Netronix CTU-M Series Instruction Manual

Technical Data Sheet
RFID reader
CTU-M series
CTU-Mxx-man-eng-v2.pdf
Fig. 1 CTU-M2R
ATTE TIO ! THIS CO FIDE TIAL DOCUME T IS PROPERTY OF ETRO IX
SP. Z O.O.
DISTRIBUTION OF THIS DOCUMENT IN ANY WAY WITHOUT SPECIAL PERMISSION OF ITS
OWNER IS STRICTLY FORBIDDEN

1. INTRODUCTION ............................................................................................. 5
2. GENERAL SPECIFICATION...........................................................................
3. DIMENSION, TERMINAL DESCRIPTION....................................................... 7
4. MODULE SETTINGS BY ON-BOARD SWITCH............................................. 8
5. TRANSMISSION PROTOCOLS...................................................................... 8
5.1. RS-232/485 TRANSMISSION PROTOCOL ................................................ 8
5.2. Protocol for I
2
C transmission............................................................................. 8
5.2.1. Data exchange algorithm ............................................................................... 8
5.2.2. Timings............................................................................................................ 10
5.3. Protocol for 1WIRE (Dallas) bus...................................................................... 10
5.4. Wiegand protocol ................................................................................................ 12
5.5. Key management................................................................................................. 13
5.5.1. Key loading into dynamic key memory....................................................... 13
5.5.2. Key loading to key static memory ............................................................... 14
5.6. Commands for communication with transponder ..................................... 14
5.6.1. On/off switching of reader field.................................................................... 14
5.6.2. Selecting one of many transponders.......................................................... 15
5.6.3. Logging by means of Dynamic Key Buffer to selected sector of
transponder......................................................................................................................... 16
5.6.4. Logging by means of Static Key Buffer to selected sector of
transponder......................................................................................................................... 16
5.6.5. Reading-out the content of transponder block.......................................... 17
5.6.6. Writing the content of transponder block ................................................... 17
5.6.7. Copying the content of transponder block into other block..................... 18
5.6.8. Writing the page content into Mifare UL .................................................... 18
5.6.9. Reading the page content in Mifare UL ..................................................... 19
5.6.10. Writing values to transponder block ....................................................... 19
5.6.11. Reading-out the values from transponder block................................... 20
5.6.12. Increasing the value included in transponder block............................. 20
5.6.13. Decreasing the value included in block transponder ........................... 21
5.6.14. Setting the transponder in field into sleep mode .................................. 21
5.7. Reader inputs and outputs ............................................................................... 22
5.7.1. Writing the output state................................................................................. 22
5.7.2. Reading the input state................................................................................. 22
5.7.3. Writing the settings to any port.................................................................... 23

5.7.4. Reading-out the configuration of freely selected port .............................. 25
5.8. Access password ................................................................................................ 25
5.8.1. Logging to reader........................................................................................... 25
5.8.2. Changing the password................................................................................ 26
5.8.3. Logging out of the reader ............................................................................. 26
5.9. Operating the transponder internal memory ............................................... 27
5.9.1. Reading-out the transponder number from memory................................ 27
5.9.2. Writing the transponder name to memory ................................................. 27
5.10. Operating the built-in access control ........................................................ 27
5.10.1. Writing the configuration of access control............................................ 27
5.10.2. Reading-out the configuration of access control .................................. 28
5.10.3. Writing the “automatic read” configuration............................................. 28
5.10.4. Reading-out the configuration of automatic device.............................. 30
5.10.5. Setting the date and time ......................................................................... 30
5.10.6. Reading-out the date and time ................................................................ 30
5.11. Configuring the UART serial interface....................................................... 31
5.11.1. Writing the configuration of serial port.................................................... 31
5.11.2. Reading the configuration of serial interface......................................... 31
5.12. Managing the events ...................................................................................... 32
5.12.1. Setting the event recorder........................................................................ 32
5.12.2. Reading the event recorder ..................................................................... 33
5.12.3. Reading the counters related to event memory. .................................. 33
5.12.4. Reading the events ................................................................................... 34
5.13. MAD – Mifare Application Directory........................................................... 35
5.13.1. Card MAD formatting ................................................................................ 35
5.13.2. Adding the application to MAD directory................................................ 35
5.13.3. Pursuing the sector for given application............................................... 36
5.13.4. Pursuing the next sector of application .................................................. 36
5.14. Other commands ............................................................................................. 37
5.14.1. Remote reset of reader............................................................................. 37
5.14.2. Reading-out the reader software............................................................. 37
5.14.3. Change buzzer volume............................................................................. 37
5.15. Code meanings in response frames .......................................................... 38
6. MEANING OF SYMBOLS USED IN THE SPECIFICATION ......................... 38
7. MECHANISM OF MASTER ID ...................................................................... 38
8. RESET TO DEFAULT SETTINGS ................................................................ 39

