SAAT-520Wireless Communication Programming Development Protocol

SAAT-520 Series Reader
Wireless Communication
Programming Protocol Manual
Version: V2.0.0
1
Dear Customer
Thanks for your trust and support! We try best to provide you comprehensive service and
technical support.
This manual will introduce How to use API of SAAT-520 series wireless communication Reader, so
that your integrated software can communicate, configure reader parameter, control the
command of reader reading tags, and information of tags returned. Please consult our technical
support if you have problems of using products. Welcome to s contact us for any feedback and
suggestion.
2
This manual is suitable for the following readers:
SAAT-520 Series Wireless Communication Reader
The manual is supposed that the user already owns basic RFID and computer knowledge, so that
related terms such as RFID, RF and Ethernet is not described in details, the users can search and
inquire reference, or consult our technical department.
there are some signs with the following definitions:
Warning
if violate the signed operation method or usage environment, which will do damage to health or
devices.
Advice:
it will come to better effect according to the signed method
3
Table of Contents
1. Overview 1
2. Data Structure 2
2.1Data Frame Format........................................................................................................... 2
2.2Frame Structure ................................................................................................................ 2
2.3Data and Bit Sequence ...................................................................................................... 3
2.4CRC Checkout .................................................................................................................... 4
2.5Error Code Table............................................................................................................... 5
3. Command Instruction 8
3.1 System Information Query Command (0x01H) .......................................................... 8
3.2 Commands of Receiving Tag ID 0x62H .............................................................. 10
3.3 Commands of Stopping Tag Inquiry and Reception0x6FH .............................. 12
3.4 Command of Antenna Port Parameter Configures (0x11H)..................................... 14
3.5 Command of Antenna Port Parameter Inquires (0x12H)......................................... 16
3.6 Command of Carrier Parameter Configures (0x13H) ............................................... 18
3.7 Command of Carrier Parameter Inquires (0x13H) ................................................... 20
3.8 Command of Device Time Calibration (0xBOH) ....................................................... 21
3.9 Confirming Command of Data Receiving (0xDOH) ................................................... 23
3.10 Command of GPS Position Information Inquires (0xC8H) ....................................... 23

1. Overview
This document is only suitable for our active reader devices, which describes the connection
and management of reader transmits data by GPRS\CDMA\WIFI model. For example, the
data received by SOCKET need further analysis to get the system required data, and the data
received need meet the following protocol format, including 10 commands about reading
tags, stopping reading, information query, carrier frequency point query and configuration;
the specific command is as follows:
0x01 Device Information Query

0x11 Attenuation Setting
0x12 Attenuation Query
0x13 Carrier Setting
0x14 Carrier Query
0x62 Start Reading
0x6F Stop Reading
0xB0 Device Time Calibration
0xD0 Data Received, Reply and Confirm the frame
0xC8 Receive GPS data
1
2. Data Structure
2.1Data Frame Format
All the data transmitted between reader and PC by RS-232, USB, and Ethernet interface, data
frame is as the basic unit, which is similar with the frame format of SLIP Ethernet protocol,
defined as the following diagram.
Diagram 2-1 Data Frame Format
2.2Frame Structure
Struct CRfidFrame
{
unsigned char bFrame;
unsigned char bAddrInfo;
unsigned char bAddr;
unsigned char bLength;
2
unsigned char bCommand;
unsigned char bData [256];
};
Definition:
Control Field
Frame Control Length of Data Data Field Check Field
Bus-Address
Frame Field
Length Field
1 byte 1 byte 1 byte 1 byte 2 bytes
Value
Data Frame Format instruction:
1. "0x55" is the identifier of frame header, there is no identifier of frame ender in the
agreement, every frame length is decided by the frame field length after the frame
header identifier.
2. If the frame header identifier 0x55 appeared in the frame data, which requires to
transmit the two bytes "0x56" and "0x56" instead.
3. If the data 0x56 appeared in the frame data, which requires to transmit the two bytes
"0x56" and "0x57" instead.
4. The data field is the actual data content transmitted, including command, command
parameters and exchange data, length is the section length or defined value.
5. The check field is to achieve data test of the entire frame, including all other data except
the frame header and CRC check word, by the standard CRC-16 algorithm, demonstrate
the concrete realization of reference source, the length of 2 bytes.
6. about the connection of GPRS/CDMA/WIFI, the bus address is reserved unused, and
inquire device information through this value.
2.3Data and Bit Sequence
Without special instructions, all command and byte data in the domain follows the principle of
higher bit priority. That means higher byte priority on the data frame transmission, and higher
bit priority on the byte transmission.
3
2.4CRC Checkout
To ensure reliable data transmission, its reliable to use CRC to check the data transmission
between reader and PC, with the standard CRC-16 checkout algorithm (excluding frame
head).
Two ways to realize CRC-16 examining procedure: Numeration and Look-up Table
Numeration Sample Codes:
unsigned int calculate_crc(unsigned char *ptr, unsigned char len)

