1.

Read the tag number in a single time：

Send：BB 00 22 00 00 22 7E
hexadecimal number，there are 7 bytes in total；

If reading tag, the module replies：

BB 02 22 00 11 D5 30 00 E2 00 10 71 00 00 52 9B 09 40 B4 02 EB 98 0C 7E
BB 02 22 : is a package identifier, with 3 bytes in length；
00 11 ：is the package length, hexadecimal，0x11Represents 17 bytes, and 2 bytes in length；
D5 30 00 ：You can leave it alone ；3 bytes in length, and the specific content may change；
E2 ~ B4 02：tag number, with 12 bytes in total；
EB 98：CRC of tag；
0C: Checksum ； Specific counting method See below Field parsing of written to the sent
package；
7E；termination character；
If the tag is not read, or no tag, the module replies：
BB 01 FF 00 01 15 16 7E
There are 8 bytes in total；

2. Multiple reading tag number instruction：

Send：BB 00 27 00 03 22 FF FF 4A 7E
BB 00 27 ：Frame flag, 3 bytes；
00 03：Data length, 2 bytes；0003 Indicates 3 bytes；
22：Keep the bytes；
FF FF ： Number of reads, with 65,535 consecutive reads ； If read 100 consecutive
times，fill in 00 64；
4A：Checksum，00 27 00 03 22 FF FF Every byte adds up，get 0x024A；Withdrawal is 8
bits lower than 4A;
7E：termination character

Recv： BB 01 FF 00 01 15 16 7E
BB 01 FF 00 01 15 16 7E
.
.
.
BB 02 22 00 11 C8 34 00 E2 00 10 71 00 00 52 9B 09 40 B4 02 16 3D D3 7E
BB 01 FF 00 01 15 16 7E
BB 02 22 00 11 C9 34 00 E2 00 10 71 00 00 52 9B 09 40 B4 02 16 3D D4 7E
BB 02 22 00 11 C0 34 00 E2 00 10 71 00 00 52 9B 09 40 B4 02 16 3D CB 7E
BB 01 FF 00 01 15 16 7E

After sending a linked read frame, it receive two types of packets。

BB 01 FF 00 01 15 16 7E
 This is one of these, indicating a read failure；
BB 02 22 00 11 C0 34 00 E2 00 10 71 00 00 52 9B 09 40 B4 02 16 3D CB 7E
This is the other type, indicating the reading of the tag number：
The specific format is the same as in the reply package with a single read tag number；
BB 02 22：Frame flag, 3 bytes；
00 11：Data length, 11 for hexadecimal, is actually 17 bytes；
C0：Signal strength; RSSI, 1 byte；
34 00：PC，2 bytes；
E2 00 10 71 00 00 52 9B 09 40 B4 02：tag Number, 12 bytes；
16 3D ：CRC 2 bytes；
CB：Checksum，02 ~ 16 3D accumulation, Take 8 bits low；
7E：termination character ；

3. End of Multi- reading：

Send： BB 00 28 00 00 28 7E
Due to the large number of multi reads, the operation time will be very long, and the
customer can send the instruction to end the multi reading instruction；
Recv： BB 01 28 00 01 00 2A 7E
The module executes a reply to the end multi read instruction。

4. Select Set：
Send：BB 00 0C 00 07 23 00 00 00 00 60 00 96 7E
No mask mode；
BB 00 0C 00 13 23 00 00 00 00 60 00 E2 00 00 16 55 11 02 06 03 90 EA AF 34 7E
Among E2 00 00 16 55 11 02 06 03 90 EA AF it is the EPC (tag number) mask of the
tag，When added, you can read and write the specified tag unaffected。
Rcve：BB 01 0C 00 01 00 0E 7E
Set success。

