HS500E READ/WRITE INDUSTRIAL ETHERNET ANTENNA Escort Memory Systems’ Active Radio Frequency Identification Device O PERATOR’S M ANUAL How to Install, Configure and Operate Escort Memory Systems’ HS500E Industrial Ethernet Antenna HS500E Industrial Ethernet Antenna - Operator’s Manual - P/N: 17-1305 REV 01.
FCC C OMPLIANCE N OTICE FCC Part 15 This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment uses, generates, and can radiate radio frequency energy and, if not installed and used in accordance with these instructions, may cause harmful interference to radio communications.
TABLE OF CONTENTS TABLE OF C ONTENTS TABLE OF CONTENTS.............................................................................................4 CHAPTER 1: GETTING STARTED ...........................................................................6 1.1 Introduction ............................................................................................................. 6 Company Background ............................................................................................................
TABLE OF CONTENTS Command F3: Write IP Address.................................................................................... 46 Command F4: Reset Battery Counter Value................................................................ 47 CHAPTER 4: ERROR CODES ................................................................................48 Basic Error Types........................................................................................................... 48 Overall Length Errors..............
CHAPTER 1: GETTING STARTED C HAPTER 1: G ETTING S TARTED This chapter contains an introduction to Escort Memory Systems and includes general information relating to the HS500E Industrial Ethernet Antenna and common uses for RFID technology. 1.1 I N T R O D U C T I O N Welcome to the HS500E Industrial Ethernet Antenna - Operator’s Manual. This manual will assist you in the installation, configuration and operation of Escort Memory Systems’ HS500E Industrial Ethernet Antenna.
CHAPTER 1: GETTING STARTED 1.2 A B O U T T H I S M A N U A L This document provides guidelines and instructions on how to install and operate the HS500E Industrial Ethernet Antenna. Also included are descriptions of the RFID command set with instructions detailing how to issue commands from the Host computer to the HS500E. SIDE NOTE: Occasionally throughout this manual, we refer to the HS500E Industrial Ethernet Antenna as the HS500E, the HS500E Antenna, the Industrial Antenna or just simply “the Antenna.
CHAPTER 1: GETTING STARTED 1.3 HS500E D I M E N S I O N S & D I A G R A M S HS500E - Dimensions H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 1: GETTING STARTED HS500E Side/Profile View HS500E LEDs H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 1: GETTING STARTED HS500E – Power & Ethernet Connections H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 2: INTERFACING WITH THE HS500E C HAPTER 2: I NTERFACING WITH THE HS500E The HS500E supports four different interface connections over Ethernet. • MODBUS-TCP • ETHERNET-IP • TCP-IP • OnDemand The process of issuing commands and receiving responses depends on the interface chosen and the Host computer that is connected to the HS500E. This chapter contains a brief overview of how commands can be sent using the four different interfaces listed above.
CHAPTER 2: INTERFACING WITH THE HS500E 2.1 MODBUS-TCP I N T E R FA C E Note: Maximum number of registers transferred to/from an RFID tag per command issued = 125 Registers (250 Bytes). Commands must be placed in the Holding Register Area of Node 1, starting at address 40001. Most commands utilize 6 registers (double-byte values or words). The Write Data command will require more words to transmit the data used for the Write.
CHAPTER 2: INTERFACING WITH THE HS500E When the length is set at 40001, the command is executed and the result returned. 40001: <0006H> When the command is completed, the HS500E will reset the length at 40001 of Node Address 1 back to 0. This way a simple handshaking mechanism can be implemented. H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 2: INTERFACING WITH THE HS500E 2.2 E T H E R N E T /IP I N T E R FA C E The mechanism to send commands over Ethernet/IP is similar to that of MODBUSTCP. Commands must still be copied to the appropriate registers. However, the mechanism for handshaking is different. For example, in a ControlLogix environment, commands must be written to the ControlLogix tags that are generated when the HS500E is added to the I/O Configuration. The first step is to add the HS500E to the ControlLogix PLC.
CHAPTER 2: INTERFACING WITH THE HS500E Assign a name to the new device. In the example below, the device has been named EMS. Configure the IP Address to match the IP Address of the HS500E. Match the Connection Parameters to the image below. After clicking the OK button, there will be predefined tags containing the specified I/O Information. Predefined Tags INPUT EMS:I.Data [0] = Consume Data Sequence Number Handshake EMS:I.Data [1] = Produce Data Sequence Number EMS:I.
CHAPTER 2: INTERFACING WITH THE HS500E The image below displays the input and output tags during the execution of a command: Commands are placed into the O.Data structure, beginning at word 2, while their corresponding responses can be located in the I.Data structure again beginning at word 2. The data located at words 0 and 1 are used for handshaking. The device that produces the information must increment the sequence number by one for every data packet that is exchanged.
