The ACR33U-A1 SmartDuo PC-linked Smart Card Reader acts as an interface for the communication
between a computer and a smart card. Different types of smart cards have different commands and
different communication protocols, which, in most cases, prevent direct communication between a
smart card and a computer. The ACR33U-A1 SmartDuo Smart Card Reader establishes a uniform
interface from the computer to the smart card for a wide variety of cards. By taking care of the card’s
particulars, it releases the computer software programmer from being responsible with smart card
operations’ technical details, which in many cases, are not relevant to the implementation of a smart
card system.
1.1. Reference Documents
The following related documents are available from www.usb.org
•Universal Serial Bus Specification 2.0 (also referred to as the USB specification), April 27,
2000
• Universal Serial Bus Common Class Specification 1.0, December 16, 1997
• Universal Serial Bus Device Class: Smart Card CCID Specification for Integrated Circuit(s)
Cards Interface Devices, Revision 1.1, April 22, 2005
The following related documents can be ordered through www.ansi.org
•ISO/IEC 7816-1; Identification Cards – Integrated circuit(s) cards with contacts - Part 1:
Physical Characteristics
•ISO/IEC 7816-2; Identification Cards – Integrated circuit(s) cards with contacts - Part 2:
Dimensions and Locations of the contacts
•ISO/IEC 7816-3; Identification Cards – Integrated circuit(s) cards with contacts - Part 3:
Electronic signals and transmission protocols
1.2. Symbols and Abbreviations
Abbreviation Description
ATR Answer-to-reset
CCID Chip/Smart Card Interface Device
ICC Integrated Circuit Cards
IFSC Information Field Sized for ICC for protocol T=1
IFSD Information Field Sized for CCID for protocol T=1
NAD Node Address
PPS Protocol and Parameters Selection
RFU Reserved for future use*
TPDU Transport Protocol Data Unit
USB Universal Serial Bus
Table 1: Symbols and Abbreviations
*Note: Must be set to zero unless stated differently.
Page 4 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 5
2.0. Features
• USB Full Speed Interface
• Plug-and-Play – CCID support brings utmost compatibility
• Dual Slots for Full-Sized Smart Cards
• Three SAM (Secure Access Module) Card Slots
• Smart Card Reader:
o Supports ISO 7816 Class A (5 V) smart cards
o Supports microprocessor cards with T=0 and T=1 protocol
o Supports memory cards
o Supports PPS (Protocol and Parameters Selection)
o Features Short Circuit Protection
• User controllable peripherals:
o Tri-Color LED (Green, Red, Blue)
o Buzzer
• Application Programming Interface:
o Supports PC/SC
o Supports CT-API (through wrapper on top of PC/SC)
• Supports Android™ OS 3.1 and above
• Compliant with the following international standards:
o ISO 7816
o CE
o FCC
o VCCI
o PC/SC
o CCID
o Microsoft WHQL
o RoHS
Page 5 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 6
3.0. Smart Card Support
3.1. MCU Cards
The ACR33U-A1 is a PC/SC compliant smart card reader that supports ISO 7816 Class A (5 V) smart
card. It also works with MCU cards following either the T=0 and T=1 protocol.
The card ATR indicates the specific operation mode (TA2 present; bit b5 of TA2 must be 0) and when
that the particular mode is not supported by the ACR33U-A1; the reader will reset the card to a
negotiable mode. If the card cannot be set to negotiable mode, the reader will then reject the card.
When the card ATR indicates the negotiable mode (TA2 not present) and communication parameters
other than the default parameters, the ACR33U-A1 will execute the PPS and try to use the
communication parameters that the card suggested in its ATR. If the card does not accept the PPS,
the reader will use the default parameters (F=372, D=1).
For the meaning of the aforementioned parameters, please refer to ISO 7816-3.
3.2. Memory-based Smart Cards
The ACR33U-A1 works with several memory-based smart cards such as:
•Cards following the I2Cbus protocol (free memory cards) with maximum 128 bytes page with
capability, including:
o Atmel: AT24C01/02/04/08/16/32/64/128/256/512/1024
•Cards with secure memory IC with password and authentication, including:
o Atmel: AT88SC153 and AT88SC1608
•Cards with intelligent 1k bytes EEPROM with write-protect function, including:
o Infineon: SLE4418, SLE4428, SLE5518 and SLE5528
•Cards with intelligent 256 bytes EEPROM with write-protect function, including:
o Infineon: SLE4432, SLE4442, SLE5532 and SLE5542
•Cards with ‘104’ type EEPROM non-reloadable token counter cards, including:
o Infineon: SLE4406, SLE4436, SLE5536 and SLE6636
•Cards with Security Logic with Application Zone(s), including:
o Atmel: AT88SC101, AT88SC102 and AT88SC1003
Note: Memory card is supported in ICC Slot 0 only of ACR33U-A1 SmartDuo Smart Card Reader.
Page 6 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 7
4.0. Smart Card Interface
The interface between the ACR33U-A1 and the inserted smart card follows the specifications of ISO
7816-3 with certain restrictions or enhancements to increase the practical functionality of the
ACR33U-A1.
4.1. Smart Card Power Supply VCC (C1)
The current consumption of the inserted card must not be higher than 50 mA.
4.2. Programming Voltage VPP (C6)
According to ISO 7816-3, the smart card contact C6 (VPP) supplies the programming voltage to the
smart card. Since all common smart cards in the market are EEPROM-based and do not require the
provision of an external programming voltage, the contact C6 (VPP) has been implemented as a
normal control signal in the ACR33U-A1. The electrical specifications of this contact are identical to
those of the signal RST (at contact C2).
4.3. Card Type Selection
The controlling PC must always select the card type through the proper command sent to the
ACR33U-A1 prior to activating the inserted card. This includes both the memory cards and MCUbased cards.
For MCU-based cards the reader allows to select the preferred protocol, T=0 or T=1. However, this
selection is only accepted and carried out by the reader through the PPS when the card inserted in
the reader supports both protocol types. Whenever an MCU-based card supports only one protocol
type, T=0 or T=1, the reader automatically uses that protocol type, regardless of the protocol type
selected by the application.
4.4. Interface for Microcontroller-based Cards
For microcontroller-based smart cards only the contacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND)
and C7 (I/O) are used. A frequency of 4 MHz is applied to the CLK signal (C3).
4.5. Card Tearing Protection
The ACR33U-A1 provides a mechanism to protect the inserted card when it is suddenly withdrawn
while it is powered up. The power supply to the card and the signal lines between the ACR33U-A1
and the card is immediately deactivated when the card is removed. However, as a rule to avoid any
electrical damage, a card should only be removed from the reader while it is powered down.
Note: ACR33U-A1 does not switch on the power supply to the inserted card by itself. This can be
done by the controlling computer through the proper command sent to the reader.
Page 7 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 8
5.0. Power Supply
The ACR33U-A1 requires a voltage of 5 V DC, 100 mA, regulated, power supply. The ACR33U-A1
gets the power supply from the computer (through the cable supplied along with each type of reader).
