Response Formats

Response_Formats

Response Formats

Responses are data packets sent from the RSD to the ACP.

(+) APM_STATUS (30H)

Table 1-57: APM_STATUS Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	30H
4	Length	03H
5	Data	Byte1
6		Byte2
7		Byte3
8/9	Frame Check Sequence	CRC or CHECKSUM

Table 1-58: APM_STATUS byte1, byte2, and byte3 Definitions

Byte	bit	Function	Comments
byte1	0	Reader tamper	1 = the polled APM has a reader tamper
	1	Low Battery (2)	1 = the polled APM has a low battery
	2	Loss of RF Communications	1 = the polled APM has a loss of RF
	3	RSD Tamper	1 = the RSD door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (2)	1 = the polled APM’s lock motor is stalled
	6	(+) Lock Clutch Position	1 = door unlocked, 0= door locked
		... WRI400 Only: Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position	1 = bolt extended, 0 = bolt retracted
		... WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte2	0	(+) Request to Exit Active	These bits are set when a changed of state occurs in the APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (2)
	2	(+) Inside Pushbutton (IPB) (2)
	3	(+) APM Tamper Active
	4	Datalog Ready (2)	1 = the polled APM has a datalog ready
	5	Configuration Mode (2)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the polled RSD/APM is in link mode
	7	(+) Battery Critical/REN (2)	AD-400/ENGAGE device Battery: 1 = critical, 0 = not critical
		AD-300 REN: 1 = active, 0 = inactive
byte3	0	Trouble	1 = the polled APM has trouble (i.e. byte1, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 3, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (2)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (2)	AD-300 Data Type: undefinedAPM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (polled APM)
	3	(+) IPB (2)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1 = inactive, 0 = active (polled APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (2)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (polled APM)
			RMRU 1 = Dogged or Dog Next Exit, 0 = Undogged

(1) The Configuration Mode bit is set after the RSD receives a SET_APM_CONFIGURATION command and remains set until that APM communicates with the RSD. A subsequent SET_APM_CONFIGURATION command must not be sent until the Configuration Mode bit is cleared for all APMs linked to that RSD.

(2) These Status bits do not apply to the WRI400 and can be ignored when communicating with this product.

(*) APM_STATUS_EXTENDED (33H)

NOTE: This message is not sent in place of APM_STATUS when the device has been configured for extended status reporting using the SET_RSD_CONFIGURATION command.

Table 1-59: APM_STATUS_EXTENDED Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	33H
4	Length	05H
5	Data	Byte1
6		Byte2
7		Byte3
8		Byte4
9		Byte5
10/11	Frame Check Sequence	CRC or CHECKSUM

Table 1-60: APM_STATUS_EXTENDED byte1, byte2, byte3, byte4 and byte5 Definitions

Byte	bit	Function	Comments
byte1	0	Reader tamper	1 = the polled APM has a reader tamper
	1	Low Battery5	1 = the polled APM has a low battery
	2	Loss of RF Communications	1 = the polled APM has a loss of RF
	3	RSD Tamper	1 = the RSD door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (5)	1 = the polled APM’s lock motor is stalled
	6	(+) Lock Clutch Position /	1 = door unlocked, 0= door locked
		WRI400 Only: Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position /	1 = bolt extended, 0 = bolt retracted
		WRI400 Only: Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte2	0	(+) Request to Exit Active	These bits are set when a change of state occurs in the APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (5)
	2	(+) Inside Pushbutton (IPB) (5)
	3	(+) APM Tamper Active
	4	Datalog Ready (5)	1 = the polled APM has a datalog ready
	5	Configuration Mode (5)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the polled RSD/APM is in link mode
	7	(+) Battery Critical/REN (5)	AD-400/ ENGAGE device battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte3	0	Trouble	1 = the polled APM has trouble (i.e. byte1, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 3, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (5)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (5)	AD-300 Data Type: undefined
			APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (polled APM)
	3	(+) IPB (5)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1 = inactive, 0 = active (polled APM)
	5	Wireless: Request to Enter Switch VIP	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (5)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (polled APM)
			RMRU 1 = Dogged or Dog Next Exit, 0 = Undogged
byte4	0-7	Number of extended status bytes	01H (2)
byte5	0-1	ONR Status	00 = ONR not active
			01 = ONR ready for next command
			10 = ONR in progress processing previous command
			11 = Error encountered
	2	FDR Information (3)	0 = FDR Not In Progress
			1 = FDR Initiated
	3	WOR Lock/Unlock Status (3)	0 = WOR lock/unlock in process
			1 = WOR lock/unlock not active/complete (4)
	4-7	Reserved	00h

(2) For the current revision of the protocol there is only 1 byte that is part of the extended status, so byte 4 will always be 0x01. However, for future revisions the number of extended status bytes may change so this byte is necessary so that it is clear how many extended status bytes a certain revision of firmware supports.

(3) The “FDR Information” and the “WOR Lock/Unlock Status” bits are applicable only on the PIM and not on the AD-300, so the relevant bits are still reserved on the AD-300.

(4) The “WOR lock/unlock not active/complete” status indicates the completion of the latest WOR command. The status of whether the particular WAPMs woke up successfully or not, to execute the latest command can be seen in the response to the GET_WOR_WAKEUP_STATUS command.

(5) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

RSD_STATUS_IDLE (31H)

Table 1-61: RSD_STATUS_IDLE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	31H
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

(*) RSD_STATUS_IDLE_EXTENDED (34H)

Note: This message is sent in place of RSD_STATUS_IDLE when the device has been configured for extended status reporting using the SET_RSD_CONFIGURATION command.

Table 1-62: RSD_STATUS_IDLE_EXTENDED Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	34H
4	Length	00H
5/6	Frame Check Sequence	CRC or CHECKSUM

(+) RSD_STATUS_CHANGE (31H)

Table 1-63: RSD_STATUS_CHANGE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	31H
4	Length	05H
5	Data	Byte1
6		Byte2
7		Byte3
8		Byte4
9		Byte5
10/11	Frame Check Sequence	CRC or CHECKSUM

Table 1-64: RSD_STATUS_CHANGE byte1 - byte5 Definitions

Byte	bit	Function	Comments
byte1		APM address	If FFH, then RSD has nothing new to report and byte2, byte3, byte4, byte5 are all = 0.
			If 00H to FEH (not AAH), then byte2, byte3, byte4 contain the status for that APM.
byte2	0	Reader tamper	1 = the byte1 APM has a reader tamper
	1	Low Battery (2)	1 = the byte1 APM has a low battery
	2	Loss of RF Communications	1 = the byte1 APM has a loss of RF
	3	RSD Tamper	1 = the polled RSD’s door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (2)	1 = the byte1 APM’s lock motor is stalled
	6	(+) Lock Clutch Position /	1 = door unlocked, 0= door locked
		WRI400 Only - Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position /	1 = bolt extended, 0 = bolt retracted
		WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte3	0	(+) Request to Exit Active	These bits are set when a change of state occurs in the byte1 APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (2)
	2	(+) Inside Pushbutton (IPB) (2)
	3	(+) APM Tamper Active
	4	(+) Datalog Ready (2)	1 = the polled APM has a datalog ready
	5	Configuration Mode (2)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the byte1 APM of the RSD is in link mode
	7	(+) Battery Critical/REN (2)	AD-400/ ENGAGE device Battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte4	0	Trouble	1 = the byte1 APM has trouble (i.e. byte2, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 4, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (2)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		... ** Magnetic Tamper Alert (2)	AD-300 Data Type: undefined APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (byte1 APM)
	3	(+) IPB (2)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1 = inactive, 0=active (byte1 APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (2)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (byte1 APM) ,
			RMRU 1 = Dogged or Dog Next Exit
			0 = Undogged
byte5		More Events	0 = polled RSD does not have more events to report
			0 <> polled RSD has more events to report and should be polled again

(2) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

(*) RSD_STATUS_CHANGE_EXTENDED (34H)

NOTE: This message is sent in place of RSD_STATUS_CHANGE when the device has been configured for extended status reporting using the SET_RSD_CONFIGURATION command.

