Balluff C1007 Cobalt HF RFID Reader User Manual C1007 Operator s Manual

BALLUFF inc Cobalt HF RFID Reader C1007 Operator s Manual

User Manual

scort Memory Systems reserves the right to make modifications andimprovements to its products and/or documentation without prior notification.Escort Memory Systems shall not be liable for technical or editorial errors oromissions contained herein, nor for incidental or consequential damages resultingfrom the use of this material.The text and graphic content of this publication may be used, printed and distributedonly when all of the following conditions are met:§ Permission is first obtained from Escort Memory Systems.§ The content is used for non-commercial purposes only.§ The content is not modified.§ The following copyright information is clearly displayed: Copyright © 2007,Escort Memory Systems, All Rights Reserved.The following are trademarks and/or registered trademarks of Escort MemorySystems, a Datalogic Group Company: Escort Memory Systems®, the EscortMemory Systems logo, Subnet16 and RFID AT WORK.Third party product names mentioned herein are used for identification purposes onlyand may be trademarks and/or registered trademarks of their respective companies:Philips, Rockwell Automation, Texas Instruments, Infineon, Belden and Microsoft.COPYRIGHT © 2007 ESCORT MEMORY SYSTEMS, ALL RIGHTS RESERVED, PUBLISHED IN USA.ECobalt C1007-Series RFID Controllers -Operators ManualFor Models: C1007-232/485/USB-01Publication P/N: 17-1327 REV 02 (08/07)
For C1007 models:•C1007-232-01•C1007-485-01•C1007-USB-01ESCORT MEMORY SYSTEMSCOBALT C1007-SERIESRFID CONTROLLERSHigh Frequency, Multi-Protocol, Passive RFID ControllersOPERATORSMANUALHow to Install, Configure and OperateCobalt C1007-Series RFID Controllers
REGULATORY COMPLIANCE -PENDINGFCC PART 15.105This equipment has been tested and found to comply with the limits for a Class Bdigital device, pursuant to part 15 of the FCC Rules. These limits are designed toprovide reasonable protection against harmful interference in a residential installation.This equipment uses, generates, and can radiate radio frequency energy and, if notinstalled and used in accordance with these instructions, may cause harmfulinterference to radio communications. However, there is no guarantee thatinterference will not occur in a particular installation. If this equipment does causeharmful interference to radio or television reception, which can be determined byturning the equipment off and on, the user is encouraged to try to correct theinterference by one or more of the following measures:• Reorient or relocate the receiving antenna.• Increase the separation between the equipment and receiver.• Connect the equipment into an outlet on a circuit different from that to whichthe receiver is connected.• Consult the dealer or an experienced radio/TV technician for help.FCC PART 15.21Users are cautioned that changes or modifications to the unit not expressly approvedby Escort Memory Systems may void the users authority to operate the equipment.This device complies with Part 15 of the FCC Rules. Operation is subject to thefollowing two conditions: (1) This device may not cause harmful interference, and (2)this device must accept any interference that may cause undesired operation.This product complies with CFR Title 21 Part 15.225.CEThis product complies with the following regulatory specifications: EN-300-330, EN-300-683, EN 60950, IEC 68-2-1, IEC 68-2-6, IEC 68-2-27 and IEC 68-2-28.TELECThis product complies with TELEC Regulations for Enforcement of the Radio LawArticle 6, section 1, No. 1.
CONTENTSP/N: 17-1327 REV 02 (08/07) PAGE 5 OF 82CONTENTSCONTENTS .................................................................................... 5LIST OF TABLES................................................................................................8LIST OF FIGURES ..............................................................................................9CHAPTER 1: GETTING STARTED ................................................101.1 INTRODUCTION........................................................................................101.1.1 Company Background ................................................................................................101.1.2 The C1007-Series RFID Controller ............................................................................. 101.1.3 Contents of the C1007 Package .................................................................................111.1.4 C1007 Features..........................................................................................................121.2 ABOUT THIS MANUAL...............................................................................131.2.1 Who Should Read this Manual?..................................................................................131.2.2 HEX Notation..............................................................................................................131.3 COMMUNICATION OPTIONS .......................................................................141.3.1 Connection and Communication Interface Options......................................................141.3.2 C1007 Controllers - Interface Connectors ...................................................................14CHAPTER 2: INSTALLING THE C1007..........................................152.1 PREPARING FOR INSTALLATION.................................................................152.1.1 Installation Guidelines.................................................................................................152.1.2 C1 00 7 Controller D imen sions .....................................................................................162.1.3 Mounting the Controller...............................................................................................172.2 INSTALLING THE C1007-232-01 CONTROLLER............................................192.2.1 Steps to Install the C1007-232-01...............................................................................192.2.2 C1007-232-01 Cabling Inf ormation ........................ ........ ................ ........ ................ .....202.3 INSTALLING THE C1007-485-01 CONTROLLER............................................232.3.1 Steps to Install the C1007-485-01...............................................................................232.3.2 C1007-485-01 Cabling Inf ormation ........................ ........ ................ ........ ................ .....242.4 INSTALLING THE C1007-USB-01 CONTROLLER ..........................................252.4.1 Steps to Install the C1007-USB-01..............................................................................252.4.2 C1007-USB-01 Cabling Information................ ........ ........ ........ ........ ................ ........ ....262.5 ANTENNA ENVIRONMENT..........................................................................27CHAPTER 3: POWER & COMMUNICATION...................................313.1 POWER REQUIREMENTS ...........................................................................313.1.1 C1007-232-01/C1007-485-01 Power Requirements....................................................313.1.2 C1007-USB-01 Power Requirements........... .............. .............. .............. .............. .......313.2 COBALT HF CONFIGURATION TAG.............................................................323.2.1 Co nfigura tion Tag Over view........................................................................................323.2.2 Configuration Tag Memory Map.................................................................................. 333.2.3 Using the Configuration Tag ....................................................................................... 33
CONTENTSP/N: 17-1327 REV 02 (08/07) PAGE 6 OF 82CHAPTER 4: LED STATUS ..........................................................354.1 LED FUNCTIONS OVERVIEW .....................................................................354.1.1 LED Descriptions........................................................................................................354.1.2 C1 007-23 2/USB LED Status.......................................................................................364.1.3 C1 007- 48 5 LED Status...............................................................................................364.2 SPECIAL LED FUNCTIONS........................................................................394.2.1 Updating the Controllers Firmware.............................................................................394.2.2 Continuous Read Mode  LED Behavior.....................................................................404.3 LED DISPLAYED ERROR CODES ...............................................................41CHAPTER 5: RFID TAGS .............................................................435.1 RFID TAG OVERVIEW ..............................................................................435.1.1 RFID Standards .......................................................................................................435.2 EMS RFID TAGS ....................................................................................445.2.1 HMS-Series Tags.......................................................................................................445.2.2 LRP-Series Tags ........................................................................................................445.3 TAG EMBODIMENTS .................................................................................455.3.1 Printed Circuit Board RFID Tags.................................................................................455.3.2 Molded RFID Tags .....................................................................................................465.4 TAG MEMORY .........................................................................................465.4.1 Mapp ing Tag Memory.................................................................................................475.4.2 Creating an RFID Tag Memory Map ...........................................................................475.4.3 Opt im iz ing Tag Memory..............................................................................................47CHAPTER 6: COMMAND PROTOCOLS.........................................496.1 COMMAND PROTOCOLS OVERVIEW............................................................496.1.1 ABx Protocols - Command Structures.........................................................................506.1.2 ABx Protocols - Headers and Terminators ..................................................................506.1.3 ABx Protocols - Response Structures .........................................................................506.2 ABXFAST COMMAND PROTOCOL..............................................................516.2.1 ABx Fast - Command / Response Procedure..............................................................516.2.2 ABx Fast - Command Packet Structure.......................................................................526.2.3 ABx Fast - Response Packet Structure.......................................................................536.2.4 ABx Fast - Command Packet Parameters...................................................................546.2.5 ABx Fast Multi-Tag Command Packet Structure..........................................................556.2.6 ABx Fast Multi-Tag Command Packet Elements.........................................................576.2.7 ABx Fast Multi-Tag Response Packet Structures........................................................596.2.8 ABx Fast Multi-Tag Response Final Termination Packet Structure..............................606.3 ABXSTANDARD COMMAND PROTOCOL......................................................616.3.1 ABx Standard - Command Packet Structure ...............................................................616.3.2 ABx Standard - Response Packet Structure................................................................626.3.3 ABx Standard - Command Example............................................................................63
CONTENTSP/N: 17-1327 REV 02 (08/07) PAGE 7 OF 82CHAPTER 7: RFID COMMANDS AND ERROR CODES ...................647.1 ABXFAST RFID COMMAND TABLE............................................................647.2 ABXSTANDARD RFID COMMAND TABLE ...................................................667.3 ERROR CODES........................................................................................677.4 ABXERROR CODE TABLE........................................................................687.5 ABXFAST ERROR RESPONSE STRUCTURE.................................................697.6 ABXSTANDARD ERROR RESPONSE STRUCTURE.........................................70APPENDIX A: TECHNICAL SPECIFICATIONS................................71APPENDIX B: MODELS & ACCESSORIES .....................................73EMS HARDWARE ............................................................................................73C 10 0 7 -S e r i e s RF I D Co n t r ol l e r s ..............................................................................73COBALT FAMILY SOFTWARE & DEMONSTRATION KITS .........................................747.6.1 Sof t ware A ppl i cati on s ....................................................................................747.6.2 Demon st rat i on Ki t s .........................................................................................74CABLE AND NETWORK ACCESSORIES ................................................................75POWER SUPPLIES ...........................................................................................767.6.3 Escort Memory Systems RFID Tags........................................................................76APPENDIX C: NETWORK DIAGRAMS ...........................................77APPENDIX D: ASCII CHART .........................................................80EMS WARRANTY ..........................................................................82
CONTENTSP/N: 17-1327 REV 02 (08/07) PAGE 8 OF 82LIST OF TABLESTable 1-1: Connection and Communication Interface Options....................................................14Table 1-2: C1007 Controllers - Interface Connectors .................................................................14Table 2-1: C1007-232-01 Interface Connector - Pinout..............................................................20Table 2-2: C1007-485-01 Interface Connector - Pinout..............................................................24Table 2-3: C1007-USB-01 Interface Connector - Pinout.............................................................26Table 3-1: EMS Power Supplies ................................................................................................31Table 3-2: Controller Default Values .......................................................................................... 33Table 4-1: Continuous Read Mode - LED Behavior....................................................................40Table 5-1: Tag Memory Map Example.......................................................................................47Table 6-1: ABx Protocols - Headers and Terminators ................................................................50Table 6-2: ABx Fast - Command Packet Structure.....................................................................53Table 6-3: ABx Fast - Response Packet Structure.....................................................................53Table 6-4: ABx Fast Multi-Tag Command Packet Structure........................................................56Table 6-5: ABx Fast Multi-Tag Response Packet Structure........................................................59Table 6-6: ABx Fast Multi-Tag Response Final Termination Packet Structure............................60Table 6-7: ABx Standard - Command Packet Structure..............................................................62Table 6-8: ABx Standard - Response Packet Structure..............................................................62Table 7-1: ABx Fast RFID Command Table...............................................................................65Table 7-2: ABx Standard RFID Command Table........................................................................66Table 7-3: ABx Error Codes....................................................................................................... 68Table 7-4: ABx Fast - Error Response Structure........................................................................69Table 7-5: ABx Standard - Error Response Structure.................................................................70
CONTENTSP/N: 17-1327 REV 02 (08/07) PAGE 9 OF 82LIST OF FIGURESFigure 2-1: C1007 RFID Controller Dimensions.........................................................................16Figure 2-2: Mounting the Controller Near Metallic Surfaces........................................................18Figure 2-3: C1007-232-01 Interface Connector - Diagram..........................................................20Figure 2-4: RS232 Interface Cable Schematic ...........................................................................21Figure 2-5: CBL-1478 Serial Interface Cable..............................................................................21Figure 2-6: CBL-1493 Connector ...............................................................................................22Figure 2-7: C1007-485-01 Interface Connector - Diagram..........................................................24Figure 2-8: CBL-1525................................................................................................................25Figure 2-9: C1007-USB-01 Interface Connector - Diagram ........................................................26Figure 2-10: C1007 Top View - LRP250S Typical Read Range..................................................27Figure 2-11: C1007 Front View - LRP250S Typical Read Range ...............................................28Figure 2-12: C1007 Top View - HMS150 Typical Read Range...................................................29Figure 2-13: C1007 Front View - HMS150 Typical Read Range.................................................30Figure 3-1: Cobalt HF Configuration Tag ...................................................................................32Figure 5-1: HMS125HT and HMS150HT tags............................................................................44Figure 5-2: LRP-Series Tags..................................................................................................... 45Figure 5-3: Optimizing Tag Memory...........................................................................................48Figure 6-1: ABx Fast - Command Packet Structure....................................................................52Figure 6-2: ABx Standard - Command Packet Structure ............................................................61Figure Appendix A-0-1: C1007-Series RFID Controller Dimensions ...........................................72Figure Appendix C-0-1: Subnet16 Gateway - C1007-485-01 ThinNet Network Diagram.............77Figure Appendix C-0-2: Subnet16 Gateway - C1007-485-01 ThinNet Network Diagram.............78Figure Appendix C-0-3: Subnet16 Hub - C1007-485-01 Network Diagram .................................79
CHAPTER 1: GETTING STARTEDP/N: 17-1327 REV 02 (08/07) PAGE 10 OF 82Escort Memory Systems headquarters inScotts Valley, CA.CHAPTER 1:GETTING STARTED1.1 INTRODUCTIONWelcome to the C1007-Series RFID Controllers - Operators Manual. This manualwill assist you in the installation, configuration and operation of Escort MemorySystems C1007-Series RFID Controllers.The C1007-Series product family is a complete line of passive high frequencyread/write Radio-Frequency Identification solutions. These devices are designed tobe compact, reliable and rugged, in order to meet and exceed the requirements ofthe industrial automation industry.1.1.1 Company BackgroundEscort MemorySystems is anindustry leader inproviding RadioFrequencyIdentification(RFID) systems.By consistentlydelivering anextended selectionof high quality,highly durableRFID devices,Escort MemorySystems has builta solid reputation.1.1.2 The C1007-Series RFIDControllerEscort Memory Systems' C1007-Series RFID Controllers are among themost compact in our line of passive RFID controllers. Throughinductive coupling, RFID enabled tags are able to utilize theRadio Frequency (RF) field from the controllers integratedantenna to acquire power. By being able to receive powerfrom the RFID controller, the tag, itself, does not requirean internal power supply or battery - and is thereforesaid to be passive.Passive tags, however, must enter the antennaselectromagnetic field to establish a link with the controller, andmust remain within RF range during the entire data transfer process.
