Dot Origin VTAP100-PACW v4a User manual

VTAP100-PACWv4a
InstallationGuide
Revised May 2022 v1.1

If you need help to set up or use VTAP100-PACW, beyond what is contained in this
Installation Guide, then please contact our support team.
Email: [email protected]
Download the latest documentation and firmware from https://vtap100.com/resources/
Telephone UK and Europe: [phone]
Telephone North America and Latin America: [phone] or [phone]
If you have any feedback on setting up or using VTAP100-PACW or this documentation,
then please contact our support team. The product is constantly being reviewed and
improved and we value feedback about your experience.
Copyright 2022 Dot Origin Ltd. All rights reserved.
No part of this Installation Guide may be published or reproduced without the written
permission of Dot Origin Ltd except for personal use. This Installation Guide relates to correct
use of the VTAP100-PACW only. No liability can be accepted under any circumstances
relating to the operation of the user’s own PC, network or infrastructure.
Dot Origin Ltd
Unit 7, Coopers Place Business Park, Combe Lane, Wormley
Godalming GU8 5SZ United Kingdom
[phone]

Contents
1 Using this guide 1
2 How the VTAP100 works 2
2.1 Default operation on factory settings 3
2.2 Start reading your own passes 3
2.3 Check status in BOOT.TXT 7
2.4 Send pass data over a Wiegand interface 8
2.5 Wiegand wiring (for model VTAP100-PACW only) 9
3 Choose a location for your VTAP100 13
4 Design a custom label for the wallbox 14
5 Mount a VTAP100 wallbox 15
6 Hardware lock to disable USB mass storage device 16
7 Disposal 19
VTAP100-PACW V4A INSTALLATION GUIDE PAGE I

Safety instructions
WARNING: INTENDEDUSE
The VTAP100-PACW is a boxed product for end-users. Although the wallbox may be
opened when the device is not connected, components mounted on the VTAP100 PCB are
not user-serviceable.
WARNING: ESD PRECAUTIONS
If the wallbox is opened to access the PCB, we recommend careful handling of Electrostatic
Sensitive Devices (ESDs) .
WARNING: POWERSUPPLY
Use a standard micro-USB cable to connect the VTAP100-PACW model to a PC or
alternatively power the unit by connecting it to an access controller, using the Wiegand
connector supplied. If the VTAP100 is being powered through its Wiegand connection, you
can still make an additional USB data connection to a PC, provided that the PC is already
powered before the connection is made.
Using other cables or operating the product without its wallbox will invalidate EMC
emissions and immunity certifications.
The VTAP100 is rated at 5V DC (typ. 110mA, max 150mA) for power over USB. When
powered over Wiegand it is rated at 8V-16V DC @ 30 to 100mA.
VTAP100-PACW V4A INSTALLATION GUIDE PAGE II

1  Using this guide
This guide is for first-time users of the VTAP100-PACW.
Figure 1-1 VTAP100 in square (-SQ) case
Figure 1-2 VTAP100 in compact (-CC) case
It contains the information you need to physically install your VTAP100.
Consult the VTAP100 Basic Configuration Guide for more about custom configuration and
maintenance features, including how to update the firmware on your VTAP100 unit, when a
new release is available.
If you need help beyond what is contained in this guide please contact
[email protected].
VTAP100-PACW V4A INSTALLATION GUIDE PAGE 1