Table 1-65: RSD_STATUS_CHANGE_EXTENDED Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	34H
4	Length	08H
5	Data	Byte1
6		Byte2
7		Byte3
8		Byte4
9		Byte5
10		Byte6
11		Byte7
12		Byte8
13/14	Frame Check Sequence	CRC or CHECKSUM

Table 1-66: RSD_STATUS_CHANGE_EXTENDED byte1 – byte8 Definitions

Byte	bit	Function	Comments
byte1		APM address	If FFH, then RSD has nothing new to report and all remaining bytes in the status are = 0
			If 00H to FEH (not AAH), then all remaining bytes contain the status for that APM
byte2	0	Reader tamper	1 = the byte1 APM has a reader tamper
	1	Low Battery (6)	1 = the byte1 APM has a low battery
	2	Loss of RF Communications	1 = the byte1 APM has a loss of RF
	3	RSD Tamper	1 = the polled RSD’s door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall6	1 = the byte1 APM’s lock motor is stalled
	6	(+) Lock Clutch Position /	1 = door unlocked, 0= door locked
		WRI400 Only - Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position /	1 = bolt extended, 0 = bolt retracted
		WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte3	0	(+) Request to Exit Active	These bits are set when a change of state occurs in the byte1 APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (6)
	2	(+) Inside Pushbutton (IPB) (6)
	3	(+) APM Tamper Active
	4	(+) Datalog Ready (6)	1 = the polled APM has a datalog ready
	5	Configuration Mode (6)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the byte1 APM of the RSD is in link mode
	7	(+) Battery Critical/REN (6)	AD-400/ ENGAGE Device Battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte4	0	Trouble	1 = the byte1 APM has trouble (i.e. byte2, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 4, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (6)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (6)	AD-300 Data Type: undefined
			APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (byte1 APM)
	3	(+) IPB (6)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1 = inactive, 0=active (byte1 APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (6)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (byte1 APM)
			RMRU 1 = Dogged or Dog Next Exit
			0 = Undogged
byte5	0-7	More Events	0 = polled RSD does not have more events to report
			0 <> polled RSD has more events to report and should be polled again
byte6	0-7	Card data bit count	00H (2)
byte7	0-7	Number of extended status bytes	01H (3)
byte8	0-1	ONR Status	00 = ONR not active
			01 = ONR ready for next command
			10 = ONR in progress processing previous command
			11 = Error encountered
	2	FDR Information (4)	0 = FDR Not In Progress
			1 = FDR Initiated
	3	WOR Lock/Unlock Status (4)	0 = WOR lock/unlock in process
			1 = WOR lock/unlock not active/complete (5)
	4-7	Reserved	00h

(2) Card data bit count is used here so that there is a clear division between what is card data and what is extended status information. For a status change message there is no card data to report, so this count will always be 0. If it were non-zero, then the RSD_STATUS_CARDDATA_EXTENDED response format should be followed.

(3) For the current revision of the protocol there is only 1 byte that is part of the extended status, so byte 7 will always be 0x01. However, for future revisions the number of extended status bytes may change so this byte is necessary so that it is clear how many extended status bytes a certain revision of firmware supports.

(4) The “FDR Information” and the “WOR Lock/Unlock Status” bits are applicable only on the PIM and not on AD-300, so the relevant bits are still reserved on the AD-300.

(5) The “WOR lock/unlock not active/complete” status indicates the completion of the latest WOR command. The status of whether the particular WAPMs woke up successfully or not, to execute the latest command can be seen in the response to the GET_WOR_WAKEUP_STATUS command.

(6) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

(+) RSD_STATUS_CARDDATA (31H)

Table 1-67: RSD_STATUS_CARDDATA Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	31H
4	Length	07H to 26H
5	Data	byte1	See footnote (1) The Configuration Mode bit is set after the RSD receives a SET_APM_CONFIGURATION command and remains set until that APM communicates with the RSD. A subsequent SET_APM_CONFIGURATION command must not be sent until the Configuration Mode bit is cleared for all APMs linked to that RSD.
			See the following Table 1-68 for a detailed description of the byte1-byte38 formats
6		byte2
7		byte3
8		byte4
9		byte5
10		byte6
11		byte7
•		•
•		•
•		•
42		byte38
43/44	Frame Check Sequence	CRC or CHECKSUM

Table 1-68: RSD_STATUS_CARDDATA byte1 – byte38 Definitions

Byte	bit	Function	Comments
byte1		APM address	If FFH, then RSD has nothing new to report and byte2, byte3, byte4, byte5 are = 0.
			If 00H to FEH (not AAH), then byte2, byte3, byte4 contain the status for that APM.
byte2	0	Reader tamper	1 = the byte1 APM has a reader tamper
	1	Low Battery2	1 = the byte1 APM has a low battery
	2	Loss of RF Communications	1 = the byte1 APM has a loss of RF
	3	RSD Tamper	1 = the polled RSD’s door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (2)	1 = the byte1 APM’s lock motor is stalled
	6	(+) Lock Clutch Position	1 = door unlocked, 0= door locked
		WRI400 Only - Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position	1 = bolt extended, 0 = bolt retracted
		WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte3	0	(+) Request to Exit Active	These bits are set when a changed of state occurs in the byte1 APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (2)
	2	(+) Inside Pushbutton (IPB) (2)
	3	(+) APM Tamper Active
	4	(+) Datalog Ready (2)	1 = the polled APM has a datalog ready
	5	Configuration Mode (2)	1 = the polled APM is in configuration mode1
	6	Link Mode Enabled	1 = the byte1 APM of the RSD is in link mode
	7	(+) Battery Critical/REN (2)	AD-400/ ENGAGE Device Battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte4	0	Trouble	1 = the byte1 APM has trouble (i.e. byte2, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 4, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (2)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (2)	AD-300 Data Type: 1 = keypad, 0 = card
			(in byte7-byte38)
			APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (byte1 APM)
	3	(+) IPB (2)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1=inactive, 0=active (byte1 APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (2)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (byte1 APM) ,
			RMRU 1 = Dogged or Dog Next Exit
			0 = Undogged
byte5		More Events	0 = polled RSD does not have more events to report
			0 <> polled RSD has more events to report and should be polled again
byte6		Card data bit count	number of data bits in card data (4-255)
byte7		msb of byte7 is first bit of carddata read from card	Card data read at APM, either Wiegand or magnetic data, up to the first 255 bits, format depends on which card conversion is being used.
•		•
•		•
•		•
byte38		number of bytes of card data depends on number of bits read from card

(2) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

(*) RSD_STATUS_CARDDATA_EXTENDED (34H)

NOTE: This message is sent in place of RSD_STATUS_CARDDATA when the device has been configured for extended status reporting using the SET_RSD_CONFIGURATION command.

Table 1-69: RSD_STATUS_CARDDATA_EXTENDED Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	34H
4	Length	09H to 28H
5	Data	byte1	See footnote (1) The Configuration Mode bit is set after the RSD receives a SET_APM_CONFIGURATION command and remains set until that APM communicates with the RSD. A subsequent SET_APM_CONFIGURATION command must not be sent until the Configuration Mode bit is cleared for all APMs linked to that RSD.
			See the following Table 1-70 for a detailed description of the byte1-byte38 formats
6		byte2
7		byte3
8		byte4
9		byte5
10		byte6
11		byte7
• • •		• • •
42		byte38
43		byte39
44		byte40
45/46	Frame Check Sequence	CRC or CHECKSUM