CHAPTER 1: GETTING STARTEDP/N: 17-1327 REV 02 (08/07) PAGE 11 OF 82The C1007 Controller utilizes the internationally recognized ISM (Industrial, Scientificand Medical) frequency of 13.56 MHz to power the tag, while modulating side-bandfrequencies for communicating data.The entire RFID system works by attaching a tag to a product or its carrier. The RFIDtag acts as an electronic identifier, portable job sheet, or real-time tracking database.Tags are identified, read and written to by issuing specific commands from a hostcomputer.RFID tags can be read and written to through any nonconductive, non-metallicmaterial, while moving or standing still, in or out of the direct line of sight.The controller provides cost effective RFID data collection and control solutions toshop floor, item-level tracking and material handling applications. It is compatible withall LRP and HMS-Series tags from Escort Memory Systems.1.1.3 Contents of the C1007 PackageUnpack the C1007 hardware and accessories. Retain the original shipping cartonand packing material in case any items need to be returned. Inspect each item forevidence of damage. If an item appears to be damaged, notify your EMS productdistributor.The C1007 product package contains the following components:EMS P/N QTY DESCRIPTIONC1007-XXX-01 1 C1007-Series RFID Controller00-3000 1 HF-Series Configuration Tag (I-CODE SLi)17-3140~3 1 C1007-Series RFID Controller  Installation GuideNote: XXX = 232, 485 or USBUser Supplied ComponentsTo configure a complete RFID system, you will need to provide the following items:•Passive, read/write RFID tags (EMS HMS, LRP and/or T-Series)•Controller-to-Host communication interface cable: (RS232, RS485 or USB)•Host device: (PC, PLC, MUX32, TCP/IP, Ethernet/IP, Subnet16 Gateway orHub)•Power supply: 10~30VDC, 3.6W (150mA @ 24VDC)•Mating connectors: (when applicable)•Mounting hardware (screws, washers and nuts)
CHAPTER 1: GETTING STARTEDP/N: 17-1327 REV 02 (08/07) PAGE 12 OF 821.1.4 C1007 Features§ High performance, low-cost, 13.56MHz RFID controller with integrated RFantenna that may be mounted directly to metallic surfaces§ Supports multiple RF, ABx, air and serial communications protocols§ Small controller size: approximately 100mm x 70mm§ Flash memory for software updates and configuration storage§ Auto configurable / software programmable§ Eight LED indicators display power, COM port activity, RF activity, Subnet16Node ID, system diagnostics, error codes and controller status§ Reads/Writes ISO 14443A and ISO 15693 compatible RFID tags (LRP, HMSand T-Series RFID tags from EMS)§ FCC/CE/TELEC agency compliance certification (PENDING)§ IP67 rated enclosure and M12 interface connector (8-pin for RS232; 5-pin forRS485/USB)§ Fully encapsulated electronics
CHAPTER 1: GETTING STARTEDP/N: 17-1327 REV 02 (08/07) PAGE 13 OF 821.2 ABOUT THIS MANUALThis document provides guidelines and instructions on how to install and operateC1007-Series RFID Controllers.This document does NOT include explicit details regarding each of the C1007s RFIDcommands. Specific RFID command related information is available in the ABx FastCommand Protocol  Reference Manual and the ABx Standard CommandProtocol  Reference Manual, both of which are available at www.ems-rfid.com.However, this manual does explain the process of issuing commands from a host PCto a C1007 RFID controller.NOTE:Occasionally in this manual, the C1007-Series RFID Controller is referred to as theC1007 Controller, the C1007 or just simply the controller.1.2.1 Who Should Read this Manual?This manual should be read by those who will be installing, configuring and operatingC1007-Series RFID Controllers. This may include the following people:§ Hardware Installers§ System Integrators§ Project Managers§ IT Personnel§ System and Database Administrators§ Software Application Engineers§ Service and Maintenance Engineers1.2.2 HEX NotationThroughout this manual, numbers expressed in Hexadecimal notation are prefacedwith 0x. For example, the number "10" in decimal is expressed as "0x0A" inhexadecimal. See Appendix D for a chart containing Hex values, ASCII charactersand their corresponding decimal integers.
CHAPTER 1: GETTING STARTEDP/N: 17-1327 REV 02 (08/07) PAGE 14 OF 821.3 COMMUNICATION OPTIONSThere are three distinct versions of the C1007 RFID Controller. Each model providessupport for one specific communication interface requirement.1.3.1 Connection and Communication Interface OptionsCONTROLLERMODEL CONNECTIONTYPE COMMUNICATIONINTERFACE MAX CABLELENGTHC1007-232-01 RS232 Point-to-Point, Host/Controller 15 MetersC1007-485-01 RS485 Subnet16 Multidrop busarchitecture via Subnet16Gateway or Hub300 MetersC1007-USB-01 USB 2.0 Point-to-Point, Host/Controller 5 MetersTable 1-1: Connection and Communication Interface Options1.3.2 C1007 Controllers - Interface ConnectorsCONTROLLER MODEL INTERFACE CONNECTOR(S)C1007-232-01 8-pin, male M12 connectorC1007-485-01 5-pin, male M12 connectorC1007-USB-01 5-pin, male, reverse-keyed M12 connectorTable 1-2: C1007 Controllers - Interface ConnectorsThrough the Subnet16 protocol, multiple C1007-485-01 controllers can be networkedvia a single bus that is connected to an EMS Subnet16 Gateway or Hub interfacemodule.See Appendix B: Models & Accessories for more information on model numbers,parts and accessories for all C1007-Series RFID Controllers.
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 15 OF 82CHAPTER 2:INSTALLING THE C10072.1 PREPARING FOR INSTALLATIONC1007-Series RFID Controllers support direct connections for point-to-point(host/controller) applications (RS232, RS485 and USB). Up to 16 C1007-485 unitscan be networked via Subnet16 Gateway interface module and Escort MemorySystems Subnet16 Multidrop Bus Architecture. Host/controller data transmission isachieved via 5-pin or 8-pin serial interface cable.2.1.1 Installation Guidelines•Conduct a test phase where you will construct a small scale, independentnetwork that includes only the essential devices required to test your RFIDapplication. To avoid possible interference with other devices, do not initiallyconnect your RFID testing environment to an existing local area network.•RF performance and read/write range can be negatively impacted by theproximity of metallic objects. Avoid mounting the controller within 60mm (2.36inches) of any metallic object or surface.•If electrical interference is encountered (as indicated by a reduction inread/write performance), relocate the controller to an area free from potentialsources of interference.•Route cables away from other unshielded cables and away from wiringcarrying high voltage or high current. Avoid routing cables near motors andsolenoids.•Refrain from mounting the controller near sources of EMI (electro-magneticinterference) or near devices that generate high ESD (electro-staticdischarge) levels.•Always use adequate ESD prevention measures to dissipate potentially highvoltages. C1007 controllers are designed to withstand 8kV of direct ESD and15kV of air gap discharge. However, it is not uncommon for some RFIDapplications to generate considerably higher ESD levels.•For applications using multiple RFID controllers operating at the 13.56 MHzfrequency, maintain a minimum distance of at least 20 centimeters betweenadjacent RF devices.
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 16 OF 822.1.2 C1007 Controller DimensionsThe graphic below contains the dimensions of the Cobalt C1007-Series RFIDControllers. Dimensions are listed in millimeters and [inches].Figure 2-1: C1007 RFID Controller DimensionsTightenmountingscrews tobetween 1.3and 1.7 Nm (12 15 lbf/in).
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 17 OF 822.1.3 Mounting the ControllerC1007-Series RFID Controllers can be mounted to wood, plastic fixtures and metalplate surfaces. However, do not recess the C1007 in metal and allow at least 60mmclearance from metallic objects along the sides of the C1007.To fasten the controller to the mounting surface you will need two M5 (#10) diameterscrews, four flat washers, two spring lock washers and two nuts (not included).NOTE: The controller may be mounted horizontally or vertically, but should be alignedin such a manner that the LED indicators can be seen during operation.1. Select a suitable location tomount the C1007 Controller.2. Place one flat washer on eachscrew and pass the screwsthrough the mounting holeson the C1007.3. From the backside, place oneflat washer, one spring lockwasher and one nut on eachscrew.4. Tighten screws to between1.3 and 1.7 Nm (12-15 lbf/in).NOTE: To convert Newton metres to pound force inches1 Nm = 8.851 lbf/in To convert pound force inches to Newton metres1 lbf/in = 0.1129 Nm
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 18 OF 82Though the C1007 may be mounted directly to metallic plate surfaces, to avoid apotential drop in read/write range, do not affix the controller in such a manner thatmetal is within 60mm of the sides of the device.Figure 2-2: Mounting the Controller Near Metallic Surfaces
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 19 OF 822.2 INSTALLING THE C1007-232-01 CONTROLLERThe C1007-232-01 RFID Controller is designed for point-to-point RFID applications,where the distance from host to controller is less than 15 meters (50 feet). Thecontroller connects directly to a serial communications port on a host computer via anRS232-compatible interface cable.NOTE: review Section 2.1.1 Installation Guidelines prior to installing the controller.2.2.1 Steps to Install the C1007-232-011. Attach the controller to the work area as noted in Section 2.1.3 Mounting theController.2. Connect the 8-pin, female M12 connector from your serial interface cable (EMSCable P/N: CBL-1478: 8-pin, female M12 to RS232; with 2.5mm DC power jack,2m) to the 8-pin, male M12 connector on the C1007-232-01.3. Connect the serial interface cables DE9F D-Sub connector to a COM port on thehost computer. Tighten the cables two locking thumbscrews.4. Provide a power supply for the controller that is capable of delivering 10~30VDC,3.6W (150mA @ 24VDC).5. Connect the 2.5mm DC power plug on the power supply transformer to the DCpower jack receptacle on the serial interface cable. Tighten the locking ring toprevent power from becoming disconnected during use.6. Plug the power supply transformer into a suitable AC power source. Apply powerto the controller after all cable connections have been made. The LEDs on theunit should flash. For the C1007-232 model, the amber LED 20 should stay litindefinitely to indicate that the controller is in RS232 mode.7. On the host computer, set COM port parameters to: 9600 baud, 8 data bits, 1stop bit, no parity and no handshaking.8. To verify operations, download the Cobalt HF Serial Dashboard Utility fromEscort Memory Systems website (www.ems-rfid.com). The Dashboard Utilityallows users to send RFID commands to the controller for testing purposes.2321PWR242220COMR FRF FIELDLED 20willilluminate toindicate RS232mode.
