SL-RF800 COMMUNICATION PROTOCOL

*Versions: RF_X6_V1.0

1.The data communication interface

Communication way: USB2.0 full speed interface, custom HID device communication interface

2. Data packet format

Sending data packet format
STX

SELEN

CM

PM

SE_DATAB

ETX

BCC

SELEN length range

BCC calculation range

Right return packet format

STX

RELEN

CM

PM

RE_DATAB

ETX

BCC

RELEN length range

Wrong return packet format
STX

RELEN

CM

PM

ERR_CD

ETX

BCC

Explanation:
[1]CM,The command code.
[2]PM,command parameter.

[3]SE_DATAB,packet sent.
[4]RE_DATAB,packet returned.
[5]ERR_CD,Error code.
[6]BCC,XOR checksum.Calculate way:XOR each data between STXincluding STXand ETXincluding
ETX

[7]P,=0x50.Indicates that the command executed successfully.[8]N,=0x4E.Indicates that the command

executed successfully.
[9]SELEN,sending data packet length.two bytes length.
[10]RELEN,return data packet length.two bytes length.
[11]STX,A start symbol.Fixed be0X02
[12]ETX,a over symbol. Fixed be0x03

3.Command list
Command
serial No.
1

Command Name
Reset
reader-writer

RFID card
operation

RFID card
operation

Command
Code

Command function

0x30

Initialize the card reader-writer and

upload the version number

0X30

S50

S70

0x32

0x33

RFID card UL
Card operation
4

command
parameter

0x34

0x30

Find cards

0x31

Read serial number

0x32

Verify password

0x33

Read data

0x34

Write data

0x35

Value operation Initialization

0x36

Value added operations

0x37

Decrease value operation

0x38

stop

0x30

Find cards

0x31

Read serial number

0x32

Verify password

0x33

Read data

0x34

Write data

0x35

Value operation Initialization

0x36

Value added operations

0x37

Decrease value operation

0x38

stop

0x30

Find cards

0x31

Read serial number

0x32

Read card

0x33

Write card

0x34

stop

0x31

Verify password

0x32

Read data

Non contact CPU

card TYPEA

0x35

0x33

Write data

0x34

Read the state of fuse

0x35

fuse

0x36

Initialization certification

0x37

Check certification

0x38

Change password

0x35

With a write data protection

0x36

Change password

0x30

activation,and get reset information

0x31
0x32
0x33

APDU transfer command

0x34

15693
operation

card

Non-contact CPU
card TYPEB

The two
generation ID card
operation

0x36

0x48

0x49

4.Command detail Explanation

0x35

Stop living

0x30

Catalogue request

0x31

Read card

0x32

Write card

0x33

choose

0x34

Read system information

0x35

Read safe state

0x36

Write DSFID

0x37

Read AFI

0x3a

Lock block

0x3b

Lock AFI

0x3c

Lock DSFID

0x30

activation,and get UID

0x31

APDU command transfer

0x30

get the 12 byte type code

0x31

get 8 byte UID

0x32

Stop living

4.1:Initialize the card reader, no action

0x02

0x00

0x02

0x30

0x30

0x03

BCC

PM=0X32,Initialize the card reader, no action on card.

Return successfully
0x02

0x00

0x11

0x50

0x30

0x30

Version information

0x03

BCC

Version informationTTCE_M100_V2.3
successfully return
0x02

0x00

0x04

0x4E

0x30

0x30

ERR_CD

0x03

BCC

4.2:RFID card S50 operation command

4.21:find card
0x02

0x00

0x02

0x32

0x30

0X03

BCC

0x50

0x32

0x30

0x03

0x4E

0x32

0x30

ERR_CD

successfully return
0x02

0X00

0X03

BCC

successfully return
0x02

0X00

0X04

0X03

BCC

4.22:Read card serial No

0x02

0x00

0x02

0x32

0x31

0X03

BCC

successfully return
0x02

RELEN_H

RELEN_L

0x50

0x32

0x31

Card serial No.