Table 1-70: RSD_STATUS_CARDDATA_EXTENDED byte1 – byte40 Definitions

Byte	Bit	Function	Comments
byte1		APM address	If FFH, then RSD has nothing new to report and byte2, byte3, byte4, byte5 are = 0. .
			If 00H to FEH (not AAH), then byte2, byte3, byte4 contain the status for that APM
byte2	0	Reader tamper	1 = the byte1 APM has a reader tamper
	1	Low Battery (6)	1 = the byte1 APM has a low battery
	2	Loss of RF Communications	1 = the byte1 APM has a loss of RF
	3	RSD Tamper	1 = the polled RSD’s door is open or, if the ENGAGE Gateway, a mobile application is connected
	4	Cache Status	1 = has been used, 0 = has not been used
	5	Motor Stall (6)	1= the byte1 APM’s lock motor is stalled
	6	(+) Lock Clutch Position	1 = door unlocked, 0= door locked
		WRI400 Only - Reader Tamper 1	WRI400 Only: 1 = Tamper 1 Active, 0=Tamper 1 Inactive
	7	(+) Deadbolt Position /	1 = bolt extended, 0 = bolt retracted
		WRI400 Only - Reader Tamper 2	WRI400 Only: 1 = Tamper 2 Active, 0=Tamper 2 Inactive
byte3	0	(+) Request to Exit Active	These bits are set when a changed of state occurs in the byte1 APM, similar to datalogs that occur when polling by APM
	1	(+) Key Override (ATK) (6)
	2	(+) Inside Pushbutton (IPB) (6)
	3	(+) APM Tamper Active
	4	(+) Datalog Ready (6)	1 = the polled APM has a datalog ready
	5	Configuration Mode (6)	1 = the polled APM is in configuration mode (1)
	6	Link Mode Enabled	1 = the byte1 APM of the RSD is in link mode
	7	(+) Battery Critical/REN (6)	AD-400/ ENGAGE Device Battery: 1 = critical, 0 = not critical
			AD-300 REN: 1 = active, 0 = inactive
byte4	0	Trouble	1 = the byte1 APM has trouble (i.e. byte2, bits 0-5<>0);
			APMs linked to Gateway will also have Trouble bit set if Magnetic Tamper Alert bit is set (byte 4, bit 1 <> 0)
	1	(+) Low Lithium Battery/ Data Type (6)	AD-400 Lithium battery: 1 = low, 0 = normal (not used)
		** Magnetic Tamper Alert (6)	AD-300 Data Type: 1 = keypad, 0 = card (in byte7-byte38) APM with wireless door position sensing: 1 = lock requires calibration, 0 = normal
	2	Door Position Switch	1 = closed, 0 = open (byte1 APM)
	3	(+) IPB (6)	1 = IPB pressed, 0 = IPB not pressed
	4	Request to Exit Switch	1=inactive, 0=active (byte1 APM)
	5	Wireless: Request to Enter Switch	Wireless (not ENGAGE): 1 = active, 0 = inactive (polled APM)
		VIP/RMRU: LBM Status	VIP/RMRU: 1 = bolt extended, 0 = bolt retracted
	6	Key Override (6)	1 = key being used, 0 = key not being used
	7	Lock State	1 = unlocked, 0 = locked (byte1 APM)
			RMRU 1 = Dogged or Dog Next Exit
			0 = Undogged
byte5		More Events	0 = polled RSD does not have more events to report
			0 <> polled RSD has more events to report and should be polled again
byte6		Card data bit count	number of data bits in card data (4-255)
byte7		msb of byte7 is first bit of carddata read from card	Card data read at APM, either Wiegand or magnetic data, up to the first 255 bits, format depends on which card conversion is being used .
• • •		• • •
byte38		number of bytes of card data depends on number of bits read from card
byte39 (2)	0-7	Number of extended status bytes	01H (3)
byte40 (2)	0-1	ONR Status	00 = ONR not active
			01 = ONR ready for next command
			10 = ONR in progress processing previous command
			11 = Error encountered
	2	FDR Information (4)	0 = FDR Not In Progress
			1 = FDR Initiated
	3	WOR Lock/Unlock Status (4)	0 = WOR lock/unlock in process
			1 = WOR lock/unlock not active/complete (5)
	4-7	Reserved	00h

(2) The actual position of these bytes in the message is variable depending on the number of card data bytes that are sent. These bytes always directly follow the card data and the values shown represent the maximum card size.

(3) For the current revision of the protocol there is only 1 byte that is part of the extended status, so byte 39 will always be 0x01. However, for future revisions the number of extended status bytes may change so this byte is necessary so that it is clear how many extended status bytes a certain revision of firmware supports.

(4) The “FDR Information” and the “WOR Lock/Unlock Status” bits are applicable only on the PIM and not on AD-300, so the relevant bits are still reserved on the AD-300.

(6) These status bits do not apply to the WRI400 and can be ignored when communicating with this product.

NEXT_DATALOG (38H)

Table 1-71: NEXT_DATALOG Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	38H
4	Length	12H
5	Data	byte1	See the NEXT_DATALOG Data Field Formats Section for a detailed description of the byte1-byte18 formats
6		byte2
7		byte3
8		byte4
9		byte5
10		byte6
11		byte7
12		byte8
13		byte9
14		byte10
15		byte11
16		byte12
17		byte13
18		byte14
19		byte15
20		byte16
21		byte17
22		byte18
23/24	Frame Check Sequence	CRC or CHECKSUM

(+) OEM_CODE (4FH)

Table 1-72: RSD OEM_CODE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	4FH
4	Length	02H
5	Data	57H (ascii ‘W’)
6		41H (ascii ‘A’)
7/8	Frame Check Sequence	CRC or CHECKSUM

Table 1-73: VIP5100 OEM_CODE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	4FH
4	Length	02H
5	Data	56H (ascii ‘V’)
6		31H (ascii ‘1’)
7/8	Frame Check Sequence	CRC or CHECKSUM

Table 1-74: VIP5500 OEM_CODE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	4FH
4	Length	02H
5	Data	56H (ascii ‘V’)
6		35H (ascii ‘5’)
7/8	Frame Check Sequence	CRC or CHECKSUM

Table 1-75: VIP993 OEM_CODE Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	4FH
4	Length	02H
5	Data	56H (ascii ‘V’)
6		39H (ascii ‘9’)
7/8	Frame Check Sequence	CRC or CHECKSUM

APM/RSD_STATUS (39H)

Table 1-76: APM/RSD STATUS Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	39H
4	Length	02H
5	Data	APM address: Refer to APM Address Space section
6		RSD RS485 address: Refer to RSD Address Space section
7/8	Frame Check Sequence	CRC or CHECKSUM

RSD_CONFIGURATION (53H)

Table 1-77: RSD CONFIGURATION Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	53H
4	Length	06H
5	Data	Low byte of RSD RF address (1)
6		High byte of RSD RF address (1)
7		Type of RSD:
		0x06 = PIM400-485 / AD300 / AD301
		0x07 = ENGAGE Gateway
		0x08 = AD302
		0x16 = PIM400-485-B / AD300-B
8		Low APM range (0 to FEH, not EEH)
9		High APM range (0 to FEH, not EEH)
10		RSD RF Channel (1)
11/12	Frame Check Sequence	CRC or CHECKSUM

(1) RF address and DCS features are not supported by ENGAGE products. Corresponding bytes are read back with a value of 0xFF.

RSD_FULL_CONFIGURATION (36H/82H)

Table 1-78: RSD_FULL_CONFIGURATION Response Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	0CH
5	Data	Sub Command: 82H
6		Low byte of RSD RF address (1)
7		High byte of RSD RF address (1)
8		Type of RSD 0x06 = PIM400-485 / AD300 / AD301 0x07 = ENGAGE Gateway 0x08 = AD302 0x16 = PIM400-485-B / AD300-B
9		Low APM range (0 to FEH, not EEH)
10		High APM range (0 to FEH, not EEH)
11		RSD RF Channel (1)
12		RSD RS485 address: Refer to RSD Address Space section
13		DCS state (1)
14		Low PIM SRCID (1)
15		High PIM SRCID (1)
16		Current WOR value: 0-10 (2)
17/18	Frame Check Sequence	CRC or CHECKSUM

(1) RF address, channels, SRCID and DCS features are not supported by ENGAGE products. Corresponding bytes are read back with a value of 0xFF.

(2) WOR value is a static value = 5 for ENGAGE Gateway.

(*) RSD_CHANNEL (36H/81H)

NOTES:

Channel number selection is not supported by ENGAGE products.
DCS selection takes priority over the single channel selection. So, this command won’t cause any change if DCS is already enabled in case of AD wireless products.

Table 1-79: RSD_CHANNEL Response Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	02H
5 6	Data	Sub Command: 81H Channel Number: 01D-10D (1)
7/8	Frame Check Sequence	CRC or CHECKSUM

(1) The valid channel range for the AD400/PIM400-485 is 1 through 10. The valid channel range for the AD400-B/PIM400-485-B is 6 through 10.

(*) SET_NEXT_GEN_APM_CONFIGURATION RESPONSE (36H/84H)

Table 1-80: SET_NEXT_GEN_APM_CONFIGURATION Response Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	01H
5	Sub Command	84H
6/7	Frame Check Sequence	CRC or CHECKSUM

APM_CONFIGURATION (32H)

Table 1-81: APM_CONFIGURATION Response Packet Format

Byte	Field	Data/Description
1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	32H
4	Length	10H
5	Data	byte1 byte2 byte3 byte4 byte5 byte6 byte7 byte8 byte9	APM configuration data structure (see Table 1‑12)
14		byte10	0
15		byte11	0
16		byte12	0
17		byte13	0
18		byte14	0
19		byte15	0
20		byte16	0
21/22	Frame Check Sequence	CRC or CHECKSUM

(*) NEXT_GEN_APM_CONFIGURATION (36H/85H)

Table 1-82: NEXT_GEN_APM_CONFIGURATION Response Packet Format

Byte	Field	Data/Description

1	Start-of-Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	22H
5 6	Data	Sub Command: 85H APM address: Refer to APM Address Space section
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38	Data	byte1 byte2 byte3 byte4 byte5 byte6 byte7 byte8 byte9 byte10 byte11 byte12 byte13 byte14 byte15 byte16 byte17 byte18 byte19 byte20 byte21 byte22 byte23 byte24 byte25 byte26 byte27 byte28 byte29 byte30 byte31 byte32	Next Generation Lock APM/Reader Configuration Structure (see Table 1‑83 below). For WRI400 Reader Configuration (see Table 1‑84 below)
39/40	Frame Check Sequence	CRC or CHECKSUM

