API Specification - SC Point · 2013-04-25 · Document Title Here Document Title Here ACR1251U-A1-...

Subject to change without prior notice

[email protected]

www.acs.com.hk

Prepared by: Reviewed by: Approved by:

Document Name: 03-API-ACR1251U-A1-1.00.00.doc

ACR1251U-A1

API Specification V1.00.00

Document Title Here Document Title Here

Document Title Here ACR1251U-A1- API Specification Version 1.00.00

of 65

[email protected]

www.acs.com.hk

Version History

Date By Changes Version

2013-04-15 Kit Au • First Release 1.00.00

•

•

•

•

•



of 65

[email protected]

www.acs.com.hk

Table of Contents

1.0. Introduction ............................................................................................................. 5

2.0. Features ................................................................................................................... 6

3.0. Architecture ............................................................................................................. 7

4.0. Software Design ...................................................................................................... 8

4.1. CCID Protocol ........................................................................................................................ 8

4.2. CCID COMMANDS .............................................................................................................. 10

4.2.1. CCID Command Pipe Bulk-OUT Messages ............................................................... 10

4.2.2. CCID Bulk-IN Messages ............................................................................................. 15

4.3. Contactless Smart Card Protocol ........................................................................................ 17

4.3.1. ATR Generation .......................................................................................................... 17

5.0. PCSC API ............................................................................................................... 20

5.1. SCardEstablishContext ........................................................................................................ 20

5.2. SCardListReaders ............................................................................................................... 20

5.3. SCardConnect ..................................................................................................................... 20

5.4. SCardControl ....................................................................................................................... 20

5.5. ScardTransmit ..................................................................................................................... 20

5.6. ScardDisconnect .................................................................................................................. 20

5.7. ADPU Flow .......................................................................................................................... 21

5.8. Escape Command Flow ....................................................................................................... 21

6.0. Command Set ........................................................................................................ 22

6.1. PICC Commands (T=CL Emulation) for MiFare 1K/4K MEMORY Cards ........................... 22

6.1.1. Load Authentication Keys ........................................................................................... 22

6.1.2. Authentication for MIFARE 1K/4K ............................................................................... 23

6.1.3. Read Binary Blocks ..................................................................................................... 25

6.1.4. Update Binary Blocks .................................................................................................. 26

6.1.5. Value Block Operation (INC, DEC, STORE) .............................................................. 27

6.1.6. Read Value Block ........................................................................................................ 29

6.1.7. Copy Value Block ........................................................................................................ 30

6.1.8. Access PCSC Compliant Tags (ISO14443-4) ............................................................ 31

6.1.9. Access FeliCa Tags .................................................................................................... 32

6.2. Peripherals Control .............................................................................................................. 34

6.2.1. Get Firmware Version ................................................................................................. 34

6.2.2. LED Control ................................................................................................................. 35

6.2.3. LED Status .................................................................................................................. 35

6.2.4. Buzzer Control ............................................................................................................ 37

6.2.5. Buzzer Status .............................................................................................................. 37

6.2.6. Set LED and Buzzer Status Indicator Behaviors ........................................................ 38

6.2.7. Read LED and Buzzer status indicator Behaviors ...................................................... 39

6.2.8. Set Automatic PICC Polling ........................................................................................ 40

6.2.9. Read Automatic PICC Polling ..................................................................................... 42

6.2.10. Set the PICC Operating Parameter ............................................................................ 43

6.2.11. Read the PICC Operating Parameter ......................................................................... 44

6.2.12. Set Auto PPS .............................................................................................................. 45

6.2.13. Read Auto PPS ........................................................................................................... 46

6.2.14. Antenna Field Control ................................................................................................. 47

6.2.15. Read Antenna Field Status ......................................................................................... 47

6.2.16. Initial PN512 TypeA/TypeB Setting............................................................................. 48

6.2.17. Read PN512 TypeA/TypeB Setting ............................................................................ 49

6.2.18. Initial PN512 FeliCa Setting ........................................................................................ 50

6.2.19. Read PN512 FeliCa Setting ........................................................................................ 51

6.2.20. Update the PN512 Register ........................................................................................ 51

6.2.21. Read PN512 Register ................................................................................................. 52

6.2.22. User Extra Guard Time Setting ................................................................................... 52



of 65

[email protected]

www.acs.com.hk

6.2.23. Read User Extra Guard Time ..................................................................................... 53

6.2.24. “616C” Auto Handle Option Setting ............................................................................ 53

6.2.25. Read “616C” Auto Handle Option ............................................................................... 54

6.3. ACR122U Compatible Command ........................................................................................ 55

6.3.1. Bi-Color LED and Buzzer Control ............................................................................... 55

6.3.2. Get the Firmware Version of the reader...................................................................... 57

6.3.3. Get the PICC Operating Parameter ............................................................................ 58

6.3.4. Set the PICC Operating Parameter ............................................................................ 59

6.4. NFC Peer-to-Peer Related Command ................................................................................. 60

6.4.1. SNEP Message ........................................................................................................... 60

6.4.2. Set Initiator Mode Timeout .......................................................................................... 61

6.4.3. Enter Initiator Mode ..................................................................................................... 62

6.4.4. Enter Target Mode ...................................................................................................... 63

6.4.5. Get Received Data ...................................................................................................... 64

Appendix A. Firmware Upgrade Procedure .................................................................. 65

Method 1: Upgrade by “FW” Key .................................................................................................... 65

Method 2: Upgrade by APDU command ........................................................................................ 65



of 65

[email protected]

www.acs.com.hk

1.0. Introduction

The smart card reader ACR1251U is a USB PC-linked contactless card reader/writer with

SAM access. ACR1251U is compliant to ISO-14443 Parts 1- 4 supporting contactless card,

Mifare cards, FeliCa cards and NFC tags. ACR1251U is capable to support NFC Card Reader

and Write mode operations.



of 65

[email protected]

www.acs.com.hk

2.0. Features

• Support contactless smart card Standard

o ISO 14443 Parts 1- 4 Compliant

o ISO-18092 (NFCIP-1) Compliant

o NFC support

� Card reader/writer mode

� Peer-to-Peer mode

• The ACR1251U supports the following Tag Types:

o MIFARE Classic. E.g. MIFARE 1K, 4K, MINI and Ultralight.

o ISO14443-4 Type A and B

o FELICA, TOPAZ

• T=CL emulation for MIFare 1K/4K PICCs. Multi-Blocks Transfer Mode is provided

for efficient PICC access

• High Speed (424 kbps) Communication for PICCs. #Maximum 848 kbps

• Support 2 User-controllable LEDs

• Support User-controllable Buzzer

• USB2.0 full speed (12Mbps)

• Direct USB Firmware Upgradeable

• Microsoft CCID Compliant for both SAM and PICC interface.

• PCSC Compliant Contactless Interfaces

• OS Support

o Windows 98 and above, obtain WHQL

o Mac10.5 and above

o Linux

o Android 3.1 or above

• Compliance to Standards

o CE/FCC

o VCCI

o RoHS



of 65

[email protected]

www.acs.com.hk

3.0. Architecture

For communication architecture, the protocol between ACR1251U and PC is using CCID

protocol. All the communication between PICC and SAM are PCSC Compliant



of 65

[email protected]

www.acs.com.hk

4.0. Software Design

4.1. CCID Protocol

ACR1251U shall interface with the host with USB connection. A specification, namely CCID, has been released within the industry defining such a protocol for the USB chip-card interface devices. CCID covers all the protocols required for operating smart cards and PIN.

The configurations and usage of USB endpoints on ACR1251U shall follow CCID section 3. An overview is summarized below:

Control Commands are sent on control pipe (default pipe). These include class-specific requests and USB standard requests. Commands that are sent on the default pipe report information back to the host on the default pipe.

CCID Events are sent on the interrupt pipe.

CCID Commands are sent on BULK-OUT endpoint. Each command sent to ACR1251U has an associated ending response. Some commands can also have intermediate responses.

CCID Responses are sent on BULK-IN endpoint. All commands sent to ACR1251U have to be sent synchronously. (i.e. bMaxCCIDBusySlots is equal to 1 for ACR1251U)

The supported CCID features by ACR1251U are indicated in its Class Descriptor:

PICC Interface CCID Descriptor:

Offset Field Size Value Description

0 bLength 1 36h Size of this descriptor, in bytes.

1 bDescriptorType 1 21h CCID Functional Descriptor type.

2 bcdCCID 2 0100h CCID Specification Release Number in Binary-Coded decimal.

4 bMaxSlotIndex 1 00h One slot is available on ACR1251U

5 bVoltageSupport 1 07h ACR1251U can supply 1.8V, 3.0V and 5.0V to its slot.

