Protocol 725E QFM3 En

SOYALCommunication Protocol

Item No.

AR-725E QFM3

Version 1.07 Version 1.03

Author Date

Andrew May 7, 2010

SOYAL

TECHNOLOGY CO., LTD.

http://www.soyal.com

2010/5/7

Index1 Communication Protocol Page 2 2 2 2 3

2

1.1 Preparing Connect . 1.2 Data Format 1.3 Data Packet 1.4 Echo Code . Command List 2.1 2.2 2.3 2.4 2.5 2.6 2.7Echo ACK/NACK Appended Data of ACK/NACK

44 5 6 6 7 8 8 8 8 9 10 11 12 17 18 18

Relay On/Off Command of AR725E (21H) Setup real time clock of target device (23H) Get real time clock from target device (24H)

Get the lasted event log of device (25H) Remove the lasted event log of device (37H)

3

2.8 Bypass data package to sub nodes (26H) 2.9 Empty the event log of device (2DH) 2.10 Setup Daily Time Zone (2AH) 2.11 Setup Holidays of Year (2CH) 2.12 Setup User Parameters (83H) 2.13 Initial Anti-pass back Parameters (86H) 2.14 Get User Parameters (87H) 2.15 Write Flash Memory (A5) 2.16 Erase All User Data (85H) Data Structure ....................... 3.1 Data Structure of Time Zone .. 3.2 Data Structure of Holiday 3.3 Data Structure of User Parameters Update Log

1919 19 20

4

21

1

SOYAL



2010/5/7

1 Communication ProtocolAll SOYAL devices use the same protocol, only the commands given vary depending on different devices

1.1 Preparing Connect:Before connect to controller, the node number of the controller has to be known. The node number could be checked from the keypad or DIP switch as shown on the table below: Steps AR-725E QFM3 Step 1:(Enter into EDIT MODE) Setting DIP switch 123456 Step 2:(Setting Node ID) 00 001 Step 3:(Exit)

1.2 Data Format :Baud Rate Data Format Data Packet Head 8bits Length 8bits Destination ID 8bits Command Code 8bits Data XOR 8bits SUM 8bits 9600N81 Binary HEX Data

1.3 Data packed : 1.3.1 Standard format (The data length must less then 250 bytes)Size Byte Head Length 1 1 Description 0x7E Data Length Indicator which denotes the length from Destination to the end including XOR and SUM Destination Node ID 00: Reserved for the bus master FF: Broadcast to each reader Instruction Command Length of Data Block which varies depending on instructions XOR 0xFF No No SUM 0x00 No No

Destination ID Command Code Data

1

Yes

Yes

1 00

Yes Yes

Yes Yes

XOR SUM

D0 1 1

To XOR each byte from Destination ID to Data with 0xFF TO sum each byte from Destination to XOR with 0x00. If the summary is greater than 0xFF, it should keep the low byte.

Yes

ExamplePolling Status from Node. 1 Head Length Destination 0x7E 0x04 0x01 XOR = 0xFF ^ 0x01 ^ 0x18 = 0xE6

Command Data XOR 0x18 0xE6 SUM = 0x01 + 0x18 + 0xE6 = 0xFF

SUM 0xFF

Node ID needs to set from the keypadPlease refer to the command list for- 00*

2

SOYAL



2010/5/7

1.3.2

Extend format (The data length must less then 2048 bytes)Size Byte Head Length 4 2 1 Description 0xFF005AA5 (MSB First) Data Length Indicator (MSB First) which denotes the length from next byte until end of package. Destination Node ID 00: Reserved for the bus master FF: Broadcast to each reader Instruction Command Length of Data Block which varies depending on instructions XOR 0xFF No No Yes SUM 0x00 No No Yes

Destination ID Command Code Data

1 00

Yes Yes

Yes Yes

XOR SUM

D0 1 1

To XOR each byte from Destination ID to Data with 0xFF TO sum each byte from Destination to XOR with 0x00. If the summary is greater than 0xFF, it should keep the low byte.

