Internal V3.A.

Base Station DB316 Protocol－

CEP 3.A

NO: HZ_Protocol_CEP
2016-02-18
Version

Version Date Description Modifier

3.A 2014/11/26 1. Extract from ESL CEP 3.A Chenmingxin

1. Translate to English.
3.A.1 2014/12/07 Seth
2. Remove segment labels.

3.A.2 2014/12/09 1. Supplement the format of IMAGE_DATA Seth

3.A.3 2014/12/12 1. Modify 3.5.3 Chenmingxin

1. Update 3.5.2 to describe the detail of

3.A.4 2014/12/14 Seth
TotalFrame and FinallyFrameBytes.

3.A.5 2014/12/17 1. Update segment tag details in 3.5.1 Seth

1. Update ‘Change Interval’ command in

3.A.6 2015/4/9 Seth
3.5.1
1. Append new tag type
3.A.7 2015/9/29 Seth
2. Append description for "TASK Keepalive"
1. Update the heart beat value (3.3.2).
3.A.8 2015/11/30 2. Update the unbind result for TE819 Seth
(3.5.3).

3.A.9 2015/12/2 1. Update the heart beat value (3.3.2). Seth

 Content
1. Introduction .................................................................................................................................. 4
1.1. Communitation Structure .................................................................................................. 4
1.2. Protocol Structure .............................................................................................................. 5
2. Initialization command part .......................................................................................................... 5
2.1. Search Base Station ............................................................................................................ 5
2.1.1. Search Command .................................................................................................... 5
2.1.2. Response Message .................................................................................................. 5
2.2. Configure Base Station ....................................................................................................... 6
3. Gernal command part ................................................................................................................... 7
3.1. Overview ............................................................................................................................ 7
3.2. Message Type ..................................................................................................................... 8
3.3. Base Station Process .......................................................................................................... 9
3.3.1. Base Station Inspection ........................................................................................... 9
3.3.2. Collect Tag’s Heart beat......................................................................................... 10
3.4. Handheld-Terminal process.............................................................................................. 11
3.4.1. Bind the Tag and Product ...................................................................................... 11
3.4.2. Unbind the Tag and Product.................................................................................. 11
3.4.3. Query the property of Product.............................................................................. 11
3.5. Tag Process ....................................................................................................................... 12
3.5.1. Small data message ............................................................................................... 12
3.5.2. Big data message ................................................................................................... 18
3.5.3. Get the Result........................................................................................................ 22
1.Introduction

The ESL system contain Software（ESL Suite）

、Base Station、ESL Tag、Handheld
Terminal.
Software [ESL Suite]：Manage the data, template, devices, report, and
transmission.
Base Station [DB316]：Forward the data between ESL Tag and software.
ESL Tag：Show the information which is received from the Base Station by
2.4 GHz.
Handheld Terminal [HT303]：A remote, wireless, and portable terminal
that manage the system, including binding/unbinding, system monitoring,
page switch and so on.

1.1.Communitation Structure
1.2.Protocol Structure

This protocol contain two part,

1. Initialization Command part: used in broadcast messages that search the
base stations and set the network configuration (IP address, port, subnet
mask, gateway and so on).
2. Gernal command part: used in UDP communitaion that send and receive the
message to the tag by the base station, such as update command, so on.

2.Initialization command part

The base station open 9999 UDP port to receive the initialization command,
and also send ACK to 9999 UDP port of the Server.