6 dwProtocols 4 00000003h

ACR1251U supports T=0 and T=1 Protocol

10 dwDefaultClock 4 00000FA0h

Default ICC clock frequency is 4MHz

14 dwMaximumClock 4 00000FA0h

Maximum supported ICC clock frequency is 4MHz

18 bNumClockSupported

1 00h Does not support manual setting of clock frequency

19 dwDataRate 4 00003267h

Default ICC I/O data rate is 12903 bps

23 dwMaxDataRate 4 00054024h

Maximum supported ICC I/O data rate is 344100 bps



of 65

[email protected]

www.acs.com.hk

27 bNumDataRatesSupported

1 00h Does not support manual setting of data rates

28 dwMaxIFSD 4 00000FEh

Maximum IFSD supported by ACR1251U for protocol T=1 is 254

32 dwSynchProtocols 4 00000000h

ACR1251U does not support synchronous card

36 dwMechanical 4 00000000h

ACR1251U does not support special mechanical characteristics

40 dwFeatures 4 000200BAh

ACR1251U supports the following features:

Automatic parameter configuration based on ATR data

Automatic activation of ICC on inserting

Automatic ICC voltage selection

Automatic ICC clock frequency change according to parameters

Automatic baud rate change according to frequency and FI,DI parameters

Automatic PPS made by the CCID according to the active parameters

Short APDU level exchange with ACR1251U

44 dwMaxCCIDMessageLength

4 0000010Fh

Maximum message length accepted by ACR1251U is 271 bytes

48 bClassGetResponse

1 00h Indicates that the CCID echoes the class of the APDU

49 bClassEnvelope 1 00h Indicates that the CCID echoes the class of the APDU

50 wLCDLayout 2 0000h No LCD

52 bPINSupport 1 00h No PIN Verification

53 bMaxCCIDBusySlots

1 01h Only 1 slot can be simultaneously busy



of 65

[email protected]

www.acs.com.hk

4.2. CCID COMMANDS

4.2.1. CCID Command Pipe Bulk-OUT Messages

ACR1251U shall follow the CCID Bulk-OUT Messages as specified in CCID section 4. In addition, this specification defines some extended commands for operating additional features. This section lists the CCID Bulk-OUT Messages to be supported by ACR1251U.

4.2.1.1. PC_to_RDR_IccPowerOn

Activate the card slot and return ATR from the card.


0 bMessageType 1 62h

1 dwLength 4 00000000h

Size of extra bytes of this message

2 bSlot 1 Identifies the slot number for this command

5 bSeq 1 Sequence number for command

6 bPowerSelect 1 Voltage that is applied to the ICC 00h – Automatic Voltage Selection 01h – 5 volts 02h – 3 volts

7 abRFU 2 Reserved for future use

The response to this message is the RDR_to_PC_DataBlock message and the data returned is the Answer To Reset (ATR) data.

4.2.1.2. PC_to_RDR_IccPowerOff

Deactivate the card slot.








The response to this message is the RDR_to_PC_SlotStatus message.



of 65

[email protected]

www.acs.com.hk

4.2.1.3. PC_to_RDR_GetSlotStatus

Get current status of the slot.








The response to this message is the RDR_to_PC_SlotStatus message.

4.2.1.4. PC_to_RDR_XfrBlock

Transfer data block to the ICC.


0 bMessageType 1 6Fh

1 dwLength 4 Size of abData field of this message



7 bBWI 1 Used to extend the CCIDs Block Waiting Timeout for this current transfer. The CCID will timeout the block after “this number multiplied by the Block Waiting Time” has expired.

8 wLevelParameter 2 0000h RFU (TPDU exchange level)

10 abData Byte array

Data block sent to the CCID. Data is sent “as is” to the ICC (TPDU exchange level)

The response to this message is the RDR_to_PC_DataBlock message.



of 65

[email protected]

www.acs.com.hk

4.2.1.5. PC_to_RDR_Escape

Access extended features


0 bMessageType 1 6Bh


5 bSlot 1

Identifies the slot number for this command


7 abRFU 3 Reserved for Future Use


data block sent to the CCID

The response to this command message is the RDR_to_PC_Escape response message

4.2.1.6. PC_to_RDR_GetParameters

Get slot parameters.


0 bMessageType 1 6Ch






The response to this message is the RDR_to_PC_Parameters message.

4.2.1.7. PC_to_RDR_ResetParameters

Reset slot parameters to default value.


0 bMessageType 1 6Dh

1 DwLength 4 00000000h


5 BSlot 1 Identifies the slot number for this command



of 65

[email protected]

www.acs.com.hk

6 BSeq 1 Sequence number for command

7 AbRFU 3 Reserved for future use


4.2.1.8. PC_to_RDR_SetParameters

Set slot parameters.



1 dwLength 4 Size of extra bytes of this message



7 bProtocolNum 1 Specifies what protocol data structure follows. 00h = Structure for protocol T=0 01h = Structure for protocol T=1 The following values are reserved for future use.

80h = Structure for 2-wire protocol


82h = Structure for I2C protocol


10 abProtocolDataStructure

Byte array

Protocol Data Structure

Protocol Data Structure for Protocol T=0 (dwLength=00000005h)


10 bmFindexDindex 1 B7-4 – FI – Index into the table 7 in ISO/IEC 7816-3:1997 selecting a clock rate conversion factor

B3-0 – DI - Index into the table 8 in

ISO/IEC 7816-3:1997 selecting a baud rate conversion factor

11 bmTCCKST0 1 B0 – 0b, B7-2 – 000000b

B1 – Convention used (b1=0 for direct, b1=1 for inverse) Note: The CCID ignores this bit.



of 65

[email protected]

www.acs.com.hk

12 bGuardTimeT0 1 Extra Guardtime between two characters. Add 0 to 254 etu to the normal guardtime of 12etu. FFh is the same as 00h.

13 bWaitingIntegerT0

1 WI for T=0 used to define WWT

14 bClockStop 1 ICC Clock Stop Support

00h = Stopping the Clock is not allowed

01h = Stop with Clock signal Low

02h = Stop with Clock signal High

03h = Stop with Clock either High or Low

Protocol Data Structure for Protocol T=1 (dwLength=00000007h)


10 bmFindexDindex 1 B7-4 – FI – Index into the table 7 in ISO/IEC 7816-3:1997 selecting a clock rate conversion factor

B3-0 – DI - Index into the table 8 in

ISO/IEC 7816-3:1997 selecting a baud rate conversion factor

11 BmTCCKST1 1 B7-2 – 000100b

B0 – Checksum type (b0=0 for LRC, b0=1 for CRC

B1 – Convention used (b1=0 for direct, b1=1 for inverse) Note: The CCID ignores this bit.

12 BGuardTimeT1 1 Extra Guardtime (0 to 254 etu between two characters). If value is FFh, then guardtime is reduced by 1 etu.

13 BwaitingIntegerT1

1 B7-4 = BWI values 0-9 valid

B3-0 = CWI values 0-Fh valid

14 bClockStop 1 ICC Clock Stop Support

00h = Stopping the Clock is not allowed

01h = Stop with Clock signal Low

02h = Stop with Clock signal High

03h = Stop with Clock either High or Low

15 bIFSC 1 Size of negotiated IFSC

16 bNadValue 1 00h Only support NAD = 00h




of 65

[email protected]

www.acs.com.hk

4.2.2. CCID Bulk-IN Messages

The Bulk-IN messages are used in response to the Bulk-OUT messages. ACR1251U shall follow the CCID Bulk-IN Messages as specified in CCID section 4. This section lists the CCID Bulk-IN Messages to be supported by ACR1251U.

4.2.2.1. RDR_to_PC_DataBlock

This message is sent by ACR1251U in response to PC_to_RDR_IccPowerOn, PC_to_RDR_XfrBlock and PC_to_RDR_Secure messages.


0 bMessageType 1 80h Indicates that a data block is being sent from the CCID


5 bSlot 1 Same value as in Bulk-OUT message

6 bSeq 1 Same value as in Bulk-OUT message

7 bStatus 1 Slot status register as defined in CCID section 4.2.1

8 bError 1 Slot error register as defined in CCID section 4.2.1

9 bChainParameter 1 00h RFU (TPDU exchange level)


This field contains the data returned

by the CCID

4.2.2.2. RDR_to_PC_Escape

This message is sent by ACR1251U in response to PC_to_RDR_Escape messages.










of 65

[email protected]

www.acs.com.hk

9 bRFU 1 00h RFU


This field contains the data returned

by the CCID

4.2.2.3. RDR_to_PC_SlotStatus

This message is sent by ACR1251U in response to PC_to_RDR_IccPowerOff, PC_to_RDR_GetSlotStatus, PC_to_RDR_Abort messages and Class specific ABORT request.









9 bClockStatus 1 value =

00h Clock running

01h Clock stopped in state L

02h Clock stopped in state H

03h Clock stopped in an unknown state

All other values are RFU.