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 20 OF 822.2.2 C1007-232-01 Cabling InformationThe C1007-232-01 has one 8-pin, male M12 interface connector.C1007-232-01 Interface Connector  PinoutPIN # DESCRIPTION110~30VDC POWER20VDC (POWER GROUND)3NOT CONNECTED4NOT CONNECTED5NOT CONNECTED6RX7TX8SGND (SIGNAL GROUND)Table 2-1: C1007-232-01 Interface Connector - PinoutC1007-232-01 Interface Connector  DiagramFigure 2-3: C1007-232-01 Interface Connector - DiagramCabling Part Numbers for the C1007-232-01•CBL-1478: Cable Assembly (8-pin, female M12 to RS232; with 2.5mm DC powerjack, 2m)•CBL-1488-XX: Cable (8-pin, female M12 to bare wire leads)•CBL-1492-XX: Cable (8-pin, right-angle female M12 to bare wire leads)•CBL-1493: Connector (8-pos, straight female M12, field mountable) (XX = Cable Length in Meters)
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 21 OF 82RS232 Serial Interface Cable SchematicIf you intend to assemble your own RS232 serial interface cable, follow the schematicbelow. Note that signals and electrical loads applied to Pin 6 (RX) and Pin 7 (TX)should conform to RS232 specifications. For bulk RS232 cable, see Belden cableP/N: 9941 (www.belden.com).Figure 2-4: RS232 Interface Cable SchematicCBL-1478: Serial Interface CableFigure 2-5: CBL-1478 Serial Interface Cable
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 22 OF 82CBL-1493: Field Mountable ConnectorFigure 2-6: CBL-1493 ConnectorThe CBL-1493 field mountable connector is available for connecting the C1007-232-01 to a host computer via bulk cable. (See Appendix B for more information regardingcables and connectors for the entire line of C1007-Series RFID Controllers).
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 23 OF 822.3 INSTALLING THE C1007-485-01 CONTROLLERThe C1007-485-01 supports RS485 communications and EMS Subnet16Multidrop bus architecture and RFID network protocol. Through the Subnet16protocol, multiple C1007-485-01 units can be connected to one Subnet16 RFIDGateway or Hub interface device. The Gateway or Hub assigns each attachedC1007-485-01 a unique Node ID number through which communication with a hostPC and/or Programmable Logic Controller (PLC) is achieved.NOTE: review Section 2.1.1 Installation Guidelines prior to installing the controller.2.3.1 Steps to Install the C1007-485-011. Attach the controller to the work area as noted in Section 2.1.3 Mounting theController.2. Connect the 5-pin, female end of your Subnet16 compatible cable to the 5-pin,male M12 interface connector on the C1007-485. Connect the opposite end ofthis cable to an EMS Subnet16 Gateway or Hub device. Connect the Gateway orHub to a host computer via Category 5E Ethernet cabling*.3. Turn the power supply ON. The green power LED on the unit will illuminate whenpower is applied to the unit. The five amber Node LEDs, when lit, display theNode ID value (in binary format from right to left) currently assigned to theC1007-485 RFID Controller. Note: the default Node ID value is zero, in whichcase none of the amber Node LEDs will be lit.4. To verify operations, download the Cobalt HF TCP/IP Dashboard Utility fromEscort Memory Systems website (www.ems-rfid.com). The Dashboard Utilityallows Gateway/Hub users to send RFID commands to any connected Cobaltcontroller for testing purposes.* For more information regarding the installation of a Subnet16 Gateway or Subnet16Hub, refer to the Operators Manual for each product, available online at www.ems-rfid.com.23 21PWR2422 20COMR FRF FIELDAmber NodeLEDs 20- 24indicate Node IDof the C1007-485controller.
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 24 OF 822.3.2 C1007-485-01 Cabling InformationThe C1007-485-01 has one 5-pin, male M12 interface connector.C1007-485-01 Interface Connector - PinoutPIN # DESCRIPTION1SGND (SIGNAL GROUND)210~30VDC POWER30V (POWER GROUND)4TX/RX+5TX/RX-Table 2-2: C1007-485-01 Interface Connector - PinoutC1007-485-01 Interface Connector - DiagramFigure 2-7: C1007-485-01 Interface Connector - Diagram
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 25 OF 822.4 INSTALLING THE C1007-USB-01 CONTROLLERThe C1007-USB-01 RFID Controller is designed for point-to-point RFID applicationsthat support USB 2.0 communications. Host/controller data is transmitted viastandard USB cabling.NOTE: review Section 2.1.1 Installation Guidelines prior to installing the controller.2.4.1 Steps to Install the C1007-USB-011. Download the Cobalt USB driver software from the Escort Memory Systemswebsite (www.ems-rfid.com). Extract the .zip file archive to a separate folder onthe desktop of the host computer.2. Install the Cobalt USB driver. For instructions, refer to EMS document P/N: 17-3128Cobalt USB Driver - Installation Instructions,which is included in theCobalt USB driver archive.3. Attach the controller to the work area as noted in Section 2.1.3  Mounting theController.4. Attach the 5-pin, female, reverse-keyed M12 connector from a suitable USBcable (EMS P/N: CBL-1525, not included) to the 5-pin, male, reverse-keyed M12interface connector on the C1007-USB-01.Figure 2-8: CBL-15255. Plug the remaining end of the USB interface cable into a USB port on the hostcomputer. The LEDs on the unit should flash. For the C1007-USB model, theamber LED 22 should illuminate to indicate that the controller is in USB mode.6. To verify operations, download the Cobalt HF Serial Dashboard Utility from theEMS website (www.ems-rfid.com). The Dashboard Utility allows users to sendRFID commands to the controller for testing purposes.
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 26 OF 822.4.2 C1007-USB-01 Cabling InformationThe C1007-USB-01 has one 5-pin, male, reverse-keyed, M12 interface connector.C1007-USB-01 Interface Connector - PinoutPIN # DESCRIPTION1+5V2D-3D+4GND5SHIELDTable 2-3: C1007-USB-01 Interface Connector - PinoutC1007-USB-01 Interface Connector  DiagramFigure 2-9: C1007-USB-01 Interface Connector - DiagramCabling Part Numbers for the C1007-USB-01•CBL-1514: Connector (5-pin, straight male, reverse-keyed M12 for USB)•CBL-1525: Cable Assembly (5-pin, female, reverse-keyed M12 to USB type A,3m)2321PWR242220COMR FRF FIELDLED 22willilluminate toindicate USBmode.
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 27 OF 822.5 ANTENNA ENVIRONMENTThe antenna used to power and communicate with RFID tags is integrated within thehousing module of the C1007 RFID Controller. Electro-magnetic interference (EMI)and the presence of metal near the antennas RF field can negatively affect thecommunication range of the RFID controller.Figure 2-10: C1007 Top View - LRP250S Typical Read Range
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 28 OF 82Figure 2-11: C1007 Front View - LRP250S Typical Read Range
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 29 OF 82Figure 2-12: C1007 Top View - HMS150 Typical Read Range
CHAPTER 2: INSTALLING THE C1007P/N: 17-1327 REV 02 (08/07) PAGE 30 OF 82Figure 2-13: C1007 Front View - HMS150 Typical Read Range
CHAPTER 3: POWER & COMMUNICATIONP/N: 17-1327 REV 02 (08/07) PAGE 31 OF 82CHAPTER 3:POWER & COMMUNICATION3.1 POWER REQUIREMENTS3.1.1 C1007-232-01/C1007-485-01 Power RequirementsC1007-232-01 and C1007-485-01 RFID Controllers require an agency compliant LPSpower supply capable of providing the following:10~30VDC, 3.6W (150mA @ 24VDC)EMS Power Supplies for C1007-232 and C1007-485 RFID ControllersEMS PART NUMBER DESCRIPTION00-1166 45W, 1.88A max @ 24VDC00-1167 100W, 4.17A max @ 24VDC00-1168 120W, 5.0A max @ 24VDCTable 3-1: EMS Power Supplies3.1.2 C1007-USB-01 Power RequirementsThe C1007-USB-01 RFID Controller obtains power directly from the USB busTypical power consumption under normal conditions = 2.5W (500mA @ 5VDC)CAUTION:Do not connect or disconnect the C1007 while power is applied. Turn the power supplyoff at the source prior to connecting or disconnecting the unit. Reapply power only afterthe controller has been reconnected.Use only high quality, shielded cables for power and interface connections. SeeAppendix B for a list of compatible cables and network components.
CHAPTER 3: POWER & COMMUNICATIONP/N: 17-1327 REV 02 (08/07) PAGE 32 OF 823.2 COBALT HF CONFIGURATION TAG3.2.1 Configuration Tag OverviewIn the past, RFID controllers had multiple jumpers and DIP-switches that were usedto set various configuration parameters. C1007-Series RFID Controllers do notrequire jumpers or DIP-switches because they are software configurable viacommands sent from a host PC as well as through the use of a Cobalt HFConfiguration Tag.Figure 3-1: Cobalt HF Configuration TagIn the event that serial communication parameters become improperly assigned,reset or cycle power to the RFID controller while holding the Configuration Tag in thecontrollers RF field. When power returns to the controller, factory default settings willbe read from the Configuration Tag and the controllers internal configuration will bereset. For the C1007-485, the Configuration Tag can also be used to set the devicesNode ID manually. It is recommended that you write the product model and serialnumber on the tag and store it in a safe place.
CHAPTER 3: POWER & COMMUNICATIONP/N: 17-1327 REV 02 (08/07) PAGE 33 OF 823.2.2 Configuration Tag Memory MapContaining a Philips I-CODE SLi IC, the Configuration Tag is a 112-byte ISO 15693compliant tag that has had much of its memory locked at the factory to preventimportant data from being erased or overwritten. Of the 112 bytes of memory, the first80 bytes (addresses 0x0000  0x0079) are allocated to storing factory defaultsettings, product ID and manufacturing information. The first 16-bytes (addresses0x0000 through 0x0015) contain specific data that the controller reads to identify thisspecial tag.You are welcome to experiment with the remaining 32 bytes available (addresses0x0080  0x0111). All addresses on the Configuration Tag can be read and no useridentifiable information is stored.3.2.3 Using the Configuration TagResetting the Controller Configuration to Default ValuesThe Configuration Tag can be used to reset factory defaults to all versions of theC1007. To restore factory default values, cycle power to the controller or issue thereset command (Command 0x35) while the Configuration Tag is in the RF field. Twoseconds after power returns to the C1007, remove the Configuration Tag from the RFfield. The controllers configuration will be reset to the following default values:CONFIGURATION PARAMETER DEFAULT VALUECommand Protocol ABx Fast  No ChecksumTag Type ISO 15693 (I-Code SLi)Serial Communications 9600, N, 8, 1, N (C1007-232 model)Node ID zero (C1007-485 model)Table 3-2: Controller Default ValuesSetting Node ID Manually (C1007-485 Model Only)To set the Node ID on C1007-485 models, cycle power to the controller or issue thereset command (Command 0x35) while the Configuration Tag is in the RF field. Twoseconds after power returns to the C1007, remove the Configuration Tag from the RFfield. This will set the Node ID value back to the default value of Node ID 00.• All amber Node LEDs should be off.After power returns to the unit, move the Configuration Tag out of the RF field andthen back into the RF field to increment the Node ID from zero to one.• Amber Node LED 20 should now be lit.Removing the Configuration Tag from the controllers RF field and then placing itback into the field will increment the Node ID value once each time the ConfigurationTag re-enters the RF field.• The amber Node LEDs will display, in binary, the Node ID assigned to thecontroller.
CHAPTER 3: POWER & COMMUNICATIONP/N: 17-1327 REV 02 (08/07) PAGE 34 OF 82This procedure can be used to cycle through all 16 possible Node ID values. Notethat after reaching Node ID 16, incrementing the value once more returns thecontroller to Node ID 00.After selecting the desired Node ID value, reset the C1007 with the Configuration Tagout of RF range to allow the unit to reset completely and resume operation under itsnew Node ID.See Section 4.1 LED Functions Overviewfor more information regarding LEDpositions and colors.Setting Node ID Automatically (C1007-485 Model Only)To allow a Subnet16 Gateway or Hub to assign the Subnet Node ID to a C1007-485automatically, reset the controller to Node ID 00, connect the controller to the network,and apply power to the Subnet16 bus. When the Gateway or Hub comes on line,hold the Configuration Tag in the RF field of the controller for several seconds toallow the Gateway or Hub to assign the next available Node ID value.For more information on using a Subnet16 Gateway and Hub product to auto-assignSubnet Node ID values, please refer to the Operators Manuals for the Subnet16Gateway and/or subnet16 Hub.
