RSI_Protocol_Specification

REVISION CONTROL RECORD
VER	DATE	DESCRIPTION OF CHANGE	AUTHOR
X0	02/22/2009	preliminary in house release for comments	Ron Taylor
X1	04/30/2009	Commands added: SET_APM_WOR_CONFIGURATION, GET_APM_WOR_CONFIGURATION, RSD_WOR_WAKEUP, SET_APM_UI_CONFIGURATION, REFLASH_RSD, REFLASH_APM, REFLASH_READER, SET_APM_DATABASE, GET_APM_DATABASE, SET_APM_KEYPAD_CONFIGURATION, GET_APM_KEYPAD_CONFIGURATION, SET_APM_MAGNETIC_CONFIGURATION, GET_APM_MAGNETIC_CONFIGURATION, SET_APM_PROXIMITY_CONFIGURATION, GET_APM_PROXIMITY_CONFIGURATION, SET_APM_SMARTCARD_CONFIGURATION, GET_APM_SMARTCARD_CONFIGURATION, SET_ENCRYPTION_CONFIGURATION, GET_ENCRYPTION_CONFIGURATION, SET_APM_IPB_CONFIGURATION, GET_APM_IPB_CONFIGURATION, GET_APM_BATTERY_STATUS, GET_APM_PEDIGREE, GET_APM_STATISTICS Responses added: APM_WOR_CONFIGURATION, APM_UI_CONFIGURATION, RSD_REFLASH_STATUS, APM_REFLASH_STATUS, READER_REFLASH_STATUS, APM_DATABASE_STATUS, APM_DATABASE, APM_KEYPAD_CONFIGURATION, APM_MAGNETIC_CONFIGURATION, APM_PROXIMITY_CONFIGURATION, APM_SMARTCARD_CONFIGURATION, APM_IPB_CONFIGURATIOIN, APM_BATTERY, APM_PEDIGREE, APM_STATISTICS	Ron Taylor
X2	07/16/2009	Changed byte 10 of SET_RSD_CONFIGURATION to accommodate Next Gen DCS, added SET_RSD_CHANNEL command & RSD_CHANNEL response, added “PIN Required” function to APM_LOCK_CONTROL command,	Ron Taylor
X2.1	09/21/2009	Added notation for new commands (*) and modified commands (+) for customers who are familiar with WA1G protocol	Todd Eberwine
3.0	09/29/2009	Changed page format to Allegion template Moved revision history to front Removed title page Re-formatted table of contents Re-formatted table captions Added AD OEM codes to OEM_CODE response Modified type & sub command data in RSD_CHANNEL response Added GET_RSD_FULL_CONFIGURATION command Added PIM_FULL_CONFIGURATION response Added SET_NEXT_GEN_APM_CONFIGURATION command Added SET_NEXT_GEN_APM_CONFIGURATION response Added GET_NEXT_GEN_APM_CONFIGURATION command Added NEXT_GEN_APM_CONFIGURATION response Changed RSD_STATUS_CARDDATA minimum Length from 1 to 7 Changed GET_APM_BATTERY_STATUS command Changed APM_BATTERY_STATUS response Deleted (these commands were concatenated into the NEXT_GEN_APM_CONFIGURATION commands): SET_APM_UI_CONFIGURATION, GET_APM_UI_CONFIGURATION, SET_APM_KEYPAD_CONFIGURATION, GET_APM_KEYPAD_CONFIGURATION, SET_APM_MAGNETIC_CONFIGURATION, GET_APM_MAGNETIC_CONFIGURATION, SET_APM_PROXIMITY_CONFIGURATION, GET_APM_PROXIMITY_CONFIGURATION, SET_APM_SMARTCARD_CONFIGURATION, GET_APM_SMARTCARD_CONFIGURATION, SET_APM_IPB_CONFIGURATION, GET_APM_IPB_CONFIGURATION commands Deleted (these responses were concatenated into the NEXT_GEN_APM_CONFIGURATION responses): APM_UI_CONFIGURATION, APM_KEYPAD_CONFIGURATION, APM_MAGNETIC_CONFIGURATION, APM_PROXIMITY_CONFIGURATION, APM_SMARTCARD_CONFIGURATION, APM_IPB_CONFIGURATION responses	Ron Taylor
3.1	10/10/2009	Deleted SET_APM_WOR_CONFIGURATION, GET_APM_WOR_CONFIGURATION, RSD_WOR_WAKEUP commands Deleted APM_WOR_CONFIGURATION response Added SET_RSD_WOR, SET_WOR_WAKEUP, GET_WOR_WAKEUP_STATUS command Added RSD_WOR, WOR_WAKEUP, WOR_WAKEUP_STATUS response Added WOR byte to RSD_FULL_CONFIGURATION response Added TBD date on GET_APM_STATISTICS, APM_STATISTICS, REFLASH_APM, REFLASH_READER, RSD_REFLASH, APM_REFLASH_STATUS, READER_REFLASH_STATUS, RSD_REFLASH_STATUS, SET_ENCRYPTION_CONFIGURATION, GET_ENCRYPTION_CONFIGURATION, GET_APM_PEDIGREE, APM_PEDIGREE commands/responses Deleted SET_APM_DATABASE, GET_APM_DATABASE, APM_DATABSE_STATUS, APM_DATABASE commands/responses	Ron Taylor
3.2	10/19/2009	Added to note for APM_LOCK_CONTROL: with the data byte = 1 Added optional 2nd and 3rd data bytes to APM_LOCK_CONTROL Corrected error in deadbolt position status in APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses Added request to enter status bit to APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses Added latch bolt monitor status bit to APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses Corrected table reference in SET_NEXT_GEN_APM_CONFIGURATION command Added WPR400 & WSM400 to OEM code table Added/changed Request to Enter, IPB online configuration, IPB offline configuration, IPB long button press, ACP communications timeout, WOR timeout, Beeper enable/disable, Smartcard enable/disable, maximum cache entries, battery failure mode in NEXT_GEN_APM_CONFIGURATION structure table	Ron Taylor
3.3	10/22/2009	Changed WOR Timeout to “0-10 (default=10, disabled=0)” in Next Generation Lock APM/Reader Configuration Structure Table, byte 13 Removed Beeper on/off modes in bits 1 & 2 in Next Generation Lock APM/Reader Configuration Structure Table, byte 27 Removed IPB beeper control in bit 7 in APM_LOCK_CONTROL Command byte 7 Added RSD_ENCRYPTION_CONFIGURATION response Fixed cross reference errors Removed TBD date on GET_APM_STATISTICS, APM_STATISTICS, REFLASH_APM, REFLASH_READER, RSD_REFLASH, APM_REFLASH_STATUS, READER_REFLASH_STATUS, RSD_REFLASH_STATUS, SET_ENCRYPTION_CONFIGURATION, GET_ENCRYPTION_CONFIGURATION, GET_APM_PEDIGREE, APM_PEDIGREE commands/responses	Ron Taylor
3.4	11/09/2009	Bit reassignment in APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses	Ron Taylor
3.5	01/08/2010	APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses: edited critical battery/REN function/comments, changed comments on Trouble bit, changed comments on Cache Status bit, added AD-300 Data Type to Low Lithium Battery bit RSD_FULL_CONFIGURATION response: correct Length byte to 0CH NEXT_GEN_APM_CONFIGURATION response: updated Keypad Output Format descriptions, updated Number of Keys to Buffer descriptions, updated PIN-Required LED Mode descriptions GET_WOR_WAKEUP_STATUS command: corrected byte designations for Frame Check Sequence Added GET_FIRMWARE_VERSION command & FIRMWARE_VERSION response (previously undocumented 1G command/response) Added GET_FULL_FIRMWARE_VERSION command & FULL_FIRMWARE_VERSION response RSD_STATUS_CARDDATA response: changed bit range to 4-255 (data section byte6)	Ron Taylor
3.6	04/06/2010	Version number only change for internal Allegion record keeping	Paul Avgerinos
3.7	04/26/2010	Version number only change for internal Allegion record keeping	Paul Avgerinos
3.8	12/15/2010	Modified Address paragraph regarding use of broadcast packets Modified Type paragraph regarding use of 2 byte length field Modified Data paragraph for 65535 maximum byte of data Modified Frame Check Sequence paragraphs removing recommendations Modified Character Timeout paragraph removing baud rate independence sentence Modified sentence in Commands for Addressing APM section Modified APM_LOCK_CONTROL command note for “timed unlock”, added WRI400 for aux relay Modified APM_TIMED_UNLOCK command note for “timed unlock” Modified SET_APM_CONFIGURATION command note for better explanation of the Configuration Mode bit, Card Format does not apply to AD series, Modified SET_NEXT_GEN_APM_CONFIGURATION command note for better explanation of the Configuration Mode bit Modified SET_RSD_CONFIGURATION command notes to indicate which fields apply to PIM400-485 and/or AD-300 Added SET_LINK command description Re-formatted command/response table so that only section levels 1, 2, & 3 are included in the TOC Added WAPM n type “05 = AD-401” in FIRMWARE_VERSION and FULL_FIRMWARE_VERSION responses Changed OEM_CODE response back to 1G WA version for legacy compatibility Added the following commands: GET_AD_APM_OEM_CODE GET_AD_RSD_OEM_CODE GET_SERIAL_NUMBER GET_MANUFACTURE_DATE GET_HARDWARE_VERSION GET_PIM_TYPE Added the following responses: AD_APM_OEM_CODE AD_RSD_OEM_CODE SERIAL_NUMBER MANUFACTURE_DATE HARDWARE_VERSION PIM_TYPE	Ron Taylor
3.9	04/21/2011	Changed AD_APM_OEM_CODE response: Removed (AD300CY, AD300MS, AD300MD, AD300EX, AD301CY, AD301MS, AD FIPS-201, AD301MD, AD301EX, AD400CY, AD400MS, AD400MD, AD400EX, AD401CY, AD401MS, AD401MD, AD401EX); Added (AD300 & AD400); Changed type from 47H to 36H; Changed AD_RSD_OEM_CODE response: Removed (AD300CY, AD300MS, AD300MD, AD300EX, AD301CY, AD301MS, AD301MD, AD301EX); Added (AD300); Changed type from 47H to 36H; Changed SET_WOR_WAKEUP command: byte7, bit0 is the 9th lock on the PIM not the 8th; Changed SET_RSD_CONFIGURATION command: byte10, bit3 & bit 4 set to reserved; Edited the Address paragraph: added RSD Address Space and APM Address Space sections; Updated APM_LOCK_CONTROL IPB/Schlage blink extensions; Changed SET_NEXT_GEN_APM_CONFIGURATION data to add “Forced Heartbeat after WoR event”; Changed SET_NEXT_GEN_APM_CONFIGURATION Response to correct values (Type from 47H to 36H; Subcommand from 05H to 84H); Updated SET/GET_NEXT_GEN_APM_CONFIGURATION to include keypad formats 11 (ASCII) and 12 (32-bit Wiegand); Corrected Table reference numbers; Added “clear cache entries” switch to byte 9, bit 0 of NEXT_GEN_APM_CONFIGURATION (for SET only); Added latch for IPB and ATK into APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA; Added APM Address to AD_APM_OEM_CODE; Added commands for Serial Number / Manufacture Date and Hardware Versions for APM and RSD; Removed reference to RSI hand-reader commands (same as xxx);	Ron Taylor / Todd Eberwine / Joe Baumgarte
3.91	10/25/2011	Added Request to Enter Level to NEXT_GEN_APM_CONFIGURATION Added note for AD-300 radio module serial number being N/A. Added type 06 and 07 in FIRMWARE_VERSION for the WRI401 and WPR401 respectively. Added Brazil updates for: SET_RSD_CONFIGURATION, SET_RSD_CHANNEL, RSD_CONFIGURATION, RSD_FULL_CONFIGURATION, RSD_CHANNEL, FIRMWARE_VERSION, FULL_FIRMWARE_VERSION, AD_RSD_OEM_CODE, and AD_APM_OEM_CODE Added “0 = no state change” for APM_LOCK_CONTROL command in order to send UI with no lock command attached.Added note to APM_LOCK_CONTROL to clarify Schlage and IPB LED pattern disable message requirements	J. Baumgarte B. Allen
3.92	12/12/2011	Removed “0 = no state change” for APM_LOCK_CONTROL Changed GET_NEXT_GEN_APM_CONFIGURATION to RSD Address instead of APM Address Changed SET_NEXT_GEN_APM_CONFIGURATION RESPONSE, RSD_WOR, WOR_WAKEUP, WOR_WAKEUP STATUS & APM_BATTERY_STATUS Address field to FFH. Cleaned up Address field naming to specify RSD Address for FFH Changed APM_CONFIGURATION and NEXT_GEN_APM_CONFIGURATION bits to reflect AD400 implementation.	B. Allen
3.93	02/08/2012	Corrected the Fail Safe Configuration Values in byte16 of Next Generation Lock APM/Reader Configuration Structure to match the firmware behavior Updated with PIV card format support Updated with Partner ID support Updated Next Generation Lock APM/Reader Configuration Structure with WRI Reader Configuration Structure Added a note to indicate that addresses 0xAA and 0xFF are reserved and not to be used as RSD or APM Address.	Arun M Kamath
3.94	03/20/2012	APM_LOCK_CONTROL command updated with NO STATE CHANGE option	Lakshmi S
3.95	03/23/2012	APM_LOCK_CONTROL command updated for WRI beeper configuration NEXT_GEN_APM_CONFIGURATION updated to add iClass format configuration and a bit to indicate AD reader configuration done by presenting configuration card Reader format configuration bytes are marked as reserved in the WRI reader configuration table	Lakshmi S
3.96	05/31/2012	Corrected the Prox GE reader configuration details	Lakshmi S
3.97	06/12/2012	Update spec to catchup with existing lock functionality. Change info for Next Generation Lock APM/Reader Configuration Structure:	John Wolfe
3.98	06/27/2012	APM_LOCK_CONTROL message specification updated for WRI beeper frequency (Changed 100msec to 200msec)	Lakshmi S
3.99	01/20/2013 01/24/2013	Format changes only. Added Type/SubCmd to Packet Names and also added hyperlinks to Table 1-2 for easy/quick referencing. Added back a header which was accidently removed.	John Wolfe
4.00	02/12/2013	Changed max Backlight Timeout from 31 to 15 sec in Next Generation Lock APM to reflect actual limit of AD locks. (IR TTP 5006)	John Wolfe
4.01	07/23/2013	Added the new RSI command GET_READER_INFO and the response READER_INFORMATION. (IR TTP 4979)	Ancy Joseph
4.02	12/10/2013	Added all Over the Network Reprogramming (ONR) related commands and responses. This includes changes to the SET_RSD_CONFIGURATION command to enable/disable extended status reporting. Added new extended status responses (APM_STATUS_EXTENDED, RSD_STATUS_IDLE_EXTENDED, RSD_STATUS_CHANGE_EXTENDED, RSD_STATUS_CHANGE_CARDDATA_EXTENDED) (IR TTP 4420)	Josh Piron
4.03	01/03/2014	Added a note in the “APM_LOCK_CONTROL” command to always send the “reserved” bits as zero. (IR TTP 5162)	Shivakumar Sillin
4.04	01/06/2014	Modifications to ONR related commands based on review feedback (IR TTP4420)	Josh Piron
4.05	01/15/2014	Re-branding to Allegion	Ron Taylor
4.06	06/20/2014	Adding details to support MTK2 reader type	Josh Piron
4.07	06/27/2014	1. Addition of new command/response for Diagnostics Mode Configuration for the PIM-RSI and PIM-SBB. This message will allow the ACP, to enable or disable the following - Credential data from being displayed on the Diagnostics Mode screen on the SUS. - Momentary access on the lock via PIM, using the Diagnostics Mode. Command: SET_RSD_DIAGNOSTICS_CONFIGURATION Response: RSD_DIAGNOSTICS_CONFIGURATION 2. Addition of the “FDR Information” and “WOR Lock/Unlock Status” bits for the PIM product in the following response messages: - APM_STATUS_EXTENDED - RSD_STATUS_CHANGE_EXTENDED - RSD_STATUS_CARDDATA_EXTENDED 3. Corrected the Comm Loss failure byte values to 01=fail locked and 10=fail unlocked, in the APM_CONFIGURATION (32H) response	Sanjay Hegde
4.08	09/07/2014	Added Beeper control for APM_TIMED_UNLOCK command, only for WRI400.	Sandeep M
4.09	09/14/2014	Added Secure Communication (Encryption) related commands and responses	Ankit Patel
4.10	10/01/2014	Adding proposals for adoption of ENGAGE product lines. Updated commands with new options or clarifications made:	Zeb GrandPre
4.11	02/04/2015	Updated following commands for FIPS product types.	Pradyuman A
4.12	02/10/2015	Further clarifying differences between AD & ENGAGE products:	Joe Baumgarte / Zeb GrandPre
4.13	03/05/2015	Removed draft notation, 4.13 is a released version	R. Taylor
4.14	06/04/2015	Adding new response code definition to ONR_STATUS response	Josh Piron
4.15	06/11/2015	Modified APM_TIMED_UNLOCK acceptable range from 1 to 255 seconds, removing 0 as an acceptable time to unlock.	Z. Grandpre
4.16	09/14/2015	Update the reference within the iClass formats byte of the Next Generation Lock APM/Reader Configuration Structure	Josh Piron
4.17	01/07/2016	Removed NDE specific language and added Schlage Control & LE APM types	Z. GrandPre
4.18	01/26/2016	Updated status code definitions in ONR_STATUS response	Josh Piron
4.19	02/16/2016	Changed max Backlight Timeout from 15 to 31 sec in Next Generation Lock APM to reflect actual limit of AD locks.	Dorothi Borgohain
4.20	03/07/2016	Updated Trouble bit in APM_STATUS/RSD_STATUS to include Magnetic tamper if supported by APM linked to ENGAGE Gateway.	Z. GrandPre
4.21	03/15/2016	Added APM_PIV_GEN_AUTH_CHALLENGE(78H) message	Shaun Thaker
4.22	03/23/2016	Modify APM_PIV_GEN_AUTH_ACK/ERR message type to be 0x7A	Shaun Thaker
4.23	03/31/2016	Updated “START_FW_DOWNLOAD (15H/00H)” command to provide ONR support to Si(K)2 readers.	Dorothi Borgohain
4.24	03/31/2016	Updated “Next Generation Lock APM/Reader Configuration Structure” to support “Mifare Plus credentials”.	Pavithra S A
4.25	06/07/2016	Added clarification on usage of ABORT_LINK for ENGAGE Gateway	T. Anfield
4.26	06/10/2016	Updated “Next Generation Lock APM/Reader Configuration Structure” to support FIPS201-2 reader compatibility support.	Sankar nag
4.27	10/24/2016	Added the 3 models of LE (LEMS, LEMB, LEMD) as responses to AD_APM_OEM_CODE (36H/8BH)	J. Everson
4.28	11/04/2016	Added Note “DCS selection takes priority over the single channel selection” in “Set RSD Channel” command and “RSD Channel” response.	Pavithra S A
4.29	11/11/2016	Updated ONR FW update status for GWE in following response messages:	Jane Liu
4.30	12/09/2016	Added notes to WRI400 Reader Configuration Data table to clarify the location of the bytes in the NEXT_GEN_APM_CONFIG message	Josh Piron
4.31	01/25/2017	Added Identifiers for ENGAGE RMRU exit device product. Note that 2 versions are included in the APM_OEM_CODE response; RM – Remote Monitor and RU – Remote Monitor	Dan Pfunder
4.32	05/16/2017	Clarification of RMRU use of Trouble bit and Locked, Clutch bits.	Dan Pfunder
4.33	06/29/2017	Added new ONR Command and Response	Jane Liu Tripp Holt
4.34	06/30/2017	Accepted All Changes after the publication for ENGAGE 5.2 Release	Tripp Holt
4.35	09/01/2017	Added FIPS201-2 Authentication Enable/Disable bit to NEXT_GEN_APM_CONFIGURATION	Alex Lammers
4.36	09/05/2017	Updated Allegionization and corrected minor formatting discrepancies for consistency, added hyperlinks to TOC, moved APM_PIV_GEN_AUTH_ACK/ERR from Commands for Addressing APM devices to Response Format section, added APM_PIV_GEN_AUTH_CHALLENGE, APM_PIV_GEN_AUTH_ACK/ERROR, and APM_PIV_GEN_AUTH_RESPONSE to the Protocol Commands, Responses, & Datalogs table	Ron Taylor
4.37	10/27/2017	Updated the message types for the following FIPS201-2 messages, to reflect two byte length field support.	Sanjay Hegde Alex Lammers
4.38	11/28/2017	Merged Felica CSN with iClass CSN in “Next Generation Lock APM/Reader Configuration Structure”. Added comments to iClass/Felica related bits in “Next Generation Lock APM/Reader Configuration Structure” to better represent Reader behavior	Vamsee Vardhan
4.39	02/19/2018	Updated FIPS 201-2 Error List in “APM_PIV_GEN_AUTH_ACK/ERR” message. Also renamed the NEXT_GEN_APM_CONFIG Byte 14 bit 0 as “FIPS 201-2 Capable”.	Pavithra S A
4.40	04/23/2018	Updated to call out the status bits applicable to the WRI400 only in the following messages:	Deepak Srivastava
		APM_STATUS,
		APM_STATUS_EXTENDED,
		RSD_STATUS_CHANGE,
		RSD_STATUS_CHANGE_EXTENDED,
		RSD_STATUS_CARDDATA,
		RSD_STATUS_CARDDATA_EXTENDED
4.41	07/26/2018	-Corrected sub command for LARGE_FW_FILE_BLOCK / LARGE_FW_FILE_BLOCK_RESP	Josh Piron
4.42	08/28/2018	-Added “0x63 = Error: Lock Bitmap includes unlinked or unknown edge device(s) (Gateway Only)” Response Code to the ABORT_FW_DONWLOAD_RESP (16H/03H) response	Ron Taylor
4.43	9/26/2018	-Removing RMRU Trouble Bit sources that have no specific fault bit.	Rafael Verde
4.44	1/14/2019	-Added configuration bits for BLE Credential Enable, BLE Credential Range, BLE Performance, and Credential Read LED to NEXT_GEN_APM_CONFIGURATION to support 1.1 devices	Scott Fieldhouse
4.45	03/21/2019	-Added configuration bit for Card Read Reties to NEXT_GEN_APM_CONFIGURATION	Bachcha Babu

Byte25 - Add of PIV Format 15
Byte24 - Add bit 7 for PIV 200bit
Byte24 – Change bit 3 to state for 75bit

Update spec per changes for MiK (iClassSE capable) Reader Support. Change info for Next Generation Lock APM/Reader Configuration Structure:

Byte24 – Change bit 4 to be iClassSE. Was assigned for ISOX Secure (15693), but was never used.
GET_AD_APM_PARTNER_ID (47H/0DH)
SET_RSD_CONFIGURATION (77H)
(*) SET_RSD_CHANNEL (02H/01H)
SET_RSD_WOR (47H/07H)
GET_AD_RSD_PARTNER_ID (47H/0EH)
START_FW_DOWNLOAD (15H/00H)
START_FW_REFLASH (15H/04H)
APM_STATUS (30H)
APM_STATUS_EXTENDED (33H)
RSD_STATUS_CHANGE (31H)
RSD_STATUS_CHANGE_EXTENDED (34H)
RSD_STATUS_CARDDATA (31H)
RSD_STATUS_CARDDATA_EXTENDED (34H)
RSD_CONFIGURATION (53H)
RSD_FULL_CONFIGURATION (36H/82H)
RSD_CHANNEL (36H/81H)
RSD_WOR (36H/87H)
FIRMWARE_VERSION (41H)
FULL_FIRMWARE_VERSION (36H/8AH)
APM_SERIAL_NUMBERS (5AH/81H)
APM_MANUFACTURE_DATES (5AH/82H)
APM_HARDWARE_VERSIONS (5AH/83H)
RSD_SERIAL_NUMBERS (5BH/81H)
RSD_MANUFACTURE_DATES (5BH/82H)
RSD_HARDWARE_VERSIONS (5BH/83H)
AD_RSD_OEM_CODE (36H/8CH)
AD_RSD_OEM_CODE (36H/8CH)
AD_APM_OEM_CODE (36H/8BH)
AD_RSD_PARTNER_ID (36H/8EH)
AD_APM_PARTNER_ID (36H/8DH)
READER_INFORMATION (36H/8FH)
RSD_CONFIGURATION
RSD_FULL_CONFIGURATION
FULL_FIRMWARE_VERSION
FIRMWARE_VERSION
AD_APM_OEM_CODE
AD_RSD_OEM_CODE

Added note in section 1.9 for Data log format for AD devices

Added notes to APM_TIMED_UNLOCK and APM_TIMED_UNLOCK
Added notes to APM configuration tables, Table 1-12 and Table 1-80
Add column indicating which RSI commands apply to the ENGAGE Gateway’s commands.
Added definition of gateway
Modified the definition of firmware commands to indicate that gateways only support
Modified note for ENGAGE products on SET_RSD_WOR to specifically state 5 as the read-only value.
For ENGAGE Gateway, a SET_LINK command issued against an existing link will delete the original link right away.
If APM_LOCK_CONTROL contains a lock state change command and custom LED blink patterns, ENGAGE locks will first flash the default pattern associated with the lock state change and then the custom LED blink pattern.
Update the APM Configuration Data Structure to include missing items in byte 9
Updated next gen configuration block to indicate that the IPB configurations for local lock control also apply to the deadbolt
Added Custom Key status bit in Next Generation Lock APM byte18 bit 6
Added APM_PIV_GEN_AUTH_ACK/ERR(80H) message
Added APM_PIV_GEN_AUTH_RESPONSE(79H)
Added AD-302 and AD-402 in START_FW_DOWNLOAD message
Added AD-302 in RSD_CONFIGURATION message
Added “AD302” in AD_RSD_OEM_CODE(36H/8CH) message
Added “AD302” and “AD402” in AD_APM_OEM_CODE (36H/8BH) message
Added AD-402 in FIRMWARE_VERSION(41H) message
Added AD-402 in FULL_FIRMWARE_VERSION (36H/8AH) message
Added AD-302 in RSD_CONFIGURATION (53H) message
Added AD-302 in RSD_FULL_CONFIGURATION (36H/82H) message
Added SiK2 and Si2 reader types to “READER_INFORMATION (36H/8FH)” command
Added note on RSD Tamper Bit being set for BLE connection to Gateway
Also updated command Headings with proper types for “Set RSD Channel” and “Get WOR Wake-up status”.