9. OPERATION EXAMPLE OF TRANSPONDER............................................. 39

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
5
1. Introduction
CTU-M device series is OEM miniature RFID card reader operating at frequency of
13,56 MHz
Main features:
• Support of Mifare S50, S70, Ultralight, Desfire
• built-in antenna
• card memory with build-in lock driver,
• lots of communication interfaces type, depend on version (see table below)
• Built-in relay and buzzer
• Built-in push-button for reset to default settings
• 2 configurable inputs/outputs
• Two-state outputs control
• Read-out of two-state input
• changeable format of sending ID
• MAD functionality
• Data password protected
• Software update via serial interface using NEFIR program
CTU-M reader series
I TERFACES
Module type
GPIO
Card memory
Event memory
Relay
Power supply
RS-232 RS-485 RS-232TTL SPI I2C WIEGA D 1WIRE
CTU-M2R* 

 40 

 

 7-1 


CTU-M4R  40   7-16 
CTU-M5N* 

 40 

 

 5 

 

 

 

 


CTU-M5R  40   5     
CTU-M2RM  1000 4000  7-16 
* - standard version, rest of version for special order

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
6
2. General specification
Supported functionality depending on transponder / card type:
Transponder
type
ID number
read-out Full write and read-out of memory blocks
S50 YES YES
S70 YES YES
Ultralight YES YES
Desfire YES O
CTU-Mxx module parameters
Supply voltage (M2R, M4R model) 7-16 V
Supply voltage (M5R model ) 4,5 - 5,5 V
Max. supply current 120 mA
Rated operation radio frequency of module 13,56MHz
Working temperature -20°c - +65°c
Max. relay current 2A
Appr. read distance for S50 7 cm
Max. output current for GPIO 20mA
Transmission parameters for
RS232/RS485/RSTTL
2400, 4800, 9600, 19200, 38400, 57600,
115200 bps,
8 data bits, 1 stop bit, no parity
compliant with „ etronix Protocol”
Address on I
2
C bus 0xC0
1WIRE family code,address (configurable) 0x01,0x01
WIEGA D number of bits 37

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
7
3. Dimension, terminal description
Rys.2 top side view
Pin no. Description
1 RS232RX, RS485B, RSTTL_RX, 1WIRE, MOSI,
SDA
2 RS232TX, RS485A, RSTTL_TX, MISO
3 SCK, SCL
4 CS
5 MCLR
6 G D
7 VCC
8 GPIO 1
9 GPIO 2
10 G D
11 C
12 C
13 RELAY 1
14 RELAY 2
4x
φ
3
67 mm
67 mm
79.5 mm
79.5mm
2 14
1 13

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
8
4. Module settings by on-board switch
Two function of build-in switch:
• configure to factory settings – press button for 8 seconds
• change interface and RFID transponder type – press button in schematic:
STEP Number of press 1 2 3 4 5
1 ME U1 – interface
selection*
- RS232/485 SPI WIEGA D 1WIRE I2C
2 Triple beep
* - type of interface depends on CTU-M model
5. Transmission protocols
5.1. RS-232/485 transmission protocol
In this data sheet RS-232/485 protocol has been confined to descriptions of
commands, responses and their parameters. Header and CRC control sum exist
always and are compliant with full “ etronix Protocol” document.
Command frame:
Header C_Command ame Response_parameters1…n CRC
Response frame:
Header C_Command ame+1 Response_parametrers…m OperationCode CRC
RS protocol operation can be tested by means of development tools including free of
charge “FRAMER” software”.
5.2. Protocol for I
2
C transmission
5.2.1. Data exchange algorithm
A module configured depending on table showed on point 4. operates in I
2
C
interface mode in following sequences:
1. Master (external device) writes command with parameters if necessary into slave
device (CTU module)
2 The command is performed (immediately after receiving byte sent quantity declared
in frame)
3. Master device reads response, its parameters and operation code. In case of
receiving busy byte 0xCB, repeat attempt to read the response after ca. 1 ms