VTAP100-PACW V4A INSTALLATION GUIDE PAGE 2
2  How the VTAP100 works
With the VTAP100-PACW connected to a PC, simply tap your smartphone against the
VTAP100. Your mobile NFC pass will be read and data sent to the connected PC. The extra
facility with the VTAP100-PACW model only, is that it can alternatively be connected to an
access controller, using the Wiegand connector supplied.
Of course, the data can only be read if your phone contains a mobile NFC pass, which has
been issued in connection with the Merchant ID(s)/Collector ID(s) and key(s) that are known
to the VTAP100. The unit comes with default values, so that you can test Default operation
on factory settings before you begin customising any settings.
When the VTAP100-PACW is connected to a computer it appears as a generic mass storage
device (like a memory stick). To configure your VTAP100, you simply edit or create text files.
These will be read automatically, and control the operation of the VTAP100. There is
information in Start reading your own passes to take the first steps towards reading your
own passes. The VTAP100-PACW must be configured over USB from a PC, before it will send
pass data over the Wiegand interface. After being configured it does not need to be
connected to a PC. Consult the VTAP100 Basic Configuration Guide for more detail.
By default the VTAP100 is fully upgradable in the field. However, the VTAP100 can be locked
in software or hardware, before deploying the unit, so that operation is no longer easily
changed.

2.1 Default operation on factory settings
Before anyone changes the configuration from its default, you can confirm that the unit is
working.
These steps demonstrate that the hardware can detect and interact with an OriginPass mobile
NFC pass, which is ready to work with the default configuration of your VTAP100.
1. Obtain an OriginPass from Dot Origin by visiting https://originpass.com/VTAP/ and add it
to your Google Pay or Apple Wallet.
2. Connect the VTAP100 to your PC, using a USB cable.
3. Open a text editor, such as Windows Notepad.
4. When you tap the OriginPass on the VTAP100:
lPass contents will be displayed in the open text editor.
lThe diagnostic LEDs on the VTAP100 PCB will flash together.
lYour smartphone may signal with a buzz or beep.
Note: Some Android phones will only interact if their screen is on, although it does not
need to be unlocked. You may need to enable NFC in the settings for the smartphone.
Note: If the pass detected does not match the key and ID on the VTAP, or is moved away
too quickly to be read, the pass contents displayed will be an 8 digit random hex string,
such as '08E22AC1', different on each presentation. OriginPass contents will be a
consistent string of the type '3~ffymeK9f_mziYtA6~53999301628695~Valued'. The
separator '~' or '|' will depend on your keyboard language settings.
Note: If local security settings prevent or limit the use of removable storage devices, or
the connection of additional keyboards, an administrator may need to alter those
permissions.
2.2 Start reading your own passes
If you navigate to the VTAP100 in the computer's file system. It will appear as an attached
mass storage device and list the files contained, including the main config.txt file.
To read any mobile NFC pass, you will need to provide your pass reading parameters. This
means a collector ID or merchant ID and any keys. These allow you to read and decrypt pass
data that is held by your users, on their smartphones.
This first time, you will need to connect the VTAP100 to your PC, using a USB cable. (If
needed, you can adjust the configuration to make these changes remotely in future, see
Advanced Configuration and Commands Reference Guide.)
VTAP100-PACW V4A INSTALLATION GUIDE PAGE 3

VTAP100-PACW V4A INSTALLATION GUIDE PAGE 4
Step 1: Upload key file(s) to your VTAP100
1. Ensure each of the keys you need to use are stored in a file with the name
private#.pem, following the .pem format, where # is replaced with a number from 1
to 6, matching the key slot you will save it in. (The demo passes are accessed using the
key in KeySlot 6, so don't overwrite this one unless you are finished with demo passes.)
Note: You cannot use more than 6 key files.
2. Load your keys by copying these files onto your VTAP100, which shows up in the file
system of your PC as a mass storage device.
Note: When you reboot the VTAP100 your key will have been stored in hardware, and
will no longer be listed as a file on the device. You can confirm key file(s) have been
loaded when you Check status in BOOT.TXT

