Allegion Developer Portal
Allegion Developer Portal
AD-400 APM Address 1
PIM-400-485-400 RSD Address 3
The Message Bytes column in Table 14-2 shows the first three bytes without the Start and CRC bytes. These are Address, Message Type, and Message Length.
NOTE: The use of Bold, Italic and Bold Italic font is to show the difference in the first three bytes within the table.
| Message Bytes | Command Type/ Address | Decoded Message | Notes |
|---|---|---|---|
| 03 3A 00 | RSD/0x03 | Address = 3, POLL_RSD_CRC, Lngth = 0 | Standard poll message to the PIM-400-485. |
| FF 31 0A 01 01 00 11 00 1A 99 00 02 C1 | 0xFF | Address = 255, RSD_STATUS_CARDDATA, Lngth = 10 Byte 1 Bits 0 - 7: APM Address (0x00 to 0xFE excluding 0xAA) =>0x01 (1) Byte 2 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 3 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bit 2: APM Open Too Long;1=APM Open Too Long =>0 Bit 3: Tamper Active;1=Tamper Active =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 | Response gives status of a 26-bit card. In this case, a Prox card presented to the AD-400 at APM Address 1 connected to PIM-400-485 with RSD Address 3. The trouble bit on this APM is because the cover was removed on the AD-400 unit that this trace was taken. The other status bits may vary slightly on your unit depending on the conditions of the device. |
| Byte 4 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300; 1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBM Status;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>0 Byte 5 Bits 0 - 7: More Events =>0x00 (0) Byte 6 Bits 0 - 7: Card data bit count =>0x1A (26) Byte 7 Bits 0 - 7: Card data read at APM =>0x99 (153) Byte 8 Bits 0 - 7: Card data read at APM =>0x00 (0) Byte 9 Bits 0 - 7: Card data read at APM =>0x02 (2) Byte 10 Bits 0 - 7: Card data read at APM =>0xC1 (193) | |||
| 01 4F 01 0E | APM/0x01 | Address = 1, APM_LOCK_CONTROL, Lngth = 1 Byte 1 Bits 0-7: Output state; 14=PIN required => 0x0E (14) | ACP sends indication to APM that the credential was valid, but that a PIN is required for access. |
| FF 30 03 01 00 11 | 0xFF | Address = 255, APM_STATUS, Lngth = 3 Byte 1 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 2 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bits 2 - 3: Reserved; =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 Byte 3 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300;1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBM Status;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>0 | Response is the standard APM_STATUS. Now, the lights on the AD-400 are flashing red and green to indicate to the person who presented the card that a PIN is required for access. |
| 03 3A 00 | RSD/0x03 | Address = 3, POLL_RSD_CRC, Lngth = 0 | Standard poll message to the PIM-400-485. |
| FF 31 07 01 01 00 11 00 04 01 | 0xFF | Address = 255, RSD_STATUS_CARDDATA, Lngth = 7 Byte 1 Bits 0 - 7: APM Address (0x00 to 0xFE excluding 0xAA) =>0x01 (1) Byte 2 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 3 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bit 2: APM Open Too Long;1=APM Open Too Long =>0 Bit 3: Tamper Active;1=Tamper Active =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 Byte 4 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300;1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBM Status;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>0 Byte 5 Bits 0 - 7: More Events =>0x00 (0) Byte 6 Bits 0 - 7: Card data bit count =>0x04 (4) Byte 7 Bits 0 - 7: Card data read at APM =>0x01 (1) | This will return RSD_STATUS_IDLE until a credential is presented. Since that credential in this case is a button push, the keypress comes through as a RSD_STATUS_CARDDATA response with 4 bits equal to 0x1 (keypress 1). It should be noted that there are different keypad formats available on the credential readers with keypads on AD-400 and these will all appear slightly different both in the number of bits and the format of the data returned. Some ACPs inherently expect a specific keypad formats and that keypad format is probably supported from buffered mode to different unbuffered 4-bit and 8-bit formats. |