{
unsigned char i;
unsigned int crc_value = 0;
while(len--)
{
for(i=0x80; i!=0; i>>=1 )
{
if (crc_value&0x8000)
crc_value = (crc_value << 1) ^0x8005 ;
else
crc_value = crc_value << 1 ;
if(*ptr&i)
crc_value^=0x8005 ;
}
ptr++;
}
return(crc_value);
}
Look-up Table Sample Codes:
code unsigned int CRCtable[ 256 ] = {

0x0000, 0x8005, 0x800f, 0x000a, 0x801b, 0x001e, 0x0014, 0x8011,
0x8033, 0x0036, 0x003c, 0x8039, 0x0028, 0x802d, 0x8027, 0x0022,
0x8063, 0x0066, 0x006c, 0x8069, 0x0078, 0x807d, 0x8077, 0x0072,
0x0050, 0x8055, 0x805f, 0x005a, 0x804b, 0x004e, 0x0044, 0x8041,
0x80c3, 0x00c6, 0x00cc, 0x80c9, 0x00d8, 0x80dd, 0x80d7, 0x00d2,
0x00f0, 0x80f5, 0x80ff, 0x00fa, 0x80eb, 0x00ee, 0x00e4, 0x80e1,
0x00a0, 0x80a5, 0x80af, 0x00aa, 0x80bb, 0x00be, 0x00b4, 0x80b1,
0x8093, 0x0096, 0x009c, 0x8099, 0x0088, 0x808d, 0x8087, 0x0082,
0x8183, 0x0186, 0x018c, 0x8189, 0x0198, 0x819d, 0x8197, 0x0192,
0x01b0, 0x81b5, 0x81bf, 0x01ba, 0x81ab, 0x01ae, 0x01a4, 0x81a1,
0x01e0, 0x81e5, 0x81ef, 0x01ea, 0x81fb, 0x01fe, 0x01f4, 0x81f1,
0x81d3, 0x01d6, 0x01dc, 0x81d9, 0x01c8, 0x81cd, 0x81c7, 0x01c2,
0x0140, 0x8145, 0x814f, 0x014a, 0x815b, 0x015e, 0x0154, 0x8151,
0x8173, 0x0176, 0x017c, 0x8179, 0x0168, 0x816d, 0x8167, 0x0162,
0x8123, 0x0126, 0x012c, 0x8129, 0x0138, 0x813d, 0x8137, 0x0132,
0x0110, 0x8115, 0x811f, 0x011a, 0x810b, 0x010e, 0x0104, 0x8101,
0x8303, 0x0306, 0x030c, 0x8309, 0x0318, 0x831d, 0x8317, 0x0312,
0x0330, 0x8335, 0x833f, 0x033a, 0x832b, 0x032e, 0x0324, 0x8321,
0x0360, 0x8365, 0x836f, 0x036a, 0x837b, 0x037e, 0x0374, 0x8371,
0x8353, 0x0356, 0x035c, 0x8359, 0x0348, 0x834d, 0x8347, 0x0342,
0x03c0, 0x83c5, 0x83cf, 0x03ca, 0x83db, 0x03de, 0x03d4, 0x83d1,
0x83f3, 0x03f6, 0x03fc, 0x83f9, 0x03e8, 0x83ed, 0x83e7, 0x03e2,
0x83a3, 0x03a6, 0x03ac, 0x83a9, 0x03b8, 0x83bd, 0x83b7, 0x03b2,
0x0390, 0x8395, 0x839f, 0x039a, 0x838b, 0x038e, 0x0384, 0x8381,
4
0x0280, 0x8285, 0x828f, 0x028a, 0x829b, 0x029e, 0x0294, 0x8291,
0x82b3, 0x02b6, 0x02bc, 0x82b9, 0x02a8, 0x82ad, 0x82a7, 0x02a2,
0x82e3, 0x02e6, 0x02ec, 0x82e9, 0x02f8, 0x82fd, 0x82f7, 0x02f2,
0x02d0, 0x82d5, 0x82df, 0x02da, 0x82cb, 0x02ce, 0x02c4, 0x82c1,
0x8243, 0x0246, 0x024c, 0x8249, 0x0258, 0x825d, 0x8257, 0x0252,
0x0270, 0x8275, 0x827f, 0x027a, 0x826b, 0x026e, 0x0264, 0x8261,
0x0220, 0x8225, 0x822f, 0x022a, 0x823b, 0x023e, 0x0234, 0x8231,
0x8213, 0x0216, 0x021c, 0x8219, 0x0208, 0x820d, 0x8207, 0x0202
};
unsigned int addCRC( unsigned int LastCRC, unsigned char CheckByte )