0x03

BCC

successfully return
0x02

0X00

0X04

0x4E

0x32

0x31

ERR_CD

0x32

0x32

Block address

0X03

BCC

4.23:verify password
0x02

0x00

0x0a

Password type

Explanation
password type:=0X30,verify KEYA;=0X31,verify KEYB
passwordLength is 6 byte sectors password.
successfully return
0x02

0x00

0x03

0x50

0x32

0x32

0x03

BCC

0x4E

0x32

0x32

ERR_CD

0x32

0x33

Block address

successfully return
0x02

0X00

0X04

0X03

BCC

4.24:read data
0x02

0x00

0x03

successfully return

0X03

BCC

6
byte
password

0X03

BCC

0x02

0x00

0x13

0x50

0x32

0x33

16 byte data block

0x4E

0x32

0x33

ERR_CD

0x3B

0x34

Block address

0x50

0x32

0x34

0x03

0x4E

0x32

0x34

ERR_CD

0x03

BCC

successfully return
0x02

0X00

0X04

0X03

BCC

4.25:write data
0x02

0x00

0x13

16 byte data block

0X03

BCC

successfully return
0x02

0x00

0x03

BCC

successfully return
0x02

0X00

0X04

0X03

BCC

4.26:value operation initialization

0x02

0x00

0x13

0x32

0x35

Block address

16 byte data block

0x50

0x32

0x35

0x03

0x4E

0x32

0x35

ERR_CD

0X03

BCC

successfully return
0x02

0x00

0x03

BCC

successfully return
0x02

0X00

0X04

0X03

BCC

12

13

14

15

ADR

/ADR

ADR

/ADR

Explanationthe format of initialization value is below:

0

Value
Value:

/Value

10

Value

11

to initialize 4 byte value,Low byte note values in the former, the high byte in the post

/Value: To initialize the 4 byte value inversion

ADR:

The block address initialization value

ADR= Sector number X 4 + block number (S50 Card No.0-15 sector,S70 card No.0 31 sector block value
operation calculate)
ADR= Sector No. 32 X
value operation address calculate

16

128 + block No. S70 card No. 32 39 sector block

/ADR: To initialize the value of the inverse of the block address

NoteThe last block of every sector cant be value operated.
For example:to initialize sector 5 block 0 to be 10,to write 16 byte sector block data
0x0A, 0x00, 0x00, 0x00, 0xF5 0xFF,0xFF ,0xFF , 0x0A, 0x00, 0x00, 0x00, 0x14, 0xEB, 0x14, 0xEB

S70 card initialization value of sector 39 block o is 10,to write 16 byte sector block data
0x0A, 0x00, 0x00, 0x00, 0xF5, 0xFF,0xFF ,0xFF , 0x0A, 0x00, 0x00, 0x00, 0xF0, 0x0F, 0XF0, 0x0F

4.27:value added operation

0x02

0x00

0x07

0x32

0x36

Block address

4 byte value added data

0X03

BCC

Explanationvalue added data, low byte in the former, the high byte in the post.

successfully return

0x02

0x00

0x03

0x50

0x32

0x36

0x03

BCC

0x4E

0x32

0x36

ERR_CD

successfully return
0x02

0X00

0X04

4 byte hex Data is the

increase value of

0X03

BCC

the specified sector refers to the block value

low byte in the former, the high byte in the post..As increase 0x10,send 4 byte hex data is 0x10, 0x00,
0x00, 0x00

4.28:value decrease operation

0x02

0x00

0x07

0x32

0x37

Block address

4
byte
value
decrease data

0X03

Explanationvalue decrease data,low byte in the former, the high byte in the post.
successfully return
0x02

0x00

0x03

0x50

0x32

0x37

0x03

BCC

0x4E

0x32

0x37

ERR_CD

successfully return
0x02

0X00

0X04

4 byte hex Data is the

increase value of

0X03

BCC

the specified sector refers to the block value

low byte in the former, the high byte in the post..