5.1. Status LED
The LED indicates the activation status of the smart card interface:
•Flashing slowly (turns on 200 ms every 2 seconds)
Indicates ACR33U-A1 is powered up and in the standby state. Either the smart card has not
been inserted or the smart card has not been powered up (if it is inserted).
•Lighting up
Indicates power supply to the smart card is switched on, i.e., the smart card is activated.
•Flashing quickly
Indicates there are communications between ACR33U-A1 and smart card.
The different LED colors indicate the different states of the ACR33U-A1, where:
•Red LED
Power status
•Green LED
Main card slot status (ICC Slot 0)
•Blue LED
Slave card slot status (ICC Slot 1)
Page 8 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 9
6.0. USB Interface
6.1. Communication Parameters
The ACR33U-A1 is connected to a computer through USB as specified in the USB Specification 2.0.
The ACR33U-A1 is working in full speed mode, i.e. 12 Mbps.
Pin Signal Function
1 VBUS +5 V power supply for the reader
2 D- Differential signal transmits data between ACR33U-A1 and PC
3 D+ Differential signal transmits data between ACR33U-A1 and PC
4 GND Reference voltage level for power supply
Table 2: USB Interface Wiring
Note: In order for the ACR33U-A1 to function properly through USB interface, either ACS proprietary
device driver or ACS PC/SC device driver has to be installed.
6.2. Endpoints
The ACR33U-A1 uses the following endpoints to communicate with the host computer:
Control Endpoint
Bulk OUT
Bulk IN
Interrupt IN
For setup and control purpose
For command to be sent from host to ACR33U-A1
(data packet size is 64 bytes)
For response to be sent from ACR33U-A1 to host
(data packet size is 64 bytes)
For card status message to sent from ACR33U-A1 to host
(data packet size is 8 bytes)
Page 9 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 10
7.0. Communication Protocol
ACR33U-A1 shall interface with the host through the USB connection. A specification, namely CCID,
has been released within the industry defining such a protocol for the USB chip-card interface
devices. CCID covers all the protocols required for operating smart cards.
The configurations and usage of USB endpoints on ACR33U-A1 shall follow CCID Section 3.
An overview is summarized below:
1. Control Commands are sent on control pipe (default pipe). These include class-specific
requests and USB standard requests. Commands that are sent on the default pipe report
information back to the host on the default pipe.
2. CCID Events are sent on the interrupt pipe.
3. CCID Commands are sent on BULK-OUT endpoint. Each command sent to ACR33U-A1 has
an associated ending response. Some commands can also have intermediate responses.
4. CCID Responses are sent on BULK-IN endpoint. All commands sent to ACR33U-A1 have to
be sent synchronously (e.g., bMaxCCIDBusySlots is equal to 01h for ACR33U-A1).
The ACR33U-A1 supported CCID features are indicated in its Class Descriptor:
Offset Field Size Value Description
0
1
2
4
5
6
10
14
18
19
23
27
bLength
bDescriptorType
bcdCCID
bMaxSlotIndex
bVoltageSupport
dwProtocols
dwDefaultClock
dwMaximumClock
bNumClockSupported
dwDataRate
dwMaxDataRate
bNumDataRatesSupported
1 36h Size of this descriptor, in bytes
1 21h CCID Functional Descriptor type
2 0100h
1 05h
1 01h ACR33U-A1 can supply 5 V to its slot
4 00000003h
4 00000FA0h Default ICC clock frequency is 4 MHz
4 00000FA0h
1 00h
4 00002A00h Default ICC I/O data rate is 10752 bps
4 00054024h
1 00h
CCID Specification Release Number in
Binary-Coded decimal
2 big slots and 3 SAM slots are available
on ACR33U-A1
ACR33U-A1 supports T=0 and T=1
protocol
Maximum supported ICC clock
frequency is 4 MHz
Does not support manual setting of
clock frequency
Maximum supported ICC I/O data rate is
344100 bps
Does not support manual setting of data
rates
28
32
36
dwMaxIFSD
dwSynchProtocols
dwMechanical
4 00000FEh
4 00000000h
4 00000000h
Maximum IFSD supported by ACR33UA1 for protocol T=1 is 254
ACR33U-A1 does not support
synchronous card
ACR33U-A1 does not support special
mechanical characteristics
Page 10 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 11
Offset Field Size Value Description
ACR33U-A1 supports the following
features:
Automatic ICC clock frequency change
according to parameters
Automatic baud rate change according
40
dwFeatures
4 000204B0h
to frequency and FI,DI parameters
Automatic PPS made by the CCID
according to the active parameters
Automatic IFSD exchange as first
exchange (T=1 protocol in use)
Short APDU level exchange with CCID
44
48
49
50
52
53
dwMaxCCIDMessageLength
bClassGetResponse
bClassEnvelope
wLCDLayout
bPINSupport
bMaxCCIDBusySlots
4 0000010Fh
1 00h Insignificant for TPDU level exchanges
1 00h Insignificant for TPDU level exchanges
2 0000h No LCD
1 03h With PIN Verification and Modification
1 01h Only 1 slot can be simultaneously busy
Maximum message length accepted by
ACR33U-A1 is 271 bytes
Page 11 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 12
8.0. Commands
8.1. CCID Command Pipe Bulk-OUT Messages
ACR33U-A1 shall follow the CCID Bulk-OUT Messages as specified in CCID Section 4. In addition,
this specification defines some extended commands for operating additional features.
This section lists the CCID Bulk-OUT Messages to be supported by ACR33U-A1.
8.1.1. PC_to_RDR_IccPowerOn
Activates the card slot and return ATR from the card.
Offset Field Size Value Description
0
1
2
5
6
7
The response to this command message is the RDR_to_PC_DataBlock response message and the
data returned is the Answer-to-Reset (ATR) data.
bMessageType
dwLength
bSlot
bSeq
bPowerSelect
abRFU
1 62h -
4 00000000h Size of extra bytes of this message
1 00-05h
1 00-FFh Sequence number for command
1 01h
2 - Reserved for future use
Identifies the slot number for this
command
Voltage that is applied to the ICC:
01h – 5 volts
Page 12 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 13
8.1.2. PC_to_RDR_IccPowerOff
Deactivates the card slot.
Offset Field Size Value Description
0
1
5
6
7
The response to this message is the RDR_to_PC_SlotStatus message.
bMessageType
dwLength
bSlot
bSeq
abRFU
1 63h -
4 00000000h Size of extra bytes of this message
1 00-05h
1 00-FFh Sequence number for command
3 - Reserved for future use
Identifies the slot number for this
command
Page 13 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 14
8.1.3. PC_to_RDR_GetSlotStatus
Gets current status of the slot.