CHAPTER 2: INTERFACING WITH THE HS500E Below is a sample ladder logic program that sets up a timer to send a new request every 1000ms. Every time a new message is sent, the command (0xF000) and length (0x0006) are written to the I/O Data structure and the Consume Data Sequence Number is incremented by 1. Note that if the Consume Data Sequence Number reverts back to 0, the sequence number must be set to 1 (see rung 2 in the image below).
CHAPTER 2: INTERFACING WITH THE HS500E 2.3 TCP/IP I N T E R FA C E It is also possible to communicate with the HS500E through a standard TCP-IP session. A session between the client software and the reader consists of a connection setup, data transactions and the connection termination. The HS500E acts as the server and the user must supply the client software. All connections to the HS500E are initiated by client software only.
CHAPTER 2: INTERFACING WITH THE HS500E Example: The string below is an example of a Read Data command sent to the HS500E: 0x00 0x06 0xAB 0x02 0x00 0x01 0x00 0x32 0x00 0x01 0x00 0x20 0x00 0x00 0xFE 0xF9 Note: the first 12 bytes are listed in the table below; the remaining 4 bytes are reserved fields and checksum.
CHAPTER 2: INTERFACING WITH THE HS500E 2’s Compliment Example Byte Value Sum 0 0x02 0x0002 1 0x00 0x0002 2 0x12 0x0014 3 0x34 0x0048 4 0x54 0x009E 5 0x78 0x0116 Description Binary Hexadecimal SUM 0000 0001 0001 0110 0x0116 1’s Compliment 1111 1110 1110 1001 0xFEE9 2’s Compliment 1111 1110 1110 1010 0xFEEA H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 2: INTERFACING WITH THE HS500E 2.4 O N D E M A N D C O N F I G U R AT I O N After you have confirmed that the PC, HS500E and PLC can communicate, it is time to use the HS500E’s built-in Web Server to configure the HS500E’s “OnDemand” communications features. OnDemand links the Industrial Antenna to specific “Tags” as defined in the ControlLogix PLC.
CHAPTER 2: INTERFACING WITH THE HS500E There are three important links on this page. They are labeled: 2.4.1 • IP Configuration • OnDemand Configuration • OnDemand Status IP Configuration The IP Configuration page provides an option to modify and configure the HS500E’s IP address, Subnet Mask and (Network) Gateway Address. To modify the IP settings of the HS500E, go to the HS500E’s OnDemand Website Main Page and click the IP Configuration link to arrive at the page displayed below.
CHAPTER 2: INTERFACING WITH THE HS500E 2.4.2 OnDemand Configuration At the OnDemand Website – Main Page, Click the link labeled “OnDemand Configuration.” The OnDemand Configuration page will be displayed. As noted, OnDemand is used to link the HS500E to specific tags defined in the ControlLogix PLC. The OnDemand Configuration page allows you to modify the settings of the HS500E’s Subnet Node.
CHAPTER 2: INTERFACING WITH THE HS500E The OnDemand Node 01 Configuration Page PLC Controller Settings 1. Select a Controller Type from the drop-down menu. (Controller Type specifies the type of PLC that will be communicating with the HS500E). 2. Enter the Controller’s IP address. (Controller IP address is the IP address assigned to the PLC). 3. Enter the Controller’s Slot Number.
CHAPTER 2: INTERFACING WITH THE HS500E Write Settings 4. Specify the number of words (between 1 and 200) for the Max Write Size. (The Max Write Size indicates the maximum number of 2-byte data “words” that the HS500E will write to PLC memory each command-response cycle). 5. Specify a Write Tag Name that is 40 characters or less. (The Write Tag Name refers to the name of the tag in the PLC where the HS500E will write data). 6. Enter values for the Write File Address.
CHAPTER 2: INTERFACING WITH THE HS500E The OnDemand Website - OnDemand Configuration Summary This page displays a brief configuration summary for the HS500E. 2.4.3 Configuring the PLC Meanwhile, in your PLC program, define two tags using the same read tag name and write tag name specified earlier (i.e. EMS_READ1 and EMS_WRITE1). In most PLC programs, the defined tag must have the capacity to store an integer array equal to the Max Size + 3 words.
CHAPTER 2: INTERFACING WITH THE HS500E 2.5 C H E C K I N G C O M M U N I C AT I O N S TAT U S 2.5.1 C h e c k i n g t h e O n D e m a n d S ta t u s P a g e After configuring the HS500E’s Node (via OnDemand) and defining the two “tags” in the PLC, your next step is to check the communication status between the HS500E and the PLC. • Back at the OnDemand Website - Main Page, click the link labeled: “OnDemand Status.” The OnDemand Status page will be displayed.