If to decrease 0x10,the data of 4 byte hex will be sent 0x10, 0x00, 0x00, 0x00

3:RFID card S70 operation

31:find card
0x02

0x00

0x02

0x33

0x30

0X03

BCC

successfully return
0x02

0X00

0X03

0x50

0x33

0x30

0x03

BCC

successfully return
0x02

0X00

0X04

0x4E

0x33

0x30

ERR_CD

32:read card serial No.

0x02

0x00

0x02

successfully return

0x33

0x31

0X03

BCC

0X03

BCC

BCC

0x02

0X00

0X07

0x50

0x33

0x31

4 byte card serial No.

0x4E

0x33

0x31

ERR_CD

0x03

BCC

unsuccessfully return
0x02

0X00

0X04

0X03

BCC

33:verify password
0x02

0x00

0x0A

0x33

0x32

Block
address

Password
type

6 byte password

0X03

BCC

Successfully return
0x02

0x00

0x03

0x50

0x33

0x32

0x03

BCC

0X04

0x4E

0x33

0x32

ERR_CD

0x03

0x33

0x33

Block address

0x50

0x33

0x33

16 byte data block

0X04

0x4E

0x33

0x33

ERR_CD

0x13

0x33

0x34

Block address

0x50

0x33

0x34

0x03

0x4E

0x33

0x34

ERR_CD

0x33

0x35

Block address

0x50

0x33

0x35

Unsuccessfully return
0x02

0X00

0X03

BCC

34:read data
0x02

0x00

0X03

BCC

Successfully return
0x02

0x00

0x13

0x03

BCC

Unsuccessfully return
0x02

0X00

0X03

BCC

35:write data
0x02

0x00

16 byte data
block

0X03

BCC

0X03

BCC

successfully return
0x02

0x00

0x03

BCC

unsuccessfully return
0x02

0X00

0X04

0X03

BCC

36:initialize value operation

0x02

0x00

0x13

16 byte data
block

successfully return
0x02

0x00

0x03

0x03

BCC

unsuccessfully return
0x02

0X00

0X04

0x4E

0x33

0x35

ERR_CD

0X03

BCC

12

13

14

15

ADR

/ADR

ADR

/ADR

the format of initialization value is

0

Value
Value:

/Value

Value

10

11

to initialize 4 byte value,Low byte note values in the former, the high byte in the post

/Value: To initialize the 4 byte value inversion

ADR:
The block address initialization value
ADR= sector No X 4 + block No (S50 Card No.0-15 sector,S70 card No.0 31 sector block

value operation calculate)

ADR= sector No 32 X
operation calculate
/ADR:

16

128 + block No

S70 card No.32 39 sector block value

To initialize the value of the inverse of the block address

NoteThe last block of every sector cant be value operated.

For example:to initialize sector 5 block 0 to be 10,to write 16 byte sector block data
S70 card initialization value of sector 39 block o is 10,to write 16 byte sector block data
0x0A, 0x00, 0x00, 0x00, 0xF5, 0xFF,0xFF ,0xFF , 0x0A, 0x00, 0x00, 0x00, 0xF0, 0x0F, 0XF0, 0x0F

37:value added operation

0x02

0x00

0x07

0x33

0x36

block address

4 byte value added 0X03

data

BCC

Explanationvalue added data,Low byte note values in the former, the high byte in the post.
successfully return
0x02

0x00

0x03

0x50

0x33

0x36

0x03

BCC

0x4E

0x33

0x36

ERR_CD

unsuccessfully return
0x02

0X00

0X04

0X03

BCC

38:value decrease operation

0x02

0x00

0x07

0x33

0x37

block
address

4 byte value decrease 0X03

data

BCC

Explanation:value decrease data,Low byte note values in the former, the high byte in the post.
successfully return
0x02