Step 2:Declare Merchant ID(s)/Collector ID(s) in the config.txt file
1. Open the file config.txt in a text editor (such as Windows Notepad). It already
contains parameters for accessing the demo passes, prefixed VAS1 and ST1, both relying
on KeySlot 6. You can overwrite these, or keep them in addition to your own pass
reading parameters.
2. Add your pass reading parameters in the config.txt file to access up to 6 Apple
VAS and up to 6 Google Pay Smart Tap IDs, and identify the keys to be used in each
case.
Note: Although the VTAP100 supports multiple IDs, Apple and Google expect most
users will only use one. Using multiple IDs is an advanced feature to use with care. The
VAS# and ST# numbers define the order in which IDs will be requested from Apple or
Android phones respectively. The lowest numbered ID will be requested first, then
continuing in ascending numeric order.
Put each parameter on a new line. Order of parameters does not matter to the
VTAP100, but could help other people who need to edit the file. Start any comment
lines in the config.txt file, that the VTAP100 should ignore, with a semicolon. Each
parameter should only appear once - if it accidentally appears more than once then only
the last instance will take effect.
Example:Settings in config.txt to interact with both
Apple VASand Google Smart Tap mobile passes
!VTAPconfig

VAS1MerchantID=<yourmerchantID>
VAS1KeySlot=1
;Thissaysusethekeyaddedasfile'private1.pem'toreadand
;decryptanypassconnectedtoyourmerchantIDonanAppleiPhone

ST1CollectorID=<yourcollectorID>
ST1KeySlot=2
ST1KeyVersion=1
;Thissaysusethekeyaddedasfile'private2.pem'atkeyversion1
;toreadanddecryptanypassconnectedtoyourcollectorID
;onanAndroidphone
3. Save the amended config.txt file and these changes will take effect immediately. (A small
number of changes to the config.txt file require a reboot to take effect, for instance
to the status of the virtual COM port, but these are highlighted in later sections).
VTAP100-PACW V4A INSTALLATION GUIDE PAGE 5

VTAP100-PACW V4A INSTALLATION GUIDE PAGE 6
Note: If a VAS#KeySlot parameter is omitted, or set to 0, then all available keys will be
compared with the 4 byte hash of the public key for the data, to choose the right key. If the
data received by the VTAP100 cannot be decrypted, the Apple iphone will register a pass
read, but the data will not be output.
Note: If an ST#KeySlot parameter is omitted, or set to 0, then authentication will be
omitted and decryption will not be performed. In this case, Google Pay Smart Tap data will
be received and sent on by the VTAP100, only if the pass does not require authentication by
the terminal.

2.3 Check status in BOOT.TXT
If you navigate to the VTAP100 in the computer's file system. It will appear as an attached
mass storage device and list the files contained, including the BOOT.TXT file.
Inspecting BOOT.TXT will give you essential information about your VTAP100 set up, at time
of last reboot, which might be helpful when troubleshooting.
Figure 2-1 Example BOOT.TXTfile
You are most likely to need:
l'ATCA' - the serial number for your VTAP100 unit.
l'Firmware' - the VTAP100 firmware version in use.
l'Hardware' - the VTAP100 hardware version in use.
l'KeySlots used:' - a useful check that you have uploaded the necessary key files, since these
are deleted when they are uploaded. These two examples show how to read this
information:
o'KeySlots used:------' shows that no keys have been uploaded.
o'KeySlots used: 12--56' shows that key files 1 and 2 have been successfully uploaded, in
addition to the defaults 5 and 6.
l'VCP enabled' - indicates that the virtual COM port has been enabled.
l'Status' - should be 0 if operating normally, anything else indicates an error state.
l'Boot time' - The time at boot, which defaults to 1970/00/00 00:00:00 if power is removed
to reboot.
If the configuration has been locked the BOOT.TXT file will end with the words LOCKED S/W
or LOCKED H/W.
VTAP100-PACW V4A INSTALLATION GUIDE PAGE 7

VTAP100-PACW V4A INSTALLATION GUIDE PAGE 8
2.4 Send pass data over a Wiegand interface
Note: This will only have an effect if you are using the VTAP100-PACW model.
The Wiegand interface allows mobile NFC pass data to be passed straight to an access
controller, like data from any other card reader.
1. To enable the Wiegand interface you will need to make changes to the config.txt file.
Example:Changes to config.txt to enable the Wiegand interface
!VTAPconfig