Offset Field Size Value Description
0
1
5
6
7
The response to this message is the RDR_to_PC_SlotStatus message.
bMessageType
dwLength
bSlot
bSeq
abRFU
1 65h -
4 00000000h Size of extra bytes of this message
1 00-05h
1 00-FFh Sequence number for command
3 - Reserved for future use
Identifies the slot number for this
command
Page 14 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 15
8.1.4. PC_to_RDR_XfrBlock
Transfers data block to the ICC.
Offset Field Size Value Description
0
1
5
6
7
8
10
The response to this message is the RDR_to_PC_DataBlock message.
bMessageType
dwLength
bSlot
bSeq
bBWI
wLevelParameter
abData
1 6Fh -
4 -
1 00-05h
1 00-FFh Sequence number for command
1 00-FFh
2 0000h RFU (TPDU exchange level)
Byte
array
Size of abData field of this message
Identifies the slot number for this
command
Used to extend the CCIDs Block
Waiting Timeout for this current
transfer. The CCID will timeout the
block after “this number multiplied by
the Block Waiting Time” has expired.
Data block sent to the CCID. Data is
-
sent “as is” to the ICC (TPDU
exchange level).
Page 15 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 16
8.1.5. PC_to_RDR_GetParameters
Gets slot parameters.
Offset Field Size Value Description
0
1
5
6
7
The response to this message is the RDR_to_PC_Parameters message.
bMessageType
DwLength
BSlot
BSeq
AbRFU
1 6CH -
4 00000000H Size of extra bytes of this message
1 00-05H
1 00-FFH Sequence number for command
3 - Reserved for future use
Identifies the slot number for this
command
Page 16 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 17
8.1.6. PC_to_RDR_SetParameters
Sets slot parameters.
Offset Field Size Value Description
0
1
5
6
7
8
10
The response to this message is the RDR_to_PC_Parameters message.
bMessageType
dwLength
bSlot
bSeq
bProtocolNum
abRFU
abProtocolDataStructure
1 61h -
4 - Size of extra bytes of this message
1 00-05h
1 00-FFh Sequence number for command
1
2 -
Byte
array
00h,
01h
Identifies the slot number for this
command
Specifies what protocol data structure
follows.
00h = Structure for protocol T=0
01h = Structure for protocol T=1
The following values are reserved for
future use:
80h = Structure for 2-wire protocol
81h = Structure for 3-wire protocol
82h = Structure for I2C protocol
Reserved for future use
- Protocol Data Structure
Protocol Data Structure for Protocol T=0 (dwLength=00000005h)
Offset Field Size Value Description
B7-4 – FI – Index into the Table 7 in
ISO/IEC 7816-3:1997 selecting a clock
10
11
12
13
bmFindexDindex
bmTCCKST0
bGuardTimeT0
bWaitingIntegerT0
1 -
1 -
1 00-FFh
1 00-FFh WI for T=0 used to define WWT
rate conversion factor
B3-0 – DI - Index into the Table 8 in
ISO/IEC 7816-3:1997 selecting a baud
rate conversion factor
B0 – 0b, B7-2 – 000000b
B1 – Convention used (b1=0 for direct,
b1=1 for inverse) Note: The CCID
ignores this bit.
Extra guard time between two
characters. Add 0 to 254etu to the
normal guard time of 12etu. FFh is the
same as 00h.
Page 17 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 18
Offset Field Size Value Description
ICC Clock Stop Support:
00h = Stopping the Clock is not allowed
14
The response to this message is the RDR_to_PC_Parameters message.
Protocol Data Structure for Protocol T=1 (dwLength=00000007h)
Offset Field Size Value Description
10
bClockStop
bmFindexDindex
1 00-03h
1 -
01h = Stop with Clock signal Low
02h = Stop with Clock signal High
03h = Stop with Clock either High or
Low
B7-4 – FI – Index into the Table 7 in
ISO/IEC 7816-3:1997 selecting a
clock rate conversion factor
B3-0 – DI - Index into the Table 8 in
ISO/IEC 7816-3:1997 selecting a
baud rate conversion factor
11
12
13
14
15
16
BmTCCKST1
BGuardTimeT1
BwaitingIntegerT1
bClockStop
bIFSC
bNadValue
B7-2 – 000100b
B0 – Checksum type (b0=0 for LRC,
1 -
1 00-FFh
1 00-9Fh
1 00-03h
1 00-FFh Size of negotiated IFSC
1 00h Only support NAD = 00h
b0=1 for CRC
B1 – Convention used (b1=0 for
direct, b1=1 for inverse) Note: The
CCID ignores this bit.
Extra guard time (0 to 254etu
between two characters). If value is
FFh, then guard time is reduced by
1etu.
ICC Clock Stop Support:
00h = Stopping the Clock is not
allowed
01h = Stop with Clock signal Low
02h = Stop with Clock signal High
03h = Stop with Clock either High or
Low
The response to this message is the RDR_to_PC_Parameters message.
Page 18 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 19
8.1.7. PC_to_RDR_Escape
Defines and access extended features.
Offset Field Size Value Description
0
1
5
6
7
10
bMessageType
dwLength
bSlot
bSeq
abRFU
abData
1 6Bh -
4 -
1 00-05h
1 00-FFh Sequence number for command
3 - Reserved for future use
Byte
array
- Data block sent to the CCID
8.1.7.1. LED
Offset Field Size Value Description
10
11
13
15
bcmdCode
wcmdLength
abRFU
abData
1 01h -
2 0001h -
2 - Reserved for future use
00000
1
XYZb
Size of abData field of this message
Identifies the slot number for this
command
00000xxx for 3 LED,
XYZ: 000 => 3 LEDs off
XYZ: 001 => LED1 on, green for 1 Sec
XYZ: 010 => LED2 on, red for 1 Sec
XYZ: 100 => LED3 on, blue for 1 Sec
The response to this command message is the RDR_to_PC_Escape response message.
8.1.7.2. BUZZER
Offset Field Size Value Description
10
11
13
15
The response to this command message is the RDR_to_PC_Escape response message.
bcmdCode
wcmdLength
abRFU
abData
1 08h -
2 0001h -
2 - Reserved for future use
XX for buzzer on or off,
1 XXh
YZ: 5A = buzzer on for 1 Sec
YZ: A5 = buzzer off
Page 19 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 20
8.1.7.3. Get Firmware Version
Offset Field Size Value Description
10
11
13
The response to this command message is the RDR_to_PC_Escape response message.
bcmdCode
wcmdLength
abRFU
1 04h -
2 0000h -
2 - Reserved for future use
Page 20 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 21
8.2. CCID Bulk-IN Messages
The Bulk-IN messages are used in response to the Bulk-OUT messages. ACR33U-A1 shall follow the
CCID Bulk-IN Messages as specified in CCID Section 4.
This section lists the CCID Bulk-IN Messages to be supported by ACR33U-A1.
Note: The values of bSlot and bSeq are the same as Bulk-OUT message.
8.2.1. RDR_to_PC_DataBlock
This message is sent by ACR33U-A1 in response to the command message:
PC_to_RDR_IccPowerOn and PC_to_RDR_XfrBlock.