4.2.2.4. RDR_to_PC_Parameters

This message is sent by ACR1251U in response to PC_to_RDR_GetParameters, PC_to_RDR_ResetParameters and PC_to_RDR_SetParameters messages.








of 65

[email protected]

www.acs.com.hk



9 bProtocolNum 1 Specifies what protocol data structure follows.

00h = Structure for protocol T=0

01h = Structure for protocol T=1

The following values are reserved for future use.



82h = Structure for I2C protocol

10 abProtocolDataStructure

Byte array

Protocol Data Structure

4.3. Contactless Smart Card Protocol

4.3.1. ATR Generation

If the reader detects a PICC, an ATR will be sent to the PCSC driver for identifying the PICC.

4.3.1.1. ATR format for ISO 14443 Part 3 PICCs.

Byte

Value

(Hex) Designation Description

0 3B Initial Header

1 8N T0

Higher nibble 8 means: no TA1, TB1, TC1 only TD1 is following.

Lower nibble N is the number of historical bytes (HistByte 0 to HistByte N-1)

2 80 TD1

Higher nibble 8 means: no TA2, TB2, TC2 only TD2 is following.

Lower nibble 0 means T = 0

3 01 TD2

Higher nibble 0 means no TA3, TB3, TC3, TD3 following.


4

To

3+N

80 T1 Category indicator byte, 80 means A status

indicator may be present in an optional COMPACT-TLV data object

4F

Tk

Application identifier Presence Indicator

0C Length

RID Registered Application Provider Identifier (RID) #

A0 00 00 03 06

SS Byte for standard



of 65

[email protected]

www.acs.com.hk

C0 .. C1 Bytes for card name

00 00 00 00 RFU RFU # 00 00 00 00

4+N UU TCK Exclusive-oring of all the bytes T0 to Tk

e.g. ATR for MIFare 1K = {3B 8F 80 01 80 4F 0C A0 00 00 03 06 03 00 01 00 00 00 00 6A}

Length (YY) = 0x0C

RID = {A0 00 00 03 06} (PC/SC Workgroup)

Standard (SS) = 03 (ISO14443A, Part 3)

Card Name (C0 .. C1) = {00 01} (MIFare 1K)

Standard (SS)

03: ISO14443A, Part 3 11: FeliCa

Card Name (C0 .. C1)

00 01: Mifare 1K 00 30: Topaz and Jewel 00 02: Mifare 4K 00 3B: FeliCa 00 03: Mifare Ultralight FF 28: JCOP 30 00 26: Mifare Mini FF [SAK]: undefined tags

4.3.1.2. ATR format for ISO 14443 Part 4 PICCs.

Byte

Value

(Hex)

Designation Description

0 3B Initial Header

1 8N T0 Higher nibble 8 means: no TA1, TB1, TC1 only TD1 is following.

Lower nibble N is the number of historical bytes (HistByte 0 to HistByte N-1)

2 80 TD1 Higher nibble 8 means: no TA2, TB2, TC2 only TD2 is following.


3 01 TD2 Higher nibble 0 means no TA3, TB3, TC3, TD3 following.


4

to

3 + N

XX T1 Historical Bytes:

ISO14443A:

The historical bytes from ATS response. Refer to the ISO14443-4 specification.

ISO14443B:

XX

XX

XX

Tk



of 65

[email protected]

www.acs.com.hk

Byte1-4 Byte5-7 Byte8

Application Data from ATQB

Protocol Info Byte from ATQB

Higher nibble=MBLI from ATTRIB command Lower nibble (RFU)=0

4+N UU TCK Exclusive-oring of all the bytes T0 to Tk

E.g 1. ATR for DESFire = { 3B 81 80 01 80 80 } // 6 bytes of ATR

Hint: Use the APDU “FF CA 01 00 00” to distinguish the ISO14443A-4 and ISO14443B-4 PICCs, and retrieve the full ATS if available. ISO14443A-3 or ISO14443B-3/4 PICCs do have ATS returned.

APDU Command = FF CA 01 00 00

APDU Response = 06 75 77 81 02 80 90 00

ATS = {06 75 77 81 02 80}

E.g 2. ATR for ez-link = {3B 88 80 01 1C 2D 94 11 F7 71 85 00 BE}

Application Data of ATQB = 1C 2D 94 11

Protocol Information of ATQB = F7 71 85

MBLI of ATTRIB = 00



of 65

[email protected]

www.acs.com.hk

5.0. PCSC API This Section will describe some of the PCSC API for application programming usage. For detail, please ref to Microsoft MSDN Library or PCSC workgroup.

5.1. SCardEstablishContext

The SCardEstablishContext function establishes the resource manager context within which database operations are performed.

Refer: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379479%28v=vs.85%29.aspx

5.2. SCardListReaders

The SCardListReaders function provides the list of readers within a set of named reader groups, eliminating duplicates.

The caller supplies a list of reader groups, and receives the list of readers within the named groups. Unrecognized group names are ignored. This function only returns readers within the named groups that are currently attached to the system and available for use.


5.3. SCardConnect

The SCardConnect function establishes a connection (using a specific resource manager context) between the calling application and a smart card contained by a specific reader. If no card exists in the specified reader, an error is returned.


5.4. SCardControl

The SCardControl function gives you direct control of the reader. You can call it any time after a successful call to SCardConnect and before a successful call to SCardDisconnect. The effect on the state of the reader depends on the control code.


Remark: Commands from “Section 6.2 Peripherals Control” are using this API for sending

5.5. ScardTransmit

The SCardTransmit function sends a service request to the smart card and expects to receive data back from the card.


Remark: APDU Commands (i.e. the command send to connected card and “Section 6.1 Pseudo APDUs for Contactless Interface”) are using this API for sending

5.6. ScardDisconnect

The SCardDisconnect function terminates a connection previously opened between the calling application and a smart card in the target reader.




of 65

[email protected]

www.acs.com.hk

5.7. ADPU Flow

Start

SCardEstablishContext

SCardListReadersReader Present? NoSCardConnect

YESConnect Success? NoScardTransmit

YESScardDisconnect

End

5.8. Escape Command Flow

Start

SCardEstablishContext

SCardListReadersReader Present? NoSCardConnect

YESSCardControl

ScardDisconnect

End



of 65

[email protected]

www.acs.com.hk

6.0. Command Set

6.1. PICC Commands (T=CL Emulation) for MiFare 1K/4K MEMORY Cards

6.1.1. Load Authentication Keys

The “Load Authentication Keys command” will load the authentication keys into the reader. The authentication keys are used to authenticate the particular sector of the Mifare 1K/4K Memory Card. Two kinds of authentication key locations are provided, volatile and non-volatile key locations respectively.

Load Authentication Keys APDU Format (11 Bytes)

Command Class INS P1 P2 Lc Data In

Load Authentication

Keys

FF 82 Key Structure

Key Number

06 Key

(6 bytes)

Key Structure (1 Byte):

0x00 = Key is loaded into the reader volatile memory.

Other = Reserved.

Key Number (1 Byte):

0x00 ~ 0x01 = Volatile memory for storing a temporally key. The key will be disappeared once the reader is disconnected from the PC. 2 volatile keys are provided. The volatile key can be used as a session key for different sessions. Default Value = {FF FF FF FF FF FF}

Key (6 Bytes):

The key value loaded into the reader. E.g. {FF FF FF FF FF FF}

Load Authentication Keys Response Format (2 Bytes)

Response Data Out

Result SW1 SW2

Load Authentication Keys Response Codes

Results SW1 SW2 Meaning

Success 90 00 The operation is completed successfully.

Error 63 00 The operation is failed.

Example:

// Load a key {FF FF FF FF FF FF} into the volatile memory location 0x00.



of 65

[email protected]

www.acs.com.hk

APDU = {FF 82 00 00 06 FF FF FF FF FF FF}

6.1.2. Authentication for MIFARE 1K/4K

The “Authentication command” uses the keys stored in the reader to do authentication with the MIFARE 1K/4K card (PICC). Two types of authentication keys are used, TYPE_A and TYPE_B respectively.

Load Authentication Keys APDU Format (6 Bytes) #Obsolete

Command Class INS P1 P2 P3 Data In

Authentication

FF 88 00 Block Number

Key

Type

Key Number

Load Authentication Keys APDU Format (10 Bytes)


Authentication

FF 86 00 00 05 Authenticate Data Bytes

Authenticate Data Bytes (5 Byte):

Byte1 Byte 2 Byte 3 Byte 4 Byte 5

Version

0x01

0x00 Block

Number

Key Type

Key Number

Block Number (1 Byte):

The memory block to be authenticated.