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
9
(commands connected with write to/and read from transponders can last up to 100
ms).
We write inquiry-command to CTU module:
The „number of bytes” field must contain information on byte quantity sent directly
“command” fields and “parameters”.
We have then:
START
UMBER OF BYTES(1B)
SLAVE ADDRESS (1B) 0
COMMA D (1B)
PARAMETERS (0...n B)
START
umber of bytes or 0xCB
SLAVE ADDRESS (1B) 1
PARAMETERS + OPERATIO CODE
( bytes)
STOP
I
2
C SE D
START
I
2
C SE D:
0b110000a0
Wait for ACK
I
2
C SE D:
umber of bytes,command,[data]
I
2
C SE D:
0b110000a1
Wait for ACK
Wait 1ms
I
2
C START
I
2
C READ 1 byte:
= 0xCB ?
Receive bytes
I
2
C SE D
STOP
TAK
NIE

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
10
5.2.2. Timings
Module sends and receives data at 400 kHz clock frequency considering
timings showed below.
Note 2: Reader keeps in low state first clock pulse of each byte sent until
proper state is placed on SDA line.
5.3. Protocol for 1WIRE (Dallas) bus.

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
11
Family code ID1…ID5 Address CRC
1 byte 5 bytes 1 byte 1 bytet
ID1...5 – unique ID number of transponder
CRC_DAL- check sum of data send
The format conforms 1-WIRE Dallas (e.g.. DS1990A). It means, that described
module could be used as a replacement of DS1990A drop.
During operation, a module tries to read-out transponder periodically. If it fails (no
successful read-out), module does not response for pulses sent from 1-WIRE master
unit. Bus does not "see" the module, which corresponds with lack of reader applying, it
means applying the DS1990A drop to drop reader. If module reads out the
transponder, the module starts to send data via 1-WIRE bus.
Calculate the CRC value
According to DS1990A specification C value is calculated from equation
x^8+x^5+x^4+1 with initial value equal to 0x00. The CRC is calculated on basis of all
frame bytes excluding the last one.
An example of CRC value calculation procedure written in C language
unsigned char CalcCRCDallas(unsigned char *SourceAdr)
{
unsigned char i,k,In,CRC=0;
for(i=0;i<7;i++)
{
In=*SourceAdr;
for(k=0;k<8;k++)
{
if((In^CRC)&1) CRC=((CRC^0x18)>>1)|0x80;
else CRC=CRC>>1;
In>>=1;
}
SourceAdr++;
}
return(CRC);
}
where *SourceAdr is beginning flag of data buffer

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
12
5.4. Wiegand protocol
The format conforms WIEGA D protocol specification for bits. During operation,
a module tries to read-out transponder periodically. If it fails (no successful read-out),
module does not send data (bus does not "see" the module). If module reads out the
transponder, the module starts to send data via Wiegand bus.
Pulse sequence from left to right.
Total number of pulses (level L) is equal to . The first being bit sent complements up
to parity the bits from first half of total bits. The last bit complements up to non-parity
the bits from second half of bits being sent.
It means, that two bits out of bits assure the transmission correctness. Information is
being sent is written by means bits 2 to -1, it gives information bits.
Check sums for bit sequence:
for even :
EXXXXXXXXXXXXYYYYYYYYYYYYO
or for odd :
EXXXXXXXXXXXXXXXXXX..................
..................YYYYYYYYYYYYYYYYYYO
Where:
E = bit complementing up to parity
O = bit complementing up to non-parity
X = mask for parity calculation
Y = mask for non-parity calculation
......
......
DATA1
DATA0
1 1 0 0 1 ............. 1 0 0 encoding DATA
H level
H level
L level
L level