{
return ( LastCRC >> 8 ) ^ CRCtable [ ( LastCRC & 0xFF ) ^ CheckByte ];
}
Combination of various factors, SAAT series of readers can transmit 255 bytes data as a max
now, only 256- byte CRC checkout code is displayed in the above table.
2.5Error Code Table
When the reader fails to execute command from host, it will return error code to host and
indicates the reason of failure.
Error Code Fields divided as following:
0x10-0x1F Reader System Error Code
0x20-0x2F Reader Operation Error Code
0x60-0x6F Data Transmission Error Code
0xA0-0xAF ISO18000-6B Tag Operation Error Code
0xB0-0xBF ISO18000-6C Tag Operation Error Code
Error Code Specific definition as following:
Table 1: Reader System Error Codes

Error Code Error Code Definition
0x10 Reader Decoding Unit Software Version Error
5
0x11 Reader Baseband Board Hardware Version Error
0x12 Reader RF BoardVeneer Hardware Version Error
0x13 Reader Expansion Board Hardware Version Error
0x14 Reader Baseband Starts Self-examing Failed
0x15 Reader RF Board Starts Self-examing Failed
0x16 Reader Ethernet Starts Self-examing Failed
0x17 Reader Real-time Clock Starts Self-examing Failed
0x18 Reader External Memory Starts Self-examing Failed
0x19 Reader System Parameter Table Self-examing Failed
0x1F Unknown System Hardware Error
Table 2: Reader Operation Error Codes

0x20 Reader Access Code Error
0x21 Using forbidden or error antenna port
0x22 Currently, reader is under testing mode
0x23 Operate on reader inner memory failed
0x24 Now, reader is executing non-suspendable operation
0x25 Reader running errors, such as program running by ill-

operation
0x26 Operation occupied(another higher lever user is operating)
0x2F Unknown operation error of reader
Table 3: Protocol Data Transmission Error Codes

0x60 The structure of received order or data frame is not

complete
0x61 The CRC error of received order or data
0x62 The running reader doesn't support this order type
6
0x63 The running reader doesn't support the tag protocol
0x64 Parameter error of the received order
0x65 Order frame structure error (lack of field or field

structure error)
0x66 Reader has received too many orders to deal with
0x6F Unknown type of data transmission error
7
3. Command Instruction
3.1 System Information Query Command (0x01H)
The command is used to inquire the system setting information of RFID device, including
products series number and hardware configuration information. The command structure
is as follows:
Field Length Value Definition

Frame Header
Frame Header 1 0x55
Identifier
Bus Address, Control
Control Field 3 0x00~0xFF word, Data field
length, etc
commands of The host
Command
1 0x01 point the RFID device
Word
to operate
System Information
Type 1 0x00
type for query
Check Filed 2 0x00~0xFF CRC check data
Commands instructions:
Information Type Definition Length
0x00 RFID Device Name 8 Bytes
RFID Device Name: Name of returned RFID device, is defined by the user and used to
separate the different RFID devices in the same integrated system.
Note:
Because this command is only used to inquire one parameter, so which can be used to
specify and distinguish different bus addresses, query device name, device serial number
and device number, software and hardware version information;
Command response:
8
a) Command operated successfully:

Frame Header
Frame Header 1 0x55
Identifier
length, etc
Command Mirror
Image
to operate
RFID device
successfully finished
Operate Successfully 1 0x00
the command
operation
System configurated
Operate Data N 0x00~0xFF
information inquired
Check Field 2 0x00~0xFF CRC Check data
b) Command operation failed:

Frame Header
Frame Header 1 0x55
Identifier
length, etc
Command
Mirror Image
to operate
Return the error code
and Clarify the
Error Code 1 0x01~0xFF
operation failure
reason
Calling Example:
CRfidFrame frame;
CString userid=13800138000;
int nLen;
// Data binding function, self-encapsulation, refer to DEMO source code
PackDeviceCmd(0x01,frame,nLen,0);
// SOC is the socket for the device to login
if ( send(soc,(char*)&frame, nLen, NULL) != SOCKET_ERROR )
return TRUE;
else
9
return FALSE;
3.2 Commands of Receiving Tag ID 0x62H
This instruction commands reader to receive ID code of active RFID tag.
Commands Structure:

Frame Header
Frame Header 1 0x55
Identifier
length, etc
Command
Word
to operate
Execution Receive the Execution
1 0x00~0xFF
Model Model
ID Code Type for
ID Type 1 0x00~0xFF
reading
Check Field 2 0x00~0xFF CRC checking data
Commands instructions:
The reader will start up reception circuit to receive ID code sent by the tag after receiving
the command, and send the receiving data to the host.
Execution Model: 0x01
ID type: Tag ID code type is defined as follows:
0x01 Basic ID (BID)
0xXX Reserve
10
Command response:

Frame Header 1 0x55 Frame Header Identifier
Control Field 3 0x00~0xFF Bus Address, Control word, Data field length, etc
Command Mirror commands of The host point the RFID device to
1 0x62
Image operate
RFID device successfully finished the command
operation
ID CODE 8 0x00~0xFF Identified Tag ID CODE
Tag Reading Time 7 0x00~0x99 BCD code of sending time
sending tag temperature, the signed numer is before

Tag Temperature 2 ~ the decimal point of the first byte, unsigned number
after the the decimal point of the later byte
Tag state 1 0x00~0xFF Inner state of tag (such as Low-voltage alarm)
Time information includes (time data is BCD code, as 0x11 means 11 but not 17):
GetClock_Para[0]:seconds
GetClock_Para[1]:minutes
GetClock_Para[2]:hour
GetClock_Para[3]:day
GetClock_Para[4]:date
GetClock_Para[5]:month
GetClock_Para[6]:year
There are no such 2-byte Tag Temperature for non-temperature tag.

11
Bus Address, Control word,
Control Field 3 0x00~0xFF
Data field length, etc
Command commands of The host point
1 0x62
Mirror Image the RFID device to operate
Return the error code and
Error Code 1 0x01~0xFF Clarify the operation failure
reason
Among the returned ID code, only 4 bits are used as follows:
CRfidFrame rf;// see the 2.2 chapter of this document

.// Socket is received in the data package, and stored in RF STRUCTURE
//transfer to the decial tag number
CString cstrId;
unsigned int id = 0;
//Start reading from the fifth byte
id = (rf.bData[5] << 24) + (rf.bData[6] << 16) + (rf.bData[7] << 8) + rf.bData[8];
cstrId.Format("%u", id);
//transfer to the hexadecimal tag number
CString tmp,cstrId;
for( int i = 0; i < 4; i++ )

{
tmp.Format("%02x", rf.bData[i+5]);// Look backward 4 bytes from the fifth one

cstrId += tmp;
3.3 Commands of Stopping Tag Inquiry and Reception

0x6FH
This command stopped readers current operation of all tag inquiry.
Commands Structure:

commands of The host point
Command Word 1 0x6F
the RFID device to operate
12
Command response:


Command Mirror commands of The host point
1 0x6F
Image the RFID device to operate
RFID device successfully
Operate Successfully 1 0x00 finished the command
operation

1 0x6F
reason
13
3.4 Command of Antenna Port Parameter Configures
(0x11H)
This command is used to configure parameter of reader antenna port.
Commands Structure:

Command Word 1 0x6F
Port Enable 4 0x00~0x01 Antenna Port Enable
Output Power 4 0x00~0xFF Antenna Port Output Power
Polling Time 4 0x00~0xFF Antenna Port Polling Time
Command Instruction:
About reader:
Port Enable :
the first byte: 0x03 allow to modify the receiving gain of amplifier (Reserve)
The second byte: 0x03 allow to modify transmission power of 2401 RF device
(Reserve)
The Third byte: 0x03 allow to modify the attenuator power of RF device
The Fourth byte: Reserve
Output Power:
The First Byte (Amplifier receiving gain):
14
0x02: high gain;
0x03: low gain;
The Second Byte (2401 RF devices transmission power)
0x00-18DB
0x01-12DB
0x02 -6DB
0x03 0DB
The Third Byte (RF attenuator power):
0-0DB
1-2DB
2-4DB
3-6DB
4-8DB
5-10DB
6-12DB
....
15-30Db
The Fourth Byte: Reserve, default 0x00.
Polling Time:
Polling time is 4-byte long, successively 0x00 0x00 0x00 0x00
Data sent suggested
Port Enable0x03 0x03 0x03 0x00
Output Power0x02 0x03 Option 0x00(option is RF Attenuator power

input value)
Polling Time0x00 0x00 0x00 0x00

15
Command response:

1 0x11
operation

1 0x11
reason
3.5 Command of Antenna Port Parameter Inquires (0x12H)
This command is used to inquire parameter of reader antenna port, defined as the above
section.
Commands Structure:

16
Command Word 1 0x12
Reader device returns the antenna port parameter in turn according to format defined in
above section.
Command response:

1 0x12
Operate
1 0x00 finished the command
Successfully
operation
Antenna Port Enable
Port Enable 4 0x00~0x01
configures parameter
Antenna Port Output Power
Output Power 4 0x00~0xFF
Antenna Port Polling Time
Polling Time 4 0x00~0xFF

1 0x12
17
reason
3.6 Command of Carrier Parameter Configures (0x13H)
This command is used to set carrier parameter of reader
Commands Structure:

Command Word 1 0x13
Parameter Types 1 0x00~0x01 Setting Parameter Type
Parameter Setting length of carrier
1 0x00~0x01
Length Parameter
Setting data of carrier
Parameter Data N 0x00~0xFF
Parameter
Parameter Types is the carrier parameter types, 0x00 is frequency hopping format.value
is 0x00.
Parameter Length is the carrier parameter length.value is 0x01.
Parameter data is the carrier parameter data, when the type is 0x00, this is the frequency
point serial number list.
Definition of parameter list is different according to reader devices, reference to reader

parameter list definition.
About reader:
Parameter data:
18
02405M
12410M
22415M
32420M
162515M
172520M
Command response:


1 0x13
operation

1 0x13
reason
19
3.7 Command of Carrier Parameter Inquires (0x13H)
This command is used to inquire carrier parameter of reader
Commands Structure:

Command Word 1 0x14
Inquire Carrier Parameter
Parameter Types 4 0x00~0x0F
Types
Command response:

1 0x14
operation
System configure information
Inquire Parameter N 0x00~0xFF
inquired
About active reader:

20
Parameter Data:
02405M
12410M
22415M
32420M
162515M
172520M

1 0x14
reason
3.8 Command of Device Time Calibration (0xBOH)
This command is used to calibrate time of reader
Commands Structure:

21
Command Word 1 0xBO
Parameter Types 7 0x00~0x99 BCD code of sending time
Time information includes:
GetClock_Para[0]:seconds
GetClock_Para[1]:minutes
GetClock_Para[2]:hour
GetClock_Para[3]:day
GetClock_Para[4]:date
GetClock_Para[5]:month
GetClock_Para[6]:year
Command response:

1 0xBO
operation

1 0xBO
reason
22
3.9 Confirming Command of Data Receiving (0xDOH)
This command is used to reply the data length received on the reader working process, or
the reader will continuously upload the same data package; after over some data package,
reader will judge the communication with the server disconnected, then reboot and login;
Commands Structure:

