of fuse

0x35 fuse

0x36 Initialization certification

0x37 Check certification0x38 Change password

0x35 With a write data protection

0x36 Change password

5

Non contact CPU

card TYPEA

0x35 0x30 activation,and get reset information

0x31

0x32

0x33 APDU transfer command0x34

0x35 Stop living

6 15693 card

operation

0x36 0x30 Catalogue request

0x31 Read card

0x32 Write card

0x33 choose

0x34 Read system information

0x35 Read safe state

0x36 Write DSFID

0x37 Read AFI

0x3a Lock block

0x3b Lock AFI

0x3c Lock DSFID

7 Non-contact CPU

card TYPEB

0x48 0x30 activation,and get UID

0x31 APDU command transfer

8 The two

generation ID card

operation

0x49 0x30 get the 12 byte type code

0x31 get 8 byte UID

0x32 Stop living

4.Command detail Explanation


4/14

4.1:Initialize the card reader, no action

0x02 0x00 0x02 0x30 0x30 0x03 BCC

PM=0X32,Initialize the card reader, no action on card.

Return successfully

0x02 0x00 0x11 0x50 0x30 0x30 Version information 0x03 BCC

Version informationTTCE_M100_V2.3

successfully return

0x02 0x00 0x04 0x4E 0x30 0x30 ERR_CD 0x03 BCC

4.2:RFID card S50 operation command

4.21:find card

0x02 0x00 0x02 0x32 0x30 0X03 BCC

successfully return

0x02 0X00 0X03 0x50 0x32 0x30 0x03 BCC

successfully return

0x02 0X00 0X04 0x4E 0x32 0x30 ERR_CD 0X03 BCC

4.22:Read card serial No

0x02 0x00 0x02 0x32 0x31 0X03 BCC

successfully return

0x02 RELEN_H RELEN_L 0x50 0x32 0x31 Card serial No. 0x03 BCCsuccessfully return


4.2

3:verify password

0x02 0x00 0x0a 0x32 0x32 Block address Password type 6 byte

password

0X03 BCC

Explanation

password type:=0X30,verify KEYA;=0X31,verify KEYB

passwordLength is 6 byte sectors password.

successfully return

0x02 0x00 0x03 0x50 0x32 0x32 0x03 BCC

successfully return


4.24:read data

0x02 0x00 0x03 0x32 0x33 Block address 0X03 BCC

successfully return


5/14

0x02 0x00 0x13 0x50 0x32 0x33 16 byte data block 0x03 BCC

successfully return


4.25:write data0x02 0x00 0x13 0x3B 0x34 Block address 16 byte data block 0X03 BCC

successfully return

0x02 0x00 0x03 0x50 0x32 0x34 0x03 BCC

successfully return


4.2

6:value operationinitialization

0x02 0x00 0x13 0x32 0x35 Block address 16 byte data block 0X03 BCC

successfully return

0x02 0x00 0x03 0x50 0x32 0x35 0x03 BCC

successfully return


Explanationthe format of initialization value is below:

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Value /Value Value ADR /ADR ADR /ADR

Value: to initialize 4 byte value,Low byte note values in the former, the high byte in the post

/Value: To initialize the 4 byte value inversion

ADR: The block address initialization value

ADR= Sector number X 4 + block number (S50 Card No.0-15 sector,S70 card No.0 31 sector block value

operation calculate)

ADR= Sector No. 32 X 16 + 128 + block No. S70 card No. 32 39 sector block

value operation address calculate

/ADR: To initialize the value of the inverse of the block address

NoteThe last block of every sector cant be value operated.