Yes

ExamplePolling Status from Node. 1 Head Length Destination 0xFF005AA5 0x1234 0x01 XOR = 0xFF ^ 0x01 ^ 0x18 = 0xE6

Command Data XOR 0x18 0xE6 SUM = 0x01 + 0x18 + 0xE6 = 0xFF

SUM 0xFF

Node ID needs to set from the keypadPlease refer to the command list for- 00*

1.4 Echo Code :

Command03h 04h 05h 06h 07h 08h 09h 0Ah 0Bh

DescriptionEcho requested data Echo command acknowledged (ACK) Echo command unacknowledged (NACK) Echo authentication failed (AUTHERR) Echo no tags presented (NOTAG) Echo not login (NOT LOGIN LEVEL2) Echo CRC8 check error for ReadBlockCRC8 Echo not authenticated Echo authentication layer rejected

Note7E xx 00 03 [Data... ] XOR SUM 7E 04 00 04 FB FF 7E 04 00 05 FA FF 7E 04 00 06 F9 FF 7E 04 00 07 F8 FF 7E 04 00 08 F7 FF 7E 04 00 09 XX XX

3

SOYAL



2010/5/7

2 Command List2.1 Echo ACK/NACKEcho Header Length Value 7E 05 Leading Code Data Length Indicator which denotes the length from Node to the end including XOR and SUM Node Function Source ID Data0 Data1 XOR SUM FA FF XOR=FF^00^04^01 =FA SUM=00+04+01+FA=FF 00 04/05 01 Always 00, the message would be sent to command source device Command Acknowledged or Unacknowledged ( ACK/NACK The data package send from Appended Data (Check 2.2 Appended Data of Echo please). 04/05) Description

2.2 Appended Data of Echo ACK/NACK 2.2.1 725EFiled Data0 Value Controller Type Description

4

SOYAL



2010/5/7

2.2.2 QFM3Filed Data0 Data1 Data2 Value 0x86 0x?? 0x?? Controller Type Bit mapping of DI port Bit mapping of Relay Port. Bit7~4: Relay 4 ~ Relay 1 Data3 Data4 Data5 Data6 Data7 Data8 Option DIP switch value Firmware version High byte of Ticket Printer status Low byte of Ticket Printer status Bit0~7:Node1~8, Set bit for Online else will be Offline Bit0~7:Node9~16, Set bit for Online else will be Offline Description

5

SOYAL



2010/5/7

2.3 Relay On/Off Control (21H) 2.3.1 Relay On/Off Control of AR725EValue Head Length 7E 0B Leading Code Data Length Indicator which denotes the length from Destination ID to the end including XOR and SUM Node ID Command Data 01 21 80 Node ID of destination Relay On/Off Control Sub Code, 80H:On Armed 81H:Off Armed Description

Door Relay Latch On(82H), Latch Off(83H), Pulse On(84H) Alarm Relay Latch On(85H), Latch Off(86H), Pulse On(87H) Data XOR SUM Echo: Current IO status. Value Head Length Node ID Command Data Data Data Data Data Data Data Data 00 0x03 Echo to host Data echo Node ID Firmware version DI status Relay status Node Option:0 Node Option:1 Node Option:2 ARMED status for each door (1/0: armed/disarm) Bit0: Main Door, Bit1: WGA, Bit2:WGB Data XOR SUM 00 XOR SUM 7E Leading Code Description 00 Device Assignment: 03H for all doors, 00H/01H/02H for Main/WGA/WGB XOR SUM

6

SOYAL



2010/5/7

2.3.2

Relay On/Off Control of QFM3Value Head 7E 0B Leading Code Data Length Indicator which denotes the length from Destination ID to the end including XOR and SUM Description