Table 1-83: Next Generation Lock APM/Reader Configuration Structure

Byte	Bit	Function	Comments
byte1		Door unlock time	1-255 seconds (default=3)
byte2	0 1 2	Card format * (depends on RSD type)	0=none 1=reverse 2=Northern #1 3=Northern #2 4=Northern #5 5=Northern #6
	3	Trouble level *	Not applicable on RS485 RSD
	4	Door open level *	not applicable on RS485 RSD
	5	Deny access	1=enable deny access option 0=disable deny access option
	6	Re-latch event	1=relatch on door open 0=relatch on door close
	7	Relock method	1=relatch on door position change 0=timer only
byte3		Heartbeat time (low byte) *	number of 15 second intervals (low byte)
byte4		Heartbeat time (high byte) *	number of 15 second intervals (high byte)
byte5	0	IPB *	1=IPB 0=Request to Enter (1G only)
	1	Pre-alarm enable *	1=enable 0=disable
	2 3 4	Motor type for IRL/MIRL/WA*	0=normal 1=Best/WEXK 2=Saflok MIRL mortise 3=Schlage 4=Schlage WA5600/WA993 & Marks MIRL cyl 5=Schlage WA5200
	5	Latch Type for WISI *	1=strike 0=relay
	6	Request to exit mode *	1=normal 0=inquiry
	7	Extended unlock *	1=enabled 0=disabled
byte6	0 1 2 3	Retry times (1)	1-15 (default=5)
	4 5 6 7	Door held open time *	1-15 (seconds = 15 +( value*5))
byte7	0 1 2 3	Subsequent Delay (1)	0-15 (100 mS resolution) (default = 2 or 200 mS)
	4 5 6 7	First Delay (1)	0-15 (100 mS resolution) (default = 3 or 300 mS)
byte8		Cache memory bits per card	0-255 0=cache disabled (default=0)
byte9	0	Clear cache entries	SET: 1=clear cache entries 0=maintain cache GET: 1=cache entries cleared 0=cache maintained
	1 2 3	Mag track selection * (current product, 1G)	track 1 (1G only) track 2 (1G only) track 3 (1G only)
	4	Auto purge	1=disabled 0=enabled (default=1)
	5 6	Failsafe mode	00=disabled 01=fail locked 10=fail unlocked (default=00)
	7	Cache memory mode	0=full card number 1=facility code (default =0)
byte10	0 1	APM Mode *	0=normal (default) 1=test
	2 3 4	PIN-required led Mode	0=disabled 1=Schlage left green LED-Schlage right red LED alternate blink 5 times (300 ms on, 300 ms off) 2=Schlage left green LED-Schlage right red LED alternate blink 5 times (300 mS on, 300 mS off) Beeps twice (starts when LED blink starts, 150 mS on, 150 mS off) 3-7: future
	5	Request to Enter	1=enabled 0=disabled
	6	Disable IPB blinking	1=enabled (normal default) 0=disabled
	7	reserved
byte11	0 1	IPB/Deadbolt Online Configuration	00=disabled (default) 01=lock/unlock NOTE: Deadbolt can be used to lock the door only
	2 3	IPB/Deadbolt Offline Configuration	00=disabled (default) 01=lock/unlock NOTE: Deadbolt can be used to lock the door only 10=disable reader
	4 5 6 7	IPB Long Button Press	0-15 seconds (default=0=disabled)
byte12		ACP Communications Timeout (3)	0-255 seconds
byte13	0 1 2 3	WOR Timeout	0-10 seconds (default=10, disabled=0) NOTE: this is for GET command only. WoR timeout is set via SET_PIM_WOR_COMMAND
	4	Forced Heartbeat after WoR	0=disabled 1=enabled (Always enabled for ENGAGE products)
	5	Request to Enter Level *	Not applicable on RS485 RSD
	6	Reserved
	7	Reserved
byte14	0	FIPS201-2 Capable *	0=disabled 1=enabled
	1	FIPS201-2 Authentication *	0=disabled 1=enabled (default = 0)
	2	Reserved
	3	Reserved
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte15		Maximum number of cache entries	0-255, where the number of cache entries=5* value, Default=20 (5*20=100 cache entries)
byte16	0 1	Failure mode (3) for: a. Bad/critical battery for wireless (AD400) b. Loss of power for wired (AD300)	00=as-is/cache according to byte 8 01= fail secured/locked/cache according to byte 8 10= fail unsecured/unlocked Default=00
	2	Reserved
	3	Reserved
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte17	0 1 2	Magnetic Configuration	track 1: 0=disabled, 1=enabled (default = 0) track 2: 0=disabled, 1=enabled (default = 1) track 3: 0=disabled, 1=enabled (default = 0)
	3 4 5	Prox Configuration	HID : 0= disabled, 1 = enabled (default=1) GE/CACY; 0 = disabled, 1 = enabled. (default = 1) AWID: 0 = disabled, 1 = enabled (default=1)
	6	Mag card low power wakeup	0 = disabled, 1 = enabled (default = 1)
	7	GE Prox Configuration	0 = GE4002, 1 = GE4001 (default = 0) GE/CACY above must be enabled.
byte18	0 1 2 3 4	Backlight Timeout	0=disabled 1- 31 seconds
	5	Config Card Presented(read only)	1 = Config Card has been presented 0 = Config Card has not been presented
	6	Custom Key Installation Status	1 = Custom Key has been Installed 0 = Custom Key has not been Installed
	7	Reserved
byte19		Keypad Output Format	0 = disabled 1=4 bits per key, upper nibble, no parity 2=6 bits per key, parity 3=8 bits per key, no parity 4=10 bits per key, parity 5=4 bits per key, buffered, no parity 6=4 bits per key, buffered, parity 7=26 bit Wiegand emulation 8=4 bits per key, lower nibble, no parity 9=IR buffered, no parity 10=IR buffered, parity 11=ASCII, odd parity, MSB first 12=32 bit Wiegand emulation
byte20	0	Keypad Interface Format *	00=Wiegand (data1/data0) (default) 01=Magnetic (clock&data)
	1
	2
	3
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte21		Keypad facility code	0-255 (applies to only to format #7)
byte22	0 1 2 3	Number of keys to buffer/cache	format 1: maximum number of keys to cache format 2: maximum number of keys to cache format 3: maximum number of keys to cache format 4: maximum number of keys to cache format 5: 1-11 format 6 : 1-10 format 7: maximum number of keys to cache format 8: maximum number of keys to cache format 9: 1-11 format 10: 1-11 format 11: maximum number of keys to cache format 12: maximum number of keys to cache
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte23	0 1 2 3	Keystroke timeout	0=disabled 1-15 seconds
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte24	0	13.56 MHz Smart Card - 14443 UID (CSN)	1=enabled 0=disabled
	1	13.56 MHz Smart Card - 14443 Secure MiFare Classic*	1=enabled 0=disabled (requires 14443 UID to be disabled)
	2	13.56 MHz Smart Card - 14443 EV1 (NOC) *	1=enabled 0=disabled (requires 14443 UID to be disabled)
	3	13.56 MHz Smart Card - 14443 PIV 75bit (open)	1=enabled 0=disabled (requires 14443 UID to be disabled)
	4	Mi/MiK 13.56 MHz Smart – 15693 iClass SE	1 = enabled 0 = disabled (default = 1 for Mi/MiK iClass secure reader)
		Si2/SiK2 13.56 MHz Smart – 15693 iClass SE / 14443A SEOS and Elite Key delivery	1 = enabled 0 = disabled (default = 1 for Si2/SiK2 iClass secure reader)
		(Must make sure that iClass/Felica** 40-bit UID(CSN) (Byte 24 bit 6) is disabled to utilize this feature)	(default = 0 for MT/MTK/MT2/MTK2 reader types as this feature is not supported)
	5	13.56 MHz Smart - 15693 UID (CSN)	1=enabled 0=disabled
	6	13.56 MHz Smart – iClass/Felica** 40-bit UID (CSN)	1=enabled 0=disabled (default = 0)
	7	13.56 MHz Smart Card - 14443 PIV 200bit (open)	1=enabled 0=disabled (requires 14443 UID to be disabled)
byte25		PIV Configuration format	0 – Disabled 2 - FORMAT 2 - 58-bit TWIC / CAC 4 - FORMAT 4 - 64-bit (BCD) TWIC / CAC 5 - FORMAT 5 - 83-bit TWIC / CAC 6 - FORMAT 6 - 66-bit (58 bit format + TSM) TWIC / CAC 7 - FORMAT 7 - 64-bit (58 bit format (no parity) + TSM) TWIC / CAC 8 - FORMAT 8 - 91-bit (83 bit format + TSM) TWIC / CAC 9 - FORMAT 9 - 40-bit BCD 10 - FORMAT 10 - 40-bit Reversed BCD 11 - FORMAT 11 - 64-bit BCD 12 - FORMAT 12 - 64-bit Reversed BCD 13 - FORMAT 13 - 128-bit BCD 14 - FORMAT 14 - 128-bit Reversed BCD 15 – FORMAT 15 – 58-bit AMAG
byte26		13.56 MHz Smart – iClass/Felica Output Format (If other than 40-bit UID required) (Must make sure that iClass/Felica 40-bit UID (CSN) (Byte 24 bit 6) and iClass SE/SEOS (byte 24 bit 4) are disabled in order to utilize this feature)	0 = Disabled 1 = reserved 2 = reserved 3 = reserved 4 = 64 bit CSN Enabled 5 - 255 = reserved (default = 4 for MT/MTK/MT2/MTK2) (default = 0 for Mi/MiK/Si2/SiK2)
byte27	0	Beeper on/off (normal operation)	1=beeper enabled 0=beeper disabled
	1	Support for 14 PIV Format	1= Supports 14 PIV formats 0= Does not support 14 PIV formats (Supports only 75 bit and 200 bit)
	2	13.56 MHz Smart Card - 14443 Secure MiFare Plus	0=enabled 1=disabled (requires 14443 UID to be disabled)
	3	BLE Credential Enable***	0=disabled 1=enabled (default = 1)
	4	BLE Credential Range***	0=short 1=long (default = 0)
	5	BLE Performance***	0=normal 1=max (default = 0)
	6	Credential Read LED***	0=none 1=green (default = 1)
	7	Reserved
byte28		In Reader Firmware, this byte is assigned for “ReaderConfigTableVersion”
byte29	0	Card Read Retries	1=enable 0=disable (default = 0)
	1	Reserved
	2	Reserved
	3	Reserved
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
byte30	Reserved
byte31	Reserved
byte32	Reserved