CHAPTER 4: LED STATUSP/N: 17-1327 REV 02 (08/07) PAGE 35 OF 82CHAPTER 4:LED STATUS4.1 LED FUNCTIONS OVERVIEWC1007-Series RFID Controllers have eight LED indicators. The LEDs areconveniently located on the top panel of the device and display everything fromantenna RF and communications activity to Node ID, diagnostic information andpower status.LEDCOLOR Red Green Amber Amber Amber Amber Amber GreenFUNCTION RFActivityCOMActivityNode24(16)Node23(8)Node22(4)Node21 (2)Node20 (1)PowerOn4.1.1 LED DescriptionsRF LED: Color is red. The RF LED will illuminate while RF power is beingtransmitted by the antenna, and will stay ON during the entire RF operation. Bydefault, this occurs each time an RF command is being executed.COM LED: Color is green. The COM LED indicates that data is being transmittedbetween the host and the C1007. On receipt of a command, the COM LED willbegin flashing ON and OFF rapidly. After the controller generates the commandresponse, COM LED flashing will halt. When in Continuous Read mode, the COMLED will remain ON and will turn OFF briefly only while a tag is in the antenna fieldand data is being read or written to the tag. Node LEDs: Colors are amber. These five LEDs indicate the serialcommunications type for C1007-232 and -USB models. For the C1007-485model, the five amber LEDs indicate (in binary from right to left) the current NodeID value assigned to the controller. The five amber LEDs also flash an error codewhen a fault occurs (see Section 4.3 LED Displayed Error Codes).Power LED: Color is green. The Power LED will remain ON while power isapplied to the C1007-Series RFID Controller.
CHAPTER 4: LED STATUSP/N: 17-1327 REV 02 (08/07) PAGE 36 OF 82Node 0(default) Node 1 Node 24.1.2 C1007-232/USB LED StatusC1007-232 - amber Node LED 20 will illuminate. Node LED 20indicates RS232 mode.C1007-USB - amber Node LED 23will illuminate. Node LED 23indicates USB mode.4.1.3 C1007-485 LED StatusWhen used in conjunction with a Subnet16 Gateway or Subnet16 Hub, the fiveamber Node LEDs on the C1007-485 model indicate (in binary, weighted by powersof two, from right to left) the Node ID value currently assigned (for which there are 16).For example, 20 (0x01) = Node ID 1, 21 (0x02) = Node ID 2, 22 (0x04) = Node ID 4, 23(0x08) = Node ID 8, 24(0x10) = Node ID 16.By default, C1007-485 RFID Controllers ship with their Node ID value set to zero(none of the five amber Node LEDs will be lit). After the controller is connected to aSubnet16 bus and has been recognized by a Subnet16 Gateway or Hub, it will beautomatically assigned the next available Node ID (1 through 16). For configuring orresetting the Node ID using the Configuration Tag, see Chapter 3  Section 3.2:Cobalt HF Configuration Tag.N ode ID Values for the C1007-4852321PWR242220COMR FRF FIELDPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRF
CHAPTER 4: LED STATUSP/N: 17-1327 REV 02 (08/07) PAGE 37 OF 82Node 3 Node 4 Node 5Node 6 Node 7 Node 8Node 9 Node 10 Node 11Node 12 Node 13 Node 14PWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRFPWR2423212220COMRF
CHAPTER 4: LED STATUSP/N: 17-1327 REV 02 (08/07) PAGE 38 OF 82Node 15 Node 16NOTE:Node ID 00 is the default Node ID for C1007-485 controllers. In this state the controllerwill be unable to perform commands until it has been initialized by a Gateway or Hub, atwhich time it will be assigned a Node ID value between 1 and 16.PWR2423212220COMRFPWR2423212220COMRF
CHAPTER 4: LED STATUSP/N: 17-1327 REV 02 (08/07) PAGE 39 OF 824.2 SPECIAL LED FUNCTIONS4.2.1 Updating the Controllers FirmwareUpdating Firmware(Part 1)With the PWR LED on theright, the remaining LEDs willilluminate one at a timesequentially from right to left toindicate that new firmwarecode is being copied tointernal memory.The LEDs will repeat this R toL sequence until the C1007has completely received thefirmware installation file.
CHAPTER 4: LED STATUSP/N: 17-1327 REV 02 (08/07) PAGE 40 OF 824.2.2 Continuous Read Mode  LED BehaviorThe table below describes the behavior of the LEDs when the C1007 is inContinuous Read Mode (Command 0x0D).LED BEHAVIOR DESCRIPTIONPWR ON Controller is powered and functioningCOM ON Duplicate Read Delay  1 and a tag has entered the RF field.COM LED will remain ON while a tag is in the RF field.After the tag has exited the RF field the COM light will remainON for the duration of the Duplicate Read Delay before turningOFFCOM BLINKING Duplicate Read Delay = 0 and a tag is in the RF fieldRF ON Continuous Read mode is enabledTable 4-1: Continuous Read Mode - LED BehaviorUpdating Firmware(Part 2)After the new firmware hasbeen copied to internalmemory, the LEDs will blinkON and OFF repeatedly duringwhich time the new code isbeing written to flash memory.Warning: do not cancel orabort this operation, AND donot unplug or remove powerfrom the controller under anycircumstance until thisprocedure is completed.
CHAPTER 4: LED STATUSP/N: 17-1327 REV 02 (08/07) PAGE 41 OF 824.3 LED DISPLAYED ERROR CODESWhen an error occurs, other than a Timeout, the red RF LED and one or more amberNode LEDs will flash in unison. The amber Node LEDs flash a binary representationof the one-byte error code value of the fault that transpired. The COM LED will alsobe illuminated after an error occurs to help orient the binary LED positions. SeeChapter 8: ABx Error Codes for a complete list of errors and their descriptions.To display the single-byte error code in binary, the two left-most amber Node LEDs(LED 24and LED 23) represent the first or most significant digit (MSD) of the errorcode. The three remaining amber Node LEDs (LED 22, LED 21and LED 20) arecombined to represent the second or least significant digit (LSD) of the error code.Examples:•If the five amber Node LEDs (from L to R) =ON, OFF, OFF, OFF, ON, the first digit of theerror code is a 2 and the second digit is a1, meaning that error code 0x21 occurred(error code 0x21 = command syntax error).•If the five amber Node LEDs (from L to R) =ON, ON, OFF, ON, OFF, the first digit of theerror code is a 3 and the second digit is a2, meaning that error code 0x32 occurred(error code 0x32 = invalid programmingaddress).The red RF LED and amber Node LEDs will continue to flash until a valid commandis received by the controller. If an unrecoverable error occurs, the LEDs willcontinuously flash the error code until the C1007 has been reset.PWR2423212220COMRFPWR2423212220COMRF
CHAPTER 4: LED STATUSP/N: 17-1327 REV 02 (08/07) PAGE 42 OF 82PWR2423212220COMRFThis example depicts Error 0x21.When an error occurs, the greenCOM LED will remain ON to helporient the binary LED positions. Thegreen power LED will also be ONwhile power is applied to the C1007.
CHAPTER 5: RFID TAGSP/N: 17-1327 REV 02 (08/07) PAGE 43 OF 82CHAPTER 5:RFID TAGS5.1 RFID TAG OVERVIEWRFID tags, which are also referred to as transponders, smart labels, or inlays, comein a variety of sizes, memory capacities, read ranges, frequencies, temperaturesurvivability ranges and physical embodiments. C1007-Series RFID Controllers arecapable of reading Escort Memory Systems HMS, LRP and T-Series RFID tags aswell as most tags made by other manufacturers.5.1.1 RFID StandardsISO 14443ARFID integrated circuits (ICs) designed to meet the ISO 14443A standard wereoriginally intended for use in smart cards used in secure transactions such as creditcards, passports, bus passes, ski lift tickets, etc. For this reason there are manysecurity authentication measures taken within the air protocol between the RFIDcontroller and the tag. Escort Memory Systems was the first company to adopt ISO14443A RFID ICs with this technology for industrial automation applications. Becausethese applications do not require the level of security monetary or passportapplications require, many of these features have not been implemented in currentcontrollers. It is important to understand the requirements of an ISO 14443Aapplication before assuming the C1007-Series controller is suitable.ISO 14443A compliant tags and controllers incorporate security authentication anduse software keys during the transfer of data to and from a tag. Both the RFIDcontroller and the tag must use the same security keys for communication to beauthenticated. The C1007 controllers operating system manages these securityfeatures, making their existence essentially transparent to the user.However, it is important to understand the implications associated with ISO 14443Awhen using a third party manufacturers tags. Because of the aforementionedsecurity features an ISO 14443A tag made by one manufacturer might not bereadable by C1007 controllers and likewise, an EMS ISO 14443A compliant tagmight not be readable by another manufacturers RFID controller. C1007-SeriesControllers support EMS security keys for use on Mifare-based ISO 14443A tags.ISO 15693ISO 15693 was established at a time when the RFID industry identified that the lackof standards was preventing market growth and further adoption of RFIDtechnologies. Philips Semiconductor and Texas Instruments were the majormanufacturers producing RFID ICs for the Industrial, Scientific, and Medical (ISM)frequency of 13.56MHz, but each used a unique protocol and modulation algorithm.Texas Instruments Tag-it and Philips Semiconductors I-CODE product lineswere eventually standardized on the mutually compatible ISO 15693 standard. Afterthe decision was made to standardize, the door opened for other siliconmanufacturers to enter the RFID business, many of which have since contributed toRFID ISO definitions. This healthy competition has led to rapid growth in the industryand has pushed the development of other standards, such as ISO 18000 forElectronic Product Code (EPC) applications.
CHAPTER 5: RFID TAGSP/N: 17-1327 REV 02 (08/07) PAGE 44 OF 82ISO 18000-3.1The ISO 18000 standard has not been implemented in C1007-Series RFIDControllers at the time of publication of this manual. It is a planned productenhancement for future release. This will provide support for EPC and UniqueIdentification (UID) tag applications.ADDITIONAL INFORMATION:Because ISO 14443A and ISO 15693 standards leave many features open to thediscretion and interpretation of the RFID equipment manufacturer, EMS can notguarantee that all 13.56MHz RFID tags will be compatible with Cobalt controllers. Whenusing any tag other than those supplied by Escort Memory Systems, you should ensurecompatibility of those tags with your RFID system provider.5.2 EMS RFID TAGSAs of the publication of this manual, tags that contain the following RFID integratedcircuits are compatible with Cobalt C1007-Series RFID Controllers.5.2.1 HMS-Series Tags•Philips Mifare Classic: 1KB total IC memory, + 32-bit tag ID. Of this memory, 736bytes are available for user data (ISO 14443A compliant).•Philips Mifare Classic: 4KB total IC memory, + 32-bit tag ID. Of this memory,3,440 bytes are available for user data (ISO 14443A compliant).Figure 5-1: HMS125HT and HMS150HT tags5.2.2 LRP-Series Tags§Philips I-CODE 1: 48 bytes total IC memory available for user data, + 64-bit tagID.§Philips I-CODE SLi: 112 bytes total IC memory available for user data, + 64-bittag ID (ISO 15693 compliant).§Texas Instruments Tag-it: 32 bytes total IC memory available for user data, +64-bit tag ID (ISO 15693 compliant).§Infineon My-D Vicinity: 1KB total IC memory available for user data, + 64-bit tagID (ISO 15693 compliant).