2.1.Search Base Station

2.1.1.Search Command

The command that search base station is fixed:

00 01 00 00 00 00 00 00 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F 40 41 42 43 44 45 46
47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 5B 5C 5D 5E 5F 60 61 62 63 64
65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72

2.1.2.Response Message

The response packet structure is:

Content / sample remark

Fixed content（２Ｂytes） 00 01
６个 0（6Ｂytes） 00 00 00 00 00 00
Fixed content（２Ｂytes） 5A 5A
Fixed content（1Ｂyte） 5A
 ＭＡＣ Address（6Ｂytes） 00 23 20 EE 0C BB

ＭＡＣ Ending（1Ｂyte） A5
IP Address（4Ｂytes） C0 A8 0B 64 192.168.11.100
Subnet mask（4Ｂytes） FF FF FF 00 255.255.255.0
Gateway（4Ｂytes） C0 A8 0B 01 192.168.11.1
IP of Server（4Ｂytes） C0 A8 0B 16 192.168.11.22
Server ＵＤＰ port（2Ｂytes） 04 D2 1234
Local ＵＤＰ port（2Ｂytes） 04 01 1025
Fixed content 0A 06 00
Module Name（33Ｂytes） 43 45 4E 54 55 52 59 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
Ending（1Ｂyte） 3C

2.2.Configure Base Station

Configure the network parameters, such as IP address, server UDP port, local UDP
port, module name, subnet mask, and gateway. When the Base station receive the
message, it will restart itself.
Content / sample remark

Fixed content（２Ｂytes） 00 03
ＭＡＣ Address（6Ｂytes） 00 23 14 EE 0C BB

ＭＡＣ Ending（2Ｂytes） A5 A5
８个 0（８Bytes） 00 00 00 00 00 00 00 00
IP Address（4Ｂytes） C0 A8 0A 6F 192.168.10.111
Subnet mask（4Ｂytes） FF FF FF 00 255.255.255.0
Gateway（4Ｂytes） C0 A8 0A 01 192.168.10.1
IP of Server（4Ｂytes） C0 A8 0A 66 192.168.10.102
Server UDP Port（2Ｂytes） 04 D2 1234
Local UDP Port（2Ｂytes） 04 01 1025
Fixed content（3Ｂytes） 06 06 00
Module Name（33Ｂytes） 43 45 4E 54 55 52 59 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00
 00 00 00 00 00 00 00 00 00 00 00
Ending（1Ｂyte） 3C

3.Gernal command part

3.1.Overview

There are 2 type general command frame format, short frame and long frame.

Short frame:

The short frame is less than 255 bytes, the format is:
Head Length Reader ID Message Sequence Payload Check Sum
Type
2Bytes 1Byte 2Bytes 1Byte 2Bytes x Bytes 1Byte

The following table explains every segment.

Segment Explanation
Head Always be [0x0D 0x0D]
Length The length of the message, not including the ‘Head’and
‘Length’ segment
Reader ID Always be [0xFF 0xFF]
Message The type of message.
Type
Sequence The Server will generate unique sequence for every message. For
***_ACK message, it is response message. So, its sequence is same
as request message. For example, Server send READER_SEARCH
message with a sequence 0x60, correlated, the Base Station will
response a READER_SEARCH_ACK message with a sequence 0x60.
Payload The content of message. It can be empty.
Check Sum XOR check sum of the total message (not including “Check Sum”
segment).
 Long frame

Long frame is used to transmit long message which is long than 255 and less 长
than 65535 bytes, and the frame format is:
Head Length Reader ID Message Sequence Payload Check Sum
Type
2Bytes 2Bytes 2Bytes 1Byte 2Bytes x Bytes 1Byte
The long frame is used in transmitting E-paper dot-matrix information.
The following table explains every segment.
Segment
Head Always be [0x0A 0x0A]
Length The length of the message, not including the ‘Head’and ‘Length’ segment. 2 bytes.
Reader ID Always be [0xFF 0xFF]
Message The type of message.
Type
Sequence The Server will generate unique sequence for every message. For ***_ACK
message, it is response message. So, its sequence is same as request message. For
example, Server send READER_SEARCH message with a sequence 0x60, correlated,
the Base Station will response a READER_SEARCH_ACK message with a sequence
0x60.
Payload The content of message. It can be empty.
Check XOR check sum of the total message (not including “Check Sum” segment).
Sum

