How to read an NFC Credential using a VTAP reader and ACUConsole with OSDP

In this article, we are going to give you a step by step walk-through on how to read an AccessGrid issued credential on Apple Wallet using a VTAP reader connected to a RS-485 converter and ACUConsole with the Open Supervised Device Protocol (OSDP). We will also explain the deficiencies with the Wiegand protocol and how the RS-485 protocol solves for it and then leverage our RS-485 set up to transmit data over OSDP.

In this set up, you'll need a few key components to set up the RS-485 prototype and into a secure OSDP setup using ACUConsole.

Materials Needed

To create an OSDP set up and test RS-485 communication using a VTAP reader, you’ll need the following:

Before, you can actually get started, you need a credential from your organization so that you can test the set up. To get that credential, you can use AccessGrid, but it's not required for this tutorial. You also need to download a configuration for the VTAP Reader, which you can download from AccessGrid or you can learn how to set up your own configuration by following the instructions on the VTAP website .

Creating a Reader config with AccessGrid

Login to AccessGrid.com, and navigate to Reader config section. Next, on the top right hand side, click Create reader config+ which will open the Generate a reader config page.

In this page you are going to type and insert the following options.

Below is a screenshot of how it should look like:

Create reader config+

Don't forget to click "Save & download config" on the bottom right. Next, this will re-route you to the configs page on the AccessGrid platform and you will have to scroll and find the VTAP-OSDP config. Then you need to click "Download" on the right hand side and it will download the AccessGrid.json file inside a zip folder labelled "config.zip".

Next unzip the package, open the folder in a file explorer (finder for Mac), connect your VTAP via a USB-C to USB-C connection and drag the contents of the folder onto the VTAP.

File transfer after drag and drop of appkey1.txt file to VTAP100 reader

Eject/restart the VTAP from the mac. That's it, you're done. 

Now, all you need to do is connect the VTAP reader's PWR pin to the power supply's +12V pin (blue cable) and connect ground cable from VTAP to the ground pin of the power supply (light brown cable).

Demonstrated in the image below you will see how the blue and light brown cables are connected, (ignore the other cables for now).

Zoomed version of Blue and Brown cables

Now turn on the power supply. Your VTAP's LED should be on and now you can tap your AccessGrid issued Apple Wallet Pass to the reader and you should hear a beep. Congrats, you got passed the first test.

Now that you’ve confirmed the VTAP reader is operational, it’s time to set up RS-485. But first, here’s a quick overview of what we’re doing and why it matters.

In our previous article, Decoding the Wiegand Protocol, we explained how to use a Raspberry Pi to transmit electrical pulses across two wires. In this article, we are going to go explain the deficiencies with the Wiegand protocol and how the RS-485 protocol solves for it and then leverage our RS-485 set up to transmit the data over OSDP.

The challenge with the Wiegand protocol is that it's unidirectional and unencrypted—making it vulnerable to eavesdropping and spoofing. RS-485 solves these issues by enabling two-way communication and supporting secure protocols like OSDP.

Wiegand transmits data using two wires—D0 and D1—where a brief voltage drop (pulse) on either line represents a binary 0 or 1. These signals are easy to detect with simple hardware like a logic analyzer or even an Arduino, making the protocol highly susceptible to sniffing, replay attacks, and cloning. There's no encryption, no challenge-response mechanism, and no way to verify the authenticity of the reader or controller.

RS-485, on the other hand, sends data as a differential signal across two wires labeled A and B. Instead of pulsing voltage on individual lines, it compares the voltage difference between the two. A logical 1 is represented when A is more positive than B; a logical 0 is the reverse. This method not only improves noise immunity but also makes the signal much harder to intercept or spoof, especially when combined with protocols like OSDP that layer on encryption and authentication.

Wigand vs RS-485 Diagram

Ok, great—now it's time to configure the electrical set up for RS-485. First, we are going to connect the wires and then we are going to modify the config.txt file on the VTAP so that it's adjusted for RS-485.

So first we are going to join two ground cables together with a twist on one end that will be inserted into the ground pin of the VTAP device. One of those cables will be connected to the ground pin of the Power supply (light brown cable), and the other cable will be connected to the GND pin of the RS-485 (orange cable).

Next, we are going to connect A pin of the VTAP with the A connector of RS-485 (yellow cable). Connect B pin of the VTAP with the B connector of RS-485 (white cable).

RS-485 Set up

Next, we need to set up our digital Access Control Unit.  Navigate to this link and download the ACUConsole package to the ~/Downloads directory and extract it. 