APM_STATUS_EXTENDED, RSD_STATUS_CHANGE_EXTENDED,

RSD_STATUS_CHANGE_CARDDATA_EXTENDED)

Added RMRU to the VIP LBM (latch bold monitor) response definitions

LARGE_FW_FILE_BLOCK

LARGE_FW_FILE_BLOCK_RESP

Added new status and error codes in the ONR Command Responses:

START_FW_DOWNLOAD_RESP

FW_FILE_BLOCK

END_FW_DOWNLOAD_RESP

ABORT_FW_DOWNLOAD_RESP

START_FW_REFLASH_RESP

ONR_STATUS

Added lock bitmap clarification for the ENGAGE™ Gateway in the following ONR Commands:

START_FW_DOWNLOAD

ABORT_FW_DOWNLOAD

START_FW_REFLASH

Revoked updates from version 4.29 of this document: ONR FW update status for GWE in following response messages:

APM_STATUS_EXTENDED, RSD_STATUS_CHANGE_EXTENDED,

RSD_STATUS_CHANGE_CARDDATA_EXTENDED)

APM_PIV_GEN_AUTH_CHALLENGE

APM_PIV_GEN_AUTH_RESPONSE

Removed Total Length and Offset Length from PIV challenge and response messages

-Added large fw file block status ID to ONR_STATUS_RESPONSE

-Made minor formatting improvements

Sections: 1.81, 1.82, 1.86, 1.87, and 1.88

-Added 1.1 device types to START_FW_DOWNLOAD, AD_APM_OEM_CODE, and FIRMWARE_VERSION

-Added description for a byte used internally in Reader Firmware to NEXT_GEN_APM_CONFIGURATION

RS-485 PROTOCOL

Overview

This section describes the RS-485 serial protocol that is used between an Allegion AD-series PIM400/PIB300 or an AD-series online wired lock to an Access Control Panel (ACP).

Definitions

Acronym	Description
PIM400	Panel Interface Module (Wireless)
PIB300	Panel Interface Board (Wired)
APM	Access Point Module, either wireless or wired
WAPM	Wireless Access Point Module
RSD	RS-485 Device: either a PIM400-485 (online wireless) or an AD-300 (online wired)
ACP	Access Control Panel
FCS	Frame Check Sequence
TBD	To Be Determined
GWE	ENGAGE Gateway

Communication Protocol

Character Format

1 start bit, 8 data bits, no parity, 1 stop bit

Baud Rate

The baud rate is 9600 baud.

Packet Format

This section describes the communication packet which is the smallest unit an RSD can use to communicate. There are also command packets and response packets, and they share the same format as described herein. Table 1‑1 describes the Field and gives a Description of the format for a communication packet.

Table 1-1: Communication Packet Format

Field	Description
Start-of-Frame	0AH indicates the start of a packet
Address	the address to which the packet is being sent
Type	the command or response type
Length	the number of bytes in the data field
Data	the data being sent – may be 0 bytes
Frame Check Sequence	CRC or checksum

Start of Frame

Every communication packet begins with the byte 0x0A.

Address space

Following the Start-of-Frame character is the address of the device to which the packet is directed. The address field is one byte long.

There are two independent RS-485 address spaces defined in this protocol:

RSD address space, and
APM address space

Each address space ranges from 0x00 to 0xFE.

Addresses 0xFF and 0xAA are special and shall not be used to address an RSD or APM. More details are given below.

ACP Address Space

The Access Control Panel (ACP) has the default address of 0xFF. This address is also referred to as “Network Master Address” in subsequent sections below.

All the RS485 slave devices (RSD, APM) shall use the address 0xFF for all response packets that originate at the APM/RSD.

It is strongly recommended that the ACP NOT transmit any RSD or APM message with the address 0xFF on the RS-485 bus. Both the APM and RSD ignore messages received with the address 0xFF.

RSD Address Space

Each RSD has a unique address on the RS485 bus. This means each RSD shall have a different address from every other RSD on the same physical RS485 bus.

Valid RSD addresses are

0x00 to 0xA9
0xAB to 0xFE

Two addresses shall be treated as “special addresses”. The Address 0xFF is reserved for the network master, and address 0xAA is reserved for a specific purpose of RSD broadcast. RSD broadcast is supported for a limited set of commands and is used sparingly. [Example: The command SET_RSD_WOR may use the RSD address 0xAA to set the same Wake up interval for all the PIM400 devices on the network].

RSD broadcast packets should be used sparingly because there is no response to them, so there is no way to be sure that every RSD on the network properly received the packet.

When an RSD receives a packet with address 0xAA, the command is processed internally within the RSD. The RSD does not communicate with all the APMs connected to it.

Example:

Consider the ACP sends out a command with address 0xAA
The PIM400-485 (which is an RSD) device receives the packet
The PIM400-485 does not send this command to all the AD400 devices connected to it
All AD400 devices (APMs) do not receive an RS485 message with an address of 0xAA

NOTE: For the remainder of this document, whenever the RSD Address is mentioned, it should be interpreted as follows:

Each RSD has a unique address
The address range is from 0x00 to 0xFE
Addresses 0xFF and 0xAA are invalid addresses for an RSD

APM Address Space

Each APM has an address. APM addresses must be unique within the APM address space: Each APM must have a different address from every other APM on the same physical link.

Valid RSD addresses are:

0x00 to 0xA9
0xAB to 0xFE

NOTE: For the remainder of this document, whenever the APM Address is mentioned, it should be interpreted as follows:

Each APM has a unique address
The address range is from 0x00 to 0xFE
Addresses 0xFF and 0xAA are invalid addresses for an APM

Type

Every command or response packet has a unique type. This indicates which command or response is being sent. (Some responses may have the same type as some commands. Because any station always knows whether it is sending or receiving, there is no ambiguity.)

The byte type serves a dual purpose. The lower 7 bits contain the packet type, and bit 7, the MSB, is used as a flag indicating whether the next field, the length field, contains one byte or two bytes.

For the AD-series commands and responses, data fields are currently less than 256 bytes and therefore typically use only a one-byte length field and the MSB of the byte type must be set to zero. In the future, if data fields exceed 255 bytes, failing to set the MSB of the byte type when a two-byte length is being sent is a common cause of communications errors in custom applications. Be sure to set the MSB of the type field appropriately.

Length

This field indicates the number of bytes in the Data field. The field may be one or two bytes long, as needed. Some packets have no data and the length field is set to zero.

NOTE: Although packets with 256 bytes of data or more require a two-byte length, packets with 255 bytes or less do not require a one-byte length. Applications may send two-byte lengths with every packet. However, the RSD always selects the shortest possible length field when it sends packets, so an application program must be prepared to receive both one-byte and two-byte lengths.

Data

This is a series of bytes, the number of which is specified in the length field, described above. Some packets contain no data, while others may contain, theoretically, up to 65535 bytes of data.

Frame Check Sequence

The Frame Check Sequence (FCS) is a one-byte checksum or two-byte CRC. This is used to validate the contents of the packet. It is strongly recommended that CRC be used rather than checksum.

The FCS, whether CRC or checksum, is calculated beginning with the address field and ending with the last byte of the data field, or the last byte of the length field if there is no data in the data field.

CRC

The CRC method of frame checking is the more reliable error detection technique. It is approximately 256 times more likely to detect a communications error than the 8-bit checksum but does require more processing time and additional code necessary to implement it.

The CRC used is the CRC-CCITT specification. The Appendix provides a C function which can generate the table for performing CRC calculations. It is strongly recommended that this table be used.

Checksum

The checksum that is sent with a packet is zero minus the 8-bit sum of all the data from the address field to the last byte before the FCS field. To validate a received packet, the receiver should calculate the 8-bit sum of the received packet, then add the result to the checksum in the received packet. The sum should be zero.

NOTE: The negative of a binary number is not the same as the inverse. The negative of 00000001 is 11111111, but the inverse of 00000001 is 11111110. The correct value to send with a packet is the negative of the sum of the packet bytes.

Timeouts

Character Timeout

Once an RSD receives the address byte of a packet, all the remaining bytes of the packet must follow with no more than a 100ms delay between them. If more than 100ms elapses between characters, the RSD reverts to the state where it is waiting for the Start-of-Frame (SOF) byte.

NOTE: The actual character timeout value is a random time from 100ms to 200ms. Times longer than 200ms are guaranteed to cause a timeout; those less than 100ms are guaranteed not to, but those between 100ms and 200ms may or may not, depending on internal software delays in the RSD. To be safe, ensure that no more than 100ms elapses between characters. In this material, the character timeout is always referred to as 100ms, with it understood that there is some variability in the actual time.

Packet Timeout

There is no time restriction in the RSD on the total amount of time taken to receive a packet other than that implied by the character timeout. The total time to receive a packet depends on the baud rate, and it is recommended that applications not qualify incoming packets by the total receive time.

Packet Start Timeout

The units receive the Start-of-Frame and address bytes differently than the data bytes. There is no timeout limit between the SOF character and the address byte. The timeout testing begins with the length byte, which must be received within 100ms after the address byte is received.

Protocol Commands, Responses, and Datalogs

This section details the commands, responses, and datalogs that are implemented in an RS-485 UNIT.

This protocol is a multi-drop, polling protocol where the ACP is the master and the RS-485 UNITs are the slaves. As master, the ACP initiates all communications using addressed commands and then waits for a response from the addressed RS-485 UNIT.

This protocol provides for polling by access point.

In larger systems where there may be up to 254 RS-485 UNITs on an RS-485 bus polling by RS-485 UNITs would result in a long round-trip polling times. To reduce the round trip polling time, the ability to poll by PIM400 is included.

Table 1-2: ACP Commands and RSD Responses

ACP Command	RSD Response	How used	Applies to GWE
POLL_APM_CRC (44h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	APM polling with CRC	X
POLL_APM_CHECKSUM (3Bh)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	APM polling with CHECKSUM	X
POLL_RSD_CRC (3Ah)	RSD_STATUS_IDLE (31h) or RSD_STATUS_IDLE_EXTENDED (34h)	RSD polling with CRC	X
	RSD_STATUS_CHANGE (31h) or RSD_STATUS_CHANGE_EXTENDED (34h)
	RSD_STATUS_CARDDATA (31h) or RSD_STATUS_CARDDATA_EXTENDED (34h)
	APM_PIV_GEN_AUTH_RESPONSE (79H) (AD only) APM_PIV_GEN_AUTH_ACK/ERR (7AH) (AD only)
POLL_RSD_CHECKSUM (74h)	RSD_STATUS_IDLE (31h) or RSD_STATUS_IDLE_EXTENDED (34h)	RSD polling with CHECKSUM	X
	RSD_STATUS_CHANGE (31h) or RSD_STATUS_CHANGE_EXTENDED (34h)
	RSD_STATUS_CARDDATA (31h) or RSD_STATUS_CARDDATA_EXTENDED (34h)
	APM_PIV_GEN_AUTH_RESPONSE (79H) (AD only) APM_PIV_GEN_AUTH_ACK/ERR (7AH) (AD only)
GET_APM_DATALOG (4Dh)	NEXT_DATALOG (38h)	send event details: card data, door alarms, request to exit, & troubles
GET_PREVIOUS_APM_DATALOG (6Dh)	NEXT_DATALOG (38h)	repeat sending event details in case of receiving error
APM_LOCK_CONTROL (4Fh)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	control the lock/strike state: locked, momentary unlock, extended unlock	X
APM_TIMED_UNLOCK (56h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	momentary unlock specifying the unlock time (available in version 2 hw only)	X
ABORT_LINK (32h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	abort a current linking mode	X
SET_LINK (45h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	initiate a linking mode	X
SET_POLL (49h)	RSD_STATUS_IDLE (31h) or RSD_STATUS_IDLE_EXTENDED (34h)	sets APM addresses to which the RSD will respond	X
GET_OEM_CODE (6Fh)	OEM_CODE (4Fh)	to determine if the device is a RSD
(*) GET_AD_RSD_OEM_CODE (47h/0Ch)	(*) AD_RSD_OEM_CODE (36h/8Ch)	to determine the AD RSD type	X
(*) GET_AD_APM_OEM_CODE (47h/0Bh)	(*) AD_APM_OEM_CODE (36h/8Bh)	to determine the AD APM type	X
GET_APM/RSD_ASSOCIATION (65h)	APM/RSD_STATUS (39h)	determine what RSD a APM is in	X
GET_RSD_INFORMATION (3Ch)	RSD_CONFIGURATION) (53h)	get 1G RSD configuration information	X
(*) GET_RSD_FULL_CONFIGURATION (47h/02h)	RSD_FULL_CONFIGURATION (36h/82h)	get AD-series RSD configuration information	X
(*) SET_RSD_CONFIGURATION (77h)	RSD_CONFIGURATION (53h)	to send configuration data to a 1G RSD	X
(*) SET_RSD_CHANNEL (02h/01h)	RSD_CHANNEL (36h/81h)	to send RF channel data to a RSD
GET_APM_CONFIGURATION (38h)	APM_CONFIGURATION (32h)	to retrieve configuration data from a 1G APM	X
SET_APM_CONFIGURATION (37h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	to send configuration data to a 1G APM	X
(*) SET_NEXT_GEN_APM_CONFIGURATION (47h/04h)	SET_NEXT_GEN_APM_CONFIGURATION_RESPONSE (36h/84h)	to send configuration data to a Next Gen APM	X
(*) GET_NEXT_GEN_APM_CONFIGURATION (47h/05h)	(*) NEXT_GEN_APM_CONFIGURATION (36H/85H)	to retrieve configuration data from a Next Gen APM	X
(*) SET_RSD_WOR (47h/07h)	RSD_WOR (36h/87h)	to send wakeup on radio (WOR) latency configuration to a RSD	X
(*) SET_WOR_WAKEUP (47h/08h)	WOR_WAKEUP (36h/88h)	to send a RSD/APM’s wakeup on radio (WOR) to a RSD	X
(*) GET_WOR_WAKEUP_STATUS (47h/01h)	WOR_WAKEUP_STATUS (36h/89h)	to retrieve an APM’s WOR status from a RSD	X
GET_FIRMWARE_VERSION (2Ch)	FIRMWARE_VERSION (41h)	to retrieve PIM & associated WAPM’s firmware versions	X
(*) GET_FULL_FIRMWARE_VERSION (47h/0Ah)	(*) FULL_FIRMWARE_VERSION (36h/8Ah)	to retrieve PIM & associated WAPM’s firmware versions (including AD RF module firmware version)	X
(*) GET_APM_BATTERY_STATUS (47h/06h)	(*) APM_BATTERY_STATUS (36h/86h)	to retrieve battery voltage levels from an APM	X
(*) GET_APM_STATISTICS (tbd)	(*) APM_STATISTICS (tbd)	to retrieve operational statistics from an APM
(*) GET_APM_SERIAL_NUMBERS (44h/01h)	(*) APM_SERIAL_NUMBERS (5Bh/81h)	to retrieve serial number from an APM	X
(*) GET_APM_MANUFACTURE_DATES (4Ah/01h)	(*) APM_MANUFACTURE_DATES (5Bh/82h)	to retrieve manufacturing date from an APM	X
(*) GET_APM_HARDWARE_VERSIONS (4Ah/03h)	(*) APM_HARDWARE_VERSIONS (5Ah/83h)	to retrieve hardware version from an APM	X
(*) GET_RSD_SERIAL_NUMBERS (4bh/01h)	(*) RSD_SERIAL_NUMBERS) (5Bh/81h)	to retrieve serial number from a RSD	X
(*) GET_RSD_MANUFACTURE_DATES (4Bh/02h)	(*) RSD_MANUFACTURE_DATES (5Bh/82h)	to retrieve manufacturing date from a RSD	X
(*) GET_RSD_HARDWARE_VERSIONS (4Bh/03h)	(*) RSD_HARDWARE_VERSIONS (5Bh/83h)	to retrieve hardware version from a RSD	X
GET_AD_APM_PARTNER_ID (47h/0Dh)	AD_APM_ PARTNER_ID (36h/8Dh)	to retrieve partner ID from an APM
GET_AD_RSD_PARTNER_ID (47h/0Eh)	AD_RSD_PARTNER_ID (36h/8Eh)	to retrieve partner ID from an RSD
GET_READER_INFO (47h/0Fh)	READER_INFORMATION (36h/8Fh)	To retrieve the reader type and the firmware version from an RSD	X
START_FW_DOWNLOAD (15h/00h)	START_FW_DOWNLOAD_RESP (16h/00h)	To start an ONR download session for APM or RSD	X
FW_FILE_BLOCK (15h/01h)	FW_FILE_BLOCK_RESP (16h/01h)	To send a portion of an ONR fw file during an active ONR download session for APM or RSD	X
END_FW_DOWNLOAD (15h/02h)	END_FW_DOWNLOAD_RESP (16h/02h)	To stop an ONR download session and verify the downloaded fw file for APM or RSD	X
ABORT_FW_DOWNLOAD (15h/03h)	ABORT_FW_DOWNLOAD_RESP (16h/03h)	To stop any active ONR session and reset all ONR related information to its default value for APM or RSD	X
START_FW_REFLASH (15h/04h)	START_FW_REFLASH_RESP (16h/04h)	To start the process of reflashing the downloaded fw file for APM or RSD	X
GET_ONR_STATUS (15h/05h)	ONR_STATUS (16h/05h)	To retrieve the ONR status for APM or RSD	X
LARGE_FW_FILE_BLOCK (15H/06H)	LARGE_FW_FILE_BLOCK_RESP (16H/06H)	To send an ENGAGE™ enabled device firmware file	X
SET_RSD_DIAGNOSTICS_CONFIGURATION (50H)	RSD_DIAGNOSTICS_CONFIGURATION (51H)	To enable/disable the Diagnostics Mode credential read configuration
RSD_SECURE_HOST_CONFIG (20H/09H)	RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To enable/disable Secure Mode (RSI Encryption) and to set Secure Mode related configurations	X
RSD_START_SECURE_SESSION (20H/01H)	RSD_START_SECURE_SESSION_CHALLENGE (21H/01H) RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To initiate the Secure Session	X
RSD_START_SECURE_SESSION_ACK (20H/02H)	RSD_START_SECURE_SESSION_COMPLETE (21H/02H) RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To complete/establish the Secure Session	X
RSD_SET_ACP_KEY (20H/10H)	RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To set the RSD’s ACP Default Key and Master Key	X
GET_RSD_SECURE_MODE_STATUS (20H/08H)	RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To get the Secure Mode status	X
RSD_ENCRYPTED_COMMAND (2EH)	RSD_ENCRYPTED_RESPONSE (2FH) RSD_SECURE_MODE_STATUS_RESP (21H/08H)	Encrypted command and response. All other RSI commands can be encrypted and sent as a payload of this command	X
APM_PIV_GEN_AUTH_CHALLENGE (78H)	APM_PIV_GEN_AUTH_ACK/ERR (7AH)	Send FIPS201-2 PIV card challenge to PIV card

Commands for Addressing APM devices

APM Commands are data packets that are sent from the ACP to the RSD then to the APM.

POLL_APM_CRC (44H)

Table 1-3: POLL_APM_CRC Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	44H
4	Length	00H
5	Frame Check Sequence	CRC LSB
6		CRC MSB

POLL_APM_CHECKSUM (3BH)

Table 1-4: POLL_APM_CHECKSUM Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	3BH
4	Length	00H
5	Frame Check Sequence	CHECKSUM

GET_APM_DATALOG (4DH)

Table 1-5: GET_APM_DATALOG Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	4DH
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

GET_PREVIOUS_APM_DATALOG (6DH)

Table 1-6: GET_PREVIOUS_APM_DATALOG Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	6DH
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

(+) APM_LOCK_CONTROL (4FH)

NOTES:

The APM_LOCK_CONTROL command with the data byte = 1 only works with a battery-operated Wireless Access Point Module (APM: AD-400, WPR400, ENGAGE devices and WPR400) when it is sent in response to having received a card swipe data command.
This means that a “timed unlock” is ignored if sent unsolicited. There is no response from the APM.
ENGAGE products accept data byte = 1 messages at any time, regardless of card data inquiry.
If sending a lock state change command with blink pattern definitions for bytes 6/7, ENGAGE APMs will first flash the default UI associated with byte 5, then flash the RSI defined UI LED sequence.