0x00

0x03

0x50

0x33

0x37

0x03

BCC

0x4E

0x33

0x37

ERR_CD

unsuccessfully return
0x02

0X00

0X04

0X03

BCC

4:RFID card UL card operation

41:find card
0x02

0x00

0x02

0x34

0x30

0X03

BCC

0x50

0x34

0x30

0x03

0x4E

0x34

0x30

ERR_CD

successfully return
0x02

0x00

0x03

BCC

unsuccessfully return
0x02

0X00

0X04

42:read card serial No

0x02

0x00

0x02

0x34

0x31

0X03

BCC

0X03

BCC

successfully return
0x02

0x00

0x0a

0x50

0x34

0x31

7 byte serial No

0x03

BCC

unsuccessfully return
0x02

0X00

0X04

0x4E

0x34

0x31

ERR_CD

0x34

0x32

block address

0X03

BCC

43:read operation
0x02

0x00

0x03

0X03

BCC

successfully return
0x02

0x00

0x13

0x50

0x34

0x32

16 byte data

0x03

BCC

unsuccessfully return
0x02

0X00

0X04

0x4E

0x34

0x32

ERR_CD

0x13

0x34

0x33

block address

0x50

0x34

0x33

0X03

BCC

44:write data
0x02

0x00

16 byte data

0X03

BCC

successfully return
0x02

0x00

0x03

0x03

BCC

unsuccessfully return
0x02

0X00

0X04

0x4E

0x34

0x33

ERR_CD

0X03

BCC

Noteblock address0~1 just read not write,block address2~3 has special meaning,dont write.
45:stop
0x02

0x00

0x07

0x34

0x34

0X03

BCC

successfully return
0x02

0x00

0x03

0x50

0x34

0x34

0x03

BCC

0x34

0x34

ERR_CD

unsuccessfully return
0x02

0X00

0X04

0x4E

0X03

BCC

5:Non-contact CPU card operation command

51:Non-contact CPU card activation
0X02

0X00

0X02

0X35

0x30

0X03

BCC

successfully return
0x02

BLEN

0x50

0x35

0x30

RESET_DATA

0x03

BCC

unsuccessfully return
0x02

0X00

0X04

0x4E

0x35

0x30

ERR_CD

0X03

BCC

52:Non-contact CPU card APDU command

0X02

0X00

0X02

0X35

0x33

sch

slen

sapdu

0X03

successfully return
0x02

BLEN

0x50

0x35

0x33

rch

rapdu

0x03

0x33

ERR_CD

BCC

unsuccessfully return
0x02

0X00

0X04

0x4E

0x35

Explanation
[1]sch:link symbol,=0 no need link,=1 link.

0X03

BCC

BCC

[2]sapdu:to send APDU command packet.

[3]rch:receive link symbol,=0 no link,=1 with link.
[4]rapdu:returned APDU command packet.

615693 card operation

61 catalogue request
0x02

0x00

0x02

0x36

0x30

0x03

BCC

successfully return
0x02

0x00

0x0B

0x50

0x36

0x30

UID

0x03

BCC

unsuccessfully return1
0x02

0x00

0x04

0x4E

0X36

0X30

ERR_CD

0X30

2 byte
code

0x03

BCC

unsuccessfully return2
0x02

0x00

0x05

0x4E

0X36

15693

error 0x03

BCC

See the 15693 Protocol response error codes defined"

62 read card
Dont carry UID reading
0x02

0x00

0x05

0x36

0x31

0x02

The first block

address

0x0D

0x36

0x31

0x22

UID

Block
quantity

0x03

BCC

Carry UID reading

0x02

0x00

The first
block
address

Block
quantity

0x03

BCC

successfully return
0x02

RELEN_H

RELEN_L

0x50

0x36

0x31

Date
readed

Length
of data
readed

0X31

ERR_CD

0X31

2 byte 15693 error 0x03

code

0x03

BCC

unsuccessfully return1
0x02

0x00

0x04

0x4E

0X36

0x03

BCC

unsuccessfully return2
0x02

0x00

0x05

0x4E

0X36

BCC

See the 15693 Protocol response error codes defined"