3.2.Message Type

The following table shows all types of the general message. (PC: software, AP: Base
station).
Message Name Type Value Data flow
READER_SEARCH 0x00 PC->AP
READER_SEARCH_ACK 0x01 AP->PC
TAG_STATE_UPLOAD_NEW 0x3B AP->PC
WRITE_PRICEBUF_NEW 0x40 PC->AP
WRITE_PRICEBUF_NEW_ACK 0x41 AP->PC
 BIND_TAG&BARCODE_NEW 0x45 AP->PC
UN_BINDING_NEW 0x47 AP->PC
QUERY_GOODS_PROPERTY 0x2D AP->PC
QUERY_GOODS_PROPERTY_ACK 0x2E PC->AP
WRITE_IMAGE_DATA_INFO_NEW 0x48 PC->AP
WRITE_IMAGE_DATA_INFO_NEW_ACK 0x49 AP->PC
WRITE_IMAGE_DATA_NEW 0x4A PC->AP
WRITE_IMAGE_DATA _NEW_ACK 0x4B AP->PC
UPLOAD_TAG_STATE&VALUE_NEW 0x4F AP->PC
…… …… ……

3.3.Base Station Process

3.3.1.Base Station Inspection

READER_SEARCH
Query the status and the version of the Base Station.
Segment Payload
Value <empty>
Length of bytes 0Bytes

READER_SEARCH_ACK
The Base Station response the “READER_SEARCH” command by this message
type.
Segment Payload
Value ReaderStatus VersionInfo
Length of bytes 1Bytes 3Bytes

Segment Explanation
ReaderStatus Reader status, 0 indicates normal, 1 indicates unnormal.
VersionInfo Version information of the base station, 3 bytes.
Protocol version Hardware version Firmware version
1 byte 1 byte 1 byte
3.3.2.Collect Tag’s Heart beat

The base station will collect the tag’s heart beat, and when the cache is full (41
items) or time is up to 2 minutes, base station will upload the information. For
software, Server can analyse the information to dispatch a best base station for
every tag. Meanwhile, the Server can analyse which tag is offline, low-battery, and
reset.

UPLOAD_TAG_STATE&VALUE_NEW
Payload
Tag 1 Tag 2 Tag 3 Tag … Tag N

ID State StateValue … … … ID State StateValue

4Bytes 1Byte 1Byte 4Bytes 1Byte 1Byte

The following is the state specification.

TagState Description StateValue
0x02 Normal. Previous: Fixed 0x00
LT Serial: Temperature.
It a singed 8 bit integer value. The
formula that transforming to degree
Celsius is:
Celsius = StateValue ×0.6904 + 6.26.
This temperature is not accurant
enough.
0x0A Reseted Previous: Fixed 0x00
LT Serial: Temperature.
It a singed 8 bit integer value. The
formula that transforming to degree
Celsius is:
Celsius = StateValue ×0.6904 + 6.26.
This temperature is not accurant
enough.
0x14 Low power The percentage of battery
0x20
3.4.Handheld-Terminal process

3.4.1.Bind the Tag and Product

BIND_TAG&BARCODE_NEW
When the handheld-terminal scan the tag ID and the barcode of the product, it will
upload the information to the base station, and the base station will upload to the
Server by this message.
Payload
TagID BarCode
4Bytes xByte
The Barcode segment is encoded by BCD code. If the length of barcode is odd, use
‘A’ to represent the last half byte.
For example,
1234567890123 0x12,0x34,0x56,0x78,0x90,0x12,0x3A
12345678 0x12, 0x34, 0x56, 0x78

3.4.2.Unbind the Tag and Product

When the tag does not use, the operator will use Handheld-terminal to tell Server.
Meanwhile, the tag will switch to the initial page.
UN_BINDING_NEW
Payload
TagID Reserved ID
4Bytes 4Bytes

3.4.3.Query the property of Product

The handheld-terminal can query any property of the product. When the handheld
submit a query request to base station, the base station will forward the
“QUERY_GOODS_PROPERTY”command to the server, and the Server should
response a “QUERY_GOODS_PROPERTY_ACK”.