For MIFARE 1K Card, it has totally 16 sectors and each sector consists of 4 consecutive blocks. E.g. Sector 0x00 consists of Blocks {0x00, 0x01, 0x02 and 0x03}; Sector 0x01 consists of Blocks {0x04, 0x05, 0x06 and 0x07}; the last sector 0x0F consists of Blocks {0x3C, 0x3D, 0x3E and 0x3F}. Once the authentication is done successfully, there is no need to do the authentication again provided that the blocks to be accessed are belonging to the same sector. Please refer to the MIFARE 1K/4K specification for more details.

#Once the block is authenticated successfully, all the blocks belonging to the same sector are accessible.

Key Type (1 Byte):

0x60 = Key is used as a TYPE A key for authentication.

0x61 = Key is used as a TYPE B key for authentication.

Key Number (1 Byte):

0x00 ~ 0x01 = Volatile memory for storing keys. The keys will be disappeared when the reader is disconnected from the PC. 2 volatile keys are provided. The volatile key can be used as a session key for different sessions.



of 65

[email protected]

www.acs.com.hk

Load Authentication Keys Response Format (2 Bytes)

Response Data Out

Result SW1 SW2

Load Authentication Keys Response Codes




MIFARE 1K Memory Map.

Sectors (Total 16 sectors. Each sector

consists of 4 consecutive blocks)

Data Blocks (3 blocks, 16 bytes per

block)

Trailer Block (1 block, 16 bytes)

Sector 0 0x00 ~ 0x02 0x03 Sector 1 0x04 ~ 0x06 0x07

..

.. Sector 14 0x38 ~ 0x0A 0x3B Sector 15 0x3C ~ 0x3E 0x3F

MIFARE 4K Memory Map.

Sectors (Total 32 sectors. Each sector

consists of 4 consecutive blocks)


block)


Sector 0 0x00 ~ 0x02 0x03 Sector 1 0x04 ~ 0x06 0x07

..

.. Sector 30 0x78 ~ 0x7A 0x7B Sector 31 0x7C ~ 0x7E 0x7F

Sectors (Total 8 sectors. Each sector consists of 16 consecutive

blocks)


block)


Sector 32 0x80 ~ 0x8E 0x8F Sector 33 0x90 ~ 0x9E 0x9F

..

.. Sector 38 0xE0 ~ 0xEE 0xEF Sector 39 0xF0 ~ 0xFE 0xFF

Examples:

1K Bytes

2K Bytes

2K Bytes



of 65

[email protected]

www.acs.com.hk

// To authenticate the Block 0x04 with a {TYPE A, key number 0x00}.

// PC/SC V2.01, Obsolete

APDU = {FF 88 00 04 60 00};

<Similarly>

// To authenticate the Block 0x04 with a {TYPE A, key number 0x00}.

// PC/SC V2.07

APDU = {FF 86 00 00 05 01 00 04 60 00}

Hints:

MIFARE Ultralight does not need to do any authentication. The memory is free to access.

MIFARE Ultralight Memory Map.

Byte Number

0 1 2 3 Page

Serial Number SN0 SN1 SN2 BCC0 0 Serial Number SN3 SN4 SN5 SN6 1

Internal / Lock BCC1 Internal Lock0 Lock1 2

OTP OPT0 OPT1 OTP2 OTP3 3 Data read/write Data0 Data1 Data2 Data3 4 Data read/write Data4 Data5 Data6 Data7 5 Data read/write Data8 Data9 Data10 Data11 6 Data read/write Data12 Data13 Data14 Data15 7 Data read/write Data16 Data17 Data18 Data19 8 Data read/write Data20 Data21 Data22 Data23 9 Data read/write Data24 Data25 Data26 Data27 10 Data read/write Data28 Data29 Data30 Data31 11 Data read/write Data32 Data33 Data34 Data35 12 Data read/write Data36 Data37 Data38 Data39 13 Data read/write Data40 Data41 Data42 Data43 14 Data read/write Data44 Data45 Data46 Data47 15

6.1.3. Read Binary Blocks

The “Read Binary Blocks command” is used for retrieving a multiple of “data blocks” from the PICC. The data block/trailer block must be authenticated first before executing the “Read Binary Blocks command”.

Read Binary APDU Format (5 Bytes)

Command Class INS P1 P2 Le

Read Binary Blocks

FF B0 00 Block Number

Number of Bytes to Read


The starting block.

512 bits

Or

64 bytes



of 65

[email protected]

www.acs.com.hk

Number of Bytes to Read (1 Byte):

Multiply of 16 bytes for MIFARE 1K/4K or Multiply of 4 bytes for MIFARE Ultralight

• Maximum 16 bytes for MIFARE Ultralight.

• Maximum 48 bytes for MIFARE 1K. (Multiple Blocks Mode; 3 consecutive blocks)


Example 1: 0x10 (16 bytes). The starting block only. (Single Block Mode)

Example 2: 0x40 (64 bytes). From the starting block to starting block+3. (Multiple Blocks Mode)

#For safety reason, the Multiple Block Mode is used for accessing Data Blocks only. The Trailer Block is not supposed to be accessed in Multiple Blocks Mode. Please use Single Block Mode to access the Trailer Block.

Read Binary Block Response Format (Multiply of 4/16 + 2 Bytes)

Response Data Out

Result Data (Multiply of 4/16 Bytes) SW1 SW2

Read Binary Block Response Codes




Examples:

// Read 16 bytes from the binary block 0x04 (MIFARE 1K or 4K)

APDU = {FF B0 00 04 10}

// Read 240 bytes starting from the binary block 0x80 (MIFARE 4K)

// Block 0x80 to Block 0x8E (15 blocks)

APDU = {FF B0 00 80 F0}

6.1.4. Update Binary Blocks

The “Update Binary Blocks command” is used for writing a multiple of “data blocks” into the PICC. The data block/trailer block must be authenticated first before executing the “Update Binary Blocks command”.

Update Binary APDU Format (Multiple of 16 + 5 Bytes)




of 65

[email protected]

www.acs.com.hk

Update Binary Blocks

FF D6 00 Block Number

Number of Bytes

to Update

Block Data

(Multiple of 16 Bytes)


The starting block to be updated.

Number of Bytes to Update (1 Byte):

• Multiply of 16 bytes for MIFARE 1K/4K or 4 bytes for MIFARE Ultralight.



Example 1: 0x10 (16 bytes). The starting block only. (Single Block Mode)

Example 2: 0x30 (48 bytes). From the starting block to starting block+2. (Multiple Blocks Mode)

#For safety reason, the Multiple Block Mode is used for accessing Data Blocks only. The Trailer Block is not supposed to be accessed in Multiple Blocks Mode. Please use Single Block Mode to access the Trailer Block.

Block Data (Multiply of 16 + 2 Bytes, or 6 bytes):

The data to be written into the binary block/blocks.

Update Binary Block Response Codes (2 Bytes)




Examples:

// Update the binary block 0x04 of MIFARE 1K/4K with Data {00 01 .. 0F}

APDU = {FF D6 00 04 10 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F}

// Update the binary block 0x04 of MIFARE Ultralight with Data {00 01 02 03}

APDU = {FF D6 00 04 04 00 01 02 03}

6.1.5. Value Block Operation (INC, DEC, STORE)

The “Value Block Operation” command is used for manipulating value-based transactions. E.g. Increment a value of the value block etc.



of 65

[email protected]

www.acs.com.hk

Value Block Operation APDU Format (10 Bytes)


Value Block Operation

FF D7 00 Block Number

05 VB_OP VB_Value

(4 Bytes)

{MSB .. LSB}


The value block to be manipulated.

VB_OP (1 Byte):

0x00 = Store the VB_Value into the block. The block will then be converted to a value block.

0x01 = Increment the value of the value block by the VB_Value. This command is only valid for value block.

0x02 = Decrement the value of the value block by the VB_Value. This command is only valid for value block.

VB_Value (4 Bytes):

The value used for value manipulation. The value is a signed long integer (4 bytes).

E.g. 1: Decimal –4 = {0xFF, 0xFF, 0xFF, 0xFC}

VB_Value

MSB LSB

FF FF FF FC

E.g. 2: Decimal 1 = {0x00, 0x00, 0x00, 0x01}

VB_Value

MSB LSB

00 00 00 01

Value Block Operation Response Format (2 Bytes)

Response Data Out

Result SW1 SW2

Value Block Operation Response Codes






of 65

[email protected]

www.acs.com.hk

6.1.6. Read Value Block

The “Read Value Block” command is used for retrieving the value from the value block. This command is only valid for value block.

Read Value Block APDU Format (5 Bytes)


Read Value Block

FF B1 00 Block Number

04


The value block to be accessed.

Read Value Block Response Format (4 + 2 Bytes)

Response Data Out

Result

Value

{MSB .. LSB}

SW1 SW2

Value (4 Bytes):

The value returned from the card. The value is a signed long integer (4 bytes).