Table 1-7: APM_LOCK_CONTROL Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer Section 1.3.3.2.3
3	Type	4FH
4	Length	01H to 03H
5	Data	0 = no state change (blink pattern only)
		1 = timed unlock using the re-latch time
		2 = extended unlock (indefinite)
		3 = re-lock
		4 = turn on auxiliary relay (WRI-OUT/WRI400 only)
		5 = turn off auxiliary relay (WRI-OUT/WRI400 only)
		6 = reserved
		7 = red led on (only for AD-300/VIP & WRI400)
		8 = red led off (only for AD-300/VIP & WRI400)
		9 = green led on (only for AD-300/VIP & WRI400)
		10 = green led off (only for AD-300/VIP & WRI400)
		11 = beeper on (only for AD-300/VIP)
		12 = beeper off (only for AD-300/VIP) (+)
		13 = reserved (+)
		14 = PIN required
6		Optional: AD400/AD300/WPR400
		... Bit 0: IPB LED control enable
		............. 0 = disabled
		......... ***1 = enabled
		... Bit 1: AD-series Schlage LED control enable
		............. 0 = disabled
		......... ***1 = enabled
		... Bits 2-3: blink pattern
		............ 00 = green
		............ 01 = red
		............ 10 = green-red
		............ 11 = red-green
		... Bits 4-5: on interval (NOTE: on & off time for AD-series Schlage button)
		............ 00 = 100ms
		............ 01 = 500ms
		............ 10 = 1000ms
		...........*11 = always on (will reduce battery life drastically)
		... Bits 6-7: off interval (NOTE: not used for AD-series Schlage button)
		............ 00 = 100ms
		............ 01 = 500ms
		............ 10 = 1000ms
		...........*11 = always on (will reduce battery life drastically)
		Optional: WRI400
		... Bit 0: Beeper pulsing control enable
		............. 0 = disabled (No change in beeper pulsing)
		............. 1 = enabled (Update beeper pulsing pattern)
		... Bit 1-3 : Reserved
		... Bits 4-5: on interval (beeper on time)
		............ 00 = 250ms
		............ 01 = 500ms
		............ 10 = 1000ms
		.......****11 = always on (will reduce battery life drastically)
		... Bits 6-7: off interval (beeper off time)
		............ 00 = 250ms
		............ 01 = 500ms
		............ 10 = 1000ms
		.......****11 = always on (will reduce battery life drastically)
7		Optional: AD400/AD300/WPR400/ENGAGE device
		... Bits 0-1:
		............ 00 = stop blinking/blink nothing
		............ 01 = do pattern once
		.........**10 = repeat indefinitely, linearly increasing delay between interval
		............ 11 = repeat indefinitely, constant delay between interval
		... Bits 2-3: times to repeat pattern
		............ 00 = 1 time
		............ 01 = 2 times
		............ 10 = 3 times
		............ 11 = 4 times
		... Bits 4-5: interval time
		............ 00 = 0 seconds
		............ 01 = 20 seconds
		............ 10 = 40 seconds
		............ 11 = 60 seconds
		... Bits 6-7: reserved (Should be always sent as Zero)
		Optional: WRI400
		... Bits 0-1: Beeper repeat configuration
		............ 00 = stop beeping
		............ 01 = beep for the configured number of beeps
		............ 10 = beep indefinitely
		............ 11 = reserved
		... Bits 2-3: times to beep
		............ 00 = 1 time
		............ 01 = 2 times
		............ 10 = 3 times
		............ 11 = 4 times
		... Bits 4-7: reserved (Should be always sent as Zero)
6/7	Frame Check Sequence	CRC or CHECKSUM
7/8
8/9

(*) If either the on or the off interval are defined as always on, then the corresponding LED remains on forever until told to do otherwise. If the LED color is specified as alternating (red-green or green-red), the color that is supposed to blink first is the one that turns on.

(**) Delay between intervals begins at the level that is specified and then increases by 10 seconds for every iteration. This time between delays maxes out at 120 seconds, at which point the delay between intervals remains at a constant 120 seconds.

(***) Bits 0 and 1 of Data byte 6 must be set to “1=enabled” to stop a currently executing LED pattern.

(****) If either the on or the off beep time is defined as always on, the beeper remains on forever until told to do otherwise.

APM_TIMED_UNLOCK (56H)

NOTES:

The APM_TIMED_UNLOCK command will only work with a battery operated Wireless Access Point Module (APM: AD-400, & WPR400, ENGAGE device) when it is sent in response to having received a card swipe data command.
This means that a “timed unlock” is ignored if sent unsolicited. There is no response from the APM.
ENGAGE products will accept timed unlock message at any time, regardless of card data inquiry.

Table 1-8: APM_TIMED_UNLOCK Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	56H
4	Length	02H or 04H
5	Data	Byte1	number of seconds to unlock; valid range from 1-255
6		Byte2	Always 00
7		*Byte3	Optional: WRI400
			... Bit 0: Beeper pulsing control enable
			.............. 0 = disabled (No change in beeper pulsing)
			.............. 1 = enabled (Update beeper pulsing pattern)
			... Bit 1-3: Reserved
			... Bits 4-5: on interval (beeper on time)
			.............. 00 = 250ms
			.............. 01 = 500ms
			.............. 10 = 1000ms
			.........****11 = always on
			... Bits 6-7: off interval (beeper off time)
			.............. 00 = 250ms
			.............. 01 = 500ms
			.............. 10 = 1000ms
			.........****11 = always on
8		*Byte4	Optional: WRI400
			... Bits 0-1: Beeper repeat configuration
			.............. 00 = stop beeping
			.............. 01 = beep for the configured number of beeps
			.............. 10 = beep indefinitely
			.............. 11 = reserved
			... Bits 2-3: times to beep
			.............. 00 = 1 time
			.............. 01 = 2 times
			.............. 10 = 3 times
			.............. 11 = 4 times
			... Bits 4-7: reserved (Should be always sent as Zero)
8/9	Frame Check Sequence	CRC or CHECKSUM

(****) If either the on or the off beep time is defined as always on, the beeper remains on forever until told to do otherwise.

NOTE: The extra *Byte 3 and *Byte 4 are applicable only for WRI400.

GET_APM_CONFIGURATION (38H)

Table 1-9: GET_APM_CONFIGURATION Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	38H
4	Length	05H
5	Data	APM Address (0x00 to 0x0F)
6		0
7		0
8		0
9		0
10/11	Frame Check Sequence	CRC or CHECKSUM

(*) GET_NEXT_GEN_APM_CONFIGURATION (47H/05H)

Table 1-10: GET_NEXT_GEN_APM_CONFIGURATION Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	02H
5	Data	Sub Command: 05H
6		APM Address: Refer to APM Address Space section
7/8	Frame Check Sequence	CRC or CHECKSUM

SET_APM_CONFIGURATION (37H)

NOTE: The SET_APM_CONFIGURATION command must only be sent when the Configuration Mode bit in the APM_STATUS, RSD_STATUS_CHANGE, or RSD_STATUS_CARDDATA for all APMs linked to the RSD are reset (0).

If another SET_APM_CONFIGURATION command is sent while the Configuration Mode bit is set (1), then a previously sent SET_APM_COMMAND is not sent to the desired APM. The Configuration Mode bit being reset (0) indicates that previous pending SET_APM_CONFIGURATION command has been implemented in the desired APM.

Table 1-11: SET_APM_CONFIGURATION Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	37H
4	Length	10H
5	Data	byte1	APM configuration data structure (see Table 1‑12 below)
6		byte2
7		byte3
8		byte4
9		byte5
10		byte6
11		byte7
12		byte8
13		byte9
14		byte10	0
15		byte11	0
16		byte12	0
17		byte13	0
18		byte14	0
19		byte15	0
20		byte16	0
21/22	Frame Check Sequence	CRC or CHECKSUM

Table 1-12: APM Configuration Data Structure Format

Byte	Bit	Function	Comments
byte1		Door unlock time	1-255 seconds (default=3)
byte2	0	Card format * (depends on RSD type) (not applicable on AD series)	0=none 1=reverse 2=Northern #1 3=Northern #2 4=Northern #5 5=Northern #6
	1
	2
	3	Trouble level *	not applicable on RS485 RSD
	4	Door open level *	not applicable on RS485 RSD
	5	Deny access (cache)	1=enable deny access option, 0=disable deny access option
	6	Re-latch event	1=relatch on door open, 0=relatch on door close
	7	Relock method	1=relatch on door position change, 0=timer only
byte3		Heartbeat time (low byte) *	number of 15 second intervals (low byte)
byte4		Heartbeat time (high byte) *	number of 15 second intervals (high byte)
byte5	0	WA/WPR2 Reader type *	1=iClass, 0=all others (default=0)
	1	Pre-alarm enable *	1=enable, 0=disable
	2	Motor type for IRL/MIRL/WA *	0=normal 1=Best/WEXK 2=Saflok MIRL mortise 3=Schlage 4=Schlage WA5600/WA993 & Marks MIRL cyl 5=Schlage WA5200
	3
	4
	5	Latch Type for WISI *	1=strike, 0=relay
	6	Request to exit mode *	1=normal, 0=inquiry
	7	Extended unlock *	1=enabled, 0=disabled
byte 6	0	Retry times **	1-15 (default=5)
	1
	2
	3
	4	Door held open time *	1-15 (seconds = 15 +( value*5))
	5
	6
	7
byte 7	0	Subsequent Delay **	0-15 (100 ms resolution) (default = 2 or 200 ms)
	1
	2
	3
	4	First Delay **	0-15 (100 ms resolution) (default = 3 or 300 ms)
	5
	6
	7
byte 8		Cache memory bits per card	0-255, 0=cache disabled (default=0)
byte 9	0	Clear Cache Entries	SET: 1=clear cache entries; 0=maintain cache; GET: 1=cache entries cleared; 0=cache maintained
	1	Mag Track Selection (1G only)*	Track 1 (1G only)
	2		Track 2 (1G only)
	3		Track 3 (1G only)
	4	Auto purge	1=disabled, 0=enabled (default=1)
	5	Failsafe mode (comm loss)	00=disabled, 01=fail locked, 10=fail unlocked (default=00)
	6
	7	Cache memory mode	0=full card number, 1=facility code (default =0)

* Indicates a configuration that is not supported by ENGAGE products.

** For ENGAGE products, the credential inquiry timeout is defined by the formula: 100ms*[First_Delay + (Subsequent_Delay*Retry_Times)]. Different combinations resulting in the same final value result in the same credential inquiry; however it does not change the communication interval between wireless APMs and the Gateway during the inquiry timeout.

(*) SET_NEXT_GEN_APM_CONFIGURATION (47H/04H)

If another SET_NEXT_GEN_APM_CONFIGURATION command is sent while the Configuration Mode bit is set (1), then a previously sent SET_NEXT_GEN_APM_COMMAND will not be sent to the desired APM. The Configuration Mode bit being reset (0) indicates that previous pending SET_NEXT_GEN_APM_CONFIGURATION command has been implemented in the desired APM.

When communicating with an AD400 (or an ENGAGE) device, this command is actually sent from the ACP to the PIM400-485, and therefore the RSD address of the PIM400-485 (or GWE) should be used in byte 2.

When communicating with an AD300 device, bytes (2) and (6) have the same address.

Table 1-13: SET_NEXT_GEN_APM_CONFIGURATION Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	22H
5	Data	Sub Command: 04H
6		APM Address: Refer to APM Address Space section
7		byte1	Next Generation Lock APM/Reader Configuration Structure (see Table 1‑82)
8		byte2
9		byte3
10		byte4
11		byte5
12		byte6
13		byte7
14		byte8
15		byte9
16		byte10
17		byte11
18		byte12
19		byte13
20		byte14
21		byte15
22		byte16
23		byte17
24		byte18
25		byte19
26		byte20
27		byte21
28		byte22
29		byte23
30		byte24
31		byte25
32		byte26
33		byte27
34		byte28
35		byte29
36		byte30
37		byte31
38		byte32
39/40	Frame Check Sequence	CRC or CHECKSUM

(*) GET_APM_BATTERY_STATUS (47H/06H)

When communicating with an AD300 device, bytes (2) and (6) have the same address.

Table 1-14: GET_APM_BATTERY_STATUS Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer Refer to RSD Address Space section
3	Type	47H
4	Length	02H
5	Data	Sub Command: 06H
6		APM Address: Refer Refer to APM Address Space section
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) GET_APM_STATISTICS (TBD)

TBD

(*) GET_AD_APM_OEM_CODE (47H/0BH)

When communicating with an AD300 device, bytes (2) and (6) have the same address.

Table 1-15: GET_AD_APM_OEM_CODE Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer Refer to RSD Address Space section
3	Type	47H
4	Length	02H
5	Sub Command	0BH
6	APM Address	Refer Refer to APM Address Space section
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) GET_AD_APM_PARTNER_ID (47H/0DH)

When communicating with an AD300 device, bytes (2) and (6) have the same address.

NOTE: PARTNER_ID is not supported by ENGAGE products.

Table 1-16: GET_AD_APM_PARTNER_ID Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer Refer to RSD Address Space section
3	Type	47H
4	Length	02H
5	Sub Command	0DH
6	APM Address	Refer Refer to APM Address Space section
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) GET_APM_HARDWARE_VERSIONS (4AH/03H)

Table 1-17: GET_APM_HARDWARE_VERSIONS Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	4AH
4	Length	01H
5	Data	Sub Command: 03H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) GET_APM_SERIAL_NUMBERS (4AH/01H)

Table 1-18: GET_APM_SERIAL_NUMBERS Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	4AH
4	Length	01H
5	Data	Sub Command: 01H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) GET_APM_MANUFACTURE_DATES (4AH/02H)

Table 1-19: GET_APM_MANUFACTURE_DATES Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	4AH
4	Length	01H
5	Data	Sub Command: 02H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) APM_PIV_GEN_AUTH_CHALLENGE (78H | F8H)

When the length of the message data exceeds 255 bytes the Type field changes to F8H to indicate a 2-byte Length field. The optional 2nd Length byte is inserted at Byte 5. Byte 4 will be Length LSB, and Byte 5 will be Length MSB.

Table 1-20: APM_PIV_GEN_AUTH_CHALLENGE Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	F8H (78H is the actual message type, but the MSB bit is set to represent that this message has a two-byte length field. Refer to Type Section for more details).
4	Length LSB	Variable (Min: 02H Max: 102H)
5	Length MSB
6	Algorithm Reference	Reference ID sent to the PIV card to indicate which algorithm to use in the authentication procedure.
7	Key Reference	Reference ID sent to the PIV card to indicate which key to use in the authentication procedure.
8 through N	Data[0]-Data[X]	Challenge data sent to the PIV card to perform the authentication procedure (LSB sent first with a maximum length of 256 bytes total in a single message).
N+1/N+2	Frame Check Sequence	CRC or CHECKSUM

Commands for Addressing RSD devices

POLL_RSD_CRC (3AH)

Table 1-21: POLL_RSD_CRC Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	3AH
4	Length	00H
5	Frame Check Sequence	CRC LSB
6		CRC MSB

POLL_RSD_CHECKSUM (74H)

Table 1-22: POLL_RSD_CHECKSUM Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	74H
4	Length	00H
5	Frame Check Sequence	CHECKSUM

GET_RSD_INFORMATION (3CH)

Table 1-23: GET_RSD_INFO Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	3CH
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

(*) GET_RSD_FULL_CONFIGURATION (47H/02H)

Table 1-24: GET_RSD_INFO Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	01H
5	Sub Command	02H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) SET_RSD_CONFIGURATION (77H)

Table 1-25: SET_RSD_INFO Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address (1)	Refer to RSD Address Space section
3	Type	77H
4	Length	06H
5	Low RSD RF Address	00H to FFh & not AAH (2), (10)
6	High RSD RF Address	00H to FFh & not AAH (2), (10)
7	Low APM Range	00H to FFh & not AAH (3)
8	High APM Range	00H to FFh & not AAH (3)
9	New RSD Address	00H to FFh & not AAH (4)
10	DCS and Feature (5), (10)	Bit 7-6 reserved
		Bit 5 (1G only)
		...... 1=DCS enabled
		...... 0=DCS disabled
		Bit 4-3 (Next GenAD400 only)
		Extended Status Reporting Config (9)
		...... 00 = Disabled
		...... 01 = Enabled
		...... 10 = Reserved
		...... 11 = Reserved
		Bit 2-0 (Next Gen AD400only)
		...... 000=DCS Disabled
		...... 001=DCS enabled, channel set 1 (6)
		...... 010=DCS enabled, channel set 2 (7)
		...... 011=DCS enabled, channel set 3 (8)
		...... 111=no change
11/12	Frame Check Sequence	CRC or CHECKSUM

NOTES: #'s shown in ()

(1) If byte 2 is set to AAH, then all RSD’s on the RS485 bus will accept and respond to this command, therefore AAH address should only be used when there is only one RSD on the RS485 bus and its current RSD RS485 address is not known.

(2) If bytes 5 and 6 are both set to FFH, then the RSD’s RF address is not changed. Applies only to PIM400-485.

(3) If bytes 7 and 8 are both set to FFH, then the RSD’s APM range is not changed. Applies only to PIM400-485.

(4) If byte 9 is set to FFH, then the RSD’s RS485 address is not changed. Applies to PIM400-485 and AD-300.

(5) If byte 10 is set to FFH, then the RSD’s DCS (dynamic channel switching) state is not changed. Applies only to PIM400-485.

(6) Channels 1, 4, and 7 are used in channel set 1 in the AD400/PIM400-485. Channels 6 and 9 are used in channel set 1 in the AD400-B/PIM400-485-B

(7) Channels 2, 5, and 8 are used in channel set 2 in the AD400/PIM400-485. Channels 7 and 10 are used in channel set 2 in the AD400-B/PIM400-485-B.

(8) Channels 3, 6, and 9 are used in channel set 3 in the AD400/PIM400-485. Channel set 3 is not a valid option for an AD400-B/PIM400-485-B.

(9) All reserved values for extended status reporting configuration are treated as extended status reporting disabled. However, these reserved values should not be used as the means to disable this feature as they could take on a different meaning in the future.

(10) RF address and DCS features are not applicable to ENGAGE products. Changes to these data fields will be ignored by an ENGAGE Gateway device.

(*) SET_RSD_CHANNEL (47H/01H)

NOTE: Channel number selection is not supported by ENGAGE products.

NOTE: DCS selection takes priority over the single channel selection. This command will not cause any change if DCS is already enabled in the case of AD wireless products.

Table 1-26: SET_RSD_CHANNEL Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	02H
5	Data	Sub Command: 01H
6		Channel Number: 01D-10D (1)
7/8	Frame Check Sequence	CRC or CHECKSUM

(1) The valid channel range for the AD400/PIM400-485 is 1 through 10. The valid channel range for the AD400-B/PIM400-485-B is 6 through 10.

GET_APM/RSD_ASSOCIATION (65H)

Table 1-27: GET_APM/RSD_ASSOCIATION Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	65H
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

SET_POLL (49H)

NOTE: When using the SET_POLL command to set the polling addresses only one RSD can be on the RS485 bus. All other RSD’s must be temporarily disconnected.

Table 1-28: SET_POLL Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	49H
4	Length	02H
5	Data	Low APM range (0 to FEH, not AAH)
6		High APM range (0 to FEH, not AAH)
7/8	Frame Check Sequence	CRC or CHECKSUM

SET_LINK (45H)

Permits linking using the RSI protocol without needing a HHD/SUS. For ENGAGE Gateway, issuing a set link command against an existing APM Address immediately deletes the existing link.

Table 1-29: SET_LINK Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	45H
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

ABORT_LINK (32H)

For ENGAGE Gateway, issuing an abort link command against an existing APM Address deletes the existing link. It is recommended that an abort link command be sent before a new set link when reassigning an existing APM address.

Table 1-30: ABORT_LINK Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	APM Address	Refer to APM Address Space section
3	Type	32H
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

GET_OEM_CODE (6FH)

Table 1-31: SEND_OEM_CODE Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	6FH
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

(*) SET_RSD_WOR (47H/07H)

NOTE: WOR is always enabled for ENGAGE Gateway and is not configurable. Changes in the WOR data field are ignored and always return a value of 5 seconds.

Table 1-32: SET_RSD_WOR Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	02H
5	Data	Sub Command: 07H
6		WOR: 0-10 seconds; 0=WOR disabled.
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) SET_WOR_WAKEUP (47H/08H)

Table 1-33: SET_WOR_WAKEUP Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	05H
5	Data	Sub Command: 08H
6		Lock Bit Map Low Byte: .
		Bit0-1st lock on the PIM
		1-wake up this lock
		0-don’t wake up this lock
7		Lock Bit Map High Byte
		Bit0 – 9th lock on the PIM
		1-wake up this lock
		0-don’t wake up this lock
8		Control Bit Map Low Byte
		1-unlock, 0-relock
9		Control Bit Map High Byte
		1-unlock, 0-relock
10/11	Frame Check Sequence	CRC or CHECKSUM

(*) GET_WOR_WAKEUP_STATUS (47H/09H)

Table 1-34: GET_WOR_WAKEUP_STATUS Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	01H
5	Data	Sub Command: 09H
6/7	Frame Check Sequence	CRC or CHECKSUM

GET_FIRMWARE_VERSION (2CH)

Table 1-35: GET_FIRMWARE_VERSION Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	2CH
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

(*) GET_FULL_FIRMWARE_VERSION (47H/0AH)

Table 1-36: GET_FULL_FIRMWARE_VERSION Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	01H
5	Data	Sub Command: 0AH
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) GET_RSD_SERIAL_NUMBERS (4BH/01H)

Table 1-37: GET_RSD_SERIAL_NUMBERS Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	4BH
4	Length	01H
5	Data	Sub Command: 01H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) GET_RSD_MANUFACTURE_DATES (4BH/02H)

Table 1-38: GET_RSD_MANUFACTURE_DATES Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	4BH
4	Length	01H
5	Data	Sub Command: 02H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) GET_RSD_HARDWARE_VERSIONS (4BH/03H)

Table 1-39: GET_RSD_HARDWARE_VERSIONS Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	4BH
4	Length	01H
5	Data	Sub Command: 03H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) GET_AD_RSD_OEM_CODE (47H/0CH)

Table 1-40: GET_AD_RSD_OEM_CODE Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	01H
5	Sub Command	0CH
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) GET_AD_RSD_PARTNER_ID (47H/0EH)

NOTE: Partner ID is not supported by ENGAGE products.

Table 1-41: GET_AD_RSD_PARTNER_ID Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	01H
5	Sub Command	0EH
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) GET_READER_INFO (47H/0FH)

Table 1-42: GET_READER_INFO Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	47H
4	Length	02H
5	Sub Command	0FH
6	APM Address	Refer to APM Address Space section
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) START_FW_DOWNLOAD (15H/00H)

Table 1-43: START_FW_DOWNLOAD Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	15H
4	Length	04H
5	Data	Sub Command: 00H
6		Download Target:
		0x00 = MG(K)/MS(K) Reader
		0x01 = KP/PR(K)/SM(K)/MT(K)/MI(K)/FMK Reader
		0x02 = AD-300 Main
		0x03 = AD-400 Main
		0x04 = PIM400-485
		0x05 = MT(K)2/MI(K)2/Si(K)2/FMK2 Reader
		0x06 = NDE
		0x07 = ADE-COM
		0x08 = ADE-Main
		0x09 = ENGAGE Gateway
		0x0A = BE467/FE410
		0x0B = LE
		0x0C = AD-302 Main
		0x0D = AD-402 Main
		0x0E = RMRU
		0x0F = NDEB
		0x10 = LEMSB
		0x11 = LEMBB
		0x12 = LEMDB
		0x13-0xFF = Reserved
7		*Lock Bit Map Low Byte:
		Bit0 = 1st lock on the PIM
		1 = Download intended for this lock
		0 = Download not intended for this lock
8		*Lock Bit Map High Byte .
		Bit0 = 9th lock on the PIM
		1 = Download intended for this lock
		0 = Download not intended for this lock
9/10	Frame Check Sequence	CRC or CHECKSUM

NOTES: *These bytes are required only if download target is an ENGAGE Edge Device, an AD-400, or a reader that is attached to an AD-400. If download target is not one of these then these bytes should be sent as 0x00.

*For ENGAGE™ Edge Devices the Lock Bit Map shall only include the devices that match the download target.

(*) FW_FILE_BLOCK (15H/01H)

Table 1-44: FW_FILE_BLOCK Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	15H
4	Length	43H
5	Data	Sub Command: 01H
6-7		*FW Block Id. Low byte sent first.
8-71		64 bytes of Firmware File Data. Lowest byte sent first
72/73	Frame Check Sequence	CRC or CHECKSUM

*This is a 2-byte sequence number used to ensure the firmware file is received in the correct order. This should start at 0x0001 and be incremented by one for each new block that is sent by the ACP. The low byte of the value should be sent first.

(*) END_FW_DOWNLOAD (15H/02H)

Table 1-45: END_FW_DOWNLOAD Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	15H
4	Length	01H
5	Data	Sub Command: 02H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) ABORT_FW_DOWNLOAD (15H/03H)

Table 1-46: ABORT_FW_DOWNLOAD Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	15H
4	Length	03H
5	Data	Sub Command: 03H
6		*Lock Bit Map Low Byte:
		Bit0 = 1st lock on the PIM
		1 = Abort download for this lock
		0 = Do not abort download for this lock
7		*Lock Bit Map High Byte .
		Bit0 = 9th lock on the PIM
		1 = Abort download for this lock
		0 = Do not abort download for this lock
8/9	Frame Check Sequence	CRC or CHECKSUM

* These bytes are required only if aborting the download of an ENGAGE™ Edge Device, AD-400, or a reader that is attached to an AD-400. If aborting download for a device that is not one of these, then these bytes should be sent as 0x00.