(1) For ENGAGE products, the credential inquiry timeout is defined by 100ms* [First_Delay + (Subsequent_Delay*Retry_Times)] Different combinations resulting in the same final value will result in the same credential inquiry; however, it does not change the communication interval between wireless APMs andthe Gateway during the inquiry timeout.

(2) For the ENGAGE Gateway, ACP_COMMUNICATIONS_TIMEOUT is a global change that affects all APMs linked to that Gateway.

(3) Power failure for AD300 and bad/critical battery for AD400 have a higher priority than “Failure mode for communications loss.”

* Indicates a configuration that is not supported by ENGAGE products.

** Indicates Felica is only supported on AD MT2/MTK2/Si2/SiK2/FMK2 readers.

*** Indicates configuration supported by NDEB, LEMSB, LEMBB, and LEMDB readers only.

Table 1-84: Next Generation WRI400 Reader Configuration Structure

WRI400 Reader Configuration Data NOTE: The WRI400 uses a unique set of reader configurations. These configuration definitions are used in place of Byte 17 – Byte 32 in Table 1-83 (Next Gen Lock APM/Reader Configuration Structure) for the WRI400.

Byte	Bit	Function	Comments
Byte17			Reserved
Byte18			Reserved
Byte19		Reserved
Byte20	0	Reserved
	1	Reserved
	2
	3
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
Byte21		Reserved
Byte22	0 1 2 3	WRI400 Number of keys to buffer	1-11 (default = 4)
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
Byte23		Reserved
Byte24		Reserved
Byte25		Reader 1 keypad facility code	0-255 (applies only to byte8 format #7) (default = 1)
Byte26		Reserved
Byte27	0	WRI400 Beeper on/off	1=enabled 0=disabled (default = 1)
	1	Reserved
	2	Reserved
	3	Reserved
	4	Reserved
	5	Reserved
	6	Reserved
	7	Reserved
Byte28		Reader 2 keypad facility code	0-255 (applies only to byte10 format #7) (default = 1)
Byte29		Reserved
Byte30		Reserved
Byte31		Reserved
Byte32		Reserved

(*) RSD_WOR (36H/87H)

Table 1-85: RSD_WOR Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	02H
5 6	Data	Sub Command: 87H Current WOR value: 0-10 (1)
7/8	Frame Check Sequence	CRC or CHECKSUM

(1) WOR is always enabled for ENGAGE Gateway. ENGAGE Gateway responds with set value of 5.

(*) WOR_WAKEUP (36H/88H)

Table 1-86: WOR_WAKEUP_STATUS Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	01H
5	Data	Sub Command: 88H
5/6	Frame Check Sequence	CRC or CHECKSUM

(*) WOR_WAKEUP STATUS (36H/89H)

Table 1-87: WOR_WAKEUP_STATUS Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	04H
5	Data	Sub Command: 89H
6		Command Execution Status: Bit0: 0- in process 1- completed.
7		Lock Bit Map Low Byte: 0-lock waked up 1-lock not waked up
8		Lock Bit Map High Byte: 0-lock waked up 1-lock not waked up
9/10	Frame Check Sequence	CRC or CHECKSUM

(*) APM_BATTERY_STATUS (36H/86H)

Table 1-88: APM_BATTERY Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	06H
5	Data	Sub Command: 86H
6		APM Address: Refer Refer to APM Address Space section
7		Battery low byte : BCD format (fraction part)
8		Battery high byte: BCD format (integral part)
9		Lithium Battery low byte : BCD format (fraction part)
10		Lithium Battery high byte: BCD format (integral part)
11/12	Frame Check Sequence	CRC or CHECKSUM

(*) APM_PEDIGREE (TBD)

TBD

(*) APM_STATISTICS (TBD)

TBD

FIRMWARE_VERSION (41H)

Table 1-89: FIRMWARE_VERSION Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	41H
4	Length	3+(3*N), N=number of doors supported by this PIM/Gateway (1-16)
5	Data	PIM/ENGAGE Gateway major firmware version: 0-254
6		PIM/ENGAGE Gateway minor firmware version: 0-254
7		WAPM start (low) addr: 00H-FEH, not AAH
8		WAPM 1 Type: 0-254 ....00 = IRL(1G) ....01 = WISI(1G) ....02 = WPR(1G)/WPR400 ....03 = MIRL(1G)/AD-400 ....04 = Reserved ....05 = AD-401 ....06 = WRI401 ....07 = WPR401 ....08 = AD-402 ....09 = Reserved ....10 = WRI(1G)/WRI400 ....11 = WPR400-B ....12 = AD400-B ....13 = WRI400-B ....14 = NDE ....15 = ADE ....16 = BE467/FE410 ....17 = LE ....18 = RMRU ....19 = NDEB ....20 = LEB
9		WAPM 1 major firmware version: 0-255 (1)
10		WAPM 1 minor firmware version: 0-255 (1)
• • •
8+(N-1)*3		WAPM N Type: 0-254 ....00 = IRL(1G) ....01 = WISI(1G) ....02 = WPR(1G)/WPR400 ....03 = MIRL(1G)/AD-400 ....04 = Reserved ....05 = AD-401 ....06 = WRI401 ....07 = WPR401 ....08 = AD-402 ....09 = Reserved ....10 = WRI(1G)/WRI400 ....11 = WPR400-B ....12 = AD400-B ....13 = WRI400-B ....14 = NDE ....15 = ADE ....16 = BE467/FE410 ....17 = LE ....18 = RMRU ....19 = NDEB ....20 = LEB
9+(N-1)*3		WAPM N major firmware version: 0-255
10+(N-1)*3		WAPM N minor firmware version: 0-255
11+(N-1)3 12+(N-1)3	Frame Check Sequence	CRC or CHECKSUM

(1) RSD devices AD300/AD301 do not include WAPM version. Value is returned as 0.