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
13
5.5. Key management
Key management feature includes key loading to internal key memory. For security
reasons, these keys cannot be red-out.
To maintain the highest level of data security, employed a particular philosophy
of working with these keys.
It allows unit or person who possesses the highest level of confidence to load a
key. Such loading operation can be made one time only, or very rarely.
Reader operation in given application is based on using a key not directly, but on
recalling key number, to login to sector.
The result is that, in substance, key does not appear in data bus in given application.
Additionally, a user is advised to make sure key should have proper access
rights to sectors. This is accomplished by card initialization process, where new
confidential keys are loaded to cards with proper access rights, which are assigned to
these keys.
Keys A and B are assigned to each sector.
Commands C_LoadKeyToSKB and C_LoadKeyToDKB load these keys to reader
memory without information on key type (A or B).
During logging to sector, user has to input as a parameter value of 0xAA or 0xBB, if he
wants, the key which is being recalled would be treated as an A or B.
5.5.1. Key loading into dynamic key memory
Dynamic memory features of automatic content delete in case of supply decay. The
memory can be overwritten many times.
Command frame:
Header C_LoadKeyToDKB Key1…6 CRC
Where:
Parameter name Parameter description Value range
C_LoadKeyToDKB Key loading to key dynamic memory 0x14
Key1…6 6-byte code whichever
Response frame:
Header C_LoadKeyToDKB +1 OperationCode CRC

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
14
5.5.2. Key loading to key static memory
Important feature of static memory is that in case of supply decay, data stored in it will
not be lost. The memory can be overwritten many times.
Command frame:
Header C_LoadKeyToSKB Key1…6, Key o CRC
Where:
Parameter name Parameter description Value range
C_LoadKeyToSKB Key loading to key static memory 0x16
Key1…6 6-byte key whichever
Key o Key number.
It possible to load 32 different keys to a reader.
0x00…0x1f
Response frame:
Header C_LoadKeyToSKB +1 OperationCode CRC
5.6. Commands for communication with transponder
5.6.1. On/off switching of reader field
Command frame:
Header C_TurnOnAntennaPower State CRC
Where:
Parameter name Parameter description Value range
C_TurnOnAntennaPower On/off switching of reader field 0x10
State On state
0x00 –
switching the
field off
0x01 –
switching the
field on
Response frame:
Header
C_TurnOnAntennaPower
+1
OperationCode CRC

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
15
5.6.2. Selecting one of many transponders
Command frame:
Header C_Select RequestType CRC
Where:
Parameter name Parameter
description Values
C_Select
Selecting one of
many transponders 0x12
RequestType Type of trans
ponder
selection
0x00 - Standard selecting from group of
transponders, which are not in stand-
by
mode
0x01 - Selecting from group of
transponders, which are in reader field.
Response frame:
Header C_Select +1 Col o, CardType, ID1…….IDn OperationCode CRC
Where:
Parameter
name Parameter description Meaning
Col o
umber of collisions during one transponder
selecting.
This figure can be equal to the transponder
quantities, which are in the field simultaneously,
and which are not in stand-by state.
CardType Type of selected transponder
0x50 – S50
0x70 – S70
0x10 – Ultra Light
0xdf – Des Fire
ID1…IDn Unique number of transponder ID1 – LSB,
IDn – MSB

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
16
5.6.3. Logging by means of Dynamic Key Buffer to selected sector of
transponder
To complete logging successfully, it is important after any input of the reader, to reload
the Dynamic Key Buffer.
Command frame:
Header C_LoginWithDKB Sector o, KeyType, DK o CRC
Where:
Parameter name Parameter description Value range
C_LoginWithDKB Logging to sector 0x18
Sector o
Transponder sector number, to
which user wants to login.
0x00 – 0x0f (s50)
0x00 – 0x27 (s70)
KeyType
Key type, which is inside internal
Dynamic Key Buffer.
0xAA – key of A type
0xBB – key of B type
DK o Dynamic key number 0x00
Response frame:
Header C_LoginWithDKB +1 OperationCode CRC
5.6.4. Logging by means of Static Key Buffer to selected sector of
transponder
To complete logging successfully, it is important to load Static Key Buffer first.
Command frame:
Header C_LoginWithSKB Sector o, KeyType, SK o CRC
Where:
Parmeter name Parameter description Value range
C_LoginWithSKB Logging to sector 0x1a
Sector o
Transponder sector number, to
which user wants to login.
0x00 – 0x0f (s50)
0x00 – 0x27 (s70)
KeyType Key type, which is inside interna
l
Static Key Buffer.
0xAA – key of A type
0xBB – key of B type
SK o Static Key number 0x00…0x1F
Response frame:
Header C_LoginWithSKB +1
OperationCode CRC