* For ENGAGE™ Edge Devices, the Lock Bit Map includes only the same model type device(s) (i.e. all NDE, all LE, all NDE and all LE, etc, but not a partial mix). The Lock Bit Map should not include any non-linked device(s).

(*) START_FW_REFLASH (15H/04H)

Table 1-47: START_FW_REFLASH Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	15H
4	Length	04H
5	Data	Sub Command: 04H
6		Reflash Target:
		0x00 = AD-300 and/or Reader Attached to AD-300
		0x01 = *WAPM and/or Reader Attached to WAPM (including ENGAGE locks)
		0x02 = PIM400-485/ENGAGE Gateway
		0x03-0xFF = Reserved
7		**Lock Bit Map Low Byte:
		Bit0 = 1st lock on the PIM
		1 = Reprogram this lock with most recently downloaded firmware file(s)
		0 = Do not reprogram this lock
8		**Lock Bit Map High Byte
		Bit0 = 9th lock on the PIM
		1 = Reprogram this lock with most recently downloaded firmware file(s)
		0 = Do not reprogram this lock
9/10	Frame Check Sequence	CRC or CHECKSUM

*Current Release supports only AD400 WAPMs. In the future this may include other wireless devices.

**These bytes are required only if starting firmware reprogramming of a WAPM or a reader that is attached to the WAPM. If reprogramming firmware for a device that is not one of these, then these bytes should be sent as 0x00.

*For ENGAGE™ Edge Devices, the Lock Bit Map includes only the same model type device(s) (i.e. all NDE, all LE, all NDE and all LE, etc, but not a partial mix). The Lock Bit Map should not include any non-linked device(s).

(*) GET_ONR_STATUS (15H/05H)

Table 1-48: GET_ONR_STATUS Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	15H
4	Length	01H
5	Data	Sub Command: 05H
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) LARGE_FW_FILE_BLOCK (15H/06H)

Table 1-49: LARGE_FW_FILE_BLOCK Command Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	15H
4	Length	44H
5	Data	Sub Command: 06H
6-8		*FW Block Id. Low byte sent first
9-72		64 bytes of Firmware File Data. Lowest byte sent first
72/73	Frame Check Sequence	CRC or CHECKSUM

* This is a 3-byte sequence number used to ensure the firmware file is received in the correct order. This should start at 0x0001 and be incremented by one for each new block that is sent by the ACP. The low byte of the value should be sent first.

(*) SET_RSD_DIAGNOSTICS_CONFIGURATION (50H)

Table 1-50: SET_RSD_DIAGNOSTICS_CONFIGURATION Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD Address	Refer to RSD Address Space section
3	Type	50H
4	Length	01H
5	Data	00H = Disable Diagnostics Credential Read
		01H = Enable Diagnostics Credential Read
		02H-FFH = Reserved
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) RSD_SECURE_HOST_CONFIG (20H/09H)

Table 1-51: RSD_SECURE_HOST_CONFIG Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD address	Refer to RSD Address Space section
3	Type	20H
4	Length	08H
5	Data	1 byte	Sub command: 09H
		1 byte	00H – Disable secure mode
			01H – Enable secure mode
			02H-FFH – Reserved
		2 bytes	Session timeout value (in minutes)
			0000 – Not allowed
			Byte 2 – SessionTimeoutLSB
			Byte 3 – SessionTimeoutMSB
		1 byte	Bit 0:
			1 = Select ACP Default Key
			0 = Select Allegion Default Key
			Bit 1-7 = RFU (should always be zero)
		3 bytes	Reserved for future use
13/14	Frame check sequence	CRC or CHECKSUM

(*) RSD_START_SECURE_SESSION (20H/01H)

Table 1-52: RSD_START_SECURE_SESSION Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD address	Refer to RSD Address Space section
3	Type	20H
4	Length	04H
5	Data	1 byte	Sub command: 01H
		1 byte	00H = Establish Normal Secure Session
			01H = Establish Admin Secure Session
			02H – FFH = RFU (should be zero)
		2 bytes	Reserved for future.
9/10	Frame check sequence	CRC or CHECKSUM

(*) RSD_START_SECURE_SESSION_ACK (20H/02H)

Table 1-53: RSD_START_SECURE_SESSION_ACK Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD address	Refer to RSD Address Space section
3	Type	20H
4	Length	11H
5	Data	1 byte	Sub command: 02H
		16 byte	Encrypted and Permuted RSD Random Number and ACP Random Number
22/23	Frame check sequence	CRC or CHECKSUM

(*) RSD_SET_ACP_KEY (20H/10H)

NOTE: This command is always sent encrypted during an Admin Secure Session.

Table 1-54: RSD_SET_ACP_KEY Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD address	Refer to RSD Address Space section
3	Type	20H
4	Length	12H
5	Data	Byte 1	Sub Command: 10H
		Byte 2	00H = Set/Replace the new ACP Default Key
			01H = Set/Replace the new Master key
			02H-FFH = RFU
		16 bytes	New AES-128 bits key.
24/25	Frame check sequence	CRC or CHECKSUM

(*) GET_RSD_SECURE_MODE_STATUS (20H/08H)

Table 1-55: GET_RSD_SECURE_MODE_STATUS Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD address	Refer to RSD Address Space section
3	Type	20H
4	Length	01H
5	Data	Sub command: 08H
6/7	Frame check sequence	CRC or CHECKSUM

(*) RSD_SECURE_COMMAND (2EH)

Table 1-56: RSD_SECURE_COMMAND Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	RSD address	Refer to RSD Address Space section
3	Type	2EH
4	Length	Variable (always a multiple of 16)
5 – n	Data	Encrypted Original Command
n+1/n+2	Frame check sequence	CRC or CHECKSUM

Response Format

Responses are data packets sent from the RSD to the ACP.

(+) APM_STATUS (30H)

Table 1-57: APM_STATUS Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	30H
4	Length	03H
5	Data	Byte1
6		Byte2
7		Byte3
8/9	Frame Check Sequence	CRC or CHECKSUM

Table 1-58: APM_STATUS byte1, byte2, and byte3 Definitions

Byte	bit	Function	Comments
byte1	0	Reader tamper	1 = the polled APM has a reader tamper
	1	Low Battery (2)	1 = the polled APM has a low battery
	2	Loss of RF Communications	1 = the polled APM has a loss of RF
	3	RSD Tamper	1 = the RSD door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (2)	1 = the polled APM’s lock motor is stalled
	6	(+) Lock Clutch Position	1 = door unlocked, 0= door locked
		... WRI400 Only: Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position	1 = bolt extended, 0 = bolt retracted
		... WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte2	0	(+) Request to Exit Active	These bits are set when a changed of state occurs in the APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (2)
	2	(+) Inside Pushbutton (IPB) (2)
	3	(+) APM Tamper Active
	4	Datalog Ready (2)	1 = the polled APM has a datalog ready
	5	Configuration Mode (2)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the polled RSD/APM is in link mode
	7	(+) Battery Critical/REN (2)	AD-400/ENGAGE device Battery: 1 = critical, 0 = not critical
		AD-300 REN: 1 = active, 0 = inactive
byte3	0	Trouble	1 = the polled APM has trouble (i.e. byte1, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 3, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (2)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (2)	AD-300 Data Type: undefinedAPM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (polled APM)
	3	(+) IPB (2)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1 = inactive, 0 = active (polled APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (2)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (polled APM)
			RMRU 1 = Dogged or Dog Next Exit, 0 = Undogged

(1) The Configuration Mode bit is set after the RSD receives a SET_APM_CONFIGURATION command and remains set until that APM communicates with the RSD. A subsequent SET_APM_CONFIGURATION command must not be sent until the Configuration Mode bit is cleared for all APMs linked to that RSD.

(2) These Status bits do not apply to the WRI400 and can be ignored when communicating with this product.

(*) APM_STATUS_EXTENDED (33H)

NOTE: This message is not sent in place of APM_STATUS when the device has been configured for extended status reporting using the SET_RSD_CONFIGURATION command.

Table 1-59: APM_STATUS_EXTENDED Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	33H
4	Length	05H
5	Data	Byte1
6		Byte2
7		Byte3
8		Byte4
9		Byte5
10/11	Frame Check Sequence	CRC or CHECKSUM

Table 1-60: APM_STATUS_EXTENDED byte1, byte2, byte3, byte4 and byte5 Definitions

Byte	bit	Function	Comments
byte1	0	Reader tamper	1 = the polled APM has a reader tamper
	1	Low Battery5	1 = the polled APM has a low battery
	2	Loss of RF Communications	1 = the polled APM has a loss of RF
	3	RSD Tamper	1 = the RSD door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (5)	1 = the polled APM’s lock motor is stalled
	6	(+) Lock Clutch Position /	1 = door unlocked, 0= door locked
		WRI400 Only: Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position /	1 = bolt extended, 0 = bolt retracted
		WRI400 Only: Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte2	0	(+) Request to Exit Active	These bits are set when a change of state occurs in the APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (5)
	2	(+) Inside Pushbutton (IPB) (5)
	3	(+) APM Tamper Active
	4	Datalog Ready (5)	1 = the polled APM has a datalog ready
	5	Configuration Mode (5)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the polled RSD/APM is in link mode
	7	(+) Battery Critical/REN (5)	AD-400/ ENGAGE device battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte3	0	Trouble	1 = the polled APM has trouble (i.e. byte1, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 3, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (5)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (5)	AD-300 Data Type: undefined
			APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (polled APM)
	3	(+) IPB (5)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1 = inactive, 0 = active (polled APM)
	5	Wireless: Request to Enter Switch VIP	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (5)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (polled APM)
			RMRU 1 = Dogged or Dog Next Exit, 0 = Undogged
byte4	0-7	Number of extended status bytes	01H (2)
byte5	0-1	ONR Status	00 = ONR not active
			01 = ONR ready for next command
			10 = ONR in progress processing previous command
			11 = Error encountered
	2	FDR Information (3)	0 = FDR Not In Progress
			1 = FDR Initiated
	3	WOR Lock/Unlock Status (3)	0 = WOR lock/unlock in process
			1 = WOR lock/unlock not active/complete (4)
	4-7	Reserved	00h

(2) For the current revision of the protocol there is only 1 byte that is part of the extended status, so byte 4 will always be 0x01. However, for future revisions the number of extended status bytes may change so this byte is necessary so that it is clear how many extended status bytes a certain revision of firmware supports.

(3) The “FDR Information” and the “WOR Lock/Unlock Status” bits are applicable only on the PIM and not on the AD-300, so the relevant bits are still reserved on the AD-300.

(4) The “WOR lock/unlock not active/complete” status indicates the completion of the latest WOR command. The status of whether the particular WAPMs woke up successfully or not, to execute the latest command can be seen in the response to the GET_WOR_WAKEUP_STATUS command.

(5) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

RSD_STATUS_IDLE (31H)

Table 1-61: RSD_STATUS_IDLE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	31H
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

(*) RSD_STATUS_IDLE_EXTENDED (34H)

Note: This message is sent in place of RSD_STATUS_IDLE when the device has been configured for extended status reporting using the SET_RSD_CONFIGURATION command.

Table 1-62: RSD_STATUS_IDLE_EXTENDED Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	34H
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

(+) RSD_STATUS_CHANGE (31H)

Table 1-63: RSD_STATUS_CHANGE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	31H
4	Length	05H
5	Data	Byte1
6		Byte2
7		Byte3
8		Byte4
9		Byte5
10/11	Frame Check Sequence	CRC or CHECKSUM

Table 1-64: RSD_STATUS_CHANGE byte1 - byte5 Definitions

Byte	bit	Function	Comments
byte1		APM address	If FFH, then RSD has nothing new to report and byte2, byte3, byte4, byte5 are all = 0.
			If 00H to FEH (not AAH), then byte2, byte3, byte4 contain the status for that APM.
byte2	0	Reader tamper	1 = the byte1 APM has a reader tamper
	1	Low Battery (2)	1 = the byte1 APM has a low battery
	2	Loss of RF Communications	1 = the byte1 APM has a loss of RF
	3	RSD Tamper	1 = the polled RSD’s door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (2)	1 = the byte1 APM’s lock motor is stalled
	6	(+) Lock Clutch Position /	1 = door unlocked, 0= door locked
		WRI400 Only - Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position /	1 = bolt extended, 0 = bolt retracted
		WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte3	0	(+) Request to Exit Active	These bits are set when a change of state occurs in the byte1 APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (2)
	2	(+) Inside Pushbutton (IPB) (2)
	3	(+) APM Tamper Active
	4	(+) Datalog Ready (2)	1 = the polled APM has a datalog ready
	5	Configuration Mode (2)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the byte1 APM of the RSD is in link mode
	7	(+) Battery Critical/REN (2)	AD-400/ ENGAGE device Battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte4	0	Trouble	1 = the byte1 APM has trouble (i.e. byte2, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 4, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (2)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		... ** Magnetic Tamper Alert (2)	AD-300 Data Type: undefined APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (byte1 APM)
	3	(+) IPB (2)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1 = inactive, 0=active (byte1 APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (2)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (byte1 APM) ,
			RMRU 1 = Dogged or Dog Next Exit
			0 = Undogged
byte5		More Events	0 = polled RSD does not have more events to report
			0 <> polled RSD has more events to report and should be polled again

(2) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

(*) RSD_STATUS_CHANGE_EXTENDED (34H)

NOTE: This message is sent in place of RSD_STATUS_CHANGE when the device has been configured for extended status reporting using the SET_RSD_CONFIGURATION command.

Table 1-65: RSD_STATUS_CHANGE_EXTENDED Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	34H
4	Length	08H
5	Data	Byte1
6		Byte2
7		Byte3
8		Byte4
9		Byte5
10		Byte6
11		Byte7
12		Byte8
13/14	Frame Check Sequence	CRC or CHECKSUM

Table 1-66: RSD_STATUS_CHANGE_EXTENDED byte1 – byte8 Definitions

Byte	bit	Function	Comments
byte1		APM address	If FFH, then RSD has nothing new to report and all remaining bytes in the status are = 0
			If 00H to FEH (not AAH), then all remaining bytes contain the status for that APM
byte2	0	Reader tamper	1 = the byte1 APM has a reader tamper
	1	Low Battery (6)	1 = the byte1 APM has a low battery
	2	Loss of RF Communications	1 = the byte1 APM has a loss of RF
	3	RSD Tamper	1 = the polled RSD’s door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall6	1 = the byte1 APM’s lock motor is stalled
	6	(+) Lock Clutch Position /	1 = door unlocked, 0= door locked
		WRI400 Only - Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position /	1 = bolt extended, 0 = bolt retracted
		WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte3	0	(+) Request to Exit Active	These bits are set when a change of state occurs in the byte1 APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (6)
	2	(+) Inside Pushbutton (IPB) (6)
	3	(+) APM Tamper Active
	4	(+) Datalog Ready (6)	1 = the polled APM has a datalog ready
	5	Configuration Mode (6)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the byte1 APM of the RSD is in link mode
	7	(+) Battery Critical/REN (6)	AD-400/ ENGAGE Device Battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte4	0	Trouble	1 = the byte1 APM has trouble (i.e. byte2, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 4, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (6)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (6)	AD-300 Data Type: undefined
			APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (byte1 APM)
	3	(+) IPB (6)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1 = inactive, 0=active (byte1 APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (6)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (byte1 APM)
			RMRU 1 = Dogged or Dog Next Exit
			0 = Undogged
byte5	0-7	More Events	0 = polled RSD does not have more events to report
			0 <> polled RSD has more events to report and should be polled again
byte6	0-7	Card data bit count	00H (2)
byte7	0-7	Number of extended status bytes	01H (3)
byte8	0-1	ONR Status	00 = ONR not active
			01 = ONR ready for next command
			10 = ONR in progress processing previous command
			11 = Error encountered
	2	FDR Information (4)	0 = FDR Not In Progress
			1 = FDR Initiated
	3	WOR Lock/Unlock Status (4)	0 = WOR lock/unlock in process
			1 = WOR lock/unlock not active/complete (5)
	4-7	Reserved	00h

(2) Card data bit count is used here so that there is a clear division between what is card data and what is extended status information. For a status change message there is no card data to report, so this count will always be 0. If it were non-zero, then the RSD_STATUS_CARDDATA_EXTENDED response format should be followed.

(3) For the current revision of the protocol there is only 1 byte that is part of the extended status, so byte 7 will always be 0x01. However, for future revisions the number of extended status bytes may change so this byte is necessary so that it is clear how many extended status bytes a certain revision of firmware supports.

(4) The “FDR Information” and the “WOR Lock/Unlock Status” bits are applicable only on the PIM and not on AD-300, so the relevant bits are still reserved on the AD-300.

(5) The “WOR lock/unlock not active/complete” status indicates the completion of the latest WOR command. The status of whether the particular WAPMs woke up successfully or not, to execute the latest command can be seen in the response to the GET_WOR_WAKEUP_STATUS command.

(6) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

(+) RSD_STATUS_CARDDATA (31H)

Table 1-67: RSD_STATUS_CARDDATA Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	31H
4	Length	07H to 26H
5	Data	byte1	See footnote (1) The Configuration Mode bit is set after the RSD receives a SET_APM_CONFIGURATION command and remains set until that APM communicates with the RSD. A subsequent SET_APM_CONFIGURATION command must not be sent until the Configuration Mode bit is cleared for all APMs linked to that RSD.
			See the following Table 1-68 for a detailed description of the byte1-byte38 formats
6		byte2
7		byte3
8		byte4
9		byte5
10		byte6
11		byte7
•		•
•		•
•		•
42		byte38
43/44	Frame Check Sequence	CRC or CHECKSUM

Table 1-68: RSD_STATUS_CARDDATA byte1 – byte38 Definitions

Byte	bit	Function	Comments
byte1		APM address	If FFH, then RSD has nothing new to report and byte2, byte3, byte4, byte5 are = 0.
			If 00H to FEH (not AAH), then byte2, byte3, byte4 contain the status for that APM.
byte2	0	Reader tamper	1 = the byte1 APM has a reader tamper
	1	Low Battery2	1 = the byte1 APM has a low battery
	2	Loss of RF Communications	1 = the byte1 APM has a loss of RF
	3	RSD Tamper	1 = the polled RSD’s door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (2)	1 = the byte1 APM’s lock motor is stalled
	6	(+) Lock Clutch Position	1 = door unlocked, 0= door locked
		WRI400 Only - Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position	1 = bolt extended, 0 = bolt retracted
		WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte3	0	(+) Request to Exit Active	These bits are set when a changed of state occurs in the byte1 APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (2)
	2	(+) Inside Pushbutton (IPB) (2)
	3	(+) APM Tamper Active
	4	(+) Datalog Ready (2)	1 = the polled APM has a datalog ready
	5	Configuration Mode (2)	1 = the polled APM is in configuration mode1
	6	Link Mode Enabled	1 = the byte1 APM of the RSD is in link mode
	7	(+) Battery Critical/REN (2)	AD-400/ ENGAGE Device Battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte4	0	Trouble	1 = the byte1 APM has trouble (i.e. byte2, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 4, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (2)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (2)	AD-300 Data Type: 1 = keypad, 0 = card
			(in byte7-byte38)
			APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (byte1 APM)
	3	(+) IPB (2)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1=inactive, 0=active (byte1 APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (2)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (byte1 APM) ,
			RMRU 1 = Dogged or Dog Next Exit
			0 = Undogged
byte5		More Events	0 = polled RSD does not have more events to report
			0 <> polled RSD has more events to report and should be polled again
byte6		Card data bit count	number of data bits in card data (4-255)
byte7		msb of byte7 is first bit of carddata read from card	Card data read at APM, either Wiegand or magnetic data, up to the first 255 bits, format depends on which card conversion is being used.
•		•
•		•
•		•
byte38		number of bytes of card data depends on number of bits read from card

(2) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

(*) RSD_STATUS_CARDDATA_EXTENDED (34H)

NOTE: This message is sent in place of RSD_STATUS_CARDDATA when the device has been configured for extended status reporting using the SET_RSD_CONFIGURATION command.

Table 1-69: RSD_STATUS_CARDDATA_EXTENDED Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	34H
4	Length	09H to 28H
5	Data	byte1	See footnote (1) The Configuration Mode bit is set after the RSD receives a SET_APM_CONFIGURATION command and remains set until that APM communicates with the RSD. A subsequent SET_APM_CONFIGURATION command must not be sent until the Configuration Mode bit is cleared for all APMs linked to that RSD.
			See the following Table 1-70 for a detailed description of the byte1-byte38 formats
6		byte2
7		byte3
8		byte4
9		byte5
10		byte6
11		byte7
•		•
•		•
•		•
42		byte38
43		byte39
44		byte40
45/46	Frame Check Sequence	CRC or CHECKSUM

Table 1-70: RSD_STATUS_CARDDATA_EXTENDED byte1 – byte40 Definitions

Byte	bit	Function	Comments
byte1		APM address	If FFH, then RSD has nothing new to report and byte2, byte3, byte4, byte5 are = 0. .
			If 00H to FEH (not AAH), then byte2, byte3, byte4 contain the status for that APM
byte2	0	Reader tamper	1 = the byte1 APM has a reader tamper
	1	Low Battery (6)	1 = the byte1 APM has a low battery
	2	Loss of RF Communications	1 = the byte1 APM has a loss of RF
	3	RSD Tamper	1 = the polled RSD’s door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (6)	1= the byte1 APM’s lock motor is stalled
	6	(+) Lock Clutch Position	1 = door unlocked, 0= door locked
		WRI400 Only - Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position /	1 = bolt extended, 0 = bolt retracted
		WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte3	0	(+) Request to Exit Active	These bits are set when a changed of state occurs in the byte1 APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (6)
	2	(+) Inside Pushbutton (IPB) (6)
	3	(+) APM Tamper Active
	4	(+) Datalog Ready (6)	1 = the polled APM has a datalog ready
	5	Configuration Mode (6)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the byte1 APM of the RSD is in link mode
	7	(+) Battery Critical/REN (6)	AD-400/ ENGAGE Device Battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte4	0	Trouble	1 = the byte1 APM has trouble (i.e. byte2, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 4, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (6)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (6)	AD-300 Data Type: 1 = keypad, 0 = card (in byte7-byte38) APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (byte1 APM)
	3	(+) IPB (6)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1=inactive, 0=active (byte1 APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (6)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (byte1 APM)
			RMRU 1 = Dogged or Dog Next Exit
			0 = Undogged
byte5		More Events	0 = polled RSD does not have more events to report
			0 <> polled RSD has more events to report and should be polled again
byte6		Card data bit count	number of data bits in card data (4-255)
byte7		msb of byte7 is first bit of carddata read from card	Card data read at APM, either Wiegand or magnetic data, up to the first 255 bits, format depends on which card conversion is being used .
•		•
•		•
•		•
byte38		number of bytes of card data depends on number of bits read from card
byte39 (2)	0-7	Number of extended status bytes	01H (3)
byte40 (2)	0-1	ONR Status	00 = ONR not active
			01 = ONR ready for next command
			10 = ONR in progress processing previous command
			11 = Error encountered
	2	FDR Information (4)	0 = FDR Not In Progress
			1 = FDR Initiated
	3	WOR Lock/Unlock Status (4)	0 = WOR lock/unlock in process
			1 = WOR lock/unlock not active/complete (5)
	4-7	Reserved	00h

(2) The actual position of these bytes in the message is variable depending on the number of card data bytes that are sent. These bytes always directly follow the card data and the values shown represent the maximum card size.

(3) For the current revision of the protocol there is only 1 byte that is part of the extended status, so byte 39 will always be 0x01. However, for future revisions the number of extended status bytes may change so this byte is necessary so that it is clear how many extended status bytes a certain revision of firmware supports.

(4) The “FDR Information” and the “WOR Lock/Unlock Status” bits are applicable only on the PIM and not on AD-300, so the relevant bits are still reserved on the AD-300.