QUERY_GOODS_PROPERTY
The command specifies 2 parameters, barcode of the product and the property ID.
Payload
Barcode AttributeID
xBytes 1Byte
“Barcode”is a BCD code.
QUERY_GOODS_PROPERTY_ACK

负载
Attribute Contents
xBytes
The “Attribute Contents” is less than 28 bytes.

3.5.Tag Process

This section define the messages that used to interactive between tag and the
Server. There are 2 case. One is small data message, and the other is big data
message.
Small data message: used to send short message that can be transmitted in
one frame, such as:
Update the cotent of segment labels.
Send command to control the labels (switch cache pages, query some
information of tag, and so on).
Big data message: used to send big data, such as updating dot-matrix tag.

3.5.1.Small data message

This process is used in transmitting small data, such as segment data of segment
tag and controlling command data of all kinds of tag.
 Base
Server Tag
Station

Send "WRITE_PRICEBUF_NEW"

Cache Task

Send "WRITE_PRICEBUF_NEW_ACK"

Transmit by 2.4Ghz

Transmit data to Tag,and

get the result

return the result

Send "TAG_STATE_UPLOAD_NEW"

WRITE_PRICEBUF_NEW

Payloads
TagID <Fixed Content> PriceInfo
4Bytes 1 byte, 0x03 xBytes

This message is used in 2 case, and the <PriceInfo> definition is depend on the case:
Update the screen of Segment tag.
The lower four bits of the first byte is 0. The content of <PriceInfo> field is
different by the tag model. There are 2 segment tag models in use. They are
TS823L and TS825N.
TS823L:
1. Segment definition
2. True table
3. Explain
The “Segment definition” name every segment in the display for referring
to the “True table”. The “Ture table” dispatch every segment to a bit in
the <PriceInfo> field. If the value of the bit is 0, it means the segment in the
display if OFF, and 1 is ON.
The Low 4-bit of Byte0 in the table is special. If it‘s 0b0000, means this
message is a segment updating message. If it’s 0b0001, means this
message is a controlling command message. Byte21 is 0x00 always.
TS825N:
1. Segment definition

2. True table
 3. Explain
The “Segment definition” name every segment in the display for referring
to the “True table”. The “Ture table” dispatch every segment to a bit in
the <PriceInfo> field. If the value of the bit is 0, it means the segment in the
display if OFF, and 1 is ON.
The value of Byte0 in the table is special. If it‘s 0x00, means this message
is a segment updating message. If it’s 0x01, means this message is a
controlling command message.
Send some controlling command data.
The structure of <PriceInfo> is a little different between Dot Matrix tag and
Segment tag.
Segment tag:
The length is depend on the model. The lower four bits of the first byte is
0x01 (refer to the last section above).
Dot Matrix tag:
The length is 12 bytes. The content is depend on the type of tag command
and refer to the following table.
The definition of the tag command for dot-matrix tag.
Tag Value of <PriceInfo> Description
command

Unbind 0xB2, 0xB2… The tag wil switch to the initial

Dot-matrix tag: There are 12 0xB2.
TS823L: There are 21 0xB2.
TS825N: There are 12 0xB2.
Select 0xB6, 0xB6, +
cache Cache index(0 ~ 0x0F) , +
state (reseted), and show initial
image.
The tag will switch to the cache
page. Normally, dot matrix tag has
 page [0x00, 0x00, …] 3 pages in memory.
Dot-matrix tag: There are 9 0x00.
TS823L: There are 18 0x00.
TS825N: There are 9 0x00.
Query 0x01, 0xB9, 0xB9, + Query status. The return value will
Tag [Status Type], + be returned by
[0x00, 0x00, …] TAG_STATE_UPLOAD_NEW
Dot-matrix tag: There are 8 0x00. message. Refer to the next table.
TS823L: There are 17 0x00.
TS825N: There are 8 0x00.
Control 0xBC, 0xBC, + [On-Off]: 0x00-OFF; 0x01-ON;
Beeper [On/Off], + Delay: unit is 10ms, so the
Delay (2 bytes), + maximum delay will be 11
[0x00, 0x00, …] minutes.
Dot-matrix tag: There are 7 0x00.
TS823L: There are 16 0x00.
TS825N: There are 7 0x00.
Change 0xB5, + 0~20 is valid for Interval in
Interval Interval in second (1 byte), + second.
[0x00, 0x00, …]
Dot-matrix tag: There are 10 0x00.
TS823L: There are 19 0x00.
TS825N: There are 10 0x00.
The list of Status that supported by [Query Tag]:
Query what? [Status Type] Response in [TAG_STATE_UPLOAD_NEW]