Once you find the folder that corresponds to your computer where your associated ACUConsole package lives, navigate into it from the terminal. For us, since we have a mac with M chip, our path goes through the `osx-arm64` folder. This is how the terminal command should look like.

Now, make the ACUConsole Executable by running this terminal command.

We are going to give you a sequence of terminal commands to get your ACUConsole up and running. 

We need to remove quarantine. Run this command:

Now you need to check gatekeeper status by running this in terminal.

 - If output shows **accepted**, skip to Run Console. 
 - If it shows **rejected**, continue with Apply Local (Ad-hoc) Signature.

If you need to apply Local (Ad-hoc) Signature then run this command.

Now run the console.

You should see the blue screen, congrats, this is the OSDP.Net ACU Console window. Go ahead and close it by clicking "System" and select "Quit" and "Don't save". We have one more step before we can run it.

Quit and Don't save ACU Console

Your VTAP reader is hooked up to your RS-485 converter. The power supply and the RS-485 should be connected to the computer, the next step is to find the name of the serial connection because that is what we need to start the connection. 

Run this command from a separate terminal window

This should list all the serial ports. You should see entries like:

Ignore Bluetooth and cu.* entries. The RS-485 adapter will usually appear as: 

where XXXXXXXX is a manufacturer-specific string (FTDI, WCH, Silicon Labs, etc.). In our case, it's /dev/tty.usbserial-BG00OSR1.

Now, go back to the terminal screen where you cd to 'osx-arm64' and run this command:

You should see a blue screen popup and of the buttons close in the top bar, click "Connections". Now, you can click "Start Serial Connection".

Start serial connection pop-up

So if the device shows up as /dev/tty.usbserial-BG00OSR1 then that is what we need to select for the port in the pop-up screen drop down. You can keep the baud rate and reply timeout as the default. Click start and now you have started the serial connection.

Next, we need to add a peripheral device which is our VTAP reader. On the top section, click the "Device" button. For name label it "vtap-100". For address, put 0.

By default, there will be "Use CRC" and "Use Secure Channel" checked, but for this demonstration we want to uncheck "Use Secure Channel".  Now Click "Add".

Add device

You have added the peripheral device.

Next click System, then select "Connection Settings" and ensure "write packet to data file" is checked. For the polling interval, you could also write 20000 ms and click "Update". This ensure that we can see the logs of that connection id to monitor when the data is transmitted.

Write packet to data file

Now go back to system and select "Save configuration"

Now, we can tap the AccessGrid issued Apple Wallet Pass to the VTAP. You should hear a beep from your phone (if your phone is not on silent) and your phone should display a blue checkmark similar to a successful Apple Pay. The VTAP will not beep.

It's time to parse the OSDP cap file. Look at the ACUConsole window, you should see a message that as a timestamp with the connection ID. It should looks like this. Copy the connection id and keep it handy.

Click System in the top button, it should be the leftmost button. Next, click "Parse OSDP Cap File".

Parse the OSDP Cap File

Do not forget to click "Open".

You will then get another popup window. For filter for specific address, you can leave that blank for now. Click "Parse".


Now, open a new terminal window by entering Command+T shortcut on your keyboard. It should already take you into the 'osx-arm64' directory.  Now, you need to open the parsed transaction file with your default editor.

When you open the file, you will see the polls that occurred every 20 ms. So depending on how long it took you to tap your reader with your phone and how long it took you to stop the connection, is what you should use as small intuition to determine how far down you have to scroll. 

The tap event will be apparent. It should read something like this:

Translating this raw output into a human-readable format, the binary string 10000101110100100010101010 corresponds to a 26-bit Wiegand value, which breaks down into Facility Code 11 and Card Number 42069—the identifiers system operators use to recognize the cardholder.


Here is a screenshot of my VSCode window that shows the commands in the transaction with a view of the tap event.

Tap event on Parsed OSDP Cap File in VSCode

Congrats! 🎉  By following this guide, you’ve learned how to read an AccessGrid issued credential on Apple Wallet using a VTAP reader connected to a RS-485 converter and ACUConsole using the Open Supervised Device Protocol. Hopefully you’ve used AccessGrid.com for a smoother, hassle-free experience—it's much easier than handling all the technical setup yourself. Now’s the perfect time to test your setup and ensure everything works as expected. Remember, AccessGrid can take care of the entire process for you, and if you need any help, just use the chat or email [email protected].