(6) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

NEXT_DATALOG (38H)

Table 1-71: NEXT_DATALOG Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	38H
4	Length	12H
5	Data	byte1	See the NEXT_DATALOG Data Field Formats Section for a detailed description of the byte1-byte18 formats
6		byte2
7		byte3
8		byte4
9		byte5
10		byte6
11		byte7
12		byte8
13		byte9
14		byte10
15		byte11
16		byte12
17		byte13
18		byte14
19		byte15
20		byte16
21		byte17
22		byte18
23/24	Frame Check Sequence	CRC or CHECKSUM

(+) OEM_CODE (4FH)

Table 1-72: RSD OEM_CODE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	4FH
4	Length	02H
5	Data	57H (ascii ‘W’)
6		41H (ascii ‘A’)
7/8	Frame Check Sequence	CRC or CHECKSUM

Table 1-73: VIP5100 OEM_CODE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	4FH
4	Length	02H
5	Data	56H (ascii ‘V’)
6		31H (ascii ‘1’)
7/8	Frame Check Sequence	CRC or CHECKSUM

Table 1-74: VIP5500 OEM_CODE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	4FH
4	Length	02H
5	Data	56H (ascii ‘V’)
6		35H (ascii ‘5’)
7/8	Frame Check Sequence	CRC or CHECKSUM

Table 1-75: VIP993 OEM_CODE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	4FH
4	Length	02H
5	Data	56H (ascii ‘V’)
6		39H (ascii ‘9’)
7/8	Frame Check Sequence	CRC or CHECKSUM

APM/RSD_STATUS (39H)

Table 1-76: APM/RSD STATUS Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	39H
4	Length	02H
5	Data	APM address: Refer to APM Address Space section
6		RSD RS485 address: Refer to RSD Address Space section
7/8	Frame Check Sequence	CRC or CHECKSUM

RSD_CONFIGURATION (53H)

Table 1-77: RSD CONFIGURATION Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	53H
4	Length	06H
5	Data	Low byte of RSD RF address (1)
6		High byte of RSD RF address (1)
7		Type of RSD:
		0x06 = PIM400-485 / AD300 / AD301
		0x07 = ENGAGE Gateway
		0x08 = AD302
		0x16 = PIM400-485-B / AD300-B
8		Low APM range (0 to FEH, not EEH)
9		High APM range (0 to FEH, not EEH)
10		RSD RF Channel (1)
11/12	Frame Check Sequence	CRC or CHECKSUM

(1) RF address and DCS features are not supported by ENGAGE products. Corresponding bytes are read back with a value of 0xFF.

RSD_FULL_CONFIGURATION (36H/82H)

Table 1-78: RSD_FULL_CONFIGURATION Response Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	0CH
5	Data	Sub Command: 82H
6		Low byte of RSD RF address (1)
7		High byte of RSD RF address (1)
8		Type of RSD
		0x06 = PIM400-485 / AD300 / AD301
		0x07 = ENGAGE Gateway
		0x08 = AD302
		0x16 = PIM400-485-B / AD300-B
9		Low APM range (0 to FEH, not EEH)
10		High APM range (0 to FEH, not EEH)
11		RSD RF Channel (1)
12		RSD RS485 address: Refer to RSD Address Space section
13		DCS state (1)
14		Low PIM SRCID (1)
15		High PIM SRCID (1)
16		Current WOR value: 0-10 (2)
17/18	Frame Check Sequence	CRC or CHECKSUM

(1) RF address, channels, SRCID and DCS features are not supported by ENGAGE products. Corresponding bytes are read back with a value of 0xFF.

(2) WOR value is a static value = 5 for ENGAGE Gateway.

(*) RSD_CHANNEL (36H/81H)

NOTES:

Channel number selection is not supported by ENGAGE products.
DCS selection takes priority over the single channel selection. So, this command won’t cause any change if DCS is already enabled in case of AD wireless products.

Table 1-79: RSD_CHANNEL Response Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	02H
5	Data	Sub Command: 81H
6		Channel Number: 01D-10D (1)
7/8	Frame Check Sequence	CRC or CHECKSUM

(1) The valid channel range for the AD400/PIM400-485 is 1 through 10. The valid channel range for the AD400-B/PIM400-485-B is 6 through 10.

(*) SET_NEXT_GEN_APM_CONFIGURATION RESPONSE (36H/84H)

Table 1-80: SET_NEXT_GEN_APM_CONFIGURATION Response Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	01H
5	Sub Command	84H
6/7	Frame Check Sequence	CRC or CHECKSUM

APM_CONFIGURATION (32H)

Table 1-81: APM_CONFIGURATION Response Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	32H
4	Length	10H
5	Data	byte1	APM configuration data structure (see Table 1‑12)
6		byte2
7		byte3
8		byte4
9		byte5
10		byte6
11		byte7
12		byte8
13		byte9
14		byte10	0
15		byte11	0
16		byte12	0
17		byte13	0
18		byte14	0
19		byte15	0
20		byte16	0
21/22	Frame Check Sequence	CRC or CHECKSUM

(*) NEXT_GEN_APM_CONFIGURATION (36H/85H)

Table 1-82: NEXT_GEN_APM_CONFIGURATION Response Packet Format

Byte	Field	Data/Description

1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	22H
5	Data	Sub Command: 85H
6		APM address: Refer to APM Address Space section
7		byte1	Next Generation Lock APM/Reader Configuration Structure (see Table 1‑82, below) For WRI400 :WRI400 Reader Configuration (see Table 1‑83, below)
8		byte2
9		byte3
10		byte4
11		byte5
12		byte6
13		byte7
14		byte8
15		byte9
16		byte10
17		byte11
18		byte12
19		byte13
20		byte14
21		byte15
22		byte16
23		byte17
24		byte18
25		byte19
26		byte20
27		byte21
28		byte22
29		byte23
30		byte24
31		byte25
32		byte26
33		byte27
34		byte28
35		byte29
36		byte30
37		byte31
38		byte32
39/40	Frame Check Sequence	CRC or CHECKSUM

Table 1-83: Next Generation Lock APM/Reader Configuration Structure

Byte	Bit	Function	Comments
byte1		Door unlock time	1-255 seconds (default=3)
byte2	0	Card format * (depends on RSD type)	0=none 1=reverse 2=Northern #1 3=Northern #2 4=Northern #5 5=Northern #6
	1
	2
	3	Trouble level *	not applicable on RS485 RSD
	4	Door open level *	not applicable on RS485 RSD
	5	Deny access	1=enable deny access option, 0=disable deny access option
	6	Re-latch event	1=relatch on door open, 0=relatch on door close
	7	Relock method	1=relatch on door position change, 0=timer only
byte3		Heartbeat time (low byte) *	number of 15 second intervals (low byte)
byte4		Heartbeat time (high byte) *	number of 15 second intervals (high byte)
byte5	0	IPB *	1=IPB, 0=Request to Enter (1G only)
	1	Pre-alarm enable *	1=enable, 0=disable
	2	Motor type for IRL/MIRL/WA*	0=normal 1=Best/WEXK 2=Saflok MIRL mortise 3=Schlage 4=Schlage WA5600/WA993 & Marks MIRL cyl 5=Schlage WA5200
	3
	4
	5	Latch Type for WISI *	1=strike, 0=relay
	6	Request to exit mode *	1=normal, 0=inquiry
	7	Extended unlock *	1=enabled, 0=disabled
byte6	0	Retry times ¹	1-15 (default=5)
	1
	2
	3
	4	Door held open time *	1-15 (seconds = 15 +( value*5))
	5
	6
	7
byte7	0	Subsequent Delay 1	0-15 (100 mS resolution) (default = 2 or 200 mS)
	1
	2
	3
	4	First Delay 1	0-15 (100 mS resolution) (default = 3 or 300 mS)
	5
	6
	7
byte8		Cache memory bits per card	0-255, 0=cache disabled (default=0)
byte9	0	Clear cache entries	SET: 1=clear cache entries; 0=maintain cache; GET: 1=cache entries cleared; 0=cache maintained
	1	Mag track selection * (current product, 1G)	track 1 (1G only)
	2		track 2 (1G only)
	3		track 3 (1G only)
	4	Auto purge	1=disabled, 0=enabled (default=1)
	5	Failsafe mode	00=disabled, 01=fail locked, 10=fail unlocked (default=00)
	6
	7	Cache memory mode	0=full card number, 1=facility code (default =0)
byte10	0	APM Mode *	0=normal (default) 1=test,
	1
	2	PIN-required led Mode	0=disabled 1=Schlage left green LED-Schlage right red LED alternate blink 5 times (300 ms on, 300 ms off) 2=Schlage left green LED-Schlage right red LED alternate blink 5 times (300 mS on, 300 mS off), Beeps twice (starts when LED blink starts, 150 mS on, 150 mS off) 3-7: future
	3
	4
	5	Request to Enter	1=enabled, 0=disabled
	6	Disable IPB blinking	1=enabled (normal default); 0=disabled
	7	reserved
byte11	0	IPB/Deadbolt Online Configuration	00=disabled (default) 01=lock/unlock *Note: Deadbolt can be used to lock the door only
	1
	2	IPB/Deadbolt Offline Configuration	00=disabled (default) 01=lock/unlock *Note: Deadbolt can be used to lock the door only 10=disable reader
	3
	4	IPB Long Button Press	0-15 seconds (default=0=disabled)
	5
	6
	7
byte12		ACP Communications Timeout ²	0-255 seconds
byte13	0	WOR Timeout	0-10 seconds (default=10, disabled=0) NOTE: this is for GET command only. WoR timeout is set via SET_PIM_WOR_COMMAND
	1
	2
	3
	4	Forced Heartbeat after WoR	0=disabled; 1=enabled (Always enabled for ENGAGE products)
	5	Request to Enter Level *	not applicable on RS485 RSD
	6	Reserved
	7	Reserved
byte14	0	FIPS201-2 Capable *	0=disabled; 1=enabled
	1	FIPS201-2 Authentication *	0=disabled; 1=enabled (default = 0)
	2	Reserved
	3	Reserved
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte15		Maximum number of cache entries	0-255, where the number of cache entries=5value, Default=20 (520=100 cache entries)
byte16	0	Failure mode ³ for:	00=as-is/cache according to byte 8 01= fail secured/locked/cache according to byte 8 10= fail unsecured/unlocked Default=00
	1
	2	Reserved
	3	Reserved
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte17	0	Magnetic Configuration	track 1: 0=disabled, 1=enabled (default = 0)
	1		track 2: 0=disabled, 1=enabled (default = 1)
	2		track 3: 0=disabled, 1=enabled (default = 0)
	3	Prox Configuration	HID : 0= disabled, 1 = enabled (default=1)
	4		GE/CACY; 0 = disabled, 1 = enabled. (default = 1)
	5		AWID: 0 = disabled, 1 = enabled (default=1)
	6	Mag card low power wakeup	0 = disabled, 1 = enabled (default = 1)
	7	GE Prox Configuration	0 = GE4002, 1 = GE4001 (default = 0) GE/CACY above must be enabled.
byte18	0	Backlight Timeout	0=disabled 1- 31 seconds
	1
	2
	3
	4
	5	Config Card Presented(read only)	1 = Config Card has been presented 0 = Config Card has not been presented
	6	Custom Key Installation Status	1 = Custom Key has been Installed 0 = Custom Key has not been Installed
	7	Reserved
byte19		Keypad Output Format	keypad output format: 0 = disabled 1=4 bits per key, upper nibble, no parity 2=6 bits per key, parity 3=8 bits per key, no parity 4=10 bits per key, parity 5=4 bits per key, buffered, no parity 6=4 bits per key, buffered, parity 7=26 bit Wiegand emulation 8=4 bits per key, lower nibble, no parity 9=IR buffered, no parity 10=IR buffered, parity 11=ASCII, odd parity, MSB first 12=32 bit Wiegand emulation
byte20	0	Keypad Interface Format *	00=Wiegand (data1/data0) (default) 01=Magnetic (clock&data)
	1
	2
	3
	4	reserved
	5	reserved
	6	reserved
	7	reserved
byte21		Keypad facility code	0-255 (applies to only to format #7)
byte22	0	Number of keys to buffer/cache	format 1: maximum number of keys to cache format 10: 1-11 format 11: maximum number of keys to cache format 12: maximum number of keys to cache
			format 2: maximum number of keys to cache
			format 3: maximum number of keys to cache
			format 4: maximum number of keys to cache
			format 5: 1-11
			format 6 : 1-10
			format 7: maximum number of keys to cache
			format 8: maximum number of keys to cache format 9: 1-11


	1
	2
	3
	4	reserved
	5	reserved
	6	reserved
	7	reserved
byte23	0	Keystroke timeout	0=disabled 1-15 seconds
	1
	2
	3
	4	reserved
	5	reserved
	6	reserved
	7	reserved
byte24	0	13.56 MHz Smart Card - 14443 UID (CSN)	1=enabled, 0=disabled
	1	13.56 MHz Smart Card - 14443 Secure MiFare Classic*	1=enabled, 0=disabled (requires 14443 UID to be disabled)
	2	13.56 MHz Smart Card - 14443 EV1 (NOC) *	1=enabled, 0=disabled (requires 14443 UID to be disabled)
	3	13.56 MHz Smart Card - 14443 PIV 75bit (open)	1=enabled, 0=disabled (requires 14443 UID to be disabled)
	4	Mi/MiK 13.56 MHz Smart – 15693 iClass SE	1 = enabled, 0 = disabled (default = 1 for Mi/MiK iClass secure reader)
		Si2/SiK2 13.56 MHz Smart – 15693 iClass SE / 14443A SEOS and Elite Key delivery	1 = enabled, 0 = disabled (default = 1 for Si2/SiK2 iClass secure reader)
		(Must make sure that iClass/Felica** 40-bit UID(CSN) (Byte 24 bit 6) is disabled to utilize this feature)	(default = 0 for MT/MTK/MT2/MTK2 reader types as this feature is not supported)
	5	13.56 MHz Smart - 15693 UID (CSN)	1=enabled, 0=disabled
	6	13.56 MHz Smart – iClass/Felica** 40-bit UID (CSN)	1=enabled, 0=disabled (default = 0)
	7	13.56 MHz Smart Card - 14443 PIV 200bit (open)	1=enabled, 0=disabled (requires 14443 UID to be disabled)
byte25		PIV Configuration format	0 – Disabled
			2 - FORMAT 2 - 58-bit TWIC / CAC
			4 - FORMAT 4 - 64-bit (BCD) TWIC / CAC
			5 - FORMAT 5 - 83-bit TWIC / CAC
			6 - FORMAT 6 - 66-bit (58 bit format + TSM) TWIC / CAC
			7 - FORMAT 7 - 64-bit (58 bit format (no parity) + TSM) TWIC / CAC
			8 - FORMAT 8 - 91-bit (83 bit format + TSM) TWIC / CAC
			9 - FORMAT 9 - 40-bit BCD
			10 - FORMAT 10 - 40-bit Reversed BCD
			11 - FORMAT 11 - 64-bit BCD
			12 - FORMAT 12 - 64-bit Reversed BCD
			13 - FORMAT 13 - 128-bit BCD
			14 - FORMAT 14 - 128-bit Reversed BCD
			15 – FORMAT 15 – 58-bit AMAG
byte26		13.56 MHz Smart – iClass/Felica** Output Format (If other than 40-bit UID required)	0 = Disabled
		(Must make sure that iClass/Felica** 40-bit UID (CSN) (Byte 24 bit 6) and iClass SE/SEOS (byte 24 bit 4) are disabled in order to utilize this feature)	1 = reserved
			2 = reserved
			3 = reserved
			4 = 64 bit CSN Enabled
			5 - 255 = reserved
			(default = 4 for MT/MTK/MT2/MTK2)
			(default = 0 for Mi/MiK/Si2/SiK2)
byte27	0	Beeper on/off (normal operation)	1=beeper enabled, 0=beeper disabled
	1	Support for 14 PIV Format	1= Supports 14 PIV formats 0= Does not support 14 PIV formats (Supports only 75 bit and 200 bit)
	2	13.56 MHz Smart Card - 14443 Secure MiFare Plus	0=enabled, 1=disabled (requires 14443 UID to be disabled)
	3	BLE Credential Enable***	0=disabled, 1=enabled (default = 1)
	4	BLE Credential Range***	0=short, 1=long (default = 0)
	5	BLE Performance***	0=normal, 1=max (default = 0)
	6	Credential Read LED***	0=none, 1=green (default = 1)
	7	Reserved
byte28		In Reader Firmware, this byte is assigned for “ReaderConfigTableVersion”
byte29	0	Card Read Retries	1=enable; 0=disable (default = 0)
	1	Reserved
	2	Reserved
	3	Reserved
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte30	Reserved
byte31	Reserved
byte32	Reserved

a. Bad/critical battery for wireless (AD400)

b. Loss of power for wired (AD300)

Table ‑82 - Next Generation Lock APM/Reader Configuration Structure

* Indicates a configuration that is not supported by ENGAGE products.

** Indicates Felica is only supported on AD MT2/MTK2/Si2/SiK2/FMK2 readers

*** Indicates configuration supported by NDEB, LEMSB, LEMBB, and LEMDB readers only.

WRI400 Reader Configuration Data Note: The WRI400 uses a unique set of reader configurations. These configuration definitions will be used in place of Byte 17 – Byte 32 in Table 1-82 (Next Gen Lock APM/Reader Configuration Structure) for the WRI400
byte	bit	function	Comments
Byte17			Reserved
Byte18			Reserved
Byte19		Reserved
Byte20	0	Reserved
	1
	2
	3
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
Byte21		Reserved
Byte22	0	WRI400 Number of keys to buffer	1-11 (default = 4)
	1
	2
	3
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
Byte23		Reserved
Byte24		Reserved
Byte25		Reader 1 keypad facility code	0-255 (applies to only to byte8 format #7) (default = 1)
Byte26		Reserved
Byte27	0	WRI400 Beeper on/off	1=enabled, 0=disabled (default = 1)
	1	Reserved
	2	Reserved
	3	Reserved
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
Byte28		Reader 2 keypad facility code	0-255 (applies to only to byte10 format #7) (default = 1)
Byte29		Reserved
Byte30		Reserved
Byte31		Reserved
Byte32		Reserved

Table ‑83 - Next Generation WRI400 Reader Configuration Structure

(*) RSD_WOR (36H/87H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	02H
5	Data	Sub Command: 87H
6		Current WOR value: 0-10 1
7/8	Frame Check Sequence	CRC or CHECKSUM

Table ‑84 – RSD_WOR Response Packet Format

WOR is always enabled for ENGAGE Gateway. ENGAGE Gateway will respond with set value of 5.

(*) WOR_WAKEUP (36H/88H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	01H
5	Data	Sub Command: 88H
5/6	Frame Check Sequence	CRC or CHECKSUM

Table ‑85 – WOR_WAKEUP_STATUS Response Packet Format

(*) WOR_WAKEUP STATUS (36H/89H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	04H
5	Data	Sub Command: 89H
6		Command Execution Status: Bit0: 0—in process, 1- completed.
7		Lock Bit Map Low Byte: 0-lock waked up; 1-lock not waked up
8		Lock Bit Map High Byte: 0-lock waked up; 1-lock not waked up
9/10	Frame Check Sequence	CRC or CHECKSUM

Table ‑86 – WOR_WAKEUP_STATUS Response Packet Format

(*) APM_BATTERY_STATUS (36H/86H)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	06H
5	Data	Sub Command: 86H
6		APM Address: Refer Section 1.3.3.2.3
7		Battery low byte : BCD format (fraction part)
8		Battery high byte: BCD format (integral part)
9		Lithium Battery low byte : BCD format (fraction part)
10		Lithium Battery high byte: BCD format (integral part)
11/12	Frame Check Sequence	CRC or CHECKSUM

Table ‑87 - APM_BATTERY Response Packet Format

(*) APM_PEDIGREE (TBD)

TBD

(*) APM_STATISTICS (TBD)

TBD

FIRMWARE_VERSION (41H)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	41H
4	Length	3+(3*N), N=number of doors supported by this PIM/Gateway (1-16)
5	Data	PIM/ENGAGE Gateway major firmware version: 0-254
6		PIM/ENGAGE Gateway minor firmware version: 0-254
7		WAPM start (low) addr: 00H-FEH, not AAH
8		WAPM 1 Type: 0-254
9		WAPM 1 major firmware version: 0-2551
10		WAPM 1 minor firmware version: 0-2551
. . .
8+(N-1)*3		WAPM N Type: 0-254
9+(N-1)*3		WAPM N major firmware version: 0-255
10+(N-1)*3		WAPM N minor firmware version: 0-255
11+(N-1)3 12+(N-1)3	Frame Check Sequence	CRC or CHECKSUM

00 = IRL(1G)

01 = WISI(1G)

02 = WPR(1G)/WPR400

03 = MIRL(1G)/AD-400

04 = Reserved

05 = AD-401

06 = WRI401

07 = WPR401

08 = AD-402

09 = Reserved

10 = WRI(1G)/WRI400

11 = WPR400-B

12 = AD400-B

13 = WRI400-B

14 = NDE

15 = ADE

16 = BE467/FE410

17 = LE

18 = RMRU

19 = NDEB

20 = LEB

00 = IRL(1G)

01 = WISI(1G)

02 = WPR(1G)/WPR400

03 = MIRL(1G)/AD-400

04 = Reserved

05 = AD-401

06 = WRI401

07 = WPR401

08 = AD-402

09 = Reserved

10 = WRI(1G)/WRI400

11 = WPR400-B

12 = AD400-B

13 = WRI400-B

14 = NDE

15 = ADE

16 = BE467/FE410

17 = LE

18 = RMRU

19 = NDEB

20 = LEB

Table ‑88 – FIRMWARE_VERSION Response Packet Format

RSD devices AD300/AD301 do not include WAPM version. Value will be returned as 0

(*) FULL_FIRMWARE_VERSION (36H/8AH)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	8+N*7 (N=total number of WAPMs assigned to PIM/Gateway, 1-16)
5	Data	Sub Command: 8AH
6		PIM/ENGAGE Gateway major firmware version: 0-255
7		PIM/ENGAGE Gateway minor firmware version: 0-255
8		PIM/ENGAGE Gateway build firmware version: 0-255
9		PIM radio major firmware version: 0-255 1
10		PIM radio minor firmware version: 0-255 1
11		PIM radio build firmware version: ASCII (a-z, A-Z) 1
12		PIM’s WAPM Low Address: 0-FEH, not AA
13		WAPM N Type: 0-255
14		WAPM N major firmware version: 0-255
15		WAPM N minor firmware version: 0-255
16		WAPM N build firmware version: 0-255
17		WAPM N radio major firmware version: 0-255 1
18		WAPM N radio minor firmware version: 0-255 1
19		WAPM N radio build firmware version: ASCII (a-z, A-Z) 1
20/21+((N-1)*7)	Frame Check Sequence	CRC or CHECKSUM

00 = IRL(1G)

01 = WISI(1G)

02 = WPR(1G)/WPR400

03 = MIRL(1G)/AD-400

04 = Reserved

05 = AD-401

06 = WRI401

07 = WPR401

08 = AD-402

09 = Reserved

10 = WRI(1G)/WRI400

11 = WPR400-B

12 = AD400-B

13 = WRI400-B

14 = NDE

15 = ADE

16 = BE467/FE410

17 = LE

18 = RMRU

Table ‑89 – FULL_FIRMWARE_VERSION Response Packet Format

ENGAGE devices will not include a radio module FW version. Value will be read as 0xFF. RSD devices AD300/AD301 do not include a radio module FW version. Value will be returned as 0.

(*) APM_SERIAL_NUMBERS (5AH/81H)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5AH
4	Length	32H
5	Data	Sub Command: 81H
6		APM address: Refer Section 1.3.3.2.3
7-22		Main Serial Number – 16 byte ASCII data
23-38		Reader Serial Number – 16 bytes ASCII data
39-54		Radio Serial Number – 16 bytes ASCII data 1
55/56	Frame Check Sequence	CRC or CHECKSUM

Table ‑90 – APM_SERIAL_NUMBERS Response Packet Format

ENGAGE devices will not include a radio serial number. Value will be read as 0xFF. RSD devices AD300/AD301 do not include a radio serial number. Value will be returned as 0.

(*) APM_MANUFACTURE_DATES (5AH/82H)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5AH
4	Length	0EH
5	Data	Sub Command: 82H
6		APM address: Refer Section 1.3.3.2.3
7-10		Main Manufacture Date
11-14		Reader Manufacture Date
15-18		Radio Manufacture Date 1
19/20	Frame Check Sequence	CRC or CHECKSUM

Note: The Manufacture Date is captured in four bytes as binary data where each nibble corresponds to one digit of the day. (Example: 0x20100315 = 2010, March 15); also, Radio Manufacture Date is not currently supported so the radio date will be returned as 0xFFFFFFFF).