Offset Field Size Value Description
0
1
5
6
7
8
9
10
bMessageType
dwLength
bSlot
bSeq
bStatus
bError
bChainParameter
abData
1 80h
4 - Size of extra bytes of this message
1 - Same value as in Bulk-OUT message
1 - Same value as in Bulk-OUT message
1 -
1 -
1 00h RFU (TPDU exchange level)
Byte
array
Indicates that a data block is being
sent from the CCID
Slot status register as defined in CCID
Section 4.2.1
Slot error register as defined in CCID
Section 4.2.1
This field contains the data returned
by the CCID
8.2.2. RDR_to_PC_SlotStatus
This message is sent by ACR33U-A1 in response to PC_to_RDR_IccPowerOff,
PC_to_RDR_GetSlotStatus.
Offset Field Size Value Description
0
bMessageType
1 81 -
1
5
6
7
8
9
dwLength
bSlot
bSeq
bStatus
bError
bClockStatus
4 00000000h Size of extra bytes of this message
1 -
1 -
1 -
1 -
1 -
Same value as in Bulk-OUT message
Same value as in Bulk-OUT message
Slot status register as defined in CCID
Section 4.2.1
Slot error register as defined in CCID
Section 4.2.1
Value:
00h = Clock running
01h = Clock stopped in state L
02h = Clock stopped in state H
03h = Clock stopped in an unknown state
All other values are RFU
Page 21 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 22
8.2.3. RDR_to_PC_Parameters
This message is sent by ACR33U-A1 in response to PC_to_RDR_GetParameters and
PC_to_RDR_SetParameters messages.
Offset Field Size Value Description
0
1
5
6
7
8
9
10
bMessageType
dwLength
bSlot
bSeq
bStatus
bError
bProtocolNum
abProtocolDataSt
ructure
1 82h -
4 - Size of extra bytes of this message
1 - Same value as in Bulk-OUT message
1 - Same value as in Bulk-OUT message
1 -
1 -
1 -
Byte
array
Slot status register as defined in CCID
Section 4.2.1
Slot error register as defined in CCID
Section 4.2.1
Specifies what protocol data structure
follows:
00h = Structure for protocol T=0
01h = Structure for protocol T=1
The following values are reserved for
future use.
80h = Structure for 2-wire protocol
81h = Structure for 3-wire protocol
82h = Structure for I2C protocol
Protocol Data Structure as summarized
in CCID Section 10.1.6
Protocol Data Structure for Protocol T=0 (bProtocolNum=0, dwLength=00000005h)
Offset Field Size Value Description
B7-4 – FI – Index into the Table 7 in
ISO/IEC 7816-3:1997 selecting a clock
10
11
12
13
bmFindexDindex
bmTCCKST0
bGuardTimeT0
bWaitingIntegerT0
1 -
1
1 00-FFh
1 00-FFh WI for T=0 used to define WWT
00h,
02h
rate conversion factor
B3-0 – DI - Index into the Table 8 in
ISO/IEC 7816-3:1997 selecting a baud
rate conversion factor
For T=0, B0 – 0b, B7-2 – 000000b
B1 – Convention used (b1=0 for direct,
b1=1 for inverse)
Extra guard time between two
characters. Add 0 to 254etu to the
normal guard time of 12etu. FFh is the
same as 00h.
Page 22 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 23
Offset Field Size Value Description
ICC Clock Stop Support:
00h = Stopping the Clock is not allowed
14
Protocol Data Structure for Protocol T=1 (bProtocolNum=1, dwLength=00000007h)
Offset Field Size Value Description
10
bClockStop
bmFindexDindex
1 00-03h
1
01h = Stop with Clock signal Low
02h = Stop with Clock signal High
03h = Stop with Clock either High or
Low
B7-4 – FI – Index into the Table 7 in
ISO/IEC 7816-3:1997 selecting a clock
rate conversion factor
B3-0 – DI - Index into the Table 8 in
ISO/IEC 7816-3:1997 selecting a baud
rate conversion factor
11
12
13
14
15
16
BmTCCKST1
BGuardTimeT1
BwaitingIntegerT1
bClockStop
bIFSC
bNadValue
10h,
1
1 00-FFh
1 00-9Fh
1 00-03h
1 00-FFh Size of negotiated IFSC
1 00h Only support NAD = 00h
11h,
12h,
13h
For T-1, B7-2 – 000100b
B0 – Checksum type (b0=0 for LRC,
b0=1 for CRC
B1 – Convention used (b1=0 for direct,
b1=1 for inverse)
Extra guard time (0 to 254etu between
two characters). If value is FFh, then
guard time is reduced by 1h.
B7-4 = BW I
B3-0 = CWI
ICC Clock Stop Support:
00h = Stopping the Clock is not allowed
01h = Stop with Clock signal Low
02h = Stop with Clock signal High
03h = Stop with Clock either High or
Low
Page 23 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 24
8.2.4. RDR_to_PC_Escape
This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape messages.
Offset Field Size Value Description
0
1
5
6
7
8
9
10
bMessageType
dwLength
bSlot
bSeq
bStatus
bError
bRFU
abData
1 83h -
4 -
1 - Same value as in Bulk-OUT message
1 - Same value as in Bulk-OUT message
1 -
1 -
1 00h RFU (TPDU exchange level)
Byte
array
Size of abData field of this message
Slot status register as defined in CCID
Section 4.2.1
Slot error register as defined in CCID
Section 4.2.1
This field contains the data returned
by the CCID
8.2.4.1. LED
This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape LED messages.
Offset Field Size Value Description
10
11
bcmdCode
wcmdLength
1 81 -
2 0000 -
XXh for SW2:
13
abStatus
2 00XX
00h: Success
01h: Bad parameter
8.2.4.2. BUZZER
This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape Buzzer messages.
Offset Field Size Value Description
10
11
13
bcmdCode
wcmdLength
abStatus
1 88h -
2 0000h -
XXh:
2 00XXh
00h: Success
01h: Bad parameter
8.2.4.3. Get Firmware Version
This message is sent by ACR33U-A1 in response to PC_to_RDR_Escape Get Firmware Version
messages.
Offset Field Size Value Description
Page 24 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 25
Offset Field Size Value Description
10
11
13
15
bcmdCode
wcmdLength
abStatus
abData
1 84h -
2 0004h -
XXh:
2 00XXh
0x41h
0x43h
0x52h
0x33h
0x33h
0x2Dh
13
0x41h
0x31h
0x20h
0xXXh
0xXXh
0xXXh
0xXXh
00h: Success
0h: Bad parameter
XX XX XX XX: Firmware Version
Page 25 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 26
8.3. Memory Card Access via PC_to_RDR_XfrBlock
Memory cards can be accessed via PC_to_RDR_XfrBlock command. All memory card functions are
mapped into pseudo-APDUs.
8.3.1. Memory Card – 1, 2, 4, 8, 16 kbit I2C Card
8.3.1.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card
reset.
Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 01h
Response data format (abData field in the RDR_to_PC_DataBlock
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
)
8.3.1.2. SELECT_PAGE_SIZE
This command will choose the page size to read the smart card. The default value is 8-byte page
write. It will reset to default value whenever the card is removed or the reader is powered down.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Page size
FFh 01h 00h 00h 01h
Where:
Page size = 03h for 8-byte page write
= 04h for 16-byte page write
= 05h for 32-byte page write
= 06h for 64-byte page write
= 07h for 128-byte page write
Page 26 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 27
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.1.3. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh B0h
Where:
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Byte Address
MEM_L
MSB LSB
8.3.1.4. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh D0h
Where:
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be written to the memory card
Byte x: Data to be written to the memory card
Byte Address
MEM_L Byte 1 …. .... Byte n
MSB LSB
Page 27 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 28
Response data format (abData field in the RDR_to_PC_DataBlock)
This command powers down and up the selected card inserted in the card reader and performs a card
reset.
Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 02h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.2.2. SELECT_PAGE_SIZE
This command will choose the page size to read the smart card. The default value is 8-byte page
write. It will reset to default value whenever the card is removed or the reader is powered off.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Page size
FFh 01h 00h 00h 01h
Where:
Data: TPDU to be sent to the card
Page size = 03h for 8-byte page write
= 04h for 16-byte page write
= 05h for 32-byte page write
= 06h for 64-byte page write
= 07h for 128-byte page write
Page 29 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 30
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.2.3. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh
Where:
INS = B0h for 32, 64,128, 256, 512 kbit iic card
= 1011 000*b for 1024 kbit iic card, where * is the MSB of the 17 bit addressing
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Byte Address
MEM_L
MSB LSB
8.3.2.4. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh
Where:
INS = D0h for 32, 64, 128, 256, 512 kbit iic card
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be written to the memory card
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
Byte Address
MEM_L Byte 1 …. .... Byte n
MSB LSB
= 1101 000*b for 1024 kbit iic card, where * is the MSB of the 17 bit addressing
Page 30 of 60
www.acs.com.hk
Page 31
Byte x: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
Page 31 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 32
8.3.3. Memory Card – ATMEL AT88SC153
8.3.3.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card
reset. It will also select the page size to be 8-byte page write.
Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of ScardConnect( ) API, please refer to PC/SC
specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 03h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.3.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh 00h
Where:
INS = B0h for reading zone 00b
= B1h for reading zone 01b
= B2h for reading zone 10b
= B3h for reading zone 11b
= B4h for reading fuse
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Page 32 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 33
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
8.3.3.3. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Bye Address MEM_L Byte 1 .... .... Byte n
FFh 00h
Where:
INS = D0h for writing zone 00b
= D1h for writing zone 01b
= D2h for writing zone 10b
= D3h for writing zone 11b
= D4h for writing fuse
Byte Address: Memory address location of the memory card
MEM_L: Length of data to be written to the memory card
MEM_D: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.3.4. VERIFY_PASSWORD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Pw(0) Pw(1) Pw(2)
FFh 20h 00h 03h
Where:
Pw(0),Pw(1),Pw(2): Passwords to be sent to memory card
Page 33 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 34
P2 = 000000rpb
where the two bits “rp” indicate the password to compare
r = 0: Write password,
r = 1: Read password,
p = Password set number,
rp = 01 for the secure code
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1
90h
Where:
SW1 = 90h
SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates the
SW2
ErrorCnt
password is locked (exceeded the maximum number of retries). Other
values indicate the current verification has failed.
8.3.3.5. INITIALIZE_AUTHENTICATION
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Q(0) Q(1) … Q(7)
FFh 84h 00h 00h 08h
Where:
Q(0),Q(1)…Q(7): Host random number, 8 bytes
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.3.6. VERIFY_AUTHENTICATION
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Ch(0) Ch(1) … Ch(7)
FFh 82h 00h 00h 08h
Page 34 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 35
Where:
Ch(0),Ch(1)…Ch(7): Host challenge, 8 bytes
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
Page 35 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 36
8.3.4. Memory Card – ATMEL AT88SC1608
8.3.4.1. SELECT_CARD_TYPE
This command powers down and up the selected card inserted in the card reader and performs a card
reset. It will also select the page size to be 16-byte page write.
Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 04h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.4.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS Zone Address Byte Address MEM_L
FFh
Where:
INS = B0h for reading user zone
= B1h for reading configuration zone or reading fuse
Zone Address = 0000 0A
= don’t care for reading fuse
Byte Address = A
MEM_L: Length of data to be read from the memory card
7A6A5A4 A3A2A1A0
= 1000 0000b for reading fuse
b, where A10 is the MSB of zone address
10A9A8
b is the memory address location of the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Page 36 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 37
Where:
BYTE x : Data read from memory card
SW1, SW2 = 90 00h if no error
8.3.4.3. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS Zone Address Byte Address MEM_L Byte 1 .... .... Byte n
FFh
Where:
INS = D0h for writing user zone
= D1h for writing configuration zone or writing fuse
Zone Address = 0000 0A
b, where A10 is the MSB of zone address
10A9A8
= don’t care for writing fuse
Byte Address = A
= 1000 0000
7A6A5A4 A3A2A1A0
for writing fuse
b
b is the memory address location of the memory card
MEM_L: Length of data to be written to the memory card
Byte x: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.4.4. VERIFY_PASSWORD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Data
FFh 20h 00h 00h 04h RP Pw(0) Pw(1) Pw(2)
Where:
Pw(0),Pw(1),Pw(2): Passwords to be sent to memory card
RP = 0000 rp
where the four bits “rp
2p1p0
b
” indicate the password to compare:
2p1p0
r = 0: Write password,
r = 1: Read password,
Page 37 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 38
p2p1p0: Password set number
(rp
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1
90h
Where:
SW1 = 90h
SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates the
SW2
ErrorCnt
password is locked (exceeded the maximum number of retries). Other
values indicate the current verification has failed.
= 0111 for the secure code)
2p1p0
8.3.4.5. INITIALIZE_AUTHENTICATION
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Q(0) Q(1) … Q(7)
FFh 84h 00h 00h 08h
Where:
Byte Address: Memory address location of the memory card
Q(0),Q(1)…Q(7): Host random number, 8 bytes
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.4.6. VERIFY_AUTHENTICATION
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Q1(0) Q1(1) … Q1(7)
FFh 82h 00h 00h 08h
Where:
Byte Address: Memory address location of the memory card
Q1(0),Q1(1)…Q1(7): Host challenge, 8 bytes
Page 38 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 39
Response data format (abData field in the RDR_to_PC_DataBlock)
This command powers down and up the selected card inserted in the card reader and performs a card
reset.
Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 05h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Pseudo-APDU
Where:
SW1, SW2 = 90 00h
if no error
8.3.5.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh B0h
Where:
MSB Byte Address = 0000 00A
LSB Byte Address = A
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
Byte Address
MSB LSB
card
MEM_L
b is the memory address location of the memory card
9A8
7A6A5A4 A3A2A1A0
b is the memory address location of the memory
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x : Data read from memory card
SW1, SW2 = 90 00h if no error
Page 40 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 41
8.3.5.3. READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only
SLE4428 and SLE5528)
To read the presentation error counter for the secret code.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh B1h 00h 00h 03h
Response data format (abData field in the RDR_to_PC_DataBlock)
ERRCNT DUMMY 1 DUMMY 2 SW1 SW2
Where:
ERRCNT: The value of the presentation error counter. FFh indicates the last verification is
correct. 00h indicates the password is locked (exceeded the maximum number of
retries). Other values indicate the last verification has failed.
DUMMY: Two bytes dummy data read from the card.
SW1, SW2 = 90 00h if no error
8.3.5.4. READ_PROTECTION_BIT
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
FFh B2h
Where:
MSB Byte Address = 0000 00A
LSB Byte Address = A
MEM_L: Length of protection bits to be read from the card, in multiples of 8
For example, to read eight protection bits starting from memory 0x0010h, the following pseudoAPDU should be issued:
Byte Address
MSB LSB
card.
bits. Maximum value is 32
MEM_L = 1 + INT( (number of bits-1)/8 )
MEM_L
b is the memory address location of the memory card.
9A8
7A6A5A4 A3A2A1A0
b is the memory address location of the memory
0xFFh 0xB1h 0x00h 0x10h 0x01h
Response data format (abData field in the RDR_to_PC_DataBlock)
PROT 1 … … PROT L SW1 SW2
Page 41 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 42
Where:
PROT y: Bytes containing the protection bits
SW1,SW2 = 90 00h if no error
The arrangement of the protection bits in the PROT bytes is as follows:
Px is the protection bit of BYTE x in the response data
‘0’ byte is write protected
‘1’ byte can be written
8.3.5.5. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
MEM_L Byte 1 .... .... Byte N
MSB LSB
FFh D0h
Where:
Byte Address
MSB Byte Address = 0000 00A
LSB Byte Address = A
7A6A5A4
b is the memory address location of the memory card
9A8
A3A2A1A0b is the memory address location of the memory
card
MEM_L: Length of data to be written to the memory card
Byte x: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.5.6. WRITE_PROTECTION_MEMORY_CARD
Each of the bytes specified in the command is internally in the card compared with the byte stored at
the specified address and if the data match, the corresponding protection bit is irreversibly
programmed to ‘0’.
Page 42 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 43
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS
MEM_L Byte 1 .... .... Byte N
MSB LSB
FFh D1h
Where:
Byte Address
MSB Byte Address = 0000 00A
LSB Byte Address = A
7A6A5A4 A3A2A1A0
b is the memory address location of the memory card
9A8
b is the memory address location of the memory
card
MEM_L: Length of data to be written to the memory card
Byte x: Byte values to be compared with the data in the card starting at Byte Address.
BYTE 1 is compared with the data at Byte Address; BYTE N is compared with the
data at (Byte Address+N-1).
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.5.7. PRESENT_CODE_MEMORY_CARD (only SLE 4428 and SLE5528)
To submit the secret code to the memory card to enable the write operation with the SLE4428 and
SLE5528 card, the following actions are executed:
• Search a ‘1’ bit in the presentation error counter and write the bit to ‘0’
• Present the specified code to the card
• Try to erase the presentation error counter
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh 20h 00h 00h 02h
Where:
CODE: Two bytes secret code (PIN)
CODE
Byte 1 Byte 2
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1
SW2
ErrorCnt
90h
Page 43 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 44
Where:
SW1 = 90h
SW2 (ErrorCnt) = Error Counter. FFh indicates the verification is correct. 00h indicates
the password is locked (exceeded the maximum number of retries).
Other values indicate the current verification has failed.
This command powers down and up the selected card inserted in the card reader and performs a card
reset.
Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 06h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.6.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh B0h 00h
Where:
Byte Address = A
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
7A6A5A4 A3A2A1A0
b is the memory address location of the memory card
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Page 45 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 46
8.3.6.3. READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (only
SLE4442 and SLE5542)
To read the presentation error counter for the secret code.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh B1h 00h 00h 04h
Response data format (abData field in the RDR_to_PC_DataBlock)
ERRCNT DUMMY 1 DUMMY 2 DUMMY 3 SW1 SW2
Where:
ERRCNT: The value of the presentation error counter. 07h indicates the last verification is
correct. 00h indicates the password is locked (exceeded the maximum number of
retries). Other values indicate the last verification has failed.
DUMMY: Three bytes dummy data read from the card.
SW1, SW2 = 90 00h if no error
8.3.6.4. READ_PROTECTION_BITS
To read the protection bits for the first 32 bytes.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh B2h 00h 00h 04h
Response data format (abData field in the RDR_to_PC_DataBlock)
PROT 1 PROT 2 PROT3 PROT 4 SW1 SW2
Where:
PROT y: Bytes containing the protection bits from protection memory
SW1, SW2 = 90 00h if no error
The arrangement of the protection bits in the PROT bytes is as follows:
Px is the protection bit of BYTE x in the response data
‘0’ byte is write protected
‘1’ byte can be written
8.3.6.5. WRITE_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N
FFh D0h 00h
Where:
Byte Address = A
7A6A5A4 A3A2A1A0
b is the memory address location of the memory card
MEM_L: Length of data to be written to the memory card
Byte x: Data to be written to the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.6.6. WRITE_PROTECTION_MEMORY_CARD
Each of the bytes specified in the command is internally in the card compared with the byte stored at
the specified address and if the data match, the corresponding protection bit is irreversibly
programmed to ‘0’.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N
FFh D1h 00h
Where:
Byte Address = 000A
A3A2A1A0b (00 to 1F) is the protection memory address location of
4
the memory card
MEM_L: Length of data to be written to the memory card
Byte x: Byte values to be compared with the data in the card starting at Byte
Address. BYTE 1 is compared with the data at Byte Address; BYTE N is
compared with the data at (Byte Address+N-1).
Page 47 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 48
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.6.7. PRESENT_CODE_MEMORY_CARD (only SLE 4442 and SLE5542)
To submit the secret code to the memory card to enable the write operation with the SLE4442 and
SLE5542 card, the following actions are executed:
• Search a ‘1’ bit in the presentation error counter and write the bit to ‘0’
• Present the specified code to the card
• Try to erase the presentation error counter
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh 20h 00h 00h 03h
Where:
CODE:Three bytes secret code (PIN)
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1
90h
Where:
SW1 = 90h
SW2 (ErrorCnt) = Error Counter. 07h indicates the verification is correct. 00h indicates the
SW2
ErrorCnt
password is locked (exceeded the maximum number of retries). Other
values indicate the current verification has failed.
Byte 1 Byte 2 Byte 3
CODE
8.3.6.8. CHANGE_CODE_MEMORY_CARD (only SLE 4442 and SLE5542)
To write the specified data as new secret code in the card.