For example:to initialize sector 5 block 0 to be 10,to write 16 byte sector block data

0x0A, 0x00, 0x00, 0x00, 0xF5 0xFF,0xFF ,0xFF , 0x0A, 0x00, 0x00, 0x00, 0x14, 0xEB, 0x14, 0xEB

S70 card initialization value of sector 39 block o is 10,to write 16 byte sector block data

0x0A, 0x00, 0x00, 0x00, 0xF5, 0xFF,0xFF ,0xFF , 0x0A, 0x00, 0x00, 0x00, 0xF0, 0x0F, 0XF0, 0x0F
http://app/ds/initializationhttp://app/ds/initialization


6/14

4.27:value added operation

0x02 0x00 0x07 0x32 0x36 Block address 4 byte value added data 0X03 BCC

Explanationvalue added data, low byte in the former, the high byte in the post.

successfully return

0x02 0x00 0x03 0x50 0x32 0x36 0x03 BCC

successfully return


4 byte hex Data is the increase value of the specified sector refers to the block value

low byte in the former, the high byte in the post..As increase 0x10,send 4 byte hex data is 0x10, 0x00,

0x00, 0x00

4.2

8:value decrease operation

0x02 0x00 0x07 0x32 0x37 Block address 4 byte value

decrease data

0X03 BCC

Explanationvalue decrease data,low byte in the former, the high byte in the post.

successfully return

0x02 0x00 0x03 0x50 0x32 0x37 0x03 BCC

successfully return


4 byte hex Data is the increase value of the specified sector refers to the block value

low byte in the former, the high byte in the post..

If to decrease 0x10,the data of 4 byte hex will be sent 0x10, 0x00, 0x00, 0x00

3:RFID card S70 operation

31:find card

0x02 0x00 0x02 0x33 0x30 0X03 BCC

successfully return

0x02 0X00 0X03 0x50 0x33 0x30 0x03 BCC

successfully return


32:read card serial No.

0x02 0x00 0x02 0x33 0x31 0X03 BCC

successfully return


7/14

0x02 0X00 0X07 0x50 0x33 0x31 4 byte card serial No. 0x03 BCC

unsuccessfully return


33:verify password0x02 0x00 0x0A 0x33 0x32 Block

address

Password

type

6 byte password 0X03 BCC

Successfully return

0x02 0x00 0x03 0x50 0x33 0x32 0x03 BCC

Unsuccessfully return


34:read data

0x02 0x00 0x03 0x33 0x33 Block address 0X03 BCC

Successfully return

0x02 0x00 0x13 0x50 0x33 0x33 16 byte data block 0x03 BCC



3

5:write data

0x02 0x00 0x13 0x33 0x34 Block address 16 byte data

block

0X03 BCC

successfully return

0x02 0x00 0x03 0x50 0x33 0x34 0x03 BCC



36:initialize value operation

0x02 0x00 0x13 0x33 0x35 Block address 16 byte data

block

0X03 BCC

successfully return

0x02 0x00 0x03 0x50 0x33 0x35 0x03 BCC



the format of initialization value is

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Value /Value Value ADR /ADR ADR /ADR

Value: to initialize 4 byte value,Low byte note values in the former, the high byte in the post

/Value: To initialize the 4 byte value inversion

ADR: The block address initialization valueADR= sector No X 4 + block No (S50 Card No.0-15 sector,S70 card No.0 31 sector block


8/14

value operation calculate)

ADR= sector No 32 X 16 + 128 + block No S70 card No.32 39 sector block value

operation calculate

/ADR: To initialize the value of the inverse of the block address

NoteThe last block of every sector cant be value operated.For example:to initialize sector 5 block 0 to be 10,to write 16 byte sector block data

S70 card initialization value of sector 39 block o is 10,to write 16 byte sector block data

0x0A, 0x00, 0x00, 0x00, 0xF5, 0xFF,0xFF ,0xFF , 0x0A, 0x00, 0x00, 0x00, 0xF0, 0x0F, 0XF0, 0x0F

37:value added operation

0x02 0x00 0x07 0x33 0x36 block address 4 byte value added

data

0X03 BCC

Explanationvalue added data,Low bytenote values in the former, the high byte in the post.

successfully return

0x02 0x00 0x03 0x50 0x33 0x36 0x03 BCC



38:value decrease operation

0x02 0x00 0x07 0x33 0x37 block

address

4 byte value decrease

data

0X03 BCC

Explanation:value decrease data,Low byte note values in the former, the high byte in the post.