E.g. 1: Decimal –4 = {0xFF, 0xFF, 0xFF, 0xFC}

Value

MSB LSB

FF FF FF FC

E.g. 2: Decimal 1 = {0x00, 0x00, 0x00, 0x01}

Value

MSB LSB

00 00 00 01

Read Value Block Response Codes






of 65

[email protected]

www.acs.com.hk

6.1.7. Copy Value Block

The “Copy Value Block” command is used to copy a value from a value block to another value block.

Copy Value Block APDU Format (7 Bytes)


Value Block Operation

FF D7 00 Source

Block Number

02 03 Target Block

Number

Source Block Number (1 Byte): The value of the source value block will be copied to the target value block.

Target Block Number (1 Byte): The value block to be restored. The source and target value blocks must be in the same sector.

Copy Value Block Response Format (2 Bytes)

Response Data Out

Result SW1 SW2

Copy Value Block Response Codes




Examples:

// Store a value “1” into block 0x05

APDU = {FF D7 00 05 05 00 00 00 00 01}

// Read the value block 0x05

APDU = {FF B1 00 05 04}

// Copy the value from value block 0x05 to value block 0x06

APDU = {FF D7 00 05 02 03 06}

// Increment the value block 0x05 by “5”

APDU = {FF D7 00 05 05 01 00 00 00 05}



of 65

[email protected]

www.acs.com.hk

6.1.8. Access PCSC Compliant Tags (ISO14443-4)

Basically, all ISO14443-4 complaint cards (PICCs) would understand the ISO 7816-4 APDUs. The ACR1251U Reader just has to communicate with the ISO 14443-4 complaint cards through exchanging ISO 7816-4 APDUs and Responses. ACR1251U will handle the ISO 14443 Parts 1-4 Protocols internally.

MIFARE 1K, 4K, MINI and Ultralight tags are supported through the T=CL emulation. Just simply treat the MIFARE tags as standard ISO14443-4 tags. For more information, please refer to topic “PICC Commands for MIFARE Classic Memory Tags”

ISO 7816-4 APDU Format

Command Class INS P1 P2 Lc Data In Le

ISO 7816 Part 4 Command

Length of the Data

In

Expected length of

the Response

Data

ISO 7816-4 Response Format (Data + 2 Bytes)

Response Data Out

Result Response Data SW1 SW2

Common ISO 7816-4 Response Codes




Typical sequence may be:

- Present the Tag and Connect the PICC Interface

- Read / Update the memory of the tag

Step 1) Connect the Tag

The ATR of the tag is 3B 88 80 01 00 00 00 00 33 81 81 00 3A

In which,

The Application Data of ATQB = 00 00 00 00, protocol information of ATQB =

33 81 81. It is an ISO14443-4 Type B tag.

Step 2) Send an APDU, Get Challenge.

<< 00 84 00 00 08

>> 1A F7 F3 1B CD 2B A9 58 [90 00]



of 65

[email protected]

www.acs.com.hk

Hint: For ISO14443-4 Type A tags, the ATS can be obtained by using the APDU “FF CA 01 00 00”

Example:

// To read 8 bytes from an ISO 14443-4 Type B PICC (ST19XR08E)

APDU ={80 B2 80 00 08}

Class = 0x80

INS = 0xB2

P1 = 0x80

P2 = 0x00

Lc = None

Data In = None

Le = 0x08

Answer: 00 01 02 03 04 05 06 07 [$9000]

6.1.9. Access FeliCa Tags

For FeliCa Access, the command is different with PCSC Compliant Tags and Mifare. The Command is follow FeliCa Spec with header added, the following is the format.

FeliCa Command Format


FeliCa Command

FF 00 00 00 Length of the Data

In

FeliCa Command (start with Length

Byte)

FeliCa Response Format (Data + 2 Bytes)

Response Data Out

Result Response Data

Read Memory Block Example:

Step 1) Connect the FeliCa



of 65

[email protected]

www.acs.com.hk

The ATR = 3B 8F 80 01 80 4F 0C A0 00 00 03 06 11 00 3B 00 00 00 00 42

In Which 11 00 3B = FeliCa

Step 2) Read FeliCa IDM

CMD = FF CA 00 00 00

RES = [IDM (8bytes)] 90 00

e.g. the FeliCa IDM = 01 01 06 01 CB 09 57 03

Step 3) FeliCa Command Access

Example “Read” Memory Block



of 65

[email protected]

www.acs.com.hk

e.g.

CMD = ff 00 00 00 10 10 06 01 01 06 01 CB 09 57 03 01 09 01 01 80 00

Which

Felica Command = 10 06 01 01 06 01 CB 09 57 03 01 09 01 01 80 00

IDM = 01 01 06 01 CB 09 57 03

RES = Memory Block Data

6.2. Peripherals Control

The reader’s peripherals control commands are implemented by using PC_to_RDR_Escape

6.2.1. Get Firmware Version

The “Get Firmware Version” command is used to get the Reader’s firmware message

Get Firmware Version Format (5 Bytes)

Command Class INS P1 P2 Lc

Get Firmware Version

0xE0 0x00 0x00 0x18 0x00

Get Firmware Version Response Format (5 Bytes + Firmware Message Length)



of 65

[email protected]

www.acs.com.hk

Response Class INS P1 P2 Le Data Out

Result 0xE1 0x00 0x00 0x00 Number of Bytes to Received

Firmware Version

e.g. Response = E1 00 00 00 0F 41 43 52 31 32 35 31 55 5F 56 32 30 34 2E 30

Firmware Version (HEX) = 41 43 52 31 32 35 31 55 5F 56 32 30 34 2E 30

Firmware Version (ASCII) = “ACR1251U_V204.0”

6.2.2. LED Control

The “LED Control” command is used to Control the LEDs Output

LED Control Format (6 Bytes)


LED Control 0xE0 0x00 0x00 0x29 0x01 LED Status

LED Control Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 LED Status

LED Status (1 Byte):

LED Status Description Description

Bit 0 RED LED 1 = ON; 0 = OFF

Bit 1 GREEN LED 1 = ON; 0 = OFF

Bit 2 - 7 RFU RFU

6.2.3. LED Status

The “LED Status” command is used to check the existing LEDs Status

LED Status Format (5 Bytes)




of 65

[email protected]

www.acs.com.hk

LED Status 0xE0 0x00 0x00 0x29 0x00

LED Status Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 LED Status

LED Status (1 Byte):

LED Status Description Description

Bit 0 RED LED 1 = ON; 0 = OFF

Bit 1 GREEN LED 1 = ON; 0 = OFF

Bit 2 - 7 RFU RFU



of 65

[email protected]

www.acs.com.hk

6.2.4. Buzzer Control

The “Buzzer Control” command is used to Control the Buzzer Output

Buzzer Control Format (6 Bytes)


Buzzer Control 0xE0 0x00 0x00 0x28 0x01 Buzzer On Duration

Buzzer On Duration (1Bytes):

0x00 = Turn OFF

0x01 to 0xFF = Duration (unit: 10ms)

Buzzer Control Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 0x00

6.2.5. Buzzer Status

The “Buzzer Status” command is used to check the existing Buzzer Status

Buzzer Status Format (5 Bytes)


Buzzer Status 0xE0 0x00 0x00 0x28 0x00

Buzzer Status Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 0x00



of 65

[email protected]

www.acs.com.hk

6.2.6. Set LED and Buzzer Status Indicator Behaviors

The “Set LED and Buzzer Status Indicator Behaviors” command is used to set the Set the Behaviors for LEDs and Buzzer for status indicate

The setting will be saved into non-volatile memory

Set LED and Buzzer status Indicator Behaviors Format (6 Bytes)


Set LED and Buzzer Status

Indicator Behaviors

0xE0 0x00 0x00 0x21 0x01 Behaviors

Behaviors (1Bytes):

Behaviors MODE Description

Bit 0

SAM Activation Status LED To show the activation status of the SAM interface. 1 = Enable; 0 =Disable

Bit 1 PICC Polling Status LED To show the PICC Polling Status. 1 = Enable; 0 =Disable

Bit 2 PICC Activation Status LED To show the activation status of the PICC interface 1 = Enable; 0 =Disable

Bit 3 Card Insertion and Removal Events Buzzer

To make a beep whenever a card insertion or removal event is detected. (For PICC) 1 = Enable; 0 =Disabled

Bit 4 – 6

RFU RFU

Bit 7 Card Operation Blinking LED To blink the LED whenever the card (PICC) is being accessed.