WiegandMode=1
WiegandPassMode=0
WiegandSource=81
Here WiegandMode=1 chooses to send data over the Wiegand interface, for all passes
cards/tags that can be read, by using WiegandSource=81. And WiegandPassMode=0
says send the whole pass contents.
If you choose WiegandPassMode=1 all of the settings for pass payload handling can also
be used with the appropriate Wiegand prefix. This allows you to extract a short character
sequence from the pass payload, which can then be interpreted as a decimal or
hexadecimal number and sent over the Wiegand interface as a bit sequence.
2. Wiegand data is usually a short bit pattern, rather than a sequence of characters, so there
are several optional settings which are specific to control the transfer of data over a
Wiegand connection:
lPassFormat=d is a setting to interpret ASCII pass data characters as either hex (h) or
decimal (d), when converting the pass data to a Wiegand bit sequence.
lPassWiegandBits=56 lets you specify the number of bits (1 to 255) to output over
the Wiegand interface from the start of the filtered pass data. If omitted it defaults to
56. TagWiegandBits does the same for card/tag data.
lWiegandPassTypeIdent=1 inserts an additional leading byte of pass type identifier
(01 for Apple VAS, or 02 for Google ST) in the Wiegand output, to make it possible to
distinguish between cards/tags and mobile wallet passes. Overrides
PassWiegandBits and results in Wiegand bit length of 64 bits. The default =0 turns
this feature off.

lIf you are not sending a whole number of bytes, for example you require 36bit output,
there are a number of commands you can use to do the necessary truncation, shifting,
padding or addition of parity bits needed to get the output format you require.:
oPassWiegandParity=1 adds this number of 'parity bits' to pass data if
PassFormat=d. It allows the use of card number formats that include parity bits, as
long as the parity bit(s) are not being tested for validity. Again, the default =0 turns
this feature off.
oTagByteOrder, TagReadFormat, TagReadRightShift, TagReadLength,
TagReadOffset are all detailed in the Advanced Configuration Guide.
lStartupDelayMS=5000 can be used to delay full start up by a number of milliseconds
to allow the power supply to stabilise. We recommend that you use a value such as
5000ms when using an external power supply, to prevent possible file system
corruption during installation if VTAP could be wired up to a live external power supply
(typically when using Wiegand or RS485 expansions).
CAUTION: We strongly recommend that power is disconnected from the installation
cable before wiring the VTAP100 connector.
3. After making the necessary changes to your config.txt file and saving it, you can
connect the VTAP100 to your access controller. (Consult the VTAP100-PACW Installation
Guide for wiring information.) You can leave the USB connection in place at the same time,
if you want to test the configuration before disconnecting.
Passes will then be read by VTAP100 with data passed direct to your access controller.
2.5 Wiegand wiring (for model VTAP100-PACW only)
Use the Wiegand connector supplied to make a Wiegand wiring connection to a configured
VTAP100-PACW from your access controller, like any other reader.
Use 24-26AWG shielded multi-core, overall screened, cable for the connection between
VTAP100-PACW and controller (for example Belden CR9538).
Note: Screened cable should always be used to connect VTAP100 readers to door
controllers, to avoid interference from other equipment. The cable screen must be
connected electrically to GND at both the VTAP100 reader and controller ends of the cable,
using the bare wire 'drain' conductor.
VTAP100-PACW V4A INSTALLATION GUIDE PAGE 9

VTAP100-PACW V4A INSTALLATION GUIDE PAGE 10
If you have a square (SQ) case you will need to open the case to access the Wiegand
connector. Press with a screwdriver in the slot at the base of the back to release the catch and
open the case.
Figure 2-2 Where to press, to open the square case
If you have a compact (CC) case you need to need to remove the screw from the case (which
may be either a security screw or phillips head screw). Separate the case by squeezing the top
of the case in the middle of each side:
Figure 2-3 Where to squeeze, to open the compact case
You may need to break the label, which covers the large hole in the back, for access to the
Wiegand connector. Then pass the cable through that hole in the back of the case.