Length

Node ID Command Data Data Data Data Data Data Data Data Data Data XOR SUM

01 21 00 00 00 00 00 00 00 00 00 00

Node ID of destination Relay On/Off Control Bit mapping Active Mask byte for Relay 1~4. Bit0~3 Bit mapping On/Off Control byte for Relay 1~4. Bit0~3 Bit 15~8 of relay 1 delay Time base on 10ms (used for on relay only) Bit 7~0 of relay 1 delay Time base on 10ms Bit 15~8 of relay 2 delay Time base on 10ms (used for on relay only) Bit 7~0 of relay 2 delay Time base on 10ms Bit 15~8 of relay 3 delay Time base on 10ms (used for on relay only) Bit 7~0 of relay 3 delay Time base on 10ms Bit 15~8 of relay 4 delay Time base on 10ms (used for on relay only) Bit 7~0 of relay 4 delay Time base on 10ms XOR SUM

Echo: Current IO status. Value Head Length Node ID Command Data Data Data Data Data Data Data Data Data XOR SUM 00 00 00 00 XOR SUM 00 0x03 Echo to host Data echo Node ID Firmware version DI status Relay status Node Option 7E Leading Code Description

7

SOYAL



2010/5/7

2.4 Setup real time clock of target device (23H)Value Head Length 7E 0B Leading Code Data Length Indicator which denotes the length from Destination ID to the end including XOR and SUM Node ID Command Data 01 23 00 01 02 03 04 05 06 XOR SUM Echo: After received the controller will echo ACK or NACK to the source controller or PC. DA 13 Node ID of destination Setup real time clock Second Minute Hour Day of a week (SUN ~ SAT: 1~7) Day of month Month Year % 100, 09 = 2009 XOR=FF^01^23^00^01^02^03^04^05^06 =DA SUM=(01+23+00+01+02+03+04+05+06+DA)FF=13(LSB) Description

8

SOYAL



2010/5/7

2.4 Get real time clock from target device (24H)Example Value Header Length 7E 04 Leading Code Data Length Indicator which denotes the length from Destination ID to the end including XOR and SUM Node ID Command XOR SUM 01 24 DA FF XOR=FF^01^24 =DA SUM=01+24+DA=FF Node ID of destination, the node id is 01 here Description

Value Head Length 7E 11 Leading Code

Description

Data Length Indicator which denotes the length from Node to the end including XOR and SUM

Node Function Reader ID Data Field

00 03 01 0A 16 0D 06 09 0C 05 63 27 01 01

The value 00 is fixed, the message would be sent to PC from the device Response to the request Reader ID Data 0 Data 1 Data 2 Data 3 Data 4 Data 5 Data 6 Data 7 Data 8 Data 9 Second Minute Hour Day of a week Date Month Year Firmware Version (6V3) Resvered Resvered

Data 10 Firmware Identify Code 00: Is standard firmware

85 XOR SUM .. ..

Data 11 Reader Type, (85/91/92 = QFM3/725EB/725ED)

9

SOYAL



2010/5/7

2.5 Get the lasted event log of device (25H)Value Head Length 7E 04 Leading Code Data Length Indicates which denotes the length from Destination ID to the end including XOR and SUM Node Command XOR SUM 01 25 DB 01 Node ID of destination, the node id is 01 here Reading the lasted event log from the device XOR=FF^01^25 =DB SUM=(01+25+DB)FF=01(LSB) Description

2.5.1 Event Buffer is EmptyIf there have no any log, the controller will echo ACK to host.

2.5.2 Event Log GetIf there have any log in the event buffer, Controller will echo the lasted one.

2.6 Remove the lasted event log of device (37H)Value Head Length 7E 04 Leading Code Data Length Indicator which denotes the length from Destination ID to the end including XOR and SUM Node ID Command XOR SUM Echo: After received the controller will echo ACK or NACK to the source controller or PC. 01 37 C9 01 Node ID of destination, the node id is 01 here Remove the lasted log XOR=FF^01^37 =C9 SUM=(01+37+C9)FF=01(LSB) Description

2.7 Empty the event log of device (2DH)Value Head Length 7E 04 Leading Code Data Length Indicator which denotes the length from Destination ID to the end including XOR and SUM Node ID Command XOR SUM Echo: After received the controller will echo ACK or NACK to the source controller or PC. Note: This command will take more then 5 seconds after echo ACK. Please pause communication with controller until 5 seconds. 01 2D .. .. Node ID of destination, the node id is 01 here Clearing all events of the device Description