*Default value of Behaviors = 0x8F

Set LED and Buzzer Status Indicator Behaviors Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Default Behaviors



of 65

[email protected]

www.acs.com.hk

6.2.7. Read LED and Buzzer status indicator Behaviors

The “Read LED and Buzzer status indicator Behaviors” command is used to set the Read the current Default Behaviors for LEDs and Buzzer

Read LED and Buzzer status indicator Behaviors Format (5 Bytes)


Read LED and Buzzer Status

Indicator Behaviors

0xE0 0x00 0x00 0x21 0x00

Read LED and Buzzer status indicator Behaviors Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Behaviors

Behaviors (1Bytes):

Behaviors MODE Description

Bit 0

SAM Activation Status LED To show the activation status of the SAM interface. 1 = Enable; 0 =Disable

Bit 1 PICC Polling Status LED To show the PICC Polling Status. 1 = Enable; 0 =Disable

Bit 2 PICC Activation Status LED To show the activation status of the PICC interface 1 = Enable; 0 =Disable

Bit 3 Card Insertion and Removal Events Buzzer

To make a beep whenever a card insertion or removal event is detected. (For PICC) 1 = Enable; 0 =Disabled

Bit 4 – 6

RFU RFU

Bit 7 Card Operation Blinking LED To blink the LED whenever the card (PICC) is being accessed.

*Default value of Behaviors = 0x8F



of 65

[email protected]

www.acs.com.hk

6.2.8. Set Automatic PICC Polling

The “Set Automatic PICC Polling” command is used to set the reader’s polling mode

Whenever the reader is connected to the PC, the PICC polling function will start the PICC scanning to determine if a PICC is placed on / removed from the built-antenna.

We can send a command to disable the PICC polling function. The command is sent through the PCSC Escape command interface. To meet the energy saving requirement, special modes are provided for turning off the antenna field whenever the PICC is inactive, or no PICC is found. The reader will consume less current in power saving mode.


Set Automatic PICC Polling Format (6 Bytes)


Set Automatic PICC Polling 0xE0 0x00 0x00 0x23 0x01 Polling Setting

Set Automatic PICC Polling Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Polling Setting

Polling Setting (1Bytes):

Polling Setting

Description Description

Bit 0 Auto PICC Polling 1 = Enable; 0 =Disable

Bit 1 Turn off Antenna Field if no PICC found

1 = Enable; 0 =Disable

Bit 2 Turn off Antenna Field if the PICC is inactive.


Bit 3 Activate the PICC when detected.


Bit 5 .. 4 PICC Poll Interval for PICC <Bit 5 – Bit 4>

<0 – 0> = 250 msec

<0 – 1> = 500 msec

<1 – 0> = 1000 msec

<1 – 1> = 2500 msec

Bit 6 RFU -

Bit 7 Enforce ISO14443A Part 4 1= Enable; 0= Disable.

*Default value of Polling Setting = 0x8F



of 65

[email protected]

www.acs.com.hk

Hints:

• It is recommended to enable the option “Turn Off Antenna Field if the PICC is inactive”, so that the “Inactive PICC” will not be exposed to the field all the time so as to prevent the PICC from “warming up”.

• The longer the PICC Poll Interval, the more efficient of energy saving. However, the response time of PICC Polling will become longer. The Idle Current Consumption in Power Saving Mode is about 60mA, while the Idle Current Consumption in Non-Power Saving mode is about 130mA. #Idle Current Consumption = PICC is not activated.

• The reader will activate the ISO14443A-4 mode of the “ISO14443A-4 compliant PICC” automatically. Type B PICC will not be affected by this option.

• The JCOP30 card comes with two modes: ISO14443A-3 (MIFARE 1K) and ISO14443A-4 modes. The application has to decide which mode should be selected once the PICC is activated.



of 65

[email protected]

www.acs.com.hk

6.2.9. Read Automatic PICC Polling

The “Read the Automatic PICC Polling” command is used to check current Automatic PICC Polling Setting

Read Automatic PICC Polling Format (5 Bytes)


Read Automatic

PICC Polling

0xE0 0x00 0x00 0x23 0x00

Read the Configure mode Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Polling Setting

Polling Setting (1Bytes):

Polling Setting

Description Description

Bit 0 Auto PICC Polling 1 = Enable; 0 =Disable

Bit 1 Turn off Antenna Field if no PICC found


Bit 2 Turn off Antenna Field if the PICC is inactive.


Bit 3 Activate the PICC when detected.


Bit 5 .. 4 PICC Poll Interval for PICC <Bit 5 – Bit 4>

<0 – 0> = 250 msec

<0 – 1> = 500 msec

<1 – 0> = 1000 msec

<1 – 1> = 2500 msec

Bit 6 RFU -

Bit 7 Enforce ISO14443A Part 4 1= Enable; 0= Disable.

*Default value of Polling Setting = 0x8F



of 65

[email protected]

www.acs.com.hk

6.2.10. Set the PICC Operating Parameter

The “Set the PICC Operating Parameter” command is used to set the PICC Operating Parameter


Set the PICC Operating Parameter Format (6 Bytes)


Set the PICC Operating Parameter

0xE0 0x00 0x00 0x20 0x01 Operation Parameter

Set the PICC Operating Parameter Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Operation Parameter

Operating Parameter (1 Byte):

Operating Parameter

Parameter Description Option

Bit0 ISO14443 Type A

The Tag Types to be detected during PICC Polling.

1 = Detect

0 = Skip

Bit1 ISO14443 Type B 1 = Detect

0 = Skip

Bit2 Felica 212kbps 1 = Detect

0 = Skip


0 = Skip

Bit4 Topaz 1 = Detect

0 = Skip

Bit5 - 7 RFU RFU RFU

*Default value of Operation Parameter = 0x1F



of 65

[email protected]

www.acs.com.hk

6.2.11. Read the PICC Operating Parameter

The “Read the PICC Operating Parameter“ command is used to check current PICC Operating Parameter

Read the PICC Operating Parameter Format (5 Bytes)


Read the PICC

Operating Parameter

0xE0 0x00 0x00 0x20 0x00

Read the PICC Operating Parameter Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Operation Parameter

Operating Parameter (1 Byte):

Operating Parameter

Parameter Description Option

Bit0 ISO14443 Type A


1 = Detect

0 = Skip

Bit1 ISO14443 Type B 1 = Detect

0 = Skip


0 = Skip


0 = Skip

Bit4 Topaz 1 = Detect

0 = Skip

Bit5 - 7 RFU RFU RFU



of 65

[email protected]

www.acs.com.hk

6.2.12. Set Auto PPS

Whenever a PICC is recognized, the reader will try to change the communication speed between the PCD and PICC defined by the Maximum Connection Speed. If the card does not support the proposed connection speed, the reader will try to connect the card with a slower speed setting.


Set Auto PPS Format (7 Bytes)


Set Auto PPS 0xE0 0x00 0x00 0x24 0x02 Max Tx Speed Max Rx Speed

Set Auto PPS Response Format (9 Bytes)


Result 0xE1 0x00 0x00 0x00 0x04 Max Tx Speed

Current Tx Speed

Max Rx Speed

Current Rx Speed

Max Tx Speed (1 Byte): Maximum Transmission Speed

Max Rx Speed (1 Byte): Maximum Receiving Speed

Current Tx Speed (1 Byte): Current Transmission Speed

Current Rx Speed (1 Byte): Current Receiving Speed

Value can be: 106k bps = 0x00 #default setting

212k bps = 0x01

424k bps = 0x02

848k bps = 0x03

No Auto PPS = 0xFF

Hints:

• Normally, the application should know the maximum connection speed of the PICCs being used. #The environment also affects the maximum achievable speed. The reader just uses the proposed communication speed to talk with the PICC. The PICC will become inaccessible if the PICC or environment does not meet the requirement of the proposed communication speed.

• The reader supports different speed between sending and receiving.



of 65

[email protected]

www.acs.com.hk

6.2.13. Read Auto PPS

The “Read Auto PPS “command is used to check current Auto PPS Setting

Read Auto PPS Format (5 Bytes)


Read Auto PPS

0xE0 0x00 0x00 0x24 0x00

Set Auto PPS Response Format (9 Bytes)


Result 0xE1 0x00 0x00 0x00 0x04 Max Tx Speed

Current Tx Speed

Max Rx Speed

Current Rx Speed

Max Tx Speed (1 Byte): Maximum Transmission Speed

Max Rx Speed (1 Byte): Maximum Receiving Speed

Current Tx Speed (1 Byte): Current Transmission Speed

Current Rx Speed (1 Byte): Current Receiving Speed

Value can be: 106k bps = 0x00 #default setting

212k bps = 0x01

424k bps = 0x02

848k bps = 0x03

No Auto PPS = 0xFF



of 65

[email protected]

www.acs.com.hk

6.2.14. Antenna Field Control

This command is used for turning on/off the antenna field.

Antenna Field Control Format (6 Bytes)


Antenna Field Control

0xE0 0x00 0x00 0x25 0x01 Status

Antenna Field Control Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Status

Status (1 Byte):

0x01 = Enable Antenna Field

0x00 = Disable Antenna Field

Hints:

Make sure the Auto PICC Polling is disabled first before turning off the antenna field.