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
17
5.6.5. Reading-out the content of transponder block
Command frame:
Header C_ReadBlock Block o CRC
Where:
Parameter name Parameter description Value range
C_ReadBlock Read-
out of transponder
block content 0x1e
Block o
Block number within given
sector **Sector and block numeration
Response frame:
Header C_ReadBlock +1 Data1….. Data16 OperationCode CRC
Where:
Parameter name Parameter description Value range
Data1…. Data16 Red-out of data from transponder block
5.6.6. Writing the content of transponder block
Command frame:
Header C_WriteBlock Block o, Data1….. Data116 CRC
Where:
Parameter name Parameter description Value range
C_WriteBlock
Write of transponder block
content 0x1c
Block o
Block number within given
sector **Sector and block numeration
Data1…. Data16
Data, which are to be written
into transponder block. whichever
Response frame:
Header C_WriteBlock +1 OperationCode CRC

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
18
5.6.7. Copying the content of transponder block into other block
Command frame:
Header C_CopyBlock SourceBlock o, TargetBlock o CRC
Where:
Parameter name Parameter description Value range
C_CopyBlock
Copyi
ng the content of
transponder block into other
block
0x60
SourceBlock o Source block
TargetBlock o Target block for data **Sector and block numeration
Response frame:
Header C_CopyBlock +1 OperationCode CRC
5.6.8. Writing the page content into Mifare UL
Command frame:
Header C_WritePage4B PageAdr, Data1...4 CRC
Where:
Parameter name Parameter description Value range
C_WritePage4B Writing the page content into Mifare UL 0x26
PageAdr Page number in transponder 0x00…0x0f
Data1...4 Data, which are to be written whichever
Response frame:
Header C_WritePage4B +1 OperationCode CRC

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
19
5.6.9. Reading the page content in Mifare UL
Command frame:
Header C_ReadPage16B PageAdr CRC
Where:
Parameter name Parameter description Value range
C_ReadPage16B Read-out of page content in Mifare UL 0x28
PageAdr
Page address, from which read-
out of following
four pages should start. If PageAdr>0x????,
starts read-
out process of pages, which are
present at memory beginning.
0x00…0x0f
Response frame:
Header
C_ReadPage16B
+1
Data1…16 OperationCode CRC
Where:
Parameter name Parameter description Value range
Data1…16 Red-
out of data from four subsequent
pages. whichever
5.6.10. Writing values to transponder block
Command frame:
Header C_WriteValue Block o, BackupBlock o,Value1...4, CRC
Where:
Parameter name Parameter description Value range
C_WriteValue Write of values to transponder block. 0x34
Block o
Block number within given sector,
into which the Value will be written.
**Sector and block
numeration
BackupBlock o
Declared block number including the
Value copy.
BackupBlock o has no influence for
system operation, but user
can/should make the Value copy by
himself.
**Sector and block
numeration
Value1...4
The Value, which is written to
whichever

CTU
-
Mxx
NETRONIX CTU-Mxx
NETRONIX .
20
transponder block.
Response frame:
Header C_WriteValue +1 OperationCode CRC
5.6.11. Reading-out the values from transponder block
Command frame:
Header C_ReadValue Block o CRC
Where:
Parameter
name Parameter description Value range
C_ReadValue Read-out of the Va
lue from
transponder block. 0x36
Block o
Block number within given sector,
from which the Value will be red-out.
**Sector and block
numeration
Response frame:
Header C_ReadValue+1 Value1...4, BackupBlock o OperationCode CRC
Where:
Parameter name Parameter description Value range
Value1...4 Red-
out Value from transponder
block.
BackupBlock o
Block number, which can include
the Value copy.
**Sector and block
numeration
5.6.12. Increasing the value included in transponder block
To execute a command successfully, format of data included in declared block should
be “Value” format.
Command frame:
Header C_IncrementValue Block o, Value1...4 CRC
Where:
Parameter name Parameter description Value range
C_IncrementValue
Increasing the value included in
transponder block. 0x30
Block o
Block number within given sector, in
which the Value will be modified.
**Sector and block
numeration