Figure 2-4 Where to pass cable into the compact case
Screw the back of the VTAP100 case to the wall before connecting the cable to the Wiegand
connector.
CAUTION: If the VTAP100 is being powered through its Wiegand connection, you can
still make an additional USB data connection to a PC, provided that the PC is already
powered before the connection is made. (This avoids the risk of damage to the USB interface
on the PC, if the PC is not powered.)
Follow this figure and table to make the right connections in your access controller:
VTAP100-PACW V4A INSTALLATION GUIDE PAGE 11

VTAP100-PACW V4A INSTALLATION GUIDE PAGE 12
Figure 2-5 Connection between VTAP100-PACW
and EH400 access controller (for example)
EH400 Controller Signal
Name
(for example)
Wire
colour
(typical)
VTAP100 Signal
Name
(v4a hardware)
Beep Yellow BEEP
RED LED Brown RED
GRN LED Orange GRN
D1 White D1
D0 Green D0
GND Black GND
PWR Red PWR+

3  Choose a location for your VTAP100
Position the VTAP100-PACW so that users can easily tap their smartphone against the label,
on top of the device.
The square wallbox for a VTAP100 is 86mm x 86mm and 25.5mm deep.
Figure 3-1 VTAP100 -SQ square wallbox
The compact wallbox for a VTAP100 is 97mm x 49mm and 40mm deep.
Figure 3-2 VTAP100 -CC compact wallbox
The VTAP100 must be stored and operated under the following conditions:
lAmbient temperature -25 to +70°C (-13 to 158°F)
lHumidity 0 to 95% RH non-condensing
lPressure 86-106kPa
VTAP100-PACW V4A INSTALLATION GUIDE PAGE 13

VTAP100-PACW V4A INSTALLATION GUIDE PAGE 14
4  Design a custom label for the wallbox
You can design and affix your own branded label to the unit. If you need help branding units
do contact [email protected].
The size of the label recess on a square (-SQ) wallbox is 72.33mm x 72.33mm with 4mm
radius rounded corners as shown below.
Figure 4-1 Dimensions of label recess in -SQsquare wallbox
The size of the label recess on a compact case (-CC) is 41mm x 57mm with 2mm radius
rounded corners as shown below.
Figure 4-2 Dimensions of label recess in -CCcompact case

5  Mount a VTAP100 wallbox
The square wallbox has mounting holes in case you want to fix the device in place. The
wallbox separates into two pieces, which clip together around the PCB. The following diagram
shows the location of mounting holes in the wallbox base plate:
Figure 5-1 Mounting holes in the -SQsquare wallbox base plate
The compact wallbox has mounting holes in case you want to fix the device in place. The
wallbox separates into two pieces, which clip together around the PCB. The following diagram
shows the location of mounting holes in the wallbox base plate:
Figure 5-2 Mounting holes in the -CC compact case base plate
We recommend that you complete and test your configuration before the VTAP100-PACW is
mounted. Detailed help is in the VTAP100 Basic Configuration Guide.
VTAP100-PACW V4A INSTALLATION GUIDE PAGE 15

VTAP100-PACW V4A INSTALLATION GUIDE PAGE 16
6  Hardware lock to disable USB mass storage device
You can lock the VTAP100 so that its firmware and configuration cannot be changed. You can
either do this in software, or simply disable the mass storage device in hardware. If you have a
boxed VTAP100-USB or VTAP100-PACW it is strongly recommended that you use the
software lock option, which is described in the Basic Configuration Guide.
A software lock prevents changes but leaves some files visible. A hardware lock means that
the VTAP100 will no longer be detected as a USB mass storage device. (It will still behave as
an HID keyboard device and, if enabled, the virtual COM port will behave as a composite USB
device consisting of HID keyboard and USB virtual COM port.)
Users of a VTAP100-USB will need to open the wallbox to locate the jumper labelled LOCK
(close to the MicroUSB connector) on the PCB.
If you have a square (SQ) case you will need to open the case to access the Wiegand
connector. Press with a screwdriver in the slot at the base of the back to release the catch and
open the case.
Figure 6-1 Where to press, to open the square case