Tag State State Value(6Bytes)

Battery 0x01 0x01 1Byte, percentage.

Temperature 0x02 0x02 1Byte Temperature＋1Byte Humidity
&Humidity

Sleep 0x04 0x04 1Byte, unit is second.

interval
Current 0x07 0x07 1Byte
page
Version 0x09 0x09 1Byte protocol ver + １Byte FW ver,
 refer to the next table.
RSSI 0x0A 0x0A RSSI value. Supported on demand.

WRITE_PRICEBUF_NEW_ACK
When Base Station received the “WRITE_PRICEBUF_NEW”message, it will cache
the task, and response the “WRITE_PRICEBUF_NEW_ACK”to Server. The server
use it to check if the message is sent to the Base station and cached successfully.
Payload
TagID State
4Bytes 1Byte

For State, 0x00 is succeeded, 0x01 is failed when the memory is full. The memory
of the base station is 32 MB.

3.5.2.Big data message

This process is used in transmitting big data, such as pixels data of Dot-Matrix tag
and NFC content for some special tag.
 Base
Server Tag
Station

Send "WRITE_IMAGE_DATA_INFO_NEW"
Send "WRITE_IMAGE_DATA_INFO_NEW_ACK"

Send "WRITE_IMAGE_DATA_NEW"

Cache Task

Send "WRITE_IMAGE_DATA_NEW_ACK"

Transmit by 2.4Ghz

Transmit data to Tag,and

get the result

return the result

Send "TAG_STATE_UPLOAD_NEW"

WRITE_IMAGE_DATA_INFO_NEW
Before send big data, Server should send an Info-Packet to describe the content of
the big data. The format is as follow:
Payload
TagID TotalFrame StorePosition FinallyFrameBytes L_Position R_Position
4Bytes 2Bytes 1Byte 1Byte 4Bytes 4Bytes

The meaning of every segment:

字段名 含义
TotalFrame The total count of frame of big data which will send from Base
station to tag. The communication between B.S and tag is
limited to 28 bytes per package. So, when the base station
send an IMAGE DATA to tag, it will splits the big data to 28
bytes frame. This field means how many frames that the B.S
will split the data to. So, the value of this field is rounding up
[the bytes of IMAGE DATA] / 28
 StorePosition It’s a complicated segment.
Normally, High half-byte means which cache page this image
will be stored to. And if low half-byte is 0, the image will be
show after transmitted, if it’s F, it will not show. If the High
half-byte is F, the image will replace the LOGO in tag’s
memory.
Specially, if High half-byte is C, and low half-byte is F, it
means, the big data will be NFC data, and it will stored in NFC
memory.
FinallyFrameBytes The valid data numbers of the last frame. As mentioned in
the description of “TotalFrame”, the IMAGE DATA will be
splitted to 28 bytes packages. But the value of this field is
remainder of [the bytes of IMAGE DATA] / 28
L_Position Left up corner coordinates, in 4 bytes. X coordinates is
consisted of high 2 bytes, Y coordinates of low 2 bytes.
R_Position Right bottom corner coordinates, in 4 bytes. X coordinates is
consisted of high 2 bytes, Y coordinates of low 2 bytes.
e.g.: 0x01 0x02, 0x01 0x00 means coordinate (0x0102, 0x0100), namely decimal
(258,256).