6.2.15. Read Antenna Field Status

The “Read Antenna Field Status “ command is used to check current Antenna Field Status

Read Antenna Field Status Format (5 Bytes)


Read Antenna Field Status

0xE0 0x00 0x00 0x25 0x00

Read Antenna Field Status Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Status

Status (1 Byte):

0x00 = PICC Power Off

0x01 = PICC Idle [Ready to Poll Contactless Tag, but not detected]

0x02 = PICC Ready [PICC Request (Ref to ISO14443) Success, i.e. Contactless Tag Detected]

0x03 = PICC Selected [PICC Select (Ref to ISO14443) Success]

0x04 = PICC Activate [PICC Activation (Ref to ISO14443) Success, Ready for APDU Exchange]



of 65

[email protected]

www.acs.com.hk

6.2.16. Initial PN512 TypeA/TypeB Setting

This command is used for initial PN512 TypeA/TypeB Register Setting


Initial PN512 TypeA/TypeB Setting Format (24 Bytes)


Initial PN512 Setting

0xE0 0x00 0x00 0x2F 0x13 BModeIndex RxAThres106 RxAThres212 RxAThres424

Data In

RxAThres848 RxBThres106 RxBThres212 RxBThres424 RxBThres848 RxACtl106 RxACtl212

Data In

RxACtl424 RxACtl848 RxBCtl106 RxBCtl212 RxBCtl424 RxBCtl848

Data In

TypeACWGsP TypeBCWGsP

Initial PN512 TypeA/TypeB Setting Response Format (24 Bytes)

Response Class INS P1 P2 Lc Data In

Result 0xE1 0x00 0x00 0x00 0x13 BModeIndex RxAThres106 RxAThres212 RxAThres424

Data In


Data In


Data In


*For the detail description of each field, please check with PN512 Spec

Default Setting = {0E 85 85 85 85 85 85 85 85 69 69 69 69 69 69 69 69 3F 3F}



of 65

[email protected]

www.acs.com.hk

6.2.17. Read PN512 TypeA/TypeB Setting

This command is used for Read PN512 TypeA/TypeB Register Setting

Read PN512 TypeA/TypeB Setting Format (5 Bytes)


Read PN512 Setting

0xE0 0x00 0x00 0x2F 0x00

Read PN512 TypeA/TypeB Setting Response Format (24 Bytes)


Result 0xE1 0x00 0x00 0x00 0x13 BModeIndex RxAThres106 RxAThres212 RxAThres424

Data In


Data In


Data In





of 65

[email protected]

www.acs.com.hk

6.2.18. Initial PN512 FeliCa Setting

This command is used for initial PN512 FeliCa Register Setting


Initial PN512 FeliCa Setting Format (13 Bytes)


Initial PN512 Setting

0xE0 0x00 0x00 0x3F 0x08 ModGsPReg212 RxThresReg212 RFCfgReg212

Data In

CWGsPReg212 ModGsPReg424 RxThresReg424 RFCfgReg424 CWGsPReg424

Initial PN512 FeliCa Setting Response Format (13 Bytes)


Result 0xE1 0x00 0x00 0x00 0x08 ModGsPReg212 RxThresReg212 RFCfgReg212

Data In



Default Setting = {20 84 48 20 20 84 48 20}



of 65

[email protected]

www.acs.com.hk

6.2.19. Read PN512 FeliCa Setting

This command is used for Read PN512 FeliCa Register Setting

Read PN512 FeliCa Setting Format (5 Bytes)


Read PN512 Setting

0xE0 0x00 0x00 0x3F 0x00

Read PN512 FeliCa Setting Response Format (13 Bytes)


Result 0xE1 0x00 0x00 0x00 0x08 ModGsPReg212 RxThresReg212 RFCfgReg212

Data In



6.2.20. Update the PN512 Register

This command is used for Update PN512 Register.

Update the PN512 Register Format (7 Bytes)


Update the PN512

Register

0xE0 0x00 0x00 0x1A 0x02 Reg. No Value

Reg. No (1 Byte): PN512 Register No, please ref to PN512 Spec

Value (1 Byte): Setting Value

Update the PN512 Register Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Value



of 65

[email protected]

www.acs.com.hk

6.2.21. Read PN512 Register

This command is used for read PN512 Register.

Read PN512 Register Format (6 Bytes)

Command Class INS P1 P2 Lc Data in

Read PN512 Register

0xE0 0x00 0x00 0x19 0x01 Reg. No

Reg. No (1 Byte): PN512 Register No, please ref to PN512 Spec

Read PN512 Register Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Value

Value (1 Byte): Register Value

6.2.22. User Extra Guard Time Setting

This command is used to set the extra Guard time for SAM Communication


User Extra Guard Time Setting Format (6 Bytes)


User Extra Guard Time

Setting

0xE0 0x00 0x00 0x2E 0x01 UserGuardTime

User Extra Guard Time Setting Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 UserGuardTime

UserGuardTime (1 Byte): User Guard Time value



of 65

[email protected]

www.acs.com.hk

6.2.23. Read User Extra Guard Time

This command is used to read the set extra Guard time for SAM Communication

Read User Extra Guard Time Format (6 Bytes)


Read User Extra Guard

Time

0xE0 0x00 0x00 0x2E 0x00

Read User Extra Guard Time Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 UserGuardTime

UserGuardTime (1 Byte): User Guard Time value

6.2.24. “616C” Auto Handle Option Setting

* Optional for T=0 ACOS5

This command is used to set the “616C” auto Handle Option


“616C” Auto Handle Option Setting Format (6 Bytes)


“616C” Auto Handle Option Setting

0xE0 0x00 0x00 0x32 0x01 Option

“616C” Auto Handle Option Setting Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Option

Option (1 Byte): User Guard Time value

0xFF = Enable “616C” Auto Handle

0x00 = Disable “616C” Auto Handle (Default)



of 65

[email protected]

www.acs.com.hk

6.2.25. Read “616C” Auto Handle Option

This command is used to read the “616C” auto Handle Option

Read “616C” Auto Handle Option Format (6 Bytes)


Read “616C” Auto Handle

Option

0xE0 0x00 0x00 0x32 0x00

Read “616C” Auto Handle Option Response Format (6 Bytes)


Result 0xE1 0x00 0x00 0x00 0x01 Option

Option (1 Byte): User Guard Time value

0xFF = Enable “616C” Auto Handle

0x00 = Disable “616C” Auto Handle (Default)



of 65

[email protected]

www.acs.com.hk

6.3. ACR122U Compatible Command

6.3.1. Bi-Color LED and Buzzer Control

This APDU is used to control the states of the Bi-Color LED and Buzzer.

Bi-Color LED and Buzzer Control Command Format (9 Bytes)

Command Class INS P1 P2 Lc Data In (4 Bytes)

Bi-Color LED and Buzzer

Control

0xFF 0x00 0x40 LED State

Control

0x04 Blinking Duration Control

P2: LED State Control

Bi-Color LED and Buzzer Control Format (1 Byte)

CMD Item Description

Bit 0 Final Red LED State 1 = On; 0 = Off

Bit 1 Final Green LED State 1 = On; 0 = Off

Bit 2 Red LED State Mask 1 = Update the State

0 = No change

Bit 3 Green LED State Mask 1 = Update the State

0 = No change

Bit 4 Initial Red LED Blinking State 1 = On; 0 = Off

Bit 5 Initial Green LED Blinking State 1 = On; 0 = Off

Bit 6 Red LED Blinking Mask 1 = Blink

0 = Not Blink

Bit 7 Green LED Blinking Mask 1 = Blink

0 = Not Blink

Data In: Blinking Duration Control

Bi-Color LED Blinking Duration Control Format (4 Bytes)

Byte 0 Byte 1 Byte 2 Byte 3

T1 Duration

Initial Blinking State

(Unit = 100ms)

T2 Duration

Toggle Blinking State

(Unit = 100ms)

Number of repetition

Link to Buzzer



of 65

[email protected]

www.acs.com.hk

Byte 3: Link to Buzzer. Control the buzzer state during the LED Blinking.

0x00: The buzzer will not turn on

0x01: The buzzer will turn on during the T1 Duration

0x02: The buzzer will turn on during the T2 Duration

0x03: The buzzer will turn on during the T1 and T2 Duration.

Data Out: SW1 SW2. Status Code returned by the reader.

Status Code


Success 90 Current LED State The operation is completed successfully.


Current LED State (1 Byte)

Status Item Description

Bit 0 Current Red LED 1 = On; 0 = Off

Bit 1 Current Green LED 1 = On; 0 = Off

Bits 2 – 7 Reserved

Remark:

The LED State operation will be performed after the LED Blinking operation is completed.

The LED will not be changed if the corresponding LED Mask is not enabled.

The LED will not be blinking if the corresponding LED Blinking Mask is not enabled. Also, the number of repetition must be greater than zero.