5. Write：
Send：BB 00 0C 00 07 23 00 00 00 00 60 00 96 7E
BB 00 49 00 11 00 00 00 00 03 00 00 00 04 01 02 03 04 05 06 07 08 85 7E
It actually sent two packets of data, the first packet was Select Set ；The second package is
the write package 。 Refer to Select Set above for more details ； The following describes writing
packages：
BB 00 49 :It's a package identifier，Length 3 bytes；
00 11 ：Is the package length, hexadecimal, 0x11 means 17 bytes, and 2 bytes long；
00 00 00 00：Is the access password（The default is 00 00 00 00），Length 4 bytes；
03 : Selecting a user storage area；
00 00 ： Represents the address offset of the written storage area ， 00 00 Means
writing from the 0 address;
 00 04 ： Represents the length of the data being written to ， 00 04 Represents a
write of 4 words (8 bytes)；
01 02 03 04 05 06 07 08 ：Is the written data；
85 ： Checksum ， The calculation formula is ， All of the bytes before the Checksum
bytes，Except for the first byte BB，The accumulation of each byte，Results were taken only as 8
bits lower；
for example：00 49 00 11 00 00 00 00 03 00 00 00 04 01 02 03 04 05 06 07 08 The
result of the accumulation is：0x85，so Checksum is 85;
7E ：termination character；
Recv：Successful writing will be received：
BB 01 0C 00 01 00 0E 7E
BB 01 49 00 10 0E 34 00 E2 00 00 16 55 11 02 06 03 90 EA AF 00 2E 7E
Successful writes will receive that they are actually 2 packets ， The first package is
response package for the Select Set ；The second package is the written response packet：
BB 01 49 :Is a package identifier for successful writing，Length 3 bytes；
00 10 ：Is the package length, hexadecimal，0x10 Represents the 16 bytes，Length 2
bytes；
0E ： PC+The length of the tag number ， hexadecimal ， 0x0E Represents the 14
bytes，Length 1 byte；
34 00： Is the PC value，Here it is not parsed, you can leave it alone；
E2 00 ~ EA AF ：Is the successfully written tag number, a total of 12 bytes；
00 ：Indicates a successful operation；
2E : Checksum；
7E：termination character；

The write failure is received：

BB 01 0C 00 01 00 0E 7E
BB 01 FF 00 10 10 0E 34 00 E2 00 00 16 55 11 02 06 03 90 EA AF F4 7E
Write failure received is actually 2 packets, the first packet is the Select Set response packet;
the second packet is the written response packet：
BB 01 FF :Is a package identifier, for an error, 3 bytes in length；
00 10 ：Is the package length, hexadecimal, 0x10 means 16 bytes, 2 bytes in length；
10： Error code： 0x10 Indicates that the tag was not found；
0x16 Indicates an incorrect access password；
0xB3 Beyond the read and write range；
Other fields can not be considered, but they will not be analyzed here；

6. Read tag content ：

Send ：BB 00 0C 00 07 23 00 00 00 00 60 00 96 7E
BB 00 39 00 09 00 00 00 00 03 00 00 00 04 49 7E
In fact, two packets of data were sent, the first is Select Set; the second is written 。Refer
to Select Set above for more details；The following describes the read package：
BB 00 39 :Is a package identifier, with 3 bytes in length；
 00 09 ：Is the package length, hexadecimal, 0x09 means 9 bytes, 2 bytes in length；
00 00 00 00：Is the access password (the default is 00 00 00 00），Length 4 bytes；
03 : Selecting a user storage area；
00 00 ：Represents the address offset of the read store area ，00 00 Means to start
writing from the 0 address；
00 04 ：Represents the length of the read ，00 04 Represents a write of 4 words (8
bytes)；
49 ： Checksum ， The calculation formula is ， All of the bytes before the Checksum
bytes，Except for the first byte BB，The accumulation of each byte，Results were taken only as 8
bits lower；
for example：00 39 00 09 00 00 00 00 03 00 00 00 04 , The result of the accumulation
is：0x49，so Checksum is 0x49;
7E ：termination character；