10

SOYAL



2010/5/7

2.8 Bypass data package to sub nodes (26H) 2.8.1 Pass data package to sub nodes of QFM3Value Head Length Node ID Command Channel Data 7E XX 01 26 01 Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Bypass Data 00 for Reader/Voice/LED Display Panel Channel Format of Reader/Voice module: SubLen SubDID SubCtl Dat Ex: to voice T 002: 7E 0B 01 26 01 05 FC 04 02 01 03 24 57 R 003: 7E 0C 00 05 01 86 FF F0 41 13 00 00 20 EF ( 31.0ms)... Format of LED Display Panel: Length [Send out Data Package] Ex: to LED panel T 038: 7E 0E 01 26 00 08 07 27 00 04 41 42 43 44 F0 5B XOR SUM Echo: The echo data will according to target device echo data. Note 1) Pass data to voice module will echo ACK always. Description

11

SOYAL



2010/5/7

2.9 Parking parameter setting (27H)Value Head Length Node ID Command Data Data 7E XX 01 27 01 Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Parking Parameters Setting Bit mapping for active bits Parking Flag Bit0: Parking space full bit. Set to 1 indicate the parking space is full to inhibited the card or ticket procedure. XOR SUM Echo: Echo the current parking flag byte. Description

12

SOYAL



2010/5/7

2.9 Setup Daily Time Zone (2AH)Value Head Length Node ID Command Index Records Data 0 7E 26 01 2A 01 01 0C Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Setting Time Zone The first time zone index of this data package. How many records of time zones data that will be download to Link to next time zone. Set to zero mean this is a free time zone user will be passed any time. If the value larger then 63 mean no link to others. Bit7 : Enable/Disable (1/0) access on holiday Bit60: Value of link to time zone index. Data 1 Data 2 Data 3 Data 4 Data 5 Data 6 Data 7 Data 8 Data 9 00 01 E0 03 84 01 E0 03 84 Data 26 Data 27 Data 28 Data 29 Data 30 Data 31 XOR SUM 01 E0 03 84 00 00 BE CF Sat. Beginning (08:00) 0x1E0 End (18:00) 0x384 Reserved Reserved Mon. Level of time zone Sun. Beginning (08:00) 0x1E0 End (18:00) 0x384 Beginning (08:00) 0x1E0 End (18:00) 0x384 Description

Note: If the index and records are all zero mean this command is erase time zone command. For speed up download purpose. We suggest you send erase command before download all data records. Echo: After received the controller will echo ACK or NACK to the source controller or PC.

13

SOYAL



2010/5/7

2.10 Setup Holidays of Year (2CH)Value Head Length Node ID Command Index Records Data 0 Data 1 Data 2 Data 3 Data 4 Data 5 Data 6 Data 7 Data 8 Data 9 Data 10 Data 11 XOR SUM 7E 12 01 2C 01 06 0C 01 01 05 03 08 FF FF FF FF FF FF D3 63 Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Setting Holidays The first holiday index of this data package. How many records of holidays data that will be download to Month (November) Day of Month Before download to controller. The data must be sorted. All used holidays must be put to the header of data area. And set all none used data byte to 0xFF, please. Description

Note: If the index and records are all zero mean this command is erase holiday command. For speed up download purpose. We suggest you send erase command before download all data records. Echo: After received the controller will echo ACK or NACK to the source controller or PC.

14

SOYAL



2010/5/7

2.11 Setup User Parameters (83H/84H)Bytes Head Length DID CMD Records User Addr Tag UID PIN Code Mode 1 or 4 1 or 2 1 1 1 2 8 4 1 7E/ FF00A55A :Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here 83H:with anti-passback , 84H:without anti-passback flag byte How many records of user will be download to Bit15~08, Bit7~0.(MSB Format) Bit63~56,55~48,47~40,39~32,31~24,23~16,15~08,07~00.(MSB Format) Bit31~24,23~16,15~08,07~00.(MSB Format) Bit7/6:Access Mode Bit5patrol card Bit4reserved Bit3reserved Bit2enable expire check Bit1enable anti-pass back control Bit0password change available Zone Group 1 Group 2 Year Month Day Level Option 1 1 1 1 1 1 1 1 User Access Time Zone. Zero for free zone control Bit mapping of available door. (Door 16~8/Bit 7~0) 1 Access Mode Define (Bit 7/6) 00 01 10 11 Invalid Read Only Card or PIN Card + PIN Description