63 write card
Dont carry UID writing
0x02

RELEN_H

RELEN_L

0x36

0x32

0x02

The first
lock
address

Block
quantity

data

0x03

BCC

Carry UID writing

0x02

RELEN_H

RELEN_L

0x36

0x32

0x22

UID

The first
block

Block
quantity

data

0x03

BCC

address
successfully return
0x02

0x00

0x04

0x50

0x36

0x32

successfully write block 0x03

quantity

BCC

unsuccessfully return1
0x02

0x00

0x04

0x4E

0X36

0x32

ERR_CD

0x03

BCC

0X36

0x32

2 byte 15693 error code

unsuccessfully return2
0x02

0x00

0x05

0x4E

0x03

BCC

0x03

BCC

See the 15693 Protocol response error codes defined"

6. 4 select card
0x02

0x00

0x0B

0x36

0x33

0x22

UID

0x03

BCC

0x36

0x33

0x00

0x03

BCC

Successful return
0x02

0x00

0x04

0x50

unsuccessfully return 1
0x02

0x00

0x04

0x4E

0X36

0x33

ERR_CD

0x03

BCC

0X36

0x33

2 byte 15693 error code

unsuccessfully return 2
0x02

0x00

0x05

0x4E

See the 15693 Protocol response error codes defined"

65 read system information02 00 0B 48 34 22 91 89 2F 5D 00 01 04 E0 03 DB
Dont carry UID
0x02

0x00

0x03

0x36

0x00

0x0B

0x34

0x02

0x03

BCC

0x34

0x22

UID

0x03

Carry UID
0x02

0x36

BCC

Successful return02 00 12 50 48 34 00 0F 91 89 2F 5D 00 01 04 E0 04 04 1B 03 01 03 A6
0x02

RELEN_

RELEN_L

0x50

0x36

0x34

Return data
symbol

Information

UID

EXT

DSFID

AFI

symbol

Information
field

unsuccessfully return 1
0x02

0x00

0x04

0x4E

0X36

0x34

ERR_CD

0x03

BCC

0x4E

0X36

0x34

2 byte 15693 error code

unsuccessfully return 2
0x02

0x00

0x05

0x03

BCC

See the 15693 Protocol response error codes defined"

66 read safe state
Dont carry UID
0x02

0x00

0x05

0x00

0x0D

0x36

0x35

0x02

The first block

address

Block quantity

0x03

BCC

Carry UID
0x02

0x36

0x35

0x22

UID

The
first block
address

Block
quantity

0x03

BCC

BCC

successfully return
0x02

RELEN_H

RELEN_L

0x50

0x36

0x35

Return
data

Return
block
quantity

EXT

BCC

unsuccessfully return 1

0x02

0x00

0x04

0x4E

0X36

0x35

ERR_CD

0x03

BCC

0x4E

0X36

0x35

2 byte 15693 error code

unsuccessfully return 2
0x02

0x00

0x05

0x03

BCC

See the 15693 Protocol response error codes defined"

67 read DSFI02 00 0C 48 36 22 91 89 2F 5D 00 01 04 E0 04 03 DA
Carry UID
0x02

0x00

0x0c

0x36

0x36

0x22

UID

data1byte

0x03

BCC

Successfully return
0x0
2

0x0
0

0x04

0x50

0x36

0x36

0x00

0x03

BC
C

0x03

unsuccessfully return 1
0x02

0x00

0x04

0x4E

0X36

0x36

ERR_CD

BCC

0X36

0x36

2 byte 15693 error code

unsuccessfully return 2
0x02

0x00

0x05

0x4E

0x03

BCC

See the 15693 Protocol response error codes defined"

68 writeAFI
Carry UID
0x02

0x00

0x0c

0x36

0x37

0x22

0x50

0x36

0x37

UID

data1byte

0x03

BCC

Successfully return
0x02

0x00

0x04

0x00

0x03

BCC

unsuccessfully return 1
0x02

0x00

0x04

0x4E

0X36

0x37

ERR_CD

0x03

BCC

unsuccessfully return 2
0x02

0x00

0x05

0x4E

0X36

0x37

2 byte 15693 error code

0x03

See the 15693 Protocol response error codes defined"