Table ‑91 – APM_MANUFACTURE_DATES Response Packet Format

ENGAGE devices will not include a radio manufacture date. Value will be read with every byte as 0xFF.

(*) APM_HARDWARE_VERSIONS (5AH/83H)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5AH
4	Length	08H
5	Data	Sub Command: 83H
6		APM address: Refer Section 1.3.3.2.3
7/8		Main Hardware Version
9/10		Reader Hardware Version
11/12		Radio Hardware Version 1
13/14	Frame Check Sequence	CRC or CHECKSUM

Note: Radio Hardware Version is not currently supported so the response will be 0xFFFF for that field.

Table ‑92 – APM_HARDWARE_VERSIONS Response Packet Format

ENGAGE devices will not include a hardware version. Value will be read with every byte read as 0xFF.

(*) RSD_SERIAL_NUMBERS (5BH/81H)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5BH
4	Length	32H
5	Data	Sub Command: 81H
6		RSD address: 00H to FEh & not AAH
7-22		Main Serial Number – 16 byte ASCII data
23-38		Reader Serial Number – 16 bytes ASCII data 1
39-54		Radio Serial Number – 16 bytes ASCII data 1
55/56	Frame Check Sequence	CRC or CHECKSUM

Note: The serial number of the Radio module is Not Applicable on an AD-300, so the radio serial number will be returned as 0xFFFFFFFFFFFFFFFF).

Table ‑93 – RSD_SERIAL_NUMBERS Response Packet Format

Gateway will not include a reader serial number or radio serial number. Values will be read with every byte read as 0xFF.

(*) RSD_MANUFACTURE_DATES (5BH/82H)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5BH
4	Length	0EH
5	Data	Sub Command: 82H
6		RSD address: 00H to FEh & not AAH
7-10		Main Manufacture Date
11-14		Reader Manufacture Date 1
15-18		Radio Manufacture Date 1
19/20	Frame Check Sequence	CRC or CHECKSUM

Note: The Manufacture Date is captured in four bytes as binary data where each nibble corresponds to one digit of the day. (Example: 0x20100315 = 2010, March 15); also, Radio Manufacture Date is not currently supported so the radio date will be returned as 0xFFFFFFFF).

Table ‑94 – RSD_MANUFACTURE_DATES Response Packet Format

Gateway will not include a reader manufacture date or radio manufacture date. Values will be read with every byte read as 0xFF.

(*) RSD_HARDWARE_VERSIONS (5BH/83H)

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5BH
4	Length	08H
5	Data	Sub Command: 83H
6		RSD address: 00H to FEh & not AAH
7/8		Main Hardware Version
9/10		Reader Hardware Version 1
11/12		Radio Hardware Version 1
13/14	Frame Check Sequence	CRC or CHECKSUM

Note: Radio Hardware Version is not currently supported so the response will be 0xFFFF for that field.

Table ‑95 – RSD_HARDWARE_VERSIONS Response Packet Format

Gateway will not include a reader hardware version or radio hardware version. Values will be read with every byte read as 0xFF.

(*) AD_RSD_OEM_CODE (36H/8CH)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	04H, 06H, 07H, 08H or 09H
5	Data	Sub Command: 8CH
6		“PIM400” – AD Panel Interface Module “AD300” – AD wired “PIM400-B” – AD Panel Interface Module for use outside North America “AD300-B” – AD wired lock for use for use outside North America “GWE” – ENGAGE Gateway “AD301” – AD wired with FMK reader “AD302” – AD wired main board that is FIPS201-2 compliant
7
8
9
10
11
12
13
11/12/14 12/13/15	Frame Check Sequence	CRC or CHECKSUM

Notes:

Bytes 6-12 contain ASCII values of the character inside the double parenthesis in the description field.
Example: “PIM400” would have 50H, 4DH, 49H, 34H, 30H, 30H returned in bytes 6-12.

Table ‑96 – (+) AD_RSD_OEM_CODE Response Packet Format

(*) AD_APM_OEM_CODE (36H/8BH)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	04H - 09H
5	Data	Sub Command: 8BH
6		“AD300” – AD wired “AD400” – AD wireless “WRI400” – AD wireless reader interface “WPR400” – AD wireless portable reader “WSM400” – AD wireless status monitor “AD400-B” – AD wireless designed for use outside North America “WRI400-B” – AD wireless reader interface designed for use outside North America “WPR400-B” – AD wireless portable reader designed for use outside North America “AD300-B” – AD wired lock for use outside North America “AD401” – AD wireless with FMK reader “AD301”-- AD wired with FMK reader “WPR401”-- AD wireless reader interface with FMK reader “AD402” – AD wireless main board that is FIPS201-2 compliant “AD302” – AD wired main board that is FIPS201-2 compliant “NDE” – NDE lock “ADE” – ADE lock “LEMS” – LE lock indicator only “LEMB” – LE IPB lock “LEMD” – LE Deadbolt lock “BE467” – Schlage Control without interconnect “FE410” = Schlage Control with interconnect “RM” – Remote Monitor (RM) version of RMRU Exit Device “RU” – Remote Undog (RU) version of RMRU Exit Device “NDEB” – NDE 1.1 lock “LEMSB” – LE 1.1 lock indicator only “LEMBB” – LE 1.1 IPB Lock “LEMDB” – LE 1.1 Deadbolt Lock “UNDEFN” – undefined device at this address
7
8
9
10
11
12
13
11/12/13/14 12/13/14/15	Frame Check Sequence	CRC or CHECKSUM

Notes:

Bytes 6-12 contain ASCII values of the character inside the double parenthesis in the description field.
Example: “AD300” would have 41H, 44H, 33H, 30H, 30H, 20H, 20H returned in bytes 6-12.

Table ‑97 – (+) AD_APM_OEM_CODE Response Packet Format

(*) AD_RSD_PARTNER_ID (36H/8EH)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	05H
5	Data	Sub Command: 8EH
6		Partner ID
7
8
9
10/11	Frame Check Sequence	CRC or CHECKSUM

Notes:

Bytes 6-9 contain ASCII values of the character inside the double parenthesis in the description field.
Example: “CBRD” would have 43H, 42H, 52H, 44H returned in bytes 6-9.
We are currently sending 3 bytes, and this can be expanded to send 4 ASCII bytes in the future. Example: “CBD” will have values 43H, 42H, 44H and NULL returned in bytes 6-9.
Not supported by ENGAGE products.

Table ‑98 – (+) AD_RSD _PARTNER_ID Response Packet Format

(*) AD_APM_PARTNER_ID (36H/8DH)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	05H
5	Data	Sub Command: 8DH
6		Partner ID
7
8
9
10/11	Frame Check Sequence	CRC or CHECKSUM

Notes:

Bytes 6-9 contain ASCII values of the character inside the double parenthesis in the description field.
Example: “CBRD” would have 43H, 42H, 52H, 44H returned in bytes 6-9.
We are currently sending 3 bytes, and this can be expanded to send 4 ASCII bytes in the future. Example: “CBD” will have values 43H, 42H, 44H and NULL returned in bytes 6-9.
Not supported by ENGAGE products.

Table ‑99 – (+) AD_APM_PARTNER_ID Response Packet Format

(*) READER_INFORMATION (36H/8FH)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	07H
5	Data	Sub Command: 8FH
6		0=RDR-PROX 1=RDR-MAG 2=RDR-SMART 16= RDR_MAGSW_KPD 17= RDR-FMK(FIPS) 18=RDR-MT 19=RDR-KP 20=RDR_MAG_NO_KPD 21=RDR_MT_NO_KPD 22=RDR_SMART_NO_KPD 23=RDR_PROX_NO_KPD 25=RDR_MAGSW_NO_KPD 31=RDR_Mi_NO_KPD 32=RDR_Mi_WITH_KPD 58=RDR_Si2_WITH_KPD 59=RDR_Si2_NO_KPD 60=RDR_KP2 61=RDR_MT2_WITH_KPD 62=RDR_MT2_NO_KPD 63=RDR_Mi2_WITH_KPD 64=RDR_Mi2_NO_KPD 65=RDR_FM2_WITH_KPD 66=RDR_FM2_NO_KPD (reserved) 67=NDE_MT2_NO_KPD 68=CONTROL_SM2_NO_KPD 69=LE_MT2_NO_KPD 255=No Model Information
7-9		3 bytes for reader firmware version- 1 each for major, minor and build:
10-11		2 Bytes reserved(0x00 always)
12/13	Frame Check Sequence	CRC or CHECKSUM

Notes: If the reader information is not available reader type will be send as \$FF and version string will be \$FF \$FF \$FF.

Example, PIM linked to a AD400/WPR with prox reader and version 2.8.1, will respond as 0A FF 36 07 8F 00 02 08 01 00 00 C7 F9
On FDR PIM will send the reader type and the version info as \$FF only.

Table ‑100 – (+) READER_INFORMATION Response Packet Format

(*) START_FW_DOWNLOAD_RESP (16H/00H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 00H
6		Response Code: 0x00 = No Error: Ready to start download 0x01 = In Progress 0x02-0x2F = Reserved 0x30 = Error: Incorrect message format 0x31 = Error: Already in reflash mode 0x32 = Error: Invalid download target 0x33 = Error: Target does not support ONR 0x34 = Error: WOR not enabled (N/A for Gateway) 0x35 = Error: Target WAPM offline (N/A for Gateway) 0x36 = Error: Target has low batteries 0x37 = Error: Gateway is busy processing the prior command 0x38 = Error: Lock Bitmap includes more than one device type (Gateway Only) 0x39 = Error: Lock Bitmap includes unlinked or unknown device(s) (Gateway Only) 0x3A = Error: Lock Bitmap doesn’t match download target (Gateway Only) 0x3B-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

Table ‑101 – START_FW_DOWNLOAD_RESP Response Packet Format

(*) FW_FILE_BLOCK_RESP (16H/01H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 01H
6		Response Code: 0x00 = No Error: Ready for next block 0x01 = In Progress 0x02-0x3F = Reserved 0x40 = Error: Not in active firmware download session 0x41 = Error: Invalid block size received 0x42 = Reserved 0x43 = Error: Out of sequence block ID 0x44 = Error: Unable to write data to memory 0x45 = Error: Invalid fw file type received (N/A for Gateway) 0x46 = Error: Invalid fw file version received (N/A for Gateway) 0x47 = Error: Invalid block ID received 0x48 = Reserved 0x49 = Error: Buffer full – not ready for data (N/A for Gateway) 0x4A = Error: The command does not support download target (Gateway Only) 0x4B-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

Table ‑102 – FW_FILE_BLOCK_RESP Response Packet Format

(*) LARGE_FW_FILE_BLOCK_RESP (16H/06H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 06H
6		Response Code: 0x00 = No Error: Ready for next block 0x01 = In Progress 0x02-0x3F = Reserved 0x40 = Error: Not in active firmware download session 0x41 = Error: Invalid block size received 0x42 = Reserved 0x43 = Error: Out of sequence block ID 0x44 = Error: Unable to write data to memory 0x45 = Error: Invalid firmware file type received (N/A for Gateway) 0x46 = Error: Invalid firmware file version received (N/A to Gateway) 0x47 = Error: Invalid block ID received 0x48 = Reserved 0x49 = Error: Buffer full – not ready for data (N/A to GWE) 0x4A-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

LARGE_FW_FILE_BLOCK_RESP Response Packet Format

(*) END_FW_DOWNLOAD_RESP (16H/02H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 02H
6		Response Code: 0x00 = No Error: firmware file verified 0x01 = In Progress 0x02-0x44 = Reserved 0x45 = Error: Invalid firmware file type received 0x46 = Error: Invalid firmware file version received (N/A to Gateway) 0x47-0x4F = Reserved 0x50 = Error: Not in active firmware download session 0x51 = Error: CRC validation failed (For the Gateway, this does not apply for Edge Device Firmware) 0x52 = Error: WOR not enabled (N/A for Gateway) 0x53 = Reserved. 0x54 = Error: Gateway processing another ONR command. 0x55 = Error: Gateway failed to transfer firmware image to all targeted device(s). 0x56-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

Table ‑103 – END_FW_DOWNLOAD_RESP Response Packet Format

(*) ABORT_FW_DOWNLOAD_RESP (16H/03H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 03H
6		Response Code: 0x00 = No Error: Aborting download session No Error: Abort action completed (Gateway Only) 0x01 = In Progress (Gateway Only) 0x02-0x5F = Reserved 0x60 = Error: Incorrect message format 0x61 = Error: Busy with other ONR target 0x62 = = Error: Lock Bitmap includes more than one device type (Gateway Only) 0x63 = Error: Lock Bitmap includes unlinked or unknown edge device(s) (Gateway Only) 0x64-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

Table ‑104 –ABORT_FW_DOWNLOAD_RESP Response Packet Format

(*) START_FW_REFLASH_RESP (16H/04H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 04H
6		Response Code: 0x00 = Reserved 0x01 = In Progress 0x02-0x6F = Reserved 0x70 = Error: Incorrect message format 0x71 = Error: Invalid reflash target 0x72 = Error: No valid fw file downloaded 0x73 = Error: Fw file in process of being verified (N/A for Gateway) 0x74 = Error: Busy with other ONR activity 0x75 = Error: WOR not enabled (N/A for Gateway) 0x76 = Error: Reflash Failed 0x77: = Error: Lock Bitmap includes more than one device type (Gateway Only) 0x78 = Error: Lock Bitmap includes unlinked or unknown device(s) (Gateway Only) 0x79 = Error: Device has a low battery 0x7A-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

Table ‑105 –START_FW_REFLASH_RESP Response Packet Format

(*) ONR_STATUS (16H/05H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	05H
5	Data	Sub Command: 05H
6		Status Identifier:* 0x00 = Start firmware download 0x01 = Send firmware file block 0x02 = End firmware download 0x03 = Abort firmware download 0x04 = Start firmware reprogramming 0x05 = Reserved 0x06 = Send large firmware file block 0x07-0xFF = Reserved
7		Status Code:* 0x00 = Ready 0x01 = In Progress 0x02 = In Progress, but waiting on WOR to be enabled (N/A for Gateway) 0x03-0x0F = Reserved 0x10 = Target WAPM currently offline (N/A for Gateway) 0x11 = Resend previous fw file block 0x12-0x20 = Reserved 0x21 = Error: Power cycle occurred 0x22 = Error: Unknown Issue 0x23 = Error: Reader not responding to ONR command (N/A for Gateway) 0x22-0x31 = Reserved 0x32 = Error: Invalid start fw download target received 0x33 = Error: Target does not support ONR download (N/A for Gateway) 0x34 = Error: WOR is not enabled, unable to send start fw download request to target (N/A for Gateway) 0x35 = Reserved 0x36 = Error: Target has low batteries 0x37-0x42 = Reserved 0x43 = Error: Out of sequence block ID 0x44 = Error: Unable to write data to memory 0x45 = Error: Invalid fw file type received 0x46 = Error: Invalid fw file version received (N/A for Gateway) 0x47 = Error: Invalid block ID received 0x48 = Error: WOR is not enabled, unable to send fw file block request to target (N/A for Gateway) 0x49-0x50 = Reserved 0x51 = Error: CRC validation failed (Gateway: Applies only to the Gateway firmware file) 0x52 = Error: WOR is not enabled, unable to send end fw download request to target (N/A for Gateway) 0x55 = Error: Gateway fail;ed to transfer firmware image to all targeted devices. 0x56-0x74 = Reserved 0x75 = Error: WOR is not enabled, unable to send start fw reflash request to target (N/A for Gateway) 0x76 = Error: WAPM reflash timed out 0x77-0xFF = Reserved
8		Lock Bit Map Low Byte** Bit0 = 1st lock on the PIM. Bit Value = 1: If StatusCode = In Progress, this lock is being processed. If StatusCode = Error, this lock returned an error. If StatusCode = Ready, this lock is active in this activity and ready. Bit Value = 0: If StatusCode = In Progress, this lock has finished processing and not cause of this In Progress status If StatusCode = Error, this lock is not the cause of Error status. If StatusCode = Ready, this lock is not involve in this activity.
9		Lock Bit Map High Byte** Bit0 = 9th lock on the PIM. Same definition as Byte 8
10/11	Frame Check Sequence	CRC or CHECKSUM

*The Status Identifier represents the next expected message in the ONR process if the Status Code is set to 0x00(READY). Otherwise, the Status Identifier represents the current message being processed or the message associated with the error.

**These bytes only have significance if the current download/reflash target is an AD-400 or a reader that is attached to an AD-400. If the download/reflash target device that is not one of these then these bytes will be sent as 0x00 and should be ignored.

Table ‑106 –START_FW_REFLASH_RESP Response Packet Format

(*) RSD_DIAGNOSTICS_CONFIGURATION (51H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	51H
4	Length	01H
5	Data	00H = Configuration Setting Successful (No Error) 01H = Configuration Setting Unsuccessful (Error) 02H-FFH = Reserved
6/7	Frame Check Sequence	CRC or CHECKSUM

Table ‑107 – RSD_DIAGNOSTICS_CONFIGURATION Response Packet Format

(*) RSD_SECURE_MODE_STATUS_RESP (21H/08H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	RSD address	FFH
3	Type	21H
4	Length	03H
5	Data	Byte 1	Sub command: 08H
		Byte 2	Secure Mode Status Byte
			Bit 7	RFU (will be zero)
			Bit 6	RFU(will be zero)
			Bit 5	Selected Default Key 1 – ACP Default Key is selected 0 – Allegion Default Key is selected
			Bit 4	Master key info 0 – Master key is not set 1 – Master key is set
			Bit 3	Default key info 1 – ACP Default Key is set. 0 – ACP Default key is not set.
			Bit 2	Admin Session info 0 – Admin Session Not Active 1 – Admin Session Active
			Bit 1	Normal Session info 0 – Normal Session Not Active 1 – Normal Session Active
			Bit 0	Secure Mode Info 0 – Disable 1 – Enable
		Byte 3	Error Code 0x00 = No error 0x01 = Error Session not established 0x02 = Error command not supported during current session 0x03 = RFU 0x04 = Error unencrypted command not allowed 0x05 = Error Session terminated due to session timeout 0x06 = Error session terminated due to send sequence number roll over 0x07 – 0x0F = RFU 0x10 = Error START_SECURE_SESSION length invalid 0x11 = Error START_SECURE_SESSION session type is invalid 0x12 = Error START_SECURE_SESSION Normal session creation is not allowed 0x13 – 0x1F = RFU 0x20 = Error START_SECURE_SESSION_ACK length invalid 0x21 = Error START_SECURE_SESSION_ACK random number mismatch 0x22 – 0x2F = RFU 0x30 = Error SECURE_HOST_CONFIG length invalid 0x31 = Error SECURE_HOST_CONFIG incorrect secure mode configuration value 0x32 = Error SECURE_HOST_CONFIG session timeout cannot be zero 0x33 = Error SECURE_HOST_CONFIG ACP Default Key is not set, cannot configure RSD to use the ACP Default Key 0x34 – 0x3F = RFU 0x40 = Error Encrypted Command length invalid 0x41 = Error Encrypted Command Session terminated due to sequence number mismatch 0x42 = Error Encrypted Command Secure CRC mismatch 0x43 = Error Encrypted Command Session terminated due to consecutive three times Secure CRC mismatch 0x44 = Error Encrypted Command Session terminated due to received sequence number roll over 0x45 – 0x4F = RFU 0x50 = Error SET_ACP_KEY length invalid 0x51 = Error SET_ACP_KEY Key Type invalid 0x52 – 0x5F = RFU 0x60 = Error GET_RSD_RSIENCRYPTION_STATUS length invalid 0x61 – 0xFF = RFU
8/9	Frame check sequence	CRC or CHECKSUM

Table ‑108 – RSD_SECURE_MODE_STATUS_RESP Response Packet Format

(*) RSD_START_SECURE_SESSION_CHALLENGE (21H/01H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	RSD address	FFH
3	Type	21H
4	Length	11H
5	Data	Byte 1	Sub command: 01H
		Byte 2-17	Encrypted and Permuted RSD Random Number.
22/23	Frame check sequence	CRC or CHECKSUM

Table ‑109 – RSD_START_SECURE_SESSION_CHALLENGE Response Packet Format

(*) RSD_START_SECURE_SESSION_COMPLETE (21H/02H)

byte	Field	Data/Description
1	Start of Frame	0AH
2	RSD address	FFH
3	Type	21H
4	Length	11H
5	Data	Byte 1	Sub command: 02H
		Byte 2-17	Encrypted and Permuted ACP Random Number.
22/23	Frame check sequence	CRC or CHECKSUM

Table ‑110 – RSD_START_SECURE_SESSION_COMPLETE Response Packet Format

(*) RSD_SECURE_RESPONSE (2FH)

byte	Field	Data/Description
1	Start of Frame	0AH
2	RSD address	FFH
3	Type	2FH
4	Length	Variable (always be in multiple of 16)
5 – n	Data	Encrypted Original Response
n+1/n+2	Frame check sequence	CRC or CHECKSUM

Table ‑111 – RSD_SECURE_RESPONSE Response Packet Format

(*) APM_PIV_GEN_AUTH_RESPONSE (79H | F9H)

When the length of the message data exceeds 255 bytes the Type field changes to F9H to indicate a 2-byte Length field. The optional 2nd Length byte will be inserted at Byte 5. Byte 4 will the Length LSB, and Byte 5 will be Length MSB

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	F9H ( 79H is the actual message type, but the MSB bit is set to represent that this message has a two byte length field. Please refer section 1.3.3.3 for more details. )
4	Length LSB	Variable (Min: 03H Max: 103H)
5	Length MSB
6	APM Address	Address of the APM that is providing the response
7 through N	Data[0]-Data[X]	Authentication Response Data (LSB sent first with maximum length of 256 bytes in a single message)
N+1/N+2	Frame Check Sequence	CRC or CHECKSUM

Table 1-112 APM_PIV_GEN_AUTH_RESPONSE Response Packet Format

(*) APM_PIV_GEN_AUTH_ACK/ERR (7AH)

byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	7AH
4	Length	Variable (Min: 03H Current Max: 05H)
5	APM Address	Address of the APM that is providing the response
6	Error Type	Error Type: 0x00 = No Error 0x01 = PIV card error 0x02 = Gen Auth Timeout 0x03 = Gen Auth Challenge Too Large (256 byte max) 0x04 = FIPS Incompatible 0x05 = Command Not Supported 0x06 = Gen Auth Challenge Mismatch 0x07 = Non-FIPS Reader 0x08 = Non-FIPS Reader version 0x09-0xFF = Reserved
7	Detailed Error Code Length	Number of bytes of detailed error code information that will be sent (if 0 then no detailed error code bytes will follow)
8 through N	Detailed Error Code	Detailed information about the error. Number of bytes depends on the previous byte in the message, current maximum of bytes to expect is 2, but that could change in the future.
N+1/N+2	Frame Check Sequence	CRC or CHECKSUM

Table 1-20 PIV_Gen_Auth_Ack/Error Command Packet Format

NEXT_DATALOG Data Field Formats

This section details the data field portion of a NEXT_DATALOG response from the RSD to the ACP.

NOTES:

The data field portion of the NEXT_DATALOG response is always 18 bytes long.
The RSD does not do any time stamping; therefore the time stamp field is always 0 filled.
For the AD-series devices, the NEXT_DATALOG response is supported only by PIM-RSI/PIM-SBB (VBB). Also, this response only provides the “Transaction Buffer Empty” and “Identity verified” Datalog Formats.
For ENGAGE products, NEXT_DATALOG is not supported.