Bit mapping of available door. (Door 8~1/Bit 7~0) 1 Year of the last allowed date at 2 digital format Month of the last allowed date at 2 digital format Day of the last allowed date at 2 digital format User Level define Byte Extend option Byte. Bit7: 1/0 En/Disable Anti-pass-back check Only available for cmd:83H, for 84H this byte will be discarded.

3 N*26

Reserved Followed the next record of user data if records more then 1 set (Addr UID PIN Reserved)

XOR SUM

1 1

XOR=FF^DID^CMD^^^Level SUM=(DID+CMD+++Level+XOR

1): Do not care on QFM Echo: After received the controller will echo ACK or NACK to the source controller or PC.

15

SOYAL



2010/5/7

2.12 Initial anti-pass-back table (86H)Value Head Length Node ID Command Type 7E 04 01 86 0~3 Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Restoring the initial setup of anti-pass-back (AR725E only) 0:Enable/Disable Anti-pass back check of users 1:Set Anti-pass Initial status of users 2:Set Current Inside/outside flag of users. 3:Set users to initial state from Start until end.(Followed Data is discarded) Start-H Start-L End-H End-L Data XOR SUM High byte of start user address ( 0 ~16383) Low byte of start user address High byte of end(last) user address Low byte of end(last) user address Bit mapping data bytes of users Description

Echo: After received the controller will echo ACK or NACK to the source controller or PC. Each user take one bit in the mapping memory. The device will discard the unused bits. User addr. Byte Bit 0 1 2 30 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

0 4 5 6 7 0 1 2 3

1 4 5 6 7 0

2 1

Ex. Setup user anti-pass back enable flag from address 07(Dec) to 46(Dec). 7E 0E DID 86 00 [00 07] [00 2E] 80 FF FF FF 7F xor sum

16

SOYAL



2010/5/7

2.13 Get User Parameters (87H)Value Head Length Node ID Command Addr H Addr L Nums XOR SUM 7E 07 01 87 00 02 01 7A 05 Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Get the user Parameters User Address High User Address - Low Number of cards XOR=FF^01^87^00^02^01 =7A SUM=(01+87+00+02+01+7A)FF=05(LSB) Addr H Addr L=0x02(00002) User Address : 00002 Description

Echo Head Length Node Function Reader ID Data Field

Bytes 1 or 4 1 or 2 1 1 1 24 24 Leading Code

Description

How many bytes of data will be followed The value 00 is fixed, the message would be sent to PC from the device Response to the request Reader ID The 1st User Parameters The 2nd

Check reference to User Parameters Data Structure Please

User Parameters

XOR SUM

17

SOYAL



2010/5/7

2.14 Read from Flash Memory (A4H)Value Head Length Node ID Command Addr HL Addr LH Addr LL Bytes Bytes XOR SUM 7E 07 01 A4 03 00 00 01 00 Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Read Flash Memory Memory Address Bit 23~16 Memory Address Bit 15~08 Memory Address Bit 07~00 High byte of read bytes High byte of read bytes Description

Echo Head Length Node Function Data XOR SUM

Bytes 1 or 4 1 or 2 1 3 Leading Code

Description

How many bytes of data will be followed The value 00 is fixed, the message would be sent to PC from the device Response to the request Return memory data according to read command

// Memory layout of QFM & AR725E // 0x010000 ~ 0x02FFFF ;16384 Normal UID: // 0x030000 ~ 0x04FFFF ;16384 Black UID: // 0x050000 ~ 0x06FFFF ;16384 Lift data: 16384 * 8 = 65536*2 bytes( Block:001~2: 2 Block) 16384 * 8 = 65536*2 bytes (Block:003~4: 2 Block ) 16384 * 8 = 65536*2 bytes