| 03 3A 00 | RSD/0x03 | Address = 3, POLL_RSD_CRC, Lngth = 0 | Standard poll message to the PIM-400-485. NOTE: The ACP can continue polling for the rest of the PIN as shown, or the ACP can send a PIN Required APM_LOCK_CONTROL message after the RSD_STATUS_CARDDATA message is received if the LEDs keep flashing to indicate that more PIN digits are required for access. This depends on the operation of the ACP and the desired operation of the AD-400 that the user sees. There are security implications to consider such as whether to indicate the expected PIN length or incorrect PIN by sending an access denied (relock) command as soon as an incorrect digit is presented. It is less secure to give feedback to the user who presented the credential on every PIN digit because that makes it easier for an imposter to guess the PIN. |
| FF 31 07 01 01 00 11 00 04 02 | 0xFF | Address = 255, RSD_STATUS_CARDDATA, Lngth = 7, Byte 1 Bits 0 - 7: APM Address (0x00 to 0xFE excluding 0xAA) =>0x01 (1) Byte 2 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 3 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bit 2: APM Open Too Long;1=APM Open Too Long =>0 Bit 3: Tamper Active;1=Tamper Active =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 Byte 4 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300;1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBMStatus;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>0 Byte 5 Bits 0 - 7: More Events =>0x00 (0) Byte 6 Bits 0 - 7: Card data bit count =>0x04 (4) Byte 7 Bits 0 - 7: Card data read at APM =>0x02 (2) | Keypress 2 |
| 03 3A 00 | RSD/0x03 | Address = 3, POLL_RSD_CRC, Lngth = 0 | |
| FF 31 07 01 01 00 11 00 04 03 | 0xFF | Address = 255, RSD_STATUS_CARDDATA, Lngth = 7 Byte 1 Bits 0 - 7: APM Address (0x00 to 0xFE excluding 0xAA) =>0x01 (1) Byte 2 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 3 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bit 2: APM Open Too Long;1=APM Open Too Long =>0 Bit 3: Tamper Active;1=Tamper Active =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 Byte 4 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300;1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBM Status;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>0 Byte 5 Bits 0 - 7: More Events =>0x00 (0) Byte 6 Bits 0 - 7: Card data bit count =>0x04 (4) Byte 7 Bits 0 - 7: Card data read at APM =>0x03 (3) | Keypress 3 |
| 03 3A 00 | RSD/0x03 | Address = 3, POLL_RSD_CRC, Lngth = 0 | |
| FF 31 07 01 01 00 11 00 04 04 | 0xFF | Address = 255, RSD_STATUS_CARDDATA, Lngth = 7 Byte 1 Bits 0 - 7: APM Address (0x00 to 0xFE excluding 0xAA) =>0x01 (1) Byte 2 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 3 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bit 2: APM Open Too Long;1=APM Open Too Long =>0 Bit 3: Tamper Active;1=Tamper Active =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 Byte 4 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300;1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBM Status;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>0 Byte 5 Bits 0 - 7: More Events =>0x00 (0) Byte 6 Bits 0 - 7: Card data bit count =>0x04 (4) Byte 7 Bits 0 - 7: Card data read at APM =>0x04 (4) | Keypress 4 |