The current secret code must be presented to the card with the PRESENT_CODE command prior to
the execution of this command.
Page 48 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 49
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
Byte 1 Byte 2 Byte 3
FFh D2h 00h 01h 03h
Response data format (abData field in the RDR_to_PC_DataBlock)
This command powers down and up the selected card inserted in the card reader and performs a card
reset.
Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 07h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.7.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh B0h 00h
Where:
Byte Address = Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Page 50 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 51
8.3.7.3. WRITE_ONE_BYTE_MEMORY_CARD
To write one byte to the specified address of the inserted card. The byte is written to the card with
LSB first, i.e., the bit at card address 0 is regarded as the LSB of byte 0.
Four different WRITE modes are available for this card type, which are distinguished by a flag in the
command data field:
1. Write
The byte value specified in the command is written to the specified address. This command can
be used for writing personalization data and counter values to the card.
2. Write with carry
The byte value specified in the command is written to the specified address and the command is
sent to the card to erase the next lower counter stage. This write mode can therefore only be
used for updating the counter value in the card.
3. Write with backup enabled (SLE4436, SLE5536 and SLE6636 only)
The byte value specified in the command is written to the specified address. This command can
be used for writing personalization data and counter values to the card. Backup bit is enabled to
prevent data loss when card tearing occurs.
4. Write with carry and backup enabled (SLE4436, SLE5536 and SLE6636 only)
The byte value specified in the command is written to the specified address and the command is
sent to the card to erase the next lower counter stage. This write mode can therefore only be
used for updating the counter value in the card. Backup bit is enabled to prevent data loss when
card tearing occurs.
With all write modes, the byte at the specified card address is not erased prior to the write operation
and hence, memory bits can only be programmed from '1' to '0'.
The backup mode available in the SLE4436 and SLE5536 card can be enabled or disabled in the
write operation.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L MODE BYTE
FFh D0h 00h 02h
Where:
Byte Address = Memory address location of the memory card
MODE: Specifies the write mode and backup option
00h: write
01h: write with carry
02h: write with backup enabled (SLE4436, SLE5536 and SLE6636 only)
03h: write with carry and with backup enabled (SLE4436, SLE5536 and
SLE6636 only)
BYTE:Byte value to be written to the card
Page 51 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 52
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.7.4. PRESENT_CODE_MEMORY_CARD
To submit the secret code to the memory card to enable the card personalization mode, the following
actions are executed:
1. Search a '1' bit in the presentation counter and write the bit to '0'.
2. Present the specified code to the card.
The ACR33U-A1 does not try to erase the presentation counter after the code submission. This must
be done by the application software through a separate 'Write with carry' command.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
ADDR Byte 1 Byte 2 Byte 3
FFh 20h 00h 00h 04h 09h
Where:
ADDR: Byte address of the presentation counter in the card
CODE: Three bytes secret code (PIN)
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
CODE
8.3.7.5. AUTHENTICATE_MEMORY_CARD (SLE4436, SLE5536 and SLE6636
only)
To read a card authentication certificate from a SLE5536 or SLE6636 card, the following actions are
executed by the ACR33U-A1:
1. Select Key 1 or Key 2 in the card as specified in the command.
2. Present the challenge data specified in the command to the card.
3. Generate the specified number of CLK pulses for each bit of authentication data computed by
the card.
4. Read 16 bits of authentication data from the card.
5. Reset the card to normal operation mode.
Page 52 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 53
The authentication has to be performed in two steps. The first step is to send the Authentication
Certificate to the card. The second step is to get back two bytes of authentication data calculated by
the card.
Step 1: Send Authentication Certificate to the Card.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2
FFh 84h 00h 00h 08h
Where:
KEY: Key to be used for the computation of the authentication certificate:
CLK_CNT: Number of CLK pulses to be supplied to the card for the computation of each
BYTE 1...6: Card challenge data
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
61h 02h
Where:
MEM_L CODE
KEY CLK_CNT Byte1 Byte 2 …… Byte 5 Byte 6
00h: key 1 with no cipher block chaining
01h: key 2 with no cipher block chaining
80h: key 1 with cipher block chaining (SLE5536 and SLE6636 only)
81h: key 2 with cipher block chaining (SLE5536 and SLE6636 only)
bit of the authentication certificate. Typical value is 160 clocks (A0h)
SW1, SW2 = 61 02h if no error, meaning two bytes of authentication data are ready. The
authentication data can be retrieved by “Get_Response” command.
Step 2: Get back the Authentication Data (Get_Response).
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 MEM_L
FFh C0h 00h 00h 02h
Response data format (abData field in the RDR_to_PC_DataBlock)
CERT SW1 SW2
Where:
CERT: 16 bits of authentication data computed by the card. The LSB of BYTE 1 is the
This command powers down and up the selected card inserted in the card reader and performs a card
reset.
Note: This command can only be used after the logical smart card reader communication has been
established using the SCardConnect( ) API. For details of SCardConnect( ) API, please refer to
PC/SC specifications.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 P2 Lc Card Type
FFh A4h 00h 00h 01h 09h
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.8.2. READ_MEMORY_CARD
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh B0h 00h
Where:
Byte Address = Memory address location of the memory card
MEM_L: Length of data to be read from the memory card
Response data format (abData field in the RDR_to_PC_DataBlock)
BYTE 1 … … BYTE N SW1 SW2
Where:
BYTE x: Data read from memory card
SW1, SW2 = 90 00h if no error
Page 54 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 55
8.3.8.3. WRITE_MEMORY_CARD
To write data to the specified address of the inserted card. The byte is written to the card with LSB
first, e.g., the bit at card address 0 is regarded as the LSB of byte 0.
The byte at the specified card address is not erased prior to the write operation and hence, memory
bits can only be programmed from '1' to '0'.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L Byte 1 .... .... Byte N
FFh D0h 00h
Where:
Byte Address = Memory address location of the memory card
MEM_L: Length of data to be written to the memory card
BYTE: Byte value to be written to the card
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.8.4. ERASE_NON_APPLICATION_ZONE
To erase the data in Non-Application Zones. The EEPROM memory is organized into 16 bit words.
Although erases are performed on single bits the ERASE operation clears an entire word in the
memory. Therefore, performing an ERASE on any bit in the word will clear ALL 16 bits of that word to
the state of ‘1’.
To erase Error Counter or the data in Application Zones, please refer to:
• ERASE_APPLICATION_ZONE_WITH_ERASE command as specified in Section 8.3.8.5
• ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE command as specified in
Section 8.3.8.6
•VERIFY_SECURITY_CODE
commands as specified in Section 8.3.8.7
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS P1 Byte Address MEM_L
FFh D2h 00h 00h
Where:
Byte Address = Memory byte address location of the word to be erased
Page 55 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 56
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
8.3.8.5. ERASE_APPLICATION_ZONE_WITH_ERASE
This command can be used in the following cases:
• AT88SC101: To erase the data in Application Zone with EC Function Disabled
• AT88SC102: To erase the data in Application Zone 1
• AT88SC102: To erase the data in Application Zone 2 with EC2 Function Disabled
• AT88SC1003: To erase the data in Application Zone 1
• AT88SC1003: To erase the data in Application Zone 2 with EC2 Function Disabled
• AT88SC1003: To erase the data in Application Zone 3
The following actions are executed for this command:
• Present the specified code to the card
• Erase the presentation error counter. The data in corresponding Application Zone can be
erased when the submitted code is correct.