18

SOYAL



2010/5/7

2.15 Write to Flash Memory (A5H)Value Head Length Node ID Command Addr HL Addr LH Addr LL Bytes Bytes Data 7E 07 01 A4 03 00 00 01 00 Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Read Flash Memory Memory Address Bit 23~16 Memory Address Bit 15~08 Memory Address Bit 07~00 High byte of read bytes High byte of read bytes Follow the writing data XOR SUM Description

Echo Head Length Node Function XOR SUM

Bytes 1 or 4 1 or 2 1 1 Leading Code

Description

How many bytes of data will be followed The value 00 is fixed, the message would be sent to PC from the device Response ACK or NACK

19

SOYAL



2010/5/7

2.16 Erase User Data (85H)Value Head Length Node ID Command Addr H Addr L Addr H Addr L XOR SUM 7E 08 01 85 00 02 00 02 Leading Code How many bytes of data will be followed Node ID of destination, the node id is 01 here Erase user data Start User Address High Start User Address - Low End User Address High End User Address - Low XOR SUM Addr H Addr L=0x02(00002) User Address : 00002 Description

Addr H Addr L=0x02(00002) User Address : 00002

ECHO: 1) 2) After received the controller will echo ACK or NACK to the source controller or PC. It will take 100ms to 6 seconds depend on how many user assigned

20

SOYAL



2010/5/7

3 Data Structure3.1 Data Sturcture of Time ZoneData 0 : Link Data 1 : Level Beginning Time High Sunday Monday Tuesday Wednesday Thursday Friday Saturday Data 2 Data 6 Data 10 Data 14 Data 18 Data 22 Data 26 Low Data 3 Data 7 Data 11 Data 15 Data 19 Data 23 Data 27 High Data 4 Data 8 Data 12 Data 16 Data 20 Data 24 Data 28 End Time Low Data 5 Data 9 Data 13 Data 17 Data 21 Data 25 Data 29

Data 30 : Reserved Data 31 : Reserved 64 time zones available to setup, Time Zone 0 refers to Auto-shift

3.2 Data Structure of HolidaySet 00 Month Data 0 Date Data 1120 days available to setup for holiday

Set 01 Month Data 2 Date Data 3

Set xx Month Data xx Date Data xx

21

SOYAL



2010/5/7

3.3 Data Structure of User ParametersBytes Tag UID PIN Code Mode 8 4 1 Description Bit63~56,55~48,47~40,39~32,31~24,23~16,15~08,07~00.(MSB Format) Bit31~24,23~16,15~08,07~00.(MSB Format) Bit7/6:Access Mode Bit5patrol card Bit4reserved Bit3reserved Bit2enable expire check Bit1enable anti-pass back control Bit0password change available Zone Group 1 Group 2 Year Month Day Level Option Reserved 1 1 1 1 1 1 1 1 3 User Access Time Zone. Zero for free zone control Bit mapping of available door. (Door 16~8/Bit 7~0) 1 Access Mode Define (Bit 7/6) 00 01 10 11 Invalid Read Only Card or PIN Card + PIN

Bit mapping of available door. (Door 8~1/Bit 7~0) 1 Year of the last allowed date at 2 digital format Month of the last allowed date at 2 digital format Day of the last allowed date at 2 digital format User Level define Byte Extend option Byte. Bit7: 1/0 En/Disable Anti-pass-back check

1) Set to 1 to enable access on the door

22

SOYAL



2010/5/7

3.4 Address of User Lift DataAddress (0x050000 ~ 0x06FFFF) 16384 Users Lift data (16384 X 64) floors Use Flash Read (A4h)/Write (A5h) command for lift data maintains.

23

SOYAL



2010/5/7

4 Update log:Jun-05-2009 Jul-14-2009 Ver 1.01 First Release Ver 1.05 Ready for VisualProx 1V05.

24

Protocol 725E QFM3 En

Documents

Transcript of Protocol 725E QFM3 En