| Length = 2, 01 56 02 03 00 Length = 4, (Applicable only for WRI) 01 56 04 03 00 01 05 | APM/0x01 | Address = 1, APM_TIMED_UNLOCK, Lngth = 4 Byte 1 Bits 0 - 7: Number of seconds to unlock =>0x03 (3) Byte 2 Bits 0 - 7: Always 0 =>0x00 (0) Byte 3 Bit 0: Beeper pulsing control enable; 0=disabled; 1=enabled Bits 1-3: Reserved Bits 4-5: on interval (beeper on time) 00 = 250 ms 01 = 500 ms 10 = 1000 ms 11 = always on Bits 6-7: off interval (beeper off time) 00 = 250 ms 01 = 500 ms 10 = 1000 ms 11 = always on Byte 4 Bits 0-1: Beeper repeat configuration 00 = stop beeping 01 = beep for the configured number of beeps 10 = beep indefinitely 11 = reserved Bits 2-3: times to beep 00=1 time 01=2 times 10=3 times 11=4 times Bits 4-7: reserved | This is the APM command to unlock the door since the PIN (1234) matched the credential that was presented. Byte 3 and Byte 4 are optional bytes for beeper control. NOTE: The optional bytes are applicable only for WRI400. |
| FF 30 03 01 00 11 | 0xFF | Address = 255, APM_STATUS, Lngth = 3 Byte 1 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 2 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bits 2 - 3: Reserved; =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 Byte 3 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300;1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBM Status;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>0 | Door status shows locked because the message hasn’t necessarily been received and acknowledged by the AD-400 on the door through the wireless link. |
| 03 3A 00 | RSD/0x03 | Address = 3, POLL_RSD_CRC, Lngth = 0 | |
| FF 31 05 01 01 00 91 00 | 0xFF | Address = 255, RSD_STATUS_CHANGE, Lngth = 5 Byte 1 Bits 0 - 7: APM Address (0x00 to 0xFE excluding 0xAA) =>0x01 (1) Byte 2 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 3 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bit 2: APM Open Too Long;1=APM Open Too Long =>0 Bit 3: Tamper Active;1=Tamper Active =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 Byte 4 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300;1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBM Status;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>1 Byte 5 Bits 0 - 7: More Events =>0x00 (0) | Next RSD poll shows that the door is unlocked. This is positive confirmation that the door is in fact unlocked. |
| 03 3A 00 | RSD/0x03 | Address = 3, POLL_RSD_CRC, Lngth = 0 | |
| FF 31 05 01 01 00 11 00 | 0xFF | Address = 255, RSD_STATUS_CHANGE, Lngth = 5, Byte 1 Bits 0 - 7: APM Address (0x00 to 0xFE excluding 0xAA) =>0x01 (1) Byte 2 Bit 0: Reader Tamper;1=Tamper =>1 Bit 1: Low Battery;1=Low Battery =>0 Bit 2: Loss of RF Communications;1=RF loss =>0 Bit 3: RSD Tamper;1=RSD door is open =>0 Bit 4: Cache Status;1=has been used =>0 Bit 5: Motor Stall;1=Motor is Stalled =>0 Bit 6: Lock Clutch Position;1=door unlocked =>0 Bit 7: Deadbolt Position;1=bolt extended =>0 Byte 3 Bit 0: Request To Exit Active;1=REX Active =>0 Bit 1: APM forced;1=Forced APM =>0 Bit 2: APM Open Too Long;1=APM Open Too Long =>0 Bit 3: Tamper Active;1=Tamper Active =>0 Bit 4: Datalog Ready; =>0 Bit 5: Configuration Mode;1=In Configuration Mode =>0 Bit 6: RSD/APM is in Link Mode;1=Link mode Enabled =>0 Bit 7: AD-400 Battery Critical/AD-300 REN Active;1=True =>0 Byte 4 Bit 0: Trouble;1=APM has trouble =>1 Bit 1: AD-400 Low Li Battery/AD-300;1=Low Battery =>0 Bit 2: Door Position Switch;1=closed =>0 Bit 3: IPB;1=IPB Pressed =>0 Bit 4: Request To Exit Switch;1=inactive =>1 Bit 5: Wireless: Request to Enter Switch/VIP:LBM Status;1=Active/BoltExtended =>0 Bit 6: Key Override;1=key being used =>0 Bit 7: Lock State;1=unlocked, 0=locked =>0 Byte 5 Bits 0 - 7: More Events =>0x00 (0) | Most of the next POLL_RSD_CRC messages will be returned with RSD_STATUS_IDLE messages during the relock delay. Once the relock delay is done, this RSD_STATUS_CHANGE message will be sent instead. This is positive confirmation that the door is in fact locked again. |