WRITE_IMAGE_DATA_INFO_NEW_ACK
When Base Station received the “WRITE_IMAGE_DATA_INFO_NEW”message, it
will cache the task, and response the “WRITE_IMAGE_DATA_INFO_NEW_ACK”to
Server. The server use it to check if the message is sent to the Base station and
cached successfully.
Payload
TagID State
4Bytes 1Byte

For State, 0x00 is succeeded, 0x01 is failed.

WRITE_IMAGE_DATA_NEW
It use long frame. The structure of the payload is:
Payload
TagID PackageTotal PackageNum ImageData
 4Bytes 2Bytes 2Bytes xBytes

Field Description
PackageTotal The total numbers of data packet, consisting of 2 bytes. 65535
packets is the max value. For the reliability of UDP communication
between Server and Base station, the IMAGE DATA can not be too
big. So, the IMAGE data should be splitted, and the biggest
ImageData is 1428 bytes.
PackageNum The series number of current packets, consisting of 2 bytes. The
number starts from zero. When the value +１=PackageTotal”, it
means the last data packet.
ImageData Image data, the longest length of each packet is 1428 bytes.
The image data is simplized 1-bit (2-bit for 3 color labels) bitmap
format of an image. The following table show the map of color to
value of each dot.
Value of dot Black-white label Black-white-red label
Black 0 00
White 1 11
Red / 01

When scaning the image, please pay attention to the scaning

direction.
Prefix Type Resolution Dot Matrix Scan
Direction
0x02 TE836 296*128 Vertical
LT290A
0x08 TE819 800*600 Horizon
0x0A TB835 400*300 Horizon
0x16 TE836C 296*128x2 Vertical
LT290C
0x18 LT420C 400*300*2 Horizon
0x2E LT420A 400*300 Horizon
0x20 TE832C 212*104x2 Vertical
LT213C
 0x24 TE832 212*104 Vertical
LT213A
0x28 LT154C 152*152x2 Horizon
0x2A LT154A 152*152 Horizon
0xA0 Rail-based Labels, recognized by hand (imput the
type when use handheld-terminal)

WRITE_IMAGE_DATA_NEW_ACK
Payload
TagID PackageTotal PackageNum State
4Bytes 2Bytes 2Bytes 1Byte

Field Description
PackageTotal The valud of the field in related WRITE_IMAGE_DATA_NEW
message.
PackageNum The value of the field in related WRITE_IMAGE_DATA_NEW
message, and started as 0, and the PackageNum of the last
package is [PackageTotal – 1].
State 0x00- successful to cache, 0x01- lack of buffering.

3.5.3.Get the Result

As the diagram, the above message just complete to cache the information on the
base station. This section will show the message that is uploaded when the tag is
updated successed by base station.
TAG_STATE_UPLOAD_NEW

Payload
TagID TagState StateValue
4Bytes 1Byte xBytes

Segment Explanation
TagID Tag ID, 4 bytes
 TagState State of the Tag, refer to the table below
StateValue State’value of the Tag, refer to the table below

TagState Description State Value Bytes count of

segment
‘StateValue’
0x00 Update / 0Byte
succeed.
0x10 Unbind succeed / 0Byte
for TE819

0x12 Update failed Not all of the data transmitted from Base 0Byte
station to the Tag successfully.
0x22 Time out If the tag doesn’t update succeeded 0Byte
after a [Task keeplive] interval, the base
station will return this value. The value of
[Task keeplive] is 30 seconds before FW
version 0x18 of base station. And it’s 45
seconds after 0x19 version.
0x01 Battery Percentage 1Byte
0x02 Temperature 1Byte Temperature＋1Byte Humidity 2Byte
&Humidity

0x04 Sleep interval Unit is second 1Byte

0x07 Current page Page index 1Byte
0x09 Version 1Byte protocol ver + １Byte FW ver 2Byte
0x0A RSSI RSSI value. Supported on demand. 1Byte