CHAPTER 5: RFID TAGSP/N: 17-1327 REV 02 (08/07) PAGE 45 OF 82Figure 5-2: LRP-Series TagsThe HMS-Series and LRP-Series RFID tags listed in the above section are passivedevices, meaning that they require no internal batteries. These tags are fully readableand writeable, except for the tags unique ID number, which is read only.There are no serviceable or repairable parts inside these tags, yet most are capableof providing over 100,000 write cycles and 10 years of data retention. In fact, testsresulting in over one million write cycles have been recorded by some tags.Numerous tag-related factors can adversely affect RF range and data transmissionbetween the controller and the tag, including the tags integrated circuit (IC), the tagsantenna coil design, the tags antenna conductor material, the tags antenna coilsubstrate, the tag IC incorporated, the antenna coil bonding process and theembodiment material that is used.Additionally, the mounting environment of the tag and controller can hinderperformance due to other materials affecting the tuning of either antenna. EscortMemory Systems has performed extensive testing to produce tags that obtainoptimum performance with our RFID devices. In most cases, optimal range will beobtained when mounting the tag and antenna in locations free from the influence ofmetals and EMI emitting devices.5.3 TAG EMBODIMENTSRFID tags are designed, produced and distributed in a variety of sizes and packages.5.3.1 Printed Circuit Board RFID TagsRFID tags that incorporate Printed Circuit Boardtechnology are designed for encasement inside totes,pallets, or products that can provide the protectionnormally associated with injection-moldedenclosures.These tags are made primarily from etched copperPCB materials (FR-4, for example) and are die-bonded by means of high quality wire bonding. Thisprocedure ensures reliable electrical connections thatare superior to flip-chip assembly methods. The RFIDtags integrated circuit is then encapsulated in epoxy toprotect it and the electrical connections.
CHAPTER 5: RFID TAGSP/N: 17-1327 REV 02 (08/07) PAGE 46 OF 825.3.2 Molded RFID TagsMolded tags utilize PCB tags and are the most rugged and reliable of the tags offeredby Escort Memory Systems. These tags are designed for closed-loop applicationswhere the tag is reused; thereby the cost of the tag can be amortized over the life ofthe production line. Typically, molded tags will be mounted to a pallet or carrier thattransports (and accompanies) the product through the entire production process.Other applications for these tags include (but are not limited to) embedding tagswithin concrete floors for location identification, shelf identification for storage andretrieval systems, and tool identification.Escort Memory Systems offers a wide variety of molded tags that have beendeveloped over the years for real world applications. High temperature tags usingpatented processes and specialized materials allow tags to survive elevatedtemperatures, such as those required for automotive paint and plating applications.5.4 TAG MEMORYTag memory addressing begins at address zero (0x0000), with the highestaddressable memory location equal to one less than the total number of bytes in thetag. Each address is equal to one byte (8-bits), where the byte is the smallestaddressable unit of data. So for example, writing 8-bytes to a tag beginning ataddress 0 will fill addresses 0 to 7 with 64-bits of data in all.Depending on the manufacturer, RFID labels, molded tags and embedded PCBs canhave differing memory storage capacities and organization. Tag memory is groupedinto blocks of bytes that can vary in organization from manufacturer to manufacturer.Even when compliant to ISO standards, byte memory addressing can differ from onemanufacturer to another (for example, tag memory can be organized in blocks of 4 or8 bytes, depending on the RFID IC).Additionally, all bytes may not beavailable for data storage as somebytes may be used for security andaccess conditions. For more informationregarding a specific RFID tags memoryallocation, please refer to each ICmanufacturers datasheet or Website.Escort Memory Systems has takengreat care to simplify tag memoryaddressing. The mapping from logicaladdress to physical address is handledby the C1007-Series Controllersoperating system. Users only need toidentify the starting address location onthe tag and the number of bytes to beread or written. However, extra attentionneeds to be paid to the memory blockstructure when memory lock commandsare used. When data is locked, it cannotbe altered. Caution should be exercisedwhen using memory lock commands aslocked data cannot be unlocked, evenby Escort Memory Systems.
CHAPTER 5: RFID TAGSP/N: 17-1327 REV 02 (08/07) PAGE 47 OF 825.4.1 Mapping Tag MemoryCustomers need to take into account that there are some RFID tag manufacturersthat measure and specify their tag memory sizes by the total number of bits, as thismethod generates a much larger (8X) overall number designed to inflate theirspecifications. Escort Memory Systems, on the other hand, prefers to specify total tagmemory sizes in terms of bytes (rather than in bits), as this method more closelyreflects how data is stored and retrieved from a tag and is typically what ourcustomers really want to know.5.4.2 Creating an RFID Tag Memory MapCreating a tag memory map is much like creating a spreadsheet that outlines theactual data you plan to capture as well as the specific tag memory locations in whichyou wish to store said data. Tag memory maps should be carefully planned, simpleand straightforward. It is advisable to utilize more storage space than is initiallyrequired, as inevitably a need will arise to hold more data.Tag M emory Map ExampleIn the example below, 90-bytes of a 112-byte tag have been allocated to areas of thememory map (leaving roughly 20% free for future uses). Because a short paragraphof alphanumeric characters could quickly use all 90 bytes, creating an efficientmapping scheme, which utilizes all 720-bits out of the 90-bytes allocated, will providea better use of tag space.TAG ADDRESS DESCRIPTION OF USAGE00 - 15 Serial Number16 - 47 Model Number48 - 63 Manufacturing Date64 - 71 Lot Number72 - 89 Factory ID90 - 111 ReservedTable 5-1: Tag Memory Map Example5.4.3 Optimizing Tag MemoryData is always stored in tag memory in a binary form (1s and 0s). Binary numbersare notated using the hexadecimal numbering system (otherwise it would be tooconfusing looking at a screen full of 1s and 0s).Below is an example of how hexadecimal notation simplifies the expressing of bytevalues for the decimal number 52,882.DECIMAL BINARY HEXADECIMAL52,882 1100111010010010 CE92In the above example, instead of using 5-bytes of data to store the ASCII bytesrepresenting characters 5, 2, 8, 8, and 2 (ASCII bytes: 0x35, 0x32, 0x38, 0x38, 0x32)
CHAPTER 5: RFID TAGSP/N: 17-1327 REV 02 (08/07) PAGE 48 OF 82by simply writing two Hex bytes (0xCE and 0x92), 60% less tag memory is used tostore the same information.When an alphabetical character is to be written to a tag, the ASCII value of the givencharacter is written to the tag. For example, to write a capital  (ASCII value 0x44),the binary equivalent of the ASCII character 0x44 is written to the tag.Additionally, if a database with look up values is used in the RFID application, thelogic level of the individual bits in the tag can be used to maximize tag memory.(Note: refer to Appendix D in this document fora complete chart of ASCII characters and theircorresponding Hex values).The graphic below illustrates how a single byte(8-bits) can be efficiently used to track anautomobiles inspection history at eightinspection stations. The number one (1)represents a required operation and the numberzero (0) represents an operation that is notrequired for that particular vehicle.Figure 5-3: Optimizing Tag Memory
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 49 OF 82CHAPTER 6:COMMAND PROTOCOLS6.1 COMMAND PROTOCOLS OVERVIEWWhen an RFID command is issued, the host computer instructs the RFID controller toperform a given task. After performing that task, the RFID controller will normallyreply back with a Command Response message indicating the status or results of theattempted command. This response notifies the host as to whether the commandwas successfully completed or if the RFID controller failed to complete the command.To understand and execute RFID commands, the C1007 and the host must be ableto communicate using the same language. The language that is used tocommunicate RFID commands is referred to as the Command Protocol. The type ofCommand Protocol that is used is known as the ABx Command Protocol, of whichthere are two primary variations. The two versions of the ABx Command Protocol thatare supported by the C1007-Series RFID Controller are:•ABx Fast (default)•ABx StandardThe ABx Fast Command Protocol is the default command protocol used by C1007RFID Controllers. It has a single-byte based packet structure that permits theexecution of RFID commands while transferring fewer total bytes than ABx Standardrequires. It can be used with or without a checksum byte.The ABx Standard Command Protocol uses a double-byte, word based format thatshares a common syntax with most existing RFID systems produced by EscortMemory Systems. This protocol offers legacy support, which may be required byexisting PLC applications that only support a 2-byte word packet format. If yourapplication requires compatibility with existing or legacy RFID devices from EscortMemory Systems, use ABx Standard. ABx Standard does not support the use of achecksum byte.NOTE:By default, the C1007 is configured to use the ABx Fast Command Protocol. ABx Fast(as the name suggests) is the faster and more efficient of the two ABx protocols,offering increased communication speed and error immunity.
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 50 OF 826.1.1 ABx Protocols - Command StructuresAll ABx-based RFID commands contain certain fundamental packet elements,including a Command Header, a Command ID, one or more CommandParameters (when applicable) and a Command Terminator.Command Packet Structure = [Command Header + Command ID + Command Parameters+ Command Terminator]6.1.2 ABx Protocols - Headers and TerminatorsIn ABx Fast, commands begin with the two-byte command header 0x02, 0x02 andend with the one-byte command terminator 0x03.In ABx Standard, commands begin with the one-byte command header "0xAA," andend with the two-byte command terminator "0xFF, 0xFF".ABx Protocols - Headers and TerminatorsABX PROTOCOL HEADER TERMINATORABx Fast 0x02, 0x02 0x03ABx Standard 0xAA 0xFF, 0xFFTable 6-1: ABx Protocols - Headers and Terminators6.1.3 ABx Protocols - Response StructuresAfter completing an ABx command, the C1007 generates a host-bound, responsepacket that indicates the status and/or results of the attempted command. Theresponse packet structure for all ABx protocols consists of a Response Header, aCommand Echo, one or more Response Values (when applicable), and aResponse Terminator.Response Packet Structure = [Response Header + Command Echo + Response Values +Response Terminator]Note that for each ABx protocol, Response Header and Response Terminatorparameters are the same as their Command Header and Command Terminatorcounterparts.
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 51 OF 826.2 ABXFAST COMMAND PROTOCOLThe default command protocol used by C1007-Series RFID Controllers for Point-to-Point data transmission is known as the ABx Fast Command Protocol. ABx Fast hasa single-byte oriented packet structure that permits the rapid execution of RFIDcommands while requiring the transfer of a minimal number of bytes.ABx Fast supports the inclusion of an optional checksum byte. When increased dataintegrity is required, the checksum should be utilized. See Section 6.2.4. Checksum,for more information on using the checksum parameter.6.2.1 ABx Fast - Command / Response ProcedureAfter an RFID command is issued by the host, a packet of data, called theCommand Packet is sent to the controller. The command packet containsinformation that instructs the controller to perform a certain task.The controller automatically parses the incoming data packet, searching for a specificpair of start characters, known as the Command Header. In ABx Fast, theCommand Header / Start Characters are 0x02, 0x02. When a valid CommandHeader is recognized, the controller then checks for proper formatting and for thepresence of a Command Terminator byte. In ABx Fast, the Command Terminatorbyte is 0x03.Having identified a valid command, the controller will attempt to execute the giveninstructions. After which the controller will generate a host-bound response messagecontaining EITHER the results of the attempted command or an error code if theoperation failed.NOTE: For RFID applications that use an EMS Gateway or Hub Interface Module, theCBx Command Protocol applies. Please refer to the Gateway or Hub OperatorsManuals and the CBx Command Protocol Reference Manual (all of which are availableat www.ems-rfid.com) for further information regarding CBx commands.