successfully return

0x02 0x00 0x03 0x50 0x33 0x37 0x03 BCC



4:RFID card UL card operation

41:find card

0x02 0x00 0x02 0x34 0x30 0X03 BCC

successfully return

0x02 0x00 0x03 0x50 0x34 0x30 0x03 BCC



42:read card serial No

0x02 0x00 0x02 0x34 0x31 0X03 BCC


9/14

successfully return

0x02 0x00 0x0a 0x50 0x34 0x31 7 byte serial No 0x03 BCC



43:read operation

0x02 0x00 0x03 0x34 0x32 block address 0X03 BCC

successfully return

0x02 0x00 0x13 0x50 0x34 0x32 16 byte data 0x03 BCC



44:write data

0x02 0x00 0x13 0x34 0x33 block address 16 byte data 0X03 BCC

successfully return

0x02 0x00 0x03 0x50 0x34 0x33 0x03 BCC



Noteblock address0~1 just read not write,block address2~3 has special meaning,dont write.

4

5:stop

0x02 0x00 0x07 0x34 0x34 0X03 BCC

successfully return

0x02 0x00 0x03 0x50 0x34 0x34 0x03 BCC



5:Non-contact CPU card operation command

51:Non-contact CPU card activation

0X02 0X00 0X02 0X35 0x30 0X03 BCC

successfully return

0x02 BLEN 0x50 0x35 0x30 RESET_DATA 0x03 BCC



52:Non-contact CPU card APDU command

0X02 0X00 0X02 0X35 0x33 sch slen sapdu 0X03 BCC

successfully return

0x02 BLEN 0x50 0x35 0x33 rch rapdu 0x03 BCC



Explanation

[1]sch:link symbol,=0 no need link,=1 link.


10/14

[2]sapdu:to send APDU command packet.

[3]rch:receive link symbol,=0 no link,=1 with link.

[4]rapdu:returned APDU command packet.

615693 card operation

61 catalogue request

0x02 0x00 0x02 0x36 0x30 0x03 BCC

successfully return

0x02 0x00 0x0B 0x50 0x36 0x30 UID 0x03 BCC

unsuccessfully return1

0x02 0x00 0x04 0x4E 0X36 0X30 ERR_CD 0x03 BCC


0x02 0x00 0x05 0x4E 0X36 0X30 2 byte 15693 error

code

0x03 BCC

See the 15693 Protocol response error codes defined"

62 read card

Dont carry UID reading

0x02 0x00 0x05 0x36 0x31 0x02 The first block

address

Block

quantity

0x03 BCC

Carry UID reading

0x02 0x00 0x0D 0x36 0x31 0x22 UID The first

blockaddress

Block

quantity

0x03 BCC

successfully return

0x02 RELEN_H RELEN_L 0x50 0x36 0x31 Date

readed

Length

of data

readed

0x03 BCC


0x02 0x00 0x04 0x4E 0X36 0X31 ERR_CD 0x03 BCC


0x02 0x00 0x05 0x4E 0X36 0X31 2 byte 15693 error

code

0x03 BCC


6

3 write card

Dont carry UID writing

0x02 RELEN_H RELEN_L 0x36 0x32 0x02 The first

lock

address

Block

quantity

data 0x03 BCC

Carry UID writing

0x02 RELEN_H RELEN_L 0x36 0x32 0x22 UID The first

block

Block

quantity

data 0x03 BCC


11/14

address

successfully return

0x02 0x00 0x04 0x50 0x36 0x32 successfully write block

quantity

0x03 BCC


0x02 0x00 0x04 0x4E 0X36 0x32 ERR_CD 0x03 BCC


0x02 0x00 0x05 0x4E 0X36 0x32 2 byte 15693 error code 0x03 BCC


6. 4 select card

0x02 0x00 0x0B 0x36 0x33 0x22 UID 0x03 BCC

Successful return

0x02 0x00 0x04 0x50 0x36 0x33 0x00 0x03 BCC

unsuccessfully return 1





65 read system information02 00 0B 48 34 22 91 89 2F 5D 00 01 04 E0 03 DB

Dont carry UID

0x02 0x00 0x03 0x36 0x34 0x02 0x03 BCC

Carry UID

0x02 0x00 0x0B 0x36 0x34 0x22 UID 0x03 BCC

Successful return02 00 12 50 48 34 00 0F 91 89 2F 5D 00 01 04 E0 04 04 1B 03 01 03 A6