Command format (abData field in the PC_to_RDR_XfrBlock
Pseudo-APDU
CLA INS
FFh 20h 00h
Where:
Error Counter LEN: Length of presentation error counter in bits. The value should be
Byte Address: Byte address of the Application Zone Key in the card. Please refer to
AT88SC101: Erase Application Zone with EC function disabled 96h 04h
Error Counter
LEN
0x00h always.
the table below for the correct value.
Byte
Address
Byte Address LEN
MEM_L
)
Byte 1 Byte
2
CODE
……. ……
Byte
N
AT88SC102: Erase Application Zone 1 56h 06h
AT88SC102: Erase Application Zone 2 with EC2 function disabled 9Ch 04h
AT88SC1003: Erase Application Zone 1 36h 06h
AT88SC1003: Erase Application Zone 2 with EC2 function disabled 5Ch 04h
AT88SC1003: Erase Application Zone 3 C0h 06h
Where:
MEM_L:Length of the Erase Key. Please refer to the table below for the
Page 56 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 57
correct value
CODE: N bytes of Erase Key
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
Note: After SW1SW2 = 0x9000h has been received, read back the data in Application Zone can
check whether the ERASE_APPLICATION_ZONE_WITH_ERASE is correct. If all data in
Application Zone is erased and equals to “0xFFh”, the previous verification is success.
• AT88SC101: To erase the data in Application Zone with EC Function Enabled
• AT88SC102: To erase the data in Application Zone 2 with EC2 Function Enabled
• AT88SC1003: To erase the data in Application Zone 2 with EC2 Function Enabled
With EC or EC2 Function Enabled (that is, ECEN or EC2EN Fuse is undamaged and in “1” state), the
following actions are executed:
• Present the specified code to the card
• Search a '1' bit in the presentation error counter and write the bit to '0'
• Erase the presentation error counter. The data in corresponding Application Zone can be
erased when the submitted code is correct.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CODE
CLA INS Error Counter LEN Byte Address MEM_L
FFh 20h 80h 04h
Where:
Error Counter LEN: Length of presentation error counter in bits. The value should be
0x80h always.
Byte Address: Byte address of the Application Zone Key in the card.
Byte 1 Byte 2 Byte 3 Byte 4
Byte Address
AT88SC101 96h
AT88SC102 9Ch
AT88SC1003 5Ch
CODE:4 bytes Erase Key
Page 57 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 58
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
= 63 00h if there is no more retry chance
Note: After SW1SW2 = 0x9000h has been received, read back the data in Application Zone can
check whether the ERASE_APPLICATION_ZONE_WITH_ERASE is correct. If all data in
Application Zone is erased and equals to “0xFFh,” the previous verification is success.
8.3.8.7. VERIFY_SECURITY_CODE
To submit Security Code (2 bytes) to the inserted card. Security Code is to enable the memory access
of the card.
The following actions are executed:
• Present the specified code to the card
• Search a '1' bit in the presentation error counter and write the bit to '0'
• Erase the presentation error counter. The Security Code Attempts Counter can be erased
when the submitted code is correct.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
CLA INS Error Counter LEN Byte Address MEM_L
FFh 20h 08h 0Ah 02h
Where:
Error Counter LEN: Length of presentation error counter in bits
Byte Address: Byte address of the key in the card
CODE: 2 bytes Security Code
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
CODE
Byte 1 Byte 2
Where”
SW1, SW2 = 90 00h if no error
= 63 00h if there is no more retry chance
Note: After SW1SW2 = 0x9000h has been received, read back the Security Code Attempts
Counter (SCAC) can check whether the VERIFY_USER_CODE is correct. If SCAC is erased and
equals to “0xFFh,” the previous verification is success.
Page 58 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 59
8.3.8.8. BLOWN_FUSE
To blow the fuse of the inserted card. The fuse can be EC_EN Fuse, EC2EN Fuse, Issuer Fuse or
Manufacturer’s Fuse.
Note: Blowing of the Fuse is an irreversible process.
Command format (abData field in the PC_to_RDR_XfrBlock)
Pseudo-APDU
Addr
(Low)
CODE
State of
FUS
Pin
State of RST
Pin
Error
CLA INS
FFh 05h 00h 00h 04h 01h 00h or 01h
Where:
Fuse Bit Addr (2 bytes): Bit address of the fuse. Please refer to the table below for the
State of FUS Pin: State of the FUS pin. Should always be 0x01h.
State of RST Pin: State of the RST pin. Please refer to below table for the correct
AT88SC101
AT88SC102
Counter
LEN
Byte
Address
Manufacturer
Fuse
EC_EN Fuse 05h C9h 01h
Issuer Fuse 05h E0h 01h
Manufacturer
Fuse
EC2EN Fuse 05h F9h 01h
MEM_L
correct value.
value.
Fuse Bit Addr
Fuse Bit
Addr
(High)
(High)
05h 80h 01h
05h B0h 01h
Fuse Bit
Fuse Bit Addr
(Low)
State of
RST Pin
Issuer Fuse 06h 10h 01h
Manufacturer
Fuse
AT88SC1003
Response data format (abData field in the RDR_to_PC_DataBlock)
SW1 SW2
Where:
SW1, SW2 = 90 00h if no error
EC2EN Fuse 03h FCh 00h
Issuer Fuse 03h E0h 00h
03h F8h 00h
Page 59 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Page 60
Appendix A. CCID Response Error Codes
The following table summarizes the possible error code returned by the ACR33U-A1:
Error Code Status
FFh SLOTERROR_CMD_ABORTED
FEh SLOTERROR_ICC_MUTE
FDh SLOTERROR_XFR_PARITY_ERROR
FCh SLOTERROR_XFR_OVERRUN
FBh SLOTERROR_HW_ERROR
F8h SLOTERROR_BAD_ATR_TS
F7h SLOTERROR_BAD_ATR_TCK
F6h SLOTERROR_ICC_PROTOCOL_NOT_SUPPORTED
F5h SLOTERROR_ICC_CLASS_NOT_SUPPORTED
F4h SLOTERROR_PROCEDURE_BYTE_CONFLICE
F3h SLOTERROR_DEACTIVATED_PROTOCOL
F2h SLOTERROR_BUSY_WITH_AUTO_SEQUENCE
E0h SLOTERROR_CMD_SLOT_BUSY
Table 3: CCID Response Error Codes
Page 60 of 60
ACR33U-A1 – Reference Manual info@acs.com.hk
Version 1.02
www.acs.com.hk
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.