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 52 OF 826.2.2 ABx Fast - Command Packet StructureThe packet structure of all ABx Fast command contains certain basic elements,including Command Header, Command Size, Command ID and CommandTerminator. Additional options are available depending on the command beingperformed.Figure 6-1: ABx Fast - Command Packet StructureCOMMAND PACKET ELEMENT CONTENT SIZECOMMAND HEADER:The first two bytes of an ABx Fast command packet0x02, 0x02 2 bytesCOMMAND SIZE:This 2-byte integer defines the number of bytes in the packet(excluding header, command size, checksum andterminator).0x0007 +(number ofbytes ofadditionaldata)2-byteintegerCOMMAND ID:This single-byte value indicates the RFID command toexecute.0x06(Write Data)1 byteSTART ADDRESS:This two-byte parameter indicates the location of tagmemory where a read or write operation shall begin.0x0000 2-byteintegerREAD-WRITE LENGTH / BLOCK SIZE:This two-byte parameter represents the number of bytes thatare to be retrieved from or written to the RFID tag.0x0001 2-byteintegerTIMEOUT VALUE:This two-byte parameter indicates the maximum length oftime for which the controller will attempt to complete thecommand. Measured in milliseconds, this value can have arange of 0x0001 to 0xFFFE or between 1 and 65,534msecs.0x07D0(0x07D0 =2000 x .001 =2 seconds)2-byteinteger
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 53 OF 82ADDITIONAL DATA:This parameter uses one byte to hold a single character forfill operations and supports the use of multiple bytes whenseveral characters are needed for write commands (whenapplicable).0x00 One ormore bytes(whenapplicable)CHECKSUM:This optional parameter holds a single-byte checksum (onlyapplicable when using ABx Fast with Checksum).Optional 1 byte(whenapplicable)COMMAND TERMINATOR:Single-byte command packet terminator (always 0x03)0x03 1 byteTable 6-2: ABx Fast - Command Packet Structure6.2.3 ABx Fast - Response Packet StructureAfter performing a command, the C1007, in most cases, will generate a host-boundresponse packet. ABx Fast responses contain a Response Header, Response Size,Command Echo, one or more Response Values (when applicable), an optionalChecksum and a Response Terminator.RESPONSE PACKET ELEMENT CONTENT SIZERESPONSE HEADER:First two bytes of an ABx Fast response packet0x02, 0x02 2 bytesRESPONSE SIZE:This two-byte integer defines the total number of bytesin the response packet (excluding header, size,checksum and terminator).0x0001 2-byte integerCOMMAND ECHO:The single-byte parameter identifies the command forwhich the response packet was generated.0x06 1 byteRETRIEVED DATA:This parameter is used to hold one or more bytes ofdata that was requested by the command (whenapplicable).Data 1 or more bytes(whenapplicable)CHECKSUM:This optional parameter holds a single-byte checksum(only applicable when using ABx Fast withChecksum).Optional 1 byte(whenapplicable)RESPONSE TERMINATOR:Single-byte response packet terminator (always 0x03)0x03 1 byteTable 6-3: ABx Fast - Response Packet Structure
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 54 OF 826.2.4 ABx Fast - Command Packet ParametersCommand SizeThe ABx Fast protocol requires that the byte count, known as the Command Sizebe specified as a two-byte integer. To calculate the Command Size, add the totalnumber of bytes within the command packet while excluding the Header, CommandSize, Checksum (if present) and Terminator (see example below).COMMAND ELEMENT # OF BYTES INCLUDED INCOMMAND SIZE?Command Header 2NoCommand Size 2NoCommand ID 1YesStart Address 2YesRead/Write Length(Block Size) 2YesTimeout Value 2YesAdditional Data Bytes 1YesChecksum 1NoCommand Terminator 1 NoThe Command Size for this example is 0x0008.Start AddressThe Start Address parameter holds a two-byte integer representing the tag memoryaddress location where a read or write operation will begin.Read/Write Length (Block Size)The two-byte Read/Write Length (Block Size) integer indicates the number of bytesthat are to be read from or written to the RFID tag.Timeout ValueA two-byte Timeout Value parameter (measured in one-millisecond increments) isused to set the length of time that the controller will attempt to complete the specifiedoperation.The maximum supported Timeout Value is 0xFFFE or 65,534ms (slightly longer thanone minute). Setting a long Timeout Value does not necessarily mean that acommand will take any longer to execute. This value only represents the period oftime for which the controller will attempt to complete the command.IMPORTANT: During write commands, the tag must remain within the antennas RFfield until the write operation completes successfully, or until the timeout value hasexpired. If a write operation is not completed before the tag leaves the controllers RFfield, data may be incompletely written.CommandSize =number ofbytes in thesefields
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 55 OF 82ChecksumABx Fast and ABx ASCII Command Protocols support the inclusion of an additionalChecksum byte that is used to verify the integrity of data being transmitted betweenhost and controller.The Checksum is calculated by adding together (summing) the byte values in thecommand packet (less the Header, Checksum and Terminator), and then subtractingthe total byte sum from 0xFF. Therefore, when the byte values of each packetelement (from Command Size to Checksum) are added together, the byte value sumwill equal 0xFF.CHECKSUM EXAMPLEThe following example depicts Command 0x05 (Read Data) using a Checksum (StartAddress: 0x0001, Read Length: 0x0004, Timeout Value: 0x07D0).COMMANDPACKETELEMENTCONTENTS USED IN CHECKSUMCommand Header 0x02, 0x02 n/aCommand Size 0x0007 0x00, 0x07Command ID 0x05 0x05Start Address 0x0001 0x00, 0x01Read Length 0x0004 0x00, 0x04Timeout Value 0x07D0 0x07, 0xD0Checksum 0x17 n/aCommand Terminator 0x03 n/aAdd the byte values from the Command Size, Command ID, Start Address, ReadLength and Timeout Value parameters together and subtract from 0xFF. Resultingvalue will be the Checksum.[0x07 + 0x05 + 0x01 + 0x04 + 0x07 + 0xD0] = 0xE8The Checksum equation is: [0xFF 0xE8] = 0x176.2.5 ABx Fast Multi-Tag Command Packet StructureABx Fast Multi-tag Commands are capable of interrogating one or more RFID tags,when numerous tags are simultaneously within RF range. These commands alsoChecksum =[0xFF  (sumof thesefields)]
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 56 OF 82allow users to retrieve data from or write data to several tags at once. Below is thestructure of a basic ABx Fast Multi-tag command packet.ABx Fast Multi-tag Command Packet StructureCOMMAND PACKET ELEMENT CONTENT SIZECOMMAND HEADER:The first two bytes of an ABx Fast command.0x02, 0x02 2 bytesCOMMAND SIZE:This two-byte integer defines the number of bytes in thepacket (excluding Header, Command Size and Terminator).0x0007 +(number ofadditionaldata bytes)2-byteintegerCOMMAND ID:This single-byte value indicates the command to perform.0x87(Multi-TagInventory)1 byteFAMILY CODE:This single-byte value is used to specify a subset of tags whenmany are identified simultaneously in RF range. Zero =broadcast to all tags in RF range (see description in Section6.2.6)0x00 1 byteANTI-COLLISION MODE:This single-byte value allows the user to enable the use of 16time slots for retrieving data, choices are: 0x01 = use 16 timeslots, 0x00 = use single slot (see description in Section 6.2.6)0x01 1 byteTAG LIMIT:This single byte specifies the maximum # of tags expected inRF range, up to 100; 0x64 = 100 tags expected max, whenapplicable (see description in Section 6.2.6)0x64 1 byteSTART ADDRESS:This two-byte integer indicates the location of tag memorywhere a read or write operation shall begin.0x0000 2-byteintegerBLOCK SIZE:This two-byte integer represents the number of bytes that areto be read from or written to an RFID tag during the operation,when applicable.0x0001 2-byteintegerTIMEOUT VALUE:This two-byte integer indicates the maximum length of time forwhich the controller will attempt to complete the command.Measured in milliseconds, this value can have a range of0x0001 to 0xFFFE or between 1 and 65,534 msecs.0x07D0(0x07D0 =2000 x .001 =2 seconds)2-byteintegerADDITIONAL DATA:This parameter uses one byte for fill operations and supportsthe use of multiple bytes when several characters are neededfor write commands, when applicable.0x00 1 ormorebytesCOMMAND TERMINATOR:The single-byte command packet terminator is always 0x03.0x03 1 byteTable 6-4: ABx Fast Multi-Tag Command Packet Structure
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 57 OF 826.2.6 ABx Fast Multi-Tag Command Packet ElementsFamily CodeThe Family Code parameter is a one-byte value (0x00  0xFF) that can be used inmulti-tag commands to specify a subset of tags when many are identifiedsimultaneously in RF range. The parameter allows the user to filter tags based on apre-written value stored at a special location on the tag.For example, if the Family Code value is set to one (0x01), only those tags with thevalue 0x01 will respond to the given command. When a Family Code value of zero(0x00) is entered for this parameter, the command will be broadcast to all tags in RFrange.Anti-Collision ModeTag collision in RFID applications occurs when numerous passive RFID tagsbecome simultaneously active or energized (by the RFID controller) and thus reflecttheir respective signals back to the reader at the same time, such that the readercannot differentiate between tags.EMS RFID readers make use of anti-collision algorithms to enable a single readerto read more than one tag in the reader's field.The Anti-collision Mode parameter controls the tag-reading algorithm used toachieve the fastest reading speed for the number of tags expected in RF range atany given moment. This parameter helps the reader/antenna avoid data collisionswhen simultaneously reading multiple tagsThe choices for this parameter are one (0x01) for Multi-Slot and zero (0x00) forSingle-Slot.•ONE: Setting this parameter to one (0x01) implements a system of 16 time slots.To avoid data collisions when the controller encounters multiple tagssimultaneously, data requested from each tag is transferred to the host onlyduring the time slot that matches a specific pattern in the tag ID number.•ZERO: Setting this parameter to zero (0x00) utilizes a single time slot underwhich the requested data from all tags is transferred to the host as soon as itbecomes available to the controller. This setting can result in faster tag readperformance when only a few tags are expected in the RF fieldThe Anti-Collision Mode parameter immediately follows the Family Code parameterin the command packet string.Tag LimitThe Tag Limit parameter holds a one-byte value that indicates the maximum numberof tags expected simultaneously in RF range for the given command operation. Thisparameter allows users to limit the number of attempted read/write operations thecontroller will make per execution.The Tag Limit value should be set in relation to the maximum number of tags thatcould possibly be present in the reading field at any one time. Users do not have towait for the timeout to expire. Setting the value higher increases the number of tagsexpected to be read in the antennas RF field. Lowering the value, however, canspeed up tag read operations for a small group of tags.Setting the proper value is therefore a tradeoff between the number of expected tagsin the reading field, and the time required to read/write to them. The permitted values
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 58 OF 82range from zero to 100 (0x00  0x64). The Tag Limit parameter resides directly afterthe Anti-collision Mode parameter in the command string (when applicable).Timeout ValueMulti-tag commands also contain a two-byte Timeout Value parameter that is used tolimit the length of time for which the controller will attempt to complete a givenoperation.It is important to set a realistic Timeout Value that permits enough time for thecontroller to read/write to all tags specified in the command. Processing multiple-tagoperations requires a longer time period than does the execution of single-tagcommands.The value is expressed in one-millisecond increments, with a maximum value of0xFFFE (65,534 milliseconds) or approximately 60 seconds. For most single tagread/write commands, a Timeout Value of at least 1000ms is recommended.However, it is recommended that you allow an additional 100ms per tag for multi-tagread operations and 150ms per tag for multi-tag writes.Using a Timeout Value that is too short may cause the controller to inadvertentlytime out before the data has been successfully read from or written to all tags in RFrange. Setting a long Timeout Value does not necessarily mean that the commandwill take any longer to complete. The value only represents the period of time inwhich the controller will attempt to complete the particular operation. If all requiredtags are in RF range when the command is sent, the time necessary to complete thecommand will be approximately the same whether the Timeout Value is 1000ms or10,000ms.For time critical applications, the optimal Timeout Value should be obtained throughrigorous performance testing.TIMEOUT VALUE EXAMPLEWhen writing to 16 different tags in RF range, for example, set the two-byte TimeoutValue to at least 0x0D48 (16 x 150ms + 1000ms = 3400ms or 3.4 seconds). ATimeout Value of zero (0x0000) will cause the controller to return a syntax errormessage.Tag ID / Serial NumberSeveral multi-tag commands are available that will retrieve or allow the user tospecify, a tags ID number. The tag ID number is a unique read-only, 64-bit (eight-byte) number stored in tag memory. Tag ID commands can be used to selectivelyread from or write to one or more specific tags, identified by their distinctive tag IDs.Targeted tags can be recognized with a previously issued Read Tag ID command.