0x02 RELEN_

H

RELEN_L 0x50 0x36 0x34 Return data EXT BCC

symbol Information

symbol

UID DSFID AFI Information

field




0x02 0x00 0x05 0x4E 0X36 0x34 2 byte 15693 error code 0x03 BCCSee the 15693 Protocol response error codes defined"

6

6 read safe state

Dont carry UID

0x02 0x00 0x05 0x36 0x35 0x02 The first block

address

Block quantity 0x03 BCC

Carry UID

0x02 0x00 0x0D 0x36 0x35 0x22 UID The

first block

address

Block

quantity

0x03 BCC


12/14

successfully return

0x02 RELEN_H RELEN_L 0x50 0x36 0x35 Return

data

Return

block

quantity

EXT BCC






67 read DSFI02 00 0C 48 36 22 91 89 2F 5D 00 01 04 E0 04 03 DA

Carry UID

0x02 0x00 0x0c 0x36 0x36 0x22 UID data1byte 0x03 BCC

Successfully return

0x0

2

0x0

0

0x04 0x50 0x36 0x36 0x00 0x03 BC

C




0x02 0x00 0x05 0x4E 0X36 0x36 2 byte 15693 error code 0x03 BCCSee the 15693 Protocol response error codes defined"

68 writeAFI

Carry UID

0x02 0x00 0x0c 0x36 0x37 0x22 UID data1byte 0x03 BCC

Successfully return

0x02 0x00 0x04 0x50 0x36 0x37 0x00 0x03 BCC






69 lock block

0x02 0x00 0x0c 0x36 0x3a 0x22 UID Block address 0x03 BCC

Successfully return

0x02 0x00 0x04 0x50 0x36 0x3a 0x00 0x03 BCC


13/14


0x02 0x00 0x04 0x4E 0X36 0x3a ERR_CD 0x03 BCC


0x02 0x00 0x05 0x4E 0X36 0x3a 2 byte 15693 error code 0x03 BCC


6

10 block AFI

0x02 0x00 0x0b 0x36 0x3b 0x22 UID 0x03 BCC

Successfully return

0x02 0x00 0x04 0x50 0x36 0x3b 0x00 0x03 BCC


0x02 0x00 0x04 0x4E 0X36 0x3b ERR_CD 0x03 BCC


0x02 0x00 0x05 0x4E 0X36 0x3b 2 byte 15693 Error code 0x03 BCC


611 lock SFID

0x02 0x00 0x0b 0x36 0x3c 0x22 UID 0x03 BCC

Successfully return

0x02 0x00 0x04 0x50 0x36 0x3c 0x00 0x03 BCC

Unsuccessfully return 1

0x02 0x00 0x04 0x4E 0X36 0x3c ERR_CD 0x03 BCC

Unsuccessfully return 2

0x02 0x00 0x05 0x4E 0X36 0x3c 2 byte 15693 error code 0x03 BCC


7:Non-contact CPU type B card operation command

71:Non-contact CPU card activation

0X02 0X00 0X02 0X48 0x30 0X03 BCCSuccessful return


Unsuccessful return:


72:Non-contact CPU card APDU command

0X02 0X00 0X02 0X48 0x31 sch slen sapdu 0X03 BCC

Successfully return

0x02 BLEN 0x50 0x48 0x31 rch rapdu 0x03 BCCUnsuccessfully return


14/14


Explanation:

[1]sch:link symbol,=0 no need link,=1 need to link.

[2]sapdu: To send APDU commands.

[3]rch: Receiving the link symbol,=0 no link,=1 link.[4]rapdu:returned APDU command packet.

8:The two generation ID card operation command

81:get ID card type code

0X02 0X00 0X02 0X49 0x30 0X03 BCC

Successfully return




RESET_DATA:12 byte type code

82:get ID card UID

0X02 0X00 0X02 0X49 0x31 0X03 BCC

Successfully return




RESET_DATA8 byte ID card UID

83:stop living

0X02 0X00 0X02 0X49 0x32 0X03 BCC

Successfully return




8.4 Error code

Error code meaning

command error code

0x00 Undefined command

0x01 Command parameter error

0x02 command data error

0x03 The command cannot be executed

0x04 Command failure

sl-rf800 communication protocol 2

Documents