Recv：BB 01 0C 00 01 00 0E 7E
BB 01 39 00 17 0E 34 00 E2 00 00 16 55 11 02 06 03 90 EA AF 01 02 03 04 05 06 07 08 49
7E
Read success will actually receive 2 packets, the first packet is the Select Set response
packet; the second packet is the read successful response packet：
BB 01 39 :Is a package identifier, indicating read success, 3 bytes in length；
00 17 ：Is the length of the package, hexadecimal，0x17 indicates 23 bytes，Length 2
bytes；
0E ： PC+The length of the tag number ， hexadecimal ， 0x0E Represents the 14
bytes，Length 1 byte；
34 00： Is the PC value，Here it is not parsed, you can leave it alone；
E2 00 ~ EA AF ：Is the successfully written tag number, a total of 12 bytes；
01 02 03 04 05 06 07 08 ： Is the specific data, a total of 8 bytes。
49: Checksum；
7E：termination character；
A read failure is received：
BB 01 0C 00 01 00 0E 7E
BB 01 FF 00 10 09 0E 34 00 E2 00 10 71 00 00 52 9B 09 40 B4 02 AA 7E
Read failure received is actually 2 packets, the first packet is the Select Set response
packet; the second packet is the read failure response packet:
BB 01 FF :Is a package identifier, for an error, 3 bytes in length；
00 10 ：Is the package length, hexadecimal, 0x10 means 16 bytes, 2 bytes in length；
09： Error code：： 0x09Indicates that the tag was not found；
0x16 Indicates an incorrect access password；
0xA3 Beyond the read and write range；
Other fields can not be considered, but they will not be analyzed here；

7. Set the RF power：

Send：
 BB 00 B6 00 02 04 E2 9E 7E ；Set the RF power to 18.5dBm
BB 00 B6 00 02 05 78 35 7E ；Set the RF power to 20dBm；
BB 00 B6 00 02 06 0E CC 7E ；Set the RF power to 21.5dBm；
BB 00 B6 00 02 06 A4 62 7E ；Set the RF power to 23dBm；
BB 00 B6 00 02 07 3A F9 7E ；Set the RF power to 24.5dBm；
BB 00 B6 00 02 07 D0 8F 7E ；Set the RF power to 26dBm；（Maximum transmit power,
which is also the default setting)
For the above packets, select to send one；
Recv：
BB 01 B6 00 01 00 B8 7E
Send to set power，After setting success，all will reply to the data package。

8. Set the workspace：

Send：
BB 00 07 00 01 01 09 7E ；set China2 range（920~925MHz）；
BB 00 07 00 01 04 0C 7E ；set China1 range （840~845MHz）；
BB 00 07 00 01 02 0A 7E ；set US range （902.25~927.75MHz）；
BB 00 07 00 01 03 0B 7E ；set Europe range （865~868MHz）；
BB 00 07 00 01 06 0E 7E ；set Korea range（917~923MHz）；
For the above packets, select to send one；
Recv：
BB 01 07 00 01 00 09 7E
Module reply, set up the workspace successfully。

9. set RF channel
Send:
BB 00 AB 00 01 00 AC 7E
BB 00 AB :Is a package identifier, for an error, 3 bytes in length；
00 10 ：Is the package length, hexadecimal, 0x10 means 16 bytes, 2 bytes in length；
00: channel number ，00 Indicates channel 0，The length is 1 bytes；
China2 range （920.125~924.875MHz）Channel parameters(0~0x13)，There are 20
channels in total，interval 0.25M。
China1 range （840.125~844.875MHz）Channel parameters (0~0x13)，There are 20
channels in total，interval 0.25M。
US range（902.25~927.75MHz）Channel parameters(0~0x33)，There are 54 channels in
total，interval 0.5M。
Europe range （ 865.1~867.9MHz ） Channel parameters (0~0x0E) ， There are 15
channels in total，interval 0.2M。
Korea range （ 917.1~923.3MHz ） Channel parameters (0~0x1F) ， There are 32
channels in total，interval 0.2M。
 AC：Checksum，See the specific calculation formula above；
7E：termination character；

Recv：
BB 01 AB 00 01 00 AD 7E
Module reply, set the channel for success。