(*) FULL_FIRMWARE_VERSION (36H/8AH)

Table 1-90: FULL_FIRMWARE_VERSION Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	8+N*7 (N=total number of WAPMs assigned to PIM/Gateway, 1-16)
5	Data	Sub Command: 8AH
6		PIM/ENGAGE Gateway major firmware version: 0-255
7		PIM/ENGAGE Gateway minor firmware version: 0-255
8		PIM/ENGAGE Gateway build firmware version: 0-255
9		PIM radio major firmware version: 0-255 (1)
10		PIM radio minor firmware version: 0-255 (1)
11		PIM radio build firmware version: ASCII (a-z, A-Z) (1)
12		PIM’s WAPM Low Address: 0-FEH, not AA
13		WAPM N Type: 0-255 ....00 = IRL(1G) ....01 = WISI(1G) ....02 = WPR(1G)/WPR400 ....03 = MIRL(1G)/AD-400 ....04 = Reserved ....05 = AD-401 ....06 = WRI401 ....07 = WPR401 ....08 = AD-402 ....09 = Reserved ....10 = WRI(1G)/WRI400 ....11 = WPR400-B ....12 = AD400-B ....13 = WRI400-B ....14 = NDE ....15 = ADE ....16 = BE467/FE410 ....17 = LE ....18 = RMRU
14		WAPM N major firmware version: 0-255
15		WAPM N minor firmware version: 0-255
16		WAPM N build firmware version: 0-255
17		WAPM N radio major firmware version: 0-255 (1)
18		WAPM N radio minor firmware version: 0-255 (1)
19		WAPM N radio build firmware version: ASCII (a-z, A-Z) (1)
20/21+((N-1)*7)	Frame Check Sequence	CRC or CHECKSUM

(1) ENGAGE devices do not include a radio module FW version. Value is read as 0xFF. RSD devices AD300/AD301 do not include a radio module FW version. Value is returned as 0.

(*) APM_SERIAL_NUMBERS (5AH/81H)

Table 1-91: APM_SERIAL_NUMBERS Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5AH
4	Length	32H
5	Data	Sub Command: 81H
6		APM address: Refer to APM Address Space section
7-22		Main Serial Number – 16 byte ASCII data
23-38		Reader Serial Number – 16 bytes ASCII data
39-54		Radio Serial Number – 16 bytes ASCII data (1)
55/56	Frame Check Sequence	CRC or CHECKSUM

(1) ENGAGE devices do not include a radio serial number. Value is read as 0xFF. RSD devices AD300/AD301 do not include a radio serial number. Value is returned as 0.

(*) APM_MANUFACTURE_DATES (5AH/82H)

Table 1-92: APM_MANUFACTURE_DATES Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5AH
4	Length	0EH
5	Data	Sub Command: 82H
6		APM address: Refer to APM Address Space section
7-10		Main Manufacture Date
11-14		Reader Manufacture Date
15-18		Radio Manufacture Date (1)
19/20	Frame Check Sequence	CRC or CHECKSUM

NOTE: The Manufacture Date is captured in four bytes as binary data where each nibble corresponds to one digit of the day. (Example: 0x20100315 = 2010, March 15); also, Radio Manufacture Date is not currently supported so the radio date is returned as 0xFFFFFFFF).

(1) ENGAGE devices do not include a radio manufacture date. Value is read with every byte as 0xFF.

(*) APM_HARDWARE_VERSIONS (5AH/83H)

Table 1-93: APM_HARDWARE_VERSIONS Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5AH
4	Length	08H
5	Data	Sub Command: 83H
6		APM address: Refer to APM Address Space section
7/8		Main Hardware Version
9/10		Reader Hardware Version
11/12		Radio Hardware Version (1)
13/14	Frame Check Sequence	CRC or CHECKSUM

NOTE: Radio Hardware Version is not supported so the response is 0xFFFF for that field.

(1) ENGAGE devices do not include a hardware version. Values are read with every byte read as 0xFF.

(*) RSD_SERIAL_NUMBERS (5BH/81H)

Table 1-94: RSD_SERIAL_NUMBERS Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5BH
4	Length	32H
5	Data	Sub Command: 81H
6		RSD address: 00H to FEh & not AAH
7-22		Main Serial Number – 16 byte ASCII data
23-38		Reader Serial Number – 16 bytes ASCII data (1)
39-54		Radio Serial Number – 16 bytes ASCII data (1)
55/56	Frame Check Sequence	CRC or CHECKSUM

NOTE: The serial number of the Radio module is Not Applicable on an AD-300, so the radio serial number is returned as 0xFFFFFFFFFFFFFFFF).*

(1) Gateway does not include a reader serial number or radio serial number. Values are read with every byte read as 0xFF.

(*) RSD_MANUFACTURE_DATES (5BH/82H)

Table 1-95: RSD_MANUFACTURE_DATES Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5BH
4	Length	0EH
5	Data	Sub Command: 82H
6		RSD address: 00H to FEh & not AAH
7-10		Main Manufacture Date
11-14		Reader Manufacture Date (1)
15-18		Radio Manufacture Date (1)
19/20	Frame Check Sequence	CRC or CHECKSUM

NOTE: The Manufacture Date is captured in four bytes as binary data where each nibble corresponds to one digit of the day. (Example: 0x20100315 = 2010, March 15). Radio Manufacture Date is not supported so the radio date is returned as 0xFFFFFFFF).

(1) Gateway does not include a reader manufacture date or radio manufacture date. Values are read with every byte read as 0xFF.

(*) RSD_HARDWARE_VERSIONS (5BH/83H)

Table 1-96: RSD_HARDWARE_VERSIONS Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	5BH
4	Length	08H
5	Data	Sub Command: 83H
6		RSD address: 00H to FEh & not AAH
7/8		Main Hardware Version
9/10		Reader Hardware Version (1)
11/12		Radio Hardware Version (1)
13/14	Frame Check Sequence	CRC or CHECKSUM

NOTE: Radio Hardware Version is not supported so the response is 0xFFFF for that field.

(1) Gateway does not include a reader hardware version or radio hardware version. Values are read with every byte read as 0xFF.

(*) AD_RSD_OEM_CODE (36H/8CH)

Table 1-97: (+) AD_RSD_OEM_CODE Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	04H, 06H, 07H, 08H or 09H
5	Data	Sub Command: 8CH
6 7 8 9 10 11 12 13	Data	“PIM400” – AD Panel Interface Module “AD300” – AD wired “PIM400-B” – AD Panel Interface Module for use outside North America “AD300-B” – AD wired lock for use for use outside North America “GWE” – ENGAGE Gateway “AD301” – AD wired with FMK reader “AD302” – AD wired main board that is FIPS201-2 compliant
11/12/14 12/13/15	Frame Check Sequence	CRC or CHECKSUM

NOTES:

Bytes 6-12 contain ASCII values of the character inside the double parenthesis in the description field.
Example: “PIM400” would have 50H, 4DH, 49H, 34H, 30H, 30H returned in bytes 6-12.

(*) AD_APM_OEM_CODE (36H/8BH)

Table 1-98: (+) AD_APM_OEM_CODE Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	04H - 09H
5	Data	Sub Command: 8BH
6 7 8 9 10 11 12 13	Data	“AD300” – AD wired “AD400” – AD wireless “WRI400” – AD wireless reader interface “WPR400” – AD wireless portable reader “WSM400” – AD wireless status monitor “AD400-B” – AD wireless designed for use outside North America “WRI400-B” – AD wireless reader interface designed for use outside North America “WPR400-B” – AD wireless portable reader designed for use outside North America “AD300-B” – AD wired lock for use outside North America “AD401” – AD wireless with FMK reader “AD301”-- AD wired with FMK reader “WPR401”-- AD wireless reader interface with FMK reader “AD402” – AD wireless main board that is FIPS201-2 compliant “AD302” – AD wired main board that is FIPS201-2 compliant “NDE” – NDE lock “ADE” – ADE lock “LEMS” – LE lock indicator only “LEMB” – LE IPB lock “LEMD” – LE Deadbolt lock “BE467” – Schlage Control without interconnect “FE410” = Schlage Control with interconnect “RM” – Remote Monitor (RM) version of RMRU Exit Device “RU” – Remote Undog (RU) version of RMRU Exit Device “NDEB” – NDE 1.1 lock “LEMSB” – LE 1.1 lock indicator only “LEMBB” – LE 1.1 IPB Lock “LEMDB” – LE 1.1 Deadbolt Lock “UNDEFN” – undefined device at this address
11/12/13/14 12/13/14/15	Frame Check Sequence	CRC or CHECKSUM

NOTES:

Bytes 6-12 contain ASCII values of the character inside the double parenthesis in the description field.
Example: “AD300” would have 41H, 44H, 33H, 30H, 30H, 20H, 20H returned in bytes 6-12.

(*) AD_RSD_PARTNER_ID (36H/8EH)

Table 1-99: (+) AD_RSD_PARTNER_ID Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	05H
5	Data	Sub Command: 8EH
6 7 8 9	Data	Partner ID
10/11	Frame Check Sequence	CRC or CHECKSUM

NOTES:

Bytes 6-9 contain ASCII values of the character inside the double parenthesis in the description field.
Example: “CBRD” would have 43H, 42H, 52H, 44H returned in bytes 6-9.
We are currently sending 3 bytes, and this can be expanded to send 4 ASCII bytes in the future. Example: “CBD” will have values 43H, 42H, 44H and NULL returned in bytes 6-9.
Not supported by ENGAGE products.