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 59 OF 826.2.7 ABx Fast Multi-Tag Response Packet StructuresWhen executing multi-tag commands designed to retrieve information from severaltags at once (for example ABx Fast Command 0x82: Multi-Tag Read ID and DataAll), the RFID controller will generate separate host-bound response packets for eachtag that has been read, followed by a final termination packet.Below is the structure of a basic ABx Fast multi-tag response packet.ABx Fast Multi-tag Response Packet Structure (One Packet for Each Tag Read)RESPONSE PACKET ELEMENT CONTENT SIZERESPONSE HEADER:The first two bytes of an ABx Fast response0x02, 0x02 2 bytesRESPONSE SIZE:This two-byte integer defines the number of bytes in thepacket (excluding Header, Response Size andTerminator).0x0009 +(number of ReadData bytes)2-byteintegerCOMMAND ECHO:This single-byte value indicates the RFID command thatwas performed.0x82(Multi-Tag ReadID and Data AllCommand)1 byteTAG ID:8-bytes, when applicable<8-byte tag ID> 8 bytesREAD DATA <N-bytes> N-bytesRESPONSE TERMINATOR:The single-byte response packet terminator is always0x03 for ABx Fast.0x03 1 byteTable 6-5: ABx Fast Multi-Tag Response Packet Structure
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 60 OF 826.2.8 ABx Fast Multi-Tag Response Final TerminationPacket StructureAfter the RFID controller has issued response packets for each tag identified and/orread, a final termination packet is generated.Below is the structure of a standard ABx Fast multi-tag response final terminationpacket.ABx Fast Multi-tag Response Final Termination Packet StructureRESPONSE PACKET ELEMENT CONTENT SIZERESPONSE HEADER:The first two bytes of an ABx Fast response0x02, 0x02 2 bytesRESPONSE SIZE:This two-byte integer defines the number of bytes in thepacket (excluding Header, Response Size andTerminator).0x0003 2-byteintegerFINAL TERMINATION PACKET IDENTIFIER:0xFF indicates that this packet is the final terminationpacket.0xFF 1 byteNUMBER OF TAGS READ/WRITTEN:One-byte value indicates the number of tags that wereread or written to during the operation.<N-tags> 1 byteSTATUS:0x00 = operation completed successfully, 0x07 = ReadTag ID failed / Tag Not Found0x00 1 byteRESPONSE TERMINATOR:The single-byte response packet terminator is always0x03 for ABx Fast.0x03 1 byteTable 6-6: ABx Fast Multi-Tag Response Final Termination Packet Structure
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 61 OF 826.3 ABXSTANDARD COMMAND PROTOCOLThe ABx Standard Command Protocol is a binary, double-byte, word orientedprotocol where data is transmitted in 2-byte increments: a Most Significant Byte(MSB) or High Byte and a Least Significant Byte (LSB) or Low Byte.For ABx Standard commands, the first data word sent to the controller contains theCommand Header and Command ID, followed by parameters such as Start Address,Read/Write Length and Timeout Value.Note that at no time can the complete command packet string (including Terminator)exceed 50 words or 100 bytes.Figure 6-2: ABx Standard - Command Packet Structure6.3.1 ABx Standard - Command Packet StructureCOMMAND PACKET ELEMENT CONTENT BYTECOUNTCOMMAND HEADER:0xAA is always the MSB of the first word of an ABxStandard command.0xAA 1COMMAND ID:The Command ID is always the LSB of the first wordand indicates the RFID command to execute.0x06(Write Data)1START ADDRESS:This two-byte parameter indicates the location of tagmemory where a read or write operation shall begin.0x0000 2
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 62 OF 82READ/WRITE LENGTH (BLOCK SIZE):This two-byte parameter represents the number ofbytes that are to be retrieved from or written to theRFID tag.0x0001 2TIMEOUT VALUE:This two-byte integer indicates the maximum length oftime for which the controller will attempt to completethe command. Measured in milliseconds, this valuecan have a range of 0x0001 to 0xFFFE or between 1and 65,534 msecs (0x07D0 = 2000 x .001 = 2seconds).0x07D0 2ADDITIONAL DATA:This parameter uses two bytes to hold a singlecharacter (data to be written to the tag is included inthe LSB only, MSB = 0x00).0x00, 0x00 2 (or more whenapplicable)COMMAND TERMINATOR:Double-byte command packet terminator0xFF, 0xFF 2Table 6-7: ABx Standard - Command Packet Structure6.3.2 ABx Standard - Response Packet StructureRESPONSE PACKET ELEMENT CONTENT BYTECOUNTRESPONSE HEADER:0xAA is always the MSB of the first word of an ABxStandard response packet0xAA 1COMMAND ECHO:The command echo is always the LSB of the first wordand indicates the RFID command that was executed.0x06(Write Data)2ADDITIONAL DATA:This parameter uses two bytes to hold a singlecharacter of retrieved data (data is returned in the LSBonly, MSB = 0x00).0x00, 0x00 2 (or more whenapplicable)RESPONSE TERMINATOR:Double-byte command packet terminator0xFF, 0xFF 2Table 6-8: ABx Standard - Response Packet Structure
CHAPTER 6: COMMAND PROTOCOLSP/N: 17-1327 REV 02 (08/07) PAGE 63 OF 826.3.3 ABx Standard - Command ExampleThe example below depicts the packet structure of the ABx Standard command andresponse messages for Command 0x08 (Tag Search). In this example, the RFIDcontroller is instructed to search for a tag in the RF field. A Timeout Value of twoseconds (0x07D0) is set for the completion of this operation.Command from HostCOMMAND ELEMENT CONTENTCommand Header and Command ID(MSB/LSB)0xAA, 0x08 (Tag Search)Timeout Value 0x07D0Command Terminator 0xFF, 0xFFResponse from ControllerRESPONSE ELEMENT CONTENTResponse Header and Command Echo(MSB/LSB)0xAA, 0x08 (Tag Search)Response Terminator 0xFF, 0xFFIf the Timeout Value expires before the controller finds a tag, it will return an errorcode, 0x07 (Tag Not Found).
CHAPTER 7: RFID COMMANDS AND ERROR CODESP/N: 17-1327 REV 02 (08/07) PAGE 64 OF 82CHAPTER 7:RFID COMMANDS AND ERROR CODES7.1 ABXFAST RFID COMMAND TABLEThe table below lists the ABx Fast RFID commands supported by C1007-SeriesRFID Controllers.COMMAND ID COMMAND NAME DESCRIPTIONSingle-Tag RFID Commands0x04 Fill Tag Fills a specified tag address range with aone-byte value0x05 Read Data Reads a specified length of data from acontiguous (sequential) area of tag memory0x06 Write Data Writes a specified number of bytes to acontiguous area of tag memory0x07 Read Tag ID Retrieves a tags unique identification (TagID) number0x08 Tag Search Instructs the controller to search for a tag inits RF field0x0D StartContinuousRead Instructs the controller to start or stopContinuous Read mode.0x0E Read Tag ID andData Reads a tags ID number as well as aspecified number of bytes of tag memory0x0F StartContinuousRead Tag ID andDataInstructs the controller to start or stopContinuous Read Tag ID and Data mode.0x27 Lock MemoryBlock Write protects a block of tag memoryRFID Controller Commands0x35 Reset Controller Resets power to the controller0x36 Set ControllerConfigurationUsed to set (configure or modify) thecontrollers configuration parameters andsettings0x37 Get ControllerConfiguration Retrieves the controllers configurationsettings0x38 Get ControllerInfo Retrieves hardware, firmware and serialnumber information from the controller
CHAPTER 7: RFID COMMANDS AND ERROR CODESP/N: 17-1327 REV 02 (08/07) PAGE 65 OF 82COMMAND ID COMMAND NAME DESCRIPTION0x51 Set ControllerTime Used to set the time for the controller0x72 ExecuteController Macro Instructs the controller to execute one of itseight macrosMulti-Tag RFID Commands0x82 Multi-Tag Read IDand Data All Retrieves a contiguous segment of data andthe tag ID from all RFID tags in range0x85 Multi-Tag BlockRead All Retrieves a contiguous segment of datafrom all RFID tags in range0x86 Multi-Tag BlockWrite All Writes a contiguous segment of data to allRFID tags in range0x87 Multi-Tag GetInventory Retrieves the tag ID from all RFID tags inrange0x88 Multi-Tag Search All Checks for the presence of any RFID tagsin range0x95 Multi-Tag BlockRead by ID Reads a contiguous segment of data from aspecific RFID tag identified by its tag ID0x96 Multi-Tag BlockWrite by ID Writes a contiguous segment of data to aspecific RFID tag identified by its tag IDTable 7-1: ABx Fast RFID Command Table
CHAPTER 7: RFID COMMANDS AND ERROR CODESP/N: 17-1327 REV 02 (08/07) PAGE 66 OF 827.2 ABXSTANDARD RFID COMMAND TABLEThe table below lists the ABx Standard RFID commands supported by C1007-SeriesRFID Controllers.COMMAND ID COMMAND NAME DESCRIPTIONRFID Tag Commands0x04 Fill Tag Fills a specified tag address range witha one-byte value0x05 Read Data Reads a specified number of bytes froma contiguous (sequential) length of tagmemory0x06 Write Data Writes a specified number of bytes to acontiguous length of tag memory0x07 Read Tag ID Retrieves a tags unique identification(Tag ID) number0x08 Tag Search Instructs the controller to search for atag in its RF field0x0D Start ContinuousRead Instructs the controller to start and stopContinuous Read mode.0x0E Read Tag ID andData Retrieves the tag ID and a specifiednumber of bytes from the tag0x0F Start ContinuousRead Tag ID andDataInstructs the controller to start and stopContinuous Read Tag ID and Datamode.RFID Controller Commands0x35 Reset Controller Resets power to the controller0x36 Set ControllerConfiguration Used to modify and update theconfiguration settings of the controller0x37 Get ControllerConfiguration Retrieves configuration settings from thecontroller0x38 Get Controller Info Retrieves hardware, firmware and serialnumber information from the controllerTable 7-2: ABx Standard RFID Command Table
CHAPTER 7: RFID COMMANDS AND ERROR CODESP/N: 17-1327 REV 02 (08/07) PAGE 67 OF 827.3 ERROR CODESIf the C1007 encounters a fault during operation, it will generate a response thatincludes a one-byte ABx error code. Entering an invalid Start Address for a ReadData command, for example, will generate ABx Error Code 0x32 (InvalidProgramming Address).To display the single-byte error code in binary, the two left-most amber Node LEDs(LED 24and LED 23) represent the first or most significant digit (MSD) of the errorcode. The three remaining amber Node LEDs (LED 22, LED 21and LED 20) arecombined to represent the second or least significant digit (LSD) of the error code.Examples:•If the five amber Node LEDs (from L to R) =ON, OFF, OFF, OFF, ON, the first digit of theerror code is a 2 and the second digit is a1, meaning that error code 0x21 occurred(error code 0x21 = command syntax error).•If the five amber Node LEDs (from L to R) =ON, ON, OFF, ON, OFF, the first digit of theerror code is a 3 and the second digit is a2, meaning that error code 0x32 occurred(error code 0x32 = invalid programmingaddress).The RF LED and amber Node LEDs will continue to flash until a valid command isreceived by the controller. The green COM LED will remain ON to help orient thebinary LED positions. If an unrecoverable error occurs, the LEDs will continuouslyflash the error code until the C1007 has been reset.PWR2423212220COMRFPWR2423212220COMRF
CHAPTER 7: RFID COMMANDS AND ERROR CODESP/N: 17-1327 REV 02 (08/07) PAGE 68 OF 827.4 ABXERROR CODE TABLEERRORCODE DESCRIPTION0x04 Fill Operation not Completed0x05 Read Operation not Completed0x06 Write Operation not Completed0x07 Read Tag ID Operation not Completed (Tag not Found)0x21 Command Syntax Error0x23 Unsupported Tag Type / Unsupported RF Command0x27 Memory Lock Operation not Completed (Memory Locked)0x30 Internal Error, Buffer Overflow0x31 Invalid Controller Type0x32 Invalid Programming Address0x33 Invalid CRC Value0x34 Invalid Software Version0x35 Invalid Reset0x36 Set Configuration Operation not Completed0x37 Get Configuration Operation not CompletedTable 7-3: ABx Error Codes