CHAPTER 2: INTERFACING WITH THE HS500E 2.6 V E R I F Y I N G T H E E X C H A N G E O F D A T A V I A RSL O G I X 5000 At this point, communication between the PLC and the HS500E should be properly configured and a connection established. You can verify the exchange of information between the two devices using RSLogix 5000.
CHAPTER 2: INTERFACING WITH THE HS500E INPUT (where responses are written by the HS500E) EMS_Write1 [0] = (2) the counter is copied here by the HS500E to ACK EMS_Write1 [1] = (3) the HS500E increments this counter to signal a response is available EMS_Write1 [2] = Data Size EMS_Write1 [3-202] = Data OUTPUT (where commands are retrieved by the HS500E) EMS_Read1 [0] = (4) the counter is copied here by PLC to ACK the response EMS_Read1 [1] = (1) PLC increments this counter after copying a command EMS_Read1 [
CHAPTER 2: INTERFACING WITH THE HS500E 3. The HS500E places the response in the write area and then increments the counter in EMS_WRITE1 [1] which signals that there is new information for the PLC (the RFID controller’s command response). 4. After the PLC has processed the response information, it copies the counter found in EMS_WRITE1 [1] to the read area in EMS_READ1 [0] which signals (to the HS500E) that the PLC has read the response data. H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 2: INTERFACING WITH THE HS500E 5. The HS500E will clear its Write Areas by copying O’s to memory, after which it will be ready to receive another command. H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 3: RFID COMMANDS C HAPTER 3: RFID C OMMANDS 3.1 C O M M A N D S T R U C T U R E In general, RFID commands sent to the HS500E adhere to a 6-word (12-byte) packet structure, where each word within the packet is comprised of 2-bytes, a Most Significant Byte (MSB) and a Least Significant Byte (LSB). RFID Command Packet Structure Word # Description 01 Overall Length (the number of words in the Command Packet, including the Overall Length field).
CHAPTER 3: RFID COMMANDS 3.2 RFID C O M M A N D S The first three commands in the table below, Commands (AB) 02, 03 and 05, instruct the HS500E to perform standard RFID operations such as data reads, writes and fills. Commands F0 (00), F1, F3 and F4 are used to retrieve or modify information stored internally within the HS500E Ethernet Antenna. Command F2 is designed to continuously repeat one of the first three commands (Continuous Read, Continuous Write, or Continuous Fill).
CHAPTER 3: RFID COMMANDS C O M M A N D 02: R E A D D ATA DESCRIPTION Command 02 instructs the Ethernet Antenna to Read Data from a contiguous area of an RFID tag’s memory. DISCUSSION The Read Data command is used to read a specified number of bytes from contiguous areas of tag memory. This command consists of the Overall Length (OAL), the Command ID Number, a Timeout Value, a Start Address and Read Length. The minimum Read Length is 1 byte.
CHAPTER 3: RFID COMMANDS Response from HS500E Command 02: Read Data – Response Structure Field Name MSB LSB Word Value Overall Length (in words) 00 08 0008 MSB =RF Error Counter 00 02 0002 00 01 0001 RF Time XX XX XXXX MSB = RF Retry Counter 01 01 0101 Total Time YY YY YYYY Return Data (bytes 1, 2) Data Data DATA Return Data (bytes 3,4) Data Data DATA LSB = Command Echo MSB = Instance Counter LSB = Node ID Echo LSB = Syntax Error Counter • RF Error Counter – the number
CHAPTER 3: RFID COMMANDS C O M M A N D 03: W R I T E D ATA DESCRIPTION Command 03 instructs the Ethernet Antenna to Write Data to contiguous areas of an RFID tag’s memory. DISCUSSION This command is used to write segments of data to contiguous addresses of tag memory. The Write Data command consists of an Overall Length, the Command ID, a Timeout Value, Start Address and Write Length, and the Data Byte Value(s) to be written to the tag.
CHAPTER 3: RFID COMMANDS Response from HS500E Command 03: Write Data – Response Structure Field Name MSB LSB Word Value Overall Length 00 06 0006 MSB =RF Error Counter 00 03 0003 00 01 0001 RF Time XX XX XXXX MSB = RF Retry Counter 01 01 0101 YY YY YYYY LSB = Command ID Echo MSB = Instance Counter LSB = Node ID Echo LSB = Syntax Error Counter Total Time H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 3: RFID COMMANDS C O M M A N D 05: F I L L TA G DESCRIPTION Command 05 writes one byte of data across a specified range of tag memory. DISCUSSION This command is used to instruct the HS500E to write a particular data byte value to all specified contiguous areas of tag memory beginning at the Start Address. EXAMPLE In this example, the Ethernet Antenna will write the ASCII character “D” (0x44) to 8bytes of tag memory starting at address 0x0001.