Transaction Buffer Empty

The Transaction Buffer Empty datalog is sent when an APM receives a GET_APM_DATALOG or GET_PREVIOUS_APM_DATLAOG command from the ACP and the APM has no datalog to send. In other words, the APM had not set the “Datalog Ready” bit in the APM_STATUS or RSD_STATUS response.

byte	field	description
byte1	address	address of APM generating datalog
byte2	timestamp	0
byte3		0
byte4		0
byte5		0
byte6		0
byte7		0
byte8	format	00H
byte9	data1	0
byte10		0
byte11		0
byte12		0
byte13		0
byte14	data2	0
byte15		0
byte16		0
byte17		0
byte18		0

Table ‑113 – Transaction Buffer Empty Datalog

Identity Verified

The Identity Verified datalog is sent when a card has been swiped or presented at the APM’s card reader. This datalog contains the data read from the card.

byte	field	description
byte1	address	address of APM generating datalog
byte2	timestamp	0
byte3		0
byte4		0
byte5		0
byte6		0
byte7		0
byte8	format	07H
byte9	data1	Card data read at APM, either Wiegand or magnetic data, first 80 bits, format depends on which card conversion is being used
byte10
byte11
byte12
byte13
byte14	data2
byte15
byte16
byte17
byte18

Table ‑114 – Identity Verified Datalog

Door Forced Open

The Door Forced Open datalog is sent when a door position switch has indicated that the door has been opened (i.e. door position switch goes from low to high) when it was not shunted and it was locked.

byte	field	Description
byte1	address	address of APM generating datalog
byte2	timestamp	0
byte3		0
byte4		0
byte5		0
byte6		0
byte7		0
byte8	format	0DH
byte9	data1	0
byte10		0
byte11		0
byte12		0
byte13		0
byte14	data2	0
byte15		0
byte16		0
byte17		0
byte18		0

Table ‑115 – Door Forced Open Datalog

Tamper Activated

The Tamper Activated datalog is sent when a APM has detected one of six different types of trouble that need attention. This datalog contains information identifying the exact cause of the trouble.

byte	field	Description
byte1	address	address of APM generating datalog
byte2	timestamp	0
byte3		0
byte4		0
byte5		0
byte6		0
byte7		0
byte8	format	0EH
byte9	0	data1	Reader Tamper
	1		Low Battery
	2		Loss of RF Communication
	3		RSD Tamper or if the ENGAGE Gateway, a mobile application is connected
	4
	5		Motor Stall
	6		(+) Lock Clutch Position
	7
byte10		0
byte11		0
byte12		0
byte13		0
byte14	data2	0
byte15		0
byte16		0
byte17		0
byte18		0

Table ‑116 – Tamper Activated Datalog

Request to Exit Activated

The Request to Exit Activated Verified datalog is sent when the APM’s request to exit switch is activated (i.e. closed, goes from high to low).

byte	field	description
byte1	address	address of APM generating datalog
byte2	timestamp	0
byte3		0
byte4		0
byte5		0
byte6		0
byte7		0
byte8	format	12H
byte9	data1	0
byte10		0
byte11		0
byte12		0
byte13		0
byte14	data2	0
byte15		0
byte16		0
byte17		0
byte18		0

Table ‑117 – Request to Exit Activated Datalog

Door Open Too Long

The Door Open too Long datalog is sent by the APM when the APM’s door is held open too long after being unlocked.

byte	field	description
byte1	address	address of APM generating datalog
byte2	timestamp	0
byte3		0
byte4		0
byte5		0
byte6		0
byte7		0
byte8	format	1FH
byte9	data1	0
byte10		0
byte11		0
byte12		0
byte13		0
byte14	data2	0
byte15		0
byte16		0
byte17		0
byte18		0

Table ‑118 – Door Open Too Long Datalog

Appendix

CRC Generator Program

The following C functions create and use a CRC lookup table. The output of this program is text for a statically initialized array that you may include in your program. The test cases verify that the lookup function works.

#include <stdio.h>

static unsigned table[256];

void PrintTable(void);

void BuildXMODEM(void);

unsigned XMODEMcrc(unsigned char byt, unsigned crc);

unsigned crc_buf(unsigned char *buf, unsigned length, unsigned crc);

void main(void)

{

unsigned crc;

printf("/* XMODEM crc table */\n");

BuildXMODEM();

/* Do this only once.*/

/* No need to do this at all if the array is statically initialized. */

PrintTable();

crc = 0;/* It is important to initialize the CRC! */

crc = XMODEMcrc('M', crc);

if (crc != 0x9969)

printf("Test case 1 failed. crc = %04X.\n", crc);

crc = 0;

crc = XMODEMcrc('T', crc);

if (crc != 0x1A71)

printf("Test case 2 failed. crc = %04X.\n", crc);

crc = 0;

crc = XMODEMcrc('T', crc);

crc = XMODEMcrc('H', crc);

crc = XMODEMcrc('E', crc);

if (crc != 0x1E0A)

printf("Test case 3 failed. crc = %04X.\n", crc);

crc = 0;

crc = crc_buf("1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ", 36, crc);

crc = crc_buf("abcdefghijklmnopqrstuvwxyz!\@#\$%\^&*()", 36, crc);

if (crc != 0xA18A)

printf("Test case 4 failed. crc = %04X.\n", crc);

}

void PrintTable(void)

/* Print the table for including in a C program. */

{

int i;

printf("unsigned table[256] = \n{\n");

for (i=0; i < 256; I++)

{

if ((i % 8) == 0)

putchar('\t');

printf("0x%04X, ", table[i]);

if (((i+1) % 8) == 0)

putchar('\n');

}

printf("};\n\n");

}

void BuildXMODEM(void)

/* Initialize the table at run-time */

{

int i;

unsigned char z;

for (i=0; i < 256; I++)

{

z = i \^ (i >> 4);

table[i] = z \^ ((unsigned)z << 5) \^ ((unsigned)z << 12);

}

}

unsigned XMODEMcrc(unsigned char byt, unsigned crc)

/* Update the CRC with a new byte */

{

crc = (crc << 8) \^ table[byt \^ (crc >> 8)];

return crc;

}

unsigned crc_buf(unsigned char *buf, unsigned length, unsigned crc)

/* Calculate the crc of a buffer full of characters */

{

while (length--)

{

crc = XMODEMcrc(*buf, crc);

buf++;

}

return crc;

}

For ENGAGE products, the credential inquiry timeout is defined by 100ms*[First_Delay + (Subsequent_Delay*Retry_Times)] Different combinations resulting in the same final value will result in the same credential inquiry; however it will not change the communication interval between wireless APMs and the Gateway during the inquiry timeout. ↩
For the ENGAGE Gateway, ACP_COMMUNICATIONS_TIMEOUT will be a global change that affects all APMs linked to that Gateway. ↩
Power failure for AD300 and bad/critical battery for AD400 have a higher priority than “Failure mode for communications loss” ↩

RS-485_Protocol_Specification

AD-SERIES and ENGAGE RSI

RS-485 Protocol Specification

REVISION CONTROL RECORD
VERSION	DATE	DESCRIPTION OF CHANGE	AUTHOR
X0	02/22/2009	Preliminary in house release for comments	Ron Taylor
X1	04/30/2009	Commands added: SET_APM_WOR_CONFIGURATION, GET_APM_WOR_CONFIGURATION, RSD_WOR_WAKEUP, SET_APM_UI_CONFIGURATION, REFLASH_RSD, REFLASH_APM, REFLASH_READER, SET_APM_DATABASE, GET_APM_DATABASE, SET_APM_KEYPAD_CONFIGURATION, GET_APM_KEYPAD_CONFIGURATION, SET_APM_MAGNETIC_CONFIGURATION, GET_APM_MAGNETIC_CONFIGURATION, SET_APM_PROXIMITY_CONFIGURATION, GET_APM_PROXIMITY_CONFIGURATION, SET_APM_SMARTCARD_CONFIGURATION, GET_APM_SMARTCARD_CONFIGURATION, SET_ENCRYPTION_CONFIGURATION, GET_ENCRYPTION_CONFIGURATION, SET_APM_IPB_CONFIGURATION, GET_APM_IPB_CONFIGURATION, GET_APM_BATTERY_STATUS, GET_APM_PEDIGREE, GET_APM_STATISTICS Responses added: APM_WOR_CONFIGURATION, APM_UI_CONFIGURATION, RSD_REFLASH_STATUS, APM_REFLASH_STATUS, READER_REFLASH_STATUS, APM_DATABASE_STATUS, APM_DATABASE, APM_KEYPAD_CONFIGURATION, APM_MAGNETIC_CONFIGURATION, APM_PROXIMITY_CONFIGURATION, APM_SMARTCARD_CONFIGURATION, APM_IPB_CONFIGURATIOIN, APM_BATTERY, APM_PEDIGREE, APM_STATISTICS	Ron Taylor
X2	07/16/2009	Changed byte 10 of SET_RSD_CONFIGURATION to accommodate Next Gen DCS, added SET_RSD_CHANNEL command & RSD_CHANNEL response, added “PIN Required” function to APM_LOCK_CONTROL command,	Ron Taylor
X2.1	09/21/2009	Added notation for new commands (*) and modified commands (+) for customers who are familiar with WA1G protocol	Todd Eberwine
3.0	09/29/2009	Changed page format to Allegion template Moved revision history to front Removed title page Re-formatted table of contents Re-formatted table captions Added AD OEM codes to OEM_CODE response Modified type & sub command data in RSD_CHANNEL response Added GET_RSD_FULL_CONFIGURATION command Added PIM_FULL_CONFIGURATION response Added SET_NEXT_GEN_APM_CONFIGURATION command Added SET_NEXT_GEN_APM_CONFIGURATION response Added GET_NEXT_GEN_APM_CONFIGURATION command Added NEXT_GEN_APM_CONFIGURATION response Changed RSD_STATUS_CARDDATA minimum Length from 1 to 7 Changed GET_APM_BATTERY_STATUS command Changed APM_BATTERY_STATUS response Deleted (these commands were concatenated into the NEXT_GEN_APM_CONFIGURATION commands): SET_APM_UI_CONFIGURATION, GET_APM_UI_CONFIGURATION, SET_APM_KEYPAD_CONFIGURATION, GET_APM_KEYPAD_CONFIGURATION, SET_APM_MAGNETIC_CONFIGURATION, GET_APM_MAGNETIC_CONFIGURATION, SET_APM_PROXIMITY_CONFIGURATION, GET_APM_PROXIMITY_CONFIGURATION, SET_APM_SMARTCARD_CONFIGURATION, GET_APM_SMARTCARD_CONFIGURATION, SET_APM_IPB_CONFIGURATION, GET_APM_IPB_CONFIGURATION commands Deleted (these responses were concatenated into the NEXT_GEN_APM_CONFIGURATION responses): APM_UI_CONFIGURATION, APM_KEYPAD_CONFIGURATION, APM_MAGNETIC_CONFIGURATION, APM_PROXIMITY_CONFIGURATION, APM_SMARTCARD_CONFIGURATION, APM_IPB_CONFIGURATION responses	Ron Taylor
3.1	10/10/2009	Deleted SET_APM_WOR_CONFIGURATION, GET_APM_WOR_CONFIGURATION, RSD_WOR_WAKEUP commands Deleted APM_WOR_CONFIGURATION response Added SET_RSD_WOR, SET_WOR_WAKEUP, GET_WOR_WAKEUP_STATUS command Added RSD_WOR, WOR_WAKEUP, WOR_WAKEUP_STATUS response Added WOR byte to RSD_FULL_CONFIGURATION response Added TBD date on GET_APM_STATISTICS, APM_STATISTICS, REFLASH_APM, REFLASH_READER, RSD_REFLASH, APM_REFLASH_STATUS, READER_REFLASH_STATUS, RSD_REFLASH_STATUS, SET_ENCRYPTION_CONFIGURATION, GET_ENCRYPTION_CONFIGURATION, GET_APM_PEDIGREE, APM_PEDIGREE commands/responses Deleted SET_APM_DATABASE, GET_APM_DATABASE, APM_DATABSE_STATUS, APM_DATABASE commands/responses	Ron Taylor
3.2	10/19/2009	Added to note for APM_LOCK_CONTROL: with the data byte = 1 Added optional 2nd and 3rd data bytes to APM_LOCK_CONTROL Corrected error in deadbolt position status in APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses Added request to enter status bit to APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses Added latch bolt monitor status bit to APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses Corrected table reference in SET_NEXT_GEN_APM_CONFIGURATION command Added WPR400 & WSM400 to OEM code table Added/changed Request to Enter, IPB online configuration, IPB offline configuration, IPB long button press, ACP communications timeout, WOR timeout, Beeper enable/disable, Smartcard enable/disable, maximum cache entries, battery failure mode in NEXT_GEN_APM_CONFIGURATION structure table	Ron Taylor
3.3	10/22/2009	Changed WOR Timeout to “0-10 (default=10, disabled=0)” in Next Generation Lock APM/Reader Configuration Structure Table, byte 13 Removed Beeper on/off modes in bits 1 & 2 in Next Generation Lock APM/Reader Configuration Structure Table, byte 27 Removed IPB beeper control in bit 7 in APM_LOCK_CONTROL Command byte 7 Added RSD_ENCRYPTION_CONFIGURATION response Fixed cross reference errors Removed TBD date on GET_APM_STATISTICS, APM_STATISTICS, REFLASH_APM, REFLASH_READER, RSD_REFLASH, APM_REFLASH_STATUS, READER_REFLASH_STATUS, RSD_REFLASH_STATUS, SET_ENCRYPTION_CONFIGURATION, GET_ENCRYPTION_CONFIGURATION, GET_APM_PEDIGREE, APM_PEDIGREE commands/responses	Ron Taylor
3.4	11/09/2009	Bit reassignment in APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses	Ron Taylor
3.5	01/08/2010	APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA responses: edited critical battery/REN function/comments, changed comments on Trouble bit, changed comments on Cache Status bit, added AD-300 Data Type to Low Lithium Battery bit RSD_FULL_CONFIGURATION response: correct Length byte to 0CH NEXT_GEN_APM_CONFIGURATION response: updated Keypad Output Format descriptions, updated Number of Keys to Buffer descriptions, updated PIN-Required LED Mode descriptions GET_WOR_WAKEUP_STATUS command: corrected byte designations for Frame Check Sequence Added GET_FIRMWARE_VERSION command & FIRMWARE_VERSION response (previously undocumented 1G command/response) Added GET_FULL_FIRMWARE_VERSION command & FULL_FIRMWARE_VERSION response RSD_STATUS_CARDDATA response: changed bit range to 4-255 (data section byte6)	Ron Taylor
3.6	04/06/2010	Version number only change for internal Allegion record keeping	Paul Avgerinos
3.7	04/26/2010	Version number only change for internal Allegion record keeping	Paul Avgerinos
3.8	12/15/2010	Modified Address paragraph regarding use of broadcast packets Modified Type paragraph regarding use of 2 byte length field Modified Data paragraph for 65535 maximum byte of data Modified Frame Check Sequence paragraphs removing recommendations Modified Character Timeout paragraph removing baud rate independence sentence Modified sentence in Commands for Addressing APM section Modified APM_LOCK_CONTROL command note for “timed unlock”, added WRI400 for aux relay Modified APM_TIMED_UNLOCK command note for “timed unlock” Modified SET_APM_CONFIGURATION command note for better explanation of the Configuration Mode bit, Card Format does not apply to AD series, Modified SET_NEXT_GEN_APM_CONFIGURATION command note for better explanation of the Configuration Mode bit Modified SET_RSD_CONFIGURATION command notes to indicate which fields apply to PIM400-485 and/or AD-300 Added SET_LINK command description Re-formatted command/response table so that only section levels 1, 2, & 3 are included in the TOC Added WAPM n type “05 = AD-401” in FIRMWARE_VERSION and FULL_FIRMWARE_VERSION responses Changed OEM_CODE response back to 1G WA version for legacy compatibility Added the following commands: GET_AD_APM_OEM_CODE GET_AD_RSD_OEM_CODE GET_SERIAL_NUMBER GET_MANUFACTURE_DATE GET_HARDWARE_VERSION GET_PIM_TYPE Added the following responses: AD_APM_OEM_CODE AD_RSD_OEM_CODE SERIAL_NUMBER MANUFACTURE_DATE HARDWARE_VERSION PIM_TYPE	Ron Taylor
3.9	04/21/2011	Changed AD_APM_OEM_CODE response: Removed (AD300CY, AD300MS, AD300MD, AD300EX, AD301CY, AD301MS, AD FIPS-201, AD301MD, AD301EX, AD400CY, AD400MS, AD400MD, AD400EX, AD401CY, AD401MS, AD401MD, AD401EX); Added (AD300 & AD400); Changed type from 47H to 36H; Changed AD_RSD_OEM_CODE response: Removed (AD300CY, AD300MS, AD300MD, AD300EX, AD301CY, AD301MS, AD301MD, AD301EX); Added (AD300); Changed type from 47H to 36H; Changed SET_WOR_WAKEUP command: byte7, bit0 is the 9th lock on the PIM not the 8th; Changed SET_RSD_CONFIGURATION command: byte10, bit3 & bit 4 set to reserved; Edited the Address paragraph: added RSD Address Space and APM Address Space sections; Updated APM_LOCK_CONTROL IPB/Schlage blink extensions; Changed SET_NEXT_GEN_APM_CONFIGURATION data to add “Forced Heartbeat after WoR event”; Changed SET_NEXT_GEN_APM_CONFIGURATION Response to correct values (Type from 47H to 36H; Subcommand from 05H to 84H); Updated SET/GET_NEXT_GEN_APM_CONFIGURATION to include keypad formats 11 (ASCII) and 12 (32-bit Wiegand); Corrected Table reference numbers; Added “clear cache entries” switch to byte 9, bit 0 of NEXT_GEN_APM_CONFIGURATION (for SET only); Added latch for IPB and ATK into APM_STATUS, RSD_STATUS_CHANGE, RSD_STATUS_CARDDATA; Added APM Address to AD_APM_OEM_CODE; Added commands for Serial Number / Manufacture Date and Hardware Versions for APM and RSD; Removed reference to RSI hand-reader commands (same as xxx);	Ron Taylor / Todd Eberwine / Joe Baumgarte
3.91	10/25/2011	Added Request to Enter Level to NEXT_GEN_APM_CONFIGURATION Added note for AD-300 radio module serial number being N/A. Added type 06 and 07 in FIRMWARE_VERSION for the WRI401 and WPR401 respectively. Added Brazil updates for: SET_RSD_CONFIGURATION, SET_RSD_CHANNEL, RSD_CONFIGURATION, RSD_FULL_CONFIGURATION, RSD_CHANNEL, FIRMWARE_VERSION, FULL_FIRMWARE_VERSION, AD_RSD_OEM_CODE, and AD_APM_OEM_CODE Added “0 = no state change” for APM_LOCK_CONTROL command in order to send UI with no lock command attached.Added note to APM_LOCK_CONTROL to clarify Schlage and IPB LED pattern disable message requirements	J. Baumgarte B. Allen
3.92	12/12/2011	Removed “0 = no state change” for APM_LOCK_CONTROL Changed GET_NEXT_GEN_APM_CONFIGURATION to RSD Address instead of APM Address Changed SET_NEXT_GEN_APM_CONFIGURATION RESPONSE, RSD_WOR, WOR_WAKEUP, WOR_WAKEUP STATUS & APM_BATTERY_STATUS Address field to FFH. Cleaned up Address field naming to specify RSD Address for FFH Changed APM_CONFIGURATION and NEXT_GEN_APM_CONFIGURATION bits to reflect AD400 implementation.	B. Allen
3.93	02/08/2012	Corrected the Fail Safe Configuration Values in byte16 of Next Generation Lock APM/Reader Configuration Structure to match the firmware behavior Updated with PIV card format support Updated with Partner ID support Updated Next Generation Lock APM/Reader Configuration Structure with WRI Reader Configuration Structure Added a note to indicate that addresses 0xAA and 0xFF are reserved and not to be used as RSD or APM Address.	Arun M Kamath
3.94	03/20/2012	APM_LOCK_CONTROL command updated with NO STATE CHANGE option	Lakshmi S
3.95	03/23/2012	APM_LOCK_CONTROL command updated for WRI beeper configuration NEXT_GEN_APM_CONFIGURATION updated to add iClass format configuration and a bit to indicate AD reader configuration done by presenting configuration card Reader format configuration bytes are marked as reserved in the WRI reader configuration table	Lakshmi S
3.96	05/31/2012	Corrected the Prox GE reader configuration details	Lakshmi S
3.97	06/12/2012	Update spec to catchup with existing lock functionality. Change info for Next Generation Lock APM/Reader Configuration Structure: - Byte25 - Add of PIV Format 15 - Byte24 - Add bit 7 for PIV 200bit - Byte24 – Change bit 3 to state for 75bit Update spec per changes for MiK (iClassSE capable) Reader Support. Change info for Next Generation Lock APM/Reader Configuration Structure: - Byte24 – Change bit 4 to be iClassSE. Was assigned for ISOX Secure (15693), but was never used.	John Wolfe
3.98	06/27/2012	APM_LOCK_CONTROL message specification updated for WRI beeper frequency (Changed 100msec to 200msec)	Lakshmi S
3.99	01/20/2013 01/24/2013	Format changes only. Added Type/SubCmd to Packet Names and also added hyperlinks to Table 1-2 for easy/quick referencing. Added back a header which was accidentally removed.	John Wolfe
4.00	02/12/2013	Changed max Backlight Timeout from 31 to 15 sec in Next Generation Lock APM to reflect actual limit of AD locks. (IR TTP 5006)	John Wolfe
4.01	07/23/2013	Added the new RSI command GET_READER_INFO and the response READER_INFORMATION. (IR TTP 4979)	Ancy Joseph
4.02	12/10/2013	Added all Over the Network Reprogramming (ONR) related commands and responses. This includes changes to the SET_RSD_CONFIGURATION command to enable/disable extended status reporting. Added new extended status responses: (APM_STATUS_EXTENDED, RSD_STATUS_IDLE_EXTENDED, RSD_STATUS_CHANGE_EXTENDED, RSD_STATUS_CHANGE_CARDDATA_EXTENDED) (IR TTP 4420)	Josh Piron
4.03	01/03/2014	Added a note in the “APM_LOCK_CONTROL” command to always send the “reserved” bits as zero. (IR TTP 5162)	Shivakumar Sillin
4.04	01/06/2014	Modifications to ONR related commands based on review feedback (IR TTP4420)	Josh Piron
4.05	01/15/2014	Re-branding to Allegion	Ron Taylor
4.06	06/20/2014	Adding details to support MTK2 reader type	Josh Piron
4.07	06/27/2014	1. Addition of new command/response for Diagnostics Mode Configuration for the PIM-RSI and PIM-SBB. This message allows the ACP to enable or disable the following: - Credential data from being displayed on the Diagnostics Mode screen on the SUS. - Momentary access on the lock via PIM, using the Diagnostics Mode. Command: SET_RSD_DIAGNOSTICS_CONFIGURATION Response: RSD_DIAGNOSTICS_CONFIGURATION 2. Addition of the “FDR Information” and “WOR Lock/Unlock Status” bits for the PIM product in the following response messages: - APM_STATUS_EXTENDED - RSD_STATUS_CHANGE_EXTENDED - RSD_STATUS_CARDDATA_EXTENDED 3. Corrected the Comm Loss failure byte values to: ..01=fail locked and ..10=fail unlocked, in the APM_CONFIGURATION (32H) response.	Sanjay Hegde
4.08	09/07/2014	Added Beeper control for APM_TIMED_UNLOCK command, only for WRI400.	Sandeep M
4.09	09/14/2014	Added Secure Communication (Encryption) related commands and responses	Ankit Patel
4.10	10/01/2014	Adding proposals for adoption of ENGAGE product lines. Updated commands with new options or clarifications made: - GET_AD_APM_PARTNER_ID (47H/0DH) - SET_RSD_CONFIGURATION (77H) - (*) SET_RSD_CHANNEL (02H/01H) - SET_RSD_WOR (47H/07H) - GET_AD_RSD_PARTNER_ID (47H/0EH) - START_FW_DOWNLOAD (15H/00H) - START_FW_REFLASH (15H/04H) - APM_STATUS (30H) - APM_STATUS_EXTENDED (33H) - RSD_STATUS_CHANGE (31H) - RSD_STATUS_CHANGE_EXTENDED (34H) - RSD_STATUS_CARDDATA (31H) - RSD_STATUS_CARDDATA_EXTENDED (34H) - RSD_CONFIGURATION (53H) - RSD_FULL_CONFIGURATION (36H/82H) - RSD_CHANNEL (36H/81H) - RSD_WOR (36H/87H) - FIRMWARE_VERSION (41H) - FULL_FIRMWARE_VERSION (36H/8AH) - APM_SERIAL_NUMBERS (5AH/81H) - APM_MANUFACTURE_DATES (5AH/82H) - APM_HARDWARE_VERSIONS (5AH/83H) - RSD_SERIAL_NUMBERS (5BH/81H) - RSD_MANUFACTURE_DATES (5BH/82H) - RSD_HARDWARE_VERSIONS (5BH/83H) - AD_RSD_OEM_CODE (36H/8CH) - AD_RSD_OEM_CODE (36H/8CH) - AD_APM_OEM_CODE (36H/8BH) - AD_RSD_PARTNER_ID (36H/8EH) - AD_APM_PARTNER_ID (36H/8DH) - READER_INFORMATION (36H/8FH)	Zeb GrandPre
4.11	02/04/2015	Updated following commands for FIPS product types. - RSD_CONFIGURATION - RSD_FULL_CONFIGURATION - FULL_FIRMWARE_VERSION - FIRMWARE_VERSION - AD_APM_OEM_CODE - AD_RSD_OEM_CODE Added note in section 1.9 for Data log format for AD devices	Pradyuman A
4.12	02/10/2015	Further clarifying differences between AD and ENGAGE products: - Added notes to APM_TIMED_UNLOCK and APM_TIMED_UNLOCK - Added notes to APM configuration tables, Table 1-12 and Table 1-80 - Add column indicating which RSI commands apply to the ENGAGE Gateway’s commands. - Added definition of gateway - Modified the definition of firmware commands to indicate that gateways only support	Joe Baumgarte / Zeb GrandPre
4.13	03/05/2015	Removed draft notation, 4.13 is a released version	R. Taylor
4.14	06/04/2015	Adding new response code definition to ONR_STATUS response	Josh Piron
4.15	06/11/2015	- Modified APM_TIMED_UNLOCK acceptable range from 1 to 255 seconds, removing 0 as an acceptable time to unlock. - Modified note for ENGAGE products on SET_RSD_WOR to specifically state 5 as the read-only value. - For ENGAGE Gateway, a SET_LINK command issued against an existing link deletes the original link right away. - If APM_LOCK_CONTROL contains a lock state change command and custom LED blink patterns, ENGAGE locks will first flash the default pattern associated with the lock state change and then the custom LED blink pattern.	Z. Grandpre
4.16	09/14/2015	- Update the reference within the iClass formats byte of the Next Generation Lock APM/Reader Configuration Structure - Update the APM Configuration Data Structure to include missing items in byte 9	Josh Piron
4.17	01/07/2016	Removed NDE specific language and added Schlage Control & LE APM types	Z. GrandPre
4.18	01/26/2016	- Updated status code definitions in ONR_STATUS response - Updated next gen configuration block to indicate that the IPB configurations for local lock control also apply to the deadbolt	Josh Piron
4.19	02/16/2016	- Changed max Backlight Timeout from 15 to 31 sec in Next Generation Lock APM to reflect actual limit of AD locks. - Added Custom Key status bit in Next Generation Lock APM byte18 bit 6	Dorothi Borgohain
4.20	03/07/2016	Updated Trouble bit in APM_STATUS/RSD_STATUS to include Magnetic tamper if supported by APM linked to ENGAGE Gateway.	Z. GrandPre
4.21	03/15/2016	- Added APM_PIV_GEN_AUTH_CHALLENGE(78H) message - Added APM_PIV_GEN_AUTH_ACK/ERR(80H) message - Added APM_PIV_GEN_AUTH_RESPONSE(79H) - Added AD-302 and AD-402 in START_FW_DOWNLOAD message - Added AD-302 in RSD_CONFIGURATION message - Added “AD302” in AD_RSD_OEM_CODE(36H/8CH) message - Added “AD302” and “AD402” in AD_APM_OEM_CODE (36H/8BH) message - Added AD-402 in FIRMWARE_VERSION(41H) message - Added AD-402 in FULL_FIRMWARE_VERSION (36H/8AH) message - Added AD-302 in RSD_CONFIGURATION (53H) message - Added AD-302 in RSD_FULL_CONFIGURATION (36H/82H) message	Shaun Thaker
4.22	03/23/2016	- Modify APM_PIV_GEN_AUTH_ACK/ERR message type to be 0x7A	Shaun Thaker
4.23	03/31/2016	- Updated “START_FW_DOWNLOAD (15H/00H)” command to provide ONR support to Si(K)2 readers. - Added SiK2 and Si2 reader types to “READER_INFORMATION (36H/8FH)” command	Dorothi Borgohain
4.24	03/31/2016	- Updated “Next Generation Lock APM/Reader Configuration Structure” to support “Mifare Plus credentials”.	Pavithra S A
4.25	06/07/2016	- Added clarification on usage of ABORT_LINK for ENGAGE Gateway - Added note on RSD Tamper Bit being set for BLE connection to Gateway	T. Anfield
4.26	06/10/2016	- Updated “Next Generation Lock APM/Reader Configuration Structure” to support FIPS201-2 reader compatibility support.	Sankar nag
4.27	10/24/2016	- Added the 3 models of LE (LEMS, LEMB, LEMD) as responses to AD_APM_OEM_CODE (36H/8BH)	J. Everson
4.28	11/04/2016	- Added Note “DCS selection takes priority over the single channel selection” in “Set RSD Channel” command and “RSD Channel” response. - Also updated command Headings with proper types for “Set RSD Channel” and “Get WOR Wake-up status”.	Pavithra S A
4.29	11/11/2016	- Updated ONR FW update status for GWE in following response messages: ....APM_STATUS_EXTENDED ....RSD_STATUS_CHANGE_EXTENDED ....RSD_STATUS_CHANGE_CARDDATA_EXTENDED)	Jane Liu
4.30	12/09/2016	Added notes to WRI400 Reader Configuration Data table to clarify the location of the bytes in the NEXT_GEN_APM_CONFIG message	Josh Piron
4.31	01/25/2017	- Added Identifiers for ENGAGE RMRU exit device product. NOTE: Two versions are included in the APM_OEM_CODE response; RM – Remote Monitor and RU – Remote Monitor - Added RMRU to the VIP LBM (latch bold monitor) response definitions - Added lock bitmap clarification for the ENGAGE™ Gateway in the following ONR Commands: ....START_FW_DOWNLOAD ....ABORT_FW_DOWNLOAD ....START_FW_REFLASH	Dan Pfunder
4.32	05/16/2017	Clarification of RMRU use of Trouble bit and Locked, Clutch bits.	Dan Pfunder
4.33	06/29/2017	- Added new ONR Command and Response ....LARGE_FW_FILE_BLOCK ....LARGE_FW_FILE_BLOCK_RESP - Added new status and error codes in the ONR Command Responses: ....START_FW_DOWNLOAD_RESP ....FW_FILE_BLOCK ....END_FW_DOWNLOAD_RESP ....ABORT_FW_DOWNLOAD_RESP ....START_FW_REFLASH_RESP ....ONR_STATUS - Revoked updates from version 4.29 of this document: ONR FW update status for GWE in following response messages: ....APM_STATUS_EXTENDED ....RSD_STATUS_CHANGE_EXTENDED, ....RSD_STATUS_CHANGE_CARDDATA_EXTENDED	Jane Liu Tripp Holt
4.34	06/30/2017	Accepted All Changes after the publication for ENGAGE 5.2 Release	Tripp Holt
4.35	09/01/2017	Added FIPS201-2 Authentication Enable/Disable bit to NEXT_GEN_APM_CONFIGURATION	Alex Lammers
4.36	09/05/2017	Updated Allegionization and corrected minor formatting discrepancies for consistency, added hyperlinks to TOC, moved APM_PIV_GEN_AUTH_ACK/ERR from Commands for Addressing APM devices to Response Format section. Added APM_PIV_GEN_AUTH_CHALLENGE APM_PIV_GEN_AUTH_ACK/ERROR APM_PIV_GEN_AUTH_RESPONSE to the Protocol Commands, Responses, and Datalogs table	Ron Taylor
4.37	10/27/2017	Updated the message types for the following FIPS201-2 messages, to reflect two byte length field support. ....APM_PIV_GEN_AUTH_CHALLENGE ....APM_PIV_GEN_AUTH_RESPONSE Removed Total Length and Offset Length from PIV challenge and response messages.	Sanjay Hegde Alex Lammers
4.38	11/28/2017	- Merged Felica CSN with iClass CSN in “Next Generation Lock APM/Reader Configuration Structure”. - Added comments to iClass/Felica related bits in “Next Generation Lock APM/Reader Configuration Structure” to better represent Reader behavior	Vamsee Vardhan
4.39	02/19/2018	Updated FIPS 201-2 Error List in “APM_PIV_GEN_AUTH_ACK/ERR” message. Also renamed the NEXT_GEN_APM_CONFIG Byte 14 bit 0 as “FIPS 201-2 Capable”.	Pavithra S A
4.40	04/23/2018	Updated to call out the status bits applicable to the WRI400 only in the following messages: APM_STATUS APM_STATUS_EXTENDED RSD_STATUS_CHANGE RSD_STATUS_CHANGE_EXTENDED RSD_STATUS_CARDDATA RSD_STATUS_CARDDATA_EXTENDED	Deepak Srivastava
4.41	07/26/2018	- Corrected sub command for LARGE_FW_FILE_BLOCK / LARGE_FW_FILE_BLOCK_RESP - Added large fw file block status ID to ONR_STATUS_RESPONSE	Josh Piron
4.42	08/28/2018	- Added “0x63 = Error: Lock Bitmap includes unlinked or unknown edge device(s) (Gateway Only)” Response Code to the ABORT_FW_DONWLOAD_RESP (16H/03H) response - Made minor formatting improvements	Ron Taylor
4.43	9/26/2018	- Removing RMRU Trouble Bit sources that have no specific fault bit. - Sections: 1.81, 1.82, 1.86, 1.87, and 1.88	Rafael Verde
4.44	1/14/2019	- Added configuration bits for BLE Credential Enable, BLE Credential Range, BLE Performance, and Credential Read LED to NEXT_GEN_APM_CONFIGURATION to support 1.1 devices - Added 1.1 device types to START_FW_DOWNLOAD, AD_APM_OEM_CODE, and FIRMWARE_VERSION	Scott Fieldhouse
4.45	03/21/2019	- Added configuration bit for Card Read Retries to NEXT_GEN_APM_CONFIGURATION - Added description for a byte used internally in Reader Firmware to NEXT_GEN_APM_CONFIGURATION	Bachcha Babu