(*) AD_APM_PARTNER_ID (36H/8DH)

Table 1-100: (+) AD_APM_PARTNER_ID Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	05H
5	Data	Sub Command: 8DH
6 7 8 9	Data	Partner ID
10/11	Frame Check Sequence	CRC or CHECKSUM

NOTES:

Bytes 6-9 contain ASCII values of the character inside the double parenthesis in the description field.
Example: “CBRD” would have 43H, 42H, 52H, 44H returned in bytes 6-9.
We are currently sending 3 bytes, and this can be expanded to send 4 ASCII bytes in the future. Example: “CBD” will have values 43H, 42H, 44H and NULL returned in bytes 6-9.
Not supported by ENGAGE products.

(*) READER_INFORMATION (36H/8FH)

Table 1-101: (+) READER_INFORMATION Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	36H
4	Length	07H
5	Data	Sub Command: 8FH
6	Data	0=RDR-PROX 1=RDR-MAG 2=RDR-SMART 16= RDR_MAGSW_KPD 17= RDR-FMK(FIPS) 18=RDR-MT 19=RDR-KP 20=RDR_MAG_NO_KPD 21=RDR_MT_NO_KPD 22=RDR_SMART_NO_KPD 23=RDR_PROX_NO_KPD 25=RDR_MAGSW_NO_KPD 31=RDR_Mi_NO_KPD 32=RDR_Mi_WITH_KPD 58=RDR_Si2_WITH_KPD 59=RDR_Si2_NO_KPD 60=RDR_KP2 61=RDR_MT2_WITH_KPD 62=RDR_MT2_NO_KPD 63=RDR_Mi2_WITH_KPD 64=RDR_Mi2_NO_KPD 65=RDR_FM2_WITH_KPD 66=RDR_FM2_NO_KPD (reserved) 67=NDE_MT2_NO_KPD 68=CONTROL_SM2_NO_KPD 69=LE_MT2_NO_KPD 255=No Model Information
7-9	Data	3 bytes for reader firmware version- 1 each for major, minor and build:
10-11	Data	2 Bytes reserved(0x00 always)
12/13	Frame Check Sequence	CRC or CHECKSUM

NOTES:

If the reader information is not available, reader type sends as $FF and version string is $FF $FF $FF.
Example: PIM linked to an AD400/WPR with prox reader and version 2.8.1, responds as 0A FF 36 07 8F 00 02 08 01 00 00 C7 F9.
On FDR PIM sends the reader type and the version info as $FF only.

(*) START_FW_DOWNLOAD_RESP (16H/00H)

Table 1-102: START_FW_DOWNLOAD_RESP Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 00H
6	Data	Response Code: 0x00 = No Error: Ready to start download 0x01 = In Progress 0x02-0x2F = Reserved 0x30 = Error: Incorrect message format 0x31 = Error: Already in reflash mode 0x32 = Error: Invalid download target 0x33 = Error: Target does not support ONR 0x34 = Error: WOR not enabled (N/A for Gateway) 0x35 = Error: Target WAPM offline (N/A for Gateway) 0x36 = Error: Target has low batteries 0x37 = Error: Gateway is busy processing the prior command 0x38 = Error: Lock Bitmap includes more than one device type (Gateway Only) 0x39 = Error: Lock Bitmap includes unlinked or unknown device(s) (Gateway Only) 0x3A = Error: Lock Bitmap doesn’t match download target (Gateway Only) 0x3B-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) FW_FILE_BLOCK_RESP (16H/01H)

Table 1-103: FW_FILE_BLOCK_RESP Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 01H
6	Data	Response Code: 0x00 = No Error: Ready for next block 0x01 = In Progress 0x02-0x3F = Reserved 0x40 = Error: Not in active firmware download session 0x41 = Error: Invalid block size received 0x42 = Reserved 0x43 = Error: Out of sequence block ID 0x44 = Error: Unable to write data to memory 0x45 = Error: Invalid FW file type received (N/A for Gateway) 0x46 = Error: Invalid FW file version received (N/A for Gateway) 0x47 = Error: Invalid block ID received 0x48 = Reserved 0x49 = Error: Buffer full – not ready for data (N/A for Gateway) 0x4A = Error: The command does not support download target (Gateway Only) 0x4B-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) LARGE_FW_FILE_BLOCK_RESP (16H/06H)

Table 1-104: LARGE_FW_FILE_BLOCK_RESP Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 06H
6	Data	Response Code: 0x00 = No Error: Ready for next block 0x01 = In Progress 0x02-0x3F = Reserved 0x40 = Error: Not in active firmware download session 0x41 = Error: Invalid block size received 0x42 = Reserved 0x43 = Error: Out of sequence block ID 0x44 = Error: Unable to write data to memory 0x45 = Error: Invalid firmware file type received (N/A for Gateway) 0x46 = Error: Invalid firmware file version received (N/A to Gateway) 0x47 = Error: Invalid block ID received 0x48 = Reserved 0x49 = Error: Buffer full – not ready for data (N/A to GWE) 0x4A-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) END_FW_DOWNLOAD_RESP (16H/02H)

Table 1-105: END_FW_DOWNLOAD_RESP Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 02H
6	Data	Response Code: 0x00 = No Error: firmware file verified 0x01 = In Progress 0x02-0x44 = Reserved 0x45 = Error: Invalid firmware file type received 0x46 = Error: Invalid firmware file version received (N/A to Gateway) 0x47-0x4F = Reserved 0x50 = Error: Not in active firmware download session 0x51 = Error: CRC validation failed (For the Gateway, this does not apply for Edge Device Firmware) 0x52 = Error: WOR not enabled (N/A for Gateway) 0x53 = Reserved 0x54 = Error: Gateway processing another ONR command 0x55 = Error: Gateway failed to transfer firmware image to all targeted device(s) 0x56-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) ABORT_FW_DOWNLOAD_RESP (16H/03H)

Table 1-106: ABORT_FW_DOWNLOAD_RESP Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 03H
6	Data	Response Code: 0x00 = No Error: Aborting download session .............No Error: Abort action completed (Gateway Only) 0x01 = In Progress (Gateway Only) 0x02-0x5F = Reserved 0x60 = Error: Incorrect message format 0x61 = Error: Busy with other ONR target 0x62 = = Error: Lock Bitmap includes more than one device type (Gateway Only) 0x63 = Error: Lock Bitmap includes unlinked or unknown edge device(s) (Gateway Only) 0x64-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) START_FW_REFLASH_RESP (16H/04H)

Table 1-107: START_FW_REFLASH_RESP Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	02H
5	Data	Sub Command: 04H
6	Data	Response Code: 0x00 = Reserved 0x01 = In Progress 0x02-0x6F = Reserved 0x70 = Error: Incorrect message format 0x71 = Error: Invalid reflash target 0x72 = Error: No valid fw file downloaded 0x73 = Error: Fw file in process of being verified (N/A for Gateway) 0x74 = Error: Busy with other ONR activity 0x75 = Error: WOR not enabled (N/A for Gateway) 0x76 = Error: Reflash Failed 0x77: = Error: Lock Bitmap includes more than one device type (Gateway Only) 0x78 = Error: Lock Bitmap includes unlinked or unknown device(s) (Gateway Only) 0x79 = Error: Device has a low battery 0x7A-0xFF = Reserved
7/8	Frame Check Sequence	CRC or CHECKSUM

(*) ONR_STATUS (16H/05H)