CHAPTER 3: RFID COMMANDS Response from HS500E Command 05: Fill Tag – Response Structure Field Name MSB LSB Word Value Overall Length 00 06 0006 MSB =RF Error Counter 00 05 0005 00 01 0001 RF Time XX XX XXXX MSB = RF Retry Counter 01 01 0101 YY YY YYYY LSB = Command ID Echo MSB = Instance Counter LSB = Node ID Echo LSB = Syntax Error Counter Total Time H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
CHAPTER 3: RFID COMMANDS C O M M A N D F0: R E A D HS500E I N F O R M AT I O N DESCRIPTION Command F0 retrieves the currently installed software version number from the HS500E. DISCUSSION This command queries the Ethernet Antenna’s flash memory and retrieves its software version number. EXAMPLE In this example the software version number (1.0A.8) will be retrieved from the EHS500E. (Note: the “period” between characters is also considered part of the software version number).
CHAPTER 3: RFID COMMANDS Response from HS500E Command F0: Read HS500E Information – Response Structure Field Name MSB LSB Word Value Overall Length 00 06 0006 MSB =RF Error Counter 00 F0 00F0 00 01 0001 Response Data (first word) 31 2E 312E Response Data (second word) 30 41 3041 Response Data (third word) 2E 38 2E38 LSB = Command ID Echo MSB = Instance Counter LSB = Node ID Echo The software version number for this example is 1.0A.
CHAPTER 3: RFID COMMANDS C O M M A N D F1: T E S T LED S / R E A D HS500E I N F O R M AT I O N DESCRIPTION Command F1 tests the HS500E’s LEDs and also retrieves its software version number. DISCUSSION This command causes the Ethernet Antenna’s LEDs to flash a coded diagnostic pattern while also retrieving the installed software version number. EXAMPLE In this example the LEDs on the Ethernet Antenna will be tested and its software version number will be retrieved.
CHAPTER 3: RFID COMMANDS Response from HS500E Command F1: Test LEDs / Read HS500E Information – Response Structure Field Name MSB LSB Word Value Overall Length 00 06 0006 MSB =RF Error Counter 00 F1 00F1 00 01 0001 Response Data (first word) 31 2E 312E Response Data (second word) 30 41 3041 Response Data (third word) 2E 38 2E38 LSB = Command ID Echo MSB = Instance Counter LSB = Node ID Echo The software version number for this example is 1.0A.
CHAPTER 3: RFID COMMANDS C O M M A N D F2: S TA RT /S TO P R E P E T I T I V E C O M M A N D DESCRIPTION Command F2 repeatedly issues a specified RFID command. DISCUSSION This command will instruct the Ethernet Antenna to continuously repeat a specified RFID command. Note that not all RFID commands support the ability to be continuously repeated. Only Commands 02, 03 and 05 support continuous repetition. To begin repeating a command, set the Overall Length to a value of 0x0006 or greater.
CHAPTER 3: RFID COMMANDS Data Byte Value(s) for Write (only applicable when word 2 is F203.
CHAPTER 3: RFID COMMANDS C O M M A N D F3: W R I T E IP A D D R E S S DESCRIPTION Command F3 writes a new IP Address to the HS500E. DISCUSSION This command is used to assign a new IP Address to the HS500E. Writing an IP Address to the HS500E 1. Run Command F3 as shown below (the R/W LED on the HS500E will blink repeatedly for 15 - 20 seconds). 2. After blinking stops, cycle power to the unit (the R/W LED will again blink for 15 20 seconds). 3.
CHAPTER 3: RFID COMMANDS C O M M A N D F4: R E S E T B AT T E RY C O U N T E R VA L U E DESCRIPTION Command F4 resets the value of a tag’s Battery Counter to zero (0x00). DISCUSSION This command is used to reset the value of the Battery Counter when replacing the batteries in a tag. The Battery Counter stores a one-byte value located at tag address 0x0000. To retrieve the Battery Counter Value, execute Command 02 and note the value stored at address 0x0000 on the tag.
CHAPTER 4: ERROR CODES C HAPTER 4: E RROR C ODES The HS500E will generate an error response if it was unable to complete a command. The MSB of the second word (Command Echo word) of the response will contain a 1byte error code indicating the error that was experienced. BASIC ERROR TYPES There are three basic types of error codes. 1. Component failure or damage that may inhibit module usage. An example of this type of error can be a blown fuse. 2. User syntax command error (0x88).
APPENDIX A: ASCII CHART A PPENDIX A: ASCII CHART H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
APPENDIX A: ASCII CHART H S500E – OPERATOR ’S MANUAL P/N: 17-1305 REV 01.
EMS WARRANTY EMS WARRANTY Escort Memory Systems warrants that all products of its own manufacturing conform to Escort Memory Systems’ specifications and are free from defects in material and workmanship when used under normal operating conditions and within the service conditions for which they were furnished.