RS-485 PROTOCOL

Overview

This section describes the RS-485 serial protocol that is used between an Allegion AD-series PIM400/PIB300 or an AD-series online wired lock to an Access Control Panel (ACP).

Definitions

Acronym	Description
PIM400	Panel Interface Module (Wireless)
PIB300	Panel Interface Board (Wired)
APM	Access Point Module, either wireless or wired
WAPM	Wireless Access Point Module
RSD	RS-485 Device: either a PIM400-485 (online wireless) or an AD-300 (online wired)
ACP	Access Control Panel
FCS	Frame Check Sequence
TBD	To Be Determined
GWE	ENGAGE Gateway

Communication Protocol

Character Format

1 start bit, 8 data bits, no parity, 1 stop bit

Baud Rate

The baud rate is 9600 baud.

Packet Format

Table 1-1: Communication Packet Format

Field	Description
Start-of-Frame	0AH indicates the start of a packet
Address	the address to which the packet is being sent
Type	the command or response type
Length	the number of bytes in the data field
Data	the data being sent – may be 0 bytes
Frame Check Sequence	CRC or checksum

Start of Frame

Every communication packet begins with the byte 0x0A.

Address space

Following the Start-of-Frame character is the address of the device to which the packet is directed. The address field is one byte long.

There are two independent RS-485 address spaces defined in this protocol:

RSD address space, and
APM address space

Each address space ranges from 0x00 to 0xFE.

Addresses 0xFF and 0xAA are special and shall not be used to address an RSD or APM. More details are given below.

ACP Address Space

The Access Control Panel (ACP) has the default address of 0xFF. This address is also referred to as “Network Master Address” in subsequent sections below.

All the RS485 slave devices (RSD, APM) shall use the address 0xFF for all response packets that originate at the APM/RSD.

It is strongly recommended that the ACP NOT transmit any RSD or APM message with the address 0xFF on the RS-485 bus. Both the APM and RSD ignore messages received with the address 0xFF.

RSD Address Space

Each RSD has a unique address on the RS485 bus. This means each RSD shall have a different address from every other RSD on the same physical RS485 bus.

Valid RSD addresses are

0x00 to 0xA9
0xAB to 0xFE

RSD broadcast packets should be used sparingly because there is no response to them, so there is no way to be sure that every RSD on the network properly received the packet.

When an RSD receives a packet with address 0xAA, the command is processed internally within the RSD. The RSD does not communicate with all the APMs connected to it.

Example:

Consider the ACP sends out a command with address 0xAA
The PIM400-485 (which is an RSD) device receives the packet
The PIM400-485 does not send this command to all the AD400 devices connected to it
All AD400 devices (APMs) do not receive an RS485 message with an address of 0xAA

NOTE: For the remainder of this document, whenever the RSD Address is mentioned, it should be interpreted as follows:

Each RSD has a unique address
The address range is from 0x00 to 0xFE
Addresses 0xFF and 0xAA are invalid addresses for an RSD

APM Address Space

Each APM has an address. APM addresses must be unique within the APM address space: Each APM must have a different address from every other APM on the same physical link.

Valid RSD addresses are:

0x00 to 0xA9
0xAB to 0xFE

NOTE: For the remainder of this document, whenever the APM Address is mentioned, it should be interpreted as follows:

Each APM has a unique address
The address range is from 0x00 to 0xFE
Addresses 0xFF and 0xAA are invalid addresses for an APM

Type

Length

This field indicates the number of bytes in the Data field. The field may be one or two bytes long, as needed. Some packets have no data and the length field is set to zero.

Data

This is a series of bytes, the number of which is specified in the length field, described above. Some packets contain no data, while others may contain, theoretically, up to 65535 bytes of data.

Frame Check Sequence

The Frame Check Sequence (FCS) is a one-byte checksum or two-byte CRC. This is used to validate the contents of the packet. It is strongly recommended that CRC be used rather than checksum.

CRC

The CRC used is the CRC-CCITT specification. The Appendix provides a C function which can generate the table for performing CRC calculations. It is strongly recommended that this table be used.

Checksum

Timeouts

Character Timeout

Packet Timeout

Packet Start Timeout

Protocol Commands, Responses, and Datalogs

This section details the commands, responses, and datalogs that are implemented in an RS-485 UNIT.

This protocol provides for polling by access point.

Table 1-2: ACP Commands and RSD Responses

ACP Command	RSD Response	How used	Applies to GWE
POLL_APM_CRC (44h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	APM polling with CRC	X
POLL_APM_CHECKSUM (3Bh)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	APM polling with CHECKSUM	X
POLL_RSD_CRC (3Ah)	RSD_STATUS_IDLE (31h) or RSD_STATUS_IDLE_EXTENDED (34h)	RSD polling with CRC	X
	RSD_STATUS_CHANGE (31h) or RSD_STATUS_CHANGE_EXTENDED (34h)
	RSD_STATUS_CARDDATA (31h) or RSD_STATUS_CARDDATA_EXTENDED (34h)
	APM_PIV_GEN_AUTH_RESPONSE (79H) (AD only) APM_PIV_GEN_AUTH_ACK/ERR (7AH) (AD only)
POLL_RSD_CHECKSUM (74h)	RSD_STATUS_IDLE (31h) or RSD_STATUS_IDLE_EXTENDED (34h)	RSD polling with CHECKSUM	X
	RSD_STATUS_CHANGE (31h) or RSD_STATUS_CHANGE_EXTENDED (34h)
	RSD_STATUS_CARDDATA (31h) or RSD_STATUS_CARDDATA_EXTENDED (34h)
	APM_PIV_GEN_AUTH_RESPONSE (79H) (AD only) APM_PIV_GEN_AUTH_ACK/ERR (7AH) (AD only)
GET_APM_DATALOG (4Dh)	NEXT_DATALOG (38h)	send event details: card data, door alarms, request to exit, & troubles
GET_PREVIOUS_APM_DATALOG (6Dh)	NEXT_DATALOG (38h)	repeat sending event details in case of receiving error
APM_LOCK_CONTROL (4Fh)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	control the lock/strike state: locked, momentary unlock, extended unlock	X
APM_TIMED_UNLOCK (56h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	momentary unlock specifying the unlock time (available in version 2 hw only)	X
ABORT_LINK (32h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	abort a current linking mode	X
SET_LINK (45h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	initiate a linking mode	X
SET_POLL (49h)	RSD_STATUS_IDLE (31h) or RSD_STATUS_IDLE_EXTENDED (34h)	sets APM addresses to which the RSD will respond	X
GET_OEM_CODE (6Fh)	OEM_CODE (4Fh)	to determine if the device is a RSD
(*) GET_AD_RSD_OEM_CODE (47h/0Ch)	(*) AD_RSD_OEM_CODE (36h/8Ch)	to determine the AD RSD type	X
(*) GET_AD_APM_OEM_CODE (47h/0Bh)	(*) AD_APM_OEM_CODE (36h/8Bh)	to determine the AD APM type	X
GET_APM/RSD_ASSOCIATION (65h)	APM/RSD_STATUS (39h)	determine what RSD a APM is in	X
GET_RSD_INFORMATION (3Ch)	RSD_CONFIGURATION) (53h)	get 1G RSD configuration information	X
(*) GET_RSD_FULL_CONFIGURATION (47h/02h)	RSD_FULL_CONFIGURATION (36h/82h)	get AD-series RSD configuration information	X
(*) SET_RSD_CONFIGURATION (77h)	RSD_CONFIGURATION (53h)	to send configuration data to a 1G RSD	X
(*) SET_RSD_CHANNEL (02h/01h)	RSD_CHANNEL (36h/81h)	to send RF channel data to a RSD
GET_APM_CONFIGURATION (38h)	APM_CONFIGURATION (32h)	to retrieve configuration data from a 1G APM	X
SET_APM_CONFIGURATION (37h)	APM_STATUS (30h) or APM_STATUS_EXTENDED (33h)	to send configuration data to a 1G APM	X
(*) SET_NEXT_GEN_APM_CONFIGURATION (47h/04h)	SET_NEXT_GEN_APM_CONFIGURATION_RESPONSE (36h/84h)	to send configuration data to a Next Gen APM	X
(*) GET_NEXT_GEN_APM_CONFIGURATION (47h/05h)	(*) NEXT_GEN_APM_CONFIGURATION (36H/85H)	to retrieve configuration data from a Next Gen APM	X
(*) SET_RSD_WOR (47h/07h)	RSD_WOR (36h/87h)	to send wakeup on radio (WOR) latency configuration to a RSD	X
(*) SET_WOR_WAKEUP (47h/08h)	WOR_WAKEUP (36h/88h)	to send a RSD/APM’s wakeup on radio (WOR) to a RSD	X
(*) GET_WOR_WAKEUP_STATUS (47h/01h)	WOR_WAKEUP_STATUS (36h/89h)	to retrieve an APM’s WOR status from a RSD	X
GET_FIRMWARE_VERSION (2Ch)	FIRMWARE_VERSION (41h)	to retrieve PIM & associated WAPM’s firmware versions	X
(*) GET_FULL_FIRMWARE_VERSION (47h/0Ah)	(*) FULL_FIRMWARE_VERSION (36h/8Ah)	to retrieve PIM & associated WAPM’s firmware versions (including AD RF module firmware version)	X
(*) GET_APM_BATTERY_STATUS (47h/06h)	(*) APM_BATTERY_STATUS (36h/86h)	to retrieve battery voltage levels from an APM	X
(*) GET_APM_STATISTICS (tbd)	(*) APM_STATISTICS (tbd)	to retrieve operational statistics from an APM
(*) GET_APM_SERIAL_NUMBERS (44h/01h)	(*) APM_SERIAL_NUMBERS (5Bh/81h)	to retrieve serial number from an APM	X
(*) GET_APM_MANUFACTURE_DATES (4Ah/01h)	(*) APM_MANUFACTURE_DATES (5Bh/82h)	to retrieve manufacturing date from an APM	X
(*) GET_APM_HARDWARE_VERSIONS (4Ah/03h)	(*) APM_HARDWARE_VERSIONS (5Ah/83h)	to retrieve hardware version from an APM	X
(*) GET_RSD_SERIAL_NUMBERS (4bh/01h)	(*) RSD_SERIAL_NUMBERS) (5Bh/81h)	to retrieve serial number from a RSD	X
(*) GET_RSD_MANUFACTURE_DATES (4Bh/02h)	(*) RSD_MANUFACTURE_DATES (5Bh/82h)	to retrieve manufacturing date from a RSD	X
(*) GET_RSD_HARDWARE_VERSIONS (4Bh/03h)	(*) RSD_HARDWARE_VERSIONS (5Bh/83h)	to retrieve hardware version from a RSD	X
GET_AD_APM_PARTNER_ID (47h/0Dh)	AD_APM_ PARTNER_ID (36h/8Dh)	to retrieve partner ID from an APM
GET_AD_RSD_PARTNER_ID (47h/0Eh)	AD_RSD_PARTNER_ID (36h/8Eh)	to retrieve partner ID from an RSD
GET_READER_INFO (47h/0Fh)	READER_INFORMATION (36h/8Fh)	To retrieve the reader type and the firmware version from an RSD	X
START_FW_DOWNLOAD (15h/00h)	START_FW_DOWNLOAD_RESP (16h/00h)	To start an ONR download session for APM or RSD	X
FW_FILE_BLOCK (15h/01h)	FW_FILE_BLOCK_RESP (16h/01h)	To send a portion of an ONR fw file during an active ONR download session for APM or RSD	X
END_FW_DOWNLOAD (15h/02h)	END_FW_DOWNLOAD_RESP (16h/02h)	To stop an ONR download session and verify the downloaded fw file for APM or RSD	X
ABORT_FW_DOWNLOAD (15h/03h)	ABORT_FW_DOWNLOAD_RESP (16h/03h)	To stop any active ONR session and reset all ONR related information to its default value for APM or RSD	X
START_FW_REFLASH (15h/04h)	START_FW_REFLASH_RESP (16h/04h)	To start the process of reflashing the downloaded fw file for APM or RSD	X
GET_ONR_STATUS (15h/05h)	ONR_STATUS (16h/05h)	To retrieve the ONR status for APM or RSD	X
LARGE_FW_FILE_BLOCK (15H/06H)	LARGE_FW_FILE_BLOCK_RESP (16H/06H)	To send an ENGAGE™ enabled device firmware file	X
SET_RSD_DIAGNOSTICS_CONFIGURATION (50H)	RSD_DIAGNOSTICS_CONFIGURATION (51H)	To enable/disable the Diagnostics Mode credential read configuration
RSD_SECURE_HOST_CONFIG (20H/09H)	RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To enable/disable Secure Mode (RSI Encryption) and to set Secure Mode related configurations	X
RSD_START_SECURE_SESSION (20H/01H)	RSD_START_SECURE_SESSION_CHALLENGE (21H/01H) RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To initiate the Secure Session	X
RSD_START_SECURE_SESSION_ACK (20H/02H)	RSD_START_SECURE_SESSION_COMPLETE (21H/02H) RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To complete/establish the Secure Session	X
RSD_SET_ACP_KEY (20H/10H)	RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To set the RSD’s ACP Default Key and Master Key	X
GET_RSD_SECURE_MODE_STATUS (20H/08H)	RSD_SECURE_MODE_STATUS_RESP (21H/08H)	To get the Secure Mode status	X
RSD_ENCRYPTED_COMMAND (2EH)	RSD_ENCRYPTED_RESPONSE (2FH) RSD_SECURE_MODE_STATUS_RESP (21H/08H)	Encrypted command and response. All other RSI commands can be encrypted and sent as a payload of this command	X
APM_PIV_GEN_AUTH_CHALLENGE (78H)	APM_PIV_GEN_AUTH_ACK/ERR (7AH)	Send FIPS201-2 PIV card challenge to PIV card