Table 1-108: START_FW_REFLASH_RESP Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	16H
4	Length	05H
5	Data	Sub Command: 05H
6	Data	Status Identifier:* 0x00 = Start firmware download 0x01 = Send firmware file block 0x02 = End firmware download 0x03 = Abort firmware download 0x04 = Start firmware reprogramming 0x05 = Reserved 0x06 = Send large firmware file block 0x07-0xFF = Reserved
7	Data	Status Code:* 0x00 = Ready 0x01 = In Progress 0x02 = In Progress, but waiting on WOR to be enabled (N/A for Gateway) 0x03-0x0F = Reserved 0x10 = Target WAPM currently offline (N/A for Gateway) 0x11 = Resend previous FW file block 0x12-0x20 = Reserved 0x21 = Error: Power cycle occurred 0x22 = Error: Unknown Issue 0x23 = Error: Reader not responding to ONR command (N/A for Gateway) 0x22-0x31 = Reserved 0x32 = Error: Invalid start FW download target received 0x33 = Error: Target does not support ONR download (N/A for Gateway) 0x34 = Error: WOR is not enabled, unable to send start FW download request to target (N/A for Gateway) 0x35 = Reserved 0x36 = Error: Target has low batteries 0x37-0x42 = Reserved 0x43 = Error: Out of sequence block ID 0x44 = Error: Unable to write data to memory 0x45 = Error: Invalid FW file type received 0x46 = Error: Invalid FW file version received (N/A for Gateway) 0x47 = Error: Invalid block ID received 0x48 = Error: WOR is not enabled, unable to send FW file block request to target (N/A for Gateway) 0x49-0x50 = Reserved 0x51 = Error: CRC validation failed (Gateway: Applies only to the Gateway firmware file) 0x52 = Error: WOR is not enabled, unable to send end FW download request to target (N/A for Gateway) 0x55 = Error: Gateway failed to transfer firmware image to all targeted devices 0x56-0x74 = Reserved 0x75 = Error: WOR is not enabled, unable to send start FW reflash request to target (N/A for Gateway) 0x76 = Error: WAPM reflash timed out 0x77-0xFF = Reserved
8	Data	Lock Bit Map Low Byte** Bit0 = 1st lock on the PIM Bit Value = 1: ......If StatusCode = In Progress, this lock is being processed. ......If StatusCode = Error, this lock returned an error. ......If StatusCode = Ready, this lock is active in this activity and ready. Bit Value = 0: ......If StatusCode = In Progress, this lock has finished processing and did not cause this In Progress status. ......If StatusCode = Error, this lock is not the cause of Error status. ......If StatusCode = Ready, this lock is not involved in this activity.
9	Data	Lock Bit Map High Byte** Bit0 = 9th lock on the PIM Same definition as Byte 8
10/11	Frame Check Sequence	CRC or CHECKSUM

*The Status Identifier represents the next expected message in the ONR process if the Status Code is set to 0x00(READY). Otherwise, the Status Identifier represents the current message being processed or the message associated with the error.

**These bytes only have significance if the current download/reflash target is an AD-400 or a reader that is attached to an AD-400. If the download/reflash target device is not one of these, then these bytes are sent as 0x00 and can be ignored.

(*) RSD_DIAGNOSTICS_CONFIGURATION (51H)

Table 1-109: – RSD_DIAGNOSTICS_CONFIGURATION Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	51H
4	Length	01H
5	Data	00H = Configuration Setting Successful (No Error) 01H = Configuration Setting Unsuccessful (Error) 02H-FFH = Reserved
6/7	Frame Check Sequence	CRC or CHECKSUM

(*) RSD_SECURE_MODE_STATUS_RESP (21H/08H)

Table 1-110: RSD_SECURE_MODE_STATUS_RESP Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	RSD address	FFH
3	Type	21H
4	Length	03H
5	Data	Byte 1	Sub command: 08H
		Byte 2	Secure Mode Status Byte
			Bit 7	RFU (will be zero)
			Bit 6	RFU (will be zero)
			Bit 5	Selected Default Key 1 – ACP Default Key is selected 0 – Allegion Default Key is selected
			Bit 4	Master key info 0 – Master key is not set 1 – Master key is set
			Bit 3	Default key info 1 – ACP Default Key is set 0 – ACP Default key is not set
			Bit 2	Admin Session info 0 – Admin Session Not Active 1 – Admin Session Active
			Bit 1	Normal Session info 0 – Normal Session Not Active 1 – Normal Session Active
			Bit 0	Secure Mode Info 0 – Disable 1 – Enable
		Byte 3	Error Code 0x00 = No error 0x01 = Error Session not established 0x02 = Error command not supported during current session 0x03 = RFU 0x04 = Error unencrypted command not allowed 0x05 = Error Session terminated due to session timeout 0x06 = Error session terminated due to send sequence number roll over 0x07 – 0x0F = RFU 0x10 = Error START_SECURE_SESSION length invalid 0x11 = Error START_SECURE_SESSION session type is invalid 0x12 = Error START_SECURE_SESSION Normal session creation is not allowed 0x13 – 0x1F = RFU 0x20 = Error START_SECURE_SESSION_ACK length invalid 0x21 = Error START_SECURE_SESSION_ACK random number mismatch 0x22 – 0x2F = RFU 0x30 = Error SECURE_HOST_CONFIG length invalid 0x31 = Error SECURE_HOST_CONFIG incorrect secure mode configuration value 0x32 = Error SECURE_HOST_CONFIG session timeout cannot be zero 0x33 = Error SECURE_HOST_CONFIG ACP Default Key is not set, cannot configure RSD to use the ACP Default Key 0x34 – 0x3F = RFU 0x40 = Error Encrypted Command length invalid 0x41 = Error Encrypted Command Session terminated due to sequence number mismatch 0x42 = Error Encrypted Command Secure CRC mismatch 0x43 = Error Encrypted Command Session terminated due to consecutive three times Secure CRC mismatch 0x44 = Error Encrypted Command Session terminated due to received sequence number roll over 0x45 – 0x4F = RFU 0x50 = Error SET_ACP_KEY length invalid 0x51 = Error SET_ACP_KEY Key Type invalid 0x52 – 0x5F = RFU 0x60 = Error GET_RSD_RSIENCRYPTION_STATUS length invalid 0x61 – 0xFF = RFU
8/9	Frame Check Sequence	CRC or CHECKSUM

(*) RSD_START_SECURE_SESSION_CHALLENGE (21H/01H)

Table 1-111: RSD_START_SECURE_SESSION_CHALLENGE Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	RSD address	FFH
3	Type	21H
4	Length	11H
5	Data	Byte 1	Sub command: 01H
		Byte 2-17	Encrypted and Permuted RSD Random Number
22/23	Frame check sequence	CRC or CHECKSUM

(*) RSD_START_SECURE_SESSION_COMPLETE (21H/02H)

Table 1-112: RSD_START_SECURE_SESSION_COMPLETE Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	RSD address	FFH
3	Type	21H
4	Length	11H
5	Data	Byte 1	Sub command: 02H
		Byte 2-17	Encrypted and Permuted ACP Random Number
22/23	Frame check sequence	CRC or CHECKSUM

(*) RSD_SECURE_RESPONSE (2FH)

Table 1-113: RSD_SECURE_RESPONSE Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	RSD address	FFH
3	Type	2FH
4	Length	Variable (always be in multiple of 16)
5 – n	Data	Encrypted Original Response
n+1/n+2	Frame check sequence	CRC or CHECKSUM

(*) APM_PIV_GEN_AUTH_RESPONSE (79H | F9H)

When the length of the message data exceeds 255 bytes, the Type field changes to F9H to indicate a 2-byte Length field. The optional 2nd Length byte is inserted at Byte 5. Byte 4 is Length LSB, and Byte 5 is Length MSB.

Table 1-114: APM_PIV_GEN_AUTH_RESPONSE Response Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	F9H (79H is the actual message type, but the MSB bit is set to represent that this message has a two byte length field. Refer to the Type section for more details.)
4	Length LSB	Variable (Min: 03H Max: 103H)
5	Length MSB	Variable (Min: 03H Max: 103H)
6	APM Address	Address of the APM that is providing the response
7 through N	Data[0]-Data[X]	Authentication Response Data (LSB sent first with maximum length of 256 bytes in a single message)
N+1/N+2	Frame Check Sequence	CRC or CHECKSUM

(*) APM_PIV_GEN_AUTH_ACK/ERR (7AH)

Table 1-115: APM_PIV_GEN_AUTH_ACK/ERR Command Packet Format

Byte	Field	Data/Description
1	Start of Frame	0AH
2	ACP Address	FFH
3	Type	7AH
4	Length	Variable (Min: 03H Current Max: 05H)
5	APM Address	Address of the APM that is providing the response
6	Error Type	Error Type: 0x00 = No Error 0x01 = PIV card error 0x02 = Gen Auth Timeout 0x03 = Gen Auth Challenge Too Large (256 byte max) 0x04 = FIPS Incompatible 0x05 = Command Not Supported 0x06 = Gen Auth Challenge Mismatch 0x07 = Non-FIPS Reader 0x08 = Non-FIPS Reader version 0x09-0xFF = Reserved
7	Detailed Error Code Length	Number of bytes of detailed error code information that are sent (if 0 then no detailed error code bytes will follow).
8 through N	Detailed Error Code	Detailed information about the error. Number of bytes depends on the previous byte in the message, current maximum of bytes to expect is 2, but that could change in the future.
N+1/N+2	Frame Check Sequence	CRC or CHECKSUM