69 lock block
0x02

0x00

0x0c

0x36

0x3a

0x22

UID

0x50

0x36

0x3a

0x00

Block address

0x03

Successfully return
0x02

0x00

0x04

0x03

BCC

BCC

BCC

unsuccessfully return 1
0x02

0x00

0x04

0x4E

0X36

0x4E

0X36

0x3a

ERR_CD

0x03

BCC

unsuccessfully return 2
0x02

0x00

0x05

0x3a

2 byte 15693 error code

0x03

BCC

See the 15693 Protocol response error codes defined"

610 block AFI
0x02

0x00

0x0b

0x36

0x3b

0x50

0x36

0x22

UID

0x03

BCC

Successfully return
0x02

0x00

0x04

0x3b

0x00

0x03

BCC

unsuccessfully return 1
0x02

0x00

0x04

0x4E

0X36

0x4E

0X36

0x3b

ERR_CD

0x03

BCC

unsuccessfully return 2
0x02

0x00

0x05

0x3b

2 byte 15693 Error code

0x03

BCC

See the 15693 Protocol response error codes defined"

611 lock SFID
0x02

0x00

0x0b

0x36

0x3c

0x22

0x50

0x36

0x3c

UID

0x03

BCC

Successfully return
0x02

0x00

0x04

0x00

0x03

BCC

Unsuccessfully return 1
0x02

0x00

0x04

0x4E

0X36

0x3c

ERR_CD

0x03

BCC

Unsuccessfully return 2
0x02

0x00

0x05

0x4E

0X36

0x3c

2 byte 15693 error code

0x03

See the 15693 Protocol response error codes defined"

7:Non-contact CPU type B card operation command

71:Non-contact CPU card activation
0X02

0X00

0X02

0X48

0x30

0X03

BCC

Successful return
0x02

BLEN

0x50

0x48

0x30

0x4E

0x35

RESET_DATA 0x03

BCC

Unsuccessful return:
0x02

0X00

0X04

0x30

ERR_CD

0X03

BCC

72:Non-contact CPU card APDU command

0X02

0X00

0X02

0X48

0x31

sch

slen

sapdu

Successfully return
0x02

BLEN

0x50

Unsuccessfully return

0x48

0x31

rch

rapdu

0x03

BCC

0X03

BCC

BCC

0x02

0X00

0X04

0x4E

0x35

0x33

ERR_CD

0X03

BCC

Explanation:
[1]sch:link symbol,=0 no need link,=1 need to link.
[2]sapdu: To send APDU commands.
[3]rch: Receiving the link symbol,=0 no link,=1 link.
[4]rapdu:returned APDU command packet.

8:The two generation ID card operation command

81:get ID card type code
0X02

0X00

0X02

0X49

0x30

0X03

BCC

0x49

0x30

RESET_DATA 0x03

0x4E

0x35

0x30

Successfully return
0x02

BLEN

0x50

BCC

Unsuccessfully return
0x02

0X00

0X04

ERR_CD

0X03

BCC

RESET_DATA:12 byte type code

82:get ID card UID
0X02

0X00

0X02

0X49

0x31

0X03

BCC

Successfully return
0x02

BLEN

0x50

0x49

0x30

RESET_DATA

0x03

BCC

Unsuccessfully return
0x02

0X00

0X04

0x4E

0x35

0x30

ERR_CD

0X03

BCC

RESET_DATA8 byte ID card UID

83:stop living
0X02

0X00

0X02

0X49

0x32

0X03

BCC

Successfully return
0x02

BLEN

0x50

0x49

0x30

RESET_DATA

0x03

BCC

Unsuccessfully return
0x02
8.4

0X00

0X04

0x4E

0x35

0x30

ERR_CD

Error code

Error code

meaning

command error code

0x00

Undefined command

0x01

Command parameter error

0x02

command data error

0x03

The command cannot be executed

0x04

Command failure

0X03

BCC