T1 and T2 duration parameters are used for controlling the duty cycle of LED blinking and Buzzer Turn-On duration. For example, if T1=1 and T2=1, the duty cycle = 50%. #Duty Cycle = T1 / (T1 + T2).

To control the buzzer only, just set the P2 “LED State Control” to zero.

The make the buzzer operating, the “number of repetition” must greater than zero.

To control the LED only, just set the parameter “Link to Buzzer” to zero.



of 65

[email protected]

www.acs.com.hk

6.3.2. Get the Firmware Version of the reader

To retrieve the firmware version form the reader.

Get Firmware Version Command Format (5 Bytes)


Get Firmware 0xFF 0x00 0x48 0x00 0x00

Get Firmware Version Response Format (X bytes)

Response Data Out

Result Firmware Version

E.g. Response = 41 43 52 31 32 35 31 55 5F 56 32 30 34 2E 30 (Hex) = ACR1251U_V204.0 (ASCII)



of 65

[email protected]

www.acs.com.hk

6.3.3. Get the PICC Operating Parameter

To get the PICC Operating Parameter of the reader

Get the PICC Operating Parameter Command Format (5 Bytes)


Get PICC Operation Parameter

0xFF 0x00 0x50 0x00 0x00

Get the PICC Operating Parameter Response Format (2 byte)

Response Data Out

Result 0x90 PICC Operating Parameter

PICC Operating Parameter

Bit Parameter Description Option

7 Auto PICC Polling To enable the PICC Polling 1 = Enable

0 = Disable

6 Auto ATS Generation To issue ATS Request whenever an ISO14443-4 Type A tag is activated

1 = Enable

0 = Disable

5 Polling Interval To set the time interval between successive PICC Polling.

1 = 250 ms

0 = 500 ms

4 FeliCa 424K


1 = Detect

0 = Skip

3 FeliCa 212K 1 = Detect

0 = Skip

2 Topaz 1 = Detect

0 = Skip

1 ISO14443 Type B 1 = Detect

0 = Skip

0

ISO14443 Type A

#To detect the MIFARE Tags, the Auto ATS Generation must be disabled first.

1 = Detect

0 = Skip



of 65

[email protected]

www.acs.com.hk

6.3.4. Set the PICC Operating Parameter

To set the PICC Operating Parameter of the reader.

Set PICC operation Parameter Command Format (5 Bytes)


Set PICC operation Parameter

0xFF 0x00 0x51 PICC Operating Parameter

0x00

Set PICC operation Parameter Response Format (2 byte)

Response Data Out

Result 0x90 PICC Operating Parameter

PICC Operating Parameter

Bit Parameter Description Option

7 Auto PICC Polling To enable the PICC Polling 1 = Enable

0 = Disable

6 Auto ATS Generation To issue ATS Request whenever an ISO14443-4 Type A tag is activated

1 = Enable

0 = Disable

5 Polling Interval To set the time interval between successive PICC Polling.

1 = 250 ms

0 = 500 ms

4 FeliCa 424K


1 = Detect

0 = Skip

3 FeliCa 212K 1 = Detect

0 = Skip

2 Topaz 1 = Detect

0 = Skip

1 ISO14443 Type B 1 = Detect

0 = Skip

0

ISO14443 Type A

#To detect the MIFARE Tags, the Auto ATS Generation must be disabled first.

1 = Detect

0 = Skip



of 65

[email protected]

www.acs.com.hk

6.4. NFC Peer-to-Peer Related Command

6.4.1. SNEP Message

This command is to set the SNEP Message which will be sent after enter Initiator Mode

SNEP Message Command Format (X Bytes)


SNEP Message

0xE0 0x00 0x00 0x50 SNEP Len

SNEP Message (Max 100Bytes)

SNEP Message Response Format (X Bytes)


Result 0xE1 0x00 0x00 0x00 SNEP Len

SNEP Message

The data format please refer to specification “NFC Forum NFC Data Exchange Format (NDEF) 1.0”

Example:

SNEP Message = {D1 02 0f 53 70 D1 01 0B 55 01 61 63 73 2E 63 6F 6D 2E 68 6B} Offset Offset Offset Offset Content Content Content Content Length Length Length Length Explanation Explanation Explanation Explanation 0 D1 1 NDEF header. TNF = 0x01, SR=1, MB=1, ME=1

1 02 1 Record name length (2 bytes)

2 0F 1 Length of the Smart Poster data (15 bytes)

3 53 70 (“Sp”) 2 The record name

5 D1 1 NDEF header. TNF = 0x01, SR=1, MB=1, ME=1

6 01 1 Record name length (1 byte)

7 0B 1 The length of the URI payload (11 bytes)

8 55 (“U”) 1 Record type: “U”

9 01 1 Abbreviation: “http://www.”

10 61 63 73 2E 63 6F 6D 2E 68 6B

10 The URI itself. “acs.com.hk”



of 65

[email protected]

www.acs.com.hk

6.4.2. Set Initiator Mode Timeout

This command is to set the timeout for Initiator Mode. Once the reader enters Initiator, it will retry 5 times (each time with 250ms interval) in order to success exchange SNEP message.

Set Initiator Mode Timeout Command Format (7 Bytes)


Enter Initiator Mode

0xE0 0x00 0x00 0x41 0x02 Timeout (MSB)

Timeout (LSB)

Set Initiator Mode Timeout Response Format (7 Bytes)


Result 0xE1 0x00 0x00 0x00 0x02 Timeout (MSB)

Timeout (LSB)

Timeout (2 Byte): timeout for initiator Mode (10ms in units)



of 65

[email protected]

www.acs.com.hk

6.4.3. Enter Initiator Mode

This command is to set the reader into initiator mode, in order to send out SNEP Message

Enter Initiator Mode Command Format (8 Bytes)



0xE0 0x00 0x00 0x40 0x03 NfcMode OpMode Speed

Enter Initiator Mode Response Format (8 Bytes)


Result 0xE1 0x00 0x00 0x00 0x03 NfcMode OpMode Speed

NfcMode (1 Byte): Nfc Device Mode

0x06 = Peer-to-Peer Initiator Mode

other = Card Readr/Write Mode

OpMode (1 Byte): Active Mode/Passive Mode

0x01 = Active Mode

0x02 = Passive Mode

Speed (1 Byte): Communication Speed

0x01 = 106kbps

0x02 = 212kbps

0x03 = 424kbps

After Enter Initiator Mode, the reader will wait for NFC device, which in target mode, present and send out the pre-set SNEP Message to it. The reader will stop all other tasks until the SNEP Message Send successfully.



of 65

[email protected]

www.acs.com.hk

6.4.4. Enter Target Mode

This command is to set the reader into target mode, in order to receive SNEP Message

Enter Target Mode Command Format (11 Bytes)



0xE0 0x00 0x00 0x99 0x06 0x98 0x01 NfcMode 0x1A 0x01 Conductance

Enter Target Mode Response Format (11 Bytes)


Result 0xE1 0x00 0x00 0x00 0x06 0x98 0x01 NfcMode 0x1A 0x01 Conductance

NfcMode (1 Byte): Nfc Device Mode

0x04 = Peer-to-Peer Target Mode

0x00 = Card Readr/Write Mode

Conductance (1 Byte): antenna conductance setting

After Enter Target Mode, the reader will wait for NFC device, which in initiator mode, present and receive the SNEP Message to it.



of 65

[email protected]

www.acs.com.hk

6.4.5. Get Received Data

This command is to get the data receive from NFC initiator device

Enter Target Mode Command Format (5 Bytes)



0xE0 0x00 0x00 0x99 0xC0

Enter Target Mode Response Format (11 Bytes)


Result 0xE1 0x00 0x00 0x00 SNEP Message

Len

SNEP Message

SNEP Message Len (1 Byte): Length of the received SNEP Message

SNEP Message (N Bytes): received SNEP Message



of 65

[email protected]

www.acs.com.hk

Appendix A. Firmware Upgrade Procedure

Method 1: Upgrade by “FW” Key

Step 1: Unplug the Reader

Step 2: Open Casing

Step 3: Press the “FW, and Hold it

Step 4: Plug the Reader into PC’s USB Port

Step 5: Release the “FW” key

Step 6: Run Firmware Upgrade Application for Firmware Upgrade

Method 2: Upgrade by APDU command

Step 1: Plug the Reader into PC’s USB Port

Step 2: Run Firmware Upgrade Application for Firmware Upgrade

Step 3: Select the Reader Name and Connect, then Press “Load Patch” For firmware upgrade.

API Specification - SC Point · 2013-04-25 · Document Title Here Document Title Here ACR1251U-A1-...

Documents

Transcript of API Specification - SC Point · 2013-04-25 · Document Title Here Document Title Here ACR1251U-A1-...