CHAPTER 7: RFID COMMANDS AND ERROR CODESP/N: 17-1327 REV 02 (08/07) PAGE 69 OF 827.5 ABXFAST ERROR RESPONSE STRUCTUREABx Fast error responses contain a two-byte Header, a two-byte Response Sizeparameter followed by a single-byte Error Flag (0xFF) and a single-byte Error Codeparameter, which identifies the error that occurred.ERROR RESPONSE ELEMENT CONTENTHeader 0x02, 0x02Response Size 0x0002Error Flag 0xFFError Code Single-byte Error CodeChecksum OptionalTerminator 0x03Table 7-4: ABx Fast - Error Response StructureABXFAST ERROR RESPONSE EXAMPLEBelow is an example of an ABx Fast error response for a failed Write Data command(error code 0x06). ERROR RESPONSE ELEMENT CONTENTHeader 0x02, 0x02Response Size 0x0002Error Flag 0xFFError Code 0x06Checksum OptionalTerminator 0x03
CHAPTER 7: RFID COMMANDS AND ERROR CODESP/N: 17-1327 REV 02 (08/07) PAGE 70 OF 827.6 ABXSTANDARD ERROR RESPONSE STRUCTUREIn ABx Standard, the error code will be returned in the LSB of the second word of theresponse.Below is the structure of an ABx Standard error response.ERROR RESPONSE ELEMENT CONTENT (MSB/LSB)Error Response Header (MSB/LSB) 0xAA, 0xFFError Code (MSB/LSB) 0x00, <1-byte error code value>Terminator (MSB/LSB) 0xFF, 0xFFTable 7-5: ABx Standard - Error Response StructureABXSTANDARD ERROR RESPONSE EXAMPLEBelow is an example of an ABx Standard error response message for a failed WriteData operation (error code: 0x06).ERROR RESPONSE ELEMENT CONTENT (MSB/LSB)Error Response Header (MSB/LSB) 0xAA, 0xFFError Code (MSB/LSB) 0x00, 0x06Terminator (MSB/LSB) 0xFF, 0xFF
APPENDIX A: TECHNICAL SPECIFICATIONSP/N: 17-1327 REV 02 (08/07) PAGE 71 OF 82APPENDIX A:TECHNICAL SPECIFICATIONSELECTRICALSupply Voltage 10~30VDCPower Consumption:C1007-232-01 and C1007-485-013.6W (150mA @ 24VDC)Power Consumption:C1007-USB-015VDC (from USB bus)COMMUNICATIONCommunication Interfaces Point-to-Point: RS232, USBMulti-drop, Subnet16, MUX32: RS485RFID Interface Cobalt C1007-Series RFID SystemRF Output Power 100mWAir Protocols ISO 15693, ISO 14443AAir Protocol Speed 26.5k Baud / 106k Baud with CRC error detectionRS232/RS485 Baud Rates 9600 (default), 19.2k, 38.4k, 57.6k, 115.2kMECHANICALDimensions 116.4mm x 73.1mm x 24mm (4.58in x 2.88in x .94in)Weight 210 grams (7.4 ounces)Enclosure PolycarbonateENVIRONMENTALOperating Temperature -20° to 49°C (-4° to 120°F),Storage Temperature -40° to 85°C (-40° to 185°)Humidity 100%Protection Class IP67Shock Resistance IEC 68-2-27, Half-sine 30 G, 11ms, 3 shocks each axisVibration Resistance IEC 68-2-6, Test FC 1.5mm; 10 to 55Hz;2 hours each axisNOTE: Specifications are subject to change without notice
APPENDIX A: TECHNICAL SPECIFICATIONSP/N: 17-1327 REV 02 (08/07) PAGE 72 OF 82C1007-SERIES RFID CONTROLLER DIMENSIONSDimensions are listed in millimeters and [inches].Figure Appendix A-0-1: C1007-Series RFID Controller Dimensions
APPENDIX B: MODELS & ACCESSORIESP/N: 17-1327 REV 02 (08/07) PAGE 73 OF 82APPENDIX B:MODELS & ACCESSORIESEscort Memory Systems designs, manufactures and distributes a wide range of highfrequency (HF) RFID equipment including RFID controllers, network interfacemodules (Gateways and Hubs), RFID tags and the cables needed to make it all work.This portion of the manual lists the products and accessories available for the C1007-Series RFID product family. To purchase any of the items listed below contact yourEMS distributor, call us directly at (800) 626-3993 or visit our Web site:http://www.ems-rfid.com. Please let us know if you have any questions.EMS HARDWAREC1007-Series RFID ControllersThere are three models of the C1007-Series RFID Controller:§C1007-232-01§C1007-485-01§C1007-USB-01The C1007 product package contains the following components:EMS P/N QTY DESCRIPTIONC1007-XXX-01 1 C1007-Series RFID Controller00-3000 1 Configuration Tag for C1007 (I-CODE SLi)17-3140/2/3 1 C1007-Series RFID Controller  Installation GuideNote: XXX = 232, 485 or USBSubnet16 Gateway Interface ModulesGWY-01-TCP-01Subnet16 TCP/IP GatewayGWY-01-IND-01Subnet16 Industrial Ethernet GatewaySubnet16 Hub Interface ModulesHUB-04-TCP-01Subnet16 4-Port TCP/IP HubHUB-04-IND-01Subnet16 4-Port Industrial Ethernet Hub
APPENDIX B: MODELS & ACCESSORIESP/N: 17-1327 REV 02 (08/07) PAGE 74 OF 82COBALT FAMILY SOFTWARE & DEMONSTRATION KITS7.6.1 Software ApplicationsVisit the Escort Memory Systems website (www.ems-rfid.com) for downloadinstructions.Cobalt HF Dashboard (for TCP/IP or Serial Connections)Communicate in real time with one or more readers directly or via Multi-drop network.Allows users to configure, monitor and control their RFID devices from anywhere ontheir network.C-Macro BuilderC-Macro Builder is an easy to use, GUI-driven utility that provides rapid developmentand implementation of custom RFID command macros.7.6.2 Demonstration Kits00-1202C1007-USB-01 Demo Kit (includes one C1007-USB-01 controller, one CBL-1525USB interface cable, one LRP125VS tag, one LRP250S tag and one T7036 tag.00-1203Gateway TCP Demo Kit (includes one GWY-01-TCP-01 TCP Gateway interfacemodule, one C0405-485-01 controller, one C1007-485-01 controller, one HF-0405-485-01 controller, LRP125S, LRP250 and T7036 RFID tags, interface cables, displayboard, power supply and carrying case).00-1218Conveyor Demo Kit (includes one GWY-01-IND-01 Industrial Gateway interfacemodule, one C0405-485-01 controller, one C1007-485-01 controller, one HF-CNTL-485-01 controller, one HF-ANT-1010-01 antenna, one LRP108S tag, three LRP250Stags, one LRP525S tag, two T5050 tags, three T7036 tags, interface cables andpower supply).
APPENDIX B: MODELS & ACCESSORIESP/N: 17-1327 REV 02 (08/07) PAGE 75 OF 82CABLE AND NETWORK ACCESSORIESEMS P/N COMPONENT DESCRIPTIONCBL-1478 Cable Assembly 8-pin, female M12 to RS232; with 2.5mm DC powerjack, 2mCBL-1480-XX Cable 5-pin, male M12 to 5-pin, female M12 (ThinNet)CBL-1481-XX Cable 5-pin, male M12 to 5-pin, male M12 (ThinNet)CBL-1481-02 Cable 5-pin, male M12 to 5-pin, male M12, 2m (ThinNet,Gateway to Drop-T)CBL-1482-XX Cable 5-pin, male M12 to 5-pin, female, right-angle M12(ThinNet)CBL-1483-XX Cable 5-pin, male 7/816 to 5-pin, female 7/8-16 (ThickNet)CBL-1484-XX Cable 5-pin, male, right-angle 7/8-16 to bare wire leads(ThickNet)CBL-1485 Drop-T Connector 5-pin, female 7/8-16 / female M12 / male 7/8-16(ThickNet to ThinNet)CBL-1486 Drop-T Connector 5-pin, female M12 / 5-pin, female M12 / 5-pin, maleM12 (ThinNet to ThinNet)CBL-1487 Field MountableConnector 5-pos, straight female M12CBL-1488-XX Cable 8-pin, female M12 to bare wire leadsCBL-1489 TerminationResistor Plug 5-pin, male 7/8-16 (ThickNet)CBL-1490 TerminationResistor Plug 5-pin, male M12 (ThinNet)CBL-1491 Field MountableConnector 5-pos, right-angle female M12CBL-1492-XX Cable 8-pin, right-angle female M12 to bare wire leadsCBL-1493 Field MountableConnector 8-pos, straight female M12CBL-1494-01 Cable 5-pin, female M12 to bare wire leads, 1m (ThinNet)CBL-1495-XX Cable 5-pin, female 7/8-16 to bare wire leadsCBL-1496 TerminationResistor Plug 5-pin, female M12 (ThinNet)
APPENDIX B: MODELS & ACCESSORIESP/N: 17-1327 REV 02 (08/07) PAGE 76 OF 82CBL-1497 TerminationResistor Plug 5-pin, female 7/8-16 (ThickNet)CBL-1498-02 Cable 5-pin, male M12 to bare wire leads, 2m (ThinNet)CBL-1514 Connector 5-pin, straight male, reverse-keyed M12 (for USB)CBL-1515-05 Cable CAT5E shielded Ethernet to 5-Pin, male, D-Code M12,5mCBL-1524 Connector 5-pin, straight female, reverse-keyed M12CBL-1525 Cable Assembly 5-pin, female, reverse-keyed M12 to USB Type A, 3mXX = Length in MetersPOWER SUPPLIES00-116645W, 24VDC, 1.88A max, universal input (90-264VAC, 47-63Hz), 5.5x2.5mm plug,positive tip; requires country specific power cord to mate to IEC 320 power cordreceptacle.00-1167100W, 24VDC, 4.17A max, universal input (90-264VAC, 47-63Hz), 5.5x2.5mm plug,positive tip; requires country specific power cord to mate with IEC 320 power cordreceptacle.00-1168120W, 24VDC, 5.0A max, universal input (88-132VAC/176-264VAC switchselectable, 47-63Hz) DIN rail mount; AC wire receptacles are spring clamped fordirect wire connection.7.6.3 Escort Memory Systems RFID TagsEscort Memory Systems designs and manufactures several lines of RFID tags. LRP,HMS and T-Series passive read/write RFID tags are specially suited for the C1007-Series product line.
APPENDIX C: NETWORK DIAGRAMSP/N: 17-1327 REV 02 (08/07) PAGE 77 OF 82APPENDIX C:NETWORK DIAGRAMSSubnet16 Gateway  C1007-485-01 ThinNet Network DiagramFigure Appendix C-0-1: Subnet16 Gateway - C1007-485-01 ThinNet Network Diagram
APPENDIX C: NETWORK DIAGRAMSP/N: 17-1327 REV 02 (08/07) PAGE 78 OF 82Subnet16 Gateway  C1007-485-01 ThickNet Network DiagramFigure Appendix C-0-2: Subnet16 Gateway - C1007-485-01 ThinNet Network Diagram
APPENDIX C: NETWORK DIAGRAMSP/N: 17-1327 REV 02 (08/07) PAGE 79 OF 82Subnet16 Hub  C1007-485-01 Network DiagramFigure Appendix C-0-3: Subnet16 Hub - C1007-485-01 Network Diagram
APPENDIX D: ASCII CHARTP/N: 17-1327 REV 02 (08/07) PAGE 80 OF 82APPENDIX D:ASCII CHART
APPENDIX D: ASCII CHARTP/N: 17-1327 REV 02 (08/07) PAGE 81 OF 82
EMS WARRANTYP/N: 17-1327 REV 02 (08/07) PAGE 82 OF 82EMS WARRANTYscort Memory Systems warrants that all products of its own manufacturing conform toEscort Memory Systems specifications and are free from defects in material andworkmanship when used under normal operating conditions and within the serviceconditions for which they were furnished. The obligation of Escort Memory Systems hereundershall expire one (1) year after delivery, unless otherwise specified, and is limited to repairing,or at its option, replacing without charge, any such product that in Escort Memory Systemssole opinion proves to be defective within the scope of this Warranty. In the event EscortMemory Systems is not able to repair or replace defective products or components within areasonable time after receipt thereof, Buyers shall be credited for their value at the originalpurchase price. Escort Memory Systems must be notified in writing of the defect ornonconformity within the warranty period and the affected product returned to Escort MemorySystems factory or to an authorized service center within thirty (30) days after discovery ofsuch defect or nonconformity. Shipment shall not be made without prior authorization by EscortMemory Systems.This is Escort Memory Systems' sole warranty with respect to the products deliveredhereunder. No statement, representation, agreement or understanding oral or written, made byan agent, distributor, representative, or employee of Escort Memory Systems which is notcontained in this warranty, will be binding upon Escort Memory Systems, unless made inwriting and executed by an authorized Escort Memory Systems employee.Escort Memory Systems makes no other warranty of any kind what so ever, expressed orimplied, and all implied warranties of merchantability and fitness for a particular use whichexceed the aforementioned obligation are here by disclaimed by Escort Memory Systems andexcluded from this agreement. Under no circumstances shall Escort Memory Systems be liableto Buyer, in contract or in tort, for any special, indirect, incidental, or consequential damages,expenses, losses or delay however caused. Equipment or parts that have been subjected toabuse, misuse, accident, alteration, neglect, unauthorized repair or installation are not coveredby warranty. Escort Memory Systems shall make the final determination as to the existenceand cause of any alleged defect. No liability is assumed for expendable items such as lampsand fuses. No warranty is made with respect to equipment or products produced to Buyersspecification except as specifically stated in writing by Escort Memory Systems in the contractfor such custom equipment. This warranty is the only warranty made by Escort MemorySystems with respect to the goods delivered hereunder, and may be modified or amended onlyby a written instrument signed by a duly authorized officer of Escort Memory Systems andaccepted by the Buyer.Extended warranties of up to four years are available for purchase for most Escort MemorySystems products. Contact Escort Memory Systems or your distributor for more information.COPYRIGHT © 2007 ESCORT MEMORY SYSTEMS, ALL RIGHTS RESERVEDE

Navigation menu