Command Word 1 0xDO
Parameter Types 2 0x00~0xFF Data Length of Receiving
Command response:
This command has no returned command;
3.10 Command of GPS Position Information Inquires (0xC8H)
This command is used to inquire GPS position information.
Commands Structure:

23
commands of The host points
Command Word 1 0x C8
Command response:

Bus Address, Control word, Data field
length, etc
Command Mirror commands of The host point the RFID
1 0x C8
Image device to operate
RFID device successfully finished the
command operation
Reader GPS Position information:

Latitude + Latitude hemisphere
GPS Information 32 ~ +Longtitude+Longtitude Hemisphere+
Ground speed+ Ground course (such as
A3723.2475N12158.3416W0.13309.62)

1 0x C8
reason
24
Without GPS function, reader didnt support this command.
25

SAAT-520Wireless Communication Programming Development Protocol

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SAAT-520Wireless Communication Programming Development Protocol

Uploaded by

Copyright:

Available Formats

SAAT-520 Series Reader

SAAT-520 Series Wireless Communication Reader

there are some signs with the following definitions:

it will come to better effect according to the signed method

2.1Data Frame Format........................................................................................................... 2

2.2Frame Structure ................................................................................................................ 2

2.3Data and Bit Sequence ...................................................................................................... 3

2.4CRC Checkout .................................................................................................................... 4

2.5Error Code Table............................................................................................................... 5

3.1 System Information Query Command (0x01H) .......................................................... 8

3.2 Commands of Receiving Tag ID 0x62H .............................................................. 10

3.3 Commands of Stopping Tag Inquiry and Reception0x6FH .............................. 12

3.4 Command of Antenna Port Parameter Configures (0x11H)..................................... 14

3.5 Command of Antenna Port Parameter Inquires (0x12H)......................................... 16

3.6 Command of Carrier Parameter Configures (0x13H) ............................................... 18

3.7 Command of Carrier Parameter Inquires (0x13H) ................................................... 20

3.8 Command of Device Time Calibration (0xBOH) ....................................................... 21

3.9 Confirming Command of Data Receiving (0xDOH) ................................................... 23

3.10 Command of GPS Position Information Inquires (0xC8H) ....................................... 23

0x01 Device Information Query

2.1Data Frame Format

Diagram 2-1 Data Frame Format

Data Frame Format instruction:

2.3Data and Bit Sequence

Numeration Sample Codes:

unsigned int calculate_crc(unsigned char *ptr, unsigned char len)

code unsigned int CRCtable[ 256 ] = {

unsigned int addCRC( unsigned int LastCRC, unsigned char CheckByte )

2.5Error Code Table

Error Code Fields divided as following:

0x10-0x1F Reader System Error Code

0x20-0x2F Reader Operation Error Code

0x60-0x6F Data Transmission Error Code

0xA0-0xAF ISO18000-6B Tag Operation Error Code

0xB0-0xBF ISO18000-6C Tag Operation Error Code

Error Code Specific definition as following:

Table 1: Reader System Error Codes

0x10 Reader Decoding Unit Software Version Error

0x12 Reader RF BoardVeneer Hardware Version Error

0x13 Reader Expansion Board Hardware Version Error

0x14 Reader Baseband Starts Self-examing Failed

0x15 Reader RF Board Starts Self-examing Failed

0x16 Reader Ethernet Starts Self-examing Failed

0x17 Reader Real-time Clock Starts Self-examing Failed

0x18 Reader External Memory Starts Self-examing Failed

0x19 Reader System Parameter Table Self-examing Failed

0x1F Unknown System Hardware Error

Table 2: Reader Operation Error Codes

0x20 Reader Access Code Error

0x21 Using forbidden or error antenna port

0x22 Currently, reader is under testing mode

0x23 Operate on reader inner memory failed

0x24 Now, reader is executing non-suspendable operation

0x25 Reader running errors, such as program running by ill-

0x26 Operation occupied(another higher lever user is operating)

0x2F Unknown operation error of reader

Table 3: Protocol Data Transmission Error Codes

0x60 The structure of received order or data frame is not

0x61 The CRC error of received order or data

0x62 The running reader doesn't support this order type

0x64 Parameter error of the received order

0x65 Order frame structure error (lack of field or field

0x66 Reader has received too many orders to deal with

